%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\documentstyle[12pt,twoside,alltt]{article}
\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {2}
\sloppy

\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of 
Proof}\hspace*{1em}}{\qed\bigskip}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}

\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1996}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture #1 : #2 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: #3 \hfill Scribe: #4} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%		ordinal number of the lecure
%		date of the lecure
%		lecturer
%		scribe---that is you
%
\lecture{8}{October 1, 1996}{Yoav Yerushalmi}{Albert Lin} 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% For theorems, lemmas, definitions, remarks, etc. use commands
% \begin{theorem} .... \end{theorem} 
% \begin{definition} ... \end{definition} 
% \begin{proof} ... \end{proof}
% and so on ...
%
% If you want to insert figures in your notes do the following: 
% 1) Prepare your figures using your favourite graphic editor
% 	for example idraw or xfig
% 2) Save your pictures in PostScript form using the following convention
% 	notes-nn-fig-mm.ps where nn is the number of the lecture you 
% 	are scribing and mm is the sequential number of the picture in the 
% 	notes
% 3) Insert the following block in your LaTeX code in the place you 
% 	want to insert the figure BUT LEAVE IT AS A COMMENT (with the %
% 	at the beginning of the line) since it will not work on athena: 
%
% \begin{figure}[h]
% \begin{center}
% \mbox{\psfig{figure=notes-nn-fig-mm.ps}}
% \caption{A very nice picture.}
% \label{fig:mm}
% \end{center}
% \end{figure}
%
% 	of course the picture will not show up when you compile and 
% 	print your notes, but don't worry the TA will take care of it. 
% 4) When you mail the TA the LaTeX code mail him/her the PostScript
%	files for the figures as well 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

Today's lecture presents some of the number theory that much of modern
cryptography is based on. Some of the stuff in the notes is clarified
from lecture, or examples were added by yoav to help demonstrate
things that time did not permit.

\begin{definition}
The Greatest Common Divisor (GCD) of a and b is the largest integer that
divides both a and b.
\end{definition}
\begin{theorem}
gcd(a,b) = gcd(b, a mod b)
\end{theorem}
\begin{proof}
We will show that $\gcd(a,b)|\gcd(b, a \bmod b)$ and $\gcd(b, a \bmod
b)|\gcd(a,b)$, thus they must be equal.

Let $d_1$ = $\gcd(a,b)$.  Then $d_1|a$ and $d_1|b$.  By definition, $(a
\bmod b) = a - qb$ for $q = \lfloor{a / b}\rfloor$.  $d_1|a$ and
$d_1|qb$ $\Rightarrow$ $d_1|(a \bmod b)$.  Since $\gcd(b, a \bmod b)$ is
a linear combination of $b$ and $(a \bmod b)$, $d_1|\gcd(b, a \bmod b)$.
Therefore $\gcd(a,b) | \gcd(b, a \bmod b)$.

Let $d_2 = \gcd(b, a \bmod b)$.  Then $d_2|b$ and $d_2|(a \bmod b)$.  By
definition, $a = qb + (a \bmod b)$ for $q = \lfloor{a / b}\rfloor$.
Since $d_2|b$ and $d_2|(a \bmod b)$, $d_2|a$.  $d_2|a$ and $d_2|b$
$\Rightarrow$ $d_2|\gcd(a,b)$.  Therefore $\gcd(b, a \bmod
b)|\gcd(a,b)$.

Since $\gcd(a,b)|\gcd(b, a \bmod b)$ and $\gcd(b, a \bmod b)|\gcd(a,b)$,
they are equal.
\end{proof}

Euclid's algorithm efficiently computes the gcd of two numbers.

\begin{tabbing}
{\noindent{\bf Euclid(a,b):}} \= if (b=0) return a \\
\> else Euclid(b, a mod b)
\end{tabbing}
{\noindent{\bf Example:}} Euclid(24,18) = Euclid(18,6) = Euclid(6,0) = 6.

Euclid's algorithm can be extended to find $x$ and $y$ such that $d =
\gcd(a,b) = ax + by$.

\begin{tabbing}
{\noindent{\bf Extended-Euclid(a,b):}} \=
if (b=0) \= return (a,1,0) \+ \\
else \> $(d', x', y') =$ Extended-Euclid$(b, a \bmod b)$ \+ \\
$(d, x, y) = (d', y', (x' - \lfloor a/b \rfloor \cdot y'))$ \\
return $(d, x, y)$
\end{tabbing}

\begin{definition}
A {\bf group} is a set S and an operation $\oplus$ with these
properties:
\begin{itemize}
\item closure: $\forall a, b \in S: a \oplus b \in S$
\item identity: $\exists e \in S$ s.t. $\forall a \in S: a \oplus e
= e\oplus a = a$
\item associativity: $\forall a,b,c \in S: (a \oplus b) \oplus c = a
\oplus (b \oplus c)$
\item inverse: foreach $a \in S: \exists b$ s.t. $a \oplus b = b \oplus
a = e$
\end{itemize}

\end{definition}
S is a {\bf finite} group if $|S| < \infty$. \\
S is an {\bf Abelian} group if it has symmetry: $\forall a,b \in S: a
\oplus b = b \oplus a$

{\bf Examples:}
\begin{itemize}
\item ($Z$, +): integers under addition.  Abelian, not finite.
\item ($Z_5$, $\ast$): integers mod 5.  Not a group (no inverse for 0)
\item ($Z_5^*$, $\ast$): $Z_5^* = \{ a \in Z_n \mid \gcd(a,n) =
1\}$. the multiplicative group.  Abelian, finite.
\end{itemize}

Finding the multiplicative inverse of x mod n: $ax = 1 \pmod{n}
\Rightarrow ax = kn + 1 \Rightarrow ax - kn = 1$.  We can use
Extended-Euclid(x,n) to determine the coefficients a and k if a and n
are relatively prime.

Sometimes we want to know the size of $Z_n^*$:
\begin{definition}
Euler's {\bf phi} or {\bf totient} function computes the number of
positive integers less than n that are relatively prime to n.
\[\phi(n) = n\prod_{p \mid n} (1 - 1/p) \]
\end{definition}
$\phi(20) = 20(1-{1 \over 2})(1-{1 \over 5}) = 8$ \\
$\phi(p) = p - 1$\\
Note that this function computes $|Z_n^*|$

\begin{theorem}
{\bf The Chinese Remainder Theorem:} Given pairwise relatively prime
$m_1,\ldots,m_n$ and given $a_1,\ldots,a_n$, the system
\begin{eqnarray*}
x & \equiv & a_1 \pmod{m_1} \\
x & \equiv & a_2 \pmod{m_2} \\
& \vdots & \\
x & \equiv & a_n \pmod{m_n} \\
\end{eqnarray*}
is equivalent to $x \equiv a \pmod{M}$ for some a where $M = m_1 \times
m_2 \times \cdots \times m_n$.
\end{theorem}

Note this theorem basically provides a one-to-one relationship between
a set of values each mod a particular number, and one value mod the
product. The two are interchangeable:
\begin{eqnarray*}
(a+b) \bmod M & \leftrightarrow &((a_1 + b_1) \bmod m_1, ..., (a_k +
b_k) \bmod m_k) \\
(ab) \bmod M & \leftrightarrow & (a_1 b_1 \bmod m_1,..., a_k b_k \bmod
m_k) \\
\end{eqnarray*}

How to transform from one representation to the other:

Forward is simple: merely take the value of $(a \bmod M) \bmod m_i$
for each $m_i$.

Backwards is slightly more complex: 
Let $m_i = n / n_i$ so that $\forall j \neq i: m_i \equiv 0
\pmod{n_j}$.  Let $c_i = m_i(m_i^{-1} \bmod n_i)$.
\begin{tabbing}
{\bf Claim:} \= $a = (a_1 c_1 + \cdots + a_k c_k)$ satisfies the system of
equations. \+ \\
For $i \neq j$, $a_j c_j \equiv a_j m_j (m_j^{-1} \bmod n_j) \equiv 0
\bmod n_j$ \\
For $i = j$, $a_j c_j \equiv a_j m_j (m_j^{-1} \bmod n_j) \equiv a_j$ \\
Thus $a = (a_1 c_1 + \cdots + a_k c_k) \equiv a_j \pmod{m_j}$
\end{tabbing}

\begin{example}

Let $a \equiv 5 \pmod{2*3}$, therefore, $a_1 \equiv 2 \pmod 3$ and
$a_2 \equiv 1 \pmod 2$.
Let $b \equiv 3 \pmod 6$, therefore, $b_1 \equiv 0 \pmod 3$ and
$b_2 \equiv 1 \pmod 2$.
\begin{eqnarray*}
(a+b) & \equiv &2 \pmod 6 \\
(a_1 + b_1) & \equiv & 2 \pmod 3 \\
(a2_ + b_2) & \equiv & 0 \pmod 2 \\
\end{eqnarray*}

It is readily apparent that $5+3 \equiv 2 \pmod 6$ is equivalent to
$2+0 \equiv 2 \pmod 3$ and $1+1 \equiv 0 \pmod 2$.
\end {example}

\begin{example}
Find a value $a \pmod 35$ such
that $a \equiv 3 \pmod 5 \mbox{ and } a \equiv 2 \pmod 7$.

\begin{eqnarray*}
a_1 = 3 & a_2 = 2 \\
n_1 = 5 & n_2 = 7 \\
m_1 = 7 & m_2 = 5 \\
c_1 = 3 \cdot 7 & c_2 = 3 \cdot 5 \\
\end{eqnarray*}
\[a = c_1 a_1 + c_2 a_2 = 3 \cdot 21 + 2 \cdot 15 = 93 \equiv 23 \pmod{35}\]
\end{example}

\begin{definition}
The {\bf generated set} of g in the group (S, $\oplus$) is the set
$\{ g, g \oplus g, g \oplus g \oplus g, g^{(4)}, \ldots \}$.
\end{definition}

\begin{example}
$Z_7^*: \langle1\rangle = \{1\}, \langle2\rangle = \{2,4,1\},
\langle3\rangle = \{3,2,6,4,5,1\}$ \\
$(Z_6, +): \langle0\rangle = \{0\}, \langle1\rangle = \{1,2,3,4,5,0\},
\langle2\rangle = \{2,4,0\}, \langle3\rangle = \{3,0\}, \langle4\rangle
= \{4,2,0\},$ etc\\
\end{example}
Note already that the groups cycle. Repeating the computation on the generator
$| \langle g \rangle |$ times results in the value of $g$. 

\begin{theorem}
{\bf Euler's Theorem}: $\forall a \in Z_n^*: a^{\phi(n)} \equiv 1
\pmod{n}$
\end{theorem}

\begin{theorem}
{\bf Fermat's Theorem}: $\forall a \in Z_p^*: a^{p-1} \equiv 1
\pmod{n}$ \\
Fermat's Theorem follows directly from Euler's Theorem, since $\phi(p)
= p-1$.
\end{theorem}

\begin{definition}
In the group S, g is a {\bf prime generator} of S if $\forall a \in S: \exists
b $ s.t. $g^b = a$. Often times, this g is just referred to as the
{\em generator}.
\end{definition}

The {\bf Discrete Log problem}: Given a generator $g \in Z_p^*$ and an
element $a \in Z_p^*$, find $b$ such that $g^b = a$. This problem turns
out to be very difficult to solve, and yet very simple to test.

\begin{example}
Given the generator $3$ of $Z_7^*$, The discrete log of $1$ is $6$,
since $3^6 = 729 \equiv 1 \pmod 7$. The discrete log of $6$ is $3$,
since, $3^3 = 27 \equiv 6 \pmod 7$.
\end {example}

The {\bf Square Root problem}: Given a value $a \in Z_n^*$, find a $b$
such that $b^2 \equiv a \pmod n$. This problem is as difficult as
factoring $n$. Given the factorization of $n$, one can find the square
roots. Given the square roots, one can find the factorization of
$n$.

There do not have to be 2 square roots to every number,
but if we are calculating in $Z_p^*$ we are guaranteed either 2 square
roots or no square roots. If n is composite, we can expect either no
square roots, or a power of two for each of its factors. So in $Z_7^*$
we expect numbers to have either two or no square roots, but in
$Z_{15}^*$ we can expect four or none, and in $Z_{245}^*$ we can expect 8
or none.

\begin {example}
The square roots of 4 in $Z_7^*$ are 2 and 5 (or 2 and -2). The square
roots of 4 in $Z_6^*$ don't exist (2, which one would expect to be a
square root, isn't in $Z_6^*$). In $Z_5^*$ we have 2 and 3 (or 2 and
-2). Finally, in $Z_{35}^*$, we have 2, 12, 23, and 33 (or 2, 12, -2,
-12). Given those roots by the way, we can add any two unique (not b
and -b, or 2 and 33 in our example), and do a gcd with the composite
number (35 in our case) to get one of the prime factors. For example,
$gcd((2+12), 35) = 7$. This is how we can factor a composite number
given all the square roots of some number within it multiplicative
group.
\end{example}

\begin{definition}
A number x is a {\bf quadratic residue} mod p if $\exists y$ s.t. $y^2
\equiv x \pmod{p}$
\end{definition}
It can be shown that half of the elements of $Z_p^*$ are quadratic residues,
and half are quadratic nonresidues. This knowledge will be used later
to create the simplest probabilistic prime number tester.


\begin{definition}
Suppose p is an odd prime.  For any integer $a \geq 0$, we define the
{\bf Legendre symbol} \[ ({x \over p}) = \left\{ \begin{array}{ll}
			   1 & \mbox{if QR(x)} \\
			   0 & \mbox{if $x|p$} \\
			   -1& \mbox{if not QR(x)}
			   \end{array}
		   \right. \]
\[ ({x \over p}) = x^{(p-1)/2} \pmod p \]
\end{definition}

\begin{definition}
Related to the Legendre Symbol, the {\bf Jacobi symbol} is defined to be
\[ ({x \over n}) = \prod_{p \mid n} ({x \over p}) \]
while the definition implies that one needs to know the factorization
of $n$ to solve for $({x \over n})$, it turns out that one
can calculate the Jacobi symbol without factoring, in polynomial time.
\end{definition}

Now that we have the basics, we can create a probabilistic test
for figuring out if a number is prime: The {\bf Solovay-Strassen}
algorithm. 
\begin{tabbing}
{\noindent{\bf Solovay-Strassen(n):}} \= choose a at random $\in
\{1,\ldots,n\}$ \\
\> if $\gcd(a,n) \neq 1$, fail \\
\> else \= $j = a^{(n-1)/2} \pmod{n}$ \\
\> \> if $j \neq ({a \over n})$, fail \\
\> \> else return \\
\end{tabbing}

The proof is beyond the scope of the class. However, an argument can
be made for its success. If $n$ is prime, it will always pass, since
the Legendre Symbol of $a = a^{(n-1)/2} \pmod n$ must equal the Jacobi
symbol of $a$ (the two yield the same result for prime numbers by the
definition of the Jacobi symbol). If
$n$ is not prime, then the Legendre symbol computation will return
some value. The Jacobi symbol computation will tell us whether the
number is not a QR in an even or an odd number of factors of $n$. (For
each prime factor of $n$ where the $a$ is a QR, we multiply by 1 which does
nothing. For each factor where it is not a QR, we multiply by -1,
which inverts the result). So we have a sort-of-random choice between
1 and -1, which we compare with the Legendre symbol value. The
probability that we have hit on two equal results is less than 50\%.

If this algorithm fails for a number, it is {\em guaranteed} to not be
a prime. If it succeeds, it can be demonstrated that the number has a
greater than 50\% chance of being prime. We can repeat this
test with different choices of $a$. For each different $a$ we chose,
the test splits the probabilities again. For $t$ different values of
$a$, if the test passes for all, there is a $2^{-t}$ chance that
p is not prime. We can make this value arbitrarily small.

There are other ways of testing primality. A popular probabilistic
on is Rabin-Miller which will be covered in the next lecture. There
are also deterministic methods in existence, although those tend
to require many more computations, and so are in general less popular.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes end here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\end{document}
