Problem Set 6 Solutions Math 158, Fall 2016

Size: px
Start display at page:

Download "Problem Set 6 Solutions Math 158, Fall 2016"

Transcription

1 All exercise numbers from the textbook refer to the second edition. 1. (a) Textbook exercise 3.3 (this shows, as we mentioned in class, that RSA decryption always works when the modulus is a product of two primes, regardless of whether the original message was a unit modulo N or not). (b) Suppose that Bob publishes a public key N = 117, e = 5 (note that this is not an RSA public key, since 117 isn t a product of two primes), and he requests that Alice encrypt her message m (where 0 m < N) by sending him c m e (mod N), as in RSA. Find two different messages m 1, m 2 which give the same ciphertext. This shows that Bob cannot always decrypt messages unambiguously in this system. (Try to find m 1 and m 2 using a principle that you would be able to generalize, rather than by guess-and-check). Note. In general, unique decryption will be possible as long as N is squarefree, meaning it is not divisible by any square. For example, decryption is always possible if N = pqr, where p, q, r are distinct prime (see problem 11). (a) Suppose that x c d (mod pq). We wish to show that x e c (mod pq). In other words, we wish to show that c de c (mod pq). By the Chinese remainder theorem, it suffices to prove that both c de c (mod p) and c de c (mod q). Since de 1 (mod (p 1)(q 1)) by assumption, we may write de = 1 + k(p 1)(q 1) for some integer k. Consider first the congruence modulo p. There are two cases: p c and p c. First, if p c, then Fermat s little theorem implies that c p 1 1 (mod p). Therefore c de = c (c p 1 ) k(q 1) c 1 k(q 1) c (mod p), as desired. The second case is p c. In this case, both c and c de are congruent to 0 modulo p, so certainly c de c (mod p). The congruence modulo q is established in exactly the same way. So c de c is divisible by both p and q, hence it is divisible by pq, and c de c (mod pq). Note. All that was needed was that de 1 was divisible by both (p 1) and (q 1), which is slightly weaker than being divisible by their product. (b) Note that 117 = Observe that by the Chinese remainder theorem, two numbers are congruent modulo 117 if and only if they are congruent modulo 9 and also congruent modulo 13. One option is to choose two integers m 1, m 2 which are congruent modulo 13, both divisible by 3, yet not congruent modulo 9. Then it is guaranteed that m 5 1 m5 2 (mod 13) (since m 1 m 2 (mod 13)), and both m 1, m 2 will be divisible by 3 5, hence both congruent to 0 (mod 9) (and congruent to each other). For example, one could solve m 1 1 (mod 13) m 2 1 (mod 13) m 1 3 (mod 9) m 2 6 (mod 9) to obtain m 1 66 (mod 117) and m (mod 117). Indeed these satisfy m 5 1 m (mod 117). Note. In fact, one can show that this is the only way to construct such pairs: one must choose numbers that are congruent modulo 13, but with different remainder modulo 9, both chosen from {0, 3, 6} (so that both are divisible by 3). 2. Textbook exercise 3.6. Due the night of Thursday 10/27 (hard deadline 4am on 10/28). page 1 of 13

2 (a) As explained in class, we can solve this congruence by finding d e 1 (mod φ(n)) (which exists since we are assuming gcd(e, φ(n)) = 1), and then computing c d (mod φ(n)). The reason given in class is that: since c is a unit modulo N, any solution x must be a unit as well (any common factor of x and N would be a common factor of x e and N), so Euler s formula implies c φ(n) 1 (mod N). Since de = 1 + kφ(n) for some integer k, it follows that c d x de x (x φ(n) ) k x (mod N). So any solution x satisfies x c d (mod N). Conversely, if x c d (mod N), then x e c de c (mod N) by the same reasoning. (b) i. N = 1463 factors into primes as , so φ(n) = (7 1)(11 1)(19 1) = The inverse of e = 577 modulo 1080 is 73. So the answer is (mod 1463), which simplifies to 1390 (mod 1463). ii. N = 1625 factors into primes as , so φ(n) = N(1 1 5 )( ) = = = The inverse of 959 modulo 1200 is 239. Therefore we compute (mod 1625). iii. N = factors into primes as Therefore φ(n) = (2 2 1)(3 2)(4)(7 6)(11 10) = (in the second step of this computation, I have used the fact that p e (1 1 p ) = pe 1 (p 1), applied to each prime individually, to simplify the expression in exercise 3.5(d)). The inverse of modulo is Therefore we compute (mod ) 3. Textbook exercise (a) The way we discussed finding decryption exponents in class, one would have d e 1 (mod φ(n)), hence φ(n) (de 1). So one can employ the following idea: construct several encryption-decryption pairs with your magic box, and compute the greatest common divisor of the various numbers de 1. Hopefully, this will be a small multiple of φ(n) (or better yet, φ(n) itself). Once we know φ(n) and N, we can factor N using the quadratic formula (see Remark 3.11). As long as we take encryption-decryption pairs, its unlikely that the various numbers de 1 will have a common factor larger than φ(n) (see Homework 2, problem 1). Unfortunately, there is a small wrinkle: this is not the only way to find decryption exponents. Indeed, Remark 3.6 points out that it s enough to make sure de 1 (mod (p 1)(q 1)/g), where g = gcd(p 1, q 1). In fact, this is both necessary and sufficient 1. It s possible that your magic box is giving exponents satisfying this weaker condition (indeed, the examples in parts (b) through (d) are of this form). The good news is that this only adds a bit of complication: if we choose enough key pairs, the gcd of the numbers de 1 will be some multiple of (p 1)(q 1)/g, and very possibly (p 1)(q 1)/g itself. Then we can try to guess φ(n) by taking a multiple of this gcd that is close to N (note that φ(n) = N p q + 1, so its order of magnitude will be close to N). 1 One way to prove this is to show that de must be congruent to 1 modulo p 1 and modulo q 1, which shows that de 1 is divisible by the least common multiple of p 1 and q 1; one can then argue that this least common multiple is (p 1)(q 1)/g. Due the night of Thursday 10/27 (hard deadline 4am on 10/28). page 2 of 13

3 This strategy may seem a big loose (and doesn t carry guarantees), but the following examples shows that is can be made to work. (b) We begin by finding the gcd of the numbers de 1. >>> from fractions import gcd >>> N = >>> e = [ , ] >>> d = [ , ] >>> gcd(d[0]*e[0]-1,d[1]*e[1]-1) This is too small to be φ(n), but it could very plausibly be φ(n)/2 (e.g. if gcd(p 1, q 1) = 2), since it is just under half of N (and we know that φ(n) is only a little less than N in relative terms). Going with this assumption, let s attempt to compute p, q as outlined in Remark >>> M = gcd(d[0]*e[0]-1,d[1]*e[1]-1) >>> phi = 2*M >>> b = N - phi + 1 # This should be p+q. We ll solve X^2 - bx + N = 0. >>> import math # So that I can use sqrt >>> p = (b-math.sqrt(b*b - 4*N))/2 >>> q = (b+math.sqrt(b*b - 4*N))/2 >>> p,q (5347.0, ) # Reported with decimals since sqrt was used. Indeed, this worked! We can check that = N. (c) We can proceed similarly to before, but now we take the gcd of three numbers. Here is the transcript from the python terminal. >>> N = >>> e = [ , , ] >>> d = [ , , ] >>> M = gcd( gcd(d[0]*e[0]-1,d[1]*e[1]-1),d[2]*e[2]-1) >>> float(n)/m >>> phi = 6 * M # Seems like a reasonable guess >>> b = N - phi + 1 # Should be p+q >>> p = (b-math.sqrt(b*b-4*n))/2 >>> q = (b+math.sqrt(b*b-4*n))/2 >>> print p,q >>> p*q #Success! (d) Similar to before: >>> N = >>> e = [ , , ] >>> d = [ , , ] >>> M = gcd( gcd(d[0]*e[0]-1,d[1]*e[1]-1), d[2]*e[2]-1 ) >>> float(n)/m Due the night of Thursday 10/27 (hard deadline 4am on 10/28). page 3 of 13

4 >>> phi = 10*M # Seems like a good guess >>> b = N - phi + 1 >>> p = (b + math.sqrt(b*b-4*n) )/2 >>> q = (b - math.sqrt(b*b-4*n) )/2 >>> print p,q >>> p*q Textbook exercise (a) The primes less than 100 are 2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53, 59, 61, 67, 71, 73, 79, 83, 89, 97 There are 25 total. Of these, the first 8 are less than 20, and two more are less than 30. So π(20) = 8, π(30) = 10, π(100) = 25. (b) There are a number of ways to count primes that will be fast enough to count up to For the sake of variety, the code below illustrates the sieve of Eratosthenes, which is a very old and reasonably quick way to do it (search online to find details and history). def primestobound(n): isprime = [True]*(N+1) primes = [] for p in xrange(2,n+1): if not(isprime[p]): continue primes += [p] k = p while k<=n/p: isprime[k*p] = False k += 1 return primes def pi(n): return len(primestobound(n)) Using the function pi(n), we can empirically examine the ratio π(x)/(x/ ln(x)) as follows. >>> from math import log >>> for X in [100,1000,10000,100000]:... print X,pi(X),pi(X)/(X/log(X)) Due the night of Thursday 10/27 (hard deadline 4am on 10/28). page 4 of 13

5 From these data, the prime number theorem looks plausible enough, although one might conjecture that the limit is closer to 1.1 than to 1 itself. More data would be needed to clearly see the convergence to Textbook exercise (a) We can sort the primes up to 100 into congruence classes modulo 4 as follows. 0 (mod 4) : (none) 1 (mod 4) : 5, 13, 17, 29, 37, 41, 53, 61, 73, 89, 97 2 (mod 4) : 2 Just by counting, we obtain: 3 (mod 4) : 3, 7, 11, 19, 23, 31, 43, 47, 59, 67, 71, 79, 83 π 1 (10) = 1 π 1 (25) = 3 π 1 (100) = 11 π 3 (10) = 2 π 3 (25) = 5 π 3 (100) = 13 Note that these are are fairly close to each other, but π 3 is always one or two larger than π 1. (b) Using a previously written function primestobound(n) that gives a list of all primes N, there are various ways to count the number of elements in a given congruence class. Here is a particularly pythonic one-liner for this. def pi(n,rem,modulus): return len([p for p in primestobound(n) if p%modulus == rem]) Using this function, we can interrogate the relationship between π 1 and π 3 as follows. >>> for X in [100,1000,10000,100000]:... print X, pi(x,1,4), pi(x,3,4), float(pi(x,3,4))/pi(x,1,4) (c) These data suggest that, asymptotically speaking π 1 (X) and π 3 (X) are the same their ratio seems to go to 1. Furthermore, the data suggest that this ratio approaches 1 from above, not below, i.e. that more primes are 3 (mod 4) than 1 (mod 4) (by a shrinking margin in relative terms). One might conjecture that π 3 (X) > π 1 (X) for all X. The investigation of this conjecture (and related questions) is described in Granville and Martin s very interesting article Prime Number Races, which you can find here: Ford/granville1.pdf, The conjecture turns out to be false, but one needs to look at more data to determine this. 6. For each integer n between 1,000,000 and 1,000,009 inclusive, determine the proportion of the numbers from 1 to n 1 inclusive that are Miller-Rabin witnesses. Which of these numbers are prime? (The figures you obtain should convince you that the 75% figure from Rabin s theorem is rather conservative, and explains why most people are not worried about using only a few Miller-Rabin trials to test primality). Due the night of Thursday 10/27 (hard deadline 4am on 10/28). page 5 of 13

6 We first require a function is witness(a,n) that determines whether or not a is a witness modulo n. See the solution to problem 9 for one implementation. With this in hand, we can determine these proportions as follows. >>> for n in xrange( , ):... wits = 0... for a in xrange(1,n):... if is_witness(a,n): wits += 1... print n, float(wits)/(n-1) One of these numbers is prime: (since it has no witnesses to compositness). The others are composite. Note that in all cases, at least 99.5% of the candidates are witnesses. So even a single Miller-Rabin trial is quite conclusive (at least for these choices of n). 7. Textbook exercise (We will discuss Pollard s algorithm in class on Monday). (a) Here s what happens when I arbitrarily choose a = 2, and start raising it to larger and larger powers as prescribed by Pollard. At each step, I check whether gcd(a 1, n) has become interesting yet. >>> n = 1739 >>> a = 2 >>> gcd(a-1,n) 1 >>> a = pow(a,2,n) >>> gcd(a-1,n) 1 >>> a = pow(a,3,n) >>> gcd(a-1,n) 1 >>> a = pow(a,5,n) >>> gcd(a-1,n) 1 >>> a = pow(a,6,n) >>> gcd(a-1,n) 37 After 6 tries, a factor is found: p = 37. The other is 1739/37 = 47. The reason that this worked so quickly is that p 1 = 36 = ; these are both very small primes, so very quickly (for small k) 2 k! 1 (mod 37). Due the night of Thursday 10/27 (hard deadline 4am on 10/28). page 6 of 13

7 (b) This time, I ll automate the process a bit. To keep track of how things evolve, I ll print the value of a at each step, and stop once gcd(a 1, n) > 1. As before, I ll use a = 2 for simplicity. >>> n = >>> i = 1 >>> a = 2 >>> while True:... print i,a,gcd(a-1,n)... if gcd(a-1,n) > 1: break... i += 1... a = pow(a,i,n) Again, this didn t take too long. We found the factor p = 449, because 2 8! 1 (mod n). This worked because = 448 factors into 2 8 7, which divides 8!. (c) We proceed like before. >>> n = >>> a = 2 >>> i = 1 >>> while True:... print i,a,gcd(a-1,n)... if gcd(a-1,n) > 1: break... i += 1... a = pow(a,i,n) Due the night of Thursday 10/27 (hard deadline 4am on 10/28). page 7 of 13

8 So after getting to 2 19! (mod n), we found one factor: p = The other is n/p = This worked because factors into small primes: it is This divides 19!, which is why we found the factor once 2 19! (mod n) was computed. 8. Suppose that p is a large prime (e.g bits), g is a primitive root modulo p, and Alice has an Elgamal public key A corresponding to a private key a (that is, A g a (mod p), and Alice knows the number a). Bob does not believe that Alice actually knows the private key a corresponding to A, so she asks her to solve the following challenge to prove it. Bob will give Alice a positive integer d of his choosing. Alice must return (in a reasonable amount of time) two integers b, c such that g b b c A d (mod p). If she succeeds, Bob will be convinved that Alice really does know her private key. (a) Describe a procedure that Alice can use to solve Bob s challenge efficiently. Hint. Choose an integer e at random, and choose b to be g e (mod p). Then find a choice of c. (b) Explain briefly why Bob should be convinced that Eve (or anyone else who doesn t know the private key) would not be able to carry out the procedure you describe in part (a). Note. This exercise prefigures the basic idea behind Elgamal digital signatures, which we will discuss soon. You can solve this problem without knowing anything about signatures, however. (a) Following the hint, suppose that Alice begins by choosing an integer k at random and setting b g k (mod p) (we ll see shortly that she shouldn t choose it completely at random, but impose a mild condition; this will come out in the analysis). We still need to choose c. At this stage, she is attempting to solve the congruence g b g kc g ad (mod p), i.e. g b+kc ad 1 (mod p). Since g is a primitive root, it s order is p 1, and this congruence is equivalent to (p 1) (b + kc ad), i.e. b + kc ad 0 (mod p 1). But all of the variables in this congruence have been fixed except one: Alice needs merely solve for c to obtain c k 1 (ad b) (mod p 1). Note that there is one tricky point here: she can only do this if she previously chose k relatively prime to p 1, so that it has an inverse modulo p 1. But that s no problem: she got to chose k herself, so she can just make sure to choose k relatively prime to p 1. (b) In order to carry out this process, Alice needed to use her knowledge of the secret key a in a crucial way. Without it, she would not have been able to write the congruence entirely in terms of powers of g, which was the crucial step to move from modulo p to modulo p 1. (It is conceivable that there is a completely different route to solving the congruence that doesn t require knowing a, of course; but the method outlined in part (a) cannot be adapted.) Due the night of Thursday 10/27 (hard deadline 4am on 10/28). page 8 of 13

9 Programming problems Full formulation and submission: 9. Determine whether a given integer N (up to 1024 bits long) is prime or not. Here is one implementation of the Miller-Rabin primality test. We first write a method to test if a specific integer a is a witness for n, then write a wrapper function that simply calls this function on 100 randomly chosen values of a, seeing if any one of them turn out to be witnesses. To save time, it is sensible not to finish all 100 trials once we have found even one witness; the function returns right away in this case. import random # Determines whether a is a Miller-Rabin witness of n def is_witness(a,n): q = n-1 k = 0 while q%2 == 0: q /= 2 k += 1 b = pow(a,q,n) if b == 1: return False for i in xrange(k): if b == n-1: return False b = b*b % n return True # Miller-Rabin test, with 100 trials by default def is_prime(n, trials=100): for i in xrange(trials): a = random.randrange(1,n) if is_witness(a,n): return False return True n = int(raw_input()) if is_prime(n): print prime else: print composite 10. Generate two prime numbers p, q, of specified length (number of bits), such that p 1 (mod q), along with a number g {1, 2,, p 1} such that ord[g] p = q. Hint. See exercise 1.33 in the textbook for a useful fact that can help you create g (Problem Set 2, number 6). Note. Generating p, q, g of this form is important for choosing parameters for the DSA system, which we will discuss soon. Due the night of Thursday 10/27 (hard deadline 4am on 10/28). page 9 of 13

10 First, we must decide how to create p and q. If we choose p first, then finding q will be difficult: we would need to factor p 1. It is easier to go in the opposite order: we can first choose q, and then choose p of the form p = 1 + kq. As discussed in class, if k is chosen at random, then the odds of 1 + kq being prime are about the same as the odds that any other integer of that size is prime, so we can expect to find a prime fairly quickly. One issue that must be sorted out is what range to choose k in when hunting for p. We can work this out by solving the inequalities 2 pbits kq 2 pbits 1, obtaining 2 pbits 1 1 q k 2pbits 2. q As long as we choose k in that range, we ll get values of p of the right size. The next matter to consider is how to find the integer g of order q. Here we follow the hint and invoke the result of exercise 1.33 in the textbook (Problem set 2, problem 6): if we just choose a number a {1, 2,, p 1} at random, and set g a (p 1)/q (mod p), then (a) As long as g 1 (mod p), it will be an element of order q, as desired, and (b) With probability 1 1 q, g won t be 1 (mod p). Probability 1 1 q is high enough that we ll find such a g in very short order (if q is over 64 bits or so in length, as it would be in applications, 1 1 q is so close to 1 that you would not expect to ever need to try more that one random value of a in this process). Here s a sample implementation (if you haven t seen the syntax 1 << n before: it just does the same thing as 2 n, but it s more universal across other programming languages). ### Omitted: is_prime function from previous problem. # Make a random prime of given size def makeprime(bits): while True: p = random.randrange(1<<(bits-1), 1<<bits) if is_prime(p): return p # Make a prime of a given size, in a given congruence class def makeprimeincongclass(bits, rem, modulus): # Find p as rem + k*modulus for some k. Must find min and max possible k. # mink is (2^(bits-1) - rem)/modulus, rounded up. # Rounding up is achieved by adding modulus-1 before division. mink = ((1<<(bits-1))-rem + modulus - 1)/modulus # maxk is (2^bits rem)/modulus, rounded down. maxk = ((1<<bits) rem)/modulus while True: k = random.randrange(mink,maxk+1) p = rem+modulus*k if is_prime(p): return p def dsaparams(qbits,pbits): q = makeprime(qbits) Due the night of Thursday 10/27 (hard deadline 4am on 10/28). page 10 of 13

11 p = makeprime(pbits,1,q) g = 1 # Just to make the while loop run the first time while g == 1: a = random.randrange(1,p) g = pow(a,(p-1)/q,p) return p,q,g qbits,pbits = map(int,raw_input().split()) p,q,g = dsaparams(qbits,pbits) print p,q,g 11. Alice decides that she wants to receive messages using a non-standard variant of RSA. Like in the usual RSA, she will choose a public key N, e, where N is a number whose factorization she knows, and gcd(e, φ(n)) = 1. In this case, she will take N = pqr, where p, q, r are distinct primes. To encrypt a message m for Alice (0 m < N), Bob computes c m e (mod N). Given the three primes p, q, r, the number e, and the ciphertext c sent by Bob, recover the original plaintext m. Note. While this setup is perfectly functional, in practice it is more efficient to use products of two primes, hence that is the standard. I encourage you to think about why it is more efficient to use only two primes. We proceed as in problem 3 of this problem set, using φ(pqr) = (p 1)(q 1)(r 1). We can simply invert e modulo φ(pqr) and use it as a decryption exponent. ### Omitted: impementation of extended Euclidean algorithm p,q,r,e,c = map(int,raw_input().split()) N = p*q*r phi = (p-1)*(q-1)*(r-1) d = ext_euclid(e,phi)[0] % phi print pow(c,d,n) 12. You will be given an RSA modulus (a product of two distinct primes), 112 bits in length. Factor it if possible. The primes will have been chosen completely at random, i.e. no effort has been made to avoid weak primes. As a result, some of the moduli will be susceptible to Pollard s algorithm (which we discuss in class on Monday), but not all. You are not expected to solve all, or even most, of the test cases; a score of 10/50 (as listed on hackerrank; this corresponds to 20 out of 100 test cases correct) will be regarded as full points in the actual grading spreadsheet. If you devise a problem to solve more testcases than these, you will receive extra credit. Here s one implementation of Pollard s p 1 algorithm that solves 20/100 test cases (10/50 points). It differs from the presentation of the book in two main ways: (a) Rather than choosing one value of a (like a = 2), it runs a series of trials (until one succeeds), choosing a different a at random each time. Due the night of Thursday 10/27 (hard deadline 4am on 10/28). page 11 of 13

12 (b) Instead of stopping at some chosen value for the exponent, it only stops once either a factor is found or a becomes 1 (mod N). Both are detected in the same way: the gcd of a 1 and N becomes greater than 1. import random,fractions # Use Pollard s algorithm to find SOME factor of N # It s possible that it will return N itself def pollard_findfact(n): a = random.randrange(1,n) # Check first whether a is a unit. If not, you have a factor. if fractions.gcd(a,n)!= 1: return fractions.gcd(a,n) j = 2 while fractions.gcd(a-1,n) == 1: a = pow(a,j,n) j += 1 return fractions.gcd(a-1,n) def pollard(n): p = N while p == N: p = pollard_findfact(n) q = N/p if p<q: return p,q else: return q,p # I/O N = int(raw_input()) p,q = pollard(n) print p,q There are a number of ways to try to improve this algorithm to squeeze the runtime down by a constant factor and get a few more test cases in the time limit. One way is suggested in the book: only compute gcd(a 1, N) periodically (not after every step). This saves more time than you would expect; the divide operations needed in the Euclidean algorithm are somewhat more expensive than the multiplications in the fast-powering algorithm. In case you are curious, the following code is the most effective program I found after a fair bit of experimentation. I would not be surprised if it is possible to squeeze still better performance out with some different ideas. This program is able to solve 38/100 test cases within the time limit (19/50 points). I encourage you to puzzle out the ideas underlying this code, and am happy to explain it during office hours. The basic idea is to reach up to larger primes in the exponent more rapidly by skipping any numbers that have already-present factors in them (in this case, we include large powers of 2, 3, 5, 7, 11, and 13 at the beginning, and then skip multiples of any of these primes for the rest of the program). Do note, however, that it is not any better asymptotically than the much easier-to-implement solution above; it just squeezes the Due the night of Thursday 10/27 (hard deadline 4am on 10/28). page 12 of 13

13 constant factor in the runtime down somewhat. In real applications you probably wouldn t want to do this sort of optimization unless you re planning to run a program for a period of weeks or months. import random,fractions smallprimes = 2*3*5*7*11*13 remainders = [i for i in xrange(smallprimes) if fractions.gcd(i,smallprimes)==1] # Use Pollard s algorithm to find SOME factor of N # It s possible that it will return N itself def pollard_findfact(n): a = random.randrange(1,n) for p in [2,3,5,7,11,13]: a = pow(a,p**50,n) if fractions.gcd(a-1,n) > 1: return fractions.gcd(a-1,n) j = 0 while fractions.gcd(a-1,n) == 1: for r in remainders: a = pow(a,smallprimes*j+r,n) j += 1 return fractions.gcd(a-1,n) def pollard(n): while True: p = pollard_findfact(n) assert(p > 1) if p < N: q = N/p if p<q: return p,q else: return q,p Due the night of Thursday 10/27 (hard deadline 4am on 10/28). page 13 of 13

Data security (Cryptography) exercise book

Data security (Cryptography) exercise book University of Debrecen Faculty of Informatics Data security (Cryptography) exercise book 1 Contents 1 RSA 4 1.1 RSA in general.................................. 4 1.2 RSA background.................................

More information

Solutions for the Practice Final

Solutions for the Practice Final Solutions for the Practice Final 1. Ian and Nai play the game of todo, where at each stage one of them flips a coin and then rolls a die. The person who played gets as many points as the number rolled

More information

Assignment 2. Due: Monday Oct. 15, :59pm

Assignment 2. Due: Monday Oct. 15, :59pm Introduction To Discrete Math Due: Monday Oct. 15, 2012. 11:59pm Assignment 2 Instructor: Mohamed Omar Math 6a For all problems on assignments, you are allowed to use the textbook, class notes, and other

More information

Cryptography, Number Theory, and RSA

Cryptography, Number Theory, and RSA Cryptography, Number Theory, and RSA Joan Boyar, IMADA, University of Southern Denmark November 2015 Outline Symmetric key cryptography Public key cryptography Introduction to number theory RSA Modular

More information

Number Theory/Cryptography (part 1 of CSC 282)

Number Theory/Cryptography (part 1 of CSC 282) Number Theory/Cryptography (part 1 of CSC 282) http://www.cs.rochester.edu/~stefanko/teaching/11cs282 1 Schedule The homework is due Sep 8 Graded homework will be available at noon Sep 9, noon. EXAM #1

More information

6. Find an inverse of a modulo m for each of these pairs of relatively prime integers using the method

6. Find an inverse of a modulo m for each of these pairs of relatively prime integers using the method Exercises Exercises 1. Show that 15 is an inverse of 7 modulo 26. 2. Show that 937 is an inverse of 13 modulo 2436. 3. By inspection (as discussed prior to Example 1), find an inverse of 4 modulo 9. 4.

More information

NUMBER THEORY AMIN WITNO

NUMBER THEORY AMIN WITNO NUMBER THEORY AMIN WITNO.. w w w. w i t n o. c o m Number Theory Outlines and Problem Sets Amin Witno Preface These notes are mere outlines for the course Math 313 given at Philadelphia

More information

The Chinese Remainder Theorem

The Chinese Remainder Theorem The Chinese Remainder Theorem Theorem. Let n 1,..., n r be r positive integers relatively prime in pairs. (That is, gcd(n i, n j ) = 1 whenever 1 i < j r.) Let a 1,..., a r be any r integers. Then the

More information

MA/CSSE 473 Day 9. The algorithm (modified) N 1

MA/CSSE 473 Day 9. The algorithm (modified) N 1 MA/CSSE 473 Day 9 Primality Testing Encryption Intro The algorithm (modified) To test N for primality Pick positive integers a 1, a 2,, a k < N at random For each a i, check for a N 1 i 1 (mod N) Use the

More information

EE 418: Network Security and Cryptography

EE 418: Network Security and Cryptography EE 418: Network Security and Cryptography Homework 3 Solutions Assigned: Wednesday, November 2, 2016, Due: Thursday, November 10, 2016 Instructor: Tamara Bonaci Department of Electrical Engineering University

More information

Solutions to Problem Set 6 - Fall 2008 Due Tuesday, Oct. 21 at 1:00

Solutions to Problem Set 6 - Fall 2008 Due Tuesday, Oct. 21 at 1:00 18.781 Solutions to Problem Set 6 - Fall 008 Due Tuesday, Oct. 1 at 1:00 1. (Niven.8.7) If p 3 is prime, how many solutions are there to x p 1 1 (mod p)? How many solutions are there to x p 1 (mod p)?

More information

Calculators will not be permitted on the exam. The numbers on the exam will be suitable for calculating by hand.

Calculators will not be permitted on the exam. The numbers on the exam will be suitable for calculating by hand. Midterm #2: practice MATH 311 Intro to Number Theory midterm: Thursday, Oct 20 Please print your name: Calculators will not be permitted on the exam. The numbers on the exam will be suitable for calculating

More information

Cryptography. 2. decoding is extremely difficult (for protection against eavesdroppers);

Cryptography. 2. decoding is extremely difficult (for protection against eavesdroppers); 18.310 lecture notes September 2, 2013 Cryptography Lecturer: Michel Goemans 1 Public Key Cryptosystems In these notes, we will be concerned with constructing secret codes. A sender would like to encrypt

More information

Discrete Mathematics & Mathematical Reasoning Multiplicative Inverses and Some Cryptography

Discrete Mathematics & Mathematical Reasoning Multiplicative Inverses and Some Cryptography Discrete Mathematics & Mathematical Reasoning Multiplicative Inverses and Some Cryptography Colin Stirling Informatics Some slides based on ones by Myrto Arapinis Colin Stirling (Informatics) Discrete

More information

b) Find all positive integers smaller than 200 which leave remainder 1, 3, 4 upon division by 3, 5, 7 respectively.

b) Find all positive integers smaller than 200 which leave remainder 1, 3, 4 upon division by 3, 5, 7 respectively. Solutions to Exam 1 Problem 1. a) State Fermat s Little Theorem and Euler s Theorem. b) Let m, n be relatively prime positive integers. Prove that m φ(n) + n φ(m) 1 (mod mn). Solution: a) Fermat s Little

More information

Calculators will not be permitted on the exam. The numbers on the exam will be suitable for calculating by hand.

Calculators will not be permitted on the exam. The numbers on the exam will be suitable for calculating by hand. Midterm #: practice MATH Intro to Number Theory midterm: Thursday, Nov 7 Please print your name: Calculators will not be permitted on the exam. The numbers on the exam will be suitable for calculating

More information

Cryptography Math 1580 Silverman First Hour Exam Mon Oct 2, 2017

Cryptography Math 1580 Silverman First Hour Exam Mon Oct 2, 2017 Name: Cryptography Math 1580 Silverman First Hour Exam Mon Oct 2, 2017 INSTRUCTIONS Read Carefully Time: 50 minutes There are 5 problems. Write your name legibly at the top of this page. No calculators

More information

Discrete Math Class 4 ( )

Discrete Math Class 4 ( ) Discrete Math 37110 - Class 4 (2016-10-06) 41 Division vs congruences Instructor: László Babai Notes taken by Jacob Burroughs Revised by instructor DO 41 If m ab and gcd(a, m) = 1, then m b DO 42 If gcd(a,

More information

CHAPTER 2. Modular Arithmetic

CHAPTER 2. Modular Arithmetic CHAPTER 2 Modular Arithmetic In studying the integers we have seen that is useful to write a = qb + r. Often we can solve problems by considering only the remainder, r. This throws away some of the information,

More information

Public Key Encryption

Public Key Encryption Math 210 Jerry L. Kazdan Public Key Encryption The essence of this procedure is that as far as we currently know, it is difficult to factor a number that is the product of two primes each having many,

More information

Collection of rules, techniques and theorems for solving polynomial congruences 11 April 2012 at 22:02

Collection of rules, techniques and theorems for solving polynomial congruences 11 April 2012 at 22:02 Collection of rules, techniques and theorems for solving polynomial congruences 11 April 2012 at 22:02 Public Polynomial congruences come up constantly, even when one is dealing with much deeper problems

More information

Math 255 Spring 2017 Solving x 2 a (mod n)

Math 255 Spring 2017 Solving x 2 a (mod n) Math 255 Spring 2017 Solving x 2 a (mod n) Contents 1 Lifting 1 2 Solving x 2 a (mod p k ) for p odd 3 3 Solving x 2 a (mod 2 k ) 5 4 Solving x 2 a (mod n) for general n 9 1 Lifting Definition 1.1. Let

More information

Diffie-Hellman key-exchange protocol

Diffie-Hellman key-exchange protocol Diffie-Hellman key-exchange protocol This protocol allows two users to choose a common secret key, for DES or AES, say, while communicating over an insecure channel (with eavesdroppers). The two users

More information

SOLUTIONS TO PROBLEM SET 5. Section 9.1

SOLUTIONS TO PROBLEM SET 5. Section 9.1 SOLUTIONS TO PROBLEM SET 5 Section 9.1 Exercise 2. Recall that for (a, m) = 1 we have ord m a divides φ(m). a) We have φ(11) = 10 thus ord 11 3 {1, 2, 5, 10}. We check 3 1 3 (mod 11), 3 2 9 (mod 11), 3

More information

DUBLIN CITY UNIVERSITY

DUBLIN CITY UNIVERSITY DUBLIN CITY UNIVERSITY SEMESTER ONE EXAMINATIONS 2013 MODULE: (Title & Code) CA642 Cryptography and Number Theory COURSE: M.Sc. in Security and Forensic Computing YEAR: 1 EXAMINERS: (Including Telephone

More information

The Chinese Remainder Theorem

The Chinese Remainder Theorem The Chinese Remainder Theorem Theorem. Let m and n be two relatively prime positive integers. Let a and b be any two integers. Then the two congruences x a (mod m) x b (mod n) have common solutions. Any

More information

Math 319 Problem Set #7 Solution 18 April 2002

Math 319 Problem Set #7 Solution 18 April 2002 Math 319 Problem Set #7 Solution 18 April 2002 1. ( 2.4, problem 9) Show that if x 2 1 (mod m) and x / ±1 (mod m) then 1 < (x 1, m) < m and 1 < (x + 1, m) < m. Proof: From x 2 1 (mod m) we get m (x 2 1).

More information

Public Key Cryptography Great Ideas in Theoretical Computer Science Saarland University, Summer 2014

Public Key Cryptography Great Ideas in Theoretical Computer Science Saarland University, Summer 2014 7 Public Key Cryptography Great Ideas in Theoretical Computer Science Saarland University, Summer 2014 Cryptography studies techniques for secure communication in the presence of third parties. A typical

More information

Fermat s little theorem. RSA.

Fermat s little theorem. RSA. .. Computing large numbers modulo n (a) In modulo arithmetic, you can always reduce a large number to its remainder a a rem n (mod n). (b) Addition, subtraction, and multiplication preserve congruence:

More information

Primitive Roots. Chapter Orders and Primitive Roots

Primitive Roots. Chapter Orders and Primitive Roots Chapter 5 Primitive Roots The name primitive root applies to a number a whose powers can be used to represent a reduced residue system modulo n. Primitive roots are therefore generators in that sense,

More information

Practice Midterm 2 Solutions

Practice Midterm 2 Solutions Practice Midterm 2 Solutions May 30, 2013 (1) We want to show that for any odd integer a coprime to 7, a 3 is congruent to 1 or 1 mod 7. In fact, we don t need the assumption that a is odd. By Fermat s

More information

Solutions for the Practice Questions

Solutions for the Practice Questions Solutions for the Practice Questions Question 1. Find all solutions to the congruence 13x 12 (mod 35). Also, answer the following questions about the solutions to the above congruence. Are there solutions

More information

CMath 55 PROFESSOR KENNETH A. RIBET. Final Examination May 11, :30AM 2:30PM, 100 Lewis Hall

CMath 55 PROFESSOR KENNETH A. RIBET. Final Examination May 11, :30AM 2:30PM, 100 Lewis Hall CMath 55 PROFESSOR KENNETH A. RIBET Final Examination May 11, 015 11:30AM :30PM, 100 Lewis Hall Please put away all books, calculators, cell phones and other devices. You may consult a single two-sided

More information

Linear Congruences. The solutions to a linear congruence ax b (mod m) are all integers x that satisfy the congruence.

Linear Congruences. The solutions to a linear congruence ax b (mod m) are all integers x that satisfy the congruence. Section 4.4 Linear Congruences Definition: A congruence of the form ax b (mod m), where m is a positive integer, a and b are integers, and x is a variable, is called a linear congruence. The solutions

More information

University of British Columbia. Math 312, Midterm, 6th of June 2017

University of British Columbia. Math 312, Midterm, 6th of June 2017 University of British Columbia Math 312, Midterm, 6th of June 2017 Name (please be legible) Signature Student number Duration: 90 minutes INSTRUCTIONS This test has 7 problems for a total of 100 points.

More information

Exam 1 7 = = 49 2 ( ) = = 7 ( ) =

Exam 1 7 = = 49 2 ( ) = = 7 ( ) = Exam 1 Problem 1. a) Define gcd(a, b). Using Euclid s algorithm comute gcd(889, 168). Then find x, y Z such that gcd(889, 168) = x 889 + y 168 (check your answer!). b) Let a be an integer. Prove that gcd(3a

More information

Introduction to Modular Arithmetic

Introduction to Modular Arithmetic 1 Integers modulo n 1.1 Preliminaries Introduction to Modular Arithmetic Definition 1.1.1 (Equivalence relation). Let R be a relation on the set A. Recall that a relation R is a subset of the cartesian

More information

Mathematics Explorers Club Fall 2012 Number Theory and Cryptography

Mathematics Explorers Club Fall 2012 Number Theory and Cryptography Mathematics Explorers Club Fall 2012 Number Theory and Cryptography Chapter 0: Introduction Number Theory enjoys a very long history in short, number theory is a study of integers. Mathematicians over

More information

Public-key Cryptography: Theory and Practice

Public-key Cryptography: Theory and Practice Public-key Cryptography Theory and Practice Department of Computer Science and Engineering Indian Institute of Technology Kharagpur Chapter 5: Cryptographic Algorithms Common Encryption Algorithms RSA

More information

Final exam. Question Points Score. Total: 150

Final exam. Question Points Score. Total: 150 MATH 11200/20 Final exam DECEMBER 9, 2016 ALAN CHANG Please present your solutions clearly and in an organized way Answer the questions in the space provided on the question sheets If you run out of room

More information

UNIVERSITY OF MANITOBA DATE: December 7, FINAL EXAMINATION TITLE PAGE TIME: 3 hours EXAMINER: M. Davidson

UNIVERSITY OF MANITOBA DATE: December 7, FINAL EXAMINATION TITLE PAGE TIME: 3 hours EXAMINER: M. Davidson TITLE PAGE FAMILY NAME: (Print in ink) GIVEN NAME(S): (Print in ink) STUDENT NUMBER: SEAT NUMBER: SIGNATURE: (in ink) (I understand that cheating is a serious offense) INSTRUCTIONS TO STUDENTS: This is

More information

SOLUTIONS FOR PROBLEM SET 4

SOLUTIONS FOR PROBLEM SET 4 SOLUTIONS FOR PROBLEM SET 4 A. A certain integer a gives a remainder of 1 when divided by 2. What can you say about the remainder that a gives when divided by 8? SOLUTION. Let r be the remainder that a

More information

Discrete Square Root. Çetin Kaya Koç Winter / 11

Discrete Square Root. Çetin Kaya Koç  Winter / 11 Discrete Square Root Çetin Kaya Koç koc@cs.ucsb.edu Çetin Kaya Koç http://koclab.cs.ucsb.edu Winter 2017 1 / 11 Discrete Square Root Problem The discrete square root problem is defined as the computation

More information

Lecture 32. Handout or Document Camera or Class Exercise. Which of the following is equal to [53] [5] 1 in Z 7? (Do not use a calculator.

Lecture 32. Handout or Document Camera or Class Exercise. Which of the following is equal to [53] [5] 1 in Z 7? (Do not use a calculator. Lecture 32 Instructor s Comments: This is a make up lecture. You can choose to cover many extra problems if you wish or head towards cryptography. I will probably include the square and multiply algorithm

More information

Introduction. and Z r1 Z rn. This lecture aims to provide techniques. CRT during the decription process in RSA is explained.

Introduction. and Z r1 Z rn. This lecture aims to provide techniques. CRT during the decription process in RSA is explained. THE CHINESE REMAINDER THEOREM INTRODUCED IN A GENERAL KONTEXT Introduction The rst Chinese problem in indeterminate analysis is encountered in a book written by the Chinese mathematician Sun Tzi. The problem

More information

CMPSCI 250: Introduction to Computation. Lecture #14: The Chinese Remainder Theorem David Mix Barrington 4 October 2013

CMPSCI 250: Introduction to Computation. Lecture #14: The Chinese Remainder Theorem David Mix Barrington 4 October 2013 CMPSCI 250: Introduction to Computation Lecture #14: The Chinese Remainder Theorem David Mix Barrington 4 October 2013 The Chinese Remainder Theorem Infinitely Many Primes Reviewing Inverses and the Inverse

More information

Wilson s Theorem and Fermat s Theorem

Wilson s Theorem and Fermat s Theorem Wilson s Theorem and Fermat s Theorem 7-27-2006 Wilson s theorem says that p is prime if and only if (p 1)! = 1 (mod p). Fermat s theorem says that if p is prime and p a, then a p 1 = 1 (mod p). Wilson

More information

Constructions of Coverings of the Integers: Exploring an Erdős Problem

Constructions of Coverings of the Integers: Exploring an Erdős Problem Constructions of Coverings of the Integers: Exploring an Erdős Problem Kelly Bickel, Michael Firrisa, Juan Ortiz, and Kristen Pueschel August 20, 2008 Abstract In this paper, we study necessary conditions

More information

ON THE EQUATION a x x (mod b) Jam Germain

ON THE EQUATION a x x (mod b) Jam Germain ON THE EQUATION a (mod b) Jam Germain Abstract. Recently Jimenez and Yebra [3] constructed, for any given a and b, solutions to the title equation. Moreover they showed how these can be lifted to higher

More information

Distribution of Primes

Distribution of Primes Distribution of Primes Definition. For positive real numbers x, let π(x) be the number of prime numbers less than or equal to x. For example, π(1) = 0, π(10) = 4 and π(100) = 25. To use some ciphers, we

More information

Number Theory. Konkreetne Matemaatika

Number Theory. Konkreetne Matemaatika ITT9131 Number Theory Konkreetne Matemaatika Chapter Four Divisibility Primes Prime examples Factorial Factors Relative primality `MOD': the Congruence Relation Independent Residues Additional Applications

More information

Solutions to Exam 1. Problem 1. a) State Fermat s Little Theorem and Euler s Theorem. b) Let m, n be relatively prime positive integers.

Solutions to Exam 1. Problem 1. a) State Fermat s Little Theorem and Euler s Theorem. b) Let m, n be relatively prime positive integers. Solutions to Exam 1 Problem 1. a) State Fermat s Little Theorem and Euler s Theorem. b) Let m, n be relatively rime ositive integers. Prove that m φ(n) + n φ(m) 1 (mod mn). c) Find the remainder of 1 008

More information

Solutions for the 2nd Practice Midterm

Solutions for the 2nd Practice Midterm Solutions for the 2nd Practice Midterm 1. (a) Use the Euclidean Algorithm to find the greatest common divisor of 44 and 17. The Euclidean Algorithm yields: 44 = 2 17 + 10 17 = 1 10 + 7 10 = 1 7 + 3 7 =

More information

L29&30 - RSA Cryptography

L29&30 - RSA Cryptography L29&30 - RSA Cryptography CSci/Math 2112 20&22 July 2015 1 / 13 Notation We write a mod n for the integer b such that 0 b < n and a b (mod n). 2 / 13 Calculating Large Powers Modulo n Example 1 What is

More information

1 Introduction to Cryptology

1 Introduction to Cryptology U R a Scientist (CWSF-ESPC 2017) Mathematics and Cryptology Patrick Maidorn and Michael Kozdron (Department of Mathematics & Statistics) 1 Introduction to Cryptology While the phrase making and breaking

More information

CMPSCI 250: Introduction to Computation. Lecture #14: The Chinese Remainder Theorem David Mix Barrington 24 February 2012

CMPSCI 250: Introduction to Computation. Lecture #14: The Chinese Remainder Theorem David Mix Barrington 24 February 2012 CMPSCI 250: Introduction to Computation Lecture #14: The Chinese Remainder Theorem David Mix Barrington 24 February 2012 The Chinese Remainder Theorem Infinitely Many Primes Reviewing Inverses and the

More information

Math 127: Equivalence Relations

Math 127: Equivalence Relations Math 127: Equivalence Relations Mary Radcliffe 1 Equivalence Relations Relations can take many forms in mathematics. In these notes, we focus especially on equivalence relations, but there are many other

More information

DUBLIN CITY UNIVERSITY

DUBLIN CITY UNIVERSITY DUBLIN CITY UNIVERSITY SEMESTER ONE EXAMINATIONS 2013/2014 MODULE: CA642/A Cryptography and Number Theory PROGRAMME(S): MSSF MCM ECSA ECSAO MSc in Security & Forensic Computing M.Sc. in Computing Study

More information

DTTF/NB479: Dszquphsbqiz Day 30

DTTF/NB479: Dszquphsbqiz Day 30 DTTF/NB479: Dszquphsbqiz Day 30 Announcements: Questions? This week: Digital signatures, DSA Coin flipping over the phone RSA Signatures allow you to recover the message from the signature; ElGamal signatures

More information

MAT 302: ALGEBRAIC CRYPTOGRAPHY. Department of Mathematical and Computational Sciences University of Toronto, Mississauga.

MAT 302: ALGEBRAIC CRYPTOGRAPHY. Department of Mathematical and Computational Sciences University of Toronto, Mississauga. MAT 302: ALGEBRAIC CRYPTOGRAPHY Department of Mathematical and Computational Sciences University of Toronto, Mississauga February 27, 2013 Mid-term Exam INSTRUCTIONS: The duration of the exam is 100 minutes.

More information

Foundations of Cryptography

Foundations of Cryptography Foundations of Cryptography Ville Junnila viljun@utu.fi Department of Mathematics and Statistics University of Turku 2015 Ville Junnila viljun@utu.fi Lecture 10 1 of 17 The order of a number (mod n) Definition

More information

Application: Public Key Cryptography. Public Key Cryptography

Application: Public Key Cryptography. Public Key Cryptography Application: Public Key Cryptography Suppose I wanted people to send me secret messages by snail mail Method 0. I send a padlock, that only I have the key to, to everyone who might want to send me a message.

More information

Modular Arithmetic. Kieran Cooney - February 18, 2016

Modular Arithmetic. Kieran Cooney - February 18, 2016 Modular Arithmetic Kieran Cooney - kieran.cooney@hotmail.com February 18, 2016 Sums and products in modular arithmetic Almost all of elementary number theory follows from one very basic theorem: Theorem.

More information

Cryptography CS 555. Topic 20: Other Public Key Encryption Schemes. CS555 Topic 20 1

Cryptography CS 555. Topic 20: Other Public Key Encryption Schemes. CS555 Topic 20 1 Cryptography CS 555 Topic 20: Other Public Key Encryption Schemes Topic 20 1 Outline and Readings Outline Quadratic Residue Rabin encryption Goldwasser-Micali Commutative encryption Homomorphic encryption

More information

MATH 324 Elementary Number Theory Solutions to Practice Problems for Final Examination Monday August 8, 2005

MATH 324 Elementary Number Theory Solutions to Practice Problems for Final Examination Monday August 8, 2005 MATH 324 Elementary Number Theory Solutions to Practice Problems for Final Examination Monday August 8, 2005 Deartment of Mathematical and Statistical Sciences University of Alberta Question 1. Find integers

More information

The congruence relation has many similarities to equality. The following theorem says that congruence, like equality, is an equivalence relation.

The congruence relation has many similarities to equality. The following theorem says that congruence, like equality, is an equivalence relation. Congruences A congruence is a statement about divisibility. It is a notation that simplifies reasoning about divisibility. It suggests proofs by its analogy to equations. Congruences are familiar to us

More information

Number Theory and Security in the Digital Age

Number Theory and Security in the Digital Age Number Theory and Security in the Digital Age Lola Thompson Ross Program July 21, 2010 Lola Thompson (Ross Program) Number Theory and Security in the Digital Age July 21, 2010 1 / 37 Introduction I have

More information

p 1 MAX(a,b) + MIN(a,b) = a+b n m means that m is a an integer multiple of n. Greatest Common Divisor: We say that n divides m.

p 1 MAX(a,b) + MIN(a,b) = a+b n m means that m is a an integer multiple of n. Greatest Common Divisor: We say that n divides m. Great Theoretical Ideas In Computer Science Steven Rudich CS - Spring Lecture Feb, Carnegie Mellon University Modular Arithmetic and the RSA Cryptosystem p- p MAX(a,b) + MIN(a,b) = a+b n m means that m

More information

Example Enemy agents are trying to invent a new type of cipher. They decide on the following encryption scheme: Plaintext converts to Ciphertext

Example Enemy agents are trying to invent a new type of cipher. They decide on the following encryption scheme: Plaintext converts to Ciphertext Cryptography Codes Lecture 4: The Times Cipher, Factors, Zero Divisors, and Multiplicative Inverses Spring 2014 Morgan Schreffler Office: POT 902 http://www.ms.uky.edu/~mschreffler New Cipher Times Enemy

More information

MODULAR ARITHMETIC II: CONGRUENCES AND DIVISION

MODULAR ARITHMETIC II: CONGRUENCES AND DIVISION MODULAR ARITHMETIC II: CONGRUENCES AND DIVISION MATH CIRCLE (BEGINNERS) 02/05/2012 Modular arithmetic. Two whole numbers a and b are said to be congruent modulo n, often written a b (mod n), if they give

More information

Overview. The Big Picture... CSC 580 Cryptography and Computer Security. January 25, Math Basics for Cryptography

Overview. The Big Picture... CSC 580 Cryptography and Computer Security. January 25, Math Basics for Cryptography CSC 580 Cryptography and Computer Security Math Basics for Cryptography January 25, 2018 Overview Today: Math basics (Sections 2.1-2.3) To do before Tuesday: Complete HW1 problems Read Sections 3.1, 3.2

More information

Sheet 1: Introduction to prime numbers.

Sheet 1: Introduction to prime numbers. Option A Hand in at least one question from at least three sheets Sheet 1: Introduction to prime numbers. [provisional date for handing in: class 2.] 1. Use Sieve of Eratosthenes to find all prime numbers

More information

MA 111, Topic 2: Cryptography

MA 111, Topic 2: Cryptography MA 111, Topic 2: Cryptography Our next topic is something called Cryptography, the mathematics of making and breaking Codes! In the most general sense, Cryptography is the mathematical ideas behind changing

More information

Number Theory - Divisibility Number Theory - Congruences. Number Theory. June 23, Number Theory

Number Theory - Divisibility Number Theory - Congruences. Number Theory. June 23, Number Theory - Divisibility - Congruences June 23, 2014 Primes - Divisibility - Congruences Definition A positive integer p is prime if p 2 and its only positive factors are itself and 1. Otherwise, if p 2, then p

More information

Q(173)Q(177)Q(188)Q(193)Q(203)

Q(173)Q(177)Q(188)Q(193)Q(203) MATH 313: SOLUTIONS HW3 Problem 1 (a) 30941 We use the Miller-Rabin test to check if it prime. We know that the smallest number which is a strong pseudoprime both base 2 and base 3 is 1373653; hence, if

More information

The number theory behind cryptography

The number theory behind cryptography The University of Vermont May 16, 2017 What is cryptography? Cryptography is the practice and study of techniques for secure communication in the presence of adverse third parties. What is cryptography?

More information

Outline Introduction Big Problems that Brun s Sieve Attacks Conclusions. Brun s Sieve. Joe Fields. November 8, 2007

Outline Introduction Big Problems that Brun s Sieve Attacks Conclusions. Brun s Sieve. Joe Fields. November 8, 2007 Big Problems that Attacks November 8, 2007 Big Problems that Attacks The Sieve of Eratosthenes The Chinese Remainder Theorem picture Big Problems that Attacks Big Problems that Attacks Eratosthene s Sieve

More information

PT. Primarity Tests Given an natural number n, we want to determine if n is a prime number.

PT. Primarity Tests Given an natural number n, we want to determine if n is a prime number. PT. Primarity Tests Given an natural number n, we want to determine if n is a prime number. (PT.1) If a number m of the form m = 2 n 1, where n N, is a Mersenne number. If a Mersenne number m is also a

More information

Number Theory and Public Key Cryptography Kathryn Sommers

Number Theory and Public Key Cryptography Kathryn Sommers Page!1 Math 409H Fall 2016 Texas A&M University Professor: David Larson Introduction Number Theory and Public Key Cryptography Kathryn Sommers Number theory is a very broad and encompassing subject. At

More information

MAT199: Math Alive Cryptography Part 2

MAT199: Math Alive Cryptography Part 2 MAT199: Math Alive Cryptography Part 2 1 Public key cryptography: The RSA algorithm After seeing several examples of classical cryptography, where the encoding procedure has to be kept secret (because

More information

Algorithmic Number Theory and Cryptography (CS 303)

Algorithmic Number Theory and Cryptography (CS 303) Algorithmic Number Theory and Cryptography (CS 303) Modular Arithmetic and the RSA Public Key Cryptosystem Jeremy R. Johnson 1 Introduction Objective: To understand what a public key cryptosystem is and

More information

Public-Key Cryptosystem Based on Composite Degree Residuosity Classes. Paillier Cryptosystem. Harmeet Singh

Public-Key Cryptosystem Based on Composite Degree Residuosity Classes. Paillier Cryptosystem. Harmeet Singh Public-Key Cryptosystem Based on Composite Degree Residuosity Classes aka Paillier Cryptosystem Harmeet Singh Harmeet Singh Winter 2018 1 / 26 Background s Background Foundation of public-key encryption

More information

EE 418 Network Security and Cryptography Lecture #3

EE 418 Network Security and Cryptography Lecture #3 EE 418 Network Security and Cryptography Lecture #3 October 6, 2016 Classical cryptosystems. Lecture notes prepared by Professor Radha Poovendran. Tamara Bonaci Department of Electrical Engineering University

More information

Xor. Isomorphisms. CS70: Lecture 9. Outline. Is public key crypto possible? Cryptography... Public key crypography.

Xor. Isomorphisms. CS70: Lecture 9. Outline. Is public key crypto possible? Cryptography... Public key crypography. CS70: Lecture 9. Outline. 1. Public Key Cryptography 2. RSA system 2.1 Efficiency: Repeated Squaring. 2.2 Correctness: Fermat s Theorem. 2.3 Construction. 3. Warnings. Cryptography... m = D(E(m,s),s) Alice

More information

Lecture 8. Outline. 1. Modular Arithmetic. Clock Math!!! 2. Inverses for Modular Arithmetic: Greatest Common Divisor. 3. Euclid s GCD Algorithm

Lecture 8. Outline. 1. Modular Arithmetic. Clock Math!!! 2. Inverses for Modular Arithmetic: Greatest Common Divisor. 3. Euclid s GCD Algorithm Lecture 8. Outline. 1. Modular Arithmetic. Clock Math!!! 2. Inverses for Modular Arithmetic: Greatest Common Divisor. 3. Euclid s GCD Algorithm Clock Math If it is 1:00 now. What time is it in 5 hours?

More information

A4M33PAL, ZS , FEL ČVUT

A4M33PAL, ZS , FEL ČVUT Pseudorandom numbers John von Neumann: Any one who considers arithmetical methods of producing random digits is, of course, in a state of sin. For, as has been pointed out several times, there is no such

More information

Unless stated otherwise, explain your logic and write out complete sentences. No notes, books, calculators, or other electronic devices are permitted.

Unless stated otherwise, explain your logic and write out complete sentences. No notes, books, calculators, or other electronic devices are permitted. Remarks: The final exam will be comprehensive. The questions on this practice final are roughly ordered according to when we learned about them; this will not be the case for the actual final. Certainly

More information

Example Enemy agents are trying to invent a new type of cipher. They decide on the following encryption scheme: Plaintext converts to Ciphertext

Example Enemy agents are trying to invent a new type of cipher. They decide on the following encryption scheme: Plaintext converts to Ciphertext Cryptography Codes Lecture 3: The Times Cipher, Factors, Zero Divisors, and Multiplicative Inverses Spring 2015 Morgan Schreffler Office: POT 902 http://www.ms.uky.edu/~mschreffler New Cipher Times Enemy

More information

Is 1 a Square Modulo p? Is 2?

Is 1 a Square Modulo p? Is 2? Chater 21 Is 1 a Square Modulo? Is 2? In the revious chater we took various rimes and looked at the a s that were quadratic residues and the a s that were nonresidues. For examle, we made a table of squares

More information

Applications of Fermat s Little Theorem and Congruences

Applications of Fermat s Little Theorem and Congruences Applications of Fermat s Little Theorem and Congruences Definition: Let m be a positive integer. Then integers a and b are congruent modulo m, denoted by a b mod m, if m (a b). Example: 3 1 mod 2, 6 4

More information

Classical Cryptography

Classical Cryptography Classical Cryptography CS 6750 Lecture 1 September 10, 2009 Riccardo Pucella Goals of Classical Cryptography Alice wants to send message X to Bob Oscar is on the wire, listening to all communications Alice

More information

ElGamal Public-Key Encryption and Signature

ElGamal Public-Key Encryption and Signature ElGamal Public-Key Encryption and Signature Çetin Kaya Koç koc@cs.ucsb.edu Çetin Kaya Koç http://koclab.org Winter 2017 1 / 10 ElGamal Cryptosystem and Signature Scheme Taher ElGamal, originally from Egypt,

More information

To be able to determine the quadratic character of an arbitrary number mod p (p an odd prime), we. The first (and most delicate) case concerns 2

To be able to determine the quadratic character of an arbitrary number mod p (p an odd prime), we. The first (and most delicate) case concerns 2 Quadratic Reciprocity To be able to determine the quadratic character of an arbitrary number mod p (p an odd prime), we need to be able to evaluate q for any prime q. The first (and most delicate) case

More information

MTH 3527 Number Theory Quiz 10 (Some problems that might be on the quiz and some solutions.) 1. Euler φ-function. Desribe all integers n such that:

MTH 3527 Number Theory Quiz 10 (Some problems that might be on the quiz and some solutions.) 1. Euler φ-function. Desribe all integers n such that: MTH 7 Number Theory Quiz 10 (Some roblems that might be on the quiz and some solutions.) 1. Euler φ-function. Desribe all integers n such that: (a) φ(n) = Solution: n = 4,, 6 since φ( ) = ( 1) =, φ() =

More information

Goldbach conjecture (1742, june, the 7 th )

Goldbach conjecture (1742, june, the 7 th ) Goldbach conjecture (1742, june, the 7 th ) We note P the prime numbers set. P = {p 1 = 2, p 2 = 3, p 3 = 5, p 4 = 7, p 5 = 11,...} remark : 1 P Statement : Each even number greater than 2 is the sum of

More information

Discrete Mathematics and Probability Theory Spring 2018 Ayazifar and Rao Midterm 2 Solutions

Discrete Mathematics and Probability Theory Spring 2018 Ayazifar and Rao Midterm 2 Solutions CS 70 Discrete Mathematics and Probability Theory Spring 2018 Ayazifar and Rao Midterm 2 Solutions PRINT Your Name: Oski Bear SIGN Your Name: OS K I PRINT Your Student ID: CIRCLE your exam room: Pimentel

More information

MAT Modular arithmetic and number theory. Modular arithmetic

MAT Modular arithmetic and number theory. Modular arithmetic Modular arithmetic 1 Modular arithmetic may seem like a new and strange concept at first The aim of these notes is to describe it in several different ways, in the hope that you will find at least one

More information

CS70: Lecture 8. Outline.

CS70: Lecture 8. Outline. CS70: Lecture 8. Outline. 1. Finish Up Extended Euclid. 2. Cryptography 3. Public Key Cryptography 4. RSA system 4.1 Efficiency: Repeated Squaring. 4.2 Correctness: Fermat s Theorem. 4.3 Construction.

More information

Implementation / Programming: Random Number Generation

Implementation / Programming: Random Number Generation Introduction to Modeling and Simulation Implementation / Programming: Random Number Generation OSMAN BALCI Professor Department of Computer Science Virginia Polytechnic Institute and State University (Virginia

More information

Modular Arithmetic. claserken. July 2016

Modular Arithmetic. claserken. July 2016 Modular Arithmetic claserken July 2016 Contents 1 Introduction 2 2 Modular Arithmetic 2 2.1 Modular Arithmetic Terminology.................. 2 2.2 Properties of Modular Arithmetic.................. 2 2.3

More information