COMS W4995 Introduction to Cryptography September 29, Lecture 8: Number Theory

Transcription

1 COMS W4995 Introduction to Cryptography September 29, 2005 Lecture 8: Number Theory Lecturer: Tal Malkin Scribes: Elli Androulaki, Mohit Vazirani Summary This lecture focuses on some basic Number Theory. After proving basic theorems related to prime numbers, this chapter is referred to the extended Euclid s algorithm, Modular Arithmetic, and the groups Z n, Z n and their properties. Recall from the previous lecture... In the last lecture we defined (weak) one-way functions (OWFs) - functions easy to compute and difficult to invert - and collections of One-Way Functions. We also introduced the Factoring Assumption and showed a OWF based on it. 1 Prime-Number Basic Theorems In the last lecture we have mentioned the following theorem: Theorem 1 If the factoring assumption holds, then F = {f i : D i {0, 1} } i I where I = {n N : n is even} and D i = {p, q : p = q = i/2 and p, q are primes} and f i (p, q) = p q is a collection of OWF. In the previous lecture we proved that three of the four conditions that are required to show that F is a collection of OWFs are satisfied. Now we have to prove that condition (2) is also satisfied. Namely, we have to prove that it is feasible in polynomial time to sample random pairs of i 2-bit primes. This is easily proven using the following claim. Claim 2 Choosing a k-bit random integer that is a prime can be done in polynomial time in k. 1

2 Proof: In order to prove the above claim, we state the following facts and corollary and later come up with an algorithm that chooses a k-bit prime integer at random in polynomial time in k. Fact 3 Primality testing can be done in polynomial time. Fact 4 (Prime Number Theorem, Hadamard, de la Vallée-P. 1896) π(x) = O( x x i.e. the number π(x) of primes p x is roughly logx as x Corollary 5 Since the biggest k-bit number is (2 k 1) there are about Algorithm 1 A PPT algorithm to find a random k-bit prime. 1. Choose random k-bit number P {2 k 1,..., 2 k 1} 2. Run a primality test on P. 3. If P is prime then output P, else goto 1. 2 k kln2 k-bit primes. What we need to prove is that the above algorithm is PPT. Because of Corollary 4, the test in step 2 succeeds with probability Ω( 1 k ). Therefore, the expected number of iterations in the algorithm is O(k), namely its expected running time is polynomial. 1 logx ) 2 Review of Number Theory Fact 6 (Extended Euclid s Algorithm) For every two integers x, y two integers a, b such that ax+by = gcd(x, y). Moreover, there is a polynomial time algorithm that computes a, b. This algorithm is called the Extended Euclid s Algorithm (EEA). Following is an example of the application of the EEA. Example 1 gcd(72, 15) 72 = = = = = 15 ( ) = ( 1) 72 gcd = 3 a = 1, b = 5 1 In order to get an algorithm that always runs in polynomial time, we can fix a polynomial bound on the number of iterations, after which the algorithm will halt and output fail. The polynomial can be set large enough so that this happens with negligible probability. 2

3 Modular Arithmetic x y (mod n) if n (x y) Example (mod 12) 3 27 (mod 15) Definition 1 x mod n Unique x {0, 1, 2, 3,..., n 1} s.t. x x (mod n) 2.1 Operations (addition, subtraction, multiplication) x y (mod n) a (x + a y + a (mod n)) x y (mod n) a (x a y a (mod n)) x y (mod n) = a (a x a y (mod n)) Note: The following example demonstrates that we cannot divide in general. Example mod mod Basic Definitions Definition 2 Z n = {0, 1, 2,..., n 1} Example 4 Z 6 = {0, 1, 2, 3, 4, 5} Z 15 = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14} Definition 3 Z n = {x Z n gcd(x, n) = 1} 3

4 Example 5 Z 6 = {1, 5} = {1, 2, 4, 7, 8, 11, 13, 14} Z 15 Fact 7 Z n is the set of all elements in Z n that have a multiplicative inverse. Namely, Z n = {x Z n a : x a = 1 (mod n)} Example = 1 mod = 1 mod 6 Thus, 1, 5 Z n Because of Fact 6, if a Z n, then we can divide by a, namely multiply both sides by a 1 mod n. Definition 4 A group is a set G with a binary operation such that G is closed under the operation : a, b G = a b G. associativity: a (b c) = (a b) c identity: I G : a I = I a = a a G inverse: a G a 1 G : a a 1 = I All of the groups we consider will also be commutative, namely a,b G a b = b a. Example 7 The integers are a group under addition ( + ). The rationals are a group under multiplication ( * ). Fact 8 Z n is a group under + (mod n). The identity element of this group for this operation is element 0. Z n is a group under * (mod n). The identity element of this group for this operation is element 1. Fact 9 For any finite group G, and any x G, if we apply operation in x G times, then we get the Identity element of. x x x x... x = I (Identity element) G times 4

5 Example 8 (Z 15, +(mod n)) ( Z 15 = 15) (mod 15) In general, 15 X 0 mod 15 X (Z 15, (mod n)) ( Z 15 = 8) 4 * 4 * 4 * 4 * 4 * 4 * 4 * 4 1 (mod 15) In general, X 8 1 mod 15 X Note: From this we can simplify many tedious exponential calculations, as we know for example that Z 15 = 8, we can immediately calculate = 1 mod 15. Definition 5 Euler s Totient Function Φ(n) = Z n Fact 10 if p is prime, then Φ(p) = p 1 Fact 11 if n = p α i i for distinct primes p i : Φ(n) = p α i 1 i (p i 1) Example 9 15 = 5 * 3 Φ(15) = Φ(5) Φ(3) = (5 1) (3 1) = 4 2 = 8 Fact 9 implies the following theorem. Theorem 12 x Z n, x Φ(n) 1 (mod n) Special case for primes (Fermat s little theorem): If p is prime then x Z n, x p 1 1 mod p 5