# Integer Factorization using the Quadratic Sieve

Save this PDF as:

Size: px
Start display at page:

## Transcription

1 Integer Factorization using the Quadratic Sieve Chad Seibert* Division of Science and Mathematics University of Minnesota, Morris Morris, MN March 16, 2011 Abstract We give a light introduction to integer factorization using the quadratic sieve. Although it is not the fastest known factorization algorithm, it provides a stepping stone for understanding the general number field sieve, the asymptotically fastest known algorithm. We explain the algorithm in detail and work out its complexity and give some empirical results.

2 1 Introduction When we want to factor a large number N, we have several options. One of the most important is the idea of primality testing. There are algorithms that provably determine whether a number is prime, e.g. the AKS primality test. If the number is composite, we have to try something else. Trial division is a factoring method where we take each prime less than N and see if it is a factor. This algorithm is extremely slow for large numbers N, such as a RSA modulus. This is already an enormous calculation if N is thirty digits long and it would take much longer than the life of the universe for number much larger than it. 2 Difference of Squares A factorization method that has been around since the era of Pierre de Fermat is Fermat s factorization algorithm. Let N be a positive, odd integer. Every odd number can be represented as the difference of two squares: N = a 2 b 2 for a and b greater than zero. Put another way, we have N = (a b)(a+b). We can now recast this as the problem of finding a and b. Rearranging, we obtain a 2 N = b 2. For each a > N, we compute a 2 N and check to see if the result is a perfect square. If it is, we have found a and b and the factors are simply a b and a + b. Notice that if a = b, then a b is zero and we haven t actually found a solution. Furthermore, if a ±b mod N, we still don t have a solution. Therefore, we forbade these solutions. Thus, we have the following theorem: Theorem 2.1. If there exist a and b such that a 2 N = b 2 and a ±b mod N, then gcd(a ± b, N) are its factors. Let us give an example of such a factorization. Let N = 6969 and a = 6969 = 84. We compute = 87, which is not a perfect square. We increment a and try again. We obtain = 256, which is a perfect square. Therefore, a = 85 and b = 16. Since 85 ±16, we can use the result of Theorem 2.1. We obtain factors 69 and 101 by computing gcd(85 ± 16, 6969). Now, we ask a simple question: how well does this perform? We can see that if the factors aren t near the square root of N, we will have to iterate through many a to find such a b. But even if we found such a and b, how likely is it that a ±b mod N? The following lemma, taken from [6] provides us with that answer. Lemma 2.2. If N has at least two different odd prime factors, then more than half of the solutions to a 2 b 2 mod N with gcd(ab, N) = 1 satisfy (2.1). Proof. For an odd prime power p u, the congruence y 2 1 mod p u has exactly two solutions. Since N is divisible by at least two different odd primes, the congruence y 2 1 mod N has at least four solutions. Label these y as y 1, y 2,..., y s where y 1 = 1, y 2 = 1. Then a complete enumeration of all the pairs of residues a, b modulo N that are coprime to N and i take the values of 1,..., s. Two of these pairs have i = 1, 2 and s 2 (out of s) of these pairs have i = 3,..., s. The latter pairs satisfy (2.1) and since s 4, we are done. 1

3 This shows that if we do find such a and b, then it is likely that they do lead to a proper factorization of N. Therefore, the main question is how do we find such a and b. To motivate our answer, let us consider another example of Fermat s factorization algorithm. This time, let N = 301 and a = 18. We perform the following computations: a a 2 N We see that there are no perfect squares in the second column. How long will it take to find one? It could take quite a while, especially if the number is a semi-prime, the product of two prime numbers. It turns out that we have enough information to find a factorization. Although we have don t have a perfect square in the second column, we do have a product that is: = The significance of this is that instead of a 2 = b 2 mod N, we have (ac) 2 = (bd) 2 mod N for some a 2 N = b and c 2 N = d. We can factor the number, giving 19 2 = 60 mod = 540 mod = mod 301. Thus a = and b = 180. Finding the factors gives and gcd( , 301) = 7 gcd( , 301) = 43. We now have a new strategy for factoring numbers. We have a sequence of integers a 2 N for a N. We would like to pick out a subsequence that when multiplied together yields a square. However, we don t want to try all subsequences, there is an exponential amount of them. How long does the sequence have to be in order to guarantee that there is such a subsequence? How do we find it? The answers to these questions require the notion of smooth numbers. We say a number m is B-smooth if all prime factors of m are less than or equal to B. We first note that if such a number in our sequence is not smooth, then it is unlikely to be a part of our subsequence. Let p be a large prime dividing some element m in the sequence. Then 2

4 there must be another element m in the sequence that has p as a divisor. Since p is large, multiples of p will be harder and harder to find. Hence, it is profitable to not include them in our search, and if possible, ignore them entirely. Now, we present the following lemma [6]. Lemma 2.3. If m 1, m 2,..., m k are positive B-smooth integers, and if k > π(b) (where π(b) denotes the number of primes in the interval [1, B]), then some non-empty subsequence of (m i ) has product which is a perfect square. Proof. For a B-smooth number m, we define its exponent vector v(m). If m has the prime factorization m = Π π(b) i=1 pv i i where p i is the ith prime number and each exponent v i is a nonnegative integer, then v(m) = (v 1, v 2,... v π(b) ). Then a subsequence m i1,... m it has product a square if and only if v(m i1 ) v(m it ) has all even entries. That is, if and only if this sum of vectors is the zero vector mod 2. Now, the vector space F π(b) 2, where F 2 is the finite field with 2 elements, has dimension π(b). And we have k > π(b) vectors. So this sequence of vectors is linearly dependent in this vector space. However, a linear dependency when the field of scalars is F 2 is exactly the same as a subsequence sum being the zero vector. Later on, we will find the notion of exponent vectors a useful one. Exponent vectors are a concise way of storing the factorization of a B-smooth number. They are also quite sparse in nature and we can store them in a concise manner, saving on memory requirements. 3 A First Attempt We now know enough information to devise a simple algorithm to factor numbers. We are given a number N which satisfies the following requirements: 1. The number is composite. 2. The number has no prime factors up to its logarithm base ten. It is more efficient to divide these out via the use of some other algorithm(trial division, elliptic curve method, Pollard s rho, etc) before we start. 3. The number is not a power. In order to use the lemma, we need two different odd primes to divide N. This is not the case if N is a power [6]. Then a reasonable first attempt, given what we know now, might be the following: 1. Compute parameter B and find the primes in [2, B] 2. Compute x 2 N and see if it is B-smooth for x N. Do this until we have π(b) smooth numbers 3. Using linear algebra, form a matrix M with columns comprised of the exponent vectors of each smooth number. Find a linear dependency by computing the nullspace. 3

5 4. Construct a, b in a manner corresponding to Theorem 2.1. If a = ±b mod N, then start over with step 1. There are many gaps in this algorithm. In particular, how do we determine whether a number is B-smooth (which we discuss in Section 4) and how do we choose the parameter B (which we will discuss in Section 5)? 4 Smooth Numbers 4.1 Determining Smooth Numbers In order to determine whether a given number N is B-smooth, we need to determine all prime numbers in the range (2, B). We could naively use trial division on each number and determine the primes this way. However, we can do much better than this. We will use a classic algorithm - the sieve of Eratosthenes. This algorithm requires N 1 numbers to be stored in memory. To store all the primes less than requires bits of memory. The largest computing array has less than 2 60 bits of memory. Therefore, there is no chance of even storing all these primes. The algorithm, however, is very useful for determining all the prime numbers less than say one billion. See algorithm (1). To determine whether a given number is B-smooth, we can divide N by each prime p in (2, B). We can use the sieve of Eratosthenes to determine all the primes in the range (2, B). The prime p may have multiplicity greater than one, so we need to repetitively divide N by p. More specifically, we have 4.2 Distribution of B-Smooth Numbers We now possess the methods for finding B-smooth numbers, but a natural question is wondering how often do the occur? This is a difficult question, and only heuristic analysis have given satisfactory answers. If B is too small, we will have a hard time finding any smooth numbers. If B is too large, then we will have too many smooth numbers and finding Algorithm 1 The Sieve of Eratosthenes 1: for i [2, B] do 2: a[i] is unmarked 3: end for 4: for i [2, B] do 5: if i is unmarked then 6: for each multiple j of i [i + 1, B] do 7: Mark a[j] 8: end for 9: end if 10: end for 11: return All unmarked a[i] 4

6 Algorithm 2 IsSmooth: Determines if a number N is B-smooth. The set P B is the set primes less than B. 1: for i P B do 2: while N mod i = 0 do 3: N N mod i 4: end while 5: end for 6: if N = 1 then 7: return Is Smooth 8: else 9: return Not Smooth 10: end if Algorithm 3 FactorOut(N, p): Removes all p from N. 1: while N mod p = 0 do 2: N N mod p 3: end while 4: return N a linear dependency will prove difficult. Heuristic analysis found in [3] show that the upper bound of L(n) = e 1 2 ln(n)ln(ln(n)) gives an optimal bound for B. We will use B = L(n) 1/2, also derived in [3], as our B value. 5 Smooth Number Generation Given a smoothness bound B, we wish to quickly find a set of B-smooth numbers. We first need to find all the primes numbers from 2 to B; this is easily done using the sieve of Eratosthenes. Then, we need determine which primes could possibly divide any numbers in our sieving region. Then we use a modified sieve of Eratosthenes to determine which numbers are smooth. 5.1 Quadratic Residues First, we need to find a range of numbers to search for smooth numbers in. Computing x 2 mod N is equivalent to finding x 2 N in the range N < x 2 < 2n or equivalently x [ N, 2n][1]. The concept of quadratic residues is important for us to determine which primes in our factor base we should consider. A integer p is a quadratic residue modulo N if there exists an x such that x 2 q mod N. We consider three cases. 1. First, no such x exists. Then p cannot divide any values of x 2 N for x [ N, 2n]. Suppose p x 2 N. Then x 2 N = 0 mod p and x 2 = N mod p. Then N is 5

7 a quadratic residue modulo p. The contrapositive states that if N is not a quadratic residue mod p, then p x 2 mod N. 2. Second, x exists and is zero. Then 0 2 = N mod p, implying that p N. We are done, since the factors are p and N/p. 3. Third, 0 < s < p. Suppose p x 2 N. Then x 2 = N mod p or equivalently x 2 = s 2 mod p. Now x 2 s 2 = 0 mod p or (x + s)(x s) = 0 mod p. Since F p is a field, either x s = 0 mod p or x + s = 0 mod p. This implies x = ±s mod p. The only two solutions will be s 2 = ( s) 2 = N mod p. We define the Legendre symbol as ( ) a 1 if a is a quadratic residue modulo p and a 0 (mod p) = 1 if a is a quadratic non-residue modulo p p 0 if a 0 (mod p). To compute the Legendre symbol we give the following equivalent definition, ( ) a 1 if a (p 1)/2 1 (mod p) = 1 if a p (p 1)/2 1 (mod p) 0 if a 0 (mod p). This give us a way of determining whether a prime in our factor base could possible divide a number x [ N, 2n]. We simply check to see if a (p 1)/2 = 1 and add these p to the factor base. 5.2 Generating Smooth Numbers Rapidly Now, given a range [a, b] [ N, 2n], we wish to determine which x [a, b] are candidates for being smooth numbers. For a given p in our factor base, we note that the first multiple of p in the range [a, b] is a/p p. Given a s such that s 2 = N mod p, the set of possible smooth numbers containing p as a factor is [1] x { a/p p s, a/p p + s, a/p p + p s, a/p p + p + s, a/p p + 2p s,(1) a/p p + 2p + s,...}. (2) This provides immense savings in computational power over the naive approach. Now, we can use a modified version of the sieve of Eratosthenes. Since we only care if an integer contains the prime divisors in our factor base, rather than divide each number by each prime in [2, N], we will divide each number by only those in our factor base. Furthermore, for each prime in the factor base, we will only divide those numbers in the above equation by p. Like the sieve of Eratosthenes, we need to repetitively divide the number in question by p. Once we have performed this step for each prime in the factor base, we need only to look for those numbers in [a, b] which as a result of repeated division are now one. These represent numbers smooth with respect to the factor base. That is to say, their prime factorizations contain only primes in the factor base. We call these numbers relations. 6

8 6 An Algorithm for Sieving We now have all the information necessary to devise an algorithm for sieving smooth numbers. First, we determine a smoothness bound using equation INSERT HERE. Second, use the sieve of Eratosthenes to determine all the prime numbers less than our bound and add them to a list. Third, we calculate the Legendre symbol for each prime in the list and add it to the factor base if the calculation results in one. Fourth, we create large intervals in the range ( N, 2n). Each interval can be given to a separate processor to sieve over. We perform the next three steps for each interval. Fifth, we calculate x 2 N for each x [a, b]. Sixth, for each prime in the factor base, we find s such that s 2 = N mod p. For each x in (1), we repeatedly divide x by the prime p until x p. Seventh, for each x [a, b], if x = 1, then add x to the list of relations. Union all lists from all computers into a single list. In pseudo-code, we have the following 7 Computing the Null Space and Finding the Factors 7.1 Review of Null Spaces Suppose we have a set of vectors v V with n = V and we ask the question if whether there exist constants a i, 0 i n, such that n a i v i = 0. i=1 This is a classic problem in linear algebra, known as finding the null space of a matrix. First, we form a matrix such that each column is a vector in V. Then, we perform Gaussian elimination on this matrix. We determine which columns are zero vectors; such columns must be linear combinations of other columns. More about Gaussian elimination and nullspaces can be found in [2]. 7.2 Finding the Null Space At this point, we have a set of smooth numbers in the range [ N, 2N]. Now we need to determine a subset of these that, when multiplied together, yield a perfect square. To do this, we transform the multiplication problem into an addition problem modulo two. We first find the exponent vectors of each relation. Then the problem of finding a subset of relations that multiply to a perfect square becomes the problem of finding a subset of relations that add to the zero vector. This is the classic problem of finding the null space of a matrix. We form a matrix with each exponent vector as a column. The rows represent which numbers have a given prime factor. Hence the matrix will be size F R, where F is the size of the factor base and R is the number of relations. There are many basic algorithms for finding the null space; for small matrices, Gaussian elimination works well. For larger matrices (greater than ), though, we need to use a more efficient algorithm, block Lanczos. This algorithm was designed specifically to find the null space of large matrices. There are even variants for finding the null space modulo two and it has 7

9 Algorithm 4 The Sieving Phase 1: B L(n) 1/2 2: p B SieveOfEratosthenes(B) 3: for p p B do 4: z N (p 1)/2 mod p 5: if z = 1 then 6: F F {p} 7: end if 8: end for 9: Let I contain several large intervals [a, b], one for each processor 10: for [a, b] I do 11: for x [a, b] do 12: R[x a] x 2 N 13: end for 14: for p F do 15: Find s satisfying s 2 = N mod p. 16: x a/p p 17: while x s b do 18: if a < x s < b then 19: R[x a] F actorout(x s, p) 20: end if 21: if a < x + s < b then 22: R[x + a] F actorout(x + s, p) 23: end if 24: x x + p 25: end while 26: end for 27: for x [a, b] do 28: if R[x] = 1 then 29: L L {x} 30: end if 31: end for 32: end for 33: Union all lists L from all processors 8

10 become the algorithm of choice for this task. The details of its implementation are outside the scope of this paper, however, we direct the interested reader to [4]. 7.3 Obtaining Factors After computing the null space, we have a set S such that r s1 + r s r sn = 0 mod 2 for s i S. We now know that multiplying these integers will yield a perfect square. Now, let r s1 + r s r sn = s when computed in the integers. We know that s is a perfect square, since there are no odd exponents in the prime factorization of s. Equivalently, if we have r s1 = x 2 i mod N, then We let r 2 = s mod N. If x 2 s 1 x 2 s 2... x 2 s N = (x s1 x s2... x sn ) 2 = s mod N. then the factors are and In pseudo-code, we have r ±x s1 x s2... x sn gcd(x s1 x s2... x sn r, N) gcd(x s1 x s2... x sn + r, N). 8 Computational Results We present two major computational results regarding the complexity of the quadratic sieve. We first demonstrate an implementation of the quadratic sieve created by the authors. Then we show that after the number is 100 digits or longer, the general number field sieve is faster for arbitrary numbers. The general number field sieve is the asymptotically fastest known algorithm for factoring number longer than 100 digits in length. Our first result is demonstrating our implementation of the quadratic sieve. It is a straight forward implementation of algorithms 4 and 5. It is only suitable for numbers in the range of 20 to 40 digits. This is mostly due to the fact that B-smooth numbers become increasingly rare the larger N becomes. There are ways around this, but these methods are outside the scope of this paper. The following graph demonstrates the speed of our program as a function of the number digits. 9

11 Algorithm 5 Recovers the factors from a set of relations 1: Form matrix M from the exponent vectors of R 2: Reduce matrix M modulo 2 3: Find null space of matrix M 4: for v N do 5: g 0 6: r 1 7: for i 1, 2,... L do 8: if v i = 1 then 9: Get (x i, g i ) from L 10: g g + x si 11: t tx i 12: end if 13: end for 14: h = 1g 2 15: Let r be the integer formed from exponent vector h 16: if r 2 ±t 2 mod N then 17: return p = gcd(r t, N), q = gcd(r + t, N) 18: end if 19: end for As can be seen, our program works well for number in this range. Extrapolating the exponential curve shows that it is, however, not capable of numbers greater that 45 digits in length. Our second result shows that the general number field sieve is faster for numbers greater that 100 digits. Since this is outside the range of our program, we use a program written by Jason Papadopoulos called msieve [5]. The program is capable of factoring numbers using either the quadratic sieve or the general number field sieve. We created a group of semi-primes in the range of 80 to 110 digits in multiples of 5. Each group had 10 numbers in it. We used a local computer lab to factor each number using both the quadratic sieve and the general number field sieve. The results are presented in the following plot. 10

12 As we can see, at around 95 digits in length, either algorithm would suffice, but numbers greater than 100 digits, the general number field sieve generally performs faster. This confirms the empirical results found by many other groups. 9 Conclusion The quadratic sieve is one of several algorithms used to factor large integers. For numbers in the range of 40 to 100 digits, it is the fastest known algorithm. For numbers larger than 100 digits, the general number field sieve tends to perform faster. We have given a thorough introduction to the quadratic sieve. There are many, many optimizations to make it faster. For example, instead of just sieving over the polynomial x 2 N, we can sieve over (ax + b) 2 N. This speeds up the factorization considerable by not relying on the polynomial x 2 N to generate all the relations. With this optimization, we can distribute the factorization over a large network of computers by giving each one a polynomial. We demonstrated a simple factorization program and showed that it can be used to factor numbers in the range of 30 to 50 digits in length. It was not optimized enough to larger numbers, although. We tested a widely known factorization program known as msieve. It can factor numbers using the quadratic sieve or the general number field sieve. We showed that for this particular program, the general number field sieve starts to factor number faster than the quadratic sieve at around 100 digits. This is consistent with empirical results found by other authors. References [1] Gregory V. Bard. The quadratic sieve. In Algebraic Cryptanalysis, pages Springer US, [2] David R. Hill Bernard Kolman. Elementary Linear Algebra with Applications. Pearson Prentice Hall, ninth edition, [3] Stephani Lee Garrett. On the quadratic sieve. Master s thesis, THE UNIVERSITY OF NORTH CAROLINA AT GREENSBORO,

13 [4] Peter L. Montgomery. A block lanczos algorithm for finding dependencies over gf(2). In Proceedings of the 14th annual international conference on Theory and application of cryptographic techniques, EUROCRYPT 95, pages , Berlin, Heidelberg, Springer-Verlag. [5] Jason Papadopoulos. Integer factorization source code, March [6] Carl Pomerance. Smooth numbers and the quadratic sieve. In Buhler and Stevenhagen University Press,

### Factoring Algorithms

Factoring Algorithms The p 1 Method and Quadratic Sieve November 17, 2008 () Factoring Algorithms November 17, 2008 1 / 12 Fermat s factoring method Fermat made the observation that if n has two factors

### Primality Testing and Factorization Methods

Primality Testing and Factorization Methods Eli Howey May 27, 2014 Abstract Since the days of Euclid and Eratosthenes, mathematicians have taken a keen interest in finding the nontrivial factors of integers,

### Smooth numbers and the quadratic sieve

Algorithmic Number Theory MSRI Publications Volume 44, 2008 Smooth numbers and the quadratic sieve CARL POMERANCE ABSTRACT. This article gives a gentle introduction to factoring large integers via the

### The Quadratic Sieve Factoring Algorithm

The Quadratic Sieve Factoring Algorithm Eric Landquist MATH 488: Cryptographic Algorithms December 14, 2001 1 Introduction Mathematicians have been attempting to find better and faster ways to factor composite

### U.C. Berkeley CS276: Cryptography Handout 0.1 Luca Trevisan January, 2009. Notes on Algebra

U.C. Berkeley CS276: Cryptography Handout 0.1 Luca Trevisan January, 2009 Notes on Algebra These notes contain as little theory as possible, and most results are stated without proof. Any introductory

### Notes on Factoring. MA 206 Kurt Bryan

The General Approach Notes on Factoring MA 26 Kurt Bryan Suppose I hand you n, a 2 digit integer and tell you that n is composite, with smallest prime factor around 5 digits. Finding a nontrivial factor

### Factoring Algorithms

Institutionen för Informationsteknologi Lunds Tekniska Högskola Department of Information Technology Lund University Cryptology - Project 1 Factoring Algorithms The purpose of this project is to understand

### Primality - Factorization

Primality - Factorization Christophe Ritzenthaler November 9, 2009 1 Prime and factorization Definition 1.1. An integer p > 1 is called a prime number (nombre premier) if it has only 1 and p as divisors.

### Factoring & Primality

Factoring & Primality Lecturer: Dimitris Papadopoulos In this lecture we will discuss the problem of integer factorization and primality testing, two problems that have been the focus of a great amount

### Factoring. Factoring 1

Factoring Factoring 1 Factoring Security of RSA algorithm depends on (presumed) difficulty of factoring o Given N = pq, find p or q and RSA is broken o Rabin cipher also based on factoring Factoring like

### An Overview of Integer Factoring Algorithms. The Problem

An Overview of Integer Factoring Algorithms Manindra Agrawal IITK / NUS The Problem Given an integer n, find all its prime divisors as efficiently as possible. 1 A Difficult Problem No efficient algorithm

### Factorization Methods: Very Quick Overview

Factorization Methods: Very Quick Overview Yuval Filmus October 17, 2012 1 Introduction In this lecture we introduce modern factorization methods. We will assume several facts from analytic number theory.

### Arithmetic algorithms for cryptology 5 October 2015, Paris. Sieves. Razvan Barbulescu CNRS and IMJ-PRG. R. Barbulescu Sieves 0 / 28

Arithmetic algorithms for cryptology 5 October 2015, Paris Sieves Razvan Barbulescu CNRS and IMJ-PRG R. Barbulescu Sieves 0 / 28 Starting point Notations q prime g a generator of (F q ) X a (secret) integer

### The Sieve Re-Imagined: Integer Factorization Methods

The Sieve Re-Imagined: Integer Factorization Methods by Jennifer Smith A research paper presented to the University of Waterloo in partial fulfillment of the requirement for the degree of Master of Mathematics

### Runtime and Implementation of Factoring Algorithms: A Comparison

Runtime and Implementation of Factoring Algorithms: A Comparison Justin Moore CSC290 Cryptology December 20, 2003 Abstract Factoring composite numbers is not an easy task. It is classified as a hard algorithm,

### (x + a) n = x n + a Z n [x]. Proof. If n is prime then the map

22. A quick primality test Prime numbers are one of the most basic objects in mathematics and one of the most basic questions is to decide which numbers are prime (a clearly related problem is to find

### Determining the Optimal Combination of Trial Division and Fermat s Factorization Method

Determining the Optimal Combination of Trial Division and Fermat s Factorization Method Joseph C. Woodson Home School P. O. Box 55005 Tulsa, OK 74155 Abstract The process of finding the prime factorization

### Homework 5 Solutions

Homework 5 Solutions 4.2: 2: a. 321 = 256 + 64 + 1 = (01000001) 2 b. 1023 = 512 + 256 + 128 + 64 + 32 + 16 + 8 + 4 + 2 + 1 = (1111111111) 2. Note that this is 1 less than the next power of 2, 1024, which

### FACTORING. n = 2 25 + 1. fall in the arithmetic sequence

FACTORING The claim that factorization is harder than primality testing (or primality certification) is not currently substantiated rigorously. As some sort of backward evidence that factoring is hard,

### Discrete Mathematics, Chapter 4: Number Theory and Cryptography

Discrete Mathematics, Chapter 4: Number Theory and Cryptography Richard Mayr University of Edinburgh, UK Richard Mayr (University of Edinburgh, UK) Discrete Mathematics. Chapter 4 1 / 35 Outline 1 Divisibility

### Breaking The Code. Ryan Lowe. Ryan Lowe is currently a Ball State senior with a double major in Computer Science and Mathematics and

Breaking The Code Ryan Lowe Ryan Lowe is currently a Ball State senior with a double major in Computer Science and Mathematics and a minor in Applied Physics. As a sophomore, he took an independent study

### 3. Applications of Number Theory

3. APPLICATIONS OF NUMBER THEORY 163 3. Applications of Number Theory 3.1. Representation of Integers. Theorem 3.1.1. Given an integer b > 1, every positive integer n can be expresses uniquely as n = a

### MATH 168: FINAL PROJECT Troels Eriksen. 1 Introduction

MATH 168: FINAL PROJECT Troels Eriksen 1 Introduction In the later years cryptosystems using elliptic curves have shown up and are claimed to be just as secure as a system like RSA with much smaller key

### Mathematics of Cryptography Modular Arithmetic, Congruence, and Matrices. A Biswas, IT, BESU SHIBPUR

Mathematics of Cryptography Modular Arithmetic, Congruence, and Matrices A Biswas, IT, BESU SHIBPUR McGraw-Hill The McGraw-Hill Companies, Inc., 2000 Set of Integers The set of integers, denoted by Z,

### Mathematics of Cryptography Part I

CHAPTER 2 Mathematics of Cryptography Part I (Solution to Odd-Numbered Problems) Review Questions 1. The set of integers is Z. It contains all integral numbers from negative infinity to positive infinity.

### Discrete Mathematics Lecture 3 Elementary Number Theory and Methods of Proof. Harper Langston New York University

Discrete Mathematics Lecture 3 Elementary Number Theory and Methods of Proof Harper Langston New York University Proof and Counterexample Discovery and proof Even and odd numbers number n from Z is called

### Mathematics of Cryptography

CHAPTER 2 Mathematics of Cryptography Part I: Modular Arithmetic, Congruence, and Matrices Objectives This chapter is intended to prepare the reader for the next few chapters in cryptography. The chapter

### Continued Fractions and the Euclidean Algorithm

Continued Fractions and the Euclidean Algorithm Lecture notes prepared for MATH 326, Spring 997 Department of Mathematics and Statistics University at Albany William F Hammond Table of Contents Introduction

### Study of algorithms for factoring integers and computing discrete logarithms

Study of algorithms for factoring integers and computing discrete logarithms First Indo-French Workshop on Cryptography and Related Topics (IFW 2007) June 11 13, 2007 Paris, France Dr. Abhijit Das Department

### Elementary factoring algorithms

Math 5330 Spring 013 Elementary factoring algorithms The RSA cryptosystem is founded on the idea that, in general, factoring is hard. Where as with Fermat s Little Theorem and some related ideas, one can

### Applications of Fermat s Little Theorem and Congruences

Applications of Fermat s Little Theorem and Congruences Definition: Let m be a positive integer. Then integers a and b are congruent modulo m, denoted by a b mod m, if m (a b). Example: 3 1 mod 2, 6 4

### MA257: INTRODUCTION TO NUMBER THEORY LECTURE NOTES

MA257: INTRODUCTION TO NUMBER THEORY LECTURE NOTES 2016 47 4. Diophantine Equations A Diophantine Equation is simply an equation in one or more variables for which integer (or sometimes rational) solutions

### Today s Topics. Primes & Greatest Common Divisors

Today s Topics Primes & Greatest Common Divisors Prime representations Important theorems about primality Greatest Common Divisors Least Common Multiples Euclid s algorithm Once and for all, what are prime

### SUM OF TWO SQUARES JAHNAVI BHASKAR

SUM OF TWO SQUARES JAHNAVI BHASKAR Abstract. I will investigate which numbers can be written as the sum of two squares and in how many ways, providing enough basic number theory so even the unacquainted

### ALGEBRAIC APPROACH TO COMPOSITE INTEGER FACTORIZATION

ALGEBRAIC APPROACH TO COMPOSITE INTEGER FACTORIZATION Aldrin W. Wanambisi 1* School of Pure and Applied Science, Mount Kenya University, P.O box 553-50100, Kakamega, Kenya. Shem Aywa 2 Department of Mathematics,

### CHAPTER 5. Number Theory. 1. Integers and Division. Discussion

CHAPTER 5 Number Theory 1. Integers and Division 1.1. Divisibility. Definition 1.1.1. Given two integers a and b we say a divides b if there is an integer c such that b = ac. If a divides b, we write a

### CONTINUED FRACTIONS AND FACTORING. Niels Lauritzen

CONTINUED FRACTIONS AND FACTORING Niels Lauritzen ii NIELS LAURITZEN DEPARTMENT OF MATHEMATICAL SCIENCES UNIVERSITY OF AARHUS, DENMARK EMAIL: niels@imf.au.dk URL: http://home.imf.au.dk/niels/ Contents

### International Journal of Information Technology, Modeling and Computing (IJITMC) Vol.1, No.3,August 2013

FACTORING CRYPTOSYSTEM MODULI WHEN THE CO-FACTORS DIFFERENCE IS BOUNDED Omar Akchiche 1 and Omar Khadir 2 1,2 Laboratory of Mathematics, Cryptography and Mechanics, Fstm, University of Hassan II Mohammedia-Casablanca,

### Lecture 13: Factoring Integers

CS 880: Quantum Information Processing 0/4/0 Lecture 3: Factoring Integers Instructor: Dieter van Melkebeek Scribe: Mark Wellons In this lecture, we review order finding and use this to develop a method

### Factorization Algorithms for Polynomials over Finite Fields

Degree Project Factorization Algorithms for Polynomials over Finite Fields Sajid Hanif, Muhammad Imran 2011-05-03 Subject: Mathematics Level: Master Course code: 4MA11E Abstract Integer factorization is

### a 11 x 1 + a 12 x 2 + + a 1n x n = b 1 a 21 x 1 + a 22 x 2 + + a 2n x n = b 2.

Chapter 1 LINEAR EQUATIONS 1.1 Introduction to linear equations A linear equation in n unknowns x 1, x,, x n is an equation of the form a 1 x 1 + a x + + a n x n = b, where a 1, a,..., a n, b are given

### Elementary Number Theory We begin with a bit of elementary number theory, which is concerned

CONSTRUCTION OF THE FINITE FIELDS Z p S. R. DOTY Elementary Number Theory We begin with a bit of elementary number theory, which is concerned solely with questions about the set of integers Z = {0, ±1,

### Integer roots of quadratic and cubic polynomials with integer coefficients

Integer roots of quadratic and cubic polynomials with integer coefficients Konstantine Zelator Mathematics, Computer Science and Statistics 212 Ben Franklin Hall Bloomsburg University 400 East Second Street

### The Mathematics of the RSA Public-Key Cryptosystem

The Mathematics of the RSA Public-Key Cryptosystem Burt Kaliski RSA Laboratories ABOUT THE AUTHOR: Dr Burt Kaliski is a computer scientist whose involvement with the security industry has been through

### Lecture 13 - Basic Number Theory.

Lecture 13 - Basic Number Theory. Boaz Barak March 22, 2010 Divisibility and primes Unless mentioned otherwise throughout this lecture all numbers are non-negative integers. We say that A divides B, denoted

### Homework until Test #2

MATH31: Number Theory Homework until Test # Philipp BRAUN Section 3.1 page 43, 1. It has been conjectured that there are infinitely many primes of the form n. Exhibit five such primes. Solution. Five such

### Modern Factoring Algorithms

Modern Factoring Algorithms Kostas Bimpikis and Ragesh Jaiswal University of California, San Diego... both Gauss and lesser mathematicians may be justified in rejoicing that there is one science [number

### 2 Primality and Compositeness Tests

Int. J. Contemp. Math. Sciences, Vol. 3, 2008, no. 33, 1635-1642 On Factoring R. A. Mollin Department of Mathematics and Statistics University of Calgary, Calgary, Alberta, Canada, T2N 1N4 http://www.math.ucalgary.ca/

### Is n a Prime Number? Manindra Agrawal. March 27, 2006, Delft. IIT Kanpur

Is n a Prime Number? Manindra Agrawal IIT Kanpur March 27, 2006, Delft Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 1 / 47 Overview 1 The Problem 2 Two Simple, and Slow, Methods

### Faster deterministic integer factorisation

David Harvey (joint work with Edgar Costa, NYU) University of New South Wales 25th October 2011 The obvious mathematical breakthrough would be the development of an easy way to factor large prime numbers

### 8 Primes and Modular Arithmetic

8 Primes and Modular Arithmetic 8.1 Primes and Factors Over two millennia ago already, people all over the world were considering the properties of numbers. One of the simplest concepts is prime numbers.

### Lecture 3: Finding integer solutions to systems of linear equations

Lecture 3: Finding integer solutions to systems of linear equations Algorithmic Number Theory (Fall 2014) Rutgers University Swastik Kopparty Scribe: Abhishek Bhrushundi 1 Overview The goal of this lecture

### COMMUTATIVITY DEGREES OF WREATH PRODUCTS OF FINITE ABELIAN GROUPS

COMMUTATIVITY DEGREES OF WREATH PRODUCTS OF FINITE ABELIAN GROUPS IGOR V. EROVENKO AND B. SURY ABSTRACT. We compute commutativity degrees of wreath products A B of finite abelian groups A and B. When B

### On Generalized Fermat Numbers 3 2n +1

Applied Mathematics & Information Sciences 4(3) (010), 307 313 An International Journal c 010 Dixie W Publishing Corporation, U. S. A. On Generalized Fermat Numbers 3 n +1 Amin Witno Department of Basic

### Cryptography and Network Security Chapter 8

Cryptography and Network Security Chapter 8 Fifth Edition by William Stallings Lecture slides by Lawrie Brown (with edits by RHB) Chapter 8 Introduction to Number Theory The Devil said to Daniel Webster:

### THE NUMBER OF REPRESENTATIONS OF n OF THE FORM n = x 2 2 y, x > 0, y 0

THE NUMBER OF REPRESENTATIONS OF n OF THE FORM n = x 2 2 y, x > 0, y 0 RICHARD J. MATHAR Abstract. We count solutions to the Ramanujan-Nagell equation 2 y +n = x 2 for fixed positive n. The computational

### The last three chapters introduced three major proof techniques: direct,

CHAPTER 7 Proving Non-Conditional Statements The last three chapters introduced three major proof techniques: direct, contrapositive and contradiction. These three techniques are used to prove statements

### k, then n = p2α 1 1 pα k

Powers of Integers An integer n is a perfect square if n = m for some integer m. Taking into account the prime factorization, if m = p α 1 1 pα k k, then n = pα 1 1 p α k k. That is, n is a perfect square

### CHAPTER SIX IRREDUCIBILITY AND FACTORIZATION 1. BASIC DIVISIBILITY THEORY

January 10, 2010 CHAPTER SIX IRREDUCIBILITY AND FACTORIZATION 1. BASIC DIVISIBILITY THEORY The set of polynomials over a field F is a ring, whose structure shares with the ring of integers many characteristics.

### Consequently, for the remainder of this discussion we will assume that a is a quadratic residue mod p.

Computing square roots mod p We now have very effective ways to determine whether the quadratic congruence x a (mod p), p an odd prime, is solvable. What we need to complete this discussion is an effective

### FACTORING LARGE NUMBERS, A GREAT WAY TO SPEND A BIRTHDAY

FACTORING LARGE NUMBERS, A GREAT WAY TO SPEND A BIRTHDAY LINDSEY R. BOSKO I would like to acknowledge the assistance of Dr. Michael Singer. His guidance and feedback were instrumental in completing this

### Cryptography and Network Security Number Theory

Cryptography and Network Security Number Theory Xiang-Yang Li Introduction to Number Theory Divisors b a if a=mb for an integer m b a and c b then c a b g and b h then b (mg+nh) for any int. m,n Prime

### HOMEWORK 5 SOLUTIONS. n!f n (1) lim. ln x n! + xn x. 1 = G n 1 (x). (2) k + 1 n. (n 1)!

Math 7 Fall 205 HOMEWORK 5 SOLUTIONS Problem. 2008 B2 Let F 0 x = ln x. For n 0 and x > 0, let F n+ x = 0 F ntdt. Evaluate n!f n lim n ln n. By directly computing F n x for small n s, we obtain the following

### MODULAR ARITHMETIC. a smallest member. It is equivalent to the Principle of Mathematical Induction.

MODULAR ARITHMETIC 1 Working With Integers The usual arithmetic operations of addition, subtraction and multiplication can be performed on integers, and the result is always another integer Division, on

### Computer and Network Security

MIT 6.857 Computer and Networ Security Class Notes 1 File: http://theory.lcs.mit.edu/ rivest/notes/notes.pdf Revision: December 2, 2002 Computer and Networ Security MIT 6.857 Class Notes by Ronald L. Rivest

### Principles of Public Key Cryptography. Applications of Public Key Cryptography. Security in Public Key Algorithms

Principles of Public Key Cryptography Chapter : Security Techniques Background Secret Key Cryptography Public Key Cryptography Hash Functions Authentication Chapter : Security on Network and Transport

### TEXAS A&M UNIVERSITY. Prime Factorization. A History and Discussion. Jason R. Prince. April 4, 2011

TEXAS A&M UNIVERSITY Prime Factorization A History and Discussion Jason R. Prince April 4, 2011 Introduction In this paper we will discuss prime factorization, in particular we will look at some of the

### Number Theory Hungarian Style. Cameron Byerley s interpretation of Csaba Szabó s lectures

Number Theory Hungarian Style Cameron Byerley s interpretation of Csaba Szabó s lectures August 20, 2005 2 0.1 introduction Number theory is a beautiful subject and even cooler when you learn about it

### Short Programs for functions on Curves

Short Programs for functions on Curves Victor S. Miller Exploratory Computer Science IBM, Thomas J. Watson Research Center Yorktown Heights, NY 10598 May 6, 1986 Abstract The problem of deducing a function

### Factorization of a 1061-bit number by the Special Number Field Sieve

Factorization of a 1061-bit number by the Special Number Field Sieve Greg Childers California State University Fullerton Fullerton, CA 92831 August 4, 2012 Abstract I provide the details of the factorization

### CLASS 3, GIVEN ON 9/27/2010, FOR MATH 25, FALL 2010

CLASS 3, GIVEN ON 9/27/2010, FOR MATH 25, FALL 2010 1. Greatest common divisor Suppose a, b are two integers. If another integer d satisfies d a, d b, we call d a common divisor of a, b. Notice that as

### 9. POLYNOMIALS. Example 1: The expression a(x) = x 3 4x 2 + 7x 11 is a polynomial in x. The coefficients of a(x) are the numbers 1, 4, 7, 11.

9. POLYNOMIALS 9.1. Definition of a Polynomial A polynomial is an expression of the form: a(x) = a n x n + a n-1 x n-1 +... + a 1 x + a 0. The symbol x is called an indeterminate and simply plays the role

### THE FUNDAMENTAL THEOREM OF ALGEBRA VIA PROPER MAPS

THE FUNDAMENTAL THEOREM OF ALGEBRA VIA PROPER MAPS KEITH CONRAD 1. Introduction The Fundamental Theorem of Algebra says every nonconstant polynomial with complex coefficients can be factored into linear

### CS 103X: Discrete Structures Homework Assignment 3 Solutions

CS 103X: Discrete Structures Homework Assignment 3 s Exercise 1 (20 points). On well-ordering and induction: (a) Prove the induction principle from the well-ordering principle. (b) Prove the well-ordering

### *.I Zolotareff s Proof of Quadratic Reciprocity

*.I. ZOLOTAREFF S PROOF OF QUADRATIC RECIPROCITY 1 *.I Zolotareff s Proof of Quadratic Reciprocity This proof requires a fair amount of preparations on permutations and their signs. Most of the material

### FACTORING POLYNOMIALS IN THE RING OF FORMAL POWER SERIES OVER Z

FACTORING POLYNOMIALS IN THE RING OF FORMAL POWER SERIES OVER Z DANIEL BIRMAJER, JUAN B GIL, AND MICHAEL WEINER Abstract We consider polynomials with integer coefficients and discuss their factorization

### Factoring a semiprime n by estimating φ(n)

Factoring a semiprime n by estimating φ(n) Kyle Kloster May 7, 2010 Abstract A factoring algorithm, called the Phi-Finder algorithm, is presented that factors a product of two primes, n = pq, by determining

### On the coefficients of the polynomial in the number field sieve

On the coefficients of the polynomial in the number field sieve Yang Min a, Meng Qingshu b,, Wang Zhangyi b, Li Li a, Zhang Huanguo b a International School of Software, Wuhan University, Hubei, China,

### I. GROUPS: BASIC DEFINITIONS AND EXAMPLES

I GROUPS: BASIC DEFINITIONS AND EXAMPLES Definition 1: An operation on a set G is a function : G G G Definition 2: A group is a set G which is equipped with an operation and a special element e G, called

### Quotient Rings and Field Extensions

Chapter 5 Quotient Rings and Field Extensions In this chapter we describe a method for producing field extension of a given field. If F is a field, then a field extension is a field K that contains F.

### On prime-order elliptic curves with embedding degrees k = 3, 4 and 6

On prime-order elliptic curves with embedding degrees k = 3, 4 and 6 Koray Karabina and Edlyn Teske University of Waterloo ANTS VIII, Banff, May 20, 2008 K. Karabina and E. Teske (UW) Prime-order elliptic

### The application of prime numbers to RSA encryption

The application of prime numbers to RSA encryption Prime number definition: Let us begin with the definition of a prime number p The number p, which is a member of the set of natural numbers N, is considered

### PYTHAGOREAN TRIPLES PETE L. CLARK

PYTHAGOREAN TRIPLES PETE L. CLARK 1. Parameterization of Pythagorean Triples 1.1. Introduction to Pythagorean triples. By a Pythagorean triple we mean an ordered triple (x, y, z) Z 3 such that x + y =

### Optimization of the MPQS-factoring algorithm on the Cyber 205 and the NEC SX-2

Optimization of the MPQS-factoring algorithm on the Cyber 205 and the NEC SX-2 Walter Lioen, Herman te Riele, Dik Winter CWI P.O. Box 94079, 1090 GB Amsterdam, The Netherlands ABSTRACT This paper describes

### The Prime Numbers. Definition. A prime number is a positive integer with exactly two positive divisors.

The Prime Numbers Before starting our study of primes, we record the following important lemma. Recall that integers a, b are said to be relatively prime if gcd(a, b) = 1. Lemma (Euclid s Lemma). If gcd(a,

### RSA and Primality Testing

and Primality Testing Joan Boyar, IMADA, University of Southern Denmark Studieretningsprojekter 2010 1 / 81 Correctness of cryptography cryptography Introduction to number theory Correctness of with 2

### MA2C03 Mathematics School of Mathematics, Trinity College Hilary Term 2016 Lecture 59 (April 1, 2016) David R. Wilkins

MA2C03 Mathematics School of Mathematics, Trinity College Hilary Term 2016 Lecture 59 (April 1, 2016) David R. Wilkins The RSA encryption scheme works as follows. In order to establish the necessary public

### MATH10212 Linear Algebra. Systems of Linear Equations. Definition. An n-dimensional vector is a row or a column of n numbers (or letters): a 1.

MATH10212 Linear Algebra Textbook: D. Poole, Linear Algebra: A Modern Introduction. Thompson, 2006. ISBN 0-534-40596-7. Systems of Linear Equations Definition. An n-dimensional vector is a row or a column

### RSA Question 2. Bob thinks that p and q are primes but p isn t. Then, Bob thinks Φ Bob :=(p-1)(q-1) = φ(n). Is this true?

RSA Question 2 Bob thinks that p and q are primes but p isn t. Then, Bob thinks Φ Bob :=(p-1)(q-1) = φ(n). Is this true? Bob chooses a random e (1 < e < Φ Bob ) such that gcd(e,φ Bob )=1. Then, d = e -1

### Elementary Number Theory and Methods of Proof. CSE 215, Foundations of Computer Science Stony Brook University http://www.cs.stonybrook.

Elementary Number Theory and Methods of Proof CSE 215, Foundations of Computer Science Stony Brook University http://www.cs.stonybrook.edu/~cse215 1 Number theory Properties: 2 Properties of integers (whole

### SOLVING POLYNOMIAL EQUATIONS

C SOLVING POLYNOMIAL EQUATIONS We will assume in this appendix that you know how to divide polynomials using long division and synthetic division. If you need to review those techniques, refer to an algebra

### QUADRATIC RECIPROCITY IN CHARACTERISTIC 2

QUADRATIC RECIPROCITY IN CHARACTERISTIC 2 KEITH CONRAD 1. Introduction Let F be a finite field. When F has odd characteristic, the quadratic reciprocity law in F[T ] (see [4, Section 3.2.2] or [5]) lets

### COMMUTATIVITY DEGREES OF WREATH PRODUCTS OF FINITE ABELIAN GROUPS

Bull Austral Math Soc 77 (2008), 31 36 doi: 101017/S0004972708000038 COMMUTATIVITY DEGREES OF WREATH PRODUCTS OF FINITE ABELIAN GROUPS IGOR V EROVENKO and B SURY (Received 12 April 2007) Abstract We compute

### Some Polynomial Theorems. John Kennedy Mathematics Department Santa Monica College 1900 Pico Blvd. Santa Monica, CA 90405 rkennedy@ix.netcom.

Some Polynomial Theorems by John Kennedy Mathematics Department Santa Monica College 1900 Pico Blvd. Santa Monica, CA 90405 rkennedy@ix.netcom.com This paper contains a collection of 31 theorems, lemmas,

### Chapter 4, Arithmetic in F [x] Polynomial arithmetic and the division algorithm.

Chapter 4, Arithmetic in F [x] Polynomial arithmetic and the division algorithm. We begin by defining the ring of polynomials with coefficients in a ring R. After some preliminary results, we specialize

### ELEMENTARY THOUGHTS ON DISCRETE LOGARITHMS. Carl Pomerance

ELEMENTARY THOUGHTS ON DISCRETE LOGARITHMS Carl Pomerance Given a cyclic group G with generator g, and given an element t in G, the discrete logarithm problem is that of computing an integer l with g l

### Number Theory and Cryptography using PARI/GP

Number Theory and Cryptography using Minh Van Nguyen nguyenminh2@gmail.com 25 November 2008 This article uses to study elementary number theory and the RSA public key cryptosystem. Various commands will

### Cryptography and Network Security Department of Computer Science and Engineering Indian Institute of Technology Kharagpur

Cryptography and Network Security Department of Computer Science and Engineering Indian Institute of Technology Kharagpur Module No. # 01 Lecture No. # 05 Classic Cryptosystems (Refer Slide Time: 00:42)