Primality  Factorization


 Gary West
 3 years ago
 Views:
Transcription
1 Primality  Factorization Christophe Ritzenthaler November 9, Prime and factorization Definition 1.1. An integer p > 1 is called a prime number (nombre premier) if it has only 1 and p as divisors. Example 1. There are infinitely many prime numbers. The biggest generic one is ((((((((( ) ) 3 + 6) ) ) ) ) ) ) Interested readers may read http: // www. cs. uwaterloo. ca/ journals/ JIS/ VOL8/ Caldwell/ caldwell78. html for the origin of this number. It has 20,562 decimal digits and the proof was built using fastecpp on several networks of workstations. We will write P the set of prime numbers. To estimate the efficiency of some algorithms, we need results on density of primes. Theorem 1.1. Let π(x) = #{p x prime}. One has π(x) x log x. Let n 2 be an integer and c an integer prime to n. Let π n,c (x) = #{p x prime, p = kn + c}. One has π n,c (x) 1 x φ(n) log x. To find a prime number, the number of attempts is then of the size of x. Indeed, the probability to fail in k attempts is (1 1/ log(x)) k so the probability to succeed which is closed to 1 for any k = log(x) 1+ɛ. 1 (1 1/ log(x)) k k/ log(x) 1 e Remark 1. For x 17, one has π(x) > x/ log x and for x > 1 one has π(x) < (x/ log x). Let us finish with the fundamental result. 1
2 Theorem 1.2. Every integer a > 1 can be written as the product of prime numbers a = p P p e(p) with e(p) 0 and e(p) = 0 except for finitely many primes p. Up to permutation, the factors in this product are uniquely determined. 2 Prime numbers To produce big prime numbers is very important for cryptographic applications. For a given n, there is no generic algorithm which can compute a random prime number less than n. However a result by Hadamard and de la Vallée Poussin shows that #{p n prime} n log n (see 1). So the usual method is to pick random numbers and to test if they are prime or not. This requests that we have fast algorithms to test primality. 2.1 Primality test Trial division The simplest algorithm is based on the following result. Proposition 2.1. n is a composite number if and only if it has a prime divisor p such that p n. Proof. Since n is composite, n = ab and either a or b is smaller than n. This proposition suggests that one can try all prime numbers less or equal to n using Eratosthenes sieve. Following the estimate density of prime (see 1), it means that we make up to n/ log n divisions, leading to an exponential algorithm in O(e ( 1 2 ɛ) log n ) Fermat test and Carmichael numbers By Fermat little theorem, one knows that if n is a prime number then a n 1 1 (mod n) for all a Z coprime with n. If the theorem was an equivalence, we would have an easy polynomial algorithm to test if a number is a prime. Unfortunately Example 2. Consider n = 341 = One has (mod 341). Such a number is called pseudoprime (pseudopremier) in base 2. We can prove that there are infinitely many pseudoprimes in base 2 by showing that if n is such a number then 2 n 1 also. Indeed because n is a pseudoprime in base 2 one has n 2 n 1 1, i.e. there is c such that nc = 2 n 1 1. Now The last expression is divisible by 2 n 1 so 2 2n = 2 2(2n 1 1) 1 = 2 2nc n (mod 2 n 1). 2
3 To finish the proof, one has to show that 2 n 1 is not a prime. Since n = ab, 2 n 1 is divisible by 2 a 1. An idea is then to change the value of a : for instance (mod 341). Unfortunately, there are numbers that are pseudoprime in any base. Such numbers are called Carmichael numbers (for instance 561 = ). It has been shown by Alford, Granville and Pomerance in 1994 that there are infinitely many Carmichael numbers so Fermat test cannot be completely sure. Let us show some properties of these numbers. Proposition 2.2. An (odd) composite number n 3 is a Carmichael number if and only if it is square free and for each prime divisor p of n, p 1 divides n 1. Proof. First it is easy to see that a Carmichael number is odd : indeed ( 1) n 1 1 (mod n) if and only if n is odd. Let a be a Carmichael number, for any a prime to n one has a n 1 1 (mod n). Let p be a prime divisor of n. There exists a primitive element modulo p that is prime to n. Indeed, let a a primitive element modulo p and n = p r m with m coprime to p. There exists an element (still denoted a) in Z/p r Z lifting the initial a (because the morphism Z/p r Z Z/pZ est surjectif). We find s Z/mZ coprime to m and since Z/nZ Z/p r Z Z/mZ we construct the element a Z/nZ image of (a, s). Such an element satisfies the properties for a. Now, one has of course a n 1 1 (mod p) but as a is primitive p 1 divides n 1. Now suppose that n = p 2 m and write a = 1 + pm. One has a p 1 + p 2 m (mod n) So the order of a is p. But p does not divide n 1 (p n) so we get a contradiction. Conversely, let n be a squarefree integer such that p 1 divides n 1 for all prime divisors p of n. Let a be prime to n one has and because n 1 is a multiple of p 1, a p 1 1 (mod p) a n 1 1 (mod p). Using the Chinese Remainder theorem for all the factors p, one gets a n 1 1 (mod n). Corollary 2.1. Any Carmichael number is the product of at least 3 distinct odd primes. 3
4 Proof. Because a Carmichael number is without square factor and is not prime it has at least two prime factors. Let us assume that n = pq with p < q. Then q 1 divides pq 1 = p(q 1) + p 1 so q 1 divides p 1. Absurd. Example 3. Show that if 6m + 1, 12m + 1 and 18m + 1 are primes then n = (6m + 1)(12m+1)(18m+1) is a Carmichael number. First by the Chinese Remainder theorem, one can see that if n = ab with a, b coprime then for any x prime to n one has x lcm(φ(a),φ(b)) 1 (mod n). Now lcm(φ(6m + 1), φ(12m + 1), φ(18m + 1)) = 36m and also 36m n 1. One can check that 1729 is such a number Lucas test Let n > 1 be an integer. We will show that if there exists an a such that a n 1 1 (mod n) and a q 1 (mod n) for all q n 1, q n 1, then n is prime. This is a very good test for Fermat numbers F m, i.e. numbers of the form n = 2 2m + 1 (For m = only the first five are prime. F 33 is so big that it may be many years before we can decide its nature). But obviously this test is not good for a generic prime since we must know the factorization of n 1. Let assume that such an a exists and let d be the order of a in (Z/nZ). Since a n 1 1 (mod n), d (n 1). More exactly as no proper divisor of n 1 is the order of a, one has d = n 1. Now n 1 = d φ(n). This is possible only if n is prime RabinMiller test Contrary to the Fermat test, the MillerRabin test can prove the compositeness of any composite number (i.e. there is no analog of Carmichael numbers for this test). But RabinMiller test is a MonteCarlo algorithm : it always stops ; if it answers yes, the number is composite and if it answers no then the answer is correct with a probability greater than 3/4. Let n be an odd positive integer and s = max{r N, 2 r n 1}. Let d = (n 1)/2 s. Lemma 2.1 (Miller). If n is a prime and if a is an integer prime to n then we have either a d 1 (mod n) or there exists r {0,..., s 1} such that a 2rd 1 (mod n). Proof. The order of a is a divisor of n 1. It can be d and then a d 1 (mod n). If it is not then its order is 2 r d for r {1,..., s}. So a 2rd 1 (mod n) and a 2r 1d is a nontrivial square root of 1 so a 2r 1d 1 (mod n). If we find an a which is prime to n and that satisfies neither of the conditions, then n is composite. Such an integer a is called a witness (témoin) for the compositeness of n. Example 4. Let n = 561. a = 2 is a witness for n. Indeed here s = 4, d = 35 and (mod 561), (mod 561), (mod 561), (mod 561). 4
5 For the efficiency of the RabinMiller test, it is important that there are sufficiently many witnesses for the compositeness of a composite number. Theorem 2.1 (Rabin). If n 3 is an odd composite number, then the set {1,..., n 1} contains at most (n 1)/4 numbers that are prime to n and not witnesses for the compositeness of n. Proof. Let k be the maximum value of r for which there is an integer a prime to n that satisfies the second identity. We set m = 2 k d. Let n = p pe(p) be the prime factorization of n. Let J = {a : gcd(a, n) = 1, a n 1 1 (mod n)} K = {a : gcd(a, n) = 1, a m ±1 (mod p e(p) ) for all p n} L = {a : gcd(a, n) = 1, a m ±1 (mod n)} M = {a : gcd(a, n) = 1, a m 1 (mod n)}. We have M L K J (Z/nZ). For each a which is not a witness for the compositeness of n, the residue class a belongs to L. We will prove that the index of L in (Z/nZ) is at least four. The index of M in K is a power of 2. Indeed one can write M K M x x x 2. Let denote I the image of the morphism s : x x 2 from the multiplicative group K. s has kernel a group of order 2 j for some j so #I = #K/2 j. Now since #I divides #M we can write #M = #I a and [K : M] = 2 j /t and is a power of 2. Let s say 2 j. If j 2 then we are finished. If j = 1 (i.e. [L : K] = 2) then n has two prime divisors. It follows from Cor. 2.1 that n is not a Carmichael number. This implies that J is a proper subgroup of (Z/nZ) and the index of J in (Z/nZ) is at least 2. Therefore the index of L in (Z/nZ) is at least 4. Finally, let j = 0. Then n is a prime power, say n = p e with e > 1. But φ : (Z/nZ) Z/(p 1)Z Z/p e 1 Z is an isomorphism. As n 1 is prime to p a n 1 1 (mod n) if and only if φ(a) = (µ, 0). So [(Z/nZ) : J] = #Z/p e 1 Z = p e 1. This is bigger than 4 except for n = 9 which can be checked by hand. To apply the RabinMiller test, we choose a random number a {2,..., n 1}. If gcd(a, n) > 1 then n is composite. Otherwise we compute a d, a 2d,..., a 2s 1d. If we find a witness for the compositeness of n, then we have proved that n is composite. By Th. 2.1, the probability that n is composite and that a is not a witness is less than 1/4. So if we repeat the test t times we can make this probability less than (1/4) t. For t = 10 this probability is less than Remark 2. Under the Generalized Riemann hypothesis (which is conjectural but believed true), it can be proved that there is always a witness for the compositeness of n with 5
6 a O((log n) 2 ). If we want a absolute test, Adleman, Pomerance, Rumely, Cohen and Lenstra have given an algorithm (APRCL) which is slower but still feasible on numbers of 1000 digits (it runs in O( n C log log n 2 2 )). In 2002, M. Agrawal, N. Kayal and N. Saxena have found a deterministic polynomial algorithm to solve the problem of primality. 3 Factorization Now given an n that is known to be composite, how can we find its decomposition in prime factors? We are going to present algorithms to obtain a nontrivial factor. By repeating inductively the algorithm, we can then factorize the number. 3.1 Trial division To find small prime factors of n, a precomputed table of all prime numbers below a fixed bound B is computed. This can be done using the sieve of Eratosthenes. A typical bound is B = Example 5. We want to factor n = Trial division with primes less than 50 yields the factors 2 2, 7 2, 43. If we divide n by those factors, we obtain m = Since 2 m (mod m), this number is still composite. 3.2 Pollard p 1 method This algorithm is efficient when n has a prime factor p such that p 1 has only small prime divisors. Indeed, by Fermat s little theorem, one has a k 1 (mod p) for all multiple k of p 1. If p 1 has only small prime divisors, one can try k = q P,q e B q e where B is a given bound. Now if a k 1 is not divisible by n, then gcd(a k 1, n) is a nontrivial factor of n. Example 6. Let n = of the previous example. We set B = 13. Then k = and gcd(2 k 1, n) = 547. So n = which are both prime numbers. 6
7 3.3 Quadratic sieve Idea The quadratic sieve finds integer x, y such that and x 2 y 2 (mod n) x ±y (mod n). Then n is a divisor of x 2 y 2 = (x y)(x + y) but of neither x y or x + y. Hence g = gcd(x y, n) is a proper divisor of n. Example 7. Let n = 7429, x = 227, y = 210. Then x 2 y 2 = n, x y = 17 so 17 n Determination of x and y The idea from the previous section is also used in other factoring algorithms, such as the number field sieve (NFS), but those algorithms have different ways of finding x, y. We describe how x, y are found in the quadratic sieve. Let m = n and f(x) = (X + m) 2 n. We first explain the procedure on an example. Example 8. Let n = Then m = 86. One has This implies f( 3) = = 540 = , f(1) = = 140 = , f(2) = = 315 = (mod 7429), (mod 7429), (mod 7429). If the last two congruences are multiplied then we obtain (87 88) 2 ( ) 2 (mod n). Therefore we can set x (mod n) 227 and y (mod n) 210. In the example we have presented number s for which the value f(s) has only small prime factors. Then we use the congruence (s + m) 2 f(s) (mod n). From those congruences, we select a subset whose products yields squares on the leftand the righthand sides. The lefthand side of each congruence is a square anyway. Also we know the prime factorization of each righthand side. The product of a number of righthand sides is a square if the exponents 1 and all prime factors are even. In the next section, we explain how an appropriate subset of congruences is chosen. 7
8 Table 1: Factor base and sieving # decimal digits of n # factor base in thousand # sieving interval in million Choosing appropriate congruences The selection process is controlled by coefficients λ i {0, 1}. If λ i = 1 the congruence i is chosen; otherwise it is not. The product of the right hand sides of the chosen congruences is ( ) λ1 ( ) λ2 ( ) λ 3 = ( 1) λ1 2 2λ 1+2λ2 3 3λ 1+2λ3 5 λ 1+λ 2 +λ3 7 λ 2+λ 3. We want this number to be a square, so we have to solve the following linear system: λ 1 0 (mod 2) 2λ 1 + 2λ 2 0 (mod 2) 3λ 1 + 2λ 3 0 (mod 2) λ 1 + λ 2 + λ 3 0 (mod 2) λ 2 + λ 3 0 (mod 2). A solution is λ 1 = 0, λ 2 = λ 3 = 1. In general we choose a positive integer B. Then we look for integers s such that f(s) has only prime factors that belong to the factor base F (B) = {p P, p B} { 1}. Such values f(s) are called Bsmooth. If we have found as many values for s as the factor base has elements, then we try to solve the corresponding linear system over Z/2Z. Faster algorithms than Gauss algorithm exist in this case Sieving It remains to be shown how the values of s are found for which f(s) is Bsmooth. One possibility is to compute the value f(s) for s = 0, ±1, ±2,... and to test by trial division whether f(s) is Bsmooth. Unfortunately, those values typically are not Bsmooth. This is very inefficient as the factor base is large for large n (see Tab. 1). A more efficient method is to use sieving techniques, which are described as follows. We explain a simplified version that shows the main idea. We fix a sieving interval S = { C, C+1,..., 0, 1,..., C}. We want to find all s S such that f(s) is Bsmooth. 8
9 To find out which of the values f(s) is divisible by a prime number p in the factor base, we start from the end. We fix a prime p. The equation f(s) 0 (mod p) has two solutions s i,p which can be computed quickly. Then we try to find values s i,p + kp S. After each step, we divide the corresponding f(s) by p. Prime powers can be treated similarly. Example 9. Let n = 7429, m = 86. The factor base is the set {2, 3, 5, 7} { 1}. As sieve interval, we use the set S = { 3,..., 3}. s (s + m) 2 n Sieve with Sieve with Sieve with Sieve with Remark 3. The optimum size of the factor base is roughly B = ( ) 2/4 e log n log(log n) and the sieving interval is in C = B 3. The heuristic running time is L n (1/2, 1). The fastest current algorithm is NFS which is in L n (1/3, (64/9) 1/3 ). 9
U.C. Berkeley CS276: Cryptography Handout 0.1 Luca Trevisan January, 2009. Notes on Algebra
U.C. Berkeley CS276: Cryptography Handout 0.1 Luca Trevisan January, 2009 Notes on Algebra These notes contain as little theory as possible, and most results are stated without proof. Any introductory
More informationFactoring Algorithms
Factoring Algorithms The p 1 Method and Quadratic Sieve November 17, 2008 () Factoring Algorithms November 17, 2008 1 / 12 Fermat s factoring method Fermat made the observation that if n has two factors
More informationPrime Numbers The generation of prime numbers is needed for many public key algorithms:
CA547: CRYPTOGRAPHY AND SECURITY PROTOCOLS 1 7 Number Theory 2 7.1 Prime Numbers Prime Numbers The generation of prime numbers is needed for many public key algorithms: RSA: Need to find p and q to compute
More informationFactoring & Primality
Factoring & Primality Lecturer: Dimitris Papadopoulos In this lecture we will discuss the problem of integer factorization and primality testing, two problems that have been the focus of a great amount
More information(x + a) n = x n + a Z n [x]. Proof. If n is prime then the map
22. A quick primality test Prime numbers are one of the most basic objects in mathematics and one of the most basic questions is to decide which numbers are prime (a clearly related problem is to find
More informationIs n a Prime Number? Manindra Agrawal. March 27, 2006, Delft. IIT Kanpur
Is n a Prime Number? Manindra Agrawal IIT Kanpur March 27, 2006, Delft Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 1 / 47 Overview 1 The Problem 2 Two Simple, and Slow, Methods
More informationAn Overview of Integer Factoring Algorithms. The Problem
An Overview of Integer Factoring Algorithms Manindra Agrawal IITK / NUS The Problem Given an integer n, find all its prime divisors as efficiently as possible. 1 A Difficult Problem No efficient algorithm
More informationIs this number prime? Berkeley Math Circle Kiran Kedlaya
Is this number prime? Berkeley Math Circle 2002 2003 Kiran Kedlaya Given a positive integer, how do you check whether it is prime (has itself and 1 as its only two positive divisors) or composite (not
More informationPrime Numbers. Chapter Primes and Composites
Chapter 2 Prime Numbers The term factoring or factorization refers to the process of expressing an integer as the product of two or more integers in a nontrivial way, e.g., 42 = 6 7. Prime numbers are
More informationCryptography and Network Security Chapter 8
Cryptography and Network Security Chapter 8 Fifth Edition by William Stallings Lecture slides by Lawrie Brown (with edits by RHB) Chapter 8 Introduction to Number Theory The Devil said to Daniel Webster:
More informationRecent Breakthrough in Primality Testing
Nonlinear Analysis: Modelling and Control, 2004, Vol. 9, No. 2, 171 184 Recent Breakthrough in Primality Testing R. Šleževičienė, J. Steuding, S. Turskienė Department of Computer Science, Faculty of Physics
More informationFactoring integers, Producing primes and the RSA cryptosystem HarishChandra Research Institute
RSA cryptosystem HRI, Allahabad, February, 2005 0 Factoring integers, Producing primes and the RSA cryptosystem HarishChandra Research Institute Allahabad (UP), INDIA February, 2005 RSA cryptosystem HRI,
More informationInteger Factorization using the Quadratic Sieve
Integer Factorization using the Quadratic Sieve Chad Seibert* Division of Science and Mathematics University of Minnesota, Morris Morris, MN 56567 seib0060@morris.umn.edu March 16, 2011 Abstract We give
More informationIs n a prime number? Nitin Saxena. Turku, May Centrum voor Wiskunde en Informatica Amsterdam
Is n a prime number? Nitin Saxena Centrum voor Wiskunde en Informatica Amsterdam Turku, May 2007 Nitin Saxena (CWI, Amsterdam) Is n a prime number? Turku, May 2007 1 / 36 Outline 1 The Problem 2 The High
More informationFactoring. Factoring 1
Factoring Factoring 1 Factoring Security of RSA algorithm depends on (presumed) difficulty of factoring o Given N = pq, find p or q and RSA is broken o Rabin cipher also based on factoring Factoring like
More informationb) Find smallest a > 0 such that 2 a 1 (mod 341). Solution: a) Use succesive squarings. We have 85 =
Problem 1. Prove that a b (mod c) if and only if a and b give the same remainders upon division by c. Solution: Let r a, r b be the remainders of a, b upon division by c respectively. Thus a r a (mod c)
More informationSolutions to Practice Problems
Solutions to Practice Problems March 205. Given n = pq and φ(n = (p (q, we find p and q as the roots of the quadratic equation (x p(x q = x 2 (n φ(n + x + n = 0. The roots are p, q = 2[ n φ(n+ ± (n φ(n+2
More information3. QUADRATIC CONGRUENCES
3. QUADRATIC CONGRUENCES 3.1. Quadratics Over a Finite Field We re all familiar with the quadratic equation in the context of real or complex numbers. The formula for the solutions to ax + bx + c = 0 (where
More informationHomework 5 Solutions
Homework 5 Solutions 4.2: 2: a. 321 = 256 + 64 + 1 = (01000001) 2 b. 1023 = 512 + 256 + 128 + 64 + 32 + 16 + 8 + 4 + 2 + 1 = (1111111111) 2. Note that this is 1 less than the next power of 2, 1024, which
More informationArithmetic algorithms for cryptology 5 October 2015, Paris. Sieves. Razvan Barbulescu CNRS and IMJPRG. R. Barbulescu Sieves 0 / 28
Arithmetic algorithms for cryptology 5 October 2015, Paris Sieves Razvan Barbulescu CNRS and IMJPRG R. Barbulescu Sieves 0 / 28 Starting point Notations q prime g a generator of (F q ) X a (secret) integer
More informationFurther linear algebra. Chapter I. Integers.
Further linear algebra. Chapter I. Integers. Andrei Yafaev Number theory is the theory of Z = {0, ±1, ±2,...}. 1 Euclid s algorithm, Bézout s identity and the greatest common divisor. We say that a Z divides
More informationFACTORING. n = 2 25 + 1. fall in the arithmetic sequence
FACTORING The claim that factorization is harder than primality testing (or primality certification) is not currently substantiated rigorously. As some sort of backward evidence that factoring is hard,
More informationNotes on Factoring. MA 206 Kurt Bryan
The General Approach Notes on Factoring MA 26 Kurt Bryan Suppose I hand you n, a 2 digit integer and tell you that n is composite, with smallest prime factor around 5 digits. Finding a nontrivial factor
More informationLecture 13  Basic Number Theory.
Lecture 13  Basic Number Theory. Boaz Barak March 22, 2010 Divisibility and primes Unless mentioned otherwise throughout this lecture all numbers are nonnegative integers. We say that A divides B, denoted
More informationORDERS OF ELEMENTS IN A GROUP
ORDERS OF ELEMENTS IN A GROUP KEITH CONRAD 1. Introduction Let G be a group and g G. We say g has finite order if g n = e for some positive integer n. For example, 1 and i have finite order in C, since
More informationPrimality Testing and Factorization Methods
Primality Testing and Factorization Methods Eli Howey May 27, 2014 Abstract Since the days of Euclid and Eratosthenes, mathematicians have taken a keen interest in finding the nontrivial factors of integers,
More informationPractice Problems for First Test
Mathematicians have tried in vain to this day to discover some order in the sequence of prime numbers, and we have reason to believe that it is a mystery into which the human mind will never penetrate.
More informationHomework until Test #2
MATH31: Number Theory Homework until Test # Philipp BRAUN Section 3.1 page 43, 1. It has been conjectured that there are infinitely many primes of the form n. Exhibit five such primes. Solution. Five such
More informationComputer and Network Security
MIT 6.857 Computer and Networ Security Class Notes 1 File: http://theory.lcs.mit.edu/ rivest/notes/notes.pdf Revision: December 2, 2002 Computer and Networ Security MIT 6.857 Class Notes by Ronald L. Rivest
More informationApplications of Fermat s Little Theorem and Congruences
Applications of Fermat s Little Theorem and Congruences Definition: Let m be a positive integer. Then integers a and b are congruent modulo m, denoted by a b mod m, if m (a b). Example: 3 1 mod 2, 6 4
More informationFactoring Algorithms
Institutionen för Informationsteknologi Lunds Tekniska Högskola Department of Information Technology Lund University Cryptology  Project 1 Factoring Algorithms The purpose of this project is to understand
More informationFaster deterministic integer factorisation
David Harvey (joint work with Edgar Costa, NYU) University of New South Wales 25th October 2011 The obvious mathematical breakthrough would be the development of an easy way to factor large prime numbers
More information2 Primality and Compositeness Tests
Int. J. Contemp. Math. Sciences, Vol. 3, 2008, no. 33, 16351642 On Factoring R. A. Mollin Department of Mathematics and Statistics University of Calgary, Calgary, Alberta, Canada, T2N 1N4 http://www.math.ucalgary.ca/
More informationMathematics is the queen of sciences and number theory is the queen of mathematics.
Number Theory Mathematics is the queen of sciences and number theory is the queen of mathematics. But why is it computer science? It turns out to be critical for cryptography! Carl Friedrich Gauss Division
More informationSolutions to Homework Set 3 (Solutions to Homework Problems from Chapter 2)
Solutions to Homework Set 3 (Solutions to Homework Problems from Chapter 2) Problems from 21 211 Prove that a b (mod n) if and only if a and b leave the same remainder when divided by n Proof Suppose a
More informationI. GROUPS: BASIC DEFINITIONS AND EXAMPLES
I GROUPS: BASIC DEFINITIONS AND EXAMPLES Definition 1: An operation on a set G is a function : G G G Definition 2: A group is a set G which is equipped with an operation and a special element e G, called
More informationRSA and Primality Testing
and Primality Testing Joan Boyar, IMADA, University of Southern Denmark Studieretningsprojekter 2010 1 / 81 Correctness of cryptography cryptography Introduction to number theory Correctness of with 2
More informationMATH 168: FINAL PROJECT Troels Eriksen. 1 Introduction
MATH 168: FINAL PROJECT Troels Eriksen 1 Introduction In the later years cryptosystems using elliptic curves have shown up and are claimed to be just as secure as a system like RSA with much smaller key
More informationFactorization Methods: Very Quick Overview
Factorization Methods: Very Quick Overview Yuval Filmus October 17, 2012 1 Introduction In this lecture we introduce modern factorization methods. We will assume several facts from analytic number theory.
More informationCHAPTER 3 THE NEW MMP CRYPTO SYSTEM. mathematical problems Hidden Root Problem, Discrete Logarithm Problem and
79 CHAPTER 3 THE NEW MMP CRYPTO SYSTEM In this chapter an overview of the new Mixed Mode Paired cipher text Cryptographic System (MMPCS) is given, its three hard mathematical problems are explained, and
More informationMA257: INTRODUCTION TO NUMBER THEORY LECTURE NOTES
MA257: INTRODUCTION TO NUMBER THEORY LECTURE NOTES 2016 47 4. Diophantine Equations A Diophantine Equation is simply an equation in one or more variables for which integer (or sometimes rational) solutions
More informationDiscrete Mathematics, Chapter 4: Number Theory and Cryptography
Discrete Mathematics, Chapter 4: Number Theory and Cryptography Richard Mayr University of Edinburgh, UK Richard Mayr (University of Edinburgh, UK) Discrete Mathematics. Chapter 4 1 / 35 Outline 1 Divisibility
More informationInternational Journal of Information Technology, Modeling and Computing (IJITMC) Vol.1, No.3,August 2013
FACTORING CRYPTOSYSTEM MODULI WHEN THE COFACTORS DIFFERENCE IS BOUNDED Omar Akchiche 1 and Omar Khadir 2 1,2 Laboratory of Mathematics, Cryptography and Mechanics, Fstm, University of Hassan II MohammediaCasablanca,
More informationSmooth numbers and the quadratic sieve
Algorithmic Number Theory MSRI Publications Volume 44, 2008 Smooth numbers and the quadratic sieve CARL POMERANCE ABSTRACT. This article gives a gentle introduction to factoring large integers via the
More informationNUMBER THEORY AMIN WITNO
NUMBER THEORY AMIN WITNO ii Number Theory Amin Witno Department of Basic Sciences Philadelphia University JORDAN 19392 Originally written for Math 313 students at Philadelphia University in Jordan, this
More informationTHE MATHEMATICS OF PUBLIC KEY CRYPTOGRAPHY.
THE MATHEMATICS OF PUBLIC KEY CRYPTOGRAPHY. IAN KIMING 1. Forbemærkning. Det kan forekomme idiotisk, at jeg som dansktalende og skrivende i et danskbaseret tidsskrift med en (formentlig) primært dansktalende
More informationCryptography and Network Security Number Theory
Cryptography and Network Security Number Theory XiangYang Li Introduction to Number Theory Divisors b a if a=mb for an integer m b a and c b then c a b g and b h then b (mg+nh) for any int. m,n Prime
More information3. Applications of Number Theory
3. APPLICATIONS OF NUMBER THEORY 163 3. Applications of Number Theory 3.1. Representation of Integers. Theorem 3.1.1. Given an integer b > 1, every positive integer n can be expresses uniquely as n = a
More informationToday s Topics. Primes & Greatest Common Divisors
Today s Topics Primes & Greatest Common Divisors Prime representations Important theorems about primality Greatest Common Divisors Least Common Multiples Euclid s algorithm Once and for all, what are prime
More informationComputational Number Theory
Computational Number Theory C. Pomerance 1 Introduction Historically, computation has been a driving force in the development of mathematics. To help measure the sizes of their fields, the Egyptians invented
More informationBreaking The Code. Ryan Lowe. Ryan Lowe is currently a Ball State senior with a double major in Computer Science and Mathematics and
Breaking The Code Ryan Lowe Ryan Lowe is currently a Ball State senior with a double major in Computer Science and Mathematics and a minor in Applied Physics. As a sophomore, he took an independent study
More informationAlgebra for Digital Communication
EPFL  Section de Mathématiques Algebra for Digital Communication Fall semester 2008 Solutions for exercise sheet 1 Exercise 1. i) We will do a proof by contradiction. Suppose 2 a 2 but 2 a. We will obtain
More information10 k + pm pm. 10 n p q = 2n 5 n p 2 a 5 b q = p
Week 7 Summary Lecture 13 Suppose that p and q are integers with gcd(p, q) = 1 (so that the fraction p/q is in its lowest terms) and 0 < p < q (so that 0 < p/q < 1), and suppose that q is not divisible
More informationit is easy to see that α = a
21. Polynomial rings Let us now turn out attention to determining the prime elements of a polynomial ring, where the coefficient ring is a field. We already know that such a polynomial ring is a UF. Therefore
More informationFactoring integers, Producing primes and the RSA cryptosystem
Factoring integers,..., RSA Erbil, Kurdistan 0 Lecture in Number Theory College of Sciences Department of Mathematics University of Salahaddin Debember 1, 2014 Factoring integers, Producing primes and
More informationContinued fractions and good approximations.
Continued fractions and good approximations We will study how to find good approximations for important real life constants A good approximation must be both accurate and easy to use For instance, our
More informationLecture 13: Factoring Integers
CS 880: Quantum Information Processing 0/4/0 Lecture 3: Factoring Integers Instructor: Dieter van Melkebeek Scribe: Mark Wellons In this lecture, we review order finding and use this to develop a method
More informationSTRUCTURE AND RANDOMNESS IN THE PRIME NUMBERS. 1. Introduction. The prime numbers 2, 3, 5, 7,... are one of the oldest topics studied in mathematics.
STRUCTURE AND RANDOMNESS IN THE PRIME NUMBERS TERENCE TAO Abstract. A quick tour through some topics in analytic prime number theory.. Introduction The prime numbers 2, 3, 5, 7,... are one of the oldest
More information3. Computational Complexity.
3. Computational Complexity. (A) Introduction. As we will see, most cryptographic systems derive their supposed security from the presumed inability of any adversary to crack certain (number theoretic)
More information11 Ideals. 11.1 Revisiting Z
11 Ideals The presentation here is somewhat different than the text. In particular, the sections do not match up. We have seen issues with the failure of unique factorization already, e.g., Z[ 5] = O Q(
More informationAlgebra 2. Rings and fields. Finite fields. A.M. Cohen, H. Cuypers, H. Sterk. Algebra Interactive
2 Rings and fields A.M. Cohen, H. Cuypers, H. Sterk A.M. Cohen, H. Cuypers, H. Sterk 2 September 25, 2006 1 / 20 For p a prime number and f an irreducible polynomial of degree n in (Z/pZ)[X ], the quotient
More informationThe Prime Numbers. Definition. A prime number is a positive integer with exactly two positive divisors.
The Prime Numbers Before starting our study of primes, we record the following important lemma. Recall that integers a, b are said to be relatively prime if gcd(a, b) = 1. Lemma (Euclid s Lemma). If gcd(a,
More informationComputing exponents modulo a number: Repeated squaring
Computing exponents modulo a number: Repeated squaring How do you compute (1415) 13 mod 2537 = 2182 using just a calculator? Or how do you check that 2 340 mod 341 = 1? You can do this using the method
More information8 Primes and Modular Arithmetic
8 Primes and Modular Arithmetic 8.1 Primes and Factors Over two millennia ago already, people all over the world were considering the properties of numbers. One of the simplest concepts is prime numbers.
More informationOn Generalized Fermat Numbers 3 2n +1
Applied Mathematics & Information Sciences 4(3) (010), 307 313 An International Journal c 010 Dixie W Publishing Corporation, U. S. A. On Generalized Fermat Numbers 3 n +1 Amin Witno Department of Basic
More informationCONTINUED FRACTIONS AND FACTORING. Niels Lauritzen
CONTINUED FRACTIONS AND FACTORING Niels Lauritzen ii NIELS LAURITZEN DEPARTMENT OF MATHEMATICAL SCIENCES UNIVERSITY OF AARHUS, DENMARK EMAIL: niels@imf.au.dk URL: http://home.imf.au.dk/niels/ Contents
More informationThe van Hoeij Algorithm for Factoring Polynomials
The van Hoeij Algorithm for Factoring Polynomials Jürgen Klüners Abstract In this survey we report about a new algorithm for factoring polynomials due to Mark van Hoeij. The main idea is that the combinatorial
More informationPYTHAGOREAN TRIPLES PETE L. CLARK
PYTHAGOREAN TRIPLES PETE L. CLARK 1. Parameterization of Pythagorean Triples 1.1. Introduction to Pythagorean triples. By a Pythagorean triple we mean an ordered triple (x, y, z) Z 3 such that x + y =
More informationSUBGROUPS OF CYCLIC GROUPS. 1. Introduction In a group G, we denote the (cyclic) group of powers of some g G by
SUBGROUPS OF CYCLIC GROUPS KEITH CONRAD 1. Introduction In a group G, we denote the (cyclic) group of powers of some g G by g = {g k : k Z}. If G = g, then G itself is cyclic, with g as a generator. Examples
More informationProblem Set 7  Fall 2008 Due Tuesday, Oct. 28 at 1:00
18.781 Problem Set 7  Fall 2008 Due Tuesday, Oct. 28 at 1:00 Throughout this assignment, f(x) always denotes a polynomial with integer coefficients. 1. (a) Show that e 32 (3) = 8, and write down a list
More informationPRIMES is in P. Manindra Agrawal Neeraj Kayal Nitin Saxena
PRIMES is in P Manindra Agrawal Neeraj Kayal Nitin Saxena Department of Computer Science & Engineering Indian Institute of Technology Kanpur Kanpur208016, INDIA Email: {manindra,kayaln,nitinsa}@iitk.ac.in
More informationThe cyclotomic polynomials
The cyclotomic polynomials Notes by G.J.O. Jameson 1. The definition and general results We use the notation e(t) = e 2πit. Note that e(n) = 1 for integers n, e(s + t) = e(s)e(t) for all s, t. e( 1 ) =
More informationPrime numbers and prime polynomials. Paul Pollack Dartmouth College
Prime numbers and prime polynomials Paul Pollack Dartmouth College May 1, 2008 Analogies everywhere! Analogies in elementary number theory (continued fractions, quadratic reciprocity, Fermat s last theorem)
More informationIntroduction to Finite Fields (cont.)
Chapter 6 Introduction to Finite Fields (cont.) 6.1 Recall Theorem. Z m is a field m is a prime number. Theorem (Subfield Isomorphic to Z p ). Every finite field has the order of a power of a prime number
More informationGREATEST COMMON DIVISOR
DEFINITION: GREATEST COMMON DIVISOR The greatest common divisor (gcd) of a and b, denoted by (a, b), is the largest common divisor of integers a and b. THEOREM: If a and b are nonzero integers, then their
More informationELLIPTIC CURVES AND LENSTRA S FACTORIZATION ALGORITHM
ELLIPTIC CURVES AND LENSTRA S FACTORIZATION ALGORITHM DANIEL PARKER Abstract. This paper provides a foundation for understanding Lenstra s Elliptic Curve Algorithm for factoring large numbers. We give
More informationThe Dirichlet Unit Theorem
Chapter 6 The Dirichlet Unit Theorem As usual, we will be working in the ring B of algebraic integers of a number field L. Two factorizations of an element of B are regarded as essentially the same if
More informationModule MA3411: Abstract Algebra Galois Theory Appendix Michaelmas Term 2013
Module MA3411: Abstract Algebra Galois Theory Appendix Michaelmas Term 2013 D. R. Wilkins Copyright c David R. Wilkins 1997 2013 Contents A Cyclotomic Polynomials 79 A.1 Minimum Polynomials of Roots of
More informationFACTORING IN QUADRATIC FIELDS. 1. Introduction. This is called a quadratic field and it has degree 2 over Q. Similarly, set
FACTORING IN QUADRATIC FIELDS KEITH CONRAD For a squarefree integer d other than 1, let 1. Introduction K = Q[ d] = {x + y d : x, y Q}. This is called a quadratic field and it has degree 2 over Q. Similarly,
More informationON INTEGERS EXPRESSIBLE BY SOME SPECIAL LINEAR FORM
Acta Math. Univ. Comenianae Vol. LXXXI, (01), pp. 03 09 03 ON INTEGERS EXPRESSIBLE BY SOME SPECIAL LINEAR FORM A. DUBICKAS and A. NOVIKAS Abstract. Let E(4) be the set of positive integers expressible
More informationMTH 382 Number Theory Spring 2003 Practice Problems for the Final
MTH 382 Number Theory Spring 2003 Practice Problems for the Final (1) Find the quotient and remainder in the Division Algorithm, (a) with divisor 16 and dividend 95, (b) with divisor 16 and dividend 95,
More informationH/wk 13, Solutions to selected problems
H/wk 13, Solutions to selected problems Ch. 4.1, Problem 5 (a) Find the number of roots of x x in Z 4, Z Z, any integral domain, Z 6. (b) Find a commutative ring in which x x has infinitely many roots.
More informationRevised Version of Chapter 23. We learned long ago how to solve linear congruences. ax c (mod m)
Chapter 23 Squares Modulo p Revised Version of Chapter 23 We learned long ago how to solve linear congruences ax c (mod m) (see Chapter 8). It s now time to take the plunge and move on to quadratic equations.
More informationOn the generation of elliptic curves with 16 rational torsion points by Pythagorean triples
On the generation of elliptic curves with 16 rational torsion points by Pythagorean triples Brian Hilley Boston College MT695 Honors Seminar March 3, 2006 1 Introduction 1.1 Mazur s Theorem Let C be a
More information= 2 + 1 2 2 = 3 4, Now assume that P (k) is true for some fixed k 2. This means that
Instructions. Answer each of the questions on your own paper, and be sure to show your work so that partial credit can be adequately assessed. Credit will not be given for answers (even correct ones) without
More informationMA2C03 Mathematics School of Mathematics, Trinity College Hilary Term 2016 Lecture 59 (April 1, 2016) David R. Wilkins
MA2C03 Mathematics School of Mathematics, Trinity College Hilary Term 2016 Lecture 59 (April 1, 2016) David R. Wilkins The RSA encryption scheme works as follows. In order to establish the necessary public
More informationMathematics of Cryptography
Number Theory Modular Arithmetic: Two numbers equivalent mod n if their difference is multiple of n example: 7 and 10 are equivalent mod 3 but not mod 4 7 mod 3 10 mod 3 = 1; 7 mod 4 = 3, 10 mod 4 = 2.
More informationPrime and Composite Terms in Sloane s Sequence A056542
1 2 3 47 6 23 11 Journal of Integer Sequences, Vol. 8 (2005), Article 05.3.3 Prime and Composite Terms in Sloane s Sequence A056542 Tom Müller Institute for CusanusResearch University and Theological
More informationOrders Modulo A Prime
Orders Modulo A Prime Evan Chen March 6, 2015 In this article I develop the notion of the order of an element modulo n, and use it to prove the famous n 2 + 1 lemma as well as a generalization to arbitrary
More informationAPPLICATIONS OF THE ORDER FUNCTION
APPLICATIONS OF THE ORDER FUNCTION LECTURE NOTES: MATH 432, CSUSM, SPRING 2009. PROF. WAYNE AITKEN In this lecture we will explore several applications of order functions including formulas for GCDs and
More informationMath 453: Elementary Number Theory Definitions and Theorems
Math 453: Elementary Number Theory Definitions and Theorems (Class Notes, Spring 2011 A.J. Hildebrand) Version 542011 Contents About these notes 3 1 Divisibility and Factorization 4 1.1 Divisibility.......................................
More informationMonogenic Fields and Power Bases Michael Decker 12/07/07
Monogenic Fields and Power Bases Michael Decker 12/07/07 1 Introduction Let K be a number field of degree k and O K its ring of integers Then considering O K as a Zmodule, the nicest possible case is
More informationALGEBRAIC APPROACH TO COMPOSITE INTEGER FACTORIZATION
ALGEBRAIC APPROACH TO COMPOSITE INTEGER FACTORIZATION Aldrin W. Wanambisi 1* School of Pure and Applied Science, Mount Kenya University, P.O box 55350100, Kakamega, Kenya. Shem Aywa 2 Department of Mathematics,
More informationThe Sieve ReImagined: Integer Factorization Methods
The Sieve ReImagined: Integer Factorization Methods by Jennifer Smith A research paper presented to the University of Waterloo in partial fulfillment of the requirement for the degree of Master of Mathematics
More informationELEMENTARY THOUGHTS ON DISCRETE LOGARITHMS. Carl Pomerance
ELEMENTARY THOUGHTS ON DISCRETE LOGARITHMS Carl Pomerance Given a cyclic group G with generator g, and given an element t in G, the discrete logarithm problem is that of computing an integer l with g l
More informationLectures on Number Theory. LarsÅke Lindahl
Lectures on Number Theory LarsÅke Lindahl 2002 Contents 1 Divisibility 1 2 Prime Numbers 7 3 The Linear Diophantine Equation ax+by=c 12 4 Congruences 15 5 Linear Congruences 19 6 The Chinese Remainder
More informationElementary Number Theory
Elementary Number Theory A revision by Jim Hefferon, St Michael s College, 2003Dec of notes by W. Edwin Clark, University of South Florida, 2002Dec L A TEX source compiled on January 5, 2004 by Jim Hefferon,
More information2.1 Complexity Classes
15859(M): Randomized Algorithms Lecturer: Shuchi Chawla Topic: Complexity classes, Identity checking Date: September 15, 2004 Scribe: Andrew Gilpin 2.1 Complexity Classes In this lecture we will look
More informationCHAPTER SIX IRREDUCIBILITY AND FACTORIZATION 1. BASIC DIVISIBILITY THEORY
January 10, 2010 CHAPTER SIX IRREDUCIBILITY AND FACTORIZATION 1. BASIC DIVISIBILITY THEORY The set of polynomials over a field F is a ring, whose structure shares with the ring of integers many characteristics.
More informationSOLUTIONS FOR PROBLEM SET 2
SOLUTIONS FOR PROBLEM SET 2 A: There exist primes p such that p+6k is also prime for k = 1,2 and 3. One such prime is p = 11. Another such prime is p = 41. Prove that there exists exactly one prime p such
More information