Arithmetic algorithms for cryptology 5 October 2015, Paris. Sieves. Razvan Barbulescu CNRS and IMJ-PRG. R. Barbulescu Sieves 0 / 28
|
|
- Alison Bell
- 2 years ago
- Views:
Transcription
1 Arithmetic algorithms for cryptology 5 October 2015, Paris Sieves Razvan Barbulescu CNRS and IMJ-PRG R. Barbulescu Sieves 0 / 28
2 Starting point Notations q prime g a generator of (F q ) X a (secret) integer less than q Y = g X mod q. Quote Computing X from Y, on the other hand can be computed much more difficult and, for certain carefully chosen values of q, requires on the order of q 1/2 operations [...] Diffie and Hellman 1976 Indeed, the best known algorithm in 1976 was Baby step giant step. The DLP was as hard for (F q ) as for any other group (e.g. elliptic curves). R. Barbulescu Sieves 1 / 28
3 The L notation For any integer Q = e n, L Q (α, c) = exp ( cn α (log n) 1 α). When c is not specified we write L Q (α). Example L Q (1, 1 2 ) = exp ( 1 2 n) = exp(n) = Q (exponential algorithm). L Q (0, 3) = exp (3 log n) = n 3 (cubic algorithm) L Q (1/2, 1) = exp ( n log n ) exp ( n ) = e n (sub-exponential algorithm). Exercice L Lx (α)(β) = L x (αβ). L(α)L(β) = L(max(α, β)) 1+o(1). R. Barbulescu Sieves 2 / 28
4 History One year after the introduction of DLP in cryptography, a subexponential algorithm was proposed by Adleman (complexity L(1/2)). In 1978 when RSA was proposed, it was known that the continued fractions method of factorization was very fast. In early 80s Dixon and Pomerance proved that there are algorithms of complexity L(1/2). Ideas traveled from factorization to discrete logarithm in finite fields and vice-versa. Chronology Dates below give the publication year of the first algorithm of each class. For discrete logarithm, there are several cases, which were solved by different algorithms. complexity factorization DLP in finite fields L Q (1/2) 1970 a L Q (1/3) L Q (ɛ) 2013 a complexity unknown until 1980 (after the introduction of RSA) R. Barbulescu Sieves 3 / 28
5 Algorithms families Let us use red for factoring, blue for DLP and violet for both. elliptic curve method created in 1985 of complexity L(1/2) factorization early sieve algorithms created in of complexity L(1/2) factorization+dlp Rho + BSGS created in of complexity N = L(1) factorization+dlp advanced sieve algorithms created in of complexity L(1/3) factorization+dlp quasi-polynomial created in of complexity L(ɛ) DLP in fields F q k with small q. R. Barbulescu Sieves 4 / 28
6 Outline of the talk Introduction Index Calculus Quadratic sieve (QS/MPQS) Sieving R. Barbulescu Sieves 5 / 28
7 Integers Smoothness definition An integer is B-smooth if all its prime factors are less than B. computation One finds small prime divisors with ECM, which is probabilistic; relies on a conjecture of analytic number theory; given an integer x, it finds all its factors less than B in average time L B (1/2, 2) 1+o(1) log(x) 4. In practice, the dependency in log x is quadratic. Polynomials definition A polynomial in F q [t] is m-smooth if all its irreducible factors have degree less than or equal to m. computation One tests if a polynomial P(t) is m-smooth by one of the two methods below: by factoring it (correctness is trivial, probabilistic, slow); by taking gcd with P (t) (t qm t) (prove it!, deterministic, faster). R. Barbulescu Sieves 6 / 28
8 Integers Smoothness definition An integer is B-smooth if all its prime factors are less than B. computation One finds small prime divisors with ECM, which is probabilistic; relies on a conjecture of analytic number theory; given an integer x, it finds all its factors less than B in average time L B (1/2, 2) 1+o(1) log(x) 4. In practice, the dependency in log x is quadratic. Polynomials definition A polynomial in F q [t] is m-smooth if all its irreducible factors have degree less than or equal to m. computation One tests if a polynomial P(t) is m-smooth by one of the two methods below: by factoring it (correctness is trivial, probabilistic, slow); by taking gcd with P (t) (t qm t) (prove it!, deterministic, faster). It is not known how to define smooth elements on an elliptic curves with a fast smoothness test. R. Barbulescu Sieves 6 / 28
9 Parameters p = g = 7 is a generator of G = (Z/pZ) DLP: an example (1) l = 11 is a prime factor of (p 1) = #G B = 10 is the smoothness bound factor base 2, 3, 5, 7 Finding relations among logs 7 5 mod p = 4706 = R. Barbulescu Sieves 7 / 28
10 Parameters p = g = 7 is a generator of G = (Z/pZ) DLP: an example (1) l = 11 is a prime factor of (p 1) = #G B = 10 is the smoothness bound factor base 2, 3, 5, 7 Finding relations among logs 7 5 mod p = 4706 = mod p = 8740 = R. Barbulescu Sieves 7 / 28
11 Parameters p = g = 7 is a generator of G = (Z/pZ) DLP: an example (1) l = 11 is a prime factor of (p 1) = #G B = 10 is the smoothness bound factor base 2, 3, 5, 7 Finding relations among logs 7 5 mod p = 4706 = mod p = 8740 = mod p = 675 = R. Barbulescu Sieves 7 / 28
12 Parameters p = g = 7 is a generator of G = (Z/pZ) DLP: an example (1) l = 11 is a prime factor of (p 1) = #G B = 10 is the smoothness bound factor base 2, 3, 5, 7 Finding relations among logs 7 5 mod p = 4706 = mod p = 8740 = mod p = 675 = The last relation gives: 7 = 3 log log 7 5 R. Barbulescu Sieves 7 / 28
13 Parameters p = g = 7 is a generator of G = (Z/pZ) DLP: an example (1) l = 11 is a prime factor of (p 1) = #G B = 10 is the smoothness bound factor base 2, 3, 5, 7 Finding relations among logs 7 5 mod p = 4706 = mod p = 8740 = mod p = 675 = mod p =... The last relation gives: 7 = 3 log log = 8 log log = 6 log log 7 5. R. Barbulescu Sieves 7 / 28
14 DLP: an example (2) Thanks to the Pohlig-Hellman reduction we do the linear algebra computations modulo l = 11. Linear algebra computations We have to find the unknown log 7 2, log 7 3 and lg 7 5 in the equation log log mod log Conjecture The matrix obtained by the technique above has maximal rank. We can drop all conjectures by modifying the algorithm, but this variant is fast and, even if the matrix has smaller rank we can find logs. Solution We solve to obtain log mod 11; log mod 11 and log mod 11. For this small example we can also use Pollard s rho method and obtain that log 7 3 = mod 11. R. Barbulescu Sieves 8 / 28
15 DLP: an example (3) At this point, we know discrete logarithms of the factor base and of smooth numbers: log 7 (10) = log log mod 11. R. Barbulescu Sieves 9 / 28
16 DLP: an example (3) At this point, we know discrete logarithms of the factor base and of smooth numbers: log 7 (10) = log log mod 11. Smoothing by randomization Consider a residue modulo p which is not 10-smooth, e.g. h = 151. We take random exponents a and test is (g a h) mod p is B-smooth mod p = 3389 R. Barbulescu Sieves 9 / 28
17 DLP: an example (3) At this point, we know discrete logarithms of the factor base and of smooth numbers: log 7 (10) = log log mod 11. Smoothing by randomization Consider a residue modulo p which is not 10-smooth, e.g. h = 151. We take random exponents a and test is (g a h) mod p is B-smooth mod p = mod p = = R. Barbulescu Sieves 9 / 28
18 DLP: an example (3) At this point, we know discrete logarithms of the factor base and of smooth numbers: log 7 (10) = log log mod 11. Smoothing by randomization Consider a residue modulo p which is not 10-smooth, e.g. h = 151. We take random exponents a and test is (g a h) mod p is B-smooth mod p = mod p = = mod p = 8748 = R. Barbulescu Sieves 9 / 28
19 DLP: an example (3) At this point, we know discrete logarithms of the factor base and of smooth numbers: log 7 (10) = log log mod 11. Smoothing by randomization Consider a residue modulo p which is not 10-smooth, e.g. h = 151. We take random exponents a and test is (g a h) mod p is B-smooth mod p = mod p = = mod p = 8748 = The discrete logarithms of the two members are equal: We find log 7 (151) 3 mod log 7 (151) = 2 log log 7 3. Remark This part of the computations is independent of the relation collection and linear algebra stages. It is called individual logarithm stage. R. Barbulescu Sieves 9 / 28
20 Index Calculus p prime, g generator of (Z/pZ), l prime divisor of (p 1) Input: h integer less than p Output: log g h mod l 1: Set B to its optimal value 2: Make the list F of the primes less than B (factor base) Initialization 3: repeat 4: a Random([1,p-1]) 5: if (g a mod p) is B-smooth then 6: relations=relations {a} Relations collection 7: end if 8: until #relations #F 9: Construct the matrix M = (m a,q ), a in relations, q F as follows m a,q = val q (g a mod p). Linear algebra 10: Solve the linear system Mx = (a) a in relations. 11: repeat 12: b Random([1,p-1]) 13: until (g b h mod p) is B-smooth 14: Factor (g b h mod p) = q e i i Individual logarithm 15: return x = e i log g (q i ) b R. Barbulescu Sieves 10 / 28
21 Complexity analysis of Index Calculus (1) Notation For two integers x and y, call P(x, y) the proportion of integers less than x which are y-smooth. Stages complexity Relations collection The integers (g a mod p) are random integers less than p. The expectancy of the number of trials before finding a relation is 1/P(p, B). Hence, cost(relations collection) = B/P(p, B). Linear algebra We have to invert a square matrix of size B. With the Gaussian method it requires B 3 operations. The Wiedemann algorithm (1986) takes time B 2 λ, where λ is the average number of non-zero entries per row. In our case λ is the number of divisors of the integer g a mod p, which is less than p. Since an integer less than p has less than log 2 p prime factors, λ log p. Hence we have cost(linear algebra) = B 2+o(1). Individual logarithm The integers (g a h mod p) are random among integers less than p. Hence, on average we need 1/P(p, B) trials: cost(individual logarithm) = 1/P(p, B). R. Barbulescu Sieves 11 / 28
22 Complexity analysis of Index Calculus (2) We have: cost(index Calculus) = B/P(p, B) + B 2+o(1) + 1/P(p, B). = B 1+o(1) (1/P(p, B) + B) 2B 1+o(1) max (1/P(p, B), B). When we increase B, 1/P(p, B) decreases, so the optimal value of max (1/P(p, B), B) is obtained when B = 1/P(p, B). Theorem (Canfield,Erdös,Pomerance 1983, simplified statement) Assume that x and u are two real numbers such that u is between (log x) c 1 and (log x) c 2 for some fixed constants c 1 and c 2, 0 < c 1 < c 2 < 1. Then, we have where the o(1) depends only on x. Conclusion P(x, x 1/u ) = 1/u u(1+o(1)), The solution of the equation B = 1/P(p, B) corresponds to B = p 1/u for u = 1/ 2(log p) 1/2 /(log log p) 1/2. Then the complexity is equal to B 2 and we obtain cost (Index Calculus) = L p (1/2, 2) 1+o(1). R. Barbulescu Sieves 12 / 28
23 Comparing algorithms DLP in real life The Index Calculus evolved into algorithms which inherited its characteristics: factor base, relations collection and linear algebra. The L notation allows to compare algorithms: Index calculus L p (1/2, 2), Gaussian Integers L p (1/2, 1), and the Number Field Sieve (NFS) L p (1/3, 3 64/9). Records are published on the NMBRTHRY mailing list. Records allow to find the crossing point year algorithm size of p in decimal digits author cost in GIPS a years 1991 Gaussian Integers 58 Lammachia, Odlyzko Gaussian Integers 85 Weber NFS 85 Weber NFS 100 Lercier, Joux NFS 110 Lercier, Joux NFS 130 Lercier, Joux NFS 160 Franke et al NFS 180 Caramel 260 a Giga instructions per second R. Barbulescu Sieves 13 / 28
24 Outline of the talk Introduction Index Calculus Quadratic sieve (QS/MPQS) Sieving R. Barbulescu Sieves 14 / 28
25 Fermat s idea Idea Fermat (XVII century) computed solutions of the equation X 2 Y 2 mod N. (1) It became a classical idea for factoring, e.g. mechanical machines were built in France in early XX century to solve the above equation. a a Discovery of a lost factoring machine, Shallit, Wiliams, Morain Lemma If N = pq, Equation (1) has four solutions Y for each X 0. Proof. Using the identity X 2 Y 2 = (X Y )(X + Y ) we have Y ±X mod p and Y ±X mod q. We call X the unique integer less than N which satisfies the system Y X mod p Y X mod q. Then the solutions of Equation (1) are Y = X, Y = X, Y = X and Y = X. R. Barbulescu Sieves 15 / 28
26 Fermat s idea Idea Fermat (XVII century) computed solutions of the equation X 2 Y 2 mod N. (1) It became a classical idea for factoring, e.g. mechanical machines were built in France in early XX century to solve the above equation. a a Discovery of a lost factoring machine, Shallit, Wiliams, Morain Lemma If N = pq, Equation (1) has four solutions Y for each X 0. Proof. Using the identity X 2 Y 2 = (X Y )(X + Y ) we have Y ±X mod p and Y ±X mod q. We call X the unique integer less than N which satisfies the system Y X mod p Y X mod q. Then the solutions of Equation (1) are Y = X, Y = X, Y = X and Y = X. 50% of the solutions, i.e. X and X, give gcd(x Y, N) = p or q. R. Barbulescu Sieves 15 / 28
27 Factoring: an example (1) Not squares but smooth numbers Let us factor N = We search integers a such that a 2 N is a square. In order to keep a 2 N small, we take a approximately equal to N: 46, 47,.... Squares seem to be rare! Kraitchik (1922) proposed to collect integers which are 10-smooth. We call factor base the set of primes less than 10: 2, 3, 5 and 7. Collecting relations 46 2 N = 75 = R. Barbulescu Sieves 16 / 28
28 Factoring: an example (1) Not squares but smooth numbers Let us factor N = We search integers a such that a 2 N is a square. In order to keep a 2 N small, we take a approximately equal to N: 46, 47,.... Squares seem to be rare! Kraitchik (1922) proposed to collect integers which are 10-smooth. We call factor base the set of primes less than 10: 2, 3, 5 and 7. Collecting relations 46 2 N = 75 = N = 168 = R. Barbulescu Sieves 16 / 28
29 Factoring: an example (1) Not squares but smooth numbers Let us factor N = We search integers a such that a 2 N is a square. In order to keep a 2 N small, we take a approximately equal to N: 46, 47,.... Squares seem to be rare! Kraitchik (1922) proposed to collect integers which are 10-smooth. We call factor base the set of primes less than 10: 2, 3, 5 and 7. Collecting relations 46 2 N = 75 = N = 168 = N = 263 = R. Barbulescu Sieves 16 / 28
30 Factoring: an example (1) Not squares but smooth numbers Let us factor N = We search integers a such that a 2 N is a square. In order to keep a 2 N small, we take a approximately equal to N: 46, 47,.... Squares seem to be rare! Kraitchik (1922) proposed to collect integers which are 10-smooth. We call factor base the set of primes less than 10: 2, 3, 5 and 7. Collecting relations 46 2 N = 75 = N = 168 = N = 263 = N = 360 = R. Barbulescu Sieves 16 / 28
31 Factoring: an example (1) Not squares but smooth numbers Let us factor N = We search integers a such that a 2 N is a square. In order to keep a 2 N small, we take a approximately equal to N: 46, 47,.... Squares seem to be rare! Kraitchik (1922) proposed to collect integers which are 10-smooth. We call factor base the set of primes less than 10: 2, 3, 5 and 7. Collecting relations 46 2 N = 75 = N = 168 = N = 263 = N = 360 = N = 459 = R. Barbulescu Sieves 16 / 28
32 Factoring: an example (1) Not squares but smooth numbers Let us factor N = We search integers a such that a 2 N is a square. In order to keep a 2 N small, we take a approximately equal to N: 46, 47,.... Squares seem to be rare! Kraitchik (1922) proposed to collect integers which are 10-smooth. We call factor base the set of primes less than 10: 2, 3, 5 and 7. Collecting relations 46 2 N = 75 = N = 168 = N = 263 = N = 360 = N = 459 = N = 560 = R. Barbulescu Sieves 16 / 28
33 Factoring: an example (2) Combining relations With the previous relations we have, for all non-negative integers u 46, u 47, u 49, u 51 : ( ) 46 2u u u u u 47 +3u 49 +4u 51 3 u 46+u 47 +2u u 46+u 49 +u 51 7 u 47+u 51 mod N Linear algebra stage We find u 46, u 47, u 49, u 51 in Z/2Z satisfying We obtain u 46 = u 47 = u 49 = u 51 = 1. u u u 51 0 mod 2 u 46 + u u 49 0 mod 2 2u 46 + u 49 + u 51 0 mod 2 u 47 + u 51 0 mod 2. R. Barbulescu Sieves 17 / 28
34 Factoring: an example (3) Computing X We multiply the left sides of all the relations to find X = 46 u 46 47u 47 49u 49 51u 51 mod N = mod N = 311. Computing Y We multiply the right sides of all the relations to find Y = ( 2 3u 47+3u 49 +4u 51 3 u 46+u 47 +2u u 46+u 49 +u 51 7 u 47+u 51 ) 1/2 mod N = mod N = Euclid gives the factorization! Since X ±Y mod N, we succeed. We compute The factorization is 2041 = gcd(y X, N) = gcd( , 2041) = 13. R. Barbulescu Sieves 18 / 28
35 Quadratic sieve Input: integer N = pq for two primes p and q Output: p and q 1: Set B to its optimal value 2: Make the list F of the primes less than B (factor base) Initialization 3: a N 4: repeata a + 1 5: if (a 2 N) is B-smooth then 6: relations=relations {a} Relations collection 7: end if 8: until #relations #F 9: Construct the matrix M = (m a,q ), a in relations, q F as follows ( m a,q = val q a 2 N ). Linear algebra 10: Solve the linear system transpose(x)m 0 mod 2. 11: Compute X = a in relations ax a. 12: Compute Y = q F q( a xa)/2. 13: Compute g = gcd(x Y, N) Square root 14: if g 1 or N then 15: return p = g, q = N/g 16: else 17: Find more relations and do the linear algebra again. 18: end if R. Barbulescu Sieves 19 / 28
36 Correctness and complexity analysis Correctness The algorithm relies on two heuristics: 1. The proportion of integers a 2 N which are B-smooth is the same as the proportion of integers of the same size which are B-smooth.(proven by Pomerance in the simples form, but not in the variants of the algorithm) 2. Each solution of X 2 Y 2 mod N found by the algorithm has 50% chances to give a factor. The block version of the Wiedemann algorithm allows to compute 32 or 64 solutions of our linear system with no extra cost. Hence, we only redo the post-processing. Complexity analysis We write a = N + x. Then a 2 N = ( N + x) 2 N = 2x N + (x 2 + N 2 N) We consider the case where x = N o(1) trials are enough to collect #F relations. After all computations are done, we prove that this choice is possible. Then we have a 2 N = N 1/2+o(1). We repeat the complexity analysis of Index Calculus with P( N, B) instead of P(p, B). We obtain R. Barbulescu Sieves cost (QS) = L N (1/2, 1) 1+o(1) 20 / 28
37 Factoring in real life Comparing algorithms The quadratic sieve was improved by proposing new variants of the same complexity, like the Multiple Polynomial Quadratic Sieve (MPQS). Later, a factorization variant of the number field sieve (NFS) was invented of complexity L N (1/3, 3 64/9). The RSA company offered prizes to whoever factored RSA keys year digit size algorithm author QS Lenstra et al QS Lenstra et al QS Denny et al QS Lenstra et al NFS Franke et al NFS Franke et al NFS Franke et al NFS international The computation of the present record, RSA 768 bits took 2000 CPU years. You can factor at home with CADO R. Barbulescu Sieves 21 / 28
38 Outline of the talk Introduction Index Calculus Quadratic sieve (QS/MPQS) Sieving R. Barbulescu Sieves 22 / 28
39 The idea of sieving What we need In QS, we collect integers a = N + x, where x is a small integer, such that a 2 N is B-smooth. ( We need to find the smooth values of Q(x), when Q(x) = 2 N + x) N. Eratosthenes sieve Given a polynomial Q(x) Z[x], one can compute the values x in an interval [E 1, E 2 ] such that Q(x) is prime. One marks with a line every value of x which is divisible by two, then by three and so on. The values of x which have no marks correspond to prime values of Q. R. Barbulescu Sieves 23 / 28
40 The idea of sieving What we need In QS, we collect integers a = N + x, where x is a small integer, such that a 2 N is B-smooth. ( We need to find the smooth values of Q(x), when Q(x) = 2 N + x) N. Eratosthenes sieve Given a polynomial Q(x) Z[x], one can compute the values x in an interval [E 1, E 2 ] such that Q(x) is prime. One marks with a line every value of x which is divisible by two, then by three and so on. The values of x which have no marks correspond to prime values of Q. Numbers which have many marks are smooth. R. Barbulescu Sieves 23 / 28
41 Sieving: an example Problem Find values a in the interval [3, 7] such that Q(a) = a is prime, respectively 6-smooth. Table of sieving Computations a ticks log(a 2 + 1) log 10 log 17 log 26 log 37 log 50 R. Barbulescu Sieves 24 / 28
42 Sieving: an example Problem Find values a in the interval [3, 7] such that Q(a) = a is prime, respectively 6-smooth. Table of sieving a ticks log(a 2 + 1) log 10 log 17 log 26 log 37 log 50 Computations Consider primes less than 6 and their powers less than max{q(a) a [2, 7]}: p = 2, solutions of a mod 2 are {1}; R. Barbulescu Sieves 24 / 28
43 Sieving: an example Problem Find values a in the interval [3, 7] such that Q(a) = a is prime, respectively 6-smooth. Table of sieving a ticks l l l log(a 2 + 1) log 5 log 17 log 13 log 37 log 25 Computations Consider primes less than 6 and their powers less than max{q(a) a [2, 7]}: p = 2, solutions of a mod 2 are {1}; q = 2 2, solutions of a mod 4 are ; R. Barbulescu Sieves 24 / 28
44 Sieving: an example Problem Find values a in the interval [3, 7] such that Q(a) = a is prime, respectively 6-smooth. Table of sieving a ticks l l l log(a 2 + 1) log 5 log 17 log 13 log 37 log 25 Computations Consider primes less than 6 and their powers less than max{q(a) a [2, 7]}: p = 2, solutions of a mod 2 are {1}; q = 2 2, solutions of a mod 4 are ; p = 3, solutions of a mod 3 are ; R. Barbulescu Sieves 24 / 28
45 Sieving: an example Problem Find values a in the interval [3, 7] such that Q(a) = a is prime, respectively 6-smooth. Table of sieving a ticks l l l log(a 2 + 1) log 5 log 17 log 13 log 37 log 25 Computations Consider primes less than 6 and their powers less than max{q(a) a [2, 7]}: p = 2, solutions of a mod 2 are {1}; q = 2 2, solutions of a mod 4 are ; p = 3, solutions of a mod 3 are ; p = 5, solutions of a mod 5 are {2, 3}; R. Barbulescu Sieves 24 / 28
46 Sieving: an example Problem Find values a in the interval [3, 7] such that Q(a) = a is prime, respectively 6-smooth. Table of sieving a ticks ll l ll log(a 2 + 1) 0 log 17 log 13 log 37 log 5 Computations Consider primes less than 6 and their powers less than max{q(a) a [2, 7]}: p = 2, solutions of a mod 2 are {1}; q = 2 2, solutions of a mod 4 are ; p = 3, solutions of a mod 3 are ; p = 5, solutions of a mod 5 are {2, 3}; p = 5 2, solutions of a mod 25 are {7, 18} R. Barbulescu Sieves 24 / 28
47 Sieving: an example Problem Find values a in the interval [3, 7] such that Q(a) = a is prime, respectively 6-smooth. Table of sieving a ticks ll l lll log(a 2 + 1) 0 log 17 log 13 log 37 0 Computations Consider primes less than 6 and their powers less than max{q(a) a [2, 7]}: p = 2, solutions of a mod 2 are {1}; q = 2 2, solutions of a mod 4 are ; p = 3, solutions of a mod 3 are ; p = 5, solutions of a mod 5 are {2, 3}; p = 5 2, solutions of a mod 25 are {7, 18} R. Barbulescu Sieves 24 / 28
48 Sieving: an example Problem Find values a in the interval [3, 7] such that Q(a) = a is prime, respectively 6-smooth. Table of sieving a ticks ll l lll log(a 2 + 1) 0 log 17 log 13 log 37 0 Computations Consider primes less than 6 and their powers less than max{q(a) a [2, 7]}: p = 2, solutions of a mod 2 are {1}; q = 2 2, solutions of a mod 4 are ; p = 3, solutions of a mod 3 are ; p = 5, solutions of a mod 5 are {2, 3}; p = 5 2, solutions of a mod 25 are {7, 18} Conclusion The prime values of Q are Q(4) = 17 and Q(6) = 37. The 6-smooth values of Q are Q(3) = 10 and Q(7) = 50. R. Barbulescu Sieves 24 / 28
49 Algorithm for sieving Algorithm Input: a monic polynomial Q(x) in Z[x] and parameters B, E 1, E 2 ; Output: all the integers x [E 1, E 2 ] for which Q(x) is B-smooth. 1: Make a list (p k, r) of prime powers p k max{ Q(x), x [E 1, E 2 ]}, with p < B, and integers 0 r < p k such that Q(r) 0 mod p k 2: Define an array indexed by x [E 1, E 2 ] and initialize it with log 2 Q(x) 3: for all (p k, r) considered above do 4: for x in [E 1, E 2 ] and x r mod p k do 5: Subtract log 2 p from the entry of index x; 6: end for 7: end for 8: Collect the indices x where the array is close to 0 (numerical errors). Cofactorization In practice we sieve on primes smaller than a bound fbb < B and we collect indices x whose value is smaller than a threshold. Then we test smoothness with ECM on the survivals in a step called cofactorization. In the literature, the smoothness bound B is called lpb, large prime bound, to distinguish from fbb, factor base bound. Exercice What is the condition on fbb and lpb such that ECM is not needed, i.e., we know that there is only one large prime. R. Barbulescu Sieves 25 / 28
50 Complexity New complexity The complexity of the sieve is B(log B) O(1) + p prime 1 (E 2 E 1 ). p 1 Using the formula p<x 1 p log log x, the complexity of the sieve is (E 2 E 1 ) 1+o(1). In first approximation, this is the cardinality of the sieved array. Old complexity One can show that L Lx (α)(β) = L x (αβ). Hence, if the smoothness bound B is L p (α) for some α < 1, then one can simply enumerate values to test for smoothness, with a cost of L(α/2) per test. Then the complexity of the algorithm is B O(1) L p (α/2) = B O(1). We conclude that the sieving procedure does not change complexity, at the first level of approximation. R. Barbulescu Sieves 26 / 28
51 Conclusion of first lecture DLP in finite fields and factoring have a common history; smoothness is the key notion for these problems; complexity is best expressed with the L notation; the new algorithms evolved from Index Calculus and Quadratic Sieve; sieving is an important practical improvement, but unseen in the first approximation of the complexity. R. Barbulescu Sieves 27 / 28
52 Exercices 1. What is the complexity of solving linear systems by Gaussian elimination. 2. If f, g : R R are two functions then min max(f, g) min f + g 2 min x R x R x R max(f, g). If f is increasing and g is decreasing and both are continous then the the minimum value of max(f, g) is obtained when f (x) = g(x). 3. Find α, c > 0 so that B = L p (α, c) is solution of B = 1/P(p, B). 4. What is the speed-up obtained when using the sieve w.r.t. a direct smoothness test with ECM. R. Barbulescu Sieves 28 / 28
Factoring. Factoring 1
Factoring Factoring 1 Factoring Security of RSA algorithm depends on (presumed) difficulty of factoring o Given N = pq, find p or q and RSA is broken o Rabin cipher also based on factoring Factoring like
Primality - Factorization
Primality - Factorization Christophe Ritzenthaler November 9, 2009 1 Prime and factorization Definition 1.1. An integer p > 1 is called a prime number (nombre premier) if it has only 1 and p as divisors.
Integer Factorization using the Quadratic Sieve
Integer Factorization using the Quadratic Sieve Chad Seibert* Division of Science and Mathematics University of Minnesota, Morris Morris, MN 56567 seib0060@morris.umn.edu March 16, 2011 Abstract We give
U.C. Berkeley CS276: Cryptography Handout 0.1 Luca Trevisan January, 2009. Notes on Algebra
U.C. Berkeley CS276: Cryptography Handout 0.1 Luca Trevisan January, 2009 Notes on Algebra These notes contain as little theory as possible, and most results are stated without proof. Any introductory
Factoring Algorithms
Factoring Algorithms The p 1 Method and Quadratic Sieve November 17, 2008 () Factoring Algorithms November 17, 2008 1 / 12 Fermat s factoring method Fermat made the observation that if n has two factors
The Quadratic Sieve Factoring Algorithm
The Quadratic Sieve Factoring Algorithm Eric Landquist MATH 488: Cryptographic Algorithms December 14, 2001 1 Introduction Mathematicians have been attempting to find better and faster ways to factor composite
Factorization Methods: Very Quick Overview
Factorization Methods: Very Quick Overview Yuval Filmus October 17, 2012 1 Introduction In this lecture we introduce modern factorization methods. We will assume several facts from analytic number theory.
Study of algorithms for factoring integers and computing discrete logarithms
Study of algorithms for factoring integers and computing discrete logarithms First Indo-French Workshop on Cryptography and Related Topics (IFW 2007) June 11 13, 2007 Paris, France Dr. Abhijit Das Department
Factoring Algorithms
Institutionen för Informationsteknologi Lunds Tekniska Högskola Department of Information Technology Lund University Cryptology - Project 1 Factoring Algorithms The purpose of this project is to understand
I. Introduction. MPRI Cours 2-12-2. Lecture IV: Integer factorization. What is the factorization of a random number? II. Smoothness testing. F.
F. Morain École polytechnique MPRI cours 2-12-2 2013-2014 3/22 F. Morain École polytechnique MPRI cours 2-12-2 2013-2014 4/22 MPRI Cours 2-12-2 I. Introduction Input: an integer N; logox F. Morain logocnrs
Faster deterministic integer factorisation
David Harvey (joint work with Edgar Costa, NYU) University of New South Wales 25th October 2011 The obvious mathematical breakthrough would be the development of an easy way to factor large prime numbers
Notes on Factoring. MA 206 Kurt Bryan
The General Approach Notes on Factoring MA 26 Kurt Bryan Suppose I hand you n, a 2 digit integer and tell you that n is composite, with smallest prime factor around 5 digits. Finding a nontrivial factor
An Overview of Integer Factoring Algorithms. The Problem
An Overview of Integer Factoring Algorithms Manindra Agrawal IITK / NUS The Problem Given an integer n, find all its prime divisors as efficiently as possible. 1 A Difficult Problem No efficient algorithm
Smooth numbers and the quadratic sieve
Algorithmic Number Theory MSRI Publications Volume 44, 2008 Smooth numbers and the quadratic sieve CARL POMERANCE ABSTRACT. This article gives a gentle introduction to factoring large integers via the
MATH 168: FINAL PROJECT Troels Eriksen. 1 Introduction
MATH 168: FINAL PROJECT Troels Eriksen 1 Introduction In the later years cryptosystems using elliptic curves have shown up and are claimed to be just as secure as a system like RSA with much smaller key
Primality Testing and Factorization Methods
Primality Testing and Factorization Methods Eli Howey May 27, 2014 Abstract Since the days of Euclid and Eratosthenes, mathematicians have taken a keen interest in finding the nontrivial factors of integers,
ELEMENTARY THOUGHTS ON DISCRETE LOGARITHMS. Carl Pomerance
ELEMENTARY THOUGHTS ON DISCRETE LOGARITHMS Carl Pomerance Given a cyclic group G with generator g, and given an element t in G, the discrete logarithm problem is that of computing an integer l with g l
Factoring & Primality
Factoring & Primality Lecturer: Dimitris Papadopoulos In this lecture we will discuss the problem of integer factorization and primality testing, two problems that have been the focus of a great amount
FACTORING. n = 2 25 + 1. fall in the arithmetic sequence
FACTORING The claim that factorization is harder than primality testing (or primality certification) is not currently substantiated rigorously. As some sort of backward evidence that factoring is hard,
Cryptography: RSA and the discrete logarithm problem
Cryptography: and the discrete logarithm problem R. Hayden Advanced Maths Lectures Department of Computing Imperial College London February 2010 Public key cryptography Assymmetric cryptography two keys:
Generic attacks and index calculus. D. J. Bernstein University of Illinois at Chicago
Generic attacks and index calculus D. J. Bernstein University of Illinois at Chicago The discrete-logarithm problem Define Ô = 1000003. Easy to prove: Ô is prime. Can we find an integer Ò ¾ 1 2 3 Ô 1 such
Public-Key Cryptanalysis 1: Introduction and Factoring
Public-Key Cryptanalysis 1: Introduction and Factoring Nadia Heninger University of Pennsylvania July 21, 2013 Adventures in Cryptanalysis Part 1: Introduction and Factoring. What is public-key crypto
International Journal of Information Technology, Modeling and Computing (IJITMC) Vol.1, No.3,August 2013
FACTORING CRYPTOSYSTEM MODULI WHEN THE CO-FACTORS DIFFERENCE IS BOUNDED Omar Akchiche 1 and Omar Khadir 2 1,2 Laboratory of Mathematics, Cryptography and Mechanics, Fstm, University of Hassan II Mohammedia-Casablanca,
FACTORING SPARSE POLYNOMIALS
FACTORING SPARSE POLYNOMIALS Theorem 1 (Schinzel): Let r be a positive integer, and fix non-zero integers a 0,..., a r. Let F (x 1,..., x r ) = a r x r + + a 1 x 1 + a 0. Then there exist finite sets S
Runtime and Implementation of Factoring Algorithms: A Comparison
Runtime and Implementation of Factoring Algorithms: A Comparison Justin Moore CSC290 Cryptology December 20, 2003 Abstract Factoring composite numbers is not an easy task. It is classified as a hard algorithm,
Factoring and Discrete Logarithms in Subexponential Time
Chapter 15 Factoring and Discrete Logarithms in Subexponential Time This is a chapter from version 1.1 of the book Mathematics of Public Key Cryptography by Steven Galbraith, available from http://www.isg.rhul.ac.uk/
Basic Algorithms In Computer Algebra
Basic Algorithms In Computer Algebra Kaiserslautern SS 2011 Prof. Dr. Wolfram Decker 2. Mai 2011 References Cohen, H.: A Course in Computational Algebraic Number Theory. Springer, 1993. Cox, D.; Little,
Elements of Applied Cryptography Public key encryption
Network Security Elements of Applied Cryptography Public key encryption Public key cryptosystem RSA and the factorization problem RSA in practice Other asymmetric ciphers Asymmetric Encryption Scheme Let
STUDY ON ELLIPTIC AND HYPERELLIPTIC CURVE METHODS FOR INTEGER FACTORIZATION. Takayuki Yato. A Senior Thesis. Submitted to
STUDY ON ELLIPTIC AND HYPERELLIPTIC CURVE METHODS FOR INTEGER FACTORIZATION by Takayuki Yato A Senior Thesis Submitted to Department of Information Science Faculty of Science The University of Tokyo on
Factoring pq 2 with Quadratic Forms: Nice Cryptanalyses
Factoring pq 2 with Quadratic Forms: Nice Cryptanalyses Phong Nguyễn http://www.di.ens.fr/~pnguyen & ASIACRYPT 2009 Joint work with G. Castagnos, A. Joux and F. Laguillaumie Summary Factoring A New Factoring
Factoring integers, Producing primes and the RSA cryptosystem Harish-Chandra Research Institute
RSA cryptosystem HRI, Allahabad, February, 2005 0 Factoring integers, Producing primes and the RSA cryptosystem Harish-Chandra Research Institute Allahabad (UP), INDIA February, 2005 RSA cryptosystem HRI,
Factoring and Discrete Log
Factoring and Discrete Log Nadia Heninger University of Pennsylvania June 1, 2015 Textbook RSA [Rivest Shamir Adleman 1977] Public Key N = pq modulus e encryption exponent Private Key p, q primes d decryption
The Sieve Re-Imagined: Integer Factorization Methods
The Sieve Re-Imagined: Integer Factorization Methods by Jennifer Smith A research paper presented to the University of Waterloo in partial fulfillment of the requirement for the degree of Master of Mathematics
Breaking The Code. Ryan Lowe. Ryan Lowe is currently a Ball State senior with a double major in Computer Science and Mathematics and
Breaking The Code Ryan Lowe Ryan Lowe is currently a Ball State senior with a double major in Computer Science and Mathematics and a minor in Applied Physics. As a sophomore, he took an independent study
Cryptography and Network Security Chapter 8
Cryptography and Network Security Chapter 8 Fifth Edition by William Stallings Lecture slides by Lawrie Brown (with edits by RHB) Chapter 8 Introduction to Number Theory The Devil said to Daniel Webster:
The van Hoeij Algorithm for Factoring Polynomials
The van Hoeij Algorithm for Factoring Polynomials Jürgen Klüners Abstract In this survey we report about a new algorithm for factoring polynomials due to Mark van Hoeij. The main idea is that the combinatorial
A Factoring and Discrete Logarithm based Cryptosystem
Int. J. Contemp. Math. Sciences, Vol. 8, 2013, no. 11, 511-517 HIKARI Ltd, www.m-hikari.com A Factoring and Discrete Logarithm based Cryptosystem Abdoul Aziz Ciss and Ahmed Youssef Ecole doctorale de Mathematiques
JUST THE MATHS UNIT NUMBER 1.8. ALGEBRA 8 (Polynomials) A.J.Hobson
JUST THE MATHS UNIT NUMBER 1.8 ALGEBRA 8 (Polynomials) by A.J.Hobson 1.8.1 The factor theorem 1.8.2 Application to quadratic and cubic expressions 1.8.3 Cubic equations 1.8.4 Long division of polynomials
Index Calculation Attacks on RSA Signature and Encryption
Index Calculation Attacks on RSA Signature and Encryption Jean-Sébastien Coron 1, Yvo Desmedt 2, David Naccache 1, Andrew Odlyzko 3, and Julien P. Stern 4 1 Gemplus Card International {jean-sebastien.coron,david.naccache}@gemplus.com
Discrete Mathematics Lecture 3 Elementary Number Theory and Methods of Proof. Harper Langston New York University
Discrete Mathematics Lecture 3 Elementary Number Theory and Methods of Proof Harper Langston New York University Proof and Counterexample Discovery and proof Even and odd numbers number n from Z is called
Prime Numbers and Irreducible Polynomials
Prime Numbers and Irreducible Polynomials M. Ram Murty The similarity between prime numbers and irreducible polynomials has been a dominant theme in the development of number theory and algebraic geometry.
CHAPTER SIX IRREDUCIBILITY AND FACTORIZATION 1. BASIC DIVISIBILITY THEORY
January 10, 2010 CHAPTER SIX IRREDUCIBILITY AND FACTORIZATION 1. BASIC DIVISIBILITY THEORY The set of polynomials over a field F is a ring, whose structure shares with the ring of integers many characteristics.
(x + a) n = x n + a Z n [x]. Proof. If n is prime then the map
22. A quick primality test Prime numbers are one of the most basic objects in mathematics and one of the most basic questions is to decide which numbers are prime (a clearly related problem is to find
The Mathematics of the RSA Public-Key Cryptosystem
The Mathematics of the RSA Public-Key Cryptosystem Burt Kaliski RSA Laboratories ABOUT THE AUTHOR: Dr Burt Kaliski is a computer scientist whose involvement with the security industry has been through
RSA Attacks. By Abdulaziz Alrasheed and Fatima
RSA Attacks By Abdulaziz Alrasheed and Fatima 1 Introduction Invented by Ron Rivest, Adi Shamir, and Len Adleman [1], the RSA cryptosystem was first revealed in the August 1977 issue of Scientific American.
3 1. Note that all cubes solve it; therefore, there are no more
Math 13 Problem set 5 Artin 11.4.7 Factor the following polynomials into irreducible factors in Q[x]: (a) x 3 3x (b) x 3 3x + (c) x 9 6x 6 + 9x 3 3 Solution: The first two polynomials are cubics, so if
A New Generic Digital Signature Algorithm
Groups Complex. Cryptol.? (????), 1 16 DOI 10.1515/GCC.????.??? de Gruyter???? A New Generic Digital Signature Algorithm Jennifer Seberry, Vinhbuu To and Dongvu Tonien Abstract. In this paper, we study
3. Applications of Number Theory
3. APPLICATIONS OF NUMBER THEORY 163 3. Applications of Number Theory 3.1. Representation of Integers. Theorem 3.1.1. Given an integer b > 1, every positive integer n can be expresses uniquely as n = a
Is n a Prime Number? Manindra Agrawal. March 27, 2006, Delft. IIT Kanpur
Is n a Prime Number? Manindra Agrawal IIT Kanpur March 27, 2006, Delft Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 1 / 47 Overview 1 The Problem 2 Two Simple, and Slow, Methods
Determining the Optimal Combination of Trial Division and Fermat s Factorization Method
Determining the Optimal Combination of Trial Division and Fermat s Factorization Method Joseph C. Woodson Home School P. O. Box 55005 Tulsa, OK 74155 Abstract The process of finding the prime factorization
3. Computational Complexity.
3. Computational Complexity. (A) Introduction. As we will see, most cryptographic systems derive their supposed security from the presumed inability of any adversary to crack certain (number theoretic)
Integer factorization and discrete logarithm problems
Integer factorization and discrete logarithm problems Pierrick Gaudry October 2014 Abstract These are notes for a lecture given at CIRM in 2014, for the Journées Nationales du Calcul Formel. We explain
Lecture 13 - Basic Number Theory.
Lecture 13 - Basic Number Theory. Boaz Barak March 22, 2010 Divisibility and primes Unless mentioned otherwise throughout this lecture all numbers are non-negative integers. We say that A divides B, denoted
Mathematics of Cryptography Part I
CHAPTER 2 Mathematics of Cryptography Part I (Solution to Odd-Numbered Problems) Review Questions 1. The set of integers is Z. It contains all integral numbers from negative infinity to positive infinity.
Chapter 4, Arithmetic in F [x] Polynomial arithmetic and the division algorithm.
Chapter 4, Arithmetic in F [x] Polynomial arithmetic and the division algorithm. We begin by defining the ring of polynomials with coefficients in a ring R. After some preliminary results, we specialize
Factoring N = p r q for Large r
Factoring N = p r q for Large r Dan Boneh 1,GlennDurfee 1, and Nick Howgrave-Graham 2 1 Computer Science Department, Stanford University, Stanford, CA 94305-9045 {dabo,gdurf}@cs.stanford.edu 2 Mathematical
Homework 5 Solutions
Homework 5 Solutions 4.2: 2: a. 321 = 256 + 64 + 1 = (01000001) 2 b. 1023 = 512 + 256 + 128 + 64 + 32 + 16 + 8 + 4 + 2 + 1 = (1111111111) 2. Note that this is 1 less than the next power of 2, 1024, which
CONTINUED FRACTIONS AND FACTORING. Niels Lauritzen
CONTINUED FRACTIONS AND FACTORING Niels Lauritzen ii NIELS LAURITZEN DEPARTMENT OF MATHEMATICAL SCIENCES UNIVERSITY OF AARHUS, DENMARK EMAIL: niels@imf.au.dk URL: http://home.imf.au.dk/niels/ Contents
EMBEDDING DEGREE OF HYPERELLIPTIC CURVES WITH COMPLEX MULTIPLICATION
EMBEDDING DEGREE OF HYPERELLIPTIC CURVES WITH COMPLEX MULTIPLICATION CHRISTIAN ROBENHAGEN RAVNSHØJ Abstract. Consider the Jacobian of a genus two curve defined over a finite field and with complex multiplication.
Factoring integers and Producing primes
Factoring integers,..., RSA Erbil, Kurdistan 0 Lecture in Number Theory College of Sciences Department of Mathematics University of Salahaddin Debember 4, 2014 Factoring integers and Producing primes Francesco
The Chebotarev Density Theorem
The Chebotarev Density Theorem Hendrik Lenstra 1. Introduction Consider the polynomial f(x) = X 4 X 2 1 Z[X]. Suppose that we want to show that this polynomial is irreducible. We reduce f modulo a prime
9. POLYNOMIALS. Example 1: The expression a(x) = x 3 4x 2 + 7x 11 is a polynomial in x. The coefficients of a(x) are the numbers 1, 4, 7, 11.
9. POLYNOMIALS 9.1. Definition of a Polynomial A polynomial is an expression of the form: a(x) = a n x n + a n-1 x n-1 +... + a 1 x + a 0. The symbol x is called an indeterminate and simply plays the role
PUTNAM TRAINING POLYNOMIALS. Exercises 1. Find a polynomial with integral coefficients whose zeros include 2 + 5.
PUTNAM TRAINING POLYNOMIALS (Last updated: November 17, 2015) Remark. This is a list of exercises on polynomials. Miguel A. Lerma Exercises 1. Find a polynomial with integral coefficients whose zeros include
ALGEBRAIC APPROACH TO COMPOSITE INTEGER FACTORIZATION
ALGEBRAIC APPROACH TO COMPOSITE INTEGER FACTORIZATION Aldrin W. Wanambisi 1* School of Pure and Applied Science, Mount Kenya University, P.O box 553-50100, Kakamega, Kenya. Shem Aywa 2 Department of Mathematics,
Elementary factoring algorithms
Math 5330 Spring 013 Elementary factoring algorithms The RSA cryptosystem is founded on the idea that, in general, factoring is hard. Where as with Fermat s Little Theorem and some related ideas, one can
Cryptography and Network Security
Cryptography and Network Security Fifth Edition by William Stallings Chapter 9 Public Key Cryptography and RSA Private-Key Cryptography traditional private/secret/single key cryptography uses one key shared
Lecture 13: Factoring Integers
CS 880: Quantum Information Processing 0/4/0 Lecture 3: Factoring Integers Instructor: Dieter van Melkebeek Scribe: Mark Wellons In this lecture, we review order finding and use this to develop a method
TYPES Workshop, 12-13 june 2006 p. 1/22. The Elliptic Curve Factorization method
Ä ÙÖ ÒØ ÓÙ Ð ÙÖ ÒØ ÓÑ Ø ºÒ Ø TYPES Workshop, 12-13 june 2006 p. 1/22 ÄÇÊÁ ÍÒ Ú Ö Ø À ÒÖ ÈÓ Ò Ö Æ ÒÝÁ. The Elliptic Curve Factorization method Outline 1. Introduction 2. Factorization method principle 3.
Lecture 10: Distinct Degree Factoring
CS681 Computational Number Theory Lecture 10: Distinct Degree Factoring Instructor: Piyush P Kurur Scribe: Ramprasad Saptharishi Overview Last class we left of with a glimpse into distant degree factorization.
Public Key Cryptography: RSA and Lots of Number Theory
Public Key Cryptography: RSA and Lots of Number Theory Public vs. Private-Key Cryptography We have just discussed traditional symmetric cryptography: Uses a single key shared between sender and receiver
RSA and Primality Testing
and Primality Testing Joan Boyar, IMADA, University of Southern Denmark Studieretningsprojekter 2010 1 / 81 Correctness of cryptography cryptography Introduction to number theory Correctness of with 2
Die ganzen zahlen hat Gott gemacht
Die ganzen zahlen hat Gott gemacht Polynomials with integer values B.Sury A quote attributed to the famous mathematician L.Kronecker is Die Ganzen Zahlen hat Gott gemacht, alles andere ist Menschenwerk.
Integer Factorization
Integer Factorization Lecture given at the Joh. Gutenberg-Universität, Mainz, July 23, 1992 by ÖYSTEIN J. RÖDSETH University of Bergen, Department of Mathematics, Allégt. 55, N-5007 Bergen, Norway 1 Introduction
Recent Breakthrough in Primality Testing
Nonlinear Analysis: Modelling and Control, 2004, Vol. 9, No. 2, 171 184 Recent Breakthrough in Primality Testing R. Šleževičienė, J. Steuding, S. Turskienė Department of Computer Science, Faculty of Physics
http://wrap.warwick.ac.uk/
Original citation: Hart, William B.. (2012) A one line factoring algorithm. Journal of the Australian Mathematical Society, Volume 92 (Number 1). pp. 61-69. ISSN 1446-7887 Permanent WRAP url: http://wrap.warwick.ac.uk/54707/
8 Primes and Modular Arithmetic
8 Primes and Modular Arithmetic 8.1 Primes and Factors Over two millennia ago already, people all over the world were considering the properties of numbers. One of the simplest concepts is prime numbers.
On Factoring Integers and Evaluating Discrete Logarithms
On Factoring Integers and Evaluating Discrete Logarithms A thesis presented by JOHN AARON GREGG to the departments of Mathematics and Computer Science in partial fulfillment of the honors requirements
The Division Algorithm for Polynomials Handout Monday March 5, 2012
The Division Algorithm for Polynomials Handout Monday March 5, 0 Let F be a field (such as R, Q, C, or F p for some prime p. This will allow us to divide by any nonzero scalar. (For some of the following,
calculating the result modulo 3, as follows: p(0) = 0 3 + 0 + 1 = 1 0,
Homework #02, due 1/27/10 = 9.4.1, 9.4.2, 9.4.5, 9.4.6, 9.4.7. Additional problems recommended for study: (9.4.3), 9.4.4, 9.4.9, 9.4.11, 9.4.13, (9.4.14), 9.4.17 9.4.1 Determine whether the following polynomials
Principles of Public Key Cryptography. Applications of Public Key Cryptography. Security in Public Key Algorithms
Principles of Public Key Cryptography Chapter : Security Techniques Background Secret Key Cryptography Public Key Cryptography Hash Functions Authentication Chapter : Security on Network and Transport
Integer Factorization: Solution via Algorithm for Constrained Discrete Logarithm Problem
Journal of Computer Science 5 (9): 674-679, 009 ISSN 1549-3636 009 Science Publications Integer Factorization: Solution via Algorithm for Constrained Discrete Logarithm Problem Boris S. Verkhovsky Department
THE MATHEMATICS OF PUBLIC KEY CRYPTOGRAPHY.
THE MATHEMATICS OF PUBLIC KEY CRYPTOGRAPHY. IAN KIMING 1. Forbemærkning. Det kan forekomme idiotisk, at jeg som dansktalende og skrivende i et danskbaseret tidsskrift med en (formentlig) primært dansktalende
Integer roots of quadratic and cubic polynomials with integer coefficients
Integer roots of quadratic and cubic polynomials with integer coefficients Konstantine Zelator Mathematics, Computer Science and Statistics 212 Ben Franklin Hall Bloomsburg University 400 East Second Street
Modern Factoring Algorithms
Modern Factoring Algorithms Kostas Bimpikis and Ragesh Jaiswal University of California, San Diego... both Gauss and lesser mathematicians may be justified in rejoicing that there is one science [number
Discrete Mathematics, Chapter 4: Number Theory and Cryptography
Discrete Mathematics, Chapter 4: Number Theory and Cryptography Richard Mayr University of Edinburgh, UK Richard Mayr (University of Edinburgh, UK) Discrete Mathematics. Chapter 4 1 / 35 Outline 1 Divisibility
SOLVING POLYNOMIAL EQUATIONS
C SOLVING POLYNOMIAL EQUATIONS We will assume in this appendix that you know how to divide polynomials using long division and synthetic division. If you need to review those techniques, refer to an algebra
Computing exponents modulo a number: Repeated squaring
Computing exponents modulo a number: Repeated squaring How do you compute (1415) 13 mod 2537 = 2182 using just a calculator? Or how do you check that 2 340 mod 341 = 1? You can do this using the method
Factoring Polynomials
Factoring Polynomials Sue Geller June 19, 2006 Factoring polynomials over the rational numbers, real numbers, and complex numbers has long been a standard topic of high school algebra. With the advent
Introduction to Finite Fields (cont.)
Chapter 6 Introduction to Finite Fields (cont.) 6.1 Recall Theorem. Z m is a field m is a prime number. Theorem (Subfield Isomorphic to Z p ). Every finite field has the order of a power of a prime number
On the coefficients of the polynomial in the number field sieve
On the coefficients of the polynomial in the number field sieve Yang Min a, Meng Qingshu b,, Wang Zhangyi b, Li Li a, Zhang Huanguo b a International School of Software, Wuhan University, Hubei, China,
Elementary Number Theory We begin with a bit of elementary number theory, which is concerned
CONSTRUCTION OF THE FINITE FIELDS Z p S. R. DOTY Elementary Number Theory We begin with a bit of elementary number theory, which is concerned solely with questions about the set of integers Z = {0, ±1,
Computer and Network Security
MIT 6.857 Computer and Networ Security Class Notes 1 File: http://theory.lcs.mit.edu/ rivest/notes/notes.pdf Revision: December 2, 2002 Computer and Networ Security MIT 6.857 Class Notes by Ronald L. Rivest
MA257: INTRODUCTION TO NUMBER THEORY LECTURE NOTES
MA257: INTRODUCTION TO NUMBER THEORY LECTURE NOTES 2016 47 4. Diophantine Equations A Diophantine Equation is simply an equation in one or more variables for which integer (or sometimes rational) solutions
Copy in your notebook: Add an example of each term with the symbols used in algebra 2 if there are any.
Algebra 2 - Chapter Prerequisites Vocabulary Copy in your notebook: Add an example of each term with the symbols used in algebra 2 if there are any. P1 p. 1 1. counting(natural) numbers - {1,2,3,4,...}
NEW DIGITAL SIGNATURE PROTOCOL BASED ON ELLIPTIC CURVES
NEW DIGITAL SIGNATURE PROTOCOL BASED ON ELLIPTIC CURVES Ounasser Abid 1, Jaouad Ettanfouhi 2 and Omar Khadir 3 1,2,3 Laboratory of Mathematics, Cryptography and Mechanics, Department of Mathematics, Fstm,
USING LUCAS SEQUENCES TO FACTOR LARGE INTEGERS NEAR GROUP ORDERS
USING LUCAS SEQUENCES TO FACTOR LARGE INTEGERS NEAR GROUP ORDERS Zhenxiang Zhang* Dept. of Math., Anhui Normal University, 241000 Wuhu, Anhui, P.R. China e-mail: zhangzhx@mail.ahwhptt.net.cn (Submitted
Factoring a semiprime n by estimating φ(n)
Factoring a semiprime n by estimating φ(n) Kyle Kloster May 7, 2010 Abstract A factoring algorithm, called the Phi-Finder algorithm, is presented that factors a product of two primes, n = pq, by determining
Zeros of a Polynomial Function
Zeros of a Polynomial Function An important consequence of the Factor Theorem is that finding the zeros of a polynomial is really the same thing as factoring it into linear factors. In this section we
The Prime Numbers. Definition. A prime number is a positive integer with exactly two positive divisors.
The Prime Numbers Before starting our study of primes, we record the following important lemma. Recall that integers a, b are said to be relatively prime if gcd(a, b) = 1. Lemma (Euclid s Lemma). If gcd(a,
Modern Algebra Lecture Notes: Rings and fields set 4 (Revision 2)
Modern Algebra Lecture Notes: Rings and fields set 4 (Revision 2) Kevin Broughan University of Waikato, Hamilton, New Zealand May 13, 2010 Remainder and Factor Theorem 15 Definition of factor If f (x)