A. Algebra and Number Theory


 Tracey Moody
 4 years ago
 Views:
Transcription
1 A. Algebra and Number Theory Publickey cryptosystems are based on modular arithmetic. In this section, we summarize the concepts and results from algebra and number theory which are necessary for an understanding of the cryptographic methods. Textbooks on number theory and modular arithmetic include [HarWri79], [IreRos82], [Rose94], [Forster96] and [Rosen2000]. This section is also intended to establish notation. We assume that the reader is familiar with the elementary notions of algebra, such as groups, rings and fields. A.1 The Integers Z denotes the ring of integers; N = {z Z z > 0} denotes the subset of natural numbers. We first introduce the notion of divisors and the fundamental Euclidean algorithm which computes the greatest common divisor of two numbers. Definition A.1. Let a, b Z: 1. a divides b if there is some c Z, with b = ac. We write a b for a divides b. 2. d N is called the greatest common divisor of a and b, if: a. d a and d b. b. If t Z divides both a and b, then t divides d. The greatest common divisor is denoted by gcd(a, b). 3. If gcd(a, b) = 1, then a is called relatively prime to b, or prime to b for short. Theorem A.2 (Division with remainder). Let z, a Z, a 0. Then there are unique numbers q, r Z, such that z = q a + r and 0 r < a. Proof. In the first step, we prove that such q and r exist. If a > 0 and z 0, we may apply induction on z. For 0 z < a we obviously have z = 0 a + z. If z a, then, by induction, z a = q a + r for some q and r, 0 r < a, and hence z = (q + 1) a + r. If z < 0 and a > 0, then we have just shown the existence of an equation z = q a + r, 0 r < a. Then z = q a if r = 0, and z = q a r = q a a + (a r) = (q + 1) a + (a r) and
2 290 A. Algebra and Number Theory 0 < a r < a. If a < 0, then a > 0. Hence z = q ( a) + r = q a + r, with 0 r < a. To prove uniqueness, consider z = q 1 a + r 1 = q 2 a + r 2. Then 0 = (q 1 q 2 ) a + (r 1 r 2 ). Hence a divides (r 1 r 2 ). Since r 1 r 2 < a, this implies r 1 = r 2, and then also q 1 = q 2. Remark. r is called the remainder of z modulo a. We write z mod a for r. The number q is the (integer) quotient of z and a. We write z div a for q. The Euclidean Algorithm. Let a, b Z, a > b > 0. The greatest common divisor gcd(a, b) can be computed by an iterated division with remainder. Let r 0 := a, r 1 := b and r 0 = q 1 r 1 + r 2, 0 < r 2 < r 1, r 1 = q 2 r 2 + r 3, 0 < r 3 < r 2,. r k 1 = q k r k + r k+1, 0 < r k+1 < r k,.. r n 2 = q n 1 r n 1 + r n, 0 < r n < r n 1, r n 1 = q n r n + r n+1, 0 = r n+1. By construction, r 1 > r 2 >.... Therefore, the remainder becomes 0 after a finite number of steps. The last remainder 0 is the greatest common divisor, as is shown in the next proposition. Proposition A r n = gcd(a, b). 2. There are numbers d, e Z with gcd(a, b) = da + eb. Proof. 1. From the equations considered in reverse order, we conclude that r n divides r k, k = n 1, n In particular, r n divides r 1 = b and r 0 = a. Now let t be a divisor of a = r 0 and b = r 1. Then t r k, k = 2, 3,..., and hence t r n. Thus, r n is the greatest common divisor. 2. Iteratively substituting r k+1 by r k 1 q k r k, we get with integers d and e. r n = r n 2 q n 1 r n 1 = r n 2 q n 1 (r n 3 q n 2 r n 2 ) = (1 + q n 1 q n 2 ) r n 2 q n 1 r n 3. = da + eb, We have shown that the following algorithm, called Euclid s algorithm, outputs the greatest common divisor. abs(a) denotes the absolute value of a.
3 A.1 The Integers 291 Algorithm A.4. int gcd(int a, b) 1 while b 0 do 2 r a mod b 3 a b 4 b r 5 return abs(a) We now extend the algorithm, such that not only gcd(a, b) but also the coefficients d and e of the linear combination gcd(a, b) = da+eb are computed. For this purpose, we write the recursion using matrices ( rk r k+1 ) r k 1 = q k r k + r k+1 ( ) ( ) rk = Q k, where Q k =, k = 1,..., n. r k 1 q k Multiplying the matrices, we get ) ( rn r n+1 = Q n Q n 1... Q 1 ( r0 r 1 The first component of this equation yields the desired linear combination for r n = gcd(a, b). Therefore, we have to compute Q n Q n 1... Q 1. This is accomplished by iteratively computing the matrices ( ) ( ) Λ 0 =, Λ k = Λ k 1, k = 1,..., n, q k to finally get Λ n = Q n Q n 1... Q 1. In this way, we have derived the following algorithm, called the extended Euclidean algorithm. On inputs a and b it outputs the greatest common divisor and the coefficients d and e of the linear combination gcd(a, b) = da + eb. ).
4 292 A. Algebra and Number Theory Algorithm A.5. int array gcdcoef (int a, b) 1 λ 11 1, λ 22 1, λ 12 0, λ while b 0 do 3 q a div b 4 r a mod b 5 a b 6 b r 7 t 21 λ 21 ; t 22 λ 22 8 λ 21 λ 11 q λ 21 9 λ 22 λ 12 q λ λ 11 t λ 12 t return (abs(a), λ 11, λ 12 ) We analyze the running time of the Euclidean algorithm. Here we meet the Fibonacci numbers. Definition A.6. The Fibonacci numbers f n are recursively defined by f 0 := 0, f 1 := 1, f n := f n 1 + f n 2, for n 2. Remark. The Fibonacci numbers can be nonrecursively computed using the formula f n = 1 (g n g n ), 5 where g and g are the solutions of the equation x 2 = x + 1: g := 1 ( 1 + ) 5 and g := 1 g = 1 2 g = 1 ( 1 ) 5. 2 See, for example, [Forster96]. Definition A.7. g is called the Golden Ratio. 1 Lemma A.8. For n 2, f n g n 2. In particular, the Fibonacci numbers grow exponentially fast. Proof. The statement is clear for n = 2. By induction on n, assuming that the statement holds for n, we get f n+1 = f n + f n 1 g n 2 + g n 3 = g n 3 (1 + g) = g n 3 g 2 = g n 1. Proposition A.9. Let a, b Z, a > b > 0. Assume that computing gcd(a, b) by the Euclidean algorithm takes n iterations (i.e., using n divisions with remainder). Then a f n+1 and b f n. 1 It is the proportion of length to width which the Greeks found most beautiful.
5 A.1 The Integers 293 Proof. Let r 0 := a, r 1 := b and consider r 0 = q 1 r 1 + r 2, r 1 = q 2 r 2 + r 3,.. r n 2 = q n 1 r n 1 + r n, r n 1 = q n r n, and f n+1 = f n + f n 1, f n = f n 1 + f n 2,.. f 3 = f 2 + f 1, f 2 = f 1. By induction, starting with i = n and descending, we show that r i f n+1 i. For i = n, we have r n f 1 = 1. Now assume the inequality proven for i. Then r i 1 = q i r i + r i+1 r i + r i+1 f n+1 i + f n+1 (i+1) = f n+1 (i 1). Hence a = r 0 f n+1 and b = r 1 f n. Notation. As is common use, we denote by x the greatest integer less than or equal to x (the floor of x), and by x the smallest integer greater than or equal to x (the ceiling of x). Corollary A.10. Let a, b Z. Then the Euclidean algorithm computes gcd(a, b) in at most log g (a) + 1 iterations. Proof. Let n be the number of iterations. From a f n+1 g n 1 (Lemma A.8) we conclude n 1 log g (a). The Binary Encoding of Numbers. Studying algorithms with numbers as inputs and outputs, we need binary encodings of numbers (and residues, see below). We always assume that integers n 0 are encoded in the standard way as unsigned integers: The sequence z k 1 z k 2... z 1 z 0 of bits z i {0, 1}, 0 i k 1, is the encoding of k 1 n = z 0 + z z k 2 2 k 2 + z k 1 2 k 1 = z i 2 i. If the leading digit z k 1 is not zero (i.e., z k 1 = 1), we call n a kbit integer, and k is called the binary length of n. The binary length of n N is usually denoted by n. Of course, we only use this notation if it cannot be confused with the absolute value. The binary length of n N is log 2 (n) + 1. The numbers of binary length k are the numbers n N with 2 k 1 n 2 k 1. The BigO Notation. To state estimates, the bigo notation is useful. Suppose f(k) and g(k) are functions of the positive integers k which take positive (not necessarily integer) values. We say that f(k) = O(g(k)) if there is a constant C such that f(k) C g(k) for all sufficiently large k. For i=0
6 294 A. Algebra and Number Theory example, 2k 2 + k + 1 = O(k 2 ) because 2k 2 + k + 1 4k 2 for all k 1. In our examples, the constant C is always small, and we use the bigo notation for convenience. We do not want to state a precise value of C. Remark. Applying the classical grade school methods, we see that adding and subtracting two kbit numbers requires O(k) binary operations. Multiplication and division with remainder can be done with O(k 2 ) binary operations (see [Knuth98] for a more detailed discussion of time estimates for doing arithmetic). Thus, the greatest common divisor of two kbit numbers can be computed by the Euclidean algorithm with O(k 3 ) binary operations. Next we will show that every natural number can be uniquely decomposed into prime numbers. Definition A.11. Let p N, p 2. p is called a prime (or a prime number) if 1 and p are the only positive divisors of p. A number n N which is not a prime is called a composite. Remark. If p is a prime and p ab, a, b Z, then either p a or p b. Proof. Assume that p does not divide a and does not divide b. Then there are d 1, d 2, e 1, e 2 Z, with 1 = d 1 p + e 1 a, 1 = d 2 p + e 2 b (Proposition A.3). Then 1 = d 1 d 2 p 2 + d 1 e 2 bp + e 1 ad 2 p + e 1 e 2 ab. If p divided ab, then p would divide 1, which is impossible. Thus, p does not divide ab. Theorem A.12 (Fundamental Theorem of Arithmetic). Let n N, n 2. There are pairwise distinct primes p 1,..., p r and exponents e 1,..., e r N, e i 1, i = 1,..., r, such that n = r i=1 p e i i. The primes p 1,..., p r and exponents e 1,..., e r are unique. Proof. By induction on n we obtain the existence of such a decomposition. n = 2 is a prime. Now assume that the existence is proven for numbers n. Either n + 1 is a prime or n + 1 = l m, with l, m < n + 1. By assumption, there are decompositions of l and m and hence also for n + 1. In order to prove uniqueness, we assume that there are two different decompositions of n. Dividing both decompositions by all common primes, we get (not necessarily distinct) primes p 1,..., p s and q 1,..., q t, with {p 1,..., p s } {q 1,..., q t } = and p 1... p s = q 1... q t. Since p 1 q 1... q t, we conclude from the preceding remark that there is an i, 1 i t, with p 1 q i. This is a contradiction.
7 A.2 Residues 295 A.2 Residues In publickey cryptography, we usually have to compute with remainders modulo n. This means that the computations take place in the residue class ring Z n. Definition A.13. Let n N, n 2: 1. a, b Z are congruent modulo n, written as a b mod n, if n divides a b. This means that a and b have the same remainder when divided by n: a mod n = b mod n. 2. Let a Z. [a] := {x Z x a mod n} is called the residue class of a modulo m. 3. Z n := {[a] a Z} is the set of residue classes modulo n. Remark. As is easily seen, congruent modulo n is a symmetric, reflexive and transitive relation, i.e., it is an equivalence relation. The residue classes are the equivalence classes. A residue class [a] is completely determined by one of its members. If a [a], then [a] = [a ]. An element x [a] is called a representative of [a]. Division with remainder by n yields the remainders 0,..., n 1. Therefore, there are n residue classes in Z n : Z n = {[0],..., [n 1]}. The integers 0,..., n 1 are called the natural representatives. The natural representative of [x] Z n is just the remainder (x mod n) of x modulo n (see division with remainder, Theorem A.2). If, in the given context, no confusion is possible, we sometimes identify the residue classes with their natural representatives. Since we will study algorithms whose inputs and outputs are residue classes, we need binary encodings of the residue classes. The binary encoding of [x] Z n is the binary encoding of the natural representative x mod n as an unsigned integer (see our remark on the binary encoding of nonnegative integers in Section A.1). Definition A.14. By defining addition and multiplication as [a] + [b] = [a + b] and [a] [b] = [a b], Z n becomes a commutative ring, with unit element [1]. It is called the residue class ring modulo n. Remark. The sum [a] + [b] and the product [a] [b] do not depend on the choice of the representatives by which they are computed, as straightforward computations show. For example, let a [a] and b [b]. Then n a a and n b b. Hence n a + b (a + b), and therefore [a + b] = [a + b ].
8 296 A. Algebra and Number Theory Doing multiplications in a ring, we are interested in those elements which have a multiplicative inverse. They are called the units. Definition A.15. Let R be a commutative ring with unit element e. An element x R is called a unit if there is an element y R with x y = e. We call y a multiplicative inverse of x. The subset of units is denoted by R. Remark. The multiplicative inverse of a unit x is uniquely determined, and we denote it by x 1. The set of units R is a subgroup of R with respect to multiplication. Example. In Z, elements a and b satisfy a b = 1 if and only if both a and b are equal to 1, or both are equal to 1. Thus, 1 and 1 are the only units in Z. The residue class rings Z n contain many more units, as the subsequent considerations show. For example, if p is a prime then every residue class in Z p different from [0] is a unit. An element [x] Z n in a residue class ring is a unit if there is a residue class [y] Z n with [x] [y] = [1], i.e., n divides x y 1. Proposition A.16. An element [x] Z n is a unit if and only if gcd(x, n) = 1. The multiplicative inverse [x] 1 of a unit [x] can be computed using the extended Euclidean algorithm. Proof. If gcd(x, n) = 1, then there is an equation xb + nc = 1 in Z, and the coefficients b, c Z can be computed using the extended Euclidean algorithm A.5. The residue class [b] is an inverse of [x]. Conversely, if [x] is a unit, then there are y, k Z with x y = 1 + k n. This implies gcd(x, n) = 1. Corollary A.17. Let p be a prime. Then every [x] [0] in Z p is a unit. Thus, Z p is a field. Definition A.18. The subgroup Z n := {x Z n x is a unit in Z n } of units in Z n is called the prime residue class group modulo n. Definition A.19. Let M be a finite set. The number of elements in M is called the cardinality or order of M. It is denoted by M. We introduce the Euler phi function, which gives the number of units modulo n. Definition A.20. ϕ : N N, n Z n is called the Euler phi function or the Euler totient function. Proposition A.21 (Euler). ϕ(d) = n. d n
9 A.2 Residues 297 Proof. If d is a divisor of n, let Z d := {x 1 x n, gcd(x, n) = d}. Each k {1,..., n} belongs to exactly one Z d. Thus n = d n Z d. Since x x/ d is a bijective map from Z d to Z n/d, we have Z d = ϕ(n/ d ), and hence n = d n ϕ( n/ d ) = d n ϕ(d). Corollary A.22. Let p be a prime and k N. Then ϕ(p k ) = p k 1 (p 1). Proof. By Euler s result, ϕ(1) + ϕ(p) ϕ(p k ) = p k and ϕ(1) + ϕ(p) +...+ϕ(p k 1 ) = p k 1. Subtracting both equations yields ϕ(p k ) = p k p k 1 = p k 1 (p 1). Remarks: 1. By using the Chinese Remainder Theorem below (Section A.3), we will also get a formula for ϕ(n) if n is not a power of a prime (Corollary A.30). 2. At some points in the book we need a lower bound for the fraction ϕ(n)/ n of units in Z n. In [RosSch62] it is proven that ϕ(n) > n e γ 2.6, with Euler s constant γ = log(log(n)) + log(log(n)) This inequality implies, for example, that ϕ(n) > n 6 log(log(n)) for n , as a straightforward computation shows. The RSA cryptosystem is based on old results by Fermat and Euler. 2 These results are special cases of the following proposition. Proposition A.23. Let G be a finite group and e be the unit element of G. Then x G = e for all x G. Proof. Since we apply this result only to Abelian groups, we assume in our proof that the group G is Abelian. A proof for the general case may be found in most introductory textbooks on algebra. The map µ x : G G, g xg, multiplying group elements by x, is a bijective map (multiplying by x 1 is the inverse map). Hence, g, and this implies x G = e. g G g = g G xg = x G g G As a first corollary of Proposition A.23, we get Fermat s Little Theorem. Proposition A.24 (Fermat). Let p be a prime and a Z be a number that is prime to p (i.e., p does not divide a). Then a p 1 1 mod p. 2 Pierre de Fermat ( ) and Leonhard Euler ( ).
10 298 A. Algebra and Number Theory Proof. The residue class [a] of a modulo p is a unit, because a is prime to p (Proposition A.16). Since Z p = p 1 (Corollary A.17), we have [a] p 1 = 1 by Proposition A.23. Remark. Fermat stated a famous conjecture known as Fermat s Last Theorem. It says that the equation x n + y n = z n has no solutions with nonzero integers x, y and z, for n 3. For more than 300 years, Fermat s conjecture was one of the outstanding challenges of mathematics. It was finally proven in 1995 by Andrew Wiles. Euler generalized Fermat s Little Theorem. Proposition A.25 (Euler). Let n N and let a Z be a number that is prime to n. Then a ϕ(n) 1 mod n. Proof. It follows from Proposition A.23, in the same way as Proposition A.24. The residue class [a] of a modulo n is a unit and Z n = ϕ(n). Fast Modular Exponentiation. In cryptography, we often have to compute a power x e or a modular power x e mod n. This can be done efficiently by the fast exponentiation algorithm. The idea is that if the exponent e is a power of 2, say e = 2 k, then we can exponentiate by successively squaring: x e = x 2k = ((((... (x 2 ) 2 ) 2...) 2 ) 2 ) 2. In this way we compute x e by k squarings. For example, x 16 = (((x 2 ) 2 ) 2 ) 2. If the exponent is not a power of 2, then we use its binary representation. Assume that e is a kbit number, 2 k 1 e < 2 k. Then Hence, e = 2 k 1 e k k 2 e k e e 0, (with e k 1 = 1) = (2 k 2 e k k 3 e k e 1 ) 2 + e 0 = (... ((2e k 1 + e k 2 ) 2 + e k 3 ) e 1 ) 2 + e 0. x e = x (...((2e k 1+e k 2 ) 2+e k 3 ) e 1 ) 2+e 0 = = (x (...((2e k 1+e k 2 )) 2+e k 3 ) e 1 ) 2 x e 0 = = (... (((x 2 x e k 2 ) 2 x e k 3 ) 2...) 2 x e 1 ) 2 x e 0. We see that x e can be computed in k 1 steps, with each step consisting of squaring the intermediate result and, if the corresponding binary digit e i of e is 1, an additional multiplication by x. If we want to compute the modular power x e mod n, then we take the remainder modulo n after each squaring and multiplication: x e mod n = (... (((x 2 x e k 2 mod n) 2 x e k 3 mod n) 2...) 2 x e1 mod n) 2 x e0 mod n. We obtain the following algorithm for fast modular exponentiation.
11 A.3 The Chinese Remainder Theorem 299 Algorithm A.26. int ModPower(int x, e, n) 1 y x; 2 for i BitLength(e) 2 downto 0 do 3 y y 2 x Bit(e,i) mod n 4 return y In particular, we get Proposition A.27. Let l = log 2 e. The computation of x e mod n can be done by l squarings, l multiplications and l divisions. Proof. The binary length k of e is log 2 (e) + 1. A.3 The Chinese Remainder Theorem The Chinese Remainder Theorem provides a method of solving systems of congruences. The solutions can be found using an easy and efficient algorithm. Theorem A.28. Let n 1,..., n r N be pairwise relatively prime numbers, i.e., gcd(n i, n j ) = 1 for i j. Let b 1, b 2,..., b r be arbitrary integers. Then there is an integer b such that b b i mod n i, i = 1,..., r. Furthermore, the remainder b mod n is unique, where n = n 1... n r. The statement means that there is a onetoone correspondence between the residue classes modulo n and tuples of residue classes modulo n 1,..., n r. This onetoone correspondence preserves the additive and multiplicative structure. Therefore, we have the following ringtheoretic formulation of Theorem A.28. Theorem A.29 (Chinese Remainder Theorem). Let n 1,..., n r N be pairwise relatively prime numbers, i.e., gcd(n i, n j ) = 1, for i j. Let n = n 1... n r. Then the map ψ : Z n Z n1... Z nr, [x] ([x mod n 1 ],..., [x mod n r ]) is an isomorphism of rings. Remark. Before we give a proof, we review the notion of an isomorphism. It means that ψ is a homomorphism and bijective. Homomorphism means that ψ preserves the additive and multiplicative structure. More precisely, a map f : R R between rings with unit elements e and e is called a (ring) homomorphism if f(e) = e and f(a + b) = f(a) + f(b), f(a b) = f(a) f(b) for all a, b R.
12 300 A. Algebra and Number Theory If f is a bijective homomorphism, then, automatically, the inverse map g = f 1 is also a homomorphism. Namely, let a, b R. Then a = f(a) and b = f(b), and g(a b ) = g(f(a) f(b)) = g(f(a b)) = a b = g(a ) g(b ) (analogously for + instead of ). Being an isomorphism, as ψ is, is an extremely nice feature. It means, in particular, that a is a unit in R if and only if f(a) is a unit R (to see this, compute e = f(e) = f(a a 1 ) = f(a) f(a 1 ), hence f(a 1 ) is an inverse of f(a)). And the same equations hold in domain and range. For example, we have a 2 = b in R if and only if f(a) 2 = f(b) (note that f(a) 2 = f(a 2 )). Thus, b is a square if and only if f(b) is a square (we will use this example in Section A.7). Isomorphism means that the domain and range may be considered to be the same for all questions concerning addition and multiplication. Proof (of Theorem A.29). Since each n i divides n, the map is well defined, and it obviously is a ring homomorphism. The domain and range of the map have the same cardinality (i.e., they contain the same number of elements). Thus, it suffices to prove that ψ is surjective. Let t i := n/ ni = k i n k. Then t i 0 mod n k for all k i, and gcd(t i, n i ) = 1. Hence, there is a d i Z with d i t i 1 mod n i (Proposition A.16). Setting u i := d i t i, we have u i 0 mod n k, for all k i, and u i 1 mod n i. This means that the element (0,..., 0, 1, 0,..., 0) (the ith component is 1, all other components are 0) is in the image of ψ. If ([x 1 ],..., [x r ]) Z n1... Z nr is an arbitrary element, then ψ( r i=1 x i u i ) = ([x 1 ],..., [x r ]). Remarks: 1. Actually, the proof describes an efficient algorithm for computing a number b, with b b i mod n i, i = 1,..., r (recall our first formulation of the Chinese Remainder Theorem in Theorem A.28). In a preprocessing step, the inverse elements [d i ] = [t i ] 1 are computed modulo n i using the extended Euclidean algorithm (Proposition A.16). Then b can be computed as b = r i=1 b i d i t i, for any given integers b i, 1 i r. We mainly apply the Chinese Remainder Theorem with r = 2 (for example, in the RSA cryptosystem). Here we simply compute coefficients d and e with 1 = d n 1 + e n 2 (using the extended Euclidean algorithm A.5), and then b = d n 1 b 2 + e n 2 b The Chinese Remainder Theorem can be used to make arithmetic computations modulo n easier and (much) more efficient. We map the operands to Z n1... Z nr by ψ and do our computation there. Z n1... Z nr is a direct product of rings. Addition and multiplication are done componentwise, i.e., we perform the computation modulo n i, for i = 1,..., r.
13 A.4 Primitive Roots and the Discrete Logarithm 301 Here we work with (much) smaller numbers. 3 Finally, we map the result back to Z n by ψ 1 (which is easily done, as we have seen in the preceding remark). As a corollary of the Chinese Remainder Theorem, we get a formula for Euler s phi function for composite inputs. Corollary A.30. Let n N and n = p e pe r r into primes (as stated in Theorem A.12). Then: 1. Z n is isomorphic to Z e p Z p er. r 2. Z n is isomorphic to Z p e 1... Z 1 p. e r r In particular, we have for Euler s phi function that r ) ϕ(n) = n (1 1pi. i=1 be the decomposition of n Proof. The ring isomorphism of Theorem A.29 induces, in particular, an isomorphism on the units. Hence, ϕ(n) = ϕ(p e1 1 )... ϕ(pe r r ), and the formula follows from Corollary A.22. A.4 Primitive Roots and the Discrete Logarithm Definition A.31. Let G be a finite group and let e be the unit element of G. Let x G. The smallest n N with x n = e is called the order of x. We write this as ord(x). Remark. There are exponents n N, with x n = e. Namely, since G is finite, there are exponents m and m, m < m, with x m = x m. Then m m > 0 and x m m = e. Lemma A.32. Let G be a finite group and x G. Let n N with x n = e. Then ord(x) divides n. Proof. Let n = q ord(x) + r, 0 r < ord(x) (division with remainder). Then x r = e. Since 0 r < ord(x), this implies r = 0. Corollary A.33. Let G be a finite group and x G. Then ord(x) divides the order G of G. Proof. By Proposition A.23, x G = e. Lemma A.34. Let G be a finite group and x G. Let l Z and d = gcd(l, ord(x)). Then ord(x l ) = ord(x)/ d. 3 For example, if n = pq (as in an RSA scheme) with 512bit numbers p and q, then we compute with 512bit numbers instead of with 1024bit numbers.
14 302 A. Algebra and Number Theory Proof. Let r = ord(x l ). From (x l ) ord(x)/d = (x ord(x) ) l/d = e we conclude r ord(x)/ d. Choose numbers a and b with d = a l + b ord(x) (Proposition A.3). From x r d = x r a l+r b ord(x) = x l r a = e, we derive ord(x) r d. Definition A.35. Let G be a finite group. G is called cyclic if there is an x G which generates G, i.e., G = {x, x 2, x 3,..., x ord(x) 1, x ord(x) = e}. Such an element x is called a generator of G. Theorem A.36. Let p be a prime. Then Z p is cyclic, and the number of generators is ϕ(p 1). Proof. For 1 d p 1, let S d = {x Z p ord(x) = d} be the units of order d. If S d, let a S d. The equation X d 1 has at most d solutions in Z p, since Z p is a field (Corollary A.17). Hence, the solutions of X d 1 are just the elements of A := {a, a 2,..., a d }. Each x S d is a solution of X d 1, and therefore S d A. Using Lemma A.34 we derive that S d = {a c 1 c < d, gcd(c, d) = 1}. In particular, we conclude that S d = ϕ(d) if S d (and an a S d exists). By Fermat s Little Theorem (Proposition A.24), Z p is the disjoint union of the sets S d, d p 1. Hence Z p = p 1 = d p 1 S d. On the other hand, p 1 = d p 1 ϕ(d) (Proposition A.21), and we see that S d = ϕ(d) must hold for all divisors d of p 1. In particular, S p 1 = ϕ(p 1). This means that there are ϕ(p 1) generators of Z p. Definition A.37. Let p be a prime. A generator g of the cyclic group Z p is called a primitive root of Z p or a primitive root modulo p. Remark. It can be proven that Z n is cyclic if and only if n is one of the following numbers: 1, 2, 4, p k or 2p k ; p a prime, p 3, k 1. Proposition A.38. Let p be a prime. Then x Z p is a primitive root if and only if x (p 1)/q [1] for every prime q which divides p 1. Proof. An element x is a primitive root if and only if x has order p 1. Since ord(x) divides p 1 (Corollary A.33), either x (p 1)/q = [1] for some prime divisor q of p 1 or ord(x) = p 1. We may use Proposition A.38 to generate a primitive root for those primes p for which we know (or can efficiently compute) the prime factors of p 1. Algorithm A.39. int PrimitiveRoot(prime p) 1 Randomly choose an integer g, with 0 < g < p 1 2 if g (p 1) div q 1 mod p, for all primes q dividing p 1 3 then return g 4 else go to 1
15 A.4 Primitive Roots and the Discrete Logarithm 303 Since ϕ(p 1) > (p 1)/ 6 log(log(p 1)) (see Section A.2), we expect to find a primitive element after O(log(log(p))) iterations (see Lemma B.12). No efficient algorithm is known for the computation of primitive roots for arbitrary primes. The problem is to compute the prime factors of p 1, which we need in Algorithm A.39. Often there are primitive roots which are small. Algorithm A.39 is used, for example, in the keygeneration procedure of the ElGamal cryptosystem (see Section 3.5.1). There the primes p are chosen in such a way that the prime factors of p 1 can be derived efficiently. Lemma A.40. Let p be a prime and let q be a prime that divides p 1. Then the set G q = {x Z p ord(x) = q or x = [1]}, which consists of the unit element [1] and the elements of order q, is a subgroup of Z p. G q is a cyclic group, and every element x Z p of order q, i.e., every element x G q, x [1], is a generator. G q is generated, for example, by g (p 1)/q, where g is a primitive root modulo p. G q is the only subgroup of G of order q. Proof. Let x, y G q. Then (xy) q = x q y q = [1], and therefore ord(xy) divides q. Since q is a prime, we conclude that ord(xy) is 1 or q. Thus xy G q, and G q is a subgroup of Z p. Let h Z p be an element of order q, for example, h := g p 1/q, where g is a primitive root modulo p. Then {h 0, h 1, h 2,... h q 1 } G q. The elements of G q are solutions of the equation X q 1 in Z p. This equation has at most q solutions in Z p, since Z p is a field (Corollary A.17). Therefore {h 0, h 1, h 2,... h q 1 } = G q, and h is a generator of G q. If H is any subgroup of order q and z H, z [1], then ord(z) divides q, and hence ord(z) = q, because q is a prime. Thus z G q, and we conclude that H = G q. Computing Modulo a Prime. The security of many cryptographic schemes is based on the discrete logarithm assumption, which says that x g x mod p is a oneway function. Here p is a large prime and the base element g is 1. either a primitive root modulo p, i.e., a generator of Z p, or 2. it is an element of order q in Z p, i.e., a generator of the subgroup G q of order q, and q is a (large) prime that divides p 1. Examples of such schemes which we discuss in this book are ElGamal s encryption and digital signatures, the digital signature standard DSS (see Section 3.5), commitment schemes (see Section 4.3.2), electronic elections (see Section 4.4) and digital cash (see Section 4.5). When setting up such schemes, generators g of Z p or G q have to be selected. This can be difficult or even infeasible in the first case, because we must know the prime factors of p 1 in order to test whether a given element g is a primitive root (see Algorithm A.39 above). On the other hand, it is easy to find a generator g of G q. We simply take a random element h Z p and set g := h (p 1)/q. The order of g divides q, because g q = h p 1 = [1].
16 304 A. Algebra and Number Theory Since q is a prime, we conclude that ord(g) = 1 or ord(g) = q. Therefore, if g [1], then ord(g) = q and g is a generator of G q. To implement cryptographic operations, we have to compute in Z p or in the subgroup G q. The following rules simplify these computations. 1. Let x Z p. Then x k = x k, if k k mod (p 1). In particular, x k = x k mod (p 1), i.e., exponents can be reduced by modulo (p 1), and x k = x p 1 k. 2. Let x Z p be an element of order q, i.e., x G q. Then x k = x k, if k k mod q. In particular, x k = x k mod q, i.e., exponents can be reduced by modulo q, and x k = x q k. The rules state that the exponents are added and multiplied modulo (p 1) or modulo q. The rules hold, because x p 1 = [1] for x Z p (Proposition A.24) and x q = [1] for x G q, which implies that x k+l (p 1) = x k x l (p 1) = x k ( x p 1) l = x k [1] l = x k for x Z p and x k+l q = x k x l q = x k (x q ) l = x k [1] l = x k for x G q. These rules can be very useful in computations. For example, let x Z p and k {0, 1,..., p 2}. Then you can compute the inverse x k of x k by raising x to the (p 1 k)th power, x k = x p 1 k, without explicitly computing an inverse by using, for example, the Euclidean algorithm. Note that (p 1 k) is a positive exponent. Powers of x are efficiently computed by the fast exponentiation algorithm (Algorithm A.26). In many cases it is also possible to compute the kth root of elements in Z p. 1. Let x Z p and k N with gcd(k, p 1) = 1, i.e., k is a unit modulo p 1. Let k 1 be the inverse of k modulo p 1, i.e., k k 1 1 mod (p 1). ( Then x k 1) k = x, i.e., x k 1 is a kth root of x in Z p. 2. Let x Z p be an element of order q, i.e., x G q, and k N with 1 k < q. Let k 1 be the inverse of k modulo q, i.e., k k 1 1 mod q. ( Then x k 1) k = x, i.e., x k 1 is a kth root of x in Z p. It is common practice to denote the kth root x k 1 by x 1/k. You can apply analogous rules of computation to elements g k in any finite group G. Proposition A.23, which says that g G is the unit element, implies that exponents k are added and multiplied modulo the order G of G. A.5 Polynomials and Finite Fields A finite field is a field with a finite number of elements. In Section A.2, we met examples of finite fields: The residue class ring Z n is a field, if and only
17 A.5 Polynomials and Finite Fields 305 if n is a prime. The fields Z p, p a prime number, are called the finite prime fields, and they are also denoted by F p. Finite fields are extensions of these prime fields. Field extensions are constructed by using polynomials. So we first study the ring of polynomials with coefficients in a field k. A.5.1 The Ring of Polynomials Let k[x] be the ring of polynomials in one variable X over a (not necessarily finite) field k. The elements of k[x] are the polynomials F (X) = a 0 + a 1 X + a 2 X a d X d = d a i X i, with coefficients a i k, 0 i d. If we assume that a d 0, then the leading term a d X d really appears in the polynomial, and we call d the degree of F, deg(f ) for short. The polynomials of degree 0 are just the elements of k. The polynomials in k[x] are added and multiplied as usual: 1. We add two polynomials F = d i=0 a ix i and G = e i=0 b ix i, assume d e, by adding the coefficients (set a i = 0 for d < i e): F + G = e (a i + b i )X i. i=0 2. The product of two polynomials F = d i=0 a ix i and G = e i=0 b ix i is ( de i ) F G = a k b i k X i. i=0 With this addition and multiplication, k[x] becomes a commutative ring with unit element. The unit element of k[x] is the unit element 1 of k. The ring k[x] has no zero divisors, i.e., if F and G are nonzero polynomials, then the product F G is also nonzero. The algebraic properties of the ring k[x] of polynomials are analogous to the algebraic properties of the ring of integers. Analogously to Definition A.1, we define for polynomials F and G what it means that F divides G and the greatest common divisor of F and G. The greatest common divisor is unique up to a factor c k, c 0, i.e., if A is a greatest common divisor of F and G, then c A is also a greatest common divisor, for c k = k \ {0}. A polynomial F is (relatively) prime to G if the only common divisors of F and G are the units k of k. Division with remainder works as with the integers. The difference is that the size of a polynomial is measured by using the degree, whereas the absolute value was used for an integer. k=0 i=0
18 306 A. Algebra and Number Theory Theorem A.41 (Division with remainder). Let F, G k[x], G 0. Then there are unique polynomials Q, R k[x], such that F = Q G + R and 0 deg(r) < deg(g). Proof. The proof runs exactly in the same way as the proof of Theorem A.2: Replace the absolute value with the degree. R is called the remainder of F modulo G. We write F mod G for R. The polynomial Q is the quotient of F and G. We write F div G for Q. You can compute a greatest common divisor of polynomials F and G by using the Euclidean algorithm, and the extended Euclidean algorithm yields the coefficients C, D k[x] of a linear combination A = C F + D G, with A a greatest common divisor of F and G. If you have obtained such a linear combination for one greatest common divisor, then you immediately get a linear combination for any other greatest common divisor by multiplying with a unit from k. In particular, if F is prime to G, then the extended Euclidean algorithm computes a linear combination 1 = C F + D G. We also have the analogue of prime numbers. Definition A.42. Let P k[x], P k. P is called irreducible (or a prime) if the only divisors of P are the elements c k and c P, c k, or, equivalently, if whenever one can write P = F G with F, G k[x], then F k or G k. A polynomial Q k[x] which is not irreducible is called reducible or a composite. As the ring Z of integers, the ring k[x] of polynomials is factorial, i.e., every element has a unique decomposition into irreducible elements. Theorem A.43. Let F k[x], F 0, be a nonzero polynomial. There are pairwise distinct irreducible polynomials P 1,..., P r, r 0, exponents e 1,..., e r N, e i 1, i = 1,..., r, and a unit u k, such that F = u r i=1 P ei i. This factorization is unique in the following sense: If s F = v i=1 is another factorization of F, then we have r = s, and after a permutation of the indices i we have Q i = u i P i, with u i k, and e i = f i for 1 i r. Q f i i
19 A.5 Polynomials and Finite Fields 307 Proof. The proof runs in the same way as the proof of the Fundamental Theorem of Arithmetic (Theorem A.12). A.5.2 Residue Class Rings As in the ring of integers, we can consider residue classes in k[x] and residue class rings. Definition A.44. Let P k[x] be a polynomial of degree 1: 1. F, G k[x] are congruent modulo P, written as F G mod P, if P divides F G. This means that F and G have the same remainder when divided by P, i.e., F mod P = G mod P. 2. Let F k[x]. [F ] := {G k[x] G F mod P } is called the residue class of F modulo P. As before, congruent modulo is an equivalence relation, the equivalence classes are the residue classes, and the set of residue classes k[x]/p k[x] := {[F ] F k[x]} is a ring. Residue classes are added and multiplied by adding and multiplying a representative: [F ] + [G] := [F + G], [F ] [G] := [F G]. We also have a natural representative of [F ], the remainder F mod P of F modulo P : [F ] = [F mod P ]. As remainders modulo P, we get all the polynomials which have a degree < deg(p ). Therefore, we have a onetoone correspondence between k[x]/p k[x] and the set of residues {F k[x] deg(f ) < deg(p )}. We often identify both sets: k[x]/p k[x] = {F k[x] deg(f ) < deg(p )}. Two residues F and G are added or multiplied by first adding or multiplying them as polynomials and then taking the residue modulo P. Since the sum of two residues F and G has a degree < deg(p ), it is a residue, and we do not have to reduce. After a multiplication, we have, in general, to take the remainder. Addition : (F, G) F + G, Multiplication : (F, G) F G mod P. Let n := deg(p ) be the degree of P. The residue class ring k[x]/p k[x] is an ndimensional vector space over k. A basis of this vector space is given by the elements [1], [X], [X 2 ],..., [X n 1 ]. If k is a finite field with q elements, then k[x]/p k[x] consists of q n elements.
20 308 A. Algebra and Number Theory Example. Let k = F 2 = Z 2 = {0, 1} be the field with two elements 0 and 1 consisting of the residues modulo 2, and P := X 8 + X 4 + X 3 + X + 1 k[x]. The elements of k[x]/p k[x] may be identified with the binary polynomials b 7 X 7 + b 6 X b 1 X + b 0, b i {0, 1}, 0 i 7, of degree 7. The ring k[x]/p k[x] contains 2 8 = 256 elements. We have, for example, (X 6 + X 3 + X 2 + 1) (X 5 + X 2 + 1) = X 11 + X 7 + X 6 + X 4 + X = X 3 (X 8 + X 4 + X 3 + X + 1) mod (X 8 + X 4 + X 3 + X + 1). Thus, X 6 +X 3 +X 2 +1 is a unit in k[x]/p k[x], and its inverse is X 5 +X We may characterize units as in the integer case. Proposition A.45. An element [F ] k[x]/p k[x] is a unit if and only if F is prime to P. The multiplicative inverse [F ] 1 of a unit [F ] can be computed using the extended Euclidean algorithm. Proof. The proof is the same as the proof in the integer case (see Proposition A.16). Recall that the inverse may be calculated as follows: If F is prime to P, then the extended Euclidean algorithm produces a linear combination C F + D P = 1, with polynomials C, D k[x]. We see that C F 1 mod P. Hence, [C] is the inverse [F ] 1. If the polynomial P is irreducible, then all residues modulo P, i.e., all polynomials with a degree < deg(p ), are prime to P. So we get the same corollary as in the integer case. Corollary A.46. Let P be irreducible. Then every [F ] [0] in k[x]/p k[x] is a unit. Thus, k[x]/p k[x] is a field. Remarks: 1. Let P be an irreducible polynomial of degree n. The field k is a subset of the larger field k[x]/p k[x]. We therefore call k[x]/p k[x] an extension field of k of degree n. 2. If P is reducible, then P = F G, with polynomials F, G of degree < deg(p ). Then [F ] [0] and [G] [0], but [F ] [G] = [P ] = [0]. [F ] and [G] are zero divisors. They have no inverse, and we see that k[x]/p k[x] is not a field. A.5.3 Finite Fields Now, let k = Z p = F p be the prime field of residues modulo p, p Z a prime number, and let P F p [X] be an irreducible polynomial of degree
21 A.5 Polynomials and Finite Fields 309 n. Then k[x]/p k[x] = F p [X]/P F p [X] is an extension field of F p. It is an ndimensional vector space over F p, and it contains p n elements. In general, there is more than one irreducible polynomial of degree n over F p. Therefore there are more finite fields with p n elements. For example, if Q F p [X] is another irreducible polynomial of degree n, Q cp for all c k, then F p [X]/QF p [X] is a field with p n elements, different from k[x]/p k[x]. But one can show that all the finite fields with p n elements are isomorphic to each other in a very natural way. As the mathematicians state it, up to canonical isomorphism, there is only one finite field with p n elements. It is denoted by F p n or by GF(p n ). 4 If you need a concrete representation of F p n, then you choose an irreducible polynomial P F p [X] of degree n, and you have F p n = F p [X]/P F p [X]. But there are different representations, reflecting your degrees of freedom when choosing the irreducible polynomial. One can also prove that in every finite field k, the number k of elements in k must be a power p n of a prime number p. Therefore, the fields F p n are all the finite fields that exist. In cryptography, finite fields play an important role in many places. For example, the classical ElGamal cryptosystems are based on the discrete logarithm problem in a finite prime field (see Section 3.5), the elliptic curves used in cryptography are defined over finite fields, and the basic encryption operations of the Advanced Encryption Standard AES are algebraic operations in the field F 2 8 with 2 8 elements. The AES is discussed in this book (see Section 2.2.2). This motivates the following closer look at the fields F 2 n. We identify F 2 = Z 2 = {0, 1}. Let P = X n + a n 1 X n a 1 X + a 0, a i {0, 1}, 0 i n 1 be a binary irreducible polynomial of degree n. Then F 2 n = F p [X]/P F p [X], and we may consider the binary polynomials A = b n 1 X n 1 +b n 2 X n b 1 X +b 0 of degree n 1 (b i {0, 1}, 0 i n 1) as the elements of F 2 n. Adding two of these polynomials in F 2 n means to add them as polynomials, and multiplying them means to first multiply them as polynomials and then take the remainder modulo P. Now we can represent the polynomial A by the ndimensional vector b n 1 b n 2... b 1 b 0 of its coefficients. In this way, we get a binary representation of the elements of F 2 n; the elements of F 2 n are just the bit strings of length n. To add two of these elements means to add them as binary vectors, i.e., you add them bitwise modulo 2, which is the same as bitwise XORing: b n 1 b n 2... b 1 b 0 + c n 1 c n 2... c 1 c 0 = (b n 1 c n 1 )(b n 2 c n 2 )... (b 1 c 1 )(b 0 c 0 ). To multiply two elements is more complicated: You have to convert the bit strings to polynomials, multiply them as polynomials, reduce modulo P and 4 Finite fields are also called Galois fields, in honor of the French mathematician Évariste Galois ( ).
22 310 A. Algebra and Number Theory take the coefficients of the remainder. The 0element of F 2 n is and the 1element is In the Advanced Encryption Standard AES, encryption depends on algebraic operations in the finite field F 2 8. The irreducible binary polynomial P := X 8 + X 4 + X 3 + X + 1 is taken to represent F 2 8 as F 2 [X]/P F 2 [X] (we already used this polynomial in an example above). Then the elements of F 2 8 are just strings of 8 bits. In this way, a byte is an element of F 2 8 and vice versa. One of the core operations of AES is the socalled SBox. The AES SBox maps a byte x to its inverse x 1 in F 2 8 and then modifies the result by an F 2 affine transformation (see Section 2.2.2). We conclude this section with examples for adding, multiplying and inverting bytes in F = , = , = , = As is common practice, we sometimes represent a byte and hence an element of F 2 8 by two hexadecimal digits. Then the examples read as follows: 4D + 25 = 68, BD 69 = FC, 4D 25 = 01, 4D 1 = 25. A.6 Quadratic Residues We will study the question as to which of the residues modulo n are squares. Definition A.47. Let n N and x Z. We call that x is a quadratic residue modulo n if there is an element y Z with x y 2 mod n. Otherwise, x is called a quadratic nonresidue modulo n. Examples: 1. The numbers 0, 1, 4, 5, 6 and 9 are the quadratic residues modulo The numbers 0, 1, 3, 4, 5 and 9 are the quadratic residues modulo 11. Remark. The property of being a quadratic residue depends only on the residue class [x] Z n of x modulo n. An integer x is a quadratic residue modulo n if and only if its residue class [x] is a square in the residue class ring Z n (i.e., if and only if there is some [y] Z n with [x] = [y] 2 ). The residue class [x] is often also called a quadratic residue. In most cases we are only interested in the quadratic residues x which are units modulo n (i.e., x and n are relatively prime, see Proposition A.16).
23 A.6 Quadratic Residues 311 Definition A.48. The subgroup of Z n that consists of the residue classes represented by a quadratic residue is denoted by QR n : QR n = {[x] Z n There is a [y] Z n with [x] = [y] 2 }. It is called the subgroup of quadratic residues or the subgroup of squares. The complement of QR n is denoted by QNR n := Z n \ QR n. It is called the subset of quadratic nonresidues. We give a criterion for determining the quadratic residues modulo a prime. Lemma A.49. Let p be a prime > 2 and g Z p be a primitive root of Z p. Let x Z p. Then [x] QR p if and only if x g t mod p for some even number t, 0 t p 2. Proof. Recall that Z p is a cyclic group generated by g (Theorem A.36). If [x] QR p, then x y 2 mod p, and y g s mod p for some s. Then x = g 2s mod p g t mod p, with t := 2s mod (p 1) (the order of g is p 1) and 0 t p 2. Since p 1 is even, t is also even. Conversely, if x g t mod p, and t is even, then x (g t/2 ) 2 mod p, which means that x QR p. Proposition A.50. Let p be a prime > 2. Exactly half of the elements of Z p are squares, i.e., QR p = (p 1)/ 2. Proof. Since half of the integers x with 0 x p 2 are even, the proposition follows from the preceding lemma. Definition A.51. Let p be a prime > 2, and let x Z be prime to p. ( ) { x +1 if [x] QRp, := p 1 if [x] QR p, ( is called the Legendre symbol of x mod p. For x Z with p x, we set x p ) := 0. Proposition A.52 (Euler s criterion). Let p be a prime > 2, and let x Z. Then ( ) x x (p 1)/2 mod p. p Proof. If p divides x, then both sides are congruent 0 modulo p. Suppose p does not divide x. Let [g] Z p be a primitive element. We first observe that g (p 1)/2 1 mod p. Namely, [g] (p 1)/2 is a solution of the equation X 2 1 over the field Z p. Hence, g (p 1)/2 ±1 mod p. However, g (p 1)/2 mod p 1, because the order of [g] is p 1. Let [x] = [g] t, 0 t p 2. By Lemma A.49, [x] QR p if and only if t is even. On the other hand, x (p 1)/2 g t(p 1)/2 ±1 mod p, and it is 1 mod p if and only if t is even. This completes the proof.
24 312 A. Algebra and Number Theory Remarks: 1. The Legendre symbol is multiplicative in x: ( ) ( ) ( ) xy x y =. p p p This immediately follows, for example, from Euler s criterion. It means that [xy] QR p if and only if either both [x], [y] QR p or both [x], [y] / QR p. ( 2. The Legendre symbol x p is a homomorphism of groups. ) depends only on x mod p, and the map ( Z p {1, 1}, x We do not give proofs of the following two important results. Proofs may be found, for example, in [HarWri79], [Rosen2000], [Koblitz94] and [Forster96]. Theorem A.53. Let p be a prime > 2. Then: { ( ) 1 +1 if p 1 mod 4, 1. p = ( 1) (p 1)/2 = 1 if p 3 mod 4. { ( ) 2 +1 if p ±1 mod 8, 2. p = ( 1) (p2 1)/8 = 1 if p ±3 mod 8. Theorem A.54 (Law of Quadratic Reciprocity). Let p and q be primes > 2, p q. Then ( ) ( ) p q = ( 1) (p 1)(q 1)/4. q p We generalize the Legendre symbol for composite numbers. Definition A.55. Let n Z be a positive odd number and n = r the decomposition of n into primes. Let x Z. ( x := n) r ( x i=1 is called the Jacobi symbol of x mod n. Remarks: 1. The value of ( x n) only depends on the residue class [x] Zn. p i ) ei x p ) i=1 pe i i be
25 A.6 Quadratic Residues If [x] QR n, then [x] QR p for all primes p that divide n. Hence, ( x ) n = 1. The converse is not true, in general. For example, let n = pq be the product of two primes. Then ( ) ( ) ( ) x n = x x p q can be 1, whereas ( ) ( ) x x both p and q are 1. This means that x mod p (and x mod q), and hence x mod n are not squares. 3. The Jacobi symbol is multiplicative in both arguments: ( xy ) ( x ( y ( x ) ( x ( x = and =. n n) n) mn m) n) 4. The map Z n {1, 1}, [x] ( x n) is a homomorphism of groups. 5. J +1 n := {[x] Z n ( x n) = 1} is a subgroup of Z n. Lemma ( A.56. Let n 3 be an odd integer. If n is a square (in Z), then x ) n = 1 for all x. Otherwise, half of the elements of Z n have a Jacobi symbol of 1, i.e., J +1 n = ϕ(n)/ 2. Proof. If n is a square, then the exponents e i in the prime factorization of n are all even (notation as above), and the Jacobi symbol is always 1. If n is not a square, then there is an odd e i, say e 1. By the Chinese Remainder Theorem (Theorem A.29), we find a unit x which is a quadratic nonresidue modulo p 1 and a quadratic residue modulo p i for i = 2,..., r. Then ( x n) = 1, and mapping [y] to [y x] yields a onetoone map from J +1 n to Z n \ J +1 n. Theorem A.57. Let n 3 be an odd integer. Then: 1. ( { ) 1 +1 if n 1 mod 4, n = ( 1) (n 1)/2 = 1 if n 3 mod ( { 2 n) = ( 1) (n +1 if n ±1 mod 8, 2 1)/8 = 1 if n ±3 mod 8. Proof. Let f(n) = ( 1) (n 1)/2 for statement 1 and f(n) = ( 1) (n2 1)/8 for statement 2. You can easily check that f(n 1 n 2 ) = f(n 1 )f(n 2 ) for odd numbers n 1 and n 2 (for statement 2, consider the different cases of n 1, n 2 mod 8). Thus, both sides of the equations ( ) 1 n = ( 1) (n 1)/2 and ) = ( 1) (n 2 1)/8 are multiplicative in n, and the proposition follows from ( 2 n Theorem A.53. Theorem A.58 (Law of Quadratic Reciprocity). Let n, m 3 be odd integers. Then ( m ) ( = ( 1) (n 1)(m 1)/4 n ). n m
ECEN 5022 Cryptography
Elementary Algebra and Number Theory University of Colorado Spring 2008 Divisibility, Primes Definition. N denotes the set {1, 2, 3,...} of natural numbers and Z denotes the set of integers {..., 2, 1,
More informationMathematics for Cryptography
Mathematics for Cryptography Douglas R. Stinson David R. Cheriton School of Computer Science University of Waterloo Waterloo, Ontario, N2L 3G1, Canada March 15, 2016 1 Groups and Modular Arithmetic 1.1
More informationChapter 5. Modular arithmetic. 5.1 The modular ring
Chapter 5 Modular arithmetic 5.1 The modular ring Definition 5.1. Suppose n N and x, y Z. Then we say that x, y are equivalent modulo n, and we write x y mod n if n x y. It is evident that equivalence
More informationCongruences and Residue Class Rings
Congruences and Residue Class Rings (Chapter 2 of J. A. Buchmann, Introduction to Cryptography, 2nd Ed., 2004) Shoichi Hirose Faculty of Engineering, University of Fukui S. Hirose (U. Fukui) Congruences
More informationLecture notes: Algorithms for integers, polynomials (Thorsten Theobald)
Lecture notes: Algorithms for integers, polynomials (Thorsten Theobald) 1 Euclid s Algorithm Euclid s Algorithm for computing the greatest common divisor belongs to the oldest known computing procedures
More informationCPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Security Michael J. Fischer Lecture 9 September 30, 2015 CPSC 467, Lecture 9 1/47 Fast Exponentiation Algorithms Number Theory Needed for RSA Elementary Number Theory
More informationPublickey Cryptography: Theory and Practice
Publickey Cryptography Theory and Practice Department of Computer Science and Engineering Indian Institute of Technology Kharagpur Chapter 2: Mathematical Concepts Divisibility Congruence Quadratic Residues
More informationIntroduction to Information Security
Introduction to Information Security Lecture 5: Number Theory 007. 6. Prof. Byoungcheon Lee sultan (at) joongbu. ac. kr Information and Communications University Contents 1. Number Theory Divisibility
More informationNumber Theory and Algebra: A Brief Introduction
Number Theory and Algebra: A Brief Introduction Indian Statistical Institute Kolkata May 15, 2017 Elementary Number Theory: Modular Arithmetic Definition Let n be a positive integer and a and b two integers.
More informationNumber Theory and Group Theoryfor PublicKey Cryptography
Number Theory and Group Theory for PublicKey Cryptography TDA352, DIT250 Wissam Aoudi Chalmers University of Technology November 21, 2017 Wissam Aoudi Number Theory and Group Theoryfor PublicKey Cryptography
More informationNumber Theory. Modular Arithmetic
Number Theory The branch of mathematics that is important in IT security especially in cryptography. Deals only in integer numbers and the process can be done in a very fast manner. Modular Arithmetic
More informationApplied Cryptography and Computer Security CSE 664 Spring 2018
Applied Cryptography and Computer Security Lecture 12: Introduction to Number Theory II Department of Computer Science and Engineering University at Buffalo 1 Lecture Outline This time we ll finish the
More informationBasic elements of number theory
Cryptography Basic elements of number theory Marius Zimand 1 Divisibility, prime numbers By default all the variables, such as a, b, k, etc., denote integer numbers. Divisibility a 0 divides b if b = a
More informationBasic elements of number theory
Cryptography Basic elements of number theory Marius Zimand By default all the variables, such as a, b, k, etc., denote integer numbers. Divisibility a 0 divides b if b = a k for some integer k. Notation
More informationChapter 9 Mathematics of Cryptography Part III: Primes and Related Congruence Equations
Chapter 9 Mathematics of Cryptography Part III: Primes and Related Congruence Equations Copyright The McGrawHill Companies, Inc. Permission required for reproduction or display. 9.1 Chapter 9 Objectives
More informationNumbers. Çetin Kaya Koç Winter / 18
Çetin Kaya Koç http://koclab.cs.ucsb.edu Winter 2016 1 / 18 Number Systems and Sets We represent the set of integers as Z = {..., 3, 2, 1,0,1,2,3,...} We denote the set of positive integers modulo n as
More informationYALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE
YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE CPSC 467a: Cryptography and Computer Security Notes 13 (rev. 2) Professor M. J. Fischer October 22, 2008 53 Chinese Remainder Theorem Lecture Notes 13 We
More information1 Structure of Finite Fields
T79.5501 Cryptology Additional material September 27, 2005 1 Structure of Finite Fields This section contains complementary material to Section 5.2.3 of the textbook. It is not entirely selfcontained
More informationNumber Theory. CSS322: Security and Cryptography. Sirindhorn International Institute of Technology Thammasat University CSS322. Number Theory.
CSS322: Security and Cryptography Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 29 December 2011 CSS322Y11S2L06, Steve/Courses/2011/S2/CSS322/Lectures/number.tex,
More informationCourse 2BA1: Trinity 2006 Section 9: Introduction to Number Theory and Cryptography
Course 2BA1: Trinity 2006 Section 9: Introduction to Number Theory and Cryptography David R. Wilkins Copyright c David R. Wilkins 2006 Contents 9 Introduction to Number Theory and Cryptography 1 9.1 Subgroups
More informationA Few Primality Testing Algorithms
A Few Primality Testing Algorithms Donald Brower April 2, 2006 0.1 Introduction These notes will cover a few primality testing algorithms. There are many such, some prove that a number is prime, others
More informationNUMBER THEORY. Anwitaman DATTA SCSE, NTU Singapore CX4024. CRYPTOGRAPHY & NETWORK SECURITY 2018, Anwitaman DATTA
NUMBER THEORY Anwitaman DATTA SCSE, NTU Singapore Acknowledgement: The following lecture slides are based on, and uses material from the text book Cryptography and Network Security (various eds) by William
More informationKnow the Wellordering principle: Any set of positive integers which has at least one element contains a smallest element.
The first exam will be on Monday, June 8, 202. The syllabus will be sections. and.2 in Lax, and the number theory handout found on the class web site, plus the handout on the method of successive squaring
More informationLecture 4: Number theory
Lecture 4: Number theory Rajat Mittal IIT Kanpur In the next few classes we will talk about the basics of number theory. Number theory studies the properties of natural numbers and is considered one of
More informationCPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 8 February 1, 2012 CPSC 467b, Lecture 8 1/42 Number Theory Needed for RSA Z n : The integers mod n Modular arithmetic GCD Relatively
More informationA Guide to Arithmetic
A Guide to Arithmetic Robin Chapman August 5, 1994 These notes give a very brief resumé of my number theory course. Proofs and examples are omitted. Any suggestions for improvements will be gratefully
More informationElementary Number Theory Review. Franz Luef
Elementary Number Theory Review Principle of Induction Principle of Induction Suppose we have a sequence of mathematical statements P(1), P(2),... such that (a) P(1) is true. (b) If P(k) is true, then
More informationCourse MA2C02, Hilary Term 2013 Section 9: Introduction to Number Theory and Cryptography
Course MA2C02, Hilary Term 2013 Section 9: Introduction to Number Theory and Cryptography David R. Wilkins Copyright c David R. Wilkins 2000 2013 Contents 9 Introduction to Number Theory 63 9.1 Subgroups
More informationThe Chinese Remainder Theorem
Chapter 5 The Chinese Remainder Theorem 5.1 Coprime moduli Theorem 5.1. Suppose m, n N, and gcd(m, n) = 1. Given any remainders r mod m and s mod n we can find N such that N r mod m and N s mod n. Moreover,
More informationK. Ireland, M. Rosen A Classical Introduction to Modern Number Theory, Springer.
Chapter 1 Number Theory and Algebra 1.1 Introduction Most of the concepts of discrete mathematics belong to the areas of combinatorics, number theory and algebra. In Chapter?? we studied the first area.
More informationElementary Number Theory MARUCO. Summer, 2018
Elementary Number Theory MARUCO Summer, 2018 Problem Set #0 axiom, theorem, proof, Z, N. Axioms Make a list of axioms for the integers. Does your list adequately describe them? Can you make this list as
More informationMathematical Foundations of PublicKey Cryptography
Mathematical Foundations of PublicKey Cryptography Adam C. Champion and Dong Xuan CSE 4471: Information Security Material based on (Stallings, 2006) and (Paar and Pelzl, 2010) Outline Review: Basic Mathematical
More informationMathematics of Cryptography
UNIT  III Mathematics of Cryptography Part III: Primes and Related Congruence Equations 1 Objectives To introduce prime numbers and their applications in cryptography. To discuss some primality test algorithms
More informationSummary Slides for MATH 342 June 25, 2018
Summary Slides for MATH 342 June 25, 2018 Summary slides based on Elementary Number Theory and its applications by Kenneth Rosen and The Theory of Numbers by Ivan Niven, Herbert Zuckerman, and Hugh Montgomery.
More informationLemma 1.2. (1) If p is prime, then ϕ(p) = p 1. (2) If p q are two primes, then ϕ(pq) = (p 1)(q 1).
1 Background 1.1 The group of units MAT 3343, APPLIED ALGEBRA, FALL 2003 Handout 3: The RSA Cryptosystem Peter Selinger Let (R, +, ) be a ring. Then R forms an abelian group under addition. R does not
More informationLECTURE NOTES IN CRYPTOGRAPHY
1 LECTURE NOTES IN CRYPTOGRAPHY Thomas Johansson 2005/2006 c Thomas Johansson 2006 2 Chapter 1 Abstract algebra and Number theory Before we start the treatment of cryptography we need to review some basic
More informationFinite Fields and ErrorCorrecting Codes
Lecture Notes in Mathematics Finite Fields and ErrorCorrecting Codes KarlGustav Andersson (Lund University) (version 1.01316 September 2015) Translated from Swedish by Sigmundur Gudmundsson Contents
More informationMathematical Foundations of Cryptography
Mathematical Foundations of Cryptography Cryptography is based on mathematics In this chapter we study finite fields, the basis of the Advanced Encryption Standard (AES) and elliptical curve cryptography
More informationTC10 / 3. Finite fields S. Xambó
TC10 / 3. Finite fields S. Xambó The ring Construction of finite fields The Frobenius automorphism Splitting field of a polynomial Structure of the multiplicative group of a finite field Structure of the
More informationCourse 2316 Sample Paper 1
Course 2316 Sample Paper 1 Timothy Murphy April 19, 2015 Attempt 5 questions. All carry the same mark. 1. State and prove the Fundamental Theorem of Arithmetic (for N). Prove that there are an infinity
More informationAlgebra. Modular arithmetic can be handled mathematically by introducing a congruence relation on the integers described in the above example.
Coding Theory Massoud Malek Algebra Congruence Relation The definition of a congruence depends on the type of algebraic structure under consideration Particular definitions of congruence can be made for
More information2.3 In modular arithmetic, all arithmetic operations are performed modulo some integer.
CHAPTER 2 INTRODUCTION TO NUMBER THEORY ANSWERS TO QUESTIONS 2.1 A nonzero b is a divisor of a if a = mb for some m, where a, b, and m are integers. That is, b is a divisor of a if there is no remainder
More informationCS 5319 Advanced Discrete Structure. Lecture 9: Introduction to Number Theory II
CS 5319 Advanced Discrete Structure Lecture 9: Introduction to Number Theory II Divisibility Outline Greatest Common Divisor Fundamental Theorem of Arithmetic Modular Arithmetic Euler Phi Function RSA
More informationCPSC 467b: Cryptography and Computer Security
Outline Quadratic residues Useful tests Digital Signatures CPSC 467b: Cryptography and Computer Security Lecture 14 Michael J. Fischer Department of Computer Science Yale University March 1, 2010 Michael
More informationOutline. Some Review: Divisors. Common Divisors. Primes and Factors. b divides a (or b is a divisor of a) if a = mb for some m
Outline GCD and Euclid s Algorithm AIT 682: Network and Systems Security Topic 5.1 Basic Number Theory  Foundation of Public Key Cryptography Modulo Arithmetic Modular Exponentiation Discrete Logarithms
More informationOutline. AIT 682: Network and Systems Security. GCD and Euclid s Algorithm Modulo Arithmetic Modular Exponentiation Discrete Logarithms
AIT 682: Network and Systems Security Topic 5.1 Basic Number Theory  Foundation of Public Key Cryptography Instructor: Dr. Kun Sun Outline GCD and Euclid s Algorithm Modulo Arithmetic Modular Exponentiation
More informationTopics in Cryptography. Lecture 5: Basic Number Theory
Topics in Cryptography Lecture 5: Basic Number Theory Benny Pinkas page 1 1 Classical symmetric ciphers Alice and Bob share a private key k. System is secure as long as k is secret. Major problem: generating
More informationA Generalization of Wilson s Theorem
A Generalization of Wilson s Theorem R. Andrew Ohana June 3, 2009 Contents 1 Introduction 2 2 Background Algebra 2 2.1 Groups................................. 2 2.2 Rings.................................
More informationThe number of ways to choose r elements (without replacement) from an nelement set is. = r r!(n r)!.
The first exam will be on Friday, September 23, 2011. The syllabus will be sections 0.1 through 0.4 and 0.6 in Nagpaul and Jain, and the corresponding parts of the number theory handout found on the class
More information3 The fundamentals: Algorithms, the integers, and matrices
3 The fundamentals: Algorithms, the integers, and matrices 3.4 The integers and division This section introduces the basics of number theory number theory is the part of mathematics involving integers
More informationDefinitions. Notations. Injective, Surjective and Bijective. Divides. Cartesian Product. Relations. Equivalence Relations
Page 1 Definitions Tuesday, May 8, 2018 12:23 AM Notations " " means "equals, by definition" the set of all real numbers the set of integers Denote a function from a set to a set by Denote the image of
More informationCSC 474 Network Security. Outline. GCD and Euclid s Algorithm. GCD and Euclid s Algorithm Modulo Arithmetic Modular Exponentiation Discrete Logarithms
Computer Science CSC 474 Network Security Topic 5.1 Basic Number Theory  Foundation of Public Key Cryptography CSC 474 Dr. Peng Ning 1 Outline GCD and Euclid s Algorithm Modulo Arithmetic Modular Exponentiation
More informationNOTES ON FINITE FIELDS
NOTES ON FINITE FIELDS AARON LANDESMAN CONTENTS 1. Introduction to finite fields 2 2. Definition and constructions of fields 3 2.1. The definition of a field 3 2.2. Constructing field extensions by adjoining
More informationSets. We discuss an informal (naive) set theory as needed in Computer Science. It was introduced by G. Cantor in the second half of the nineteenth
Sets We discuss an informal (naive) set theory as needed in Computer Science. It was introduced by G. Cantor in the second half of the nineteenth century. Most students have seen sets before. This is intended
More informationLecture 5: Arithmetic Modulo m, Primes and Greatest Common Divisors Lecturer: Lale Özkahya
BBM 205 Discrete Mathematics Hacettepe University http://web.cs.hacettepe.edu.tr/ bbm205 Lecture 5: Arithmetic Modulo m, Primes and Greatest Common Divisors Lecturer: Lale Özkahya Resources: Kenneth Rosen,
More informationIntroduction to Number Theory
INTRODUCTION Definition: Natural Numbers, Integers Natural numbers: N={0,1,, }. Integers: Z={0,±1,±, }. Definition: Divisor If a Z can be writeen as a=bc where b, c Z, then we say a is divisible by b or,
More informationCHAPTER 6. Prime Numbers. Definition and Fundamental Results
CHAPTER 6 Prime Numbers Part VI of PJE. Definition and Fundamental Results 6.1. Definition. (PJE definition 23.1.1) An integer p is prime if p > 1 and the only positive divisors of p are 1 and p. If n
More informationThe primitive root theorem
The primitive root theorem Mar Steinberger First recall that if R is a ring, then a R is a unit if there exists b R with ab = ba = 1. The collection of all units in R is denoted R and forms a group under
More informationCYCLICITY OF (Z/(p))
CYCLICITY OF (Z/(p)) KEITH CONRAD 1. Introduction For each prime p, the group (Z/(p)) is cyclic. We will give seven proofs of this fundamental result. A common feature of the proofs that (Z/(p)) is cyclic
More informationMATH 361: NUMBER THEORY FOURTH LECTURE
MATH 361: NUMBER THEORY FOURTH LECTURE 1. Introduction Everybody knows that three hours after 10:00, the time is 1:00. That is, everybody is familiar with modular arithmetic, the usual arithmetic of the
More informationIntroduction to finite fields
Chapter 7 Introduction to finite fields This chapter provides an introduction to several kinds of abstract algebraic structures, particularly groups, fields, and polynomials. Our primary interest is in
More informationPart II. Number Theory. Year
Part II Year 2017 2016 2015 2014 2013 2012 2011 2010 2009 2008 2007 2006 2005 2017 Paper 3, Section I 1G 70 Explain what is meant by an Euler pseudoprime and a strong pseudoprime. Show that 65 is an Euler
More informationElementary Algebra Chinese Remainder Theorem Euclidean Algorithm
Elementary Algebra Chinese Remainder Theorem Euclidean Algorithm April 11, 2010 1 Algebra We start by discussing algebraic structures and their properties. This is presented in more depth than what we
More informationPart IA Numbers and Sets
Part IA Numbers and Sets Definitions Based on lectures by A. G. Thomason Notes taken by Dexter Chua Michaelmas 2014 These notes are not endorsed by the lecturers, and I have modified them (often significantly)
More informationPRIMALITY TESTING. Professor : Mr. Mohammad Amin Shokrollahi Assistant : Mahdi Cheraghchi. By TAHIRI JOUTI Kamal
PRIMALITY TESTING Professor : Mr. Mohammad Amin Shokrollahi Assistant : Mahdi Cheraghchi By TAHIRI JOUTI Kamal TABLE OF CONTENTS I FUNDAMENTALS FROM NOMBER THEORY FOR RANDOMIZED ALGORITHMS:.page 4 1)
More informationIntroduction to Number Theory 1. c Eli Biham  December 13, Introduction to Number Theory 1
Introduction to Number Theory 1 c Eli Biham  December 13, 2012 206 Introduction to Number Theory 1 Division Definition: Let a and b be integers. We say that a divides b, or a b if d s.t. b = ad. If b
More informationBasic Algebra and Number Theory. Nicolas T. Courtois  University College of London
Basic Algebra and Number Theory Nicolas T. Courtois  University College of London Integers 2 Number Theory Not more than 30 years ago mathematicians used to say Number Theory will be probably last branch
More informationIntroduction to Cryptography. Lecture 6
Introduction to Cryptography Lecture 6 Benny Pinkas page 1 Public Key Encryption page 2 Classical symmetric ciphers Alice and Bob share a private key k. System is secure as long as k is secret. Major problem:
More informationModular Arithmetic and Elementary Algebra
18.310 lecture notes September 2, 2013 Modular Arithmetic and Elementary Algebra Lecturer: Michel Goemans These notes cover basic notions in algebra which will be needed for discussing several topics of
More informationNumbers, Groups and Cryptography. Gordan Savin
Numbers, Groups and Cryptography Gordan Savin Contents Chapter 1. Euclidean Algorithm 5 1. Euclidean Algorithm 5 2. Fundamental Theorem of Arithmetic 9 3. Uniqueness of Factorization 14 4. Efficiency
More informationLecture Notes, Week 6
YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE CPSC 467b: Cryptography and Computer Security Week 6 (rev. 3) Professor M. J. Fischer February 15 & 17, 2005 1 RSA Security Lecture Notes, Week 6 Several
More informationHans Delfs & Helmut Knebl: Kryptographie und Informationssicherheit WS 2008/2009. References. References
Hans Delfs & Helmut Knebl: Kryptographie und Informationssicherheit WS 2008/2009 Die Unterlagen sind ausschliesslich zum persoenlichen Gebrauch der Vorlesungshoerer bestimmt. Die Herstellung von elektronischen
More informationFactorization in Polynomial Rings
Factorization in Polynomial Rings Throughout these notes, F denotes a field. 1 Long division with remainder We begin with some basic definitions. Definition 1.1. Let f, g F [x]. We say that f divides g,
More informationThe Chinese Remainder Theorem
The Chinese Remainder Theorem R. C. Daileda February 19, 2018 1 The Chinese Remainder Theorem We begin with an example. Example 1. Consider the system of simultaneous congruences x 3 (mod 5), x 2 (mod
More informationIntroduction to Cybersecurity Cryptography (Part 5)
Introduction to Cybersecurity Cryptography (Part 5) Prof. Dr. Michael Backes 13.01.2017 February 17 th Special Lecture! 45 Minutes Your Choice 1. Automotive Security 2. Smartphone Security 3. Side Channel
More informationAlgorithms (II) Yu Yu. Shanghai Jiaotong University
Algorithms (II) Yu Yu Shanghai Jiaotong University Chapter 1. Algorithms with Numbers Two seemingly similar problems Factoring: Given a number N, express it as a product of its prime factors. Primality:
More informationA SURVEY OF PRIMALITY TESTS
A SURVEY OF PRIMALITY TESTS STEFAN LANCE Abstract. In this paper, we show how modular arithmetic and Euler s totient function are applied to elementary number theory. In particular, we use only arithmetic
More informationPart IA. Numbers and Sets. Year
Part IA Year 2017 2016 2015 2014 2013 2012 2011 2010 2009 2008 2007 2006 2005 2004 2003 2002 2001 2017 19 Paper 4, Section I 1D (a) Show that for all positive integers z and n, either z 2n 0 (mod 3) or
More informationFinite Fields. Mike Reiter
1 Finite Fields Mike Reiter reiter@cs.unc.edu Based on Chapter 4 of: W. Stallings. Cryptography and Network Security, Principles and Practices. 3 rd Edition, 2003. Groups 2 A group G, is a set G of elements
More information2 More on Congruences
2 More on Congruences 2.1 Fermat s Theorem and Euler s Theorem definition 2.1 Let m be a positive integer. A set S = {x 0,x 1,,x m 1 x i Z} is called a complete residue system if x i x j (mod m) whenever
More informationBeautiful Mathematics
Beautiful Mathematics 1. Principle of Mathematical Induction The set of natural numbers is the set of positive integers {1, 2, 3,... } and is denoted by N. The Principle of Mathematical Induction is a
More information4 PRIMITIVE ROOTS Order and Primitive Roots The Index Existence of primitive roots for prime modulus...
PREFACE These notes have been prepared by Dr Mike Canfell (with minor changes and extensions by Dr Gerd Schmalz) for use by the external students in the unit PMTH 338 Number Theory. This booklet covers
More information= 1 2x. x 2 a ) 0 (mod p n ), (x 2 + 2a + a2. x a ) 2
8. padic numbers 8.1. Motivation: Solving x 2 a (mod p n ). Take an odd prime p, and ( an) integer a coprime to p. Then, as we know, x 2 a (mod p) has a solution x Z iff = 1. In this case we can suppose
More informationNumber Theory Proof Portfolio
Number Theory Proof Portfolio Jordan Rock May 12, 2015 This portfolio is a collection of Number Theory proofs and problems done by Jordan Rock in the Spring of 2014. The problems are organized first by
More informationMATH 4400 SOLUTIONS TO SOME EXERCISES. 1. Chapter 1
MATH 4400 SOLUTIONS TO SOME EXERCISES 1.1.3. If a b and b c show that a c. 1. Chapter 1 Solution: a b means that b = na and b c that c = mb. Substituting b = na gives c = (mn)a, that is, a c. 1.2.1. Find
More information4 Number Theory and Cryptography
4 Number Theory and Cryptography 4.1 Divisibility and Modular Arithmetic This section introduces the basics of number theory number theory is the part of mathematics involving integers and their properties.
More informationDiscrete Mathematics GCD, LCM, RSA Algorithm
Discrete Mathematics GCD, LCM, RSA Algorithm Abdul Hameed http://informationtechnology.pk/pucit abdul.hameed@pucit.edu.pk Lecture 16 Greatest Common Divisor 2 Greatest common divisor The greatest common
More information0 Sets and Induction. Sets
0 Sets and Induction Sets A set is an unordered collection of objects, called elements or members of the set. A set is said to contain its elements. We write a A to denote that a is an element of the set
More informationPublic Key Encryption
Public Key Encryption 3/13/2012 Cryptography 1 Facts About Numbers Prime number p: p is an integer p 2 The only divisors of p are 1 and p s 2, 7, 19 are primes 3, 0, 1, 6 are not primes Prime decomposition
More informationAn integer p is prime if p > 1 and p has exactly two positive divisors, 1 and p.
Chapter 6 Prime Numbers Part VI of PJE. Definition and Fundamental Results Definition. (PJE definition 23.1.1) An integer p is prime if p > 1 and p has exactly two positive divisors, 1 and p. If n > 1
More informationIEEE P1363 / D13 (Draft Version 13). Standard Specifications for Public Key Cryptography
IEEE P1363 / D13 (Draft Version 13). Standard Specifications for Public Key Cryptography Annex A (Informative). NumberTheoretic Background. Copyright 1999 by the Institute of Electrical and Electronics
More informationElementary Number Theory and Cryptography, 2014
Elementary Number Theory and Cryptography, 2014 1 Basic Properties of the Integers Z and the rationals Q. Notation. By Z we denote the set of integer numbers and by Q we denote the set of rational numbers.
More informationA connection between number theory and linear algebra
A connection between number theory and linear algebra Mark Steinberger Contents 1. Some basics 1 2. Rational canonical form 2 3. Prime factorization in F[x] 4 4. Units and order 5 5. Finite fields 7 6.
More information2 ALGEBRA II. Contents
ALGEBRA II 1 2 ALGEBRA II Contents 1. Results from elementary number theory 3 2. Groups 4 2.1. Denition, Subgroup, Order of an element 4 2.2. Equivalence relation, Lagrange's theorem, Cyclic group 9 2.3.
More informationTHESIS. Presented in Partial Fulfillment of the Requirements for the Degree Master of Science in the Graduate School of The Ohio State University
The HasseMinkowski Theorem in Two and Three Variables THESIS Presented in Partial Fulfillment of the Requirements for the Degree Master of Science in the Graduate School of The Ohio State University By
More informationICS141: Discrete Mathematics for Computer Science I
ICS141: Discrete Mathematics for Computer Science I Dept. Information & Computer Sci., Jan Stelovsky based on slides by Dr. Baek and Dr. Still Originals by Dr. M. P. Frank and Dr. J.L. Gross Provided by
More informationDiscrete mathematics I  Number theory
Discrete mathematics I  Number theory Emil Vatai (based on hungarian slides by László Mérai) 1 January 31, 2018 1 Financed from the financial support ELTE won from the Higher Education
More informationSelected Chapters from Number Theory and Algebra
Selected Chapters from Number Theory and Algebra A project under construction Franz Rothe Department of Mathematics University of North Carolina at Charlotte Charlotte, NC 83 frothe@uncc.edu December 8,
More informationThis is a recursive algorithm. The procedure is guaranteed to terminate, since the second argument decreases each time.
8 Modular Arithmetic We introduce an operator mod. Let d be a positive integer. For c a nonnegative integer, the value c mod d is the remainder when c is divided by d. For example, c mod d = 0 if and only
More informationChapter 3. Rings. The basic commutative rings in mathematics are the integers Z, the. Examples
Chapter 3 Rings Rings are additive abelian groups with a second operation called multiplication. The connection between the two operations is provided by the distributive law. Assuming the results of Chapter
More information