Arithmetic algorithms for cryptology 5 October 2015, Paris. Sieves. Razvan Barbulescu CNRS and IMJ-PRG. R. Barbulescu Sieves 0 / 28

Save this PDF as:

Size: px
Start display at page:

Download "Arithmetic algorithms for cryptology 5 October 2015, Paris. Sieves. Razvan Barbulescu CNRS and IMJ-PRG. R. Barbulescu Sieves 0 / 28"

Transcription

1 Arithmetic algorithms for cryptology 5 October 2015, Paris Sieves Razvan Barbulescu CNRS and IMJ-PRG R. Barbulescu Sieves 0 / 28

2 Starting point Notations q prime g a generator of (F q ) X a (secret) integer less than q Y = g X mod q. Quote Computing X from Y, on the other hand can be computed much more difficult and, for certain carefully chosen values of q, requires on the order of q 1/2 operations [...] Diffie and Hellman 1976 Indeed, the best known algorithm in 1976 was Baby step giant step. The DLP was as hard for (F q ) as for any other group (e.g. elliptic curves). R. Barbulescu Sieves 1 / 28

3 The L notation For any integer Q = e n, L Q (α, c) = exp ( cn α (log n) 1 α). When c is not specified we write L Q (α). Example L Q (1, 1 2 ) = exp ( 1 2 n) = exp(n) = Q (exponential algorithm). L Q (0, 3) = exp (3 log n) = n 3 (cubic algorithm) L Q (1/2, 1) = exp ( n log n ) exp ( n ) = e n (sub-exponential algorithm). Exercice L Lx (α)(β) = L x (αβ). L(α)L(β) = L(max(α, β)) 1+o(1). R. Barbulescu Sieves 2 / 28

4 History One year after the introduction of DLP in cryptography, a subexponential algorithm was proposed by Adleman (complexity L(1/2)). In 1978 when RSA was proposed, it was known that the continued fractions method of factorization was very fast. In early 80s Dixon and Pomerance proved that there are algorithms of complexity L(1/2). Ideas traveled from factorization to discrete logarithm in finite fields and vice-versa. Chronology Dates below give the publication year of the first algorithm of each class. For discrete logarithm, there are several cases, which were solved by different algorithms. complexity factorization DLP in finite fields L Q (1/2) 1970 a L Q (1/3) L Q (ɛ) 2013 a complexity unknown until 1980 (after the introduction of RSA) R. Barbulescu Sieves 3 / 28

5 Algorithms families Let us use red for factoring, blue for DLP and violet for both. elliptic curve method created in 1985 of complexity L(1/2) factorization early sieve algorithms created in of complexity L(1/2) factorization+dlp Rho + BSGS created in of complexity N = L(1) factorization+dlp advanced sieve algorithms created in of complexity L(1/3) factorization+dlp quasi-polynomial created in of complexity L(ɛ) DLP in fields F q k with small q. R. Barbulescu Sieves 4 / 28

6 Outline of the talk Introduction Index Calculus Quadratic sieve (QS/MPQS) Sieving R. Barbulescu Sieves 5 / 28

7 Integers Smoothness definition An integer is B-smooth if all its prime factors are less than B. computation One finds small prime divisors with ECM, which is probabilistic; relies on a conjecture of analytic number theory; given an integer x, it finds all its factors less than B in average time L B (1/2, 2) 1+o(1) log(x) 4. In practice, the dependency in log x is quadratic. Polynomials definition A polynomial in F q [t] is m-smooth if all its irreducible factors have degree less than or equal to m. computation One tests if a polynomial P(t) is m-smooth by one of the two methods below: by factoring it (correctness is trivial, probabilistic, slow); by taking gcd with P (t) (t qm t) (prove it!, deterministic, faster). R. Barbulescu Sieves 6 / 28

8 Integers Smoothness definition An integer is B-smooth if all its prime factors are less than B. computation One finds small prime divisors with ECM, which is probabilistic; relies on a conjecture of analytic number theory; given an integer x, it finds all its factors less than B in average time L B (1/2, 2) 1+o(1) log(x) 4. In practice, the dependency in log x is quadratic. Polynomials definition A polynomial in F q [t] is m-smooth if all its irreducible factors have degree less than or equal to m. computation One tests if a polynomial P(t) is m-smooth by one of the two methods below: by factoring it (correctness is trivial, probabilistic, slow); by taking gcd with P (t) (t qm t) (prove it!, deterministic, faster). It is not known how to define smooth elements on an elliptic curves with a fast smoothness test. R. Barbulescu Sieves 6 / 28

9 Parameters p = g = 7 is a generator of G = (Z/pZ) DLP: an example (1) l = 11 is a prime factor of (p 1) = #G B = 10 is the smoothness bound factor base 2, 3, 5, 7 Finding relations among logs 7 5 mod p = 4706 = R. Barbulescu Sieves 7 / 28

10 Parameters p = g = 7 is a generator of G = (Z/pZ) DLP: an example (1) l = 11 is a prime factor of (p 1) = #G B = 10 is the smoothness bound factor base 2, 3, 5, 7 Finding relations among logs 7 5 mod p = 4706 = mod p = 8740 = R. Barbulescu Sieves 7 / 28

11 Parameters p = g = 7 is a generator of G = (Z/pZ) DLP: an example (1) l = 11 is a prime factor of (p 1) = #G B = 10 is the smoothness bound factor base 2, 3, 5, 7 Finding relations among logs 7 5 mod p = 4706 = mod p = 8740 = mod p = 675 = R. Barbulescu Sieves 7 / 28

12 Parameters p = g = 7 is a generator of G = (Z/pZ) DLP: an example (1) l = 11 is a prime factor of (p 1) = #G B = 10 is the smoothness bound factor base 2, 3, 5, 7 Finding relations among logs 7 5 mod p = 4706 = mod p = 8740 = mod p = 675 = The last relation gives: 7 = 3 log log 7 5 R. Barbulescu Sieves 7 / 28

13 Parameters p = g = 7 is a generator of G = (Z/pZ) DLP: an example (1) l = 11 is a prime factor of (p 1) = #G B = 10 is the smoothness bound factor base 2, 3, 5, 7 Finding relations among logs 7 5 mod p = 4706 = mod p = 8740 = mod p = 675 = mod p =... The last relation gives: 7 = 3 log log = 8 log log = 6 log log 7 5. R. Barbulescu Sieves 7 / 28

14 DLP: an example (2) Thanks to the Pohlig-Hellman reduction we do the linear algebra computations modulo l = 11. Linear algebra computations We have to find the unknown log 7 2, log 7 3 and lg 7 5 in the equation log log mod log Conjecture The matrix obtained by the technique above has maximal rank. We can drop all conjectures by modifying the algorithm, but this variant is fast and, even if the matrix has smaller rank we can find logs. Solution We solve to obtain log mod 11; log mod 11 and log mod 11. For this small example we can also use Pollard s rho method and obtain that log 7 3 = mod 11. R. Barbulescu Sieves 8 / 28

15 DLP: an example (3) At this point, we know discrete logarithms of the factor base and of smooth numbers: log 7 (10) = log log mod 11. R. Barbulescu Sieves 9 / 28

16 DLP: an example (3) At this point, we know discrete logarithms of the factor base and of smooth numbers: log 7 (10) = log log mod 11. Smoothing by randomization Consider a residue modulo p which is not 10-smooth, e.g. h = 151. We take random exponents a and test is (g a h) mod p is B-smooth mod p = 3389 R. Barbulescu Sieves 9 / 28

17 DLP: an example (3) At this point, we know discrete logarithms of the factor base and of smooth numbers: log 7 (10) = log log mod 11. Smoothing by randomization Consider a residue modulo p which is not 10-smooth, e.g. h = 151. We take random exponents a and test is (g a h) mod p is B-smooth mod p = mod p = = R. Barbulescu Sieves 9 / 28

18 DLP: an example (3) At this point, we know discrete logarithms of the factor base and of smooth numbers: log 7 (10) = log log mod 11. Smoothing by randomization Consider a residue modulo p which is not 10-smooth, e.g. h = 151. We take random exponents a and test is (g a h) mod p is B-smooth mod p = mod p = = mod p = 8748 = R. Barbulescu Sieves 9 / 28

19 DLP: an example (3) At this point, we know discrete logarithms of the factor base and of smooth numbers: log 7 (10) = log log mod 11. Smoothing by randomization Consider a residue modulo p which is not 10-smooth, e.g. h = 151. We take random exponents a and test is (g a h) mod p is B-smooth mod p = mod p = = mod p = 8748 = The discrete logarithms of the two members are equal: We find log 7 (151) 3 mod log 7 (151) = 2 log log 7 3. Remark This part of the computations is independent of the relation collection and linear algebra stages. It is called individual logarithm stage. R. Barbulescu Sieves 9 / 28

20 Index Calculus p prime, g generator of (Z/pZ), l prime divisor of (p 1) Input: h integer less than p Output: log g h mod l 1: Set B to its optimal value 2: Make the list F of the primes less than B (factor base) Initialization 3: repeat 4: a Random([1,p-1]) 5: if (g a mod p) is B-smooth then 6: relations=relations {a} Relations collection 7: end if 8: until #relations #F 9: Construct the matrix M = (m a,q ), a in relations, q F as follows m a,q = val q (g a mod p). Linear algebra 10: Solve the linear system Mx = (a) a in relations. 11: repeat 12: b Random([1,p-1]) 13: until (g b h mod p) is B-smooth 14: Factor (g b h mod p) = q e i i Individual logarithm 15: return x = e i log g (q i ) b R. Barbulescu Sieves 10 / 28

21 Complexity analysis of Index Calculus (1) Notation For two integers x and y, call P(x, y) the proportion of integers less than x which are y-smooth. Stages complexity Relations collection The integers (g a mod p) are random integers less than p. The expectancy of the number of trials before finding a relation is 1/P(p, B). Hence, cost(relations collection) = B/P(p, B). Linear algebra We have to invert a square matrix of size B. With the Gaussian method it requires B 3 operations. The Wiedemann algorithm (1986) takes time B 2 λ, where λ is the average number of non-zero entries per row. In our case λ is the number of divisors of the integer g a mod p, which is less than p. Since an integer less than p has less than log 2 p prime factors, λ log p. Hence we have cost(linear algebra) = B 2+o(1). Individual logarithm The integers (g a h mod p) are random among integers less than p. Hence, on average we need 1/P(p, B) trials: cost(individual logarithm) = 1/P(p, B). R. Barbulescu Sieves 11 / 28

22 Complexity analysis of Index Calculus (2) We have: cost(index Calculus) = B/P(p, B) + B 2+o(1) + 1/P(p, B). = B 1+o(1) (1/P(p, B) + B) 2B 1+o(1) max (1/P(p, B), B). When we increase B, 1/P(p, B) decreases, so the optimal value of max (1/P(p, B), B) is obtained when B = 1/P(p, B). Theorem (Canfield,Erdös,Pomerance 1983, simplified statement) Assume that x and u are two real numbers such that u is between (log x) c 1 and (log x) c 2 for some fixed constants c 1 and c 2, 0 < c 1 < c 2 < 1. Then, we have where the o(1) depends only on x. Conclusion P(x, x 1/u ) = 1/u u(1+o(1)), The solution of the equation B = 1/P(p, B) corresponds to B = p 1/u for u = 1/ 2(log p) 1/2 /(log log p) 1/2. Then the complexity is equal to B 2 and we obtain cost (Index Calculus) = L p (1/2, 2) 1+o(1). R. Barbulescu Sieves 12 / 28

23 Comparing algorithms DLP in real life The Index Calculus evolved into algorithms which inherited its characteristics: factor base, relations collection and linear algebra. The L notation allows to compare algorithms: Index calculus L p (1/2, 2), Gaussian Integers L p (1/2, 1), and the Number Field Sieve (NFS) L p (1/3, 3 64/9). Records are published on the NMBRTHRY mailing list. Records allow to find the crossing point year algorithm size of p in decimal digits author cost in GIPS a years 1991 Gaussian Integers 58 Lammachia, Odlyzko Gaussian Integers 85 Weber NFS 85 Weber NFS 100 Lercier, Joux NFS 110 Lercier, Joux NFS 130 Lercier, Joux NFS 160 Franke et al NFS 180 Caramel 260 a Giga instructions per second R. Barbulescu Sieves 13 / 28

24 Outline of the talk Introduction Index Calculus Quadratic sieve (QS/MPQS) Sieving R. Barbulescu Sieves 14 / 28

25 Fermat s idea Idea Fermat (XVII century) computed solutions of the equation X 2 Y 2 mod N. (1) It became a classical idea for factoring, e.g. mechanical machines were built in France in early XX century to solve the above equation. a a Discovery of a lost factoring machine, Shallit, Wiliams, Morain Lemma If N = pq, Equation (1) has four solutions Y for each X 0. Proof. Using the identity X 2 Y 2 = (X Y )(X + Y ) we have Y ±X mod p and Y ±X mod q. We call X the unique integer less than N which satisfies the system Y X mod p Y X mod q. Then the solutions of Equation (1) are Y = X, Y = X, Y = X and Y = X. R. Barbulescu Sieves 15 / 28

26 Fermat s idea Idea Fermat (XVII century) computed solutions of the equation X 2 Y 2 mod N. (1) It became a classical idea for factoring, e.g. mechanical machines were built in France in early XX century to solve the above equation. a a Discovery of a lost factoring machine, Shallit, Wiliams, Morain Lemma If N = pq, Equation (1) has four solutions Y for each X 0. Proof. Using the identity X 2 Y 2 = (X Y )(X + Y ) we have Y ±X mod p and Y ±X mod q. We call X the unique integer less than N which satisfies the system Y X mod p Y X mod q. Then the solutions of Equation (1) are Y = X, Y = X, Y = X and Y = X. 50% of the solutions, i.e. X and X, give gcd(x Y, N) = p or q. R. Barbulescu Sieves 15 / 28

27 Factoring: an example (1) Not squares but smooth numbers Let us factor N = We search integers a such that a 2 N is a square. In order to keep a 2 N small, we take a approximately equal to N: 46, 47,.... Squares seem to be rare! Kraitchik (1922) proposed to collect integers which are 10-smooth. We call factor base the set of primes less than 10: 2, 3, 5 and 7. Collecting relations 46 2 N = 75 = R. Barbulescu Sieves 16 / 28

28 Factoring: an example (1) Not squares but smooth numbers Let us factor N = We search integers a such that a 2 N is a square. In order to keep a 2 N small, we take a approximately equal to N: 46, 47,.... Squares seem to be rare! Kraitchik (1922) proposed to collect integers which are 10-smooth. We call factor base the set of primes less than 10: 2, 3, 5 and 7. Collecting relations 46 2 N = 75 = N = 168 = R. Barbulescu Sieves 16 / 28

29 Factoring: an example (1) Not squares but smooth numbers Let us factor N = We search integers a such that a 2 N is a square. In order to keep a 2 N small, we take a approximately equal to N: 46, 47,.... Squares seem to be rare! Kraitchik (1922) proposed to collect integers which are 10-smooth. We call factor base the set of primes less than 10: 2, 3, 5 and 7. Collecting relations 46 2 N = 75 = N = 168 = N = 263 = R. Barbulescu Sieves 16 / 28

30 Factoring: an example (1) Not squares but smooth numbers Let us factor N = We search integers a such that a 2 N is a square. In order to keep a 2 N small, we take a approximately equal to N: 46, 47,.... Squares seem to be rare! Kraitchik (1922) proposed to collect integers which are 10-smooth. We call factor base the set of primes less than 10: 2, 3, 5 and 7. Collecting relations 46 2 N = 75 = N = 168 = N = 263 = N = 360 = R. Barbulescu Sieves 16 / 28

31 Factoring: an example (1) Not squares but smooth numbers Let us factor N = We search integers a such that a 2 N is a square. In order to keep a 2 N small, we take a approximately equal to N: 46, 47,.... Squares seem to be rare! Kraitchik (1922) proposed to collect integers which are 10-smooth. We call factor base the set of primes less than 10: 2, 3, 5 and 7. Collecting relations 46 2 N = 75 = N = 168 = N = 263 = N = 360 = N = 459 = R. Barbulescu Sieves 16 / 28

32 Factoring: an example (1) Not squares but smooth numbers Let us factor N = We search integers a such that a 2 N is a square. In order to keep a 2 N small, we take a approximately equal to N: 46, 47,.... Squares seem to be rare! Kraitchik (1922) proposed to collect integers which are 10-smooth. We call factor base the set of primes less than 10: 2, 3, 5 and 7. Collecting relations 46 2 N = 75 = N = 168 = N = 263 = N = 360 = N = 459 = N = 560 = R. Barbulescu Sieves 16 / 28

33 Factoring: an example (2) Combining relations With the previous relations we have, for all non-negative integers u 46, u 47, u 49, u 51 : ( ) 46 2u u u u u 47 +3u 49 +4u 51 3 u 46+u 47 +2u u 46+u 49 +u 51 7 u 47+u 51 mod N Linear algebra stage We find u 46, u 47, u 49, u 51 in Z/2Z satisfying We obtain u 46 = u 47 = u 49 = u 51 = 1. u u u 51 0 mod 2 u 46 + u u 49 0 mod 2 2u 46 + u 49 + u 51 0 mod 2 u 47 + u 51 0 mod 2. R. Barbulescu Sieves 17 / 28

34 Factoring: an example (3) Computing X We multiply the left sides of all the relations to find X = 46 u 46 47u 47 49u 49 51u 51 mod N = mod N = 311. Computing Y We multiply the right sides of all the relations to find Y = ( 2 3u 47+3u 49 +4u 51 3 u 46+u 47 +2u u 46+u 49 +u 51 7 u 47+u 51 ) 1/2 mod N = mod N = Euclid gives the factorization! Since X ±Y mod N, we succeed. We compute The factorization is 2041 = gcd(y X, N) = gcd( , 2041) = 13. R. Barbulescu Sieves 18 / 28

35 Quadratic sieve Input: integer N = pq for two primes p and q Output: p and q 1: Set B to its optimal value 2: Make the list F of the primes less than B (factor base) Initialization 3: a N 4: repeata a + 1 5: if (a 2 N) is B-smooth then 6: relations=relations {a} Relations collection 7: end if 8: until #relations #F 9: Construct the matrix M = (m a,q ), a in relations, q F as follows ( m a,q = val q a 2 N ). Linear algebra 10: Solve the linear system transpose(x)m 0 mod 2. 11: Compute X = a in relations ax a. 12: Compute Y = q F q( a xa)/2. 13: Compute g = gcd(x Y, N) Square root 14: if g 1 or N then 15: return p = g, q = N/g 16: else 17: Find more relations and do the linear algebra again. 18: end if R. Barbulescu Sieves 19 / 28

36 Correctness and complexity analysis Correctness The algorithm relies on two heuristics: 1. The proportion of integers a 2 N which are B-smooth is the same as the proportion of integers of the same size which are B-smooth.(proven by Pomerance in the simples form, but not in the variants of the algorithm) 2. Each solution of X 2 Y 2 mod N found by the algorithm has 50% chances to give a factor. The block version of the Wiedemann algorithm allows to compute 32 or 64 solutions of our linear system with no extra cost. Hence, we only redo the post-processing. Complexity analysis We write a = N + x. Then a 2 N = ( N + x) 2 N = 2x N + (x 2 + N 2 N) We consider the case where x = N o(1) trials are enough to collect #F relations. After all computations are done, we prove that this choice is possible. Then we have a 2 N = N 1/2+o(1). We repeat the complexity analysis of Index Calculus with P( N, B) instead of P(p, B). We obtain R. Barbulescu Sieves cost (QS) = L N (1/2, 1) 1+o(1) 20 / 28

37 Factoring in real life Comparing algorithms The quadratic sieve was improved by proposing new variants of the same complexity, like the Multiple Polynomial Quadratic Sieve (MPQS). Later, a factorization variant of the number field sieve (NFS) was invented of complexity L N (1/3, 3 64/9). The RSA company offered prizes to whoever factored RSA keys year digit size algorithm author QS Lenstra et al QS Lenstra et al QS Denny et al QS Lenstra et al NFS Franke et al NFS Franke et al NFS Franke et al NFS international The computation of the present record, RSA 768 bits took 2000 CPU years. You can factor at home with CADO R. Barbulescu Sieves 21 / 28

38 Outline of the talk Introduction Index Calculus Quadratic sieve (QS/MPQS) Sieving R. Barbulescu Sieves 22 / 28

39 The idea of sieving What we need In QS, we collect integers a = N + x, where x is a small integer, such that a 2 N is B-smooth. ( We need to find the smooth values of Q(x), when Q(x) = 2 N + x) N. Eratosthenes sieve Given a polynomial Q(x) Z[x], one can compute the values x in an interval [E 1, E 2 ] such that Q(x) is prime. One marks with a line every value of x which is divisible by two, then by three and so on. The values of x which have no marks correspond to prime values of Q. R. Barbulescu Sieves 23 / 28

40 The idea of sieving What we need In QS, we collect integers a = N + x, where x is a small integer, such that a 2 N is B-smooth. ( We need to find the smooth values of Q(x), when Q(x) = 2 N + x) N. Eratosthenes sieve Given a polynomial Q(x) Z[x], one can compute the values x in an interval [E 1, E 2 ] such that Q(x) is prime. One marks with a line every value of x which is divisible by two, then by three and so on. The values of x which have no marks correspond to prime values of Q. Numbers which have many marks are smooth. R. Barbulescu Sieves 23 / 28

41 Sieving: an example Problem Find values a in the interval [3, 7] such that Q(a) = a is prime, respectively 6-smooth. Table of sieving Computations a ticks log(a 2 + 1) log 10 log 17 log 26 log 37 log 50 R. Barbulescu Sieves 24 / 28

42 Sieving: an example Problem Find values a in the interval [3, 7] such that Q(a) = a is prime, respectively 6-smooth. Table of sieving a ticks log(a 2 + 1) log 10 log 17 log 26 log 37 log 50 Computations Consider primes less than 6 and their powers less than max{q(a) a [2, 7]}: p = 2, solutions of a mod 2 are {1}; R. Barbulescu Sieves 24 / 28

43 Sieving: an example Problem Find values a in the interval [3, 7] such that Q(a) = a is prime, respectively 6-smooth. Table of sieving a ticks l l l log(a 2 + 1) log 5 log 17 log 13 log 37 log 25 Computations Consider primes less than 6 and their powers less than max{q(a) a [2, 7]}: p = 2, solutions of a mod 2 are {1}; q = 2 2, solutions of a mod 4 are ; R. Barbulescu Sieves 24 / 28

44 Sieving: an example Problem Find values a in the interval [3, 7] such that Q(a) = a is prime, respectively 6-smooth. Table of sieving a ticks l l l log(a 2 + 1) log 5 log 17 log 13 log 37 log 25 Computations Consider primes less than 6 and their powers less than max{q(a) a [2, 7]}: p = 2, solutions of a mod 2 are {1}; q = 2 2, solutions of a mod 4 are ; p = 3, solutions of a mod 3 are ; R. Barbulescu Sieves 24 / 28

45 Sieving: an example Problem Find values a in the interval [3, 7] such that Q(a) = a is prime, respectively 6-smooth. Table of sieving a ticks l l l log(a 2 + 1) log 5 log 17 log 13 log 37 log 25 Computations Consider primes less than 6 and their powers less than max{q(a) a [2, 7]}: p = 2, solutions of a mod 2 are {1}; q = 2 2, solutions of a mod 4 are ; p = 3, solutions of a mod 3 are ; p = 5, solutions of a mod 5 are {2, 3}; R. Barbulescu Sieves 24 / 28

46 Sieving: an example Problem Find values a in the interval [3, 7] such that Q(a) = a is prime, respectively 6-smooth. Table of sieving a ticks ll l ll log(a 2 + 1) 0 log 17 log 13 log 37 log 5 Computations Consider primes less than 6 and their powers less than max{q(a) a [2, 7]}: p = 2, solutions of a mod 2 are {1}; q = 2 2, solutions of a mod 4 are ; p = 3, solutions of a mod 3 are ; p = 5, solutions of a mod 5 are {2, 3}; p = 5 2, solutions of a mod 25 are {7, 18} R. Barbulescu Sieves 24 / 28

47 Sieving: an example Problem Find values a in the interval [3, 7] such that Q(a) = a is prime, respectively 6-smooth. Table of sieving a ticks ll l lll log(a 2 + 1) 0 log 17 log 13 log 37 0 Computations Consider primes less than 6 and their powers less than max{q(a) a [2, 7]}: p = 2, solutions of a mod 2 are {1}; q = 2 2, solutions of a mod 4 are ; p = 3, solutions of a mod 3 are ; p = 5, solutions of a mod 5 are {2, 3}; p = 5 2, solutions of a mod 25 are {7, 18} R. Barbulescu Sieves 24 / 28

48 Sieving: an example Problem Find values a in the interval [3, 7] such that Q(a) = a is prime, respectively 6-smooth. Table of sieving a ticks ll l lll log(a 2 + 1) 0 log 17 log 13 log 37 0 Computations Consider primes less than 6 and their powers less than max{q(a) a [2, 7]}: p = 2, solutions of a mod 2 are {1}; q = 2 2, solutions of a mod 4 are ; p = 3, solutions of a mod 3 are ; p = 5, solutions of a mod 5 are {2, 3}; p = 5 2, solutions of a mod 25 are {7, 18} Conclusion The prime values of Q are Q(4) = 17 and Q(6) = 37. The 6-smooth values of Q are Q(3) = 10 and Q(7) = 50. R. Barbulescu Sieves 24 / 28

49 Algorithm for sieving Algorithm Input: a monic polynomial Q(x) in Z[x] and parameters B, E 1, E 2 ; Output: all the integers x [E 1, E 2 ] for which Q(x) is B-smooth. 1: Make a list (p k, r) of prime powers p k max{ Q(x), x [E 1, E 2 ]}, with p < B, and integers 0 r < p k such that Q(r) 0 mod p k 2: Define an array indexed by x [E 1, E 2 ] and initialize it with log 2 Q(x) 3: for all (p k, r) considered above do 4: for x in [E 1, E 2 ] and x r mod p k do 5: Subtract log 2 p from the entry of index x; 6: end for 7: end for 8: Collect the indices x where the array is close to 0 (numerical errors). Cofactorization In practice we sieve on primes smaller than a bound fbb < B and we collect indices x whose value is smaller than a threshold. Then we test smoothness with ECM on the survivals in a step called cofactorization. In the literature, the smoothness bound B is called lpb, large prime bound, to distinguish from fbb, factor base bound. Exercice What is the condition on fbb and lpb such that ECM is not needed, i.e., we know that there is only one large prime. R. Barbulescu Sieves 25 / 28

50 Complexity New complexity The complexity of the sieve is B(log B) O(1) + p prime 1 (E 2 E 1 ). p 1 Using the formula p<x 1 p log log x, the complexity of the sieve is (E 2 E 1 ) 1+o(1). In first approximation, this is the cardinality of the sieved array. Old complexity One can show that L Lx (α)(β) = L x (αβ). Hence, if the smoothness bound B is L p (α) for some α < 1, then one can simply enumerate values to test for smoothness, with a cost of L(α/2) per test. Then the complexity of the algorithm is B O(1) L p (α/2) = B O(1). We conclude that the sieving procedure does not change complexity, at the first level of approximation. R. Barbulescu Sieves 26 / 28

51 Conclusion of first lecture DLP in finite fields and factoring have a common history; smoothness is the key notion for these problems; complexity is best expressed with the L notation; the new algorithms evolved from Index Calculus and Quadratic Sieve; sieving is an important practical improvement, but unseen in the first approximation of the complexity. R. Barbulescu Sieves 27 / 28

52 Exercices 1. What is the complexity of solving linear systems by Gaussian elimination. 2. If f, g : R R are two functions then min max(f, g) min f + g 2 min x R x R x R max(f, g). If f is increasing and g is decreasing and both are continous then the the minimum value of max(f, g) is obtained when f (x) = g(x). 3. Find α, c > 0 so that B = L p (α, c) is solution of B = 1/P(p, B). 4. What is the speed-up obtained when using the sieve w.r.t. a direct smoothness test with ECM. R. Barbulescu Sieves 28 / 28

Factoring. Factoring 1

Factoring Factoring 1 Factoring Security of RSA algorithm depends on (presumed) difficulty of factoring o Given N = pq, find p or q and RSA is broken o Rabin cipher also based on factoring Factoring like

Primality - Factorization

Primality - Factorization Christophe Ritzenthaler November 9, 2009 1 Prime and factorization Definition 1.1. An integer p > 1 is called a prime number (nombre premier) if it has only 1 and p as divisors.

Integer Factorization using the Quadratic Sieve

Integer Factorization using the Quadratic Sieve Chad Seibert* Division of Science and Mathematics University of Minnesota, Morris Morris, MN 56567 seib0060@morris.umn.edu March 16, 2011 Abstract We give

U.C. Berkeley CS276: Cryptography Handout 0.1 Luca Trevisan January, 2009. Notes on Algebra

U.C. Berkeley CS276: Cryptography Handout 0.1 Luca Trevisan January, 2009 Notes on Algebra These notes contain as little theory as possible, and most results are stated without proof. Any introductory

Factoring Algorithms

Factoring Algorithms The p 1 Method and Quadratic Sieve November 17, 2008 () Factoring Algorithms November 17, 2008 1 / 12 Fermat s factoring method Fermat made the observation that if n has two factors

The Quadratic Sieve Factoring Algorithm Eric Landquist MATH 488: Cryptographic Algorithms December 14, 2001 1 Introduction Mathematicians have been attempting to find better and faster ways to factor composite

Factorization Methods: Very Quick Overview

Factorization Methods: Very Quick Overview Yuval Filmus October 17, 2012 1 Introduction In this lecture we introduce modern factorization methods. We will assume several facts from analytic number theory.

Study of algorithms for factoring integers and computing discrete logarithms

Study of algorithms for factoring integers and computing discrete logarithms First Indo-French Workshop on Cryptography and Related Topics (IFW 2007) June 11 13, 2007 Paris, France Dr. Abhijit Das Department

Factoring Algorithms

Institutionen för Informationsteknologi Lunds Tekniska Högskola Department of Information Technology Lund University Cryptology - Project 1 Factoring Algorithms The purpose of this project is to understand

I. Introduction. MPRI Cours 2-12-2. Lecture IV: Integer factorization. What is the factorization of a random number? II. Smoothness testing. F.

F. Morain École polytechnique MPRI cours 2-12-2 2013-2014 3/22 F. Morain École polytechnique MPRI cours 2-12-2 2013-2014 4/22 MPRI Cours 2-12-2 I. Introduction Input: an integer N; logox F. Morain logocnrs

Faster deterministic integer factorisation

David Harvey (joint work with Edgar Costa, NYU) University of New South Wales 25th October 2011 The obvious mathematical breakthrough would be the development of an easy way to factor large prime numbers

Notes on Factoring. MA 206 Kurt Bryan

The General Approach Notes on Factoring MA 26 Kurt Bryan Suppose I hand you n, a 2 digit integer and tell you that n is composite, with smallest prime factor around 5 digits. Finding a nontrivial factor

An Overview of Integer Factoring Algorithms. The Problem

An Overview of Integer Factoring Algorithms Manindra Agrawal IITK / NUS The Problem Given an integer n, find all its prime divisors as efficiently as possible. 1 A Difficult Problem No efficient algorithm

Smooth numbers and the quadratic sieve

Algorithmic Number Theory MSRI Publications Volume 44, 2008 Smooth numbers and the quadratic sieve CARL POMERANCE ABSTRACT. This article gives a gentle introduction to factoring large integers via the

MATH 168: FINAL PROJECT Troels Eriksen. 1 Introduction

MATH 168: FINAL PROJECT Troels Eriksen 1 Introduction In the later years cryptosystems using elliptic curves have shown up and are claimed to be just as secure as a system like RSA with much smaller key

Primality Testing and Factorization Methods

Primality Testing and Factorization Methods Eli Howey May 27, 2014 Abstract Since the days of Euclid and Eratosthenes, mathematicians have taken a keen interest in finding the nontrivial factors of integers,

ELEMENTARY THOUGHTS ON DISCRETE LOGARITHMS. Carl Pomerance

ELEMENTARY THOUGHTS ON DISCRETE LOGARITHMS Carl Pomerance Given a cyclic group G with generator g, and given an element t in G, the discrete logarithm problem is that of computing an integer l with g l

Factoring & Primality

Factoring & Primality Lecturer: Dimitris Papadopoulos In this lecture we will discuss the problem of integer factorization and primality testing, two problems that have been the focus of a great amount

FACTORING. n = 2 25 + 1. fall in the arithmetic sequence

FACTORING The claim that factorization is harder than primality testing (or primality certification) is not currently substantiated rigorously. As some sort of backward evidence that factoring is hard,

Cryptography: RSA and the discrete logarithm problem

Cryptography: and the discrete logarithm problem R. Hayden Advanced Maths Lectures Department of Computing Imperial College London February 2010 Public key cryptography Assymmetric cryptography two keys:

Generic attacks and index calculus. D. J. Bernstein University of Illinois at Chicago

Generic attacks and index calculus D. J. Bernstein University of Illinois at Chicago The discrete-logarithm problem Define Ô = 1000003. Easy to prove: Ô is prime. Can we find an integer Ò ¾ 1 2 3 Ô 1 such

Public-Key Cryptanalysis 1: Introduction and Factoring

Public-Key Cryptanalysis 1: Introduction and Factoring Nadia Heninger University of Pennsylvania July 21, 2013 Adventures in Cryptanalysis Part 1: Introduction and Factoring. What is public-key crypto

International Journal of Information Technology, Modeling and Computing (IJITMC) Vol.1, No.3,August 2013

FACTORING CRYPTOSYSTEM MODULI WHEN THE CO-FACTORS DIFFERENCE IS BOUNDED Omar Akchiche 1 and Omar Khadir 2 1,2 Laboratory of Mathematics, Cryptography and Mechanics, Fstm, University of Hassan II Mohammedia-Casablanca,

FACTORING SPARSE POLYNOMIALS

FACTORING SPARSE POLYNOMIALS Theorem 1 (Schinzel): Let r be a positive integer, and fix non-zero integers a 0,..., a r. Let F (x 1,..., x r ) = a r x r + + a 1 x 1 + a 0. Then there exist finite sets S

Runtime and Implementation of Factoring Algorithms: A Comparison

Runtime and Implementation of Factoring Algorithms: A Comparison Justin Moore CSC290 Cryptology December 20, 2003 Abstract Factoring composite numbers is not an easy task. It is classified as a hard algorithm,

Factoring and Discrete Logarithms in Subexponential Time

Chapter 15 Factoring and Discrete Logarithms in Subexponential Time This is a chapter from version 1.1 of the book Mathematics of Public Key Cryptography by Steven Galbraith, available from http://www.isg.rhul.ac.uk/

Basic Algorithms In Computer Algebra

Basic Algorithms In Computer Algebra Kaiserslautern SS 2011 Prof. Dr. Wolfram Decker 2. Mai 2011 References Cohen, H.: A Course in Computational Algebraic Number Theory. Springer, 1993. Cox, D.; Little,

Elements of Applied Cryptography Public key encryption

Network Security Elements of Applied Cryptography Public key encryption Public key cryptosystem RSA and the factorization problem RSA in practice Other asymmetric ciphers Asymmetric Encryption Scheme Let

STUDY ON ELLIPTIC AND HYPERELLIPTIC CURVE METHODS FOR INTEGER FACTORIZATION. Takayuki Yato. A Senior Thesis. Submitted to

STUDY ON ELLIPTIC AND HYPERELLIPTIC CURVE METHODS FOR INTEGER FACTORIZATION by Takayuki Yato A Senior Thesis Submitted to Department of Information Science Faculty of Science The University of Tokyo on

Factoring pq 2 with Quadratic Forms: Nice Cryptanalyses

Factoring pq 2 with Quadratic Forms: Nice Cryptanalyses Phong Nguyễn http://www.di.ens.fr/~pnguyen & ASIACRYPT 2009 Joint work with G. Castagnos, A. Joux and F. Laguillaumie Summary Factoring A New Factoring

Factoring integers, Producing primes and the RSA cryptosystem Harish-Chandra Research Institute

RSA cryptosystem HRI, Allahabad, February, 2005 0 Factoring integers, Producing primes and the RSA cryptosystem Harish-Chandra Research Institute Allahabad (UP), INDIA February, 2005 RSA cryptosystem HRI,

Factoring and Discrete Log

Factoring and Discrete Log Nadia Heninger University of Pennsylvania June 1, 2015 Textbook RSA [Rivest Shamir Adleman 1977] Public Key N = pq modulus e encryption exponent Private Key p, q primes d decryption

The Sieve Re-Imagined: Integer Factorization Methods

The Sieve Re-Imagined: Integer Factorization Methods by Jennifer Smith A research paper presented to the University of Waterloo in partial fulfillment of the requirement for the degree of Master of Mathematics

Breaking The Code. Ryan Lowe. Ryan Lowe is currently a Ball State senior with a double major in Computer Science and Mathematics and

Breaking The Code Ryan Lowe Ryan Lowe is currently a Ball State senior with a double major in Computer Science and Mathematics and a minor in Applied Physics. As a sophomore, he took an independent study

Cryptography and Network Security Chapter 8

Cryptography and Network Security Chapter 8 Fifth Edition by William Stallings Lecture slides by Lawrie Brown (with edits by RHB) Chapter 8 Introduction to Number Theory The Devil said to Daniel Webster:

The van Hoeij Algorithm for Factoring Polynomials

The van Hoeij Algorithm for Factoring Polynomials Jürgen Klüners Abstract In this survey we report about a new algorithm for factoring polynomials due to Mark van Hoeij. The main idea is that the combinatorial

A Factoring and Discrete Logarithm based Cryptosystem

Int. J. Contemp. Math. Sciences, Vol. 8, 2013, no. 11, 511-517 HIKARI Ltd, www.m-hikari.com A Factoring and Discrete Logarithm based Cryptosystem Abdoul Aziz Ciss and Ahmed Youssef Ecole doctorale de Mathematiques

JUST THE MATHS UNIT NUMBER 1.8. ALGEBRA 8 (Polynomials) A.J.Hobson

JUST THE MATHS UNIT NUMBER 1.8 ALGEBRA 8 (Polynomials) by A.J.Hobson 1.8.1 The factor theorem 1.8.2 Application to quadratic and cubic expressions 1.8.3 Cubic equations 1.8.4 Long division of polynomials

Index Calculation Attacks on RSA Signature and Encryption

Index Calculation Attacks on RSA Signature and Encryption Jean-Sébastien Coron 1, Yvo Desmedt 2, David Naccache 1, Andrew Odlyzko 3, and Julien P. Stern 4 1 Gemplus Card International {jean-sebastien.coron,david.naccache}@gemplus.com

Discrete Mathematics Lecture 3 Elementary Number Theory and Methods of Proof. Harper Langston New York University

Discrete Mathematics Lecture 3 Elementary Number Theory and Methods of Proof Harper Langston New York University Proof and Counterexample Discovery and proof Even and odd numbers number n from Z is called

Prime Numbers and Irreducible Polynomials

Prime Numbers and Irreducible Polynomials M. Ram Murty The similarity between prime numbers and irreducible polynomials has been a dominant theme in the development of number theory and algebraic geometry.

CHAPTER SIX IRREDUCIBILITY AND FACTORIZATION 1. BASIC DIVISIBILITY THEORY

January 10, 2010 CHAPTER SIX IRREDUCIBILITY AND FACTORIZATION 1. BASIC DIVISIBILITY THEORY The set of polynomials over a field F is a ring, whose structure shares with the ring of integers many characteristics.

(x + a) n = x n + a Z n [x]. Proof. If n is prime then the map

22. A quick primality test Prime numbers are one of the most basic objects in mathematics and one of the most basic questions is to decide which numbers are prime (a clearly related problem is to find

The Mathematics of the RSA Public-Key Cryptosystem

The Mathematics of the RSA Public-Key Cryptosystem Burt Kaliski RSA Laboratories ABOUT THE AUTHOR: Dr Burt Kaliski is a computer scientist whose involvement with the security industry has been through

RSA Attacks. By Abdulaziz Alrasheed and Fatima

RSA Attacks By Abdulaziz Alrasheed and Fatima 1 Introduction Invented by Ron Rivest, Adi Shamir, and Len Adleman [1], the RSA cryptosystem was first revealed in the August 1977 issue of Scientific American.

3 1. Note that all cubes solve it; therefore, there are no more

Math 13 Problem set 5 Artin 11.4.7 Factor the following polynomials into irreducible factors in Q[x]: (a) x 3 3x (b) x 3 3x + (c) x 9 6x 6 + 9x 3 3 Solution: The first two polynomials are cubics, so if

A New Generic Digital Signature Algorithm

Groups Complex. Cryptol.? (????), 1 16 DOI 10.1515/GCC.????.??? de Gruyter???? A New Generic Digital Signature Algorithm Jennifer Seberry, Vinhbuu To and Dongvu Tonien Abstract. In this paper, we study

3. Applications of Number Theory

3. APPLICATIONS OF NUMBER THEORY 163 3. Applications of Number Theory 3.1. Representation of Integers. Theorem 3.1.1. Given an integer b > 1, every positive integer n can be expresses uniquely as n = a

Is n a Prime Number? Manindra Agrawal. March 27, 2006, Delft. IIT Kanpur

Is n a Prime Number? Manindra Agrawal IIT Kanpur March 27, 2006, Delft Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 1 / 47 Overview 1 The Problem 2 Two Simple, and Slow, Methods

Determining the Optimal Combination of Trial Division and Fermat s Factorization Method

Determining the Optimal Combination of Trial Division and Fermat s Factorization Method Joseph C. Woodson Home School P. O. Box 55005 Tulsa, OK 74155 Abstract The process of finding the prime factorization

3. Computational Complexity.

3. Computational Complexity. (A) Introduction. As we will see, most cryptographic systems derive their supposed security from the presumed inability of any adversary to crack certain (number theoretic)

Integer factorization and discrete logarithm problems

Integer factorization and discrete logarithm problems Pierrick Gaudry October 2014 Abstract These are notes for a lecture given at CIRM in 2014, for the Journées Nationales du Calcul Formel. We explain

Lecture 13 - Basic Number Theory.

Lecture 13 - Basic Number Theory. Boaz Barak March 22, 2010 Divisibility and primes Unless mentioned otherwise throughout this lecture all numbers are non-negative integers. We say that A divides B, denoted

Mathematics of Cryptography Part I

CHAPTER 2 Mathematics of Cryptography Part I (Solution to Odd-Numbered Problems) Review Questions 1. The set of integers is Z. It contains all integral numbers from negative infinity to positive infinity.

Chapter 4, Arithmetic in F [x] Polynomial arithmetic and the division algorithm.

Chapter 4, Arithmetic in F [x] Polynomial arithmetic and the division algorithm. We begin by defining the ring of polynomials with coefficients in a ring R. After some preliminary results, we specialize

Factoring N = p r q for Large r

Factoring N = p r q for Large r Dan Boneh 1,GlennDurfee 1, and Nick Howgrave-Graham 2 1 Computer Science Department, Stanford University, Stanford, CA 94305-9045 {dabo,gdurf}@cs.stanford.edu 2 Mathematical

Homework 5 Solutions

Homework 5 Solutions 4.2: 2: a. 321 = 256 + 64 + 1 = (01000001) 2 b. 1023 = 512 + 256 + 128 + 64 + 32 + 16 + 8 + 4 + 2 + 1 = (1111111111) 2. Note that this is 1 less than the next power of 2, 1024, which

CONTINUED FRACTIONS AND FACTORING. Niels Lauritzen

CONTINUED FRACTIONS AND FACTORING Niels Lauritzen ii NIELS LAURITZEN DEPARTMENT OF MATHEMATICAL SCIENCES UNIVERSITY OF AARHUS, DENMARK EMAIL: niels@imf.au.dk URL: http://home.imf.au.dk/niels/ Contents

EMBEDDING DEGREE OF HYPERELLIPTIC CURVES WITH COMPLEX MULTIPLICATION

EMBEDDING DEGREE OF HYPERELLIPTIC CURVES WITH COMPLEX MULTIPLICATION CHRISTIAN ROBENHAGEN RAVNSHØJ Abstract. Consider the Jacobian of a genus two curve defined over a finite field and with complex multiplication.

Factoring integers and Producing primes

Factoring integers,..., RSA Erbil, Kurdistan 0 Lecture in Number Theory College of Sciences Department of Mathematics University of Salahaddin Debember 4, 2014 Factoring integers and Producing primes Francesco

The Chebotarev Density Theorem

The Chebotarev Density Theorem Hendrik Lenstra 1. Introduction Consider the polynomial f(x) = X 4 X 2 1 Z[X]. Suppose that we want to show that this polynomial is irreducible. We reduce f modulo a prime

9. POLYNOMIALS. Example 1: The expression a(x) = x 3 4x 2 + 7x 11 is a polynomial in x. The coefficients of a(x) are the numbers 1, 4, 7, 11.

9. POLYNOMIALS 9.1. Definition of a Polynomial A polynomial is an expression of the form: a(x) = a n x n + a n-1 x n-1 +... + a 1 x + a 0. The symbol x is called an indeterminate and simply plays the role

PUTNAM TRAINING POLYNOMIALS. Exercises 1. Find a polynomial with integral coefficients whose zeros include 2 + 5.

PUTNAM TRAINING POLYNOMIALS (Last updated: November 17, 2015) Remark. This is a list of exercises on polynomials. Miguel A. Lerma Exercises 1. Find a polynomial with integral coefficients whose zeros include

ALGEBRAIC APPROACH TO COMPOSITE INTEGER FACTORIZATION

ALGEBRAIC APPROACH TO COMPOSITE INTEGER FACTORIZATION Aldrin W. Wanambisi 1* School of Pure and Applied Science, Mount Kenya University, P.O box 553-50100, Kakamega, Kenya. Shem Aywa 2 Department of Mathematics,

Elementary factoring algorithms

Math 5330 Spring 013 Elementary factoring algorithms The RSA cryptosystem is founded on the idea that, in general, factoring is hard. Where as with Fermat s Little Theorem and some related ideas, one can

Cryptography and Network Security

Cryptography and Network Security Fifth Edition by William Stallings Chapter 9 Public Key Cryptography and RSA Private-Key Cryptography traditional private/secret/single key cryptography uses one key shared

Lecture 13: Factoring Integers

CS 880: Quantum Information Processing 0/4/0 Lecture 3: Factoring Integers Instructor: Dieter van Melkebeek Scribe: Mark Wellons In this lecture, we review order finding and use this to develop a method

TYPES Workshop, 12-13 june 2006 p. 1/22. The Elliptic Curve Factorization method

Ä ÙÖ ÒØ ÓÙ Ð ÙÖ ÒØ ÓÑ Ø ºÒ Ø TYPES Workshop, 12-13 june 2006 p. 1/22 ÄÇÊÁ ÍÒ Ú Ö Ø À ÒÖ ÈÓ Ò Ö Æ ÒÝÁ. The Elliptic Curve Factorization method Outline 1. Introduction 2. Factorization method principle 3.

Lecture 10: Distinct Degree Factoring

CS681 Computational Number Theory Lecture 10: Distinct Degree Factoring Instructor: Piyush P Kurur Scribe: Ramprasad Saptharishi Overview Last class we left of with a glimpse into distant degree factorization.

Public Key Cryptography: RSA and Lots of Number Theory

Public Key Cryptography: RSA and Lots of Number Theory Public vs. Private-Key Cryptography We have just discussed traditional symmetric cryptography: Uses a single key shared between sender and receiver

RSA and Primality Testing

and Primality Testing Joan Boyar, IMADA, University of Southern Denmark Studieretningsprojekter 2010 1 / 81 Correctness of cryptography cryptography Introduction to number theory Correctness of with 2

Die ganzen zahlen hat Gott gemacht

Die ganzen zahlen hat Gott gemacht Polynomials with integer values B.Sury A quote attributed to the famous mathematician L.Kronecker is Die Ganzen Zahlen hat Gott gemacht, alles andere ist Menschenwerk.

Integer Factorization

Integer Factorization Lecture given at the Joh. Gutenberg-Universität, Mainz, July 23, 1992 by ÖYSTEIN J. RÖDSETH University of Bergen, Department of Mathematics, Allégt. 55, N-5007 Bergen, Norway 1 Introduction

Recent Breakthrough in Primality Testing

Nonlinear Analysis: Modelling and Control, 2004, Vol. 9, No. 2, 171 184 Recent Breakthrough in Primality Testing R. Šleževičienė, J. Steuding, S. Turskienė Department of Computer Science, Faculty of Physics

http://wrap.warwick.ac.uk/

Original citation: Hart, William B.. (2012) A one line factoring algorithm. Journal of the Australian Mathematical Society, Volume 92 (Number 1). pp. 61-69. ISSN 1446-7887 Permanent WRAP url: http://wrap.warwick.ac.uk/54707/

8 Primes and Modular Arithmetic

8 Primes and Modular Arithmetic 8.1 Primes and Factors Over two millennia ago already, people all over the world were considering the properties of numbers. One of the simplest concepts is prime numbers.

On Factoring Integers and Evaluating Discrete Logarithms

On Factoring Integers and Evaluating Discrete Logarithms A thesis presented by JOHN AARON GREGG to the departments of Mathematics and Computer Science in partial fulfillment of the honors requirements

The Division Algorithm for Polynomials Handout Monday March 5, 2012

The Division Algorithm for Polynomials Handout Monday March 5, 0 Let F be a field (such as R, Q, C, or F p for some prime p. This will allow us to divide by any nonzero scalar. (For some of the following,

calculating the result modulo 3, as follows: p(0) = 0 3 + 0 + 1 = 1 0,

Homework #02, due 1/27/10 = 9.4.1, 9.4.2, 9.4.5, 9.4.6, 9.4.7. Additional problems recommended for study: (9.4.3), 9.4.4, 9.4.9, 9.4.11, 9.4.13, (9.4.14), 9.4.17 9.4.1 Determine whether the following polynomials

Principles of Public Key Cryptography. Applications of Public Key Cryptography. Security in Public Key Algorithms

Principles of Public Key Cryptography Chapter : Security Techniques Background Secret Key Cryptography Public Key Cryptography Hash Functions Authentication Chapter : Security on Network and Transport

Integer Factorization: Solution via Algorithm for Constrained Discrete Logarithm Problem

Journal of Computer Science 5 (9): 674-679, 009 ISSN 1549-3636 009 Science Publications Integer Factorization: Solution via Algorithm for Constrained Discrete Logarithm Problem Boris S. Verkhovsky Department

THE MATHEMATICS OF PUBLIC KEY CRYPTOGRAPHY.

THE MATHEMATICS OF PUBLIC KEY CRYPTOGRAPHY. IAN KIMING 1. Forbemærkning. Det kan forekomme idiotisk, at jeg som dansktalende og skrivende i et danskbaseret tidsskrift med en (formentlig) primært dansktalende

Integer roots of quadratic and cubic polynomials with integer coefficients

Integer roots of quadratic and cubic polynomials with integer coefficients Konstantine Zelator Mathematics, Computer Science and Statistics 212 Ben Franklin Hall Bloomsburg University 400 East Second Street

Modern Factoring Algorithms

Modern Factoring Algorithms Kostas Bimpikis and Ragesh Jaiswal University of California, San Diego... both Gauss and lesser mathematicians may be justified in rejoicing that there is one science [number

Discrete Mathematics, Chapter 4: Number Theory and Cryptography

Discrete Mathematics, Chapter 4: Number Theory and Cryptography Richard Mayr University of Edinburgh, UK Richard Mayr (University of Edinburgh, UK) Discrete Mathematics. Chapter 4 1 / 35 Outline 1 Divisibility

SOLVING POLYNOMIAL EQUATIONS

C SOLVING POLYNOMIAL EQUATIONS We will assume in this appendix that you know how to divide polynomials using long division and synthetic division. If you need to review those techniques, refer to an algebra

Computing exponents modulo a number: Repeated squaring

Computing exponents modulo a number: Repeated squaring How do you compute (1415) 13 mod 2537 = 2182 using just a calculator? Or how do you check that 2 340 mod 341 = 1? You can do this using the method

Factoring Polynomials

Factoring Polynomials Sue Geller June 19, 2006 Factoring polynomials over the rational numbers, real numbers, and complex numbers has long been a standard topic of high school algebra. With the advent

Introduction to Finite Fields (cont.)

Chapter 6 Introduction to Finite Fields (cont.) 6.1 Recall Theorem. Z m is a field m is a prime number. Theorem (Subfield Isomorphic to Z p ). Every finite field has the order of a power of a prime number

On the coefficients of the polynomial in the number field sieve

On the coefficients of the polynomial in the number field sieve Yang Min a, Meng Qingshu b,, Wang Zhangyi b, Li Li a, Zhang Huanguo b a International School of Software, Wuhan University, Hubei, China,

Elementary Number Theory We begin with a bit of elementary number theory, which is concerned

CONSTRUCTION OF THE FINITE FIELDS Z p S. R. DOTY Elementary Number Theory We begin with a bit of elementary number theory, which is concerned solely with questions about the set of integers Z = {0, ±1,

Computer and Network Security

MIT 6.857 Computer and Networ Security Class Notes 1 File: http://theory.lcs.mit.edu/ rivest/notes/notes.pdf Revision: December 2, 2002 Computer and Networ Security MIT 6.857 Class Notes by Ronald L. Rivest

MA257: INTRODUCTION TO NUMBER THEORY LECTURE NOTES

MA257: INTRODUCTION TO NUMBER THEORY LECTURE NOTES 2016 47 4. Diophantine Equations A Diophantine Equation is simply an equation in one or more variables for which integer (or sometimes rational) solutions

Copy in your notebook: Add an example of each term with the symbols used in algebra 2 if there are any.

Algebra 2 - Chapter Prerequisites Vocabulary Copy in your notebook: Add an example of each term with the symbols used in algebra 2 if there are any. P1 p. 1 1. counting(natural) numbers - {1,2,3,4,...}

NEW DIGITAL SIGNATURE PROTOCOL BASED ON ELLIPTIC CURVES

NEW DIGITAL SIGNATURE PROTOCOL BASED ON ELLIPTIC CURVES Ounasser Abid 1, Jaouad Ettanfouhi 2 and Omar Khadir 3 1,2,3 Laboratory of Mathematics, Cryptography and Mechanics, Department of Mathematics, Fstm,

USING LUCAS SEQUENCES TO FACTOR LARGE INTEGERS NEAR GROUP ORDERS

USING LUCAS SEQUENCES TO FACTOR LARGE INTEGERS NEAR GROUP ORDERS Zhenxiang Zhang* Dept. of Math., Anhui Normal University, 241000 Wuhu, Anhui, P.R. China e-mail: zhangzhx@mail.ahwhptt.net.cn (Submitted

Factoring a semiprime n by estimating φ(n)

Factoring a semiprime n by estimating φ(n) Kyle Kloster May 7, 2010 Abstract A factoring algorithm, called the Phi-Finder algorithm, is presented that factors a product of two primes, n = pq, by determining

Zeros of a Polynomial Function

Zeros of a Polynomial Function An important consequence of the Factor Theorem is that finding the zeros of a polynomial is really the same thing as factoring it into linear factors. In this section we