%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\documentstyle[12pt,twoside,alltt]{article}
\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {2}
\sloppy

\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of 
Proof}\hspace*{1em}}{\qed\bigskip}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}

\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1996}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture #1 : #2 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: #3 \hfill Scribe: #4} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%		ordinal number of the lecure
%		date of the lecure
%		lecturer
%		scribe---that is you
%
\lecture{7}{October 1, 1996}{Yoav Yerushalmi}{Albert Lin} 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% For theorems, lemmas, definitions, remarks, etc. use commands
% \begin{theorem} .... \end{theorem} 
% \begin{definition} ... \end{definition} 
% \begin{proof} ... \end{proof}
% and so on ...
%
% If you want to insert figures in your notes do the following: 
% 1) Prepare your figures using your favourite graphic editor
% 	for example idraw or xfig
% 2) Save your pictures in PostScript form using the following convention
% 	notes-nn-fig-mm.ps where nn is the number of the lecture you 
% 	are scribing and mm is the sequential number of the picture in the 
% 	notes
% 3) Insert the following block in your LaTeX code in the place you 
% 	want to insert the figure BUT LEAVE IT AS A COMMENT (with the %
% 	at the beginning of the line) since it will not work on athena: 
%
% \begin{figure}[h]
% \begin{center}
% \mbox{\psfig{figure=notes-nn-fig-mm.ps}}
% \caption{A very nice picture.}
% \label{fig:mm}
% \end{center}
% \end{figure}
%
% 	of course the picture will not show up when you compile and 
% 	print your notes, but don't worry the TA will take care of it. 
% 4) When you mail the TA the LaTeX code mail him/her the PostScript
%	files for the figures as well 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

Today's lecture presents some of the number theory that much of modern
cryptography is based on. Some of the stuff in the notes is clarified
from lecture, or examples were added by yoav to help demonstrate
things that time did not permit.

\begin{definition}
The Greatest Common Divisor (GCD) of a and b is the largest integer that
divides both a and b.
\end{definition}
\begin{theorem}
gcd(a,b) = gcd(b, a mod b)
\end{theorem}
\begin{proof}
We will show that $\gcd(a,b)|\gcd(b, a \bmod b)$ and $\gcd(b, a \bmod
b)|\gcd(a,b)$, thus they must be equal.

Let $d_1$ = $\gcd(a,b)$.  Then $d_1|a$ and $d_1|b$.  By definition, $(a
\bmod b) = a - qb$ for $q = \lfloor{a / b}\rfloor$.  $d_1|a$ and
$d_1|qb$ $\Rightarrow$ $d_1|(a \bmod b)$.  Since $\gcd(b, a \bmod b)$ is
a linear combination of $b$ and $(a \bmod b)$, $d_1|\gcd(b, a \bmod b)$.
Therefore $\gcd(a,b) | \gcd(b, a \bmod b)$.

Let $d_2 = \gcd(b, a \bmod b)$.  Then $d_2|b$ and $d_2|(a \bmod b)$.  By
definition, $a = qb + (a \bmod b)$ for $q = \lfloor{a / b}\rfloor$.
Since $d_2|b$ and $d_2|(a \bmod b)$, $d_2|a$.  $d_2|a$ and $d_2|b$
$\Rightarrow$ $d_2|\gcd(a,b)$.  Therefore $\gcd(b, a \bmod
b)|\gcd(a,b)$.

Since $\gcd(a,b)|\gcd(b, a \bmod b)$ and $\gcd(b, a \bmod b)|\gcd(a,b)$,
they are equal.
\end{proof}

Euclid's algorithm efficiently computes the gcd of two numbers.

\begin{tabbing}
{\noindent{\bf Euclid(a,b):}} \= if (b=0) return a \\
\> else Euclid(b, a mod b)
\end{tabbing}
{\noindent{\bf Example:}} Euclid(24,18) = Euclid(18,6) = Euclid(6,0) = 6.

Euclid's algorithm can be extended to find $x$ and $y$ such that $d =
\gcd(a,b) = ax + by$.

\begin{tabbing}
{\noindent{\bf Extended-Euclid(a,b):}} \=
if (b=0) \= return (a,1,0) \+ \\
else \> $(d', x', y') =$ Extended-Euclid$(b, a \bmod b)$ \+ \\
$(d, x, y) = (d', y', (x' - \lfloor a/b \rfloor \cdot y'))$ \\
return $(d, x, y)$
\end{tabbing}

\begin{definition}
A {\bf group} is a set S and an operation $\oplus$ with these
properties:
\begin{itemize}
\item closure: $\forall a, b \in S: a \oplus b \in S$
\item identity: $\exists e \in S$ s.t. $\forall a \in S: a \oplus e
= e\oplus a = a$
\item associativity: $\forall a,b,c \in S: (a \oplus b) \oplus c = a
\oplus (b \oplus c)$
\item inverse: foreach $a \in S: \exists b$ s.t. $a \oplus b = b \oplus
a = e$
\end{itemize}

\end{definition}
S is a {\bf finite} group if $|S| < \infty$. \\
S is an {\bf Abelian} group if it has symmetry: $\forall a,b \in S: a
\oplus b = b \oplus a$

{\bf Examples:}
\begin{itemize}
\item ($Z$, +): integers under addition.  Abelian, not finite.
\item ($Z_5$, $\ast$): integers mod 5.  Not a group (no inverse for 0)
\item ($Z_5^*$, $\ast$): $Z_5^* = \{ a \in Z_n \mid \gcd(a,n) =
1\}$. the multiplicative group.  Abelian, finite.
\end{itemize}

Finding the multiplicative inverse of x mod n: $ax = 1 \pmod{n}
\Rightarrow ax = kn + 1 \Rightarrow ax - kn = 1$.  We can use
Extended-Euclid(x,n) to determine the coefficients a and k if a and n
are relatively prime.

Sometimes we want to know the size of $Z_n^*$:
\begin{definition}
Euler's {\bf phi} or {\bf totient} function computes the number of
positive integers less than n that are relatively prime to n.
\[\phi(n) = n\prod_{p \mid n} (1 - 1/p) \]
\end{definition}
$\phi(20) = 20(1-{1 \over 2})(1-{1 \over 5}) = 8$ \\
$\phi(p) = p - 1$\\
Note that this function computes $|Z_n^*|$

\begin{theorem}
{\bf The Chinese Remainder Theorem:} Given pairwise relatively prime
$m_1,\ldots,m_n$ and given $a_1,\ldots,a_n$, the system
\begin{eqnarray*}
x & \equiv & a_1 \pmod{m_1} \\
x & \equiv & a_2 \pmod{m_2} \\
& \vdots & \\
x & \equiv & a_n \pmod{m_n} \\
\end{eqnarray*}
is equivalent to $x \equiv a \pmod{M}$ for some a where $M = m_1 \times
m_2 \times \cdots \times m_n$.
\end{theorem}

Note this theorem basically provides a one-to-one relationship between
a set of values each mod a particular number, and one value mod the
product. The two are interchangeable:
\begin{eqnarray*}
(a+b) \bmod M & \leftrightarrow &((a_1 + b_1) \bmod m_1, ..., (a_k +
b_k) \bmod m_k) \\
(ab) \bmod M & \leftrightarrow & (a_1 b_1 \bmod m_1,..., a_k b_k \bmod
m_k) \\
\end{eqnarray*}

How to transform from one representation to the other:

Forward is simple: merely take the value of $(a \bmod M) \bmod m_i$
for each $m_i$.

Backwards is slightly more complex: 
Let $m_i = n / n_i$ so that $\forall j \neq i: m_i \equiv 0
\pmod{n_j}$.  Let $c_i = m_i(m_i^{-1} \bmod n_i)$.
\begin{tabbing}
{\bf Claim:} \= $a = (a_1 c_1 + \cdots + a_k c_k)$ satisfies the system of
equations. \+ \\
For $i \neq j$, $a_j c_j \equiv a_j m_j (m_j^{-1} \bmod n_j) \equiv 0
\bmod n_j$ \\
For $i = j$, $a_j c_j \equiv a_j m_j (m_j^{-1} \bmod n_j) \equiv a_j$ \\
Thus $a = (a_1 c_1 + \cdots + a_k c_k) \equiv a_j \pmod{m_j}$
\end{tabbing}

\begin{example}

Let $a \equiv 5 \pmod{2*3}$, therefore, $a_1 \equiv 2 \pmod 3$ and
$a_2 \equiv 1 \pmod 2$.
Let $b \equiv 3 \pmod 6$, therefore, $b_1 \equiv 0 \pmod 3$ and
$b_2 \equiv 1 \pmod 2$.
\begin{eqnarray*}
(a+b) & \equiv &2 \pmod 6 \\
(a_1 + b_1) & \equiv & 2 \pmod 3 \\
(a2_ + b_2) & \equiv & 0 \pmod 2 \\
\end{eqnarray*}

It is readily apparent that $5+3 \equiv 2 \pmod 6$ is equivalent to
$2+0 \equiv 2 \pmod 3$ and $1+1 \equiv 0 \pmod 2$.
\end {example}

\begin{example}
Find a value $a \pmod 35$ such
that $a \equiv 3 \pmod 5 \mbox{ and } a \equiv 2 \pmod 7$.

\begin{eqnarray*}
a_1 = 3 & a_2 = 2 \\
n_1 = 5 & n_2 = 7 \\
m_1 = 7 & m_2 = 5 \\
c_1 = 3 \cdot 7 & c_2 = 3 \cdot 5 \\
\end{eqnarray*}
\[a = c_1 a_1 + c_2 a_2 = 3 \cdot 21 + 2 \cdot 15 = 93 \equiv 23 \pmod{35}\]
\end{example}

\begin{definition}
The {\bf generated set} of g in the group (S, $\oplus$) is the set
$\{ g, g \oplus g, g \oplus g \oplus g, g^{(4)}, \ldots \}$.
\end{definition}

\begin{example}
$Z_7^*: \langle1\rangle = \{1\}, \langle2\rangle = \{2,4,1\},
\langle3\rangle = \{3,2,6,4,5,1\}$ \\
$(Z_6, +): \langle0\rangle = \{0\}, \langle1\rangle = \{1,2,3,4,5,0\},
\langle2\rangle = \{2,4,0\}, \langle3\rangle = \{3,0\}, \langle4\rangle
= \{4,2,0\},$ etc\\
\end{example}
Note already that the groups cycle. Repeating the computation on the generator
$| \langle g \rangle |$ times results in the value of $g$. 

\begin{theorem}
{\bf Euler's Theorem}: $\forall a \in Z_n^*: a^{\phi(n)} \equiv 1
\pmod{n}$
\end{theorem}

\begin{theorem}
{\bf Fermat's Theorem}: $\forall a \in Z_p^*: a^{p-1} \equiv 1
\pmod{n}$ \\
Fermat's Theorem follows directly from Euler's Theorem, since $\phi(p)
= p-1$.
\end{theorem}

\begin{definition}
In the group S, g is a {\bf prime generator} of S if $\forall a \in S: \exists
b $ s.t. $g^b = a$. Often times, this g is just referred to as the
{\em generator}.
\end{definition}

The {\bf Discrete Log problem}: Given a generator $g \in Z_p^*$ and an
element $a \in Z_p^*$, find $b$ such that $g^b = a$. This problem turns
out to be very difficult to solve, and yet very simple to test.

\begin{example}
Given the generator $3$ of $Z_7^*$, The discrete log of $1$ is $6$,
since $3^6 = 729 \equiv 1 \pmod 7$. The discrete log of $6$ is $3$,
since, $3^3 = 27 \equiv 6 \pmod 7$.
\end {example}

The {\bf Square Root problem}: Given a value $a \in Z_n^*$, find a $b$
such that $b^2 \equiv a \pmod n$. This problem is as difficult as
factoring $n$. Given the factorization of $n$, one can find the square
roots. Given the square roots, one can find the factorization of
$n$.

There do not have to be 2 square roots to every number,
but if we are calculating in $Z_p^*$ we are guaranteed either 2 square
roots or no square roots. If n is composite, we can expect either no
square roots, or a power of two for each of its factors. So in $Z_7^*$
we expect numbers to have either two or no square roots, but in
$Z_{15}^*$ we can expect four or none, and in $Z_{245}^*$ we can expect 8
or none.

\begin {example}
The square roots of 4 in $Z_7^*$ are 2 and 5 (or 2 and -2). The square
roots of 4 in $Z_6^*$ don't exist (2, which one would expect to be a
square root, isn't in $Z_6^*$). In $Z_5^*$ we have 2 and 3 (or 2 and
-2). Finally, in $Z_{35}^*$, we have 2, 12, 23, and 33 (or 2, 12, -2,
-12). Given those roots by the way, we can add any two unique (not b
and -b, or 2 and 33 in our example), and do a gcd with the composite
number (35 in our case) to get one of the prime factors. For example,
$gcd((2+12), 35) = 7$. This is how we can factor a composite number
given all the square roots of some number within it multiplicative
group.
\end{example}

\begin{definition}
A number x is a {\bf quadratic residue} mod p if $\exists y$ s.t. $y^2
\equiv x \pmod{p}$
\end{definition}
It can be shown that half of the elements of $Z_p^*$ are quadratic residues,
and half are quadratic nonresidues. This knowledge will be used later
to create the simplest probabilistic prime number tester.


\begin{definition}
Suppose p is an odd prime.  For any integer $a \geq 0$, we define the
{\bf Legendre symbol} \[ ({x \over p}) = \left\{ \begin{array}{ll}
			   1 & \mbox{if QR(x)} \\
			   0 & \mbox{if $x|p$} \\
			   -1& \mbox{if not QR(x)}
			   \end{array}
		   \right. \]
\[ ({x \over p}) = x^{(p-1)/2} \pmod p \]
\end{definition}

\begin{definition}
Related to the Legendre Symbol, the {\bf Jacobi symbol} is defined to be
\[ ({x \over n}) = \prod_{p \mid n} ({x \over p}) \]
while the definition implies that one needs to know the factorization
of $n$ to solve for $({x \over n})$, it turns out that one
can calculate the Jacobi symbol without factoring, in polynomial time.
\end{definition}

Now that we have the basics, we can create a probabilistic test
for figuring out if a number is prime: The {\bf Solovay-Strassen}
algorithm. 
\begin{tabbing}
{\noindent{\bf Solovay-Strassen(n):}} \= choose a at random $\in
\{1,\ldots,n\}$ \\
\> if $\gcd(a,n) \neq 1$, fail \\
\> else \= $j = a^{(n-1)/2} \pmod{n}$ \\
\> \> if $j \neq ({a \over n})$, fail \\
\> \> else return \\
\end{tabbing}

The proof is beyond the scope of the class. However, an argument can
be made for its success. If $n$ is prime, it will always pass, since
the Legendre Symbol of $a = a^{(n-1)/2} \pmod n$ must equal the Jacobi
symbol of $a$ (the two yield the same result for prime numbers by the
definition of the Jacobi symbol). If
$n$ is not prime, then the Legendre symbol computation will return
some value. The Jacobi symbol computation will tell us whether the
number is not a QR in an even or an odd number of factors of $n$. (For
each prime factor of $n$ where the $a$ is a QR, we multiply by 1 which does
nothing. For each factor where it is not a QR, we multiply by -1,
which inverts the result). So we have a sort-of-random choice between
1 and -1, which we compare with the Legendre symbol value. The
probability that we have hit on two equal results is less than 50\%.

If this algorithm fails for a number, it is {\em guaranteed} to not be
a prime. If it succeeds, it can be demonstrated that the number has a
greater than 50\% chance of being prime. We can repeat this
test with different choices of $a$. For each different $a$ we chose,
the test splits the probabilities again. For $t$ different values of
$a$, if the test passes for all, there is a $2^{-t}$ chance that
p is not prime. We can make this value arbitrarily small.

There are other ways of testing primality. A popular probabilistic
one is Rabin-Miller which will be covered later. There
are also deterministic methods in existence, although those tend
to require many more computations, and so are in general less popular.

\section{Modular Exponentation}

Modular exponentiation is a very useful primitive in cryptography, along with
addition, subtraction, multiplication and computing multiplicative inverses
modulo some base $n$.

The basic idea is:

{\bf Given:} numbers $a,b,c$: We want to compute $a^b~(\bmod~c)$

This can be efficiently computed, even for large values of $a$ and $b$.  The
reason is that we can do several things well:

\begin{itemize}
\item{\bf Multiplication} We can compute $ab$ quickly, just make the product,
and find the remainder after dividing by $c$.
\item{\bf Squaring} We can compute $a^2$ just as quickly: let $b = a$.
\end{itemize}

There are two ways of approaching modular exponentiation:

\subsection{Slow Way - Brute Force}

This method is exactly like it sounds, just take $a$ and multiply it by
itself $b$ times, reducing modulo $c$ to ensure that the values don't get too
big.

The problem with this method is that it is linear in the value of $b$, which
makes it really slow for large values of $b$, or exponential in the number of
bits of $b$.\footnote{The number of bits of $b$, $k_b = lg(b)$, so brute
force runs in about $b = 2^{k_b}$ steps.}

\subsection{Smarter Way - Repeated Squaring}

This is described in one of today's readings.

\begin{example}
Compute $a^{20}~(\bmod~c)$

First, take a look at 20 in binary: $20~=~10100_2$

Then, go from left to right, working up the value that you need.  In this
case, the algorithm would go:

\begin{center}
$ a^0 \rightarrow a^1 \rightarrow a^2 \rightarrow a^5 \rightarrow a^{10} \rightarrow a^{20}$
\end{center}

{\bf Details:} Looking at the binary representation from left to right, we
figure out what to change $a$ to.
\end{example}

\begin{itemize}

\item If we shift and see a 0 (e.g. $101_2 \rightarrow 1010_2$), that is the
same as multiplying by 2, so we sqaure the number:

\begin{center}
$a^b \rightarrow a^{2b}~=~(a^b)^2$
\end{center}

\item If we shift and see a 1 (e.g. $1010_2 \rightarrow 10101_2$), that is the
same as multiplying by two and adding one, so sqaure the number and multiply
the result by $a$:

\begin{center}
$a^b \rightarrow a^{(2b + 1)}~=~ (a^b)^2 \cdot a$
\end{center}

\end{itemize}

The difficulty of this method is now limited by the bit-length of $b$.

\section{Finding Large Prime Numbers}

We can do this in several ways:

\begin{itemize}

\item{\bf Look it up} - There are books that list large numbers of primes,
and you can pick a couple for keys.

\item{\bf Find one yourself} - There are several ways of determining if a
number is prime, and we also have 2 nice properties about prime numbers:

\begin{enumerate}
\item There are an infinite number of primes.
\item The primes are reasonably spaced.
\end{enumerate}
\end{itemize}

The second point can be stated more formally:

\begin{theorem}
Prime Number Theorem (stated without proof)

if $\pi (x) =$ The number of primes $\leq~x,~(ex.~\pi(10) = 4)$ then

\begin{center}
$\pi(x) \approx \frac{x}{ln(x)}(1 + o(1))$
\end{center}
\end{theorem}

This approximation gets better for large values of $x$.  Informally, the
theorem states that if you pick a number less than $x$ at random, the
probablility that it is prime approaches $\frac{1}{ln(x)}$.  Therefore, you
would expect to pick about $ln(x)$ numbers at random before you find a prime,
so just picking a number at random and a test for primality will terminate in
a reasonable about of time\footnote{You can even increase your chances by
only picking odd numbers, and doing a couple of quick tests.} (e.g. $x =
10^{20}$ you expect in about 60 random tries to find a prime number.)

Now we need a test for primality. For this, we use a theorem of Fermat:

\begin{lemma}
Fermat's Little Theorem

If p is prime and 0 $<$ a $<$ p then:

\begin{center}
$a^{p-1} \equiv 1 \bmod p$
\end{center}
\end{lemma}

So, the test would be, test a bunch of $a$'s and see that they all obey the
theorem.  If you find one that fails, p must be composite.

Note, this theorem says nothing about what if p is composite.  It is possible
for the test to succeed for composite numbers as well.  So, the next question
to ask is how well does the theorem work for composite numbers?  It turns
out, there are composite number that satisfy this theorem as well.  So, the
theorem alone is not enough to test for primality, because we could hit one
of those ``special'' composite numbers\footnote{called Carmichael numbers}.

Prof. Rivest uses the analogy of all of the numbers $0 < a < p$ of being in a
bag of marbles, colored black or white.  The color of each marble $a$ is
determined by the test:

\begin{itemize}
\item White: $a^{p-1} \equiv 1 \bmod p$
\item Black: $a^{p-1} \not \equiv 1 \bmod p$
\end{itemize}

Now, for a prime p, all of the marbles in the bag are white, because of
Fermat's Little Theorem.  But for composite p, it depends.  However, we can
tweak our test for primality such that:

\begin{itemize}
\item If p is prime, all of the balls are white.
\item If p is compisite, at most 1/4 of the balls are white.
\end{itemize}

The tweak involves monitoring the computation of $a^{p-1}$ using the repeated
squares algorithm.  The idea is to keep track of the values after squaring.
If the intermediate value is 1, then make sure that the previous value (the
square root) is either $\pm 1$.  As long as the the exponentiation doesn't
reveal any square roots of 1 other than $\pm 1$, the above conditions are
satisfied.  This test is called the {\bf Rabin-Miller Primality Test}.

\section{Division (mod $n$)}

This is a review of performing division modulo some n.

\begin{example}
Let's say we wanted to solve the equation:
\begin{center}
$3x \equiv 5 \bmod 7$
\end{center}

We know that: $5 \equiv 3^{-1}~or~\frac{1}{3} \pmod{7}$

So, we can compute x:
\begin{center}
$5 \cdot 3x \equiv 5 \cdot 5 \rightarrow x \equiv 25 \equiv 4 \bmod 7$
\end{center}

\end{example}

How do we find $x^{-1}$?  Two ways are presented, assuming n is some prime p: 


{\bf Find:} $r$ such that: $r \cdot x \equiv 1 \bmod p ,~0 < r < p$

\subsection{Direct Calculation}

We know from Fermat's Little Theorem that: $x^{p-1} \equiv 1 \bmod p$

so: $x^{p-1} \equiv x^{p-2} \cdot x \equiv 1 \bmod p \\
\dot{\rm.\ .}~~~r \equiv x^{-1} \equiv x^{p-2} \pmod{p}$

\subsection{Euclid's Extended Algorithm}

Given Euclid's Extended Algorithm, given $a,b$ as inputs, we can compute:
\begin{enumerate}
\item $d$ = gcd($a,b$)
\item $x,y$ such that $ax + by = d$
\end{enumerate}

Now, we know that gcd($r,p$) = 1 because p is prime.  So, using the extended
algorithm, we can find $x,y$ such that $rx+py=1$.

The above equation implies that $rx \equiv 1 \bmod p$ so $x \equiv r^{-1}$

\begin{example}
Given: 
$r = 3,~p = 7,~3x + 7y = 1$

We can find values for $x,y$ to make this equation true:
\begin{center}
$3(5) + 7(-2) = 1$
\end{center}
$\dot{\rm.\ .}~ 5 \equiv 3^{-1} \pmod{7}$

\end{example}

Note, this method doesn't require that p be prime, but the condition of
gcd($r,p$) = 1 must hold.

We can use these abilities to invert numbers mod p to enable secret sharing.

\section{Secret Sharing}

Suppose you have a company with a ``big secret'' (for example, you are
Coca-Cola, and the secret is your cola formula).  You want to separate the
secret to your VP's, but in case one leaves, is bought out, etc. the secret
is not compromised, but given enough VP's in one room, each with their piece of
information, can figure out the secret.  This is the principle of {\it secret
sharing}.  You want to divide the secret such that any one person can't
divulge the secret but if ``enough'' people gather together, it is possible
to reconstruct the secret.

Here is one method to share the a secret among $n$ people, such that any $k$
can reconstruct the secret, but no fewer can.

\begin{enumerate}
\item Pick prime $p$: (known to all, public value)
\item Let $a_0$ be the secret to be shared: $0 < a_0 < p$, and k be the
number of people needed to reconstruct the secret.
\item Pick $k-1$ random values: $a_1, a_2, ..., a_{k-1}\pmod{p}$
\item Construct the polynomial: A(x) = $a_0 + a_1x + a_2x^2 + ... +
a_{k-1}x^{k-1}$
\item The ``Dealer'' gives the $i^{th}$ person the pair ($i,A(i)$), $i \neq 0$
\end{enumerate}

This method can be distributed up to $n = p-1$ people.  Now each person has a
pair such that by themselves they cannot reconstruct the secret, but $k$
together can.  How does this work?

Think of $A(x)$ as a curve.  Each pair of ($i,A(i)$) denotes a point on the
curve, and we want to derive the point ($0, A(0)$) because $A(0) = a_0$.
Now, any one point by itself does not give enough information about the
curve, becasue many curves of degree $k-1$ pass through that point.  As a
matter of fact, for any $k-1$ points, every possible curve of degree $k-1$ is
equally likely, because all are possible\footnote{This comes from the
principle that to uniquely define a polynomial of degree $d$, you need d+1
distinct points of the curve.  This fact also makes it impossible for one
person to use their information more than once to derive the secret}.  This
allows any k people to reconstruct the secret as follows:

Assume $k = 3$.  Then the dealer gives out three keys: ($l,A(l)$), ($m,A(m)$),
($n,A(n)$).  To recontruct the original equation, we set up three equations:

\begin{eqnarray}
a_0 + a_1l + a_2l^2 = A(l) \\
a_0 + a_1m + a_2m^2 = A(m) \\
a_0 + a_1n + a_2n^2 = A(n)
\end{eqnarray}

We have three equation and three unknowns, so we can solve for all of the
constants, including $a_0$.  This problem can be recast into the matrix
equation:

\begin{center}
$\left [\begin {array}{ccc} 1&l&{l}^{2}\\\noalign{\medskip}1&m&{m}^{2}
\\\noalign{\medskip}1&n&{n}^{2}\end {array}\right ]
\left [\begin {array}{c} {\it a_0}\\\noalign{\medskip}{\it a_1}
\\\noalign{\medskip}{\it a_2}\end {array}\right ] = 
\left [\begin {array}{c} A(l)\\\noalign{\medskip}A(m)
\\\noalign{\medskip}A(n)\end {array}\right ]$
\end{center}

The problem remains to find the inverse of the 3x3 matrix.  Well, it turns
out that as long as det(A) $\neq 0 \bmod p$, there exists an inverse.  The
inverses in the various intermediate steps can be found using the Extended
Euclidean Algorithm.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes end here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\end{document}
