Primzahltests und das Faktorisierungsproblem

Transcription

1 Primzahltests und das Faktorisierungsproblem Ausgewählte Folien zur Vorlesung Wintersemester 2007/2008 Dozent: Prof. Dr. J. Rothe Heinrich-Heine-Universität Düsseldorf rothe/primes 1

2 Literatur Jörg Rothe:,,Complexity Theory and Cryptology. An Introduction to Cryptocomplexity, Springer-Verlag, 2005 Martin Dietzfelbinger:,,Primality Testing in Polynomial Time, Springer-Verlag, 2004 Douglas R. Stinson:,,Cryptography: Theory and Practice, Chapman & Hall/CRC, 2. Auflage, 2002 Johannes Buchmann:,,Einführung in die Kryptographie, Springer-Verlag, 2. Auflage,

3 Erweiterter Algorithmus von Euklid berechnet die Vielfachsummendarstellung zweier Zahlen m und n: ggt(m, n) = xm + yn, aus der man insbesondere Inverse in Z 26 bestimmen kann; ist in vielen Anwendungen sehr nützlich, zum Beispiel beim RSA-Verschlüsselungsverfahren. Der,,Merge -Schritt besteht nun in der Berechnung der Werte x und y aus den rekursiv berechneten Werten x und y. EXTENDED-EUCLID(n, m) { } if (m = 0)return (n, 1, 0); else { (g, x, y ) := EXTENDED-EUCLID(m, n mod m); x := y ; y := x y n m ; return (g, x, y); } Abbildung 1: Extended Euclidean Algorithm 3

4 Der Chinesische Restesatz (CRS) Satz 1 (Chinese Remainder Theorem) Let m 1,m 2,...,m k be k positive integers that are pairwise relatively prime (i.e.,gcd(m i, m j ) = 1 for i j), let M = k m i, i=1 and let a 1,a 2,...,a k be any integers. For each i with 1 i k, define q i = M/m i, and let qi 1 denote the inverse element of q i in Z m i. Then, the system of k congruences x a i mod m i, where 1 i k, has the unique solution k x = a i q i qi 1 mod M. i=1 4

5 RSA Protocol Rivest, Shamir, and Adleman; 1978 c = m e mod n (n,e) c chooses primes p and q at random; computes n = pq, ϕ(n) = (p 1)(q 1); public key: (n,e), private key: d, satisfying (1) and (2) m = c d = (m e ) d mod n 5

6 RSA: Key Generation 1. Bob chooses randomly two large primes p and q with p q, and computes n = pq. 2. Bob chooses a number e N with 1 < e < ϕ(n) = (p 1)(q 1) and gcd(e, ϕ(n)) = 1. (1) 3. Bob computes the unique number d satisfying 1 < d < ϕ(n) and e d 1 mod ϕ(n). (2) That is, d is the inverse of e modulo ϕ(n). 4. Bob s public key: (n,e); Bob s private key: d. 6

7 RSA: Encryption Given a message m, with 1 < m < n, Alice computes the ciphertext: c = E (n,e) (m) = m e mod n. To speed up encryption, she uses which is explained below. Fast Exponentiation, Let the binary expansion of e be given by e = k e i 2 i, where e i {0, 1}. i=0 Alice computes (modulo n): m e = m k i=0 e i 2 i = k (m 2i) e i k = m 2i. (3) i=0 i = 0 e i =1 7

8 Method Square-and-multiply 1. Successively compute m 2i, where 0 i k, using the equality ( m 2i+1 = m 2i) According to Equation (3), compute k m e = m 2i. i = 0 e i =1 Instead of e multiplications, Alice need compute no more than 2 log e multiplications. 8

9 Example: Square-and-multiply Suppose Alice wants to compute c = 6 17 mod 100. The binary expansion of the exponent is 17 = = Alice successively computes: 6 20 = 6 1 = 6; 6 21 = 6 2 = 36; 6 22 = mod 100; 6 23 ( 4) 2 mod mod 100; mod mod Alice computes her ciphertext c = 6 17 mod mod mod mod 100. Only four squarings and one multiplication are needed for her to compute the ciphertext. 9

10 RSA: Decryption Let c, 0 c < n, be the ciphertext sent to Bob: c = E (n,e) (m) = m e mod n. Bob decrypts c using his private key d and the decryption function: D d (c) = c d mod n. Again, fast exponentiation ensures efficient decryption. Theorem (Rivest, Shamir, and Adleman; 1978): Let (n,e) and d be Bob s public and private key in the RSA protocol. Then, for each message m with 0 m < n, (m e ) d mod n = m. That is, RSA is a public-key cryptosystem. 10

11 Proof of RSA Theorem Since e d 1 mod ϕ(n) by choice of d, there exists an integer t such that where n = pq. It follows that e d = 1 + t(p 1)(q 1), (m e ) d = m e d = m 1+t(p 1)(q 1) = m ( m t(p 1)(q 1)) = m ( m p 1) t(q 1). Hence: since (m e ) d m mod p, (4) if p divides m then both sides of Equation (4) are 0 mod p, and if p does not divide m (i.e., gcd(p,m) = 1) then by Fermat s Little Theorem, we have m p 1 1 mod p. 11

12 Proof of RSA Theorem Continued By a symmetric argument: (m e ) d m mod q, Since p and q are primes with p q: (m e ) d m mod n, Since m < n, the claim follows. 12

13 Example RSA R S A I S T H E K E Y T O P U B L I m b c b C K E Y C R Y P T O G R A P H Y m b c b

14 Sieb des Eratosthenes i Primzahlen unterhalb von 1000:

15 Probedivision TRIAL-DIVISION(n) { // n N with n 2 } for (i = 2, 3,..., n ) { if (i divides n) return n is composite and halt; } return n is prime and halt; 15

16 Fermat Test n n 1 mod n n n 1 mod n

17 Fermat Witnesses and Fermat Liars for n = 143 Multiples of Multiples of Fermat witnesses in Z Fermat liars

18 Fermat Test FERMAT(n) { } // n 3 is an odd integer Randomly choose a number a {2, 3,...,n 2} under the uniform distribution; if (a n 1 1 mod n)return n is composite and halt; elsereturn n is prime and halt; 18

19 Miller Rabin Test MILLER-RABIN(n) { } // n 3 is an odd integer Determine the representation n 1 = 2 k m, where m is odd; Randomly choose a number a {1, 2,...,n 1} under the uniform distribution; x := a m mod n; if (x 1 mod n)return n is prime and halt; for (j = 0, 1,...,k 1) { if (x 1 mod n)return n is prime and halt; else x := x 2 mod n; } return n is composite and halt; 19

20 MR-witnesses and MR-liars for the Carmichael number n = 561 a a 35 mod 561 a 70 mod 561 a 140 mod 561 a 280 mod 561 a 560 mod

21 Solovay Strassen Test SOLOVAY-STRASSEN(n) { } // n 3 is an odd integer Randomly choose a number a {1, 2,...,n 1} under the uniform distribution; x := ( a n) ; if (x = 0) return n is composite and halt; y := a (n 1)/2 mod n; if (x y mod n)return n is prime and halt; elsereturn n is composite and halt; 21

22 Computing the Jacobi Symbol ( a n ) Given any integer a and an odd number n 3 with prime power factorization n = p e 1 1 pe k k, compute the Jacobi symbol ( a k ( ) ei a = n) i=1 as follows: 1. If a {1, 2,...,n 1}, the result is ( ) a mod n n. 2. If a = 0, the result is If a = 1, the result is 1. ( ) 4. If 4 a, the result is a/4 n. ( ) 5. If 2 a, the result is a/2 if n mod 8 {1, 7}, n ( ) and is a/2 if n mod 8 {3, 5}. n 6. If a > 1 and a 1 or n 1 mod 4, the result is ( ) n mod a a. 7. If a 3 and n 3 mod 4, the result is ( ) n mod a a. p i 22

23 Properties of the Jacobi Symbol ( a n ) 1. Law of Quadratic Reciprocity (C. F. Gauß): If m and n are odd positive integers, then ( m ) { ( n ) = m) if m n 3 mod 4 n otherwise. ( n m 2. If n is an odd positive integer and a b mod n, then ( ( ) a b =. n) n 3. Multiplicativity: If n is an odd positive integer and a and b are integers, then (a ) b ( a ) ( ) b =. n n n In particular, if m = a 2 k and a is odd, then ( m ) ( a ) ( ) k 2 =. n n n 4. If n is an odd positive integer, then ( ) { 2 1 if n ±1 mod 8 = n 1 if n ±3 mod If n is an odd positive integer, then ( ) ( ) 1 0 = 1 and n n = 0. 23

24 Computing the Jacobi Symbol ( ) Now consider the case that SOLOVAY-STRASSEN(6399) has picked the number a = 1111 at random. Again computing the Jacobi symbol gives: ( ) (1) = ( (3) 211 = (1) = (3) = (1) = (5) = 1, ( ) ( ) 6399 (2) 844 = ) ( ) 2 2 (4) = ( ) ( ) 1111 (2) 56 = ( )( ) (4) = 211 ( ) (2) = 211 ( ) 1 7 ( ) ( ) where (i) = denotes that Property i from the previous transparency is applied. 24

25 Computing a (n 1)/2 mod n for a = 1111 and n = 6399 Compute mod 6399 by fast exponentiation. The binary expansion of the exponent is 3199 = , The table below shows the values a 2i mod n computed sequentially by the square-and-multiply algorithm. a 20 a 21 a 22 a 23 a 24 a 25 a 26 a 27 a 28 a 29 a 210 a Multiplying the values in the gray boxes and reducing modulo 6399, we obtain mod Thus, (1111 ) = mod 6399, 6399 and SOLOVAY-STRASSEN(6399) correctly outputs 6399 is composite, for the random number a =

26 Trivial Solovay Strassen Liars: 1 and n 1 On the other hand, if SOLOVAY-STRASSEN(6399) picks a number a {1, 6398} at random, then it incorrectly outputs since and 6399 is prime, ( ) ( ) (3) = (4) = (5) = 1 = mod 6399, (1) = (2) = ( )( ) ( ) ( ) ( ) (5) = 1 = ( 1) 3199 mod

27 Trial Division To find the prime factors of a given integer n 2, do the following: 1. Compute all primes less than or equal to some prespecified bound b. This can be done using the sieve of Eratosthenes. 2. For each prime p in this list, determine the maximum power of p dividing n, i.e., the maximum exponent e p such that p e p divides n, and output the corresponding prime factors of n in increasing order. i = i = i = i = i =

28 Pollard s p 1 Factoring Algorithm POLLARD(n, B) { } // n 3 is an odd integer and B is a prespecified bound x := 2; for (i = 2, 3...,B) { x := x i mod n; } d := gcd(n,x 1); if (1 < d < n) { return d; Recurse by calling POLLARD(d, B) and POLLARD(n/d, B); } else return failure and restart with a new bound B > B; Computing x i mod n for Pollard s p 1 factoring algorithm: i x

29 Quadratic Sieve: Computing σ(x) x σ(x) x σ(x)

30 Quadratic Sieve: Determining B-smooth values σ(x) using sieves with p x σ(x) sieve with sieve with sieve with sieve with sieve with

31 Quadratic Sieve: Overview 1. Let n be the number to be factored. Choose a factor base B consisting of 1 and prime numbers small enough, i.e., for some small prespecified bound B, define B = { 1} {p p is a prime number with p B}. 2. Let s = n. A function value σ(x) satisfying σ(x) (x + s) 2 mod n (5) is said to be B-smooth if and only if all its prime factors are contained in B. 3. Determine B integers x such that σ(x) is B-smooth. 4. Solve the corresponding system of B congruences to select suitable congruences of the form (5) such that their product yields a square on both sides 5. Determine the values of a and b satisfying a 2 b 2 mod n and a ±b mod n. (6) by taking the product of the congruences selected. 6. Determine the nontrivial factors of n = d 1 d 2 by d 1 = gcd(n,a b) d 2 = gcd(n,a + b). 7. Recursively apply this procedure to d 1 and d 2 until the prime factorization of n has been found. 31

32 Running Times of Selected Factoring Algorithms Algorithm Running time Pollard s p 1 algorithm O(B log B(log n) 2 + (log n) 3 ) ( ) Quadratic sieve O e (1+o(1)) ln n lnlnn Number field sieve O (e (1.92+o(1)) 3 ln n 3 (lnlnn) 2) ( ) Elliptic curve method O e (1+o(1)) 2 lnplnln p 32

33 Factoring RSA-d Numbers Challenge Factoring method Year RSA-129 quadratic sieve 1994 RSA-130 number field sieve 1996 RSA-140 number field sieve 1999 RSA-155 number field sieve