p 1 MAX(a,b) + MIN(a,b) = a+b n m means that m is a an integer multiple of n. Greatest Common Divisor: We say that n divides m.

Transcription

1 Great Theoretical Ideas In Computer Science Steven Rudich CS - Spring Lecture Feb, Carnegie Mellon University Modular Arithmetic and the RSA Cryptosystem p- p MAX(a,b) + MIN(a,b) = a+b n m means that m is a an integer multiple of n. We say that n divides m. True: -66, False: Greatest Common Divisor: GCD(x,y) = greatest k s.t. k x and k y. GCD: Greatest Common Divisor What is the GCD of and? = 6 = Common factors: and Answer: 6 Least Common Multiple: LCM(x,y) = smallest k s.t. x k and y k.. Prop: GCD(x,y) = xy/lcm(x,y) LCM(x,y) = xy/gcd(x,y)

2 GCD(x,y) = xy/lcm(x,y) LCM(x,y) = xy/gcd(x,y) x = = ; y= = GCD(,) = LCM(,) = = xy = GCD(x,y) LCM(x,y) = xy MAX(a,b) + MIN(a,b) = a+b (a mod n) means the remainder when a is divided by n. If ad + r = n, r < n Then r = (a mod n) and d = (a div n) Modular equivalence of integers a and b: a b [mod n] a n b a and b are equivalent modulo n iff (a mod n) = (b mod n) iff n (a-b) equals modulo [mod ] ( mod ) = = ( mod ) (- ) n is an equivalence relation In other words, Reflexive: a n a Symmetric: (a n b) (b n a) Transitive: (a n b and b n c) (a n c)

3 a n b n (a-b) a and b are equivalent modulo n n induces a natural partition of the integers into n classes: a and b are said to be in the same residue class or congruence class exactly when a n b. a n b n (a-b) a and b are equivalent modulo n Define the residue class [i] to be the set of all integers that are congruent to i modulo n. Residue Classes Mod : [] = {, -6, -,,, 6,..} [] = {, -, -,,,,..} [] = {, -, -,,,,..} [-6] = {, -6, -,,, 6,..} [] = {, -, -,,,,..} [-] = {, -, -,,,,..} Equivalence mod n implies equivalence mod any divisor of n. If (x n y) and (k n) Then: x k y Example: If (x n y) and (k n) Then: x k y Proof: Recall, x n y n (x-y) k n and n (x-y) Hence, k (x-y) Of course, k (x-y) x k y Fundamental lemma of plus, minus, and times modulo n: If (x n y) and (a n b) Then: ) x+a n y+b ) x-a n y-b ) xa n yb

4 Equivalently, If n (x-y) and n (a-b) Then: ) n (x-y + a-b) ) n (x-y [a-b]) ) n (xa-yb) Proof of : xa-yb = a(x-y) y(b-a) n a(x-y) and n y(b-a) Fundamental lemma of plus minus, and times modulo n: When doing plus, minus, and time modulo n, I can at any time in the calculation replace a number with a number in the same residue class modulo n A Unique Representation System Modulo n: Please calculate in your head: mod - = - = We pick exactly one representative from each residue class. We do all our calculations using the representatives. Unique representation system modulo Finite set S = {,, } + and defined on S: Unique representation system modulo Finite set S = {,, -} + and defined on S:

5 The reduced system modulo n: Z n = {,,,, n-} Define + n and n : a + n b = (a+b mod n) a n b = (ab mod n) Z n = {,,,, n-} a + n b = (a+b mod n)a n b = (ab mod n) + n and n are associative binary operators from Z n X Z n Z n : When = + n or n : [Closure] x,y Z n x y Z n [Associativity] x,y,z Z n ( x y ) z = x ( y z ) Z n = {,,,, n-} a + n b = (a+b mod n)a n b = (ab mod n) + n and n are commutative, associative binary operators from Z n X Z n Z n : The reduced system modulo Z = {,, } Two binary, associative operators on Z : [Commutativity] x,y Z n x y = y x + The reduced system modulo Z = {, } The Boolean interpretation of Z = {, } means FALSE means TRUE Two binary, associative operators on Z : + + XOR AND

6 The reduced system Z = {,,,} + The reduced system Z = {,,,,} + The reduced system Z 6 = {,,,,,} + The reduced system Z 6 = {,,,,,} + An operator has the permutation property if each row and each column has a permutation of the elements. For every n, + n on Z n has the permutation property + An operator has the permutation property if each row and each column has a permutation of the elements. There are exactly distinct multiples of modulo. 6

7 There are exactly distinct multiples of modulo. There are exactly distinct multiples of modulo. 6 6 There are exactly distinct multiples of modulo. There are exactly distinct multiples of modulo There are exactly distinct multiples of modulo. There are exactly distinct multiples of modulo. 6 6

8 There are exactly distinct multiples of modulo. There are exactly distinct multiples of modulo. 6 6 There are exactly distinct multiples of modulo. There are exactly distinct multiples of modulo 6 6 There is exactly distinct multiple of modulo There are exactly distinct multiples of 6 modulo 6 6

9 There are exactly distinct multiples of 6 modulo There are exactly distinct multiples of 6 modulo 6 6 There are exactly distinct multiples of 6 modulo There are exactly distinct multiples of 6 modulo 6 6 There are exactly? distinct multiples of? modulo? There are exactly LCM(n,c)/c distinct multiples of c modulo n Can you see the general rule?

10 There are exactly LCM(n,c)/c distinct multiples of c modulo n There are exactly n/(nc/lcm(n,c)) distinct multiples of c modulo n There are exactly n/gcd(c,n) distinct multiples of c modulo n The multiples of c modulo n is the set: {, c, c + n c, c + n c + n c,.} = {kc mod n k n- } Multiples of 6 6 Theorem: There are exactly k= n/gcd(c.n) = LCM(c,n)/c distinct multiples of c modulo n: { ci mod n i < k } Clearly, c/gcd(c,n) is a whole number ck = n [c/gcd(c,n)] n There are k distinct multiples of c mod n: c, c, c,, c(k- ) k is all the factors of n missing from c cx n cy n c(x- y) k (x- y) x- y k There are k multiples of c Is there a fundamental lemma of division modulo n? cx n cy x n y? Is there a fundamental lemma of division modulo n? cx n cy x n y? NO! If c= [mod n], cx n cy for any x and y. Canceling the c is like dividing by zero. Repaired fundamental lemma of division modulo n? c (mod n), cx n cy x n y? 6, but not , but not.

11 When can I divide by c? Theorem: There are exactly n/gcd(c.n) distinct multiples of c modulo n. Corollary: If GCD(c,n) >, then the number of multiples of c is less than n. Corollary: If GCD(c,n)> then you can t always divide by c. Proof: There must exist distinct x,y<n such that cx=cy (but x y) Fundamental lemma of division modulo n. GCD(c,n)=, ca n cb a n b ab = ac mod n n ( ab ac) n a( b c) n b c since ( a, n) = b= c mod n Fundamental lemma of division modulo n. Corollary for general c: cx n cy x n/gcd(c,n) y cx n cy cx n/(c,n) cy and ( c, n/gcd(c,n) )= x n/(c,n) y GCD(c,n)=, ca n cb a n b Z n = {x Z n GCD(x,n) =} Multiplication over Z n will have the cancellation property. Z 6 = {,,,,,} Z 6 = {,} Suppose GCD(x,n) = and GCD(y,n) = + Let z = xy and z = (xy mod n) It is obvious that GCD(z,n) = It requires a moment to convince ourselves that GCD(z,n) =

12 Z n = {x Z n GCD(x,n) =} Z = {,,,} n is an associative, binary operator. In particular, Z n is closed under n : x,y Z n x n y Z n. Proof: Let z = xy. Let z = z mod n. z = z + kn. Suppose there exists a prime p> p z and p n. z is the sum of two multiples of p, so p z. p z that p x or p y. Contradiction of x,y Z n Z The column permutation property is equivalent to the right cancellation property: [b a = c a] b=c b c a The row permutation property is equivalent to the left cancellation property: Z = {,,,} [a b = a c] b=c b c a

13 Euler Phi Function Φ(n) = size of z n Z = {,,,} φ() = = number of <=k<n that are relatively prime to n. p prime Z p = {,,,,p-} Φ(p) = p- φ(pq) = (p-)(q-) if p,q distinct primes pq = # of numbers from to pq p = # of multiples of q up to pq q = # of multiples of p up to pq = # of multiple of both p and q up to pq Let s consider how we do arithmetic in Z n and in Z n φ(pq) = pq p q + = (p-)(q-) The additive inverse of a Z n is the unique b Z n such that a + n b n. We denote this inverse by a. It is trivial to calculate: -a = (n-a). The multiplicative inverse of a Z n is the unique b Z n such that a n b n. We denote this inverse by a - or /a. The unique inverse of a must exist because the a row contains a permutation of the elements and hence contains a unique. a b

14 Z n = {,,,, n- } Z n = {x Z n GCD(x,n) =} Define + n and n : a + n b = (a+b mod n) a n b = (ab mod n) c n ( a + n b) n (c n a) + n (c n b) <Z n, + n >. Closed. Associative. is identity. Additive Inverses. Cancellation 6. Commutative <Z n, n >. Closed. Associative. is identity. Multiplicative Inverses. Cancellation 6. Commutative The multiplicative inverse of a Z n is the unique b Z n such that a n b n. We denote this inverse by a - or /a. Efficient algorithm to compute a - from a and n. Execute the Extended Euclid Algorithm on a and n (previous lecture). It will give two integers r and s such that: ra + sn = (a,n) = Taking both sides mod n, we obtain: rn n Output r, which is the inverse of a If (a n b) Then x a n x b? Fundamental lemma of powers? If (a n b) Then x a n x b? NO! (6 ), but it is not the case that: 6 Calculate a b mod n: Except for b, work in a reduced mod system to keep all intermediate results less than b log (n) c + bits long. Phase I (Repeated Multiplication) For log b steps multiply largest so far by a (a, a, a, ) Phase II (Make a b from bits and pieces) Expand n in binary to see how n is the sum powers of. Assemble a b by multiplying together appropriate powers of a. Two names for the same set: Z n = Z a n Z na = {a n x x Z n }, a Z n b c a

15 Two products on the same set: Z n = Z n a Z na = {a n x x Z n }, a Z n Euler s Theorem a Z n, a Φ(n) n x n Π ax [as x ranges over Z n ] x n x (a size of Zn ) [Commutativity] = a size of Zn [Cancellation] a Φ(n) = Fermat s Little Theorem p prime, a Z p a p- p Fundamental lemma of powers. Suppose x Z n, and a,b,n are naturals. If a Φ(n) b Then x a n x b Equivalently, x amod Φ(n) n xbmod Φ(n) Defining negative powers. Suppose x Z n, and a,n are naturals. x -a is defined to be the multiplicative inverse of X a X -a = (X a ) - Rule of integer exponents Suppose x,y Z n, and a,b are integers. (xy) - n x - y - X a X b n X a+b Lemma of integer powers. Suppose x Z n, and a,b are integers. If a Φ(n) b Then x a n x b Equivalently, x amod Φ(n) n xbmod Φ(n)

16 Z n = {,,,, n-} Z n = {x Z n GCD(x,n) =} Quick raising to power. <Z n, + n >. Closed. Associative. is identity. Additive Inverses Fast + amd -. Cancellation 6. Commutative <Z n, n >. Closed. Associative. is identity. Multiplicative Inverses Fast and /. Cancellation 6. Commutative Euler Phi Function Φ(n) = size of z n p prime Z p = {,,,,p-} Φ(p) = p- φ(pq) = (p-)(q-) if p,q distinct primes The RSA Cryptosystem Rivest, Shamir, and Adelman (9) RSA is one of the most used cryptographic protocols on the net. Your browser uses it to establish a secure session with a site. Pick secret, random k-bit primes: p,q Publish : n = pq φ(n) = φ(p) φ(q) = (p-)(q-) Pick random e Z φ(n) Publish : e Compute d = inverse of e in Z φ(n) Hence, ed = [ mod φ(n) ] Private Key : d p,q random primes, e random Z φ(n) n = pq ed = [ mod φ(n) ] p,q prime, e random Z φ(n) n = pq ed = [ mod φ(n) ] n,e is my public key. Use it to send a message to me. n,e m

17 p,q prime, e random Z φ(n) n = pq ed = [ mod φ(n) ] p,q prime, e random Z φ(n) n = pq ed = [ mod φ(n) ] n,e m n,e m m e [mod n] m e [mod n] (m e ) d n m