number-theoretic algorithms

Number-Theoretic Algorithms

Chapter 31, CLRS book

Modular Arithmetic

| : divides , is a divisor of . gcd( , ): greatest common divisor of and . Coprime or relatively prime: gcd( , ) 1. Euclid's algorithm: compute gcd( , ). Extented Eucli

Integers

a b a b a ba b a b

a ba b

d's algorithm: compute integers and such that gcd( , ).x y ax by a b

Let 2 be an integer.

Def: is congruent to modulo , written

mod , if | ( ), i.e., and have the

same remainder when d

ivided by .

Note: dod an

Integers modulo n

a b n n a b a b

are different.

Def: [ ] all integers congruent to modulo .

[ ] is called a residue class modulo , and is a

representati

ve of that class.

congruence m

There are exactly residue classes modulo :

[0], [1], [2], , [ 1].

Note: " " is an equivalence relation, whose

equivalence classes are the residue classes.

If [ ]

[ ], then [ ] and [ ].

Define addition and multiplication for residue classes:

[ ] [ ] [ ]

[ ] [ ] [ ].n

y b x y a b x y a b

a b a b

A group, denoted by ( , ), is a set with a binary operation : such that 1. , , (closure) 1. ( ) ( ) (associativity) 2. s.t id. , ( entity

G GG G G

x y Gx y z x y ze G x G x x e x

3. , s.t. ( )

A group ( , ) is if , , .

Examples: ( , ), ( , ), ( \ {0}, ), ( , ),

inverse

abelian

( \ {0}, ).

x G y G x y y x

G x y G x y y x

Z Q Q RR

Define [0], [1], ..., [ 1] .

Or, more conveniently, 0, 1, ..., 1 .

, forms an abelian additive group.

For , ,

( ) mod . (Or, [ ] [ ] [ ] [ mod ].)

0 is th

a b Za b a b n a b a b a b n

e identity element. The inverse of , denoted by , is .

When doing addition/substraction in , just do the regular addition/substraction and reduce the result modulo .

In , 5

a a n a

g 5 9 4 6 2 8 3 ?

, is not a group, because 0 does not exist.

Even if we exclude 0 and consider only \ {0},

, is not necessarily a group; some may not exist.

For , exists if and on

ly if gcd( , ) 1.a n

Let : gcd( , ) 1 .

, is an abelian multiplicative group.

mod . 1 is the identity elemen

The inverse of , written , can be computated b

Z a Z a n

a b ab n

y the Extended Euclidean Algorithm.

For example, 1,5,7

Q: How many

,11 . 5 7

35mod12 11.

nts are ther ? e in nZ

Euler's totient function:

= : 1 and gcd( , ) 1

1. ( ) ( 1) for prime

2. ( ) ( ) ( ) if gcd( ,

a a n a n

p p p p

ab a b a b

Let be a (multiplicative) group. The order of , ord( ), is the number of elements in . The order of , written ord( ), is the smallest

positive integer such that .

GG G Ga G a

t e ea

ord( )

dentity element.)

Corollary: For any

Lagrange's theorem: For any element , ord( ) | ord( ).

Fermat's little theorem:

If ( a prime), t

element , .

a G a G

* ( ) *

1 in .

Euler's theorem:

If (for any 1), then 1 in .

a Z n a Z

= 1, 2, 4, 7, 8, 11, 13, 14

(15) (3) (5) 2 4 8

: 1 2 4 7 8 11 13 14ord( ) : 1 4 2 4 4 2 4 2

Example: 15

The Chinese Remainder Problem

• A problem described in an ancient Chinese arithmetic book, Sun Tze Suan Ching, by Sun Tze (around 300AD, author of The Art of War).

• Problem: We have a number of objects, but we do not know exactly how many. If we count them by threes we have two left over. If we count them by fives we have three left over. If we count them by sevens we have two left over. How many objects are there?Mathematically, if 2mod3, 3mod5, 2mod7,

at is ?x x x

If integers , , are pairwise coprime, then the system of congruences

modmod

has a unique solution modulo :

Chinese remainder theorem

x a nx a n

N n n n

1 A fo

where an rmula by Gausd mod ( s)

i i i i i

N N n y N n

Suppose 1 mod 3 6 mod 7 8 mod 10By the Chinese remainer theorem, the solution is:

1 70 (70 mod3) 6 30 (30 mod7) 8 21 (21 mod10)

1 70 (1 mod3) 6 30 (2 mod7) 8 21 (1 mod10)

1 70 1 6 30 4 8 21 1 mod 210

958 mod 210 118 mod 210

Example: Chinese remainder theorem

(the numbers are pairwise coprime) There is a one-to-one correspondence :

, , , where and mod

( ) ( ) ( ). ( )

Another version of CRT

k N i i

N n n n n

a a a a Z a a n

x y x yx y

( ) ( ).

For math students: is a ring isomorphism.

Let , where , , are pairwise coprime.Define a mapping

( mod , mod , , mod )

is bijective (one-to-one and on

Chinese remainder theorem

N n n n

N n n n n n

Z Z Z Z

x x n x n x n

( ) ( ) ( ).

x y x y

Computations in can be done by performing corresponding computations in , , , , and

then solve the CRP.

, , If

ZZ Z Z

a a ab b b

, , , ,

, , if

mod mo d mod

b a ba b a b a ba b a b a b b Z

* * *15 3 5 15 3 5

8 8mod3, 8mod5 (2,3)

11 11mod3, 11mod5 (2,1)

Suppose we want to compute 8 11 mod15. 8 11mod15 (2 2mod3, 3 1mod5) (1,3). (1,3) (

Example: Chinese remainder theoremZ Z Z Z Z Z

15which number corresponds to (1,3)?)

1mod3 Solve 13

Algorithms

Running time: log

Comment: compute gcd( , ), where 1. : : for : 1, 2, until = 0 : mod return ( )

Running time:

(log ) i t

Euclidean Algorithm

a b a br ar b

i rr r rr

erations; (log ) time for each mod.

Overall running time: (lo g )

Example: gcd(299,221) ?

299 221

Given 0, compute , such that gcd( , ) .

1 782 65

221 7878 65

78 6578 221 78

65 5 13 0

gcd(229,221) 13( 2 ) 3

78 2 1

Extended Euclidean Algorithm

a b x y a b ax by

99 221) 221299

123 2 14

Compute in .

exists if and only if gcd( , ) 1. Use extended Euclidean algorithm to find ,

such that gcd( , ) 1 (in )

?How to compute na Z

a a nx y

ax ny a n

[ ] [ ][ ] [1] [ ][ ] [1] (since [ ] [0])

[ ] [ ]. Note: may omit [ ], but reduce everything modulo .

x n ya x n

1 Compute 15 mod 47. 47 15 3 (divide 47 by 15; remainder 2) 15 2 7 (divide 15 by 2; remainder 1) 1 15 7 (mod 47) 1

25 ( ) 7 (mod 47)47 15 3

Example

15 22 47 7 (mod 47) 15 22 (mod 47)

15 mod 47 22

That is, 15 22 in Z

Comment: compute mod , where in binary.

1 for downto 0 do

mod if 1 then mod

Algorithm: Square-and-Multiply( , , )c

x n c c c c

z z nc z z x n

...Note: At the end of iteration

turn ( )

k ic ci x

23 10111

11 mod 187 11 (square and multiply)

mod 187 121 (square)

11 mod 187 44 (square and multiply)

11 mod 187 165 (square and

11 mod187

Example:

ltiply)

11 mod 187 88 (square and multiply)z z

The RSA Cryptosystem

By ivest, hamir & dleman of MIT in 1977. Best known and most widely used public-key scheme. Based on the one-way property

lar powering:

assumed

The RSA Cryptosystem

: mod (easy)

In turn based on the hardness

(hard)

of integer factorization.

f x x n

Encryption (easy):

Decryption (hard):

Looking for a "trapdoor": ( ) .If is a number such t

It works in group . Let be a mess g

Idea behind RSA

( ) 1 ( )

1mod ( ), then( ) 1 for some , and

( ) 1 .ke ed n k nd

ed ned k n k

x x x x x x x

(a) Choose large primes and , and let : . (b) Choose (1 ( )) coprime to ( ), and

compute : mod ( ). ( .) (c) Public ke

Key generation:

1 mod ( )

RSA Cryptosystem

p q n pqe e n n

d nn ede

y: . Secret key: .

( ) : mod , w

( , ) ( , )

here .

( ) : mod , where .

ncryption:

Decryptio

E x x n x Z

D y y n y

pk n e sk n d

* * ( )

The setting of RSA is the group , :

In group , , for any , we have 1.

We have chosen , such that 1 mod ( ), i.e., ( ) 1 for some o

Why RSA Works?

Z x Z x

e d ed ned k n

* ( ) 1 ( )

sitive integer .

For , . d ke ed k n n

x Z x x x x x x

( ) 1 ( 1)( 1) 1

RSA still works, but .

gcd( , ) 1 | or | .

Say | . Then, 0 mod and mod . Also,

not secur

?What if

ed ed k n k p q

x Z x n p x q x

p x x p x x q

x x q x x x

y CRT,

mod mod

ed edx x nD Ex n

Select two primes: 17, 11. Compute the modulus 187. Compute ( ) ( 1)( 1) 160. Select between 0 and 160 such that gcd( ,160) 1.

Say 7.

Compute

RSA Example: Key Setup

p qn pq

n p qe e

1 1mod ( ) 7 mod160 23 (using extended Euclid's algorithm). Public key: . Secret ke

) (7, 187)( , ) (23 ., 7 18 )

pk e n

Suppose 88.

Encryption: mod 88 mod187 11.

Decryption: mod 11 mod187 88.

When computing 11 mod187, we first

compute 11 and

RSA Example: Encryption & Decryption

reduce it modulo 187. Rather, use , and reduce intermediate

results modulo 187 whenever they gsquare-a

et biggend-mult

r than iply

To speed up encryption, small values are usually used for .

Popular choices are 3, 17 2 1, 65537 2 1. These values have only two 1's in their binary representation.

Encryption Key

There is an interesting attack on small .e

One may be tempted to use a small to speed up decryption.

Unfortunately, that is risky.

Wiener's attack: If

and 2 ,3

then the decryption exponent c

Decryption Key

nd p q

an be computed from ( , ).

CRT can be used to speed up decryption.

Decryption:

Time: ( ).

mod (i.e., compute in )

mstead of computing directly,

we compute : mod , an

d : mod

Speeding up Decryption by CRTd

c c p c c

c n c Z

( ) mod ( )2 2

mod , and : modmod

recover the plaintext by solving mod

Time: 1 4 of the direct computation. If ... , will speed up even

p m c qx m px m q

n p p p

Attacks on RSA

Four categories of attacks on RSA: brute-force key search

infeasible given the large key space

mathem

atical attacks timing attacks

chosen ciphe t r

Attacks on RSA

ext attacks

Then ( ) ( 1)( 1) and

mod ( ) can be calculated

Factor into .

Determine ( ) directly

easily.

Equivalent to factoring . Knowing ( ) will enable us to f

Mathematical Attacksn p q

Determine direc

actor by solving

( 1)( 1)

If is known, can be factored

tl with high probability.

A difficult problem, assumed to be infeasible.

More and more efficient algorithms have been developed.

In 1977, RSA challenged researchers to decode a ciphertext encrypt

Integer Factorization

ed with a key ( ) of 129 digits (428 bits).

Prize: $100. RSA thought it would take quadrillion years to break the code using fastest algorithms and computers of that time. Solved in 1994.

In 1991, RSA put forward more challenges, with prizes, to encourage research on factorization.

Each RSA number is a semiprime. (A number is semiprime if it is the product of two primes.) There are two labeling schemes.

by the number of decimal digits: RSA-100, .

RSA Numbers

.., RSA-500, RSA-617. by the number of bits: RSA-576, 640, 704, 768, 896, , 1536, 210 .24 048

RSA-100 ( bits), 1991, 7 MIPS-year, Quadratic Sieve. RSA-110 ( bits), 1992, 75 MIPS-year, QS. RSA-120

3323653 ( bits), 1993, 830 MIPS-year, QS.

RSA-129 98

RSA Numbers which have been factored bits), 1994, 5000 MIPS-year, QS. RSA-130 ( bits), 1996, 1000 MIPS-year, GNFS. RSA-140 ( bits), 1999, 2000 MIPS-year, GNFS. RSA-155 ( bits), 1999, 8000 MIPS-year, GNFS.

314655

RSA-161

bits), 2003, Lattice Sieve. RSA- (174 digits), 2003, Lattice Sieve. RSA- (193 digits), 2005, Lattice Sieve. RSA-200 ( bits), 2005, Lattice

40663 Sieve.

RSA-200 =

27,997,833,911,221,327,870,829,467,638,

722,601,621,070,446,786,955,428,537,560,

009,929,326,128,400,107,609,345,671,052,

955,360,856,061,822,351,910,951,365,788,

637,105,954,482,006,576,775,098,580,557,

613,579,098,734,950,144,178,863,178,946,

295,187,237,869,221,823,983.

In light of current factorization technoligies, RSA recommends 1024-2048 bits.

If a message \ ,

RSA works, but Since gc

d( , ) 1, the sender can factor .

Remarks

e gcd( , ) 1, the adversary can factor , too.

Question: how likely is \ ?

Generating large primes

To set up an RSA cryptosystem,

we need two large primes p and q.

Infinitely many.

First proved by Euclid: Assume only a finite number of primes , , , . Let 1. is not a prime, bec

••

aus• e

How many prime numbers are there?

p p pM p p p

So, is composite and has a prime factor for some | |1 contradiction.

i nM p ip M p

Let ( ) denote the number of primes . Then

( ) for lar

The Prime

ge .ln

For , let ( ) denote the num

Number Theorem:

Dirichlet' bes Theorem : r

Distribution of Prime Numbers

x xxx xx

of primes such that and mod . Then,1 ( ) for large .

ln ( )n b

y y x y b nxx xx n

Generate a random odd number of desired size.

Test if is prime.

If not, discard it and try a different number.

Q: How many numbers are expected to be

How to generate a large prime number?

tested before a prime is found?

Can it be solved in polynomial time? A long standing open problem until 2002.

AKS(Agrawal, Kayal, Saxena) : log .

Later improved by others to log ,

Primality test : Is a prime?

and then

to log .

In practice, Miller-Rabin's probabilistic algorithm is still

the most popular --- much faster, log .

Looking for a characteristic property of prime numbers: is prime

is prime , ( )

me , ( )

Miller-Rabin primality test : Is a prime?

n a Z P a true

n a Z P a t

not prime elements , ( )

Check ( ) for random elements . If ( ) all true, then return "prime"

else return "composite.

a Z P a false

P a t a ZP a

"A "prime" answer may be incorrect with prob ( , ).

1 1 If

then ( , )

k Z p k t

*If is prime, then for all , ( ) is true.nn a Z P a

( )P a true

not prime strong witnessIf is , then there are

which are elements s.t

( ) .n P a

ea Z fals

( )P a true

Looking for ( ) :

How about ( ) 1 mod ?

Fermat's little theorem:

If is prime , 1 mod .

If is not prime maybe no strong witnesses.

P a a n

n a Z a n

composite numbers

for which 1 mod .)

Need to refine

the conditio

rmichael number

n 1 mod .

a n a Z

Fact: if 2 is prime, then 1 has exactly two square

roots in , namely 1.

Write 1 2 , where is odd. If is prime

, 1 mod (Fermat's little theorem)

n u un

a Z a n

2 2 2 2

1 mod ( )

1 mod for some ,

, ( ) , where

Why? Consider the sequence

u u u u u

a nP a

a n i i k

a Z P a true

a a a a a

If not prime do strong witnesses always exist

Loosely speaking, : if is an odd compo

at least one ha

site and not

a prime power, then of the elements are strong witnesses

A composite number is a if for some prime and

prime powerperfect pointeger 2. (A if

for some integer and 2.)

n n pp e

n k k e

If is an odd composite and not a prime power,

then of the elements are strong witnesses.

Sketch of proof: The set of

at least o

g witnesses

forms a p

ne hal

roper subgroup of . So, ord( ) ord( ) and1 ord( ) | ord( ). So, ord( ) ord( ). 2

A Z A Z

Input: integer 2 and parameter Output: a decision as to whether is prime or if is even, return "composit

composite1. e"

if is a per2

. fect

Algorithm: Miller-Rabin primality testn t

power, return "composite" for : 1 to do choose a random integer , 2 1 if gcd( , ) 1, return "composite" if is a strong witness, ret

urn "com

. i ta a n

posite"

return ("pri4. me")

If the algorithm answers "composite", it is always correct.

If the algorithm answers "prime", it may or may not be correct.

The algorithm gives a wrong answ

Analysis: Miller-Rabin primality test

er if is composite but the algorithm fails to find a strong witness in iterations.

This may happen with probability at most 2 .

Actually, at most 4 , by a more sophisticated analysis.

A is a probabilistic algorithm which always gives an answer but sometimes the answer may be inco

Carlo a

lgorithm

Monte Carlo algorithm for a decisi

Monte Carlo algorithms

on problem is if its “yes” answer is always correct but a “no” answer may be incorrect with some error probability.

A -iteration Miller-Rabin is a “composite”-biased Mon

yes-bias

te Carl

algorithm with error probability at most 1 4 .t

A is a probabilistic algorithm which may sometimes fail to give an answer but never gives an incorrect

Las Ve

gas algori

A Las Vegas algorithm can be conver

Las Vegas algorithms

ted into a Monte Carlo algorithm.

Integer Factorization

Reference on quadratic sieve:

http://blogs.msdn.com/b/devdev/archive/2006/06/19/637332.aspx

Difference of squares

To factor , find an such that is a square, say .

Then, ( )( ).

Search for starting from .

Example: Suppos

Fermat's Method

n a n a n b

n a b a b a b

e 5959. Then, 78.

is not a square for 78 and 79.

is a square for 80 : 80 5959 441 21 .

Hence 5959 80 21 (80 21)(80 21) 59 101.

Slow: a linear search for

2 is a poor strategy.a n

Basic idea: a generation of Fermat's difference of squares.

To factor , find (mod ) such that (mod ). Then, | ( )( ), but divides nei

Dixon's Random Squares Algorithm

n x y n x y nn x y x y n

ther of . Hence, gcd( , ) are nontrivial factors of .

Example: 32 10 mod77. gcd(32 10, 77) 7 and 11.

Question: how to produce

Factor

such and ?

a set of base: small primes,

x yx y n n

1 2 1 2

say, { , , }.

An integer is if it can be factored over mod , i.e.,

mod for some , , ,

ee eb b

B p p p

z p p p n e e e

Our goals:

First, find a set of integers such that are smooth:

mod Second, select a subset such that the product

has an ev

i i ib

e e ei b

x p p p nS U

22 221 2 1 2

en exponent for each , say,

mod for some , , , 0.

Let mod and mod , and

we have mod .

If mod , no luck, try a differen

ee ei b b

ee ei b

x p p p n e e e

X x n Y p p p n

t set of 's.ix

Suppose 15770708441 and {2,3,5,7,11,13}. Consider the three congruences:

8340934156 3 7mod

12044942944 2 7 13mod

2773700011

Example (from Stinson's book on Cryptography)n B

2 3 13mod .

8340934156 12044942944 2773700011

2 3 7 13 mod .

Reducing by modulo yields 9503435785 546 mod .

A factor of : gcd 9503435785 546, 15770708441 115759.

Suppose { , , }. Let .

Suppose we have a set of integers such that are

smooth: mod (1 ).

Let mod 2,

To achieve our second goal

i i ib

e e ei b

B p p p c b

U c x x

x p p p n i c

2 mod 2, , mod 2 .

The vectors are linearly independent (because ), and we can find a subset of 's that sum modulo 2 to (0, 0, , 0).

Let mod be the product of the 's

c e c bS e

X x n x

K corresponding

to the 's in . ie S

We have 2,3,5,7,11,13 and

8340934156 3 7mod

12044942944 2 7 13mod

2773700011 2 3 13mod .

0,1,0,1,0,0

1,0,0,1,0,1

1,1,0,0,0,1

Example (cont.)B

2 21 2 3

(0,0,0,0,0,0)mod 2.

Thus, we let ( ) mod and

(3 7)(2 7 13)(2 3 13) mod .

X x x x n

Random Squares Met Dixon's strategy: choose at random, hence the name

Trick 1: try numbers of the form ,

0, 1, 2, , and 1, 2, . F

Searching for smooth squares

x j kn

2 such , mod tends to be small and has a better chance than average to be smooth.

Trick 2: also try numbers of the form ,

0, 1, 2, , and 1, 2, . For such , is ao

x kn j

j k x x n

little bit smaller than . Try to factor instead of

Trick 3: to play trick 2, we need to in

lude 1 in

Suppose 1829 and { 1,2,3,5,7,11,13}.

42.77, 2 60.48, 3 74.07, 4 85.53. Thus we try 42, 43, 60, 61, 74, 75, 85, 86, and obtain

Example (from Stinson's book on Cryptography)n B

n n n nx

12 2 2

2 22 2 2

3 32 2

4 42 2

5 52 2 4

65 ( 1) 5 13. 1,0,0,1,0,0,143 20 2 5. 0,0,0,1,0,0,061 63 3 7. 0,0,0,0,1,0,074 11 ( 1) 11. 1,0,0,0,0,1,085 91 ( 1) 7 13. 1,0,0,0,1,0,186 80 2 5. 0,0,0,

ex ex ex ex ex e

1,0,0,0

1 2 3 5

0,0,0,0,0,0,0 , but does not yield a factorization of .

43 86 2 5 mod1829.

3698 40 mod1829.

40 40 mod1829.

0,0,0,0,0,0,0 .

42 43 61 85 1 2 3 5 7 13 mod1

e e e e

1459 901 mod1829. gcd 1459 901, 1829 31.

1829 31 59.

Consider the interval , around for some suitable integers , .

Let ( ) . We want to find a set of integers for which ( ) is smooth.

Recall the factor

Quadratic Sieve

M M nM M

Q x x n U xQ x

base , , , .

Recall Dixon's method (pick an , and test if ( ) is smooth) and observe how the computing time is wasted.

Idea of QS: use each as a "sieve" and sieve it through

bB p p p

x M M Q x

Notice that if , , , , and | ( ), then we have | ( ) iff mod .

p B x y M M p Q xp Q y x y p

1. Array .. . Initially, .

2. for each , , , do find an .. such that | ( );

for each .. such that m

Sketch of the Quadratic Sieve Algorithm

QA M M QA i i n

p p p p Bi M M p Q i

j M M i j

, where is the largest possible; keep record of mod 2.

3. Let be the set of all .. such that 1. // ( ) is smooth for each //

QA i QA i p ee

U i M M QA iQ i i S

Construct a subset as in Dixon's. S U

number-theoretic algorithms

Documents

on a number-theoretic bin packing conjecture - math

1975 number theoretic transforms to implement fast digital...

number-theoretic fast-decodable space–time … ·...

mathematical counterfactuals with number-theoretic

number theory and related algorithms in...

number theoretic algorithms outline greatest common divisors...

number theoretic transform -based block motion … ·...

number-theoretic interpretation and construction of a ...the...

number-theoretic...

i3slaboratoryinternalreport,isrni3s/rr-2009-08 … ·...

basic algorithms in number theory

31 number-theoretic algorithms · 2020. 10. 11. · theorem...

number-theoretic aspects of matter agglomeration/aggregation...

1 intro. to graph theory bio/cs 471 – algorithms for...

number theoretic transform -based block motion estimation

number theory algorithms and cryptography algorithms...

p1. number-theoretic algorithms chapter 31, clrs book

research article mapreduce algorithms for inferring gene...

number-theoretic applications of ergodic theory1 ergodic...

number-theoretic reference problems