Foundations of Cryptography Ville Junnila viljun@utu.fi Department of Mathematics and Statistics University of Turku 2015 Ville Junnila viljun@utu.fi Lecture 10 1 of 17
The order of a number (mod n) Definition 3.1 Let a, n Z be such that gcd(a, n) = 1 and n 1. The order of a number a (mod n) is the smallest positive integer k such that a k 1 (mod n), i.e., the order of a Z n. We denote k = ord n (a). We also say that a belongs to the exponent k (mod n). Ville Junnila viljun@utu.fi Lecture 10 2 of 17
The order of a number (mod n) Theorem 3.5 Let a, m, n, r, s Z be such that gcd(a, n) = 1, n 1 and m, r, s 0, and denote k = ord n (a). Then the following hold: 1 k ϕ(n), 2 a r a s (mod n) r s (mod k), 3 a r 1 (mod n) r 0 (mod k), 4 1, a, a 2,..., a k 1 are non-congruent modulo n and 5 ord n (a m ) = k/ gcd(k, m). Ville Junnila viljun@utu.fi Lecture 10 3 of 17
The order of a number (mod n) Definition 3.2 If ord n (a) = ϕ(n), i.e., Z n is a cyclic group generated by a, then a is called the primitive root modulo n. Theorem 3.6 If a is a primitive root modulo n, then all the primitive roots modulo n are a m, where 1 m ϕ(n) and gcd(m, ϕ(n)) = 1. Therefore, there are ϕ(ϕ(n)) non-congruent primitive roots modulo n. Ville Junnila viljun@utu.fi Lecture 10 4 of 17
Primitive roots modulo p P Let p be a prime. In what follows, we consider the following question: How many non-congruent numbers a belong to a given exponent k, i.e., ord p (a) = k. Recall that k (p 1) since ϕ(p) = p 1. If a belongs to the exponent k modulo p, then a is a root of the congruence x k 1 (mod p). (1) Theorem 3.7 If ord p (a) = k, then the number of non-congruent roots of congruence (1) is k. The numbers are the non-congruent roots. 1, a, a 2,..., a k 1 (2) Ville Junnila viljun@utu.fi Lecture 10 5 of 17
Primitive roots modulo p P Theorem 3.8 Let p be a prime. 1 If k (p 1), then there exist ϕ(k) non-congruent numbers that belong to exponent k modulo p. If a is one of those, then a m, where 1 m k 1 and gcd(m, k 1) = 1, are the other numbers belonging to the exponent k. 2 Thus, there exist ϕ(p 1) non-congruent primitive roots modulo p. If a is one of those, then a m, where 1 m p 1 and gcd(m, p 1) = 1, are the other numbers belonging to the exponent p 1, i.e., the primitive roots modulo p. Example By the previous example, the primitive roots modulo 19 are 3 1, 3 5, 3 7, 3 11, 3 13, 3 17 3, 15, 2, 10, 14, 13 (mod 19). Ville Junnila viljun@utu.fi Lecture 10 6 of 17
Primitive roots modulo p P Remark For calculations, we are often interested in the smallest possible primitive roots. Usually quite small ones indeed exist. Example The smallest primitive root modulo 19 is 2. Remark It can be shown that a primitive root modulo n exists if and only if n = 1, 2, 4, p t or 2p t, where p is an odd prime and t is a positive integer. Ville Junnila viljun@utu.fi Lecture 10 7 of 17
Primitive roots modulo p P Theorem 3.9 An integer n > 1 is a prime if and only if there exists an integer x such that x n 1 1 (mod n) and for all prime factors q of n 1 we have x (n 1)/q 1 (mod n). Remark Previous theorem can be used for primality testing. Although it is difficult to find the prime factors of n 1 in general, we may choose n in such a way that the factors are known. As the primitive root modulo a prime is usually small, a number satisfying the conditions of the theorem can be quickly found. Example Let us show that n = 2 8 + 1 = 257 is a prime number. Ville Junnila viljun@utu.fi Lecture 10 8 of 17
Primitive roots modulo p P Remark By Theorem 3.9, there exists primitive root modulo p P as ϕ(p 1) 1. Definition 3.3 Let p be a prime, r a primitive root modulo p and a an integer such that p a. An integer i such that 0 i p 2 and r i a (mod p) is called the index of a to the base r modulo p. We denote i = ind r a. Ville Junnila viljun@utu.fi Lecture 10 9 of 17
Primitive roots modulo p P Example Consider the indices to the base 3 modulo 19. We have k 3 k (mod 19) k 3 k (mod 19) 0 1 10 16 1 3 11 10 2 9 12 11 3 8 13 14 4 5 14 4 5 15 15 12 6 7 16 17 7 2 17 13 8 6 18 1 9 18 Ville Junnila viljun@utu.fi Lecture 10 10 of 17
Primitive roots modulo p P Example Consider the indices to the base 3 modulo 19. We have k ind 3 (k) k ind 3 (k) 1 0 10 11 2 7 11 12 3 1 12 15 4 14 13 17 5 4 14 13 6 8 15 5 7 6 16 10 8 3 17 16 9 2 18 9 Ville Junnila viljun@utu.fi Lecture 10 11 of 17
Primitive roots modulo p P Theorem 3.10 Let r be a primitive root modulo p, p a and p b. Now ind r (ab) ind r a + ind r b (mod p 1) and, for any n N, ind r (a n ) n ind r a (mod p 1) Example Apply the previous theorem to ind 3 (15). Ville Junnila viljun@utu.fi Lecture 10 12 of 17
Quadratic Residues Remark Let a, n Z. Then, by Exercise 1.5, we have gcd(a, n) = gcd(a, n a) = gcd(a + (n a), n a) = gcd(n, n a). Therefore, if a Z n, i.e., gcd(a, n) = 1, then n a = a Z n. Thus, we have Z n = {±a 1 a n 2 and gcd(a, n) = 1}. Ville Junnila viljun@utu.fi Lecture 10 13 of 17
Quadratic Residues Definition (mth root) Let a R. If there exists x R such that x m = a, then we say that x is mth root of a and denote m a = x. Definition (square root) Let a R. If there exists x R such that x 2 = a, then we say that x is square root of a and denote a = x. Ville Junnila viljun@utu.fi Lecture 10 14 of 17
Quadratic Residues Definition (mth root modulo n) Let n N + and a Z n. If there exists x Z n such that x m = a, then we say that a is mth power residue modulo n. Definition (square root modulo n) Let n N + and a Z n. If there exists x Z n such that x 2 = a, then we say that a is quadratic residue modulo n. Ville Junnila viljun@utu.fi Lecture 10 15 of 17
Quadratic Residues Definition 4.1 Let a, n Z be such that n 1 and gcd(a, n) = 1. If there exists x Z such that x 2 a (mod n), then we say that a is a quadratic residue (QR) modulo n. Otherwise, a is a quadratic non-residue (QNR) modulo n. Example 4.1 Determine the QRs and QNRs modulo 9. Ville Junnila viljun@utu.fi Lecture 10 16 of 17
Quadratic Residues Theorem 4.1 Let p > 2 be a prime and r a primitive root modulo p. If p a, then 1 a is a QR modulo p if and only if ind r a is even and 2 a is a QNR modulo p if and only if ind r a is odd. The number of QRs and QNRs both are (p 1)/2. Example Consider QRs and QNRs modulo 19 P. Example Consider QRs and QNRs modulo 15 / P. Ville Junnila viljun@utu.fi Lecture 10 17 of 17