Primality - Factorization

Save this PDF as:

Size: px
Start display at page:

Transcription

1 Primality - Factorization Christophe Ritzenthaler November 9, Prime and factorization Definition 1.1. An integer p > 1 is called a prime number (nombre premier) if it has only 1 and p as divisors. Example 1. There are infinitely many prime numbers. The biggest generic one is ((((((((( ) ) 3 + 6) ) ) ) ) ) ) Interested readers may read http: // www. cs. uwaterloo. ca/ journals/ JIS/ VOL8/ Caldwell/ caldwell78. html for the origin of this number. It has 20,562 decimal digits and the proof was built using fastecpp on several networks of workstations. We will write P the set of prime numbers. To estimate the efficiency of some algorithms, we need results on density of primes. Theorem 1.1. Let π(x) = #{p x prime}. One has π(x) x log x. Let n 2 be an integer and c an integer prime to n. Let π n,c (x) = #{p x prime, p = kn + c}. One has π n,c (x) 1 x φ(n) log x. To find a prime number, the number of attempts is then of the size of x. Indeed, the probability to fail in k attempts is (1 1/ log(x)) k so the probability to succeed which is closed to 1 for any k = log(x) 1+ɛ. 1 (1 1/ log(x)) k k/ log(x) 1 e Remark 1. For x 17, one has π(x) > x/ log x and for x > 1 one has π(x) < (x/ log x). Let us finish with the fundamental result. 1

2 Theorem 1.2. Every integer a > 1 can be written as the product of prime numbers a = p P p e(p) with e(p) 0 and e(p) = 0 except for finitely many primes p. Up to permutation, the factors in this product are uniquely determined. 2 Prime numbers To produce big prime numbers is very important for cryptographic applications. For a given n, there is no generic algorithm which can compute a random prime number less than n. However a result by Hadamard and de la Vallée Poussin shows that #{p n prime} n log n (see 1). So the usual method is to pick random numbers and to test if they are prime or not. This requests that we have fast algorithms to test primality. 2.1 Primality test Trial division The simplest algorithm is based on the following result. Proposition 2.1. n is a composite number if and only if it has a prime divisor p such that p n. Proof. Since n is composite, n = ab and either a or b is smaller than n. This proposition suggests that one can try all prime numbers less or equal to n using Eratosthenes sieve. Following the estimate density of prime (see 1), it means that we make up to n/ log n divisions, leading to an exponential algorithm in O(e ( 1 2 ɛ) log n ) Fermat test and Carmichael numbers By Fermat little theorem, one knows that if n is a prime number then a n 1 1 (mod n) for all a Z coprime with n. If the theorem was an equivalence, we would have an easy polynomial algorithm to test if a number is a prime. Unfortunately Example 2. Consider n = 341 = One has (mod 341). Such a number is called pseudo-prime (pseudo-premier) in base 2. We can prove that there are infinitely many pseudo-primes in base 2 by showing that if n is such a number then 2 n 1 also. Indeed because n is a pseudo-prime in base 2 one has n 2 n 1 1, i.e. there is c such that nc = 2 n 1 1. Now The last expression is divisible by 2 n 1 so 2 2n = 2 2(2n 1 1) 1 = 2 2nc n (mod 2 n 1). 2

3 To finish the proof, one has to show that 2 n 1 is not a prime. Since n = ab, 2 n 1 is divisible by 2 a 1. An idea is then to change the value of a : for instance (mod 341). Unfortunately, there are numbers that are pseudo-prime in any base. Such numbers are called Carmichael numbers (for instance 561 = ). It has been shown by Alford, Granville and Pomerance in 1994 that there are infinitely many Carmichael numbers so Fermat test cannot be completely sure. Let us show some properties of these numbers. Proposition 2.2. An (odd) composite number n 3 is a Carmichael number if and only if it is square free and for each prime divisor p of n, p 1 divides n 1. Proof. First it is easy to see that a Carmichael number is odd : indeed ( 1) n 1 1 (mod n) if and only if n is odd. Let a be a Carmichael number, for any a prime to n one has a n 1 1 (mod n). Let p be a prime divisor of n. There exists a primitive element modulo p that is prime to n. Indeed, let a a primitive element modulo p and n = p r m with m coprime to p. There exists an element (still denoted a) in Z/p r Z lifting the initial a (because the morphism Z/p r Z Z/pZ est surjectif). We find s Z/mZ coprime to m and since Z/nZ Z/p r Z Z/mZ we construct the element a Z/nZ image of (a, s). Such an element satisfies the properties for a. Now, one has of course a n 1 1 (mod p) but as a is primitive p 1 divides n 1. Now suppose that n = p 2 m and write a = 1 + pm. One has a p 1 + p 2 m (mod n) So the order of a is p. But p does not divide n 1 (p n) so we get a contradiction. Conversely, let n be a square-free integer such that p 1 divides n 1 for all prime divisors p of n. Let a be prime to n one has and because n 1 is a multiple of p 1, a p 1 1 (mod p) a n 1 1 (mod p). Using the Chinese Remainder theorem for all the factors p, one gets a n 1 1 (mod n). Corollary 2.1. Any Carmichael number is the product of at least 3 distinct odd primes. 3

4 Proof. Because a Carmichael number is without square factor and is not prime it has at least two prime factors. Let us assume that n = pq with p < q. Then q 1 divides pq 1 = p(q 1) + p 1 so q 1 divides p 1. Absurd. Example 3. Show that if 6m + 1, 12m + 1 and 18m + 1 are primes then n = (6m + 1)(12m+1)(18m+1) is a Carmichael number. First by the Chinese Remainder theorem, one can see that if n = ab with a, b coprime then for any x prime to n one has x lcm(φ(a),φ(b)) 1 (mod n). Now lcm(φ(6m + 1), φ(12m + 1), φ(18m + 1)) = 36m and also 36m n 1. One can check that 1729 is such a number Lucas test Let n > 1 be an integer. We will show that if there exists an a such that a n 1 1 (mod n) and a q 1 (mod n) for all q n 1, q n 1, then n is prime. This is a very good test for Fermat numbers F m, i.e. numbers of the form n = 2 2m + 1 (For m = only the first five are prime. F 33 is so big that it may be many years before we can decide its nature). But obviously this test is not good for a generic prime since we must know the factorization of n 1. Let assume that such an a exists and let d be the order of a in (Z/nZ). Since a n 1 1 (mod n), d (n 1). More exactly as no proper divisor of n 1 is the order of a, one has d = n 1. Now n 1 = d φ(n). This is possible only if n is prime Rabin-Miller test Contrary to the Fermat test, the Miller-Rabin test can prove the compositeness of any composite number (i.e. there is no analog of Carmichael numbers for this test). But Rabin-Miller test is a Monte-Carlo algorithm : it always stops ; if it answers yes, the number is composite and if it answers no then the answer is correct with a probability greater than 3/4. Let n be an odd positive integer and s = max{r N, 2 r n 1}. Let d = (n 1)/2 s. Lemma 2.1 (Miller). If n is a prime and if a is an integer prime to n then we have either a d 1 (mod n) or there exists r {0,..., s 1} such that a 2rd 1 (mod n). Proof. The order of a is a divisor of n 1. It can be d and then a d 1 (mod n). If it is not then its order is 2 r d for r {1,..., s}. So a 2rd 1 (mod n) and a 2r 1d is a non-trivial square root of 1 so a 2r 1d 1 (mod n). If we find an a which is prime to n and that satisfies neither of the conditions, then n is composite. Such an integer a is called a witness (témoin) for the compositeness of n. Example 4. Let n = 561. a = 2 is a witness for n. Indeed here s = 4, d = 35 and (mod 561), (mod 561), (mod 561), (mod 561). 4

5 For the efficiency of the Rabin-Miller test, it is important that there are sufficiently many witnesses for the compositeness of a composite number. Theorem 2.1 (Rabin). If n 3 is an odd composite number, then the set {1,..., n 1} contains at most (n 1)/4 numbers that are prime to n and not witnesses for the compositeness of n. Proof. Let k be the maximum value of r for which there is an integer a prime to n that satisfies the second identity. We set m = 2 k d. Let n = p pe(p) be the prime factorization of n. Let J = {a : gcd(a, n) = 1, a n 1 1 (mod n)} K = {a : gcd(a, n) = 1, a m ±1 (mod p e(p) ) for all p n} L = {a : gcd(a, n) = 1, a m ±1 (mod n)} M = {a : gcd(a, n) = 1, a m 1 (mod n)}. We have M L K J (Z/nZ). For each a which is not a witness for the compositeness of n, the residue class a belongs to L. We will prove that the index of L in (Z/nZ) is at least four. The index of M in K is a power of 2. Indeed one can write M K M x x x 2. Let denote I the image of the morphism s : x x 2 from the multiplicative group K. s has kernel a group of order 2 j for some j so #I = #K/2 j. Now since #I divides #M we can write #M = #I a and [K : M] = 2 j /t and is a power of 2. Let s say 2 j. If j 2 then we are finished. If j = 1 (i.e. [L : K] = 2) then n has two prime divisors. It follows from Cor. 2.1 that n is not a Carmichael number. This implies that J is a proper subgroup of (Z/nZ) and the index of J in (Z/nZ) is at least 2. Therefore the index of L in (Z/nZ) is at least 4. Finally, let j = 0. Then n is a prime power, say n = p e with e > 1. But φ : (Z/nZ) Z/(p 1)Z Z/p e 1 Z is an isomorphism. As n 1 is prime to p a n 1 1 (mod n) if and only if φ(a) = (µ, 0). So [(Z/nZ) : J] = #Z/p e 1 Z = p e 1. This is bigger than 4 except for n = 9 which can be checked by hand. To apply the Rabin-Miller test, we choose a random number a {2,..., n 1}. If gcd(a, n) > 1 then n is composite. Otherwise we compute a d, a 2d,..., a 2s 1d. If we find a witness for the compositeness of n, then we have proved that n is composite. By Th. 2.1, the probability that n is composite and that a is not a witness is less than 1/4. So if we repeat the test t times we can make this probability less than (1/4) t. For t = 10 this probability is less than Remark 2. Under the Generalized Riemann hypothesis (which is conjectural but believed true), it can be proved that there is always a witness for the compositeness of n with 5

6 a O((log n) 2 ). If we want a absolute test, Adleman, Pomerance, Rumely, Cohen and Lenstra have given an algorithm (APRCL) which is slower but still feasible on numbers of 1000 digits (it runs in O( n C log log n 2 2 )). In 2002, M. Agrawal, N. Kayal and N. Saxena have found a deterministic polynomial algorithm to solve the problem of primality. 3 Factorization Now given an n that is known to be composite, how can we find its decomposition in prime factors? We are going to present algorithms to obtain a non-trivial factor. By repeating inductively the algorithm, we can then factorize the number. 3.1 Trial division To find small prime factors of n, a precomputed table of all prime numbers below a fixed bound B is computed. This can be done using the sieve of Eratosthenes. A typical bound is B = Example 5. We want to factor n = Trial division with primes less than 50 yields the factors 2 2, 7 2, 43. If we divide n by those factors, we obtain m = Since 2 m (mod m), this number is still composite. 3.2 Pollard p 1 method This algorithm is efficient when n has a prime factor p such that p 1 has only small prime divisors. Indeed, by Fermat s little theorem, one has a k 1 (mod p) for all multiple k of p 1. If p 1 has only small prime divisors, one can try k = q P,q e B q e where B is a given bound. Now if a k 1 is not divisible by n, then gcd(a k 1, n) is a non-trivial factor of n. Example 6. Let n = of the previous example. We set B = 13. Then k = and gcd(2 k 1, n) = 547. So n = which are both prime numbers. 6

7 3.3 Quadratic sieve Idea The quadratic sieve finds integer x, y such that and x 2 y 2 (mod n) x ±y (mod n). Then n is a divisor of x 2 y 2 = (x y)(x + y) but of neither x y or x + y. Hence g = gcd(x y, n) is a proper divisor of n. Example 7. Let n = 7429, x = 227, y = 210. Then x 2 y 2 = n, x y = 17 so 17 n Determination of x and y The idea from the previous section is also used in other factoring algorithms, such as the number field sieve (NFS), but those algorithms have different ways of finding x, y. We describe how x, y are found in the quadratic sieve. Let m = n and f(x) = (X + m) 2 n. We first explain the procedure on an example. Example 8. Let n = Then m = 86. One has This implies f( 3) = = 540 = , f(1) = = 140 = , f(2) = = 315 = (mod 7429), (mod 7429), (mod 7429). If the last two congruences are multiplied then we obtain (87 88) 2 ( ) 2 (mod n). Therefore we can set x (mod n) 227 and y (mod n) 210. In the example we have presented number s for which the value f(s) has only small prime factors. Then we use the congruence (s + m) 2 f(s) (mod n). From those congruences, we select a subset whose products yields squares on the leftand the right-hand sides. The left-hand side of each congruence is a square anyway. Also we know the prime factorization of each right-hand side. The product of a number of right-hand sides is a square if the exponents 1 and all prime factors are even. In the next section, we explain how an appropriate subset of congruences is chosen. 7

8 Table 1: Factor base and sieving # decimal digits of n # factor base in thousand # sieving interval in million Choosing appropriate congruences The selection process is controlled by coefficients λ i {0, 1}. If λ i = 1 the congruence i is chosen; otherwise it is not. The product of the right hand sides of the chosen congruences is ( ) λ1 ( ) λ2 ( ) λ 3 = ( 1) λ1 2 2λ 1+2λ2 3 3λ 1+2λ3 5 λ 1+λ 2 +λ3 7 λ 2+λ 3. We want this number to be a square, so we have to solve the following linear system: λ 1 0 (mod 2) 2λ 1 + 2λ 2 0 (mod 2) 3λ 1 + 2λ 3 0 (mod 2) λ 1 + λ 2 + λ 3 0 (mod 2) λ 2 + λ 3 0 (mod 2). A solution is λ 1 = 0, λ 2 = λ 3 = 1. In general we choose a positive integer B. Then we look for integers s such that f(s) has only prime factors that belong to the factor base F (B) = {p P, p B} { 1}. Such values f(s) are called B-smooth. If we have found as many values for s as the factor base has elements, then we try to solve the corresponding linear system over Z/2Z. Faster algorithms than Gauss algorithm exist in this case Sieving It remains to be shown how the values of s are found for which f(s) is B-smooth. One possibility is to compute the value f(s) for s = 0, ±1, ±2,... and to test by trial division whether f(s) is B-smooth. Unfortunately, those values typically are not B-smooth. This is very inefficient as the factor base is large for large n (see Tab. 1). A more efficient method is to use sieving techniques, which are described as follows. We explain a simplified version that shows the main idea. We fix a sieving interval S = { C, C+1,..., 0, 1,..., C}. We want to find all s S such that f(s) is B-smooth. 8

9 To find out which of the values f(s) is divisible by a prime number p in the factor base, we start from the end. We fix a prime p. The equation f(s) 0 (mod p) has two solutions s i,p which can be computed quickly. Then we try to find values s i,p + kp S. After each step, we divide the corresponding f(s) by p. Prime powers can be treated similarly. Example 9. Let n = 7429, m = 86. The factor base is the set {2, 3, 5, 7} { 1}. As sieve interval, we use the set S = { 3,..., 3}. s (s + m) 2 n Sieve with Sieve with Sieve with Sieve with Remark 3. The optimum size of the factor base is roughly B = ( ) 2/4 e log n log(log n) and the sieving interval is in C = B 3. The heuristic running time is L n (1/2, 1). The fastest current algorithm is NFS which is in L n (1/3, (64/9) 1/3 ). 9

U.C. Berkeley CS276: Cryptography Handout 0.1 Luca Trevisan January, 2009. Notes on Algebra

U.C. Berkeley CS276: Cryptography Handout 0.1 Luca Trevisan January, 2009 Notes on Algebra These notes contain as little theory as possible, and most results are stated without proof. Any introductory

Factoring Algorithms

Factoring Algorithms The p 1 Method and Quadratic Sieve November 17, 2008 () Factoring Algorithms November 17, 2008 1 / 12 Fermat s factoring method Fermat made the observation that if n has two factors

Prime Numbers The generation of prime numbers is needed for many public key algorithms:

CA547: CRYPTOGRAPHY AND SECURITY PROTOCOLS 1 7 Number Theory 2 7.1 Prime Numbers Prime Numbers The generation of prime numbers is needed for many public key algorithms: RSA: Need to find p and q to compute

Factoring & Primality

Factoring & Primality Lecturer: Dimitris Papadopoulos In this lecture we will discuss the problem of integer factorization and primality testing, two problems that have been the focus of a great amount

(x + a) n = x n + a Z n [x]. Proof. If n is prime then the map

22. A quick primality test Prime numbers are one of the most basic objects in mathematics and one of the most basic questions is to decide which numbers are prime (a clearly related problem is to find

Is n a Prime Number? Manindra Agrawal. March 27, 2006, Delft. IIT Kanpur

Is n a Prime Number? Manindra Agrawal IIT Kanpur March 27, 2006, Delft Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 1 / 47 Overview 1 The Problem 2 Two Simple, and Slow, Methods

An Overview of Integer Factoring Algorithms. The Problem

An Overview of Integer Factoring Algorithms Manindra Agrawal IITK / NUS The Problem Given an integer n, find all its prime divisors as efficiently as possible. 1 A Difficult Problem No efficient algorithm

Is this number prime? Berkeley Math Circle Kiran Kedlaya

Is this number prime? Berkeley Math Circle 2002 2003 Kiran Kedlaya Given a positive integer, how do you check whether it is prime (has itself and 1 as its only two positive divisors) or composite (not

Prime Numbers. Chapter Primes and Composites

Chapter 2 Prime Numbers The term factoring or factorization refers to the process of expressing an integer as the product of two or more integers in a nontrivial way, e.g., 42 = 6 7. Prime numbers are

Cryptography and Network Security Chapter 8

Cryptography and Network Security Chapter 8 Fifth Edition by William Stallings Lecture slides by Lawrie Brown (with edits by RHB) Chapter 8 Introduction to Number Theory The Devil said to Daniel Webster:

Recent Breakthrough in Primality Testing

Nonlinear Analysis: Modelling and Control, 2004, Vol. 9, No. 2, 171 184 Recent Breakthrough in Primality Testing R. Šleževičienė, J. Steuding, S. Turskienė Department of Computer Science, Faculty of Physics

Factoring integers, Producing primes and the RSA cryptosystem Harish-Chandra Research Institute

RSA cryptosystem HRI, Allahabad, February, 2005 0 Factoring integers, Producing primes and the RSA cryptosystem Harish-Chandra Research Institute Allahabad (UP), INDIA February, 2005 RSA cryptosystem HRI,

Integer Factorization using the Quadratic Sieve

Integer Factorization using the Quadratic Sieve Chad Seibert* Division of Science and Mathematics University of Minnesota, Morris Morris, MN 56567 seib0060@morris.umn.edu March 16, 2011 Abstract We give

Is n a prime number? Nitin Saxena. Turku, May Centrum voor Wiskunde en Informatica Amsterdam

Is n a prime number? Nitin Saxena Centrum voor Wiskunde en Informatica Amsterdam Turku, May 2007 Nitin Saxena (CWI, Amsterdam) Is n a prime number? Turku, May 2007 1 / 36 Outline 1 The Problem 2 The High

Factoring. Factoring 1

Factoring Factoring 1 Factoring Security of RSA algorithm depends on (presumed) difficulty of factoring o Given N = pq, find p or q and RSA is broken o Rabin cipher also based on factoring Factoring like

b) Find smallest a > 0 such that 2 a 1 (mod 341). Solution: a) Use succesive squarings. We have 85 =

Problem 1. Prove that a b (mod c) if and only if a and b give the same remainders upon division by c. Solution: Let r a, r b be the remainders of a, b upon division by c respectively. Thus a r a (mod c)

Solutions to Practice Problems

Solutions to Practice Problems March 205. Given n = pq and φ(n = (p (q, we find p and q as the roots of the quadratic equation (x p(x q = x 2 (n φ(n + x + n = 0. The roots are p, q = 2[ n φ(n+ ± (n φ(n+2

3. QUADRATIC CONGRUENCES 3.1. Quadratics Over a Finite Field We re all familiar with the quadratic equation in the context of real or complex numbers. The formula for the solutions to ax + bx + c = 0 (where

Homework 5 Solutions

Homework 5 Solutions 4.2: 2: a. 321 = 256 + 64 + 1 = (01000001) 2 b. 1023 = 512 + 256 + 128 + 64 + 32 + 16 + 8 + 4 + 2 + 1 = (1111111111) 2. Note that this is 1 less than the next power of 2, 1024, which

Arithmetic algorithms for cryptology 5 October 2015, Paris. Sieves. Razvan Barbulescu CNRS and IMJ-PRG. R. Barbulescu Sieves 0 / 28

Arithmetic algorithms for cryptology 5 October 2015, Paris Sieves Razvan Barbulescu CNRS and IMJ-PRG R. Barbulescu Sieves 0 / 28 Starting point Notations q prime g a generator of (F q ) X a (secret) integer

Further linear algebra. Chapter I. Integers.

Further linear algebra. Chapter I. Integers. Andrei Yafaev Number theory is the theory of Z = {0, ±1, ±2,...}. 1 Euclid s algorithm, Bézout s identity and the greatest common divisor. We say that a Z divides

FACTORING. n = 2 25 + 1. fall in the arithmetic sequence

FACTORING The claim that factorization is harder than primality testing (or primality certification) is not currently substantiated rigorously. As some sort of backward evidence that factoring is hard,

Notes on Factoring. MA 206 Kurt Bryan

The General Approach Notes on Factoring MA 26 Kurt Bryan Suppose I hand you n, a 2 digit integer and tell you that n is composite, with smallest prime factor around 5 digits. Finding a nontrivial factor

Lecture 13 - Basic Number Theory.

Lecture 13 - Basic Number Theory. Boaz Barak March 22, 2010 Divisibility and primes Unless mentioned otherwise throughout this lecture all numbers are non-negative integers. We say that A divides B, denoted

ORDERS OF ELEMENTS IN A GROUP

ORDERS OF ELEMENTS IN A GROUP KEITH CONRAD 1. Introduction Let G be a group and g G. We say g has finite order if g n = e for some positive integer n. For example, 1 and i have finite order in C, since

Primality Testing and Factorization Methods

Primality Testing and Factorization Methods Eli Howey May 27, 2014 Abstract Since the days of Euclid and Eratosthenes, mathematicians have taken a keen interest in finding the nontrivial factors of integers,

Practice Problems for First Test

Mathematicians have tried in vain to this day to discover some order in the sequence of prime numbers, and we have reason to believe that it is a mystery into which the human mind will never penetrate.-

Homework until Test #2

MATH31: Number Theory Homework until Test # Philipp BRAUN Section 3.1 page 43, 1. It has been conjectured that there are infinitely many primes of the form n. Exhibit five such primes. Solution. Five such

Computer and Network Security

MIT 6.857 Computer and Networ Security Class Notes 1 File: http://theory.lcs.mit.edu/ rivest/notes/notes.pdf Revision: December 2, 2002 Computer and Networ Security MIT 6.857 Class Notes by Ronald L. Rivest

Applications of Fermat s Little Theorem and Congruences

Applications of Fermat s Little Theorem and Congruences Definition: Let m be a positive integer. Then integers a and b are congruent modulo m, denoted by a b mod m, if m (a b). Example: 3 1 mod 2, 6 4

Factoring Algorithms

Institutionen för Informationsteknologi Lunds Tekniska Högskola Department of Information Technology Lund University Cryptology - Project 1 Factoring Algorithms The purpose of this project is to understand

Faster deterministic integer factorisation

David Harvey (joint work with Edgar Costa, NYU) University of New South Wales 25th October 2011 The obvious mathematical breakthrough would be the development of an easy way to factor large prime numbers

2 Primality and Compositeness Tests

Int. J. Contemp. Math. Sciences, Vol. 3, 2008, no. 33, 1635-1642 On Factoring R. A. Mollin Department of Mathematics and Statistics University of Calgary, Calgary, Alberta, Canada, T2N 1N4 http://www.math.ucalgary.ca/

Mathematics is the queen of sciences and number theory is the queen of mathematics.

Number Theory Mathematics is the queen of sciences and number theory is the queen of mathematics. But why is it computer science? It turns out to be critical for cryptography! Carl Friedrich Gauss Division

Solutions to Homework Set 3 (Solutions to Homework Problems from Chapter 2)

Solutions to Homework Set 3 (Solutions to Homework Problems from Chapter 2) Problems from 21 211 Prove that a b (mod n) if and only if a and b leave the same remainder when divided by n Proof Suppose a

I. GROUPS: BASIC DEFINITIONS AND EXAMPLES

I GROUPS: BASIC DEFINITIONS AND EXAMPLES Definition 1: An operation on a set G is a function : G G G Definition 2: A group is a set G which is equipped with an operation and a special element e G, called

RSA and Primality Testing

and Primality Testing Joan Boyar, IMADA, University of Southern Denmark Studieretningsprojekter 2010 1 / 81 Correctness of cryptography cryptography Introduction to number theory Correctness of with 2

MATH 168: FINAL PROJECT Troels Eriksen. 1 Introduction

MATH 168: FINAL PROJECT Troels Eriksen 1 Introduction In the later years cryptosystems using elliptic curves have shown up and are claimed to be just as secure as a system like RSA with much smaller key

Factorization Methods: Very Quick Overview

Factorization Methods: Very Quick Overview Yuval Filmus October 17, 2012 1 Introduction In this lecture we introduce modern factorization methods. We will assume several facts from analytic number theory.

CHAPTER 3 THE NEW MMP CRYPTO SYSTEM. mathematical problems Hidden Root Problem, Discrete Logarithm Problem and

79 CHAPTER 3 THE NEW MMP CRYPTO SYSTEM In this chapter an overview of the new Mixed Mode Paired cipher text Cryptographic System (MMPCS) is given, its three hard mathematical problems are explained, and

MA257: INTRODUCTION TO NUMBER THEORY LECTURE NOTES

MA257: INTRODUCTION TO NUMBER THEORY LECTURE NOTES 2016 47 4. Diophantine Equations A Diophantine Equation is simply an equation in one or more variables for which integer (or sometimes rational) solutions

Discrete Mathematics, Chapter 4: Number Theory and Cryptography

Discrete Mathematics, Chapter 4: Number Theory and Cryptography Richard Mayr University of Edinburgh, UK Richard Mayr (University of Edinburgh, UK) Discrete Mathematics. Chapter 4 1 / 35 Outline 1 Divisibility

International Journal of Information Technology, Modeling and Computing (IJITMC) Vol.1, No.3,August 2013

FACTORING CRYPTOSYSTEM MODULI WHEN THE CO-FACTORS DIFFERENCE IS BOUNDED Omar Akchiche 1 and Omar Khadir 2 1,2 Laboratory of Mathematics, Cryptography and Mechanics, Fstm, University of Hassan II Mohammedia-Casablanca,

Smooth numbers and the quadratic sieve

Algorithmic Number Theory MSRI Publications Volume 44, 2008 Smooth numbers and the quadratic sieve CARL POMERANCE ABSTRACT. This article gives a gentle introduction to factoring large integers via the

NUMBER THEORY AMIN WITNO

NUMBER THEORY AMIN WITNO ii Number Theory Amin Witno Department of Basic Sciences Philadelphia University JORDAN 19392 Originally written for Math 313 students at Philadelphia University in Jordan, this

THE MATHEMATICS OF PUBLIC KEY CRYPTOGRAPHY.

THE MATHEMATICS OF PUBLIC KEY CRYPTOGRAPHY. IAN KIMING 1. Forbemærkning. Det kan forekomme idiotisk, at jeg som dansktalende og skrivende i et danskbaseret tidsskrift med en (formentlig) primært dansktalende

Cryptography and Network Security Number Theory

Cryptography and Network Security Number Theory Xiang-Yang Li Introduction to Number Theory Divisors b a if a=mb for an integer m b a and c b then c a b g and b h then b (mg+nh) for any int. m,n Prime

3. Applications of Number Theory

3. APPLICATIONS OF NUMBER THEORY 163 3. Applications of Number Theory 3.1. Representation of Integers. Theorem 3.1.1. Given an integer b > 1, every positive integer n can be expresses uniquely as n = a

Today s Topics. Primes & Greatest Common Divisors

Today s Topics Primes & Greatest Common Divisors Prime representations Important theorems about primality Greatest Common Divisors Least Common Multiples Euclid s algorithm Once and for all, what are prime

Computational Number Theory

Computational Number Theory C. Pomerance 1 Introduction Historically, computation has been a driving force in the development of mathematics. To help measure the sizes of their fields, the Egyptians invented

Breaking The Code. Ryan Lowe. Ryan Lowe is currently a Ball State senior with a double major in Computer Science and Mathematics and

Breaking The Code Ryan Lowe Ryan Lowe is currently a Ball State senior with a double major in Computer Science and Mathematics and a minor in Applied Physics. As a sophomore, he took an independent study

Algebra for Digital Communication

EPFL - Section de Mathématiques Algebra for Digital Communication Fall semester 2008 Solutions for exercise sheet 1 Exercise 1. i) We will do a proof by contradiction. Suppose 2 a 2 but 2 a. We will obtain

10 k + pm pm. 10 n p q = 2n 5 n p 2 a 5 b q = p

Week 7 Summary Lecture 13 Suppose that p and q are integers with gcd(p, q) = 1 (so that the fraction p/q is in its lowest terms) and 0 < p < q (so that 0 < p/q < 1), and suppose that q is not divisible

it is easy to see that α = a

21. Polynomial rings Let us now turn out attention to determining the prime elements of a polynomial ring, where the coefficient ring is a field. We already know that such a polynomial ring is a UF. Therefore

Factoring integers, Producing primes and the RSA cryptosystem

Factoring integers,..., RSA Erbil, Kurdistan 0 Lecture in Number Theory College of Sciences Department of Mathematics University of Salahaddin Debember 1, 2014 Factoring integers, Producing primes and

Continued fractions and good approximations.

Continued fractions and good approximations We will study how to find good approximations for important real life constants A good approximation must be both accurate and easy to use For instance, our

Lecture 13: Factoring Integers

CS 880: Quantum Information Processing 0/4/0 Lecture 3: Factoring Integers Instructor: Dieter van Melkebeek Scribe: Mark Wellons In this lecture, we review order finding and use this to develop a method

STRUCTURE AND RANDOMNESS IN THE PRIME NUMBERS. 1. Introduction. The prime numbers 2, 3, 5, 7,... are one of the oldest topics studied in mathematics.

STRUCTURE AND RANDOMNESS IN THE PRIME NUMBERS TERENCE TAO Abstract. A quick tour through some topics in analytic prime number theory.. Introduction The prime numbers 2, 3, 5, 7,... are one of the oldest

3. Computational Complexity.

3. Computational Complexity. (A) Introduction. As we will see, most cryptographic systems derive their supposed security from the presumed inability of any adversary to crack certain (number theoretic)

11 Ideals. 11.1 Revisiting Z

11 Ideals The presentation here is somewhat different than the text. In particular, the sections do not match up. We have seen issues with the failure of unique factorization already, e.g., Z[ 5] = O Q(

Algebra 2. Rings and fields. Finite fields. A.M. Cohen, H. Cuypers, H. Sterk. Algebra Interactive

2 Rings and fields A.M. Cohen, H. Cuypers, H. Sterk A.M. Cohen, H. Cuypers, H. Sterk 2 September 25, 2006 1 / 20 For p a prime number and f an irreducible polynomial of degree n in (Z/pZ)[X ], the quotient

The Prime Numbers. Definition. A prime number is a positive integer with exactly two positive divisors.

The Prime Numbers Before starting our study of primes, we record the following important lemma. Recall that integers a, b are said to be relatively prime if gcd(a, b) = 1. Lemma (Euclid s Lemma). If gcd(a,

Computing exponents modulo a number: Repeated squaring

Computing exponents modulo a number: Repeated squaring How do you compute (1415) 13 mod 2537 = 2182 using just a calculator? Or how do you check that 2 340 mod 341 = 1? You can do this using the method

8 Primes and Modular Arithmetic

8 Primes and Modular Arithmetic 8.1 Primes and Factors Over two millennia ago already, people all over the world were considering the properties of numbers. One of the simplest concepts is prime numbers.

On Generalized Fermat Numbers 3 2n +1

Applied Mathematics & Information Sciences 4(3) (010), 307 313 An International Journal c 010 Dixie W Publishing Corporation, U. S. A. On Generalized Fermat Numbers 3 n +1 Amin Witno Department of Basic

CONTINUED FRACTIONS AND FACTORING. Niels Lauritzen

CONTINUED FRACTIONS AND FACTORING Niels Lauritzen ii NIELS LAURITZEN DEPARTMENT OF MATHEMATICAL SCIENCES UNIVERSITY OF AARHUS, DENMARK EMAIL: niels@imf.au.dk URL: http://home.imf.au.dk/niels/ Contents

The van Hoeij Algorithm for Factoring Polynomials

The van Hoeij Algorithm for Factoring Polynomials Jürgen Klüners Abstract In this survey we report about a new algorithm for factoring polynomials due to Mark van Hoeij. The main idea is that the combinatorial

PYTHAGOREAN TRIPLES PETE L. CLARK

PYTHAGOREAN TRIPLES PETE L. CLARK 1. Parameterization of Pythagorean Triples 1.1. Introduction to Pythagorean triples. By a Pythagorean triple we mean an ordered triple (x, y, z) Z 3 such that x + y =

SUBGROUPS OF CYCLIC GROUPS. 1. Introduction In a group G, we denote the (cyclic) group of powers of some g G by

SUBGROUPS OF CYCLIC GROUPS KEITH CONRAD 1. Introduction In a group G, we denote the (cyclic) group of powers of some g G by g = {g k : k Z}. If G = g, then G itself is cyclic, with g as a generator. Examples

Problem Set 7 - Fall 2008 Due Tuesday, Oct. 28 at 1:00

18.781 Problem Set 7 - Fall 2008 Due Tuesday, Oct. 28 at 1:00 Throughout this assignment, f(x) always denotes a polynomial with integer coefficients. 1. (a) Show that e 32 (3) = 8, and write down a list

PRIMES is in P. Manindra Agrawal Neeraj Kayal Nitin Saxena

PRIMES is in P Manindra Agrawal Neeraj Kayal Nitin Saxena Department of Computer Science & Engineering Indian Institute of Technology Kanpur Kanpur-208016, INDIA Email: {manindra,kayaln,nitinsa}@iitk.ac.in

The cyclotomic polynomials

The cyclotomic polynomials Notes by G.J.O. Jameson 1. The definition and general results We use the notation e(t) = e 2πit. Note that e(n) = 1 for integers n, e(s + t) = e(s)e(t) for all s, t. e( 1 ) =

Prime numbers and prime polynomials. Paul Pollack Dartmouth College

Prime numbers and prime polynomials Paul Pollack Dartmouth College May 1, 2008 Analogies everywhere! Analogies in elementary number theory (continued fractions, quadratic reciprocity, Fermat s last theorem)

Introduction to Finite Fields (cont.)

Chapter 6 Introduction to Finite Fields (cont.) 6.1 Recall Theorem. Z m is a field m is a prime number. Theorem (Subfield Isomorphic to Z p ). Every finite field has the order of a power of a prime number

GREATEST COMMON DIVISOR

DEFINITION: GREATEST COMMON DIVISOR The greatest common divisor (gcd) of a and b, denoted by (a, b), is the largest common divisor of integers a and b. THEOREM: If a and b are nonzero integers, then their

ELLIPTIC CURVES AND LENSTRA S FACTORIZATION ALGORITHM

ELLIPTIC CURVES AND LENSTRA S FACTORIZATION ALGORITHM DANIEL PARKER Abstract. This paper provides a foundation for understanding Lenstra s Elliptic Curve Algorithm for factoring large numbers. We give

The Dirichlet Unit Theorem

Chapter 6 The Dirichlet Unit Theorem As usual, we will be working in the ring B of algebraic integers of a number field L. Two factorizations of an element of B are regarded as essentially the same if

Module MA3411: Abstract Algebra Galois Theory Appendix Michaelmas Term 2013

Module MA3411: Abstract Algebra Galois Theory Appendix Michaelmas Term 2013 D. R. Wilkins Copyright c David R. Wilkins 1997 2013 Contents A Cyclotomic Polynomials 79 A.1 Minimum Polynomials of Roots of

FACTORING IN QUADRATIC FIELDS. 1. Introduction. This is called a quadratic field and it has degree 2 over Q. Similarly, set

FACTORING IN QUADRATIC FIELDS KEITH CONRAD For a squarefree integer d other than 1, let 1. Introduction K = Q[ d] = {x + y d : x, y Q}. This is called a quadratic field and it has degree 2 over Q. Similarly,

ON INTEGERS EXPRESSIBLE BY SOME SPECIAL LINEAR FORM

Acta Math. Univ. Comenianae Vol. LXXXI, (01), pp. 03 09 03 ON INTEGERS EXPRESSIBLE BY SOME SPECIAL LINEAR FORM A. DUBICKAS and A. NOVIKAS Abstract. Let E(4) be the set of positive integers expressible

MTH 382 Number Theory Spring 2003 Practice Problems for the Final

MTH 382 Number Theory Spring 2003 Practice Problems for the Final (1) Find the quotient and remainder in the Division Algorithm, (a) with divisor 16 and dividend 95, (b) with divisor 16 and dividend -95,

H/wk 13, Solutions to selected problems

H/wk 13, Solutions to selected problems Ch. 4.1, Problem 5 (a) Find the number of roots of x x in Z 4, Z Z, any integral domain, Z 6. (b) Find a commutative ring in which x x has infinitely many roots.

Revised Version of Chapter 23. We learned long ago how to solve linear congruences. ax c (mod m)

Chapter 23 Squares Modulo p Revised Version of Chapter 23 We learned long ago how to solve linear congruences ax c (mod m) (see Chapter 8). It s now time to take the plunge and move on to quadratic equations.

On the generation of elliptic curves with 16 rational torsion points by Pythagorean triples

On the generation of elliptic curves with 16 rational torsion points by Pythagorean triples Brian Hilley Boston College MT695 Honors Seminar March 3, 2006 1 Introduction 1.1 Mazur s Theorem Let C be a

= 2 + 1 2 2 = 3 4, Now assume that P (k) is true for some fixed k 2. This means that

Instructions. Answer each of the questions on your own paper, and be sure to show your work so that partial credit can be adequately assessed. Credit will not be given for answers (even correct ones) without

MA2C03 Mathematics School of Mathematics, Trinity College Hilary Term 2016 Lecture 59 (April 1, 2016) David R. Wilkins

MA2C03 Mathematics School of Mathematics, Trinity College Hilary Term 2016 Lecture 59 (April 1, 2016) David R. Wilkins The RSA encryption scheme works as follows. In order to establish the necessary public

Mathematics of Cryptography

Number Theory Modular Arithmetic: Two numbers equivalent mod n if their difference is multiple of n example: 7 and 10 are equivalent mod 3 but not mod 4 7 mod 3 10 mod 3 = 1; 7 mod 4 = 3, 10 mod 4 = 2.

Prime and Composite Terms in Sloane s Sequence A056542

1 2 3 47 6 23 11 Journal of Integer Sequences, Vol. 8 (2005), Article 05.3.3 Prime and Composite Terms in Sloane s Sequence A056542 Tom Müller Institute for Cusanus-Research University and Theological

Orders Modulo A Prime

Orders Modulo A Prime Evan Chen March 6, 2015 In this article I develop the notion of the order of an element modulo n, and use it to prove the famous n 2 + 1 lemma as well as a generalization to arbitrary

APPLICATIONS OF THE ORDER FUNCTION

APPLICATIONS OF THE ORDER FUNCTION LECTURE NOTES: MATH 432, CSUSM, SPRING 2009. PROF. WAYNE AITKEN In this lecture we will explore several applications of order functions including formulas for GCDs and

Math 453: Elementary Number Theory Definitions and Theorems

Math 453: Elementary Number Theory Definitions and Theorems (Class Notes, Spring 2011 A.J. Hildebrand) Version 5-4-2011 Contents About these notes 3 1 Divisibility and Factorization 4 1.1 Divisibility.......................................

Monogenic Fields and Power Bases Michael Decker 12/07/07

Monogenic Fields and Power Bases Michael Decker 12/07/07 1 Introduction Let K be a number field of degree k and O K its ring of integers Then considering O K as a Z-module, the nicest possible case is

ALGEBRAIC APPROACH TO COMPOSITE INTEGER FACTORIZATION

ALGEBRAIC APPROACH TO COMPOSITE INTEGER FACTORIZATION Aldrin W. Wanambisi 1* School of Pure and Applied Science, Mount Kenya University, P.O box 553-50100, Kakamega, Kenya. Shem Aywa 2 Department of Mathematics,

The Sieve Re-Imagined: Integer Factorization Methods

The Sieve Re-Imagined: Integer Factorization Methods by Jennifer Smith A research paper presented to the University of Waterloo in partial fulfillment of the requirement for the degree of Master of Mathematics

ELEMENTARY THOUGHTS ON DISCRETE LOGARITHMS. Carl Pomerance

ELEMENTARY THOUGHTS ON DISCRETE LOGARITHMS Carl Pomerance Given a cyclic group G with generator g, and given an element t in G, the discrete logarithm problem is that of computing an integer l with g l

Lectures on Number Theory. Lars-Åke Lindahl

Lectures on Number Theory Lars-Åke Lindahl 2002 Contents 1 Divisibility 1 2 Prime Numbers 7 3 The Linear Diophantine Equation ax+by=c 12 4 Congruences 15 5 Linear Congruences 19 6 The Chinese Remainder

Elementary Number Theory

Elementary Number Theory A revision by Jim Hefferon, St Michael s College, 2003-Dec of notes by W. Edwin Clark, University of South Florida, 2002-Dec L A TEX source compiled on January 5, 2004 by Jim Hefferon,

2.1 Complexity Classes

15-859(M): Randomized Algorithms Lecturer: Shuchi Chawla Topic: Complexity classes, Identity checking Date: September 15, 2004 Scribe: Andrew Gilpin 2.1 Complexity Classes In this lecture we will look