/
Spring 2017    •    Lecture 16 Spring 2017    •    Lecture 16

Spring 2017 • Lecture 16 - PowerPoint Presentation

leusemij
leusemij . @leusemij
Follow
344 views
Uploaded On 2020-07-02

Spring 2017 • Lecture 16 - PPT Presentation

B 50 4 I 538 Introduction to Cryptography 20170302 Tuesdays lecture Oneway permutations OWPs PRGs from OWPs Todays lecture Basic number theory So far secret key ID: 792594

gcd mod modulo prime mod gcd prime modulo integer theorem common integers divisor lcm multiple inverse divide positive fermat

Share:

Link:

Embed:

Download Presentation from below link

Download The PPT/PDF document "Spring 2017 • Lecture 16" is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.


Presentation Transcript

Slide1

Spring 2017 • Lecture 16

B504/I538: Introduction to Cryptography

(2017—03—02)

Slide2

Tuesday’s lecture:One-way permutations (OWPs)PRGs from OWPsToday’s lecture:Basic number theory

So far:

“secret key”

cryptography

Going forward:

“public key”

cryptography

1

Slide3

DivisibilityThe set of integers is ℤ={…,-3,-2,-1, 0, 1, 2, 3,…}Let a and b be any two integersDefn: b is called a divisor of a ifWe write b | a (read “b divides a”) to indicate that b is a divisor of

aand b ∤ a to indicate that b is not a divisor of a∃c∈ℤ such that a=bc???

If

b | a

, then

a

is called a multiple of b

Defn:

a

is called a

prime

if

a>1

and

???

b | a

implies that

b∈{±1,±a}

2

Slide4

DivisibilityDoes 6 divide 12?Does 6 divide 6?Does 0 divide 6?Does 6 divide 0?Does 4 divide 6?Does 1 divide 6?YES! (Because 6·2=12)YES! (Because 6·1=6) No! (Because

0·c=0 for all c∈ℤ)YES! (Because 6·0=0) No! (Because 4·1<6 and 4·2>6)Yes! (Because 1·6=6)every integer divides itself

1 divides every integer

every integer divides 0

only 0 divides 0

3

Slide5

Division AlgorithmThm: Let a, b∈ℤ with b>0. Then there exist unique integers q, r∈ℤ such that a=b·q+r and 0≤r<b.The integer q is called the quotient and r the remainder upon division of a by b.

If b | a, then r=If b>a, then q= and r=a=17 and b=5 ⇒a=-23 and b=6 ⇒a=20 and b=5 ⇒????

??

0

0

aq=3 and r=2

, since 17 =5·3+2q=-4 and r=1, since

-23=6·(-4) +1q=4

and

r=0

, since

20=5·4+0

????

????

????

4

Slide6

??????Greatest common divisors (GCDs)Defn: The greatest common divisor of two non-zero integers a and b isThe greatest common divisor of a and b is denoted gcd(a, b). the largest positive divisor of a that is also a divisor of b

.???gcd(4, 15)=gcd

(4, 10)=

gcd

(2

2 · 32 · 5, 2 · 33 ·

72)=1

22 ·

3

2

Def

n

:

a

and

b

are

relatively

prime

if

???

gcd

(a, b)=1

a.k.a

co-prime

5

Slide7

Least common multiples (LCMs)Defn: The least common multiple of two non-zero integers a and b isThe least common multiple of a and b is denoted by lcm(a, b). the smallest positive multiple of a that is also a multiple of b.???

lcm(4, 15)=lcm(4, 10)=lcm(4, 8)=lcm(22 · 32 · 5, 2 ·

3

3

·

72)=??????

60 (4=22 and

15=3·5)20 (4=2

2

and

10=2·5

)

8

(

4=2

2

and

8=2

3)

??

2

2

·

3

3

· 5

·

7

2

6

Slide8

Let a, b∈ℤ with a>0 and b>0, let d=gcd(a, b) and let m=lcm(a, b). Then a·b=d·m If c | a and c | b, then c | d If a | s and b | s, then m | sBezout’s identity: There exist integers (unique) s and t such that d=as+bt.Properties of GCDs and LCMs

a·b=gcd(a, b)·lcm(a,b)every common divisordivides the gcdevery common multipleis a multiple of the lcm“gcd is a linear combination”7

Slide9

Fact 1: If b | a, then gcd(a, b)=bFact 2: If a=b·q+r, then gcd(a, b)=gcd(b, r) (Assume that a>b; if not, swap a and b) Idea: Apply Facts 1 and 2 repeatedly, using the Division Algorithm to write a=b·q+r at each stepa = q 0 b +r0b = q

1 r0+r1r0 = q 2 r1+r2r1 = q 3 r2+r3 ⋮ rk-3= q k-1rk-2+rk-10 = q

k

r

k-1+rkExtended Euclidean Algorithm

gcd

(a, b)

r

0

= a-q

0

b

r

1

= b-q

3

r

0

r

k-3

= r

k-5

– q

k-3

r

k-4

r

k-2

= r

k-4

-q

k-2

r

k-3

gcd

(a, b)= r

k-3

-q

k-1

r

k-2

function

gcd

(

a,b

)

{

while

(a ≠ b)

{

if

(a >b)

a := a − b;

else

b := b − a;

}

return

a

;

repeated substitution

yields

s,t

such that

as+bt

=

gcd

(

a,b

)

8

Pseudocode:

Slide10

Euclid’s LemmaEuclid’s Lemma: Let a and b be integers. If p is a prime such that p | a·b, then p | a or p | b (or both).Proof: Assume W.L.O.G. that p is prime and p | a·b but p ∤ a. We prove that p | b.First note that p ∤ a with p prime implies that gcd(a, p)=1; thus, by

Bezout’s Theorem, there exist integer s and t such that as+pt=1.Multiplying both sides of this expression by b yields bas+bpt=(ab)s+p(bt)=b.Now, p | (ab)s by assumption and clearly p | p(bt); hence,

p | (

bas+bpt

)

.But bas+bpt=b and it therefore follows that p | b, as desired. ☐ 9

Slide11

Fundamental Theorem of ArithmeticFundamental Theorem of Arithmetic: Let n>1 be an arbitrary integer. Then n is a product of (powers of) primes, and this product is unique (up to the order of the prime powers)In other words, every n>1 can be “factored” into primes inone—and only one—way.10

Slide12

Clock arithmeticQ:If it is 10:00 am now, what time will it be in 6 hours?A:4:00 pmQ:If it is 2:00 pm now, what time was it 3 hours ago?A:11:00 amQ:It is currently October. What month will it be 25 months from now?A: NovemberQ:On Mercury, each day is 1407 hours long. If it is 1200

:00 now, what time will it be in 500 hours?A:293:00 (=1700:00-1407:00)11

Slide13

3 ≡ mod 26 ≡ mod 211≡ mod 362 ≡ mod 85????

????10262Modular arithmeticDefn: Let a, r, n∈ℤ with n>1 and 0≤r<n. Then

a

is

congruent

to r modulo n ifWe write a≡r mod n to indicate that a is congruent to r modulo n.

Thm: Let

a, b, and n be integers with n≥1, then

a≡b

mod n

if and only if

n | a-b

.

12

a=

q·n+r

, as in the

Division Algorithm

.

???

Slide14

Notational conventionsp and q typically denote prime numbersn is always a positive integer, which may or may not (though usually not) be primeℤn≔{0, 1, 2, …, n-1} with arithmetic modulo n℥n ≔{ a∈ℤn | gcd(a, n)=1 } with arithmetic modulo n13

Slide15

2 (since 2·2=4=3·1+1≡1 mod 3)2 (since 3·2=6=5·1+1≡1 mod 5)Modular inversionDefn: Let a∈ℤn. The (multiplicative) inverse of a modulo n is an element b∈ℤn such thatThe inverse of a modulo n is denoted by a

-1.a·b≡1 mod n??2

-1

≡ mod 3

3

-1 ≡ mod 52-1 ≡ mod 6Let n be any odd integer. Then 2-1 ≡ mod n??

????

??⊥ (i.e., the inverse does not exist!)

(n+1)/2

14

Slide16

Modular inversesQ: Which elements of ℤ have inverses modulo n?Thus, a∈ℤn has an inverse modulo n if and only if a∈℥n Q: Given a∈℥n, how do you compute a-1 mod n?A: By definition, a·a-1≡1 mod n ⇒ a·a-1=1+t·n for some t Hence, a·a-1+(-t)·n=gcd(a, n) ⇒ a-1

≡s from Bezout’s Theorem Thus, we can use the Extended Euclidean AlgorithmThm: An integer a∈ℤ has an inverse modulo n if and only if gcd(a, n)=1.

Corollary:

If

p

is a prime, then a has an inverse modulo p if and only if a is not a multiple of p; i.e., ℥p={1, 2, …, p-1}.

15

Slide17

Solving linear equations modulo nThm: For any integer n>1, there exists an integer x such that ax≡b mod n if and only if gcd(a, n) | b.

Q: Does 6x≡18 mod 36 have a solution?A: YES! Because gcd(6, 18)=6 and 6 | 18 In fact, it has 6 solutions in ℤn:3, 9, 15, 21, 27, 33Q: Does 2x≡5 mod 10 have a solution?A: NO! Because gcd(2, 10)=2 and 2 ∤ 516

Slide18

Corollary: For all a∈ℤp, ap≡a mod p. 34≡ mod 584112≡ mod 11379

561≡ mod 113Trick: To compute ax mod p, reduce the base (i.e., a) modulo p and the exponent (i.e., x) modulo p-11??????Fermat’s Little TheoremFermat’s Little Theorem: Let p be a prime. Then for every a∈℥

p

, we have

a

p-1≡1 mod p.79 (since 561=5·(113-1)+1)117

Slide19

Proof of Fermat’s Little TheoremTo prove Fermat’s Little Theorem, we first prove the following lemma.Lemma: If n is an integer and a∈℥n, then a·k1≡a·k2 mod n if and only if k1≡k2 mod n.18Proof: Suppose k1a≡k2a. Since a∈℥n, there exists an inverse a

-1∈℥n such that a·a-1≡1 mod n. Therefore, (k1a) a-1≡ (k2a) a-1 mod n. But (k1a) a-1=k

1

(a·a

-1

)≡k1 mod p and (k2 a) a-1= k

2 (a·a-1)≡k2 mod p

; hence, it follows that k1≡k2 mod p

, as desired. ☐

Slide20

Proof of Fermat’s Little TheoremProof: Consider the product a·(2a)·(3a)⋯((p-1)a) mod p.By the lemma on the previous slide, it follows that the above product is congruent to (p-1)!=1·2·3⋯(p-1) mod p. (Indeed, it is clearly a product of p-1 numbers from ℥p; if these numbers aren’t distinct, then we obtain an immediate contradiction.)In other words, we have that a·(2a)·(3a)⋯((p-1)a)≡1·2·3⋯(p-1) mod p.Rearranging the left-hand side, we get ap-1(p-1)!≡(p-1)! mod p.Thus, a second application of the lemma shows that ap-1≡1 mod p. ☐19

Fermat’s Little Theorem: Let p be a prime. Then for every a∈℥p, we have ap-1≡1 mod p.

Slide21

Generating random (probable) primesGoal: Generate a random n-bit primeStep 1: Choose n∈R [2n+1, 2n+1-1] Step 2: Check if 2n-1 ≡ 1 mod n If so, output n; otherwise, go to Step 120If n is prime, then Pr[2n-1≡ 1]=1If n is not prime, then

Pr[2n-1≡1] is “small”- Unless you get unlucky and n is a Carmichael number…

Slide22

Chinese Remainder TheoremChinese Remainder Theorem: Let n1, n2, …, nk be positive integers with gcd(ni, nj)=1 whenever i≠j, and let N=n1·n2⋯nk.Then the system of congruence relationsx≡ c1 mod n1 ⋮x≡ ck mod

nkhas a unique solution in ℤN.For each i=1,…,k, set yi ≡ (N/ni)-1 mod ni and zi

≡(N/

n

i

)·yi mod NThe unique solution is x≡∑zi·c

i mod N21

z

i

≡1 mod

n

i

z

i

≡0 mod

n

j

when

i≠j

Slide23

Euler’s phi functionDefn: Let n be a positive integer. Then Euler’s phi function is φ(n)≔|℥n|. In particular, Euler’s phi function of n indicates the number of positive integer less than and relatively prime to n.Thm (Fermat restatement): If p is prime, then ∀a∈℥p

, aφ(p)≡ 1 mod p.

If

p

is prime, then

φ(p)=If p is prime, then φ(p2)=If p is prime, then φ(

pk)=If p and q

are distinct prime, then φ(p·q)=

If n=p

1

e

1

p

2

e

2

⋯p

k

e

k

, then

φ

(n)=

22

p-1

p(p-1)

p

k-1

(p-1)

(p-1)(q-1)

??

??

??

??

p

1

e

1

-1

(p

1

-1) p

2

e

2

-1

(p

2

-1) ⋯p

k

e

k

-1

(p

k

-1)

??

Slide24

??Euler’s TheoremEuler’s Theorem: For any integer n>1 and a∈℥n, aφ(n)≡1 mod n.23Generalization of Fermat’s Little Theorem

34≡ mod 108440≡ mod 10079441≡ mod 100The last two digits of 10381 are Trick: To compute ax mod n, reduce the base (i.e., a) modulo n and the exponent (i.e., x) modulo φ(n)

1

(since

φ

(100)=5·(5-1)·2·(2-1)=40)????79 (since

441=11·φ(100)+1)1

??01 (since

103

81

≡3 mod 100

)

Slide25

That’s all for today, folks!24