Finally, the Chinese Remainder Theorem implies now that. and this shows that 341 is a Fermat pseudoprime to base 2. n = ap 1

Transcription

1 28 MA Pseudoprimes In the previous section we learnt that we need to find large prime numbers when we use the RSA cryptosystem. The question then arises how we can find large primes or if there are methods to test if a certain large integer is prime. The numbers N involved are so large that simply testing all primes up to the square root of N is not a practicable option. In this section we shall investigate a probabilistic method. Generally speaking, a pseudoprime is an integer which satisfies some arithmetical statement that is true for prime numbers. For example, an odd composite integer N will be called a Fermat pseudoprime to base a, if gcd(a,n) = 1 and a N 1 1 mod N. Fermat s Little Theorem tells us that each prime number which does not divide a would pass this test. It can be shown that the number of Fermat pseudoprimes to base a is small compared to the number of primes. Therefore, any number that passes such a test could be considered to be probably a prime. Example To see if 91 = 7 13 is a Fermat pseudoprime to base 3, we first observe that mod 7 by Fermat s Little Theorem. Next we calculate mod 13. Hence mod 13 and by the Chinese Remainder Theorem mod 91 and so also mod 91. Thus 91 is a pseudoprime to the base 3. On the other hand, using repeated squaring, we find that mod 91. Therefore, 91 is not a pseudoprime to base 2 and hence is not a prime number. Example The smallest Fermat pseudoprime to base 2 is the number N = 341 = To verify this, we first recall that Fermat s Little Theorem gives us Next we observe that mod 11 hence mod mod 31 hence mod 31. Finally, the Chinese Remainder Theorem implies now that mod 341 and this shows that 341 is a Fermat pseudoprime to base 2. Theorem For each integer a 2 there are infinitely many pseudoprimes to base a. Proof. Let p be an odd prime that does not divide a 2 1 then we claim that n = a2p 1 a 2 1 is a pseudoprime to base a. (The case a = 2 and p = 5 gives the example n = 341.) Because a 1 is a factor of a p 1 and a+1 is a factor of a p +1, the factorisation n = ap 1 a 1 ap +1 a+1

2 Week 5 29 shows that n is composite. We now prove that n is odd and that a n 1 1 mod n. Fermat s little Theorem implies that a 2p a 2 mod p. Thus p divides a 2p a 2. Since p does not divide a 2 1 it follows that p divides n 1 = a2p a 2 a 2 1 = a2p 2 +a 2p 4 + +a 2. The last expression shows that n 1 is the sum of an even number of terms of the same parity, thus n 1 is even. As p is odd, this implies that 2p is a divisor of n 1. Because a 2p 1 = n(a 2 1), we have a 2p 1 mod n and as n 1 is a multiple of 2p we see now that a n 1 1 mod n. We have seen above that 341 is a Fermat pseudoprime to base 2. On the other hand mod 341 and hence 341 is not a pseudoprime to base 3. This might look a hopeful avenue. After finding that a number N satisfies gcd(a,n) = 1 and a N 1 1 mod N for many randomly chosen numbers a we might get convinced that N is very likely a prime number. However, when we look at N = 561 = we find a mod 561 for any a with gcd(a,n) = 1. Such a number is called a Carmichael number. To see that 561 is a Carmichael number, first observe 560 = = = and so Fermat s Little Theorem implies that a mod 3 a mod 11 a mod 17 for each integer that is coprime to 561 = The Chinese Remainder Theorem now gives the result. Unfortunately there are an infinite number of Carmichael numbers. For all of them, the test suggested above using Fermat pseudoprimes would never detect that they are not prime. The first few Carmichael numbers are 561 = , 1105 = , 1729 = , 2465 = and2821 = All these areproducts ofthree distinct odd primes. However, this is not necessarily the case: = is also a Carmichael number. Carmichael numbers can be recognised from the following Korselt criterion. Theorem An integer n is a Carmichael number if and only if n is odd, composite, square-free and p 1 divides n 1 for each prime p dividing n. Proof. Recall that an integer is called square-free if it is not divisible by the square of an integer. In particular, all primes in its prime factorisation occur with exponent one. Suppose now that n is odd, composite, square-free and satisfies the condition above. Let n = p 1 p 2 p 3 p k be its prime factorisation. These primes are all different as n is square-free. As p i 1 divides n 1, we can write n 1 = (p i 1)b i.

3 30 MA6011 If a is coprime to n, then a is not divisible by p i. From Fermat s Little Theorem it follows that a n 1 a (p i 1)b i ( a p i 1 ) b i 1 mod p i. Hence a n 1 1 mod p i for i = 1,2,...,k. The Chinese Remainder Theorem implies now that a n 1 1 mod n. This is possible because all the primes are different. Conversely, suppose n is a Carmichael number. Then n is composite by definition. Wefirstprovethatnisodd. Takea = n 1. Thengcd(a,n) = gcd(n 1,n) = 1 and (n 1) n 1 1 mod n which implies ( 1) n 1 1 mod n from which it follows that n is odd. To prove that n is square-free and that for each prime p i dividing n we also have p i 1 n 1, we write the prime factorisation as n = p α 1 1 p α 2 2 p α 3 3 p α k k. We now need the concept of a primitive root modulo p α which will be discussed in the next section. We will see there that for each odd prime p there exists an integer a for which a ϕ(pα) 1 mod p α but for which a k 1 mod p α for positive integers k < ϕ(p α ). Clearly, we must have gcd(a,p α ) = 1. We will also show that for such a primitive root a the congruence a t 1 mod p α is only possible if t is a multiple of ϕ(p α ) = p α 1 (p 1). To continue with our proof, we let a i be a primitive root modulo p α i i. By the Chinese Remainder Theorem, there exists an integer a such that a a i mod p α i i for all i. Because gcd(a i,p i ) = 1 for all i, we also have gcd(a,n) = 1. As n was assumed to be a Carmichael number, we have a n 1 1 mod n. This implies that a n 1 1 mod p α i i. Because a i is a primitive root modulo p α i i, this is only possible if n 1 is divisible by ϕ(p α i i ) = p α i 1 i (p i 1). In particular, p i 1 n 1. Also, because p i does not divide n 1, this implies that α i = 1 for all i. This means that n is square-free. The existence of Carmichael numbers means that better primality tests are needed. The following theorem provides such an improvement. Theorem Let p be an odd prime and write p 1 = 2 k q where q is odd. Let a be a number not divisible by p. Then one of the following two statements is true. (i) a q 1 mod p. (ii) One of the numbers a q,a 2q,a 4q,...,a 2k 1q is congruent to 1 mod p. Proof. Fermat s Little Theorem tells us that a 2kq a p 1 1 mod p. Consider the numbers a q,a 2q,a 4q,...,a 2k 1q,a 2kq. Thenumbers inthislist aregotbysuccessive squaring. Ifaninteger bsatisfies b 2 1 mod p there are only two possibilities: b 1 mod p or b 1 mod p. This is so because p (b 1)(b+1) and p is prime. Thus, by going backwards through our list we see that, either all numbers are congruent to 1 mod p and we are in case (i), or one of them is congruent to 1 mod p, and this is case (ii).

4 Week 5 31 This result gives rise to the Rabin-Miller Primality Test: Let n be an odd number and write n 1 = 2 k q with q odd. Let a be an integer such that gcd(a,n) = 1. We say n passes the Rabin-Miller test to base a if one of the following conditions is satisfied: (i) a q 1 mod n; (ii) a 2iq 1 mod n for one i in the range 0 i k 1. Anumber a forwhich bothofthese conditions areviolated iscalled a Rabin-Miller witness. Theorem 15.5 means that the existence of a Rabin-Miller witness implies that the number n is composite. Example Let us apply the Rabin-Miller Test to the Carmichael number 561. We have 560 = , that is k = 4 and q = 35 in the notation used above. We find mod mod mod mod 561 Thus 2 is a Rabin-Miller witness which confirms that 561 is composite. If a composite numbers passes the Rabin-Miller Test for a certain number a it is called a strong pseudoprime to base a. For example, with n = 121, n 1 = and taking a = 3, we find mod 121. Thus n = 121 passes the Rabin-Miller Test to base a = 3 and we say 121 is a strong pseudoprime to base 3. However, these calculations mod mod mod mod 121 show that 121 fails the Rabin-Miller Test to base 2, thus 121 is composite. The question then arises as to whether there are numbers which are strong pseudoprimes to all relevant bases, what we might call strong Carmichael numbers. The answer is no. In other words, for every composite number n there is some base a which will prove the compositeness of n. Thus each application of the Rabin-Miller test not producing a composite answer, increases the likelihood that the number we start with is probably prime. It can be shown that for each odd composite number n at least 75% of the numbers from 1 to n 1 are Rabin-Miller witnesses. This means if we randomly choose a between 1 and n 1, a composite number passes the Rabin-Miller test with a probability less than If we carry out this test for 100 randomly chosen a and none of them is a Rabin-Miller witness, the probability that n is composite is less than which is approximately equal to

5 32 MA Primitive Roots We have used primitive roots in the previous section to prove Korselt s criterion. Primitive roots are also useful in calculations and in implementing fast multiplication. Let p be a prime number and suppose gcd(a,p) = 1 then a p 1 1 mod p. Taking p = 61 and successive powers of 2 mod 61 we find in turn 2,4,8,16,32,3,6,12,24,48,35,9,18,36,11,22,44,27,54,47, 33,5,10,20,40,19,38,15,30,60,59,57,53,45,29,58,55,49,37,13, 26,52,43,25,50,39,17,34,7,14,28,56,51,41,21,42,23,46,31,1 We have mod 61 but 2 m 1 mod 61 for any smaller positive value of m. Moreover, the list of powers of 2 contains all 60 non-zero residues modulo 61. Taking a = 3 or a = 11, things are different. The successive powers of these numbers modulo 61 are a a 1 a 2 a 3 a 4 a 5 a 6 a 7 a 8 a 9 a 10 a 11 a 12 a We now see that mod 61 and 3 m 1 mod 61 for any smaller m. Note that We also see that mod 61 and note that Taking a = 7 we find that mod 61 and for no smaller power. To understand what is going on here, we introduce the following definition. When a,m are integers with gcd(a,m) = 1, the order of a modulo m, denoted e m (a), is the smallest positive integer e such that a e 1 mod m. For example, we have shown above that e 61 (2) = 60, e 61 (3) = 10 and e 61 (11) = 4. Theorem Let a and m be coprime integers and suppose that a n 1 mod m for somepositive integer n. Thenthe order of adividesn. In particular e p (a) ϕ(m). Proof. Let d = gcd(e m (a),n). We can find integers r,s such that d = re m (a) sn. Then a d+sn a rem(a) mod p. Because a n 1 a em(a) mod m, this implies a d 1 mod m. As d is the greatest common divisor of e m (a) and n we must have d e m (a). This contradicts the definition of e m (a) unless d = e m (a). But then e m (a) divides n as required. Euler s Formula shows that n = ϕ(m) satisfies the assumptions made, which proves the particular case mentioned. An integer a with maximum order e p (a) = ϕ(m) is called a primitive root modulo m. For example, 2 and 7 are primitive roots modulo 19, but 3 and 11 are not. Not all numbers m have a primitive root (e.g. m = 15 and m = 16), but odd prime powers do. The following theorem, which we do not prove here, contains what we needed in the previous section. Theorem If p is an odd prime and α 1, then there exists a primitive root modulo m = p α. In fact, there are exactly ϕ(p 1) primitive roots modulo p.

6 Week 5 33 This Theorem tells us that we can find lots of primitive roots. Taking p = 13 we should have ϕ(12) = 4 primitive roots. Taking successive powers of 2 modulo 13 we obtain 2,4,8,3,6,12,11,9,5,10,7,1. Thus 2 is a primitive root. The other primitive roots are mod 13, mod 13 and mod 13 as 1,5,7,11 are the integers coprime with 12 and less than 12. Turning the problem round we can ask the question for which primes is a a primitive root. This is not so easy to answer. For a = 2, we can find the following primes work 3,5,11,13,19,29,37,53,59,61. However, no one has yet proved that there are an infinite number of such primes. Given a primitive rootg modulo a prime p then we can write each ofthe numbers 1,2,...,p 1 as a power of g. This leads to the following definition: Let 1 a < p and g a primitive root modulo p. The index of a modulo p for the base g is the unique 1 k p 1 such that g k a mod p. We write I(a) = k. For p = 13 and primitive root 2 we obtain the following table a I(a) The following properties of the index follow immediately from the laws of indices: I(ab) I(a)+I(b) mod p 1 I(a k ) ki(a) mod p 1 Because these resemble the properties of the logarithm function, the index is also known as the discrete logarithm and the notation log g (a) = I(a) is used for the discrete logarithm of a modulo p to the base g. With the aid of a table of indices, multiplication can be carried out easily, because indices turn multiplication into addition. For example, taking the primitive root g = 2 we obtain the following table of indices modulo 19. a I(a) Wecould then calculate asfollows: I(11 15) I(11)+I(15) mod 18. As I(13) = 5 it follows that mod 19. If many multiplications modulo the same large prime p are to be carried out, using a primitive root and a table of indices for this base may result in a speed-up of the calculations. Tables of indices can also be helpful in solving congruences by turning multiplication problems into addition problems, as illustrated in the following two examples. Example In order to solve 13x 11 mod 19, we use indices to find I(13x) I(13)+I(x) I(11) mod 18. Hence 5 + I(x) 12 mod 18. Therefore, I(x) = 7 and from our table we obtain the solution x = 14. Example To solve 3x 15 5 mod 19, we find I(3)+15I(x) I(5) mod 18. Hence I(x) 16 mod 18. This becomes 15I(x) 3 mod 18. Because gcd(15,18) = 3, this congruence has three solutions I(x) 5,11 or 17 mod 18. Looking up our table of indices we obtain the solutions x = 10,13,15.

7 34 MA The ElGamal Cryptosystem Suppose p is a large prime. Given g and a we can try to solve for k the congruence g k a mod p. This is called the discrete logarithm problem. Calculating g k mod p is quite easy using successive squaring. However, finding k from g and a is not so easy and can be used in cryptography. Of course, we have to use a prime p that is so large that setting up a table of indices is not feasible. The ElGamal Cryptosystem is based on the discrete logarithm problem. It works as follows: Suppose we have a large prime p and a primitive root g modulo p. Alice chooses a number k which will be her secret key. She calculates a g k mod p and publishes this number as her public key. Bob wishing to send Alice a message m which is a number less than p. He chooses randomly a number r and then computes e 1 g r mod p and e 2 ma r mod p and sends Alice the pair (e 1,e 2 ). In order to decrypt the message Alice uses her secret key k to compute c e k 1 mod p. Note that c g rk a r mod p. Next she finds u such that uc 1 mod p and then computes v ue 2 mod p. Because v is the original message. ue 2 uma r umc m mod p, Example Let p = and g = 2. Alice s secret key is k = and so her public key is a = mod Bob wishes to send the message He chooses the random number r = and calculates e mod and e mod Thus (e 1,e 2 ) = (101028,179696) is the message Bob sends. Alice decrypts by first calculating e k mod Next she calculates the inverse of mod , for example using inv mod in sage, to obtain She now calculates mod obtaining which was Bob s original message. 18 Solving the Discrete Logarithm Problem Theoretically one can solve the discrete logarithm problem by calculating all powers of the primitive root g modulo p. However, this is unpractical for large p. We will discuss Shanks Baby-step Giant-step algorithm which solves the discrete logarithm problem if the prime p is not too large. Given are a prime p and two integers a,g such that g is a primitive root modulo p and gcd(a,p) = 1. We wish to find an integer x such that g x a mod p.

8 Week 5 35 Instead of calculating all p 1 powers of g modulo p, the algorithm calculates only about 2 p such powers. The main idea is to write x = js i where s = p 1. As we can assume 1 x p 1, we only have to consider 0 i < s and 1 j s. One then produces two lists of powers of g with s elements each and looks for a number they have in common. Here are the details of the algorithm. 1) Calculate s = p 1. 2) (Baby step) Calculate the pairs (ag i mod p,i) for i = 0,1,2,...,s 1 to produce the set S which we then sort by the first element of the ordered pairs. 3) (Giant step) Compute the pairs (g js mod p,js) for j = 1,2,...,s. Sort the so obtained set T by the first element of the ordered pairs. 4) Search for a match between the first elements of the ordered pairs. If ag i = g js then calculate x = js i. This is the discrete logarithm of a to the base g modulo p. Example Let us solve 2 x 7 mod 19, so we have p = 19, g = 2 and a = 7. We first find s = 5, which is the smallest integer having a square that is not smaller than p 1 = 18. Baby step: We calculate 7 2 i mod 19 for i = 0,1,2,3,4 and store it as a pair with second component i. To go from one pair to the next, we just have to multiply the first entry by g = 2. We obtain S = {(7,0),(14,1),(9,2),(18,3),(17,4)} and order this set by first entry to get S = {(7,0),(9,2),(14,1),(17,4),(18,3)}. Giant step: We first calculate g s mod 19 and then raise this to powers j = 1,2,3,4,5. The second component in each pair is js. To go from one pair to the next, we need here to multiply the first entry by 13. We obtain T = {(13,5),(17,10),(12,15),(4,20),(14,25)}} and ordered by first entry T = {(4,20),(12,15),(13,5),(14,25),(17,10)}. We have a match in the number 14 with i = 1 and js = 25. This gives x = js i = 25 1 = 24. We also have a match in the number 17 with i = 4 and js = 10. This gives x = js i = 10 4 = 6. We know that x is determined modulo p 1 = 18 and 24 6 mod 18, hence x = 6 and mod 19. Example To solve 2 x 37 mod 83, we first find s = 10. Baby step: The ten pairs (37 2 i mod 83,i) are S = {(37,0),(74,1),(65,2),(47,3),(11,4),(22,5),(44,6),(5,7),(10,8),(20,9)} = {(5,7),(10,8),(11,4),(20,9),(22,5),(37,0),(44,6),(47,3),(65,2),(74,1)} Giant step: We only need nine pairs (2 10j mod 83,10j), because 9s = 90 > p 1. T = {(28,10),(37,20),(40,30),(41,40),(69,50),(23,60),(63,70),(21,80),(7,90)} = {(7,90),(21,80),(23,60),(28,10),(37,20),(40,30),(41,40),(63,70),(69,50)} Match is foundwith first component 37, so x = 20 0 = 20. Thus mod 83.

9 36 MA6011 We were able to solve the discrete logarithm problem in the two examples above as we were able to do all the calculations. If p is large one can carry out the Baby step and Giant step calculations in parallel until a match occurs. However, there is no guarantee that a match will occur sooner rather than later. There are other approaches to solving the discrete logarithm problem. For example, if p 1 does not have a large prime factor, an algorithm of Silver, Pohlig and Hellman calculates discrete logarithms modulo p efficiently. We will discuss this algorithm later. At this stage we just note that in order to ensure the security of the ElGamal Cryptosystem, it is important to avoid primes p for which p 1 is a product of relatively small primes. The safest primes from this perspective are those primes p for which (p 1)/2 is a prime number too. The first thirteen such primes are: 5,7,11,23,47,59,83,107,167,179,227,263,347. Currently (autumn 2014) the largest prime for which a discrete logarithm (of a random number) was computed is a 180 digit prime. For the computation a method known as the number field sieve was used.