THE CHINESE REMAINDER THEOREM INTRODUCED IN A GENERAL KONTEXT Introduction The rst Chinese problem in indeterminate analysis is encountered in a book written by the Chinese mathematician Sun Tzi. The problem states: There are things of an unknown number which when divided by 3 leave 2, by 5 leave 3, and by 7 leave 2. What is the smallest number? This rudimentary question in Elementary Number Theory is best solved using the Chinese Remainder Theorem (CRT). In general, the CRT can be interpreted as a consequence of the existence of a ringisomorphism between the rings Z r1 r n and Z r1 Z rn. This lecture aims to provide techniques to solve such sets of congruences and extends the use of CRT to polynomials. In the end, the RSA public key encription algorithm is discussed and one important application of the CRT during the decription process in RSA is explained. Direct Products Denition: Direct Products of Rings: The direct product of the commutative rings A 1,..., A r with identity element is dened as the set A := A 1 A r with componentwise addition and multiplication. For (x 1,..., x r ), (y 1,..., y r ) A we thus know: (x 1,..., x r ) + (y 1,..., y r ) := (x 1 + y 1,... x r + y r ) and (x 1,..., x r ) (y 1,... y r ) := (x 1 y 1,... x r y r ) The Chinese Remainder Theorem For pairwise coprime r 1,..., r n Z Z r1 r n Z r1 Z rn ψ : k + r 1 r n Z (k + r 1 Z,..., k + r n Z) 1
THE CHINESE REMAINDER THEOREM INTRODUCED IN A GENERAL KONTEXT 2 is a ring-isomorphism (meaning a bijective, additive and multiplicative homomorpishm). Notice that this proof is not constructive. It only proves the existence of a solution of a set of simultaneous congruences. Yet it does not tell an algorithm that calculates those solutions. This proof has an advantage over the constructive proof of CRT. It is more abstract and allows important implications later on. Proof: ψ is well dened and injective: For r 1 r n we know that k + rz = l + rz r l k r i l k i [n] k + r i Z = l + r i Z i [n] ψ (k + rz) = ψ (l + rz) Since we know n n Z r = r = r i = Z ri = Z r1 Z r2 Z rn i=1 i=1 ψ is also surjective and therefore bijective. It follows from the denition of the operations that ψ is both additive and multiplicative. Hence, ψ is a ring-isomorphism. The ring-isomorphism ψ is equivalent to the following statement of the Chinese Remainder Theorem: For pairwise coprime r 1,, r n Z and random a 1,..., a n Z exists modulo r 1 r n = r exactly one k Z with k a i (mod r i ) i [n] General algorithm to solve systems of congruences: (Repetition from Number Theory) To solve a system of congruences of the form k a 1 (mod r 1 ) i [n] with pairwise coprime r 1,..., r n Z and random a 1,..., a n Z take the following steps:
THE CHINESE REMAINDER THEOREM INTRODUCED IN A GENERAL KONTEXT 3 Set r := r 1 r n and s i := r r i for i [n] Find k i Z mit s i k i (1 mod r i ) for i [n] Then k = s 1 k 1 a 1 + + s n k n a n is a solution of the above system of congruences. The set of solutions is k + rz. Example x 2 (mod 3) x 3 (mod 5) x 2 (mod 7) r = 105, s 1 = 35, s 2 = 21, s 3 = 15 nd k 1, k 2, k 3 satisfying: 35k 1 1 (mod 3) 21k 2 1 (mod 5) 15k 3 1 (mod 7) k 1 = 2, k 2 = 1, k 3 = 1. Solution x = 1 (mod 3) {}}{ (5 7) 2 2 }{{} 2 (mod 3) + 1 (mod 5) {}}{ (3 7) 1 3 }{{} 3 (mod 5) + 1 (mod 7) {}}{ (3 5) 1 2 }{{} 2 (mod 7) Intuitively, you construct a set of summands such that each summand contains factors congruent to 0 modulo the other moduli. The only dicult thing is to nd the k i. With small numbers a fast solution is trying some numbers. There are only 4 numbers to check, if it's mod5! The extended Euklidean algorithm does always work, though it takes longer: you need the form at + bs = gcd (a, b): r r i k i 1 (mod r i ) ( ) r r k i + r i c = 1 = gcd, r i r i r i (c Z)
THE CHINESE REMAINDER THEOREM INTRODUCED IN A GENERAL KONTEXT 4 Example with k 1 of the above problem: get the form at + bs = gcd (a, b): (3 5) k 1 1 (mod 7) (3 5) k 1 + 7c = 1 = gcd ((3 5), 7) (c Z) Now k 1 can be computed with the extended Euclidean algorithm: 35 = 11 3 + 2 2 = 1 35 11 3 3 = 1 2 + 1 1 = 1 3 1 2 = 12 3 1 35 k 1 = 1 2 (mod 3) The proof that such k i exist is indirectly given by the extended Euklidian Algorithm and can be found here 1. Since r i and s i are coprime for all i [n], one can nd those k i using the extended Euklidian Algorithm. Example with Polynomials Assume p(x) is a polynomial with the following characteristics: Find p(x). p(x) x 1 = q(x) + 3 x 1 p(x) x 2 = z(x) + 2 x 2 p(x) ( 1) x 3 = w(x) + x 3 Solution: Using the CRT for Polynomials, we nd: r(x) = (x 1)(x 2)(x 3) and we set r 1 = (x 1), a 1 = 3 r 2 = (x 2), a 2 = 2 r 3 = (x 3), a 3 = 1 Using Long Division, we nd r r i k i 1 (mod r i ) i {1, 2, 3} : (x 2)(x 3)k 1 1 (mod (x 1)) k 1 = 1 2 1 Karpnger/Meyberg Algebra Lemma 5.13
THE CHINESE REMAINDER THEOREM INTRODUCED IN A GENERAL KONTEXT 5 (x 1)(x 3)k 2 1 (mod (x 2)) k 2 = 1 (x 1)(x 2)k 3 1 (mod (x 3)) k 3 = 1 2 Therefore, we nd: p(x) = (x 2)(x 3) ( 1 2) (3) + (x 1)(x 3) ( 1) (2) + (x 1) (x 2) ( 1 2) ( 1) = x 2 + 2x + 2 Remark: CRT can be extended to polynomials as long as the moduli r i are coprime!!
THE CHINESE REMAINDER THEOREM INTRODUCED IN A GENERAL KONTEXT 6 The RSA Algorithm The RSA Algorithm is the rst public-key encription system ever developed and has become an important factor in many of today's applications. Its safety largely depends on the factoring problem - prime factorization requires splitting an integer into factors that are prime numbers. Multiplying two prime integers together is easy, but as far as we know, factoring the product of two (or more) prime numbers is dicult. Key-Generation First, two large prime numbers p and q are randomly chosen. Their product, n = p q is found and stored. n is called the RSA-Modul and is used as a modulus for both encription and decription. Next, another prime number e with 1 < e < ϕ (n) = (p 1) (q 1) and gcd (e, ϕ (n)) = 1. e is called the public exponent. Additionally, a natural number d with 1 < d < ϕ(n) and d e 1mod (ϕ (n)). This number is found using the extended Euklidian algorithm. The public key consists of the tupel (n, e) and the private key is d. Encription The sender encripts a message k using the encription function: E (k) = k e mod n Since (n, e) is public, anybody can encript messages. Decription The receiver decripts the code c using the decription function: D (c) = c d mod n Since d is private and can only be calculated knowing (p, q), which are also private, only those who know the private key d can decript messages.
THE CHINESE REMAINDER THEOREM INTRODUCED IN A GENERAL KONTEXT 7 A thorough proof of the RSA Algorithm This proof probably is not the most elegant way to proof the RSA Algorithm. Our goal here is to explain every step using only elementary number theory. We try to avoid statements such as Clearly it follows.., As an obvious consequence... and others you will nd in most text books. The Problem. Given positive integers n, e, d such that (1) n = p q, where p and q are distinct primes (2) gcd (e, ϕ (n)) = 1 (This requirement is necessary to ensure that the modular inverse in (3) exists) (3) ed 1 (modϕ (n)) (4) Dene the public key transformation of a message m for 0 m < n to be E (m) = m e mod n (5) Dene the private key transformation of a message m for 0 m < n to be D (m) = m d mod n (6) Prove that, for 0 m < n, m = D (E (m)) (Decription) Concepts from Number Theory we Need for the Proof. (1) A prime number is dened as an integer, greater than one, which is only divisible by the number one and itself. (2) Two numbers a and b which have no common factors other than one are said to be coprime. (3) The greatest common divisor of two integers a and b is the largest integer that divides both numbers. (4) a and b are coprime if and only if gcd (a, b) = 1 (5) The notation n a means n divides a and thus there exists an integer d such that a = n d (6) If mn a then m a and n a for any integers m, n. (7) mod as a binary operation: The notation a = bmod n denes a binary operation where a is equal to the remainder on dividing b my n, 0 a < n (8) mod as a congruence relation: The notation a b (mod n) means a and b have the same remainder when divided by n, or, equivalently, (a) n a b, or (b) a b = nk with k N (9) The two ways of using mod are related: a m (mod n) a mod n = b mod n
THE CHINESE REMAINDER THEOREM INTRODUCED IN A GENERAL KONTEXT 8 (10) Properties of Congruence: for a xed positive integer n and any integers a, b, c, d. (a) a a (mod n) (b) a ± b b ± a (mod n) (c) ab ba (mod n) (d) abc (ab) c a (bc) (mod n) (e) If a b (mod n) then b a (mod n) (f) If a b (mod n) and b c (mod n) then a c (mod n) (g) If a b (mod n) and c d (mod n) then a ± c b ± d (mod n) and ac bd (mod n) (h) If a b (mod n) then a r b r (mod n), for any integer r 1 (i) a 0 (mod n) if and only if n a (11) If m and n are coprime and a b (mod n) and a b (mod m) then a b (mod mn) (12) ϕ (n) is the Euler phi function or totient function dened to be the number of positive integers not exceeding n which are relatively prime to n. (13) For any prime p, ϕ (p) = p 1 (14) If m and n are coprime, then ϕ (m) ϕ (n) = ϕ (mn) (15) Fermat's little Theorem: If p is a prime and a is any integer, then a p a (mod p). If gcd (a, p) = 1, then a p 1 1 (mod p) The Solution. The proof is based on the fact that the modulus n is the product of two numbers which - because they are primes and not equal - are coprime to each other. Proof: From equations (4) and (5) we nd that D (E (m)) = (m e mod n) d mod n = m ed mod n. If we can prove that m = m ed mod n we will be done. We know from equation (3) that ed 1 (mod ϕ (n)). Using (8a), this can be expressed as ϕ (n) ed 1 Since p and q are coprime, we know by (14), that ϕ (n) = ϕ (p) ϕ (q) Therefore we nd ϕ (p) ϕ (q) ed 1 Now we use (6) to split the above expression into two: ϕ (p) ed 1 and ϕ (q) ed 1
THE CHINESE REMAINDER THEOREM INTRODUCED IN A GENERAL KONTEXT 9 This can be rewritten using (8b) : ed 1 = kϕ (p) Since p is prime it follows from (13), that ed 1 = k (p 1) ( ) Now consider the case of any integer m raised to the powered modulo p. We can say that m ed m ed 1+1 (mod p) or m ed ( m ed 1) m (mod p) Substituting ( ) for ed 1 we get m ed ( m k(p 1)) m (mod p) ( ) Since p is prime, we need to consider to cases. Case 1: p and m are coprime, so gcd (p, m) = 1 Fermat's little Theorem (15) tells us that m p 1 1 (mod p) By (10h) we can raise this to the power of any positive integer k to get m k(p 1) 1 k 1 (mod p) Combining this result with ( ) we obtain m ed 1 m (mod p) Case 2: m is an exact multiple of p, so gcd (m, p) = p m to the power of any positive integer will still be divisible by p (if p m then p also divides m ed ) and so we have m ed 0 (mod p) by (10i) Since p divides m and so m 0 (mod p), we have m ed 0 m (mod p) Thus, for all m, m ed m (mod p) By the same argument we can derive that m ed m (mod q). Since p and q are coprime by denition, we can use (11) to combine the above results: m ed m (mod pq) m (mod n)
THE CHINESE REMAINDER THEOREM INTRODUCED IN A GENERAL KONTEXT 10 By symmetry (10e) we nd that m m ed (mod n) Since we limit m to 0 m < n, there will only be one integer solution to this congruence relation. Thus m = m ed (mod n) Worked Example Choose p = 11 and q = 7 n = 11 7 = 77 Calculate ϕ (n) = (11 1) (7 1) = 60 Choose e = 13 Find d with 13 d 1 (mod 60) using the extended Euklidian algorithm: 60 = 4 13 + 8 8 = 1 60 4 13 13 = 1 8 + 5 5 = 1 13 1 8 = 1 13 1 60 + 4 13 = 5 13 1 60 8 = 1 5 + 3 3 = 1 8 1 5 = 1 60 4 13 5 13 + 1 60 = 2 60 9 13 5 = 1 3 + 2 2 = 1 5 1 3 = 5 13 1 60 2 60 + 9 13 = 14 13 3 60 3 = 1 2 + 1 1 = 1 3 1 2 = 2 60 9 13 14 13 3 60 = 1 60 23 13 1 = gcd (e, ϕ (n)) = k ϕ (n) + d e = 1 60 23 13 d 23 (mod 60) d = 37 Encript the message k = 2. c = 2 13 (mod 77) = 8192 (mod 77) = 30 (mod 77) c = 30 Decript the code c = 30. 30 37 (mod 77) = 2 (mod 77) k = 2. The Chinese Remainder Theorem Applied in the Decription Process of RSA
THE CHINESE REMAINDER THEOREM INTRODUCED IN A GENERAL KONTEXT 11 The decription of RSA requires exponentiation modulo n. The decription eciency increases with smaller values of the exponent d. Since the modulus n used in RSA encription and decription usually is 1024 bit long, the decription requires 1024 squarings modulo n and 512 multiplications modulo n. What you do: Knowing d, p, q calculate m p = c d mod p m q = c d mod q Then, using CRT, solve m m p mod p m m q mod q To solve the congruence, calculate whole numbers y p and y q with y p p + y q q = 1 and set m = (m p y q q + m q y p p) mod n. Exercises Easy ones: (use the CRT!). a): Replace stars with digits so that 454** is divisible by 2, 7 and 9 b): Peter prepared some lollipops for his party. If he divides them evenly for ve people, then two pieces will be left over. If he divides them for four people one lollipop will be left. But he can divide them evenly for three people. What the smallest number of lollipops Peter could have had
THE CHINESE REMAINDER THEOREM INTRODUCED IN A GENERAL KONTEXT 12 c): nd solutions of the system: 4x 2 (mod 6) 3x 5 (mod 7) 2x 4 (mod 11) d): 2x 11 (mod 2275) e): 5832 6639 mod 840 Five Pirates and a Monkey. Five pirates and a monkey are shipwrecked on an island. The pirates have collected a pile of coconuts which they plan to divide equally among themselves the next morning. Not trusting the others, one pirate wakes up during the night and divides the coconuts into ve equal parts with one left over, which he gives to the monkey. The pirate then hides his portion of the pile. During the night, each of the other pirates does exactly the same thing by dividing the pile he nds into ve equal parts leaving one coconut for the monkey and hiding his portion. In the morning, the pirates gather and split the remaining pile of coconuts into ve equal parts and again one is left over for the monkey. What is the smallest number of coconuts the pirates could have collected for their original pile? Eggs in the Basket. (From Brahmagupta, 7th century A.D.) A girl was carrying a basket of eggs, and a man driving a horse hit the basket and broke all the eggs. Wishing to pay for the damage, he asked the girl how many eggs there were. The girl said she did not know, but she remembered that when she counted them by twos, there was one left over; when she counted them by threes, there were two left over; when she counted them by fours, there were three left over; when she counted them by ves, there were four left; and when she counted them by sixes, there were ve left over. Finally, when she counted them by sevens, there were none left over. `Well,' said the man, `I can tell you how many you had.' What was his answer? Putnam 1955: Do there exist 1, 000, 000 consecutive integers each of which contains a repeated prime factor?
THE CHINESE REMAINDER THEOREM INTRODUCED IN A GENERAL KONTEXT 13 Putnam 2006: Alice and Bob play a game in which they take turns removing stones from a heap that initially has n stones. The number of stones removed at each turn must be one less than a prime number. The winner is the player who takes the last stone. Alice plays rst. Prove that there are innitely many n such that Bob has a winning strategy. (For example, if n = 17, then Alice might take 6 leaving 11; then Bob might take 1 leaving 10; then Alice can take the remaining stones to win.)