How To Factoring

Transcription

1 Factoring integers,..., RSA Erbil, Kurdistan 0 Lecture in Number Theory College of Sciences Department of Mathematics University of Salahaddin Debember 1, 2014 Factoring integers, Producing primes and the RSA cryptosystem Francesco Pappalardi

2 Factoring integers,..., RSA Erbil, Kurdistan 1 How large are large numbers? number of cells in a human body: number of atoms in the universe: number of subatomic particles in the universe: number of atoms in a Human Brain: number of atoms in a cat: 10 26

3 Factoring integers,..., RSA Erbil, Kurdistan 2 RSA 2048 = RSA 2048 is a 617 (decimal) digit number

4 Factoring integers,..., RSA Erbil, Kurdistan 3 RSA 2048 =p q, p, q PROBLEM: Compute p and q Price offered on MArch 18, 1991: US$ ( Iraq Dinars)!! Theorem. If a N! p 1 < p 2 < < p k primes s.t. a = p α 1 1 pα k k Regrettably: RSAlabs believes that factoring in one year requires: number computers memory RSA Tb RSA , 000, Gb RSA ,000 4Gb.

5 Factoring integers,..., RSA Erbil, Kurdistan 4 Challenge Number Prize ($US) RSA 576 $10,000 RSA 640 $20,000 RSA 704 $30,000 RSA 768 $50,000 RSA 896 $75,000 RSA 1024 $100,000 RSA 1536 $150,000 RSA 2048 $200,000

6 Factoring integers,..., RSA Erbil, Kurdistan 4 Numero Premio ($US) Status RSA 576 $10,000 Factored December 2003 RSA 640 $20,000 Factored November 2005 RSA 704 $30,000 Factored July, RSA 768 $50,000 Factored December, RSA 896 $75,000 Not factored RSA 1024 $100,000 Not factored RSA 1536 $150,000 Not factored RSA 2048 $200,000 Not factored The RSA challenges ended in RSA Laboratories stated: Now that the industry has a considerably more advanced understanding of the cryptanalytic strength of common symmetric-key and public-key algorithms, these challenges are no longer active.

7 Factoring integers,..., RSA Erbil, Kurdistan 5 Famous citation!!! A phenomenon whose probability is never happens, and it will never observed. - Émil Borel (Les probabilités et sa vie)

8 Factoring integers,..., RSA Erbil, Kurdistan 6 History of the Art of Factoring 220 BC Greeks (Eratosthenes of Cyrene ) 1730 Euler = Fermat, Gauss (Sieves - Tables) 1880 Landry & Le Lasseur: = Pierre and Eugène Carissan (Factoring Machine) 1970 Morrison & Brillhart = Quadratic Sieve QS (Pomerance) Number Fields Sieve NFS 1987 Elliptic curves factoring ECF (Lenstra)

9 Factoring integers,..., RSA Erbil, Kurdistan 7 History of the Art of Factoring 220 BC Greeks (Eratosthenes of Cyrene)

10 Factoring integers,..., RSA Erbil, Kurdistan 8 History of the Art of Factoring 1730 Euler =

11 Factoring integers,..., RSA Erbil, Kurdistan 9 How did Euler factor ? Proposition Suppose p is a prime factor of b n + 1. Then 1. p is a divisor of b d + 1 for some proper divisor d of n such that n/d is odd or 2. p 1 is divisible by 2n. Application: Let b = 2 and n = 2 5 = 64. Then is prime or it is divisible by a prime p such that p 1 is divisible by 128. Note that = 3 43, = 257 is prime, = , = and = 641 is prime. Finally = =

12 Factoring integers,..., RSA Erbil, Kurdistan 10 History of the Art of Factoring 1730 Euler =

13 Factoring integers,..., RSA Erbil, Kurdistan 11 History of the Art of Factoring Fermat, Gauss (Sieves - Tables)

14 Factoring integers,..., RSA Erbil, Kurdistan 12 History of the Art of Factoring Fermat, Gauss (Sieves - Tables) Factoring with sieves N = x 2 y 2 = (x y)(x + y)

15 Factoring integers,..., RSA Erbil, Kurdistan 13 Carissan s ancient Factoring Machine Figure 1: Conservatoire Nationale des Arts et Métiers in Paris shallit/papers/carissan.html

16 Factoring integers,..., RSA Erbil, Kurdistan 14 Figure 2: Lieutenant Eugène Carissan = minutes = minutes = minutes

17 Factoring integers,..., RSA Erbil, Kurdistan 15 State of the Art of Factoring John Brillhart & Michael A. Morrison =

18 Factoring integers,..., RSA Erbil, Kurdistan 16 State of the Art of Factoring is called the n th Fermat number F n = 2 (2n) + 1 Up to today only from F 0 to F 11 are factores. It is not known the factorization of F 12 =

19 Factoring integers,..., RSA Erbil, Kurdistan 17 State of the Art of Factoring Carl Pomerance - Quadratic Sieve

20 Factoring integers,..., RSA Erbil, Kurdistan 18 State of the Art of Factoring Hendrik Lenstra - Elliptic curves factoring

21 Factoring integers,..., RSA Erbil, Kurdistan 19 Contemporary Factoring ❶ 1994, Quadratic Sieve (QS): (8 months, 600 volunteers, 20 nations) D.Atkins, M. Graff, A. Lenstra, P. Leyland RSA 129 = = = ❷ (February ), Number Field Sieve (NFS): (160 Sun, 4 months) RSA 155 = = = ❸ (December 3, 2003) (NFS): J. Franke et al. (174 decimal digits) RSA 576 = = = ❹ Elliptic curves factoring: introduced by H. Lenstra. suitable to detect small factors (50 digits) all have sub exponential complexity

22 Factoring integers,..., RSA Erbil, Kurdistan 20 The factorization of RSA 200 RSA 200 = Date: Mon, 9 May :05: (CEST) From: Thorsten Kleinjung Subject: rsa200 We have factored RSA200 by GNFS. The factors are and We did lattice sieving for most special q between 3e8 and 11e8 using mainly factor base bounds of 3e8 on the algebraic side and 18e7 on the rational side. The bounds for large primes were This produced 26e8 relations. Together with 5e7 relations from line sieving the total yield was 27e8 relations. After removing duplicates 226e7 relations remained. A filter job produced a matrix with 64e6 rows and columns, having 11e9 non-zero entries. This was solved by Block-Wiedemann. Sieving has been done on a variety of machines. We estimate that lattice sieving would have taken 55 years on a single 2.2 GHz Opteron CPU. Note that this number could have been improved if instead of the PIII- binary which we used for sieving, we had used a version of the lattice-siever optimized for Opteron CPU s which we developed in the meantime. The matrix step was performed on a cluster of GHz Opterons connected via a Gigabit network and took about 3 months. We started sieving shortly before Christmas 2003 and continued until October The matrix step began in December Line sieving was done by P. Montgomery and H. te Riele at the CWI, by F. Bahr and his family. More details will be given later. F. Bahr, M. Boehm, J. Franke, T. Kleinjung

23 Factoring integers,..., RSA Erbil, Kurdistan 21 Factorization of RSA 768

24 Factoring integers,..., RSA Erbil, Kurdistan 22 RSA Adi Shamir, Ron L. Rivest, Leonard Adleman (1978)

25 Factoring integers,..., RSA Erbil, Kurdistan 23 RSA Ron L. Rivest, Adi Shamir, Leonard Adleman (2003)

26 Factoring integers,..., RSA Erbil, Kurdistan 24 The RSA cryptosystem 1978 R. L. Rivest, A. Shamir, L. Adleman (Patent expired in 1998) Problem: Alice wants to send the message P to Bob so that Charles cannot read it A (Alice) B (Bob) C (Charles) ❶ Key generation ❷ Encryption ❸ Decryption ❹ Attack Bob has to do it Alice has to do it Bob has to do it Charles would like to do it

27 Factoring integers,..., RSA Erbil, Kurdistan 25 Bob: Key generation He chooses randomly p and q primes (p, q ) He computes M = p q, ϕ(m) = (p 1) (q 1) He chooses an integer e s.t. 0 e ϕ(m) and gcd(e, ϕ(m)) = 1 Note. One could take e = 3 and p q 2 mod 3 Experts recommend e = He computes arithmetic inverse d of e modulo ϕ(m) (i.e. d N (unique ϕ(m)) s.t. e d 1 (mod ϕ(m))) Publishes (M, e) public key and hides secret key d Problem: How does Bob do all this?- We will go came back to it!

28 Factoring integers,..., RSA Erbil, Kurdistan 26 Alice: Encryption Represent the message P as an element of Z/MZ (for example) A 1 B 2 C 3... Z 26 AA Sukumar = Note. Better if texts are not too short. Otherwise one performs some padding C = E(P) = P e (mod M) Example: p = , q = , M = , e = = 65537, P = Sukumar: E(Sukumar) = (mod ) = = C = JGEBNBAUYTCOFJ

29 Factoring integers,..., RSA Erbil, Kurdistan 27 Bob: Decryption P = D(C) = C d (mod M) Note. Bob decrypts because he is the only one that knows d. Therefore (ed 1 mod ϕ(m)) Theorem. (Euler) If a, m N, gcd(a, m) = 1, a ϕ(m) 1 (mod m). If n 1 n 2 mod ϕ(m) then a n 1 a n 2 mod m. D(E(P)) = P ed P mod M Example(cont.):d = mod ϕ( ) = D(JGEBNBAUYTCOFJ) = (mod ) = Sukumar

30 Factoring integers,..., RSA Erbil, Kurdistan 28 RSA at work

31 Factoring integers,..., RSA Erbil, Kurdistan 29 Repeated squaring algorithm Problem: How does one compute a b mod c? (mod ) Compute the binary expansion b = [log 2 b] j=0 ɛ j 2 j = Compute recursively a 2j mod c, j = 1,..., [log 2 b]: ( 2 a 2j mod c = a 2j 1 mod c) mod c Multiply the a 2j mod c with ɛ j = 1 ) a b mod c = mod c ( [log2 b] j=0,ɛ j =1 a2j mod c

32 Factoring integers,..., RSA Erbil, Kurdistan 30 #{oper. in Z/cZ to compute a b mod c} 2 log 2 b JGEBNBAUYTCOFJ is decrypted with 131 operations in Z/ Z Pseudo code: e c (a, b) = a b mod c e c (a, b) = if b = 1 then a mod c if 2 b then e c (a, b 2 )2 mod c else a e c (a, b 1 2 )2 mod c To encrypt with e = , only 17 operations in Z/MZ are enough

33 Factoring integers,..., RSA Erbil, Kurdistan 31 Key generation Problem. Produce a random prime p subproblems: Probabilistic algorithm (type Las Vegas) 1. Let p = Random( ) 2. If isprime(p)=1 then Output=p else goto 1 A. How many iterations are necessary? (i.e. how are primes distributes?) B. How does one check if p is prime? (i.e. how does one compute isprime(p)?) Primality test False Metropolitan Legend: Check primality is equivalent to factoring

34 Factoring integers,..., RSA Erbil, Kurdistan 32 A. Distribution of prime numbers Quantitative version: π(x) = #{p x t. c. p is prime} Theorem. (Hadamard - de la vallee Pussen ) π(x) x log x Therefore Theorem. (Rosser - Schoenfeld) if x 67 x log x 1/2 < π(x) < x log x 3/ < P rob ( (Random( ) = prime ) <

35 Factoring integers,..., RSA Erbil, Kurdistan 33 If P k is the probability that among k random numbers there is a prime one, then P k = 1 ( ) k 1 π(10100 ) Therefore < P 250 < To speed up the process: One can consider only odd random numbers not divisible by 3 nor by 5. Let Ψ(x, 30) = # {n x s.t. gcd(n, 30) = 1}

36 Factoring integers,..., RSA Erbil, Kurdistan 34 To speed up the process: One can consider only odd random numbers not divisible by 3 nor by 5. Let Ψ(x, 30) = # {n x s.t. gcd(n, 30) = 1} then 4 4 x 4 < Ψ(x, 30) < x + 4 Hence, if P k is the probability that among k random numbers coprime with 30, there is a prime one, then P k = 1 ( ) k 1 π(10100 ) Ψ(10 100, 30) and < P 250 <

37 Factoring integers,..., RSA Erbil, Kurdistan 35 B. Primality test Fermat Little Theorem. If p is prime, p a N a p 1 1 mod p NON-primality test M Z, 2 M 1 1 mod M => Mcomposite! Example: 2 RSA mod RSA 2048 Therefore RSA 2048 is composite! Fermat little Theorem does not invert. Infact (mod 93961) but =

38 Factoring integers,..., RSA Erbil, Kurdistan 36 Strong pseudo primes From now on m 3 mod 4 (just to simplify the notation) Definition. m N, m 3 mod 4, composite is said strong pseudo prime (SPSP) in base a if a (m 1)/2 ±1 (mod m). Note. If p > 2 prime => a (p 1)/2 ±1 (mod p) Let S = {a Z/mZ s.t. gcd(m, a) = 1, a (m 1)/2 ±1 (mod m)} ➀ S (Z/mZ) subgroup ➁ If m is composite => proper subgroup ➂ If m is composite => #S ϕ(m) 4 ➃ If m is composite => P rob(m PSPF in base a) 0, 25

39 Factoring integers,..., RSA Erbil, Kurdistan 37 Miller Rabin primality test Let m 3 mod 4 Miller Rabin algorithm with k iterations N = (m 1)/2 for j = 0 to k do a =Random(m) if a N ±1 mod m then OUPUT=(m composite): endfor OUTPUT=(m prime) END Monte Carlo primality test P rob(miller Rabin says m prime and m is composite) 1 4 k In the real world, software uses Miller Rabin with k = 10

40 Factoring integers,..., RSA Erbil, Kurdistan 38 Deterministic primality tests Theorem. (Miller, Bach) If m is composite, then GRH => a 2 log 2 m s.t. a (m 1)/2 ±1 (mod m). (i.e. m is not SPSP in base a.) Consequence: Miller Rabin de randomizes on GRH (m 3 mod 4) for a = 2 to 2 log 2 m do if a (m 1)/2 ±1 mod m then OUPUT=(m composite): endfor OUTPUT=(m prime) END Deterministic Polynomial time algorithm It runs in O(log 5 m) operations in Z/mZ.

41 Factoring integers,..., RSA Erbil, Kurdistan 39 Certified prime records , digits (discovered in 01/2014 ) , digits (discovered in 2008) , digits (discovered in 2009) , digits (discovered in 2008) , digits (discovered in 2006) , digits (discovered in 2005) , digits (discovered in 2005) , digits (discovered in 2004) , digits (discovered in 2003) , digits (discovered in 2001) , digits (discovered in 1999) , digits (discovered in 2003)

42 Factoring integers,..., RSA Erbil, Kurdistan 40 Great Internet Mersenne Prime Search (GIMPS) The Great Internet Mersenne Prime Search (GIMPS) is a collaborative project of volunteers who use freely available software to search for Mersenne prime numbers (i.e. prime numbers of the form 2 p 1 (p prime)). The project was founded by George Woltman in January 1996.

43 Factoring integers,..., RSA Erbil, Kurdistan 41 The AKS deterministic primality test Department of Computer Science & Engineering, I.I.T. Kanpur, Agost 8, Nitin Saxena, Neeraj Kayal and Manindra Agarwal New deterministic, polynomial time, primality test. Solves #1 open question in computational number theory

44 Factoring integers,..., RSA Erbil, Kurdistan 42 How does the AKS work? Theorem. (AKS) Let n N. Assume q, r primes, S N finite: q r 1; n (r 1)/q mod r {0, 1}; gcd(n, b b ) = 1, b, b S (distinct); ( ) q+#s 1 #S n 2 r ; (x + b) n = x n + b in Z/nZ[x]/(x r 1), b S; Then n is a power of a prime Bernstein formulation Fouvry Theorem (1985) => r log 6 n, s log 4 n => AKS runs in O(log 15 n) operations in Z/nZ. Many simplifications and improvements: Bernstein, Lenstra, Pomerance...

45 Factoring integers,..., RSA Erbil, Kurdistan 43 Why is RSA safe? It is clear that if Charles can factor M, then he can also compute ϕ(m) and then also d so to decrypt messages Computing ϕ(m) is equivalent to completely factor M. In fact p, q = M ϕ(m) + 1 ± (M ϕ(m) + 1) 2 4M 2 RSA Hypothesis. The only way to compute efficiently x 1/e mod M, x Z/MZ (i.e. decrypt messages) is to factor M In other words The two problems are polynomially equivalent

46 Factoring integers,..., RSA Erbil, Kurdistan 44 Two kinds of Cryptography Private key (or symmetric) Lucifer DES AES Public key RSA Diffie Hellmann Knapsack NTRU

47 Factoring integers,..., RSA Erbil, Kurdistan 45 Another quotation!!! Have you ever noticed that there s no attempt being made to find really large numbers that aren t prime. I mean, wouldn t you like to see a news report that says Today the Department of Computer Sciences at the University of Washington annouced that 2 58,111,625, is even. This is the largest non-prime yet reported. - University of Washington (Bathroom Graffiti)