6.857 Computer and Network Security Fall Term, 1996

Lecture 7 : October 1, 1996

Lecturer: Yoav Yerushalmi Scribe: Albert Lin

Today’s lecture presents some of the number theory that much of modern cryptography is based on. Some of the stuff in the notes is clarified from lecture, or examples were added by yoav to help demonstrate things that time did not permit.

Definition 1 The Greatest Common Divisor (GCD) of a and b is the largest integer that divides both a and b.

Theorem 1 gcd(a,b) = gcd(b, a mod b)

Proof: We will show that gcd(a, b)| gcd(b, a mod b) and gcd(b, a mod b)| gcd(a, b), thus they must be equal.

Let d_{1} = gcd(a, b). Then d_{1}|a and d_{1}|b. By definition, (a mod b) = a−qb for q = ⌊a/b⌋. d_{1}|a and d_{1}|qb ⇒ d_{1}|(a mod b). Since gcd(b, a mod b) is a linear combination of b and (a mod b), d_{1}| gcd(b, a mod b). Therefore gcd(a, b)| gcd(b, a mod b).

Let d_{2} = gcd(b, a mod b). Then d_{2}|b and d_{2}|(a mod b). By definition, a = qb+(a mod b) for q = ⌊a/b⌋. Since d_{2}|b and d_{2}|(a mod b), d_{2}|a. d_{2}|a and d_{2}|b ⇒ d_{2}| gcd(a, b). Therefore gcd(b, a mod b)| gcd(a, b).

Since gcd(a, b)| gcd(b, a mod b) and gcd(b, a mod b)| gcd(a, b), they are equal.

Euclid’s algorithm efficiently computes the gcd of two numbers.

Euclid(a,b): if (b=0) return a else Euclid(b, a mod b)

Example: Euclid(24,18) = Euclid(18,6) = Euclid(6,0) = 6.

Euclid’s algorithm can be extended to find x and y such that d = gcd(a, b) = ax + by.

Extended-Euclid(a,b): if (b=0) return (a,1,0)

else (d′, x′, y′) = Extended-Euclid(b, a mod b)

(d, x, y) = (d′, y′, (x′ − ⌊a/b⌋ · y′))
return (d, x, y)

Definition 2 A group is a set S and an operation ⊕ with these properties:

• closure: ∀a, b ∈ S : a ⊕ b ∈ S

• identity: ∃e ∈ S s.t. ∀a ∈ S : a ⊕ e = e ⊕ a = a

• associativity: ∀a, b, c ∈ S : (a ⊕ b) ⊕ c = a ⊕ (b ⊕ c)

• inverse: foreach a ∈ S : ∃b s.t. a ⊕ b = b ⊕ a = e

S is a finite group if |S| < ∞. S is an Abelian group if it has symmetry: ∀a, b ∈ S : a ⊕ b = b ⊕ a

Examples:

• (Z, +): integers under addition. Abelian, not finite.

• (Z_{5}, ∗): integers mod 5. Not a group (no inverse for 0)

• (Z_{5}^{∗}, ∗): Z_{5}^{∗} = {a ∈ Z_{n} | gcd(a, n) = 1}. the multiplicative group. Abelian, finite.

Finding the multiplicative inverse of x mod n: ax = 1 (mod n) ⇒ ax = kn + 1 ⇒ ax − kn = 1. We can use Extended-Euclid(x,n) to determine the coefficients a and k if a and n are relatively prime.

Sometimes we want to know the size of Z_{n}^{∗}:

Definition 3 Euler’s phi or totient function computes the number of positive integers less than n that are relatively prime to n.

ϕ(n) = n ∏_{p|n}(1 − 1/p)

ϕ(20) = 20(1 − \frac{1}{2})(1 − \frac{1}{5}) = 8 ϕ(p) = p − 1 Note that this function computes |Z_{n}^{∗}| Theorem 2 The Chinese Remainder Theorem: Given pairwise relatively prime m_{1}, …, m_{n} and given a_{1}, …, a_{n}, the system

x ≡ a_{1} (mod m_{1})
x ≡ a_{2} (mod m_{2})
⋮
x ≡ a_{n} (mod m_{n})

is equivalent to x ≡ a (mod M) for some a where M = m_{1} × m_{2} × ⋯ × m_{n}.

Note this theorem basically provides a one-to-one relationship between a set of values each mod a particular number, and one value mod the product. The two are interchangeable:

(a + b) mod M ↔ ((a_{1} + b_{1}) mod m_{1}, ..., (a_{k} + b_{k}) mod m_{k})
(ab) mod M ↔ (a_{1}b_{1} mod m_{1}, ..., a_{k}b_{k} mod m_{k})

How to transform from one representation to the other:

Forward is simple: merely take the value of (a mod M) mod m_{i} for each m_{i}.

Backwards is slightly more complex: Let m_{i} = n/n_{i} so that ∀j ≠ i : m_{i} ≡ 0 (mod n_{j}). Let c_{i} = m_{i}(m_{i}^{−1} mod n_{i}).

Claim: a = (a_{1}c_{1} + ⋯ + a_{k}c_{k}) satisfies the system of equations.

For i ≠ j, a_{j}c_{j} ≡ a_{j}m_{j}(m_{j}^{−1} mod n_{j}) ≡ 0 mod n_{j}

For i = j, a_{j}c_{j} ≡ a_{j}m_{j}(m_{j}^{−1} mod n_{j}) ≡ a_{j}
Thus a = (a_{1}c_{1} + ⋯ + a_{k}c_{k}) ≡ a_{j} (mod m_{j})

Example 1 Let a ≡ 5 (mod 2 ∗ 3), therefore, a_{1} ≡ 2 (mod 3) and a_{2} ≡ 1 (mod 2). Let b ≡ 3 (mod 6), therefore, b_{1} ≡ 0 (mod 3) and b_{2} ≡ 1 (mod 2).

(a + b) ≡ 2 (mod 6)
(a_{1} + b_{1}) ≡ 2 (mod 3)
(a2_{+}b_{2}) ≡ 0 (mod 2)

It is readily apparent that 5 + 3 ≡ 2 (mod 6) is equivalent to 2 + 0 ≡ 2 (mod 3) and 1 + 1 ≡ 0 (mod 2).

Example 2 Find a value a (mod 3)5 such that a ≡ 3 (mod 5) and a ≡ 2 (mod 7).

a_{1} = 3 a_{2} = 2
n_{1} = 5 n_{2} = 7
m_{1} = 7 m_{2} = 5
c_{1} = 3 · 7 c_{2} = 3 · 5

a = c_{1}a_{1} + c_{2}a_{2} = 3 · 21 + 2 · 15 = 93 ≡ 23 (mod 35)

Definition 4 The generated set of g in the group (S, ⊕) is the set {g, g ⊕ g, g ⊕ g ⊕ g, g^{(4)}, …}.

Example 3 Z_{7}^{∗} : ⟨1⟩ = {1}, ⟨2⟩ = {2, 4, 1}, ⟨3⟩ = {3, 2, 6, 4, 5, 1} (Z_{6}, +) : ⟨0⟩ = {0}, ⟨1⟩ = {1, 2, 3, 4, 5, 0}, ⟨2⟩ = {2, 4, 0}, ⟨3⟩ = {3, 0}, ⟨4⟩ = {4, 2, 0}, etc

Note already that the groups cycle. Repeating the computation on the generator |⟨g⟩| times results in the value of g.

Theorem 3 Euler’s Theorem: ∀a ∈ Z_{n}^{∗} : a^{ϕ(n)} ≡ 1 (mod n)

Theorem 4 Fermat’s Theorem: ∀a ∈ Z_{p}^{∗} : a^{p−1} ≡ 1 (mod n) Fermat’s Theorem follows directly from Euler’s Theorem, since ϕ(p) = p − 1.

Definition 5 In the group S, g is a prime generator of S if ∀a ∈ S : ∃b s.t. g^{b} = a. Often times, this g is just referred to as the generator.

The Discrete Log problem: Given a generator g ∈ Z_{p}^{∗} and an element a ∈ Z_{p}^{∗}, find b such that g^{b} = a. This problem turns out to be very difficult to solve, and yet very simple to test.

Example 4 Given the generator 3 of Z_{7}^{∗}, The discrete log of 1 is 6, since 3^{6} = 729 ≡ 1 (mod 7). The discrete log of 6 is 3, since, 3^{3} = 27 ≡ 6 (mod 7).

The Square Root problem: Given a value a ∈ Z_{n}^{∗}, find a b such that b^{2} ≡ a (mod n). This problem is as difficult as factoring n. Given the factorization of n, one can find the square roots. Given the square roots, one can find the factorization of n.

There do not have to be 2 square roots to every number, but if we are calculating in Z_{p}^{∗} we are guaranteed either 2 square roots or no square roots. If n is composite, we can expect either no square roots, or a power of two for each of its factors. So in Z_{7}^{∗} we expect numbers to have either two or no square roots, but in Z_{15}^{∗} we can expect four or none, and in Z_{245}^{∗} we can expect 8 or none.

Example 5 The square roots of 4 in Z_{7}^{∗} are 2 and 5 (or 2 and -2). The square roots of 4 in Z_{6}^{∗} don’t exist (2, which one would expect to be a square root, isn’t in Z_{6}^{∗}). In Z_{5}^{∗} we have 2 and 3 (or 2 and -2). Finally, in Z_{35}^{∗}, we have 2, 12, 23, and 33 (or 2, 12, -2, -12). Given those roots by the way, we can add any two unique (not b and -b, or 2 and 33 in our example), and do a gcd with the composite number (35 in our case) to get one of the prime factors. For example, gcd((2 + 12), 35) = 7. This is how we can factor a composite number given all the square roots of some number within it multiplicative group.

Definition 6 A number x is a quadratic residue mod p if ∃y s.t. y^{2} ≡ x (mod p)

It can be shown that half of the elements of Z_{p}^{∗} are quadratic residues, and half are quadratic nonresidues. This knowledge will be used later to create the simplest probabilistic prime number tester.

Definition 7 Suppose p is an odd prime. For any integer a ≥ 0, we define the Legendre symbol

(\frac{x}{p}) = \{ \begin{matrix}1 & if QR(x) \\ 0 & if x|p \\ −1 & if not QR(x) \end{matrix}

(\frac{x}{p}) = x^{(p−1)/2} (mod p)

Definition 8 Related to the Legendre Symbol, the Jacobi symbol is defined to be

(\frac{x}{n}) = ∏_{p|n}(\frac{x}{p})

while the definition implies that one needs to know the factorization of n to solve for (\frac{x}{n}), it turns out that one can calculate the Jacobi symbol without factoring, in polynomial time.

Now that we have the basics, we can create a probabilistic test for figuring out if a number is prime: The Solovay-Strassen algorithm.

Solovay-Strassen(n): choose a at random ∈ {1, …, n} if gcd(a, n) ≠ 1, fail else j = a^{(n−1)/2} (mod n) if j ≠ (\frac{a}{n}), fail else return

The proof is beyond the scope of the class. However, an argument can be made for its success. If n is prime, it will always pass, since the Legendre Symbol of a = a^{(n−1)/2} (mod n) must equal the Jacobi symbol of a (the two yield the same result for prime numbers by the definition of the Jacobi symbol). If n is not prime, then the Legendre symbol computation will return some value. The Jacobi symbol computation will tell us whether the number is not a QR in an even or an odd number of factors of n. (For each prime factor of n where the a is a QR, we multiply by 1 which does nothing. For each factor where it is not a QR, we multiply by -1, which inverts the result). So we have a sort-of-random choice between 1 and -1, which we compare with the Legendre symbol value. The probability that we have hit on two equal results is less than 50%.

If this algorithm fails for a number, it is guaranteed to not be a prime. If it succeeds, it can be demonstrated that the number has a greater than 50% chance of being prime. We can repeat this test with different choices of a. For each different a we chose, the test splits the probabilities again. For t different values of a, if the test passes for all, there is a 2^{−t} chance that p is not prime. We can make this value arbitrarily small.

There are other ways of testing primality. A popular probabilistic one is Rabin-Miller which will be covered later. There are also deterministic methods in existence, although those tend to require many more computations, and so are in general less popular.

1 Modular Exponentation

Modular exponentiation is a very useful primitive in cryptography, along with addition, subtraction, multiplication and computing multiplicative inverses modulo some base n.

The basic idea is:

Given: numbers a, b, c: We want to compute a^{b} (mod c)

This can be efficiently computed, even for large values of a and b. The reason is that we can do several things well:

• Multiplication We can compute ab quickly, just make the product, and find the remainder after dividing by c.

• Squaring We can compute a^{2} just as quickly: let b = a.

There are two ways of approaching modular exponentiation:

1.1 Slow Way - Brute Force

This method is exactly like it sounds, just take a and multiply it by itself b times, reducing modulo c to ensure that the values don’t get too big.

The problem with this method is that it is linear in the value of b, which makes it really slow for large values of b, or exponential in the number of bits of b.^{1}

1.2 Smarter Way - Repeated Squaring

This is described in one of today’s readings.

Example 6 Compute a^{20} (mod c)

First, take a look at 20 in binary: 20 = 10100_{2}

Then, go from left to right, working up the value that you need. In this case, the algorithm would go:

1The number of bits of b, k_{b} = lg(b), so brute force runs in about b = 2^{k_{b}} steps.

a^{0} → a^{1} → a^{2} → a^{5} → a^{10} → a^{20}

Details: Looking at the binary representation from left to right, we figure out what to change a to.

• If we shift and see a 0 (e.g. 101_{2} → 1010_{2}), that is the same as multiplying by 2, so we sqaure the number:

a^{b} → a^{2b} = (a^{b})^{2}

• If we shift and see a 1 (e.g. 1010_{2} → 10101_{2}), that is the same as multiplying by two and adding one, so sqaure the number and multiply the result by a:

a^{b} → a^{(2b+1)} = (a^{b})^{2} · a

The difficulty of this method is now limited by the bit-length of b.

2 Finding Large Prime Numbers

We can do this in several ways:

• Look it up - There are books that list large numbers of primes, and you can pick a couple for keys.

• Find one yourself - There are several ways of determining if a number is prime, and we also have 2 nice properties about prime numbers:

1. There are an infinite number of primes.

2. The primes are reasonably spaced.

The second point can be stated more formally:

Theorem 5 Prime Number Theorem (stated without proof)

if π(x) = The number of primes ≤ x, (ex. π(10) = 4) then

π(x) ≈ \frac{x}{ln(x)}(1 + o(1))

This approximation gets better for large values of x. Informally, the theorem states that if you pick a number less than x at random, the probablility that it is prime approaches \frac{1}{ln(x)}. Therefore, you would expect to pick about ln(x) numbers at random before you find a prime, so just picking a number at random and a test for primality will terminate in a reasonable about of time^{2} (e.g. x = 10^{20} you expect in about 60 random tries to find a prime number.)

Now we need a test for primality. For this, we use a theorem of Fermat:

Lemma 1 Fermat’s Little Theorem

If p is prime and 0 < a < p then:

a^{p−1} ≡ 1 mod p

So, the test would be, test a bunch of a’s and see that they all obey the theorem. If you find one that fails, p must be composite.

Note, this theorem says nothing about what if p is composite. It is possible for the test to succeed for composite numbers as well. So, the next question to ask is how well does the theorem work for composite numbers? It turns out, there are composite number that satisfy this theorem as well. So, the theorem alone is not enough to test for primality, because we could hit one of those “special” composite numbers^{3}.

Prof. Rivest uses the analogy of all of the numbers 0 < a < p of being in a bag of marbles, colored black or white. The color of each marble a is determined by the test:

• White: a^{p−1} ≡ 1 mod p

• Black: a^{p−1} ≢ 1 mod p

Now, for a prime p, all of the marbles in the bag are white, because of Fermat’s Little Theorem. But for composite p, it depends. However, we can tweak our test for primality such that:

2You can even increase your chances by only picking odd numbers, and doing a couple of quick tests.

3called Carmichael numbers

10 3 DIVISION (MOD N)

• If p is prime, all of the balls are white.

• If p is compisite, at most 1/4 of the balls are white.

The tweak involves monitoring the computation of a^{p−1} using the repeated squares algorithm. The idea is to keep track of the values after squaring. If the intermediate value is 1, then make sure that the previous value (the square root) is either ±1. As long as the the exponentiation doesn’t reveal any square roots of 1 other than ±1, the above conditions are satisfied. This test is called the Rabin-Miller Primality Test.

3 Division (mod n)

This is a review of performing division modulo some n.

Example 7 Let’s say we wanted to solve the equation:

3x ≡ 5 mod 7

We know that: 5 ≡ 3^{−1} or \frac{1}{3} (mod 7)

So, we can compute x:

5 · 3x ≡ 5 · 5 → x ≡ 25 ≡ 4 mod 7

How do we find x^{−1}? Two ways are presented, assuming n is some prime p:

Find: r such that: r · x ≡ 1 mod p, 0 < r < p

3.1 Direct Calculation

We know from Fermat’s Little Theorem that: x^{p−1} ≡ 1 mod p

so: x^{p−1} ≡ x^{p−2} · x ≡ 1 mod p ˙. . r ≡ x^{−1} ≡ x^{p−2} (mod p)

3.2 Euclid’s Extended Algorithm

Given Euclid’s Extended Algorithm, given a, b as inputs, we can compute:

1. d = gcd(a, b)

2. x, y such that ax + by = d

Now, we know that gcd(r, p) = 1 because p is prime. So, using the extended algorithm, we can find x, y such that rx + py = 1.

The above equation implies that rx ≡ 1 mod p so x ≡ r^{−1}

Example 8 Given: r = 3, p = 7, 3x + 7y = 1

We can find values for x, y to make this equation true:

3(5) + 7(−2) = 1

˙. . 5 ≡ 3^{−1} (mod 7)

Note, this method doesn’t require that p be prime, but the condition of gcd(r, p) = 1 must hold.

We can use these abilities to invert numbers mod p to enable secret sharing.

4 Secret Sharing

Suppose you have a company with a “big secret” (for example, you are Coca-Cola, and the secret is your cola formula). You want to separate the secret to your VP’s, but in case one leaves, is bought out, etc. the secret is not compromised, but given enough VP’s in one room, each with their piece of information, can figure out the secret. This is the principle of secret sharing. You want to divide the secret such that any one person can’t divulge the secret but if “enough” people gather together, it is possible to reconstruct the secret.

Here is one method to share the a secret among n people, such that any k can reconstruct the secret, but no fewer can.

1. Pick prime p: (known to all, public value)

2. Let a_{0} be the secret to be shared: 0 < a_{0} < p, and k be the number of people needed to reconstruct the secret.

3. Pick k − 1 random values: a_{1}, a_{2}, ..., a_{k−1} (mod p)

4. Construct the polynomial: A(x) = a_{0} + a_{1}x + a_{2}x^{2} + ... + a_{k−1}x^{k−1}

5. The “Dealer” gives the i^{th} person the pair (i, A(i)), i ≠ 0

This method can be distributed up to n = p − 1 people. Now each person has a pair such that by themselves they cannot reconstruct the secret, but k together can. How does this work?

Think of A(x) as a curve. Each pair of (i, A(i)) denotes a point on the curve, and we want to derive the point (0, A(0)) because A(0) = a_{0}. Now, any one point by itself does not give enough information about the curve, becasue many curves of degree k − 1 pass through that point. As a matter of fact, for any k − 1 points, every possible curve of degree k − 1 is equally likely, because all are possible^{4}. This allows any k people to reconstruct the secret as follows:

Assume k = 3. Then the dealer gives out three keys: (l, A(l)), (m, A(m)), (n, A(n)). To recontruct the original equation, we set up three equations:

a_{0} + a_{1}l + a_{2}l^{2} = A(l)  (1)
a_{0} + a_{1}m + a_{2}m^{2} = A(m)  (2)
a_{0} + a_{1}n + a_{2}n^{2} = A(n)  (3)

We have three equation and three unknowns, so we can solve for all of the constants, including a_{0}. This problem can be recast into the matrix equation:

[ \begin{matrix}1 & l & l^{2} \\ 1 & m & m^{2} \\ 1 & n & n^{2} \end{matrix} ] [ \begin{matrix}a_{0} \\ a_{1} \\ a_{2} \end{matrix} ] = [ \begin{matrix}A(l) \\ A(m) \\ A(n) \end{matrix} ]

4This comes from the principle that to uniquely define a polynomial of degree d, you need d+1 distinct points of the curve. This fact also makes it impossible for one person to use their information more than once to derive the secret

The problem remains to find the inverse of the 3x3 matrix. Well, it turns out that as long as det(A) ≠ 0 mod p, there exists an inverse. The inverses in the various intermediate steps can be found using the Extended Euclidean Algorithm.