Cryptography and Network Security Chapter 8

Cryptography and Cryptography and

Network Security Network Security

Chapter 8 Chapter 8

Fifth Edition Fifth Edition by William Stallings by William Stallings Lecture slides by

Lecture slides by Lawrie Lawrie Brown Brown (with edits by RHB)

(with edits by RHB)

Chapter 8

Chapter 8 – – Introduction to Number Introduction to Number Theory

Theory

The Devil said to Daniel Webster: "Set me a task I can't carry o The Devil said to Daniel Webster: "Set me a task I can't carry out, and ut, and

I'll give you anything in the world you ask for."

I'll give you anything in the world you ask for."

Daniel Webster: "Fair enough. Prove that for n greater than 2, t Daniel Webster: "Fair enough. Prove that for n greater than 2, the he

equation a

equation a

+ b + b

= c = c

has no non has no non- -trivial solution in the integers." trivial solution in the integers."

They agreed on a three

They agreed on a three- -day period for the day period for the labor labor, and the Devil , and the Devil disappeared.

disappeared.

At the end of three days, the Devil presented himself, haggard, At the end of three days, the Devil presented himself, haggard, jumpy, jumpy,

biting his lip. Daniel Webster said to him, "Well, how did you d biting his lip. Daniel Webster said to him, "Well, how did you do at o at my task? Did you prove the theorem?'

my task? Did you prove the theorem?'

"Eh? No . . . no, I haven't proved it."

"Eh? No . . . no, I haven't proved it."

"Then I can have whatever I ask for? Money? The Presidency?'

"Then I can have whatever I ask for? Money? The Presidency?'

"What? Oh, that

"What? Oh, that— —of course. But listen! If we could just prove the of course. But listen! If we could just prove the following two lemmas

following two lemmas— —" "

— —The Mathematical Magpie The Mathematical Magpie, Clifton Fadiman , Clifton Fadiman

Outline Outline

• • will consider: will consider:

– – prime numbers prime numbers

– – Fermat Fermat ’s and Euler ’ s and Euler’ ’s Theorems & s Theorems & ø ø(n (n) ) – – Primality Primality Testing Testing

– – Chinese Remainder Theorem Chinese Remainder Theorem –

– Primitive Roots & Discrete Logarithms Primitive Roots & Discrete Logarithms

Prime Numbers Prime Numbers

• • prime numbers only have divisors of 1 and self prime numbers only have divisors of 1 and self

– – they cannot be written as a product of other numbers they cannot be written as a product of other numbers –

– note: 1 is prime, but is generally not of interest note: 1 is prime, but is generally not of interest

• • eg. 2,3,5,7 are prime, 4,6,8,9,10 are not eg. 2,3,5,7 are prime, 4,6,8,9,10 are not

• • prime numbers are central to number theory prime numbers are central to number theory

•

• list of prime number less than 200 is: list of prime number less than 200 is:

2 3 5 7 11 13 17 19 23 29 31 37 41 43 47 53 59 2 3 5 7 11 13 17 19 23 29 31 37 41 43 47 53 59 61 67 71 73 79 83 89 97 101 103 107 109 113 127 61 67 71 73 79 83 89 97 101 103 107 109 113 127 131 137 139 149 151 157 163 167 173 179 181 191 131 137 139 149 151 157 163 167 173 179 181 191 193 197 199

193 197 199

Prime Factorisation Prime Factorisation

• • to factor to factor a number n a number n is to write it as a is to write it as a product of other numbers:

product of other numbers: n n = = a a x x b b x x c c

• • note that factoring a number is relatively note that factoring a number is relatively hard compared to multiplying the factors hard compared to multiplying the factors together to generate the number

together to generate the number

• • the the prime factorisation prime factorisation of a number n of a number n is is when its written as a product of primes when its written as a product of primes

– – eg. 91 eg. 91 = = 7 7 x x 13 13 ; ; 3600 3600 = = 2 2

x x 3 3

x x 5 5

Relatively Prime Numbers & GCD Relatively Prime Numbers & GCD

• • two numbers a,b two numbers a,b are relatively prime are relatively prime

(coprime ( coprime) ) if they have no common divisors if they have no common divisors apart from

apart from 1 1

– – eg. eg. 8 8 and 15 and 15 are relatively prime since factors of 8 are relatively prime since factors of 8 are

are 1,2,4,8 1,2,4,8 and of 15 and of 15 are 1,3,5,15 are 1,3,5,15 and 1 and 1 is the is the only common factor

only common factor

•

• conversely can determine the greatest common conversely can determine the greatest common divisor by

divisor by comparing their prime factorizations comparing their prime factorizations and using least powers

and using least powers

– – eg eg. . 300 300 = = 2 2

x3 x3

x5 x5

; ; 18 18 = = 2 2

x3 x3

hence hence GCD(18,300)

GCD(18,300) = = 2 2

x3 x3

x5 x5

= = 6 6

Fermat's Theorem Fermat's Theorem

• • a a ^{p p- -1 1} = = 1 1 (mod (mod p) p)

– – where p where p is prime and GCD(a,p is prime and GCD(a,p) ) = = 1 1

• • also known as Fermat’ also known as Fermat ’s Little Theorem s Little Theorem

• • also have: a also have: a ^{p p} = = a a (mod (mod p) p)

• • useful in public key and primality useful in public key and primality testing testing

Euler

Euler Totient Totient Function Function ø ø (n (n ) )

• • when doing arithmetic modulo when doing arithmetic modulo n n

• • complete set of residues complete set of residues is: 0..n is: 0..n- -1 1

• • reduced set of residues reduced set of residues is those numbers is those numbers (residues) which are relatively prime to (residues) which are relatively prime to n n

– – eg for n eg for n = = 10 10 , complete set of residues is , complete set of residues is {0,1,2,3,4,5,6,7,8,9}

{0,1,2,3,4,5,6,7,8,9}

–

– reduced set of residues is {1,3,7,9} reduced set of residues is {1,3,7,9}

• • number of elements in reduced set of residues is number of elements in reduced set of residues is called the

called the Euler Euler Totient Totient Function Function ø ø(n (n) )

Euler

Euler Totient Totient Function Function ø ø (n) (n )

• • to compute ø to compute ø(n (n) need to count number of ) need to count number of residues to be excluded

residues to be excluded

• • in general need prime factorization, but in general need prime factorization, but

–

– for p (p prime) for p (p prime) ø(p ø (p)=p )=p- -1 1

– – for for p.q p.q (p,q ( p,q prime) prime) ø(p.q ø (p.q)=(p )=(p- -1)x(q 1)x(q- -1) 1)

• • eg. eg .

ø(37) = 36 ø (37) = 36 ø

ø(21) = (3 (21) = (3– –1)x(7 1)x(7– –1) = 2x6 = 12 1) = 2x6 = 12

Euler's Theorem Euler's Theorem

• • a generalisation of Fermat's Theorem a generalisation of Fermat's Theorem

• • a a ^{ø ø(n (n) )} = = 1 1 (mod (mod n) n)

– – for any a,n for any a,n where GCD(a,n where GCD(a,n) ) = = 1 1

•

• eg eg. .

a a = = 3 3 ; ; n n = = 10 10 ; ; ø(10) ø (10) = = 4; 4;

hence

hence 3 3

= = 81 81 = = 1 1 mod mod 10 10 a a = = 2 2 ; ; n n = = 11 11 ; ; ø(11) ø (11) = = 10; 10;

hence

hence 2 2

= = 1024 1024 = = 1 1 mod mod 11 11

•

• also have: also have: a a ^{ø(n)+1 ø (n)+1} = = a a (mod n) (mod n)

Primality

Primality Testing Testing

•

• often need to find large prime numbers often need to find large prime numbers

• • traditionally sieve traditionally sieve using using trial division trial division

– – ie ie. divide by all numbers (primes) in turn less than the . divide by all numbers (primes) in turn less than the square root of the number

square root of the number –

– only works for small numbers only works for small numbers

•

• alternatively can use statistical primality alternatively can use statistical primality tests tests based on properties of primes

based on properties of primes

– – for which all primes numbers satisfy property for which all primes numbers satisfy property

– – but some composite numbers, called pseudo but some composite numbers, called pseudo- -primes, primes, also satisfy the property

also satisfy the property

• • can use a slower deterministic primality can use a slower deterministic primality test test

Miller Rabin Algorithm Miller Rabin Algorithm

•

• a test based on prime properties that result from a test based on prime properties that result from Fermat

Fermat’ ’s Theorem s Theorem

• • algorithm is: algorithm is:

TEST(

TEST(n n) ) is: is:

1. Find integers

1. Find integers k k, ,q q, ,k k>0, >0,q q odd, so that ( odd, so that (n n– – 1) 1) = = 2 2

q q 2. Select a random integer

2. Select a random integer a a, , 1 1 < < a a < < n n – – 1 1 3.

3. if if a a

mod mod n n = = 1 1 then then return ( return (“ “inconclusive inconclusive"); ");

4.

4. for for j j = = 0 0 to k to k – – 1 1 do do 5. if 5. if (a ( a

mod mod n n = = n n - - 1 1) )

then

then return( return(“ “inconclusive inconclusive") ") 6. return (

6. return (“ “composite") composite")

Probabilistic Considerations Probabilistic Considerations

• • if Miller- if Miller -Rabin returns Rabin returns “ “composite composite ” ” the the number is definitely not prime

number is definitely not prime

• • otherwise is a prime or a pseudo- otherwise is a prime or a pseudo -prime prime

• • chance it detects a pseudo- chance it detects a pseudo -prime is < prime is < ^{1 1} / / _{4 4}

• • hence if repeat test with different random a hence if repeat test with different random a then chance n is prime after t tests is:

then chance n is prime after t tests is:

–

– Pr(n Pr(n prime after t tests) = 1- prime after t tests) = 1 -4 4 ^{-t - t}

– – eg. for t=10 this probability is > 0.99999 eg . for t=10 this probability is > 0.99999

• • could then use the deterministic AKS test could then use the deterministic AKS test

Prime Distribution Prime Distribution

•

• prime number theorem states that primes occur prime number theorem states that primes occur roughly every (

roughly every (ln ln n) integers n ) integers

• • but can immediately ignore evens but can immediately ignore evens

• • so in practice need only test 0.5 so in practice need only test 0.5 ln(n ln(n) ) numbers of size

numbers of size n n to locate a prime to locate a prime

– – note this is only the note this is only the “ “average average” ”

– – sometimes primes are close together sometimes primes are close together

eg

eg. 1,000,000,000,061 and 1,000,000,000,063 both prime . 1,000,000,000,061 and 1,000,000,000,063 both prime

– – other times are quite far apart other times are quite far apart

eg eg. (1001!+2), (1001!+3) . (1001!+2), (1001!+3) … … (1001!+1001) all composite (1001!+1001) all composite

Chinese Remainder Theorem Chinese Remainder Theorem

• • used to speed up modulo computations used to speed up modulo computations

• • if working modulo a product of numbers if working modulo a product of numbers

–

– eg. mod eg. mod M M = = m m _{1 1} m m _{2 2} ..m ..m _{k k}

•

• Chinese Remainder theorem lets us work Chinese Remainder theorem lets us work in each modulus

in each modulus m m _{i i} separately separately

• • since computational cost is proportional to since computational cost is proportional to size, this is faster than working in the full size, this is faster than working in the full modulus

modulus M M

Chinese Remainder Theorem Chinese Remainder Theorem

•

• can implement CRT in several ways can implement CRT in several ways

• • to compute to compute A A (mod (mod M) M)

– – first compute all a first compute all a

= = A A mod mod m m

separately separately – – determine constants c determine constants c

below, where M below, where M

= = M/m M/m

–

– then combine results to get answer using: then combine results to get answer using:

Primitive Roots Primitive Roots

• • from Euler’ from Euler ’s theorem have s theorem have a a ^{ø(n ø (n) )} mod mod n n = = 1 1

• • consider a consider a ^{m m} = = 1 1 (mod (mod n), n), GCD(a,n) GCD(a,n ) = = 1 1

–

– must exist for must exist for m m = = ø(n ø (n) ) but may be smaller but may be smaller – – once powers reach once powers reach m m, cycle will repeat , cycle will repeat

• • if smallest is m if smallest is m = = ø(n ø (n) ) then a then a is called a is called a primitive root

primitive root

• • if p if p is prime, then successive powers of a is prime, then successive powers of a

"generate" the group

"generate" the group mod p mod p

• • these are useful but relatively hard to find these are useful but relatively hard to find

Powers mod 19 Powers mod 19

Discrete Logarithms Discrete Logarithms

• • the inverse problem to exponentiation is to find the inverse problem to exponentiation is to find the

the discrete logarithm discrete logarithm of a number b of a number b modulo p modulo p

• • that is to find i that is to find i such that b such that b = = a a ^{i i} (mod p) (mod p)

• • this is written as i this is written as i = = dlog dlog _{a a} b b (mod p) (mod p)

• • if a if a is a primitive root mod is a primitive root mod p p then dlog then dlog _{a a} always always exists, otherwise it may not,

exists, otherwise it may not, eg eg. .

x x = = log log

4 4 mod mod 13 13 has no answer has no answer

x x = = log log

3 3 mod mod 13 13 = = 4 4 by trying successive powers by trying successive powers

• • whilst exponentiation is relatively easy, finding whilst exponentiation is relatively easy, finding discrete logarithms is generally a

discrete logarithms is generally a hard hard problem problem

(which is good for cryptography, of course)

(which is good for cryptography, of course)

Discrete Logarithms

Discrete Logarithms mod 19 mod 19