RSA and Primality Testing

Transcription

1 and Primality Testing Joan Boyar, IMADA, University of Southern Denmark Studieretningsprojekter / 81

2 Correctness of cryptography cryptography Introduction to number theory Correctness of with 2 / 81

3 Caesar cipher Correctness of A B C D E F G H I J K L M N O D E F G H I J K L M N O P Q R P Q R S T U V W X Y Z Æ Ø Å S T U V W X Y Z Æ Ø Å A B C E(m) = m + 3 (mod 29) 3 / 81

4 systems Correctness of Suppose the following was encrypted using a Caesar cipher and the Danish alphabet. The key is unknown. What does it say? ZQOØQOØ, RI. 4 / 81

5 systems Correctness of Suppose the following was encrypted using a Caesar cipher and the Danish alphabet. The key is unknown. What does it say? ZQOØQOØ, RI. What does this say about how many keys should be possible? 5 / 81

6 systems Correctness of Caesar Cipher Enigma DES Blowfish IDEA Triple DES AES 6 / 81

7 cryptography Correctness of Bob 2 keys -PK B,SK B PK B Bob s public key SK B Bob s private (secret) key For Alice to send m to Bob, Alice computes: c = E(m,PK B ). To decrypt c, Bob computes: r = D(c,SK B ). r = m It must be hard to compute SK B from PK B. 7 / 81

8 Introduction to Number Theory Correctness of Definition. Suppose a,b Z, a > 0. Suppose c Z s.t. b = ac. Then a divides b. a b. a is a factor of b. b is a multiple of a. e f means e does not divide f. Theorem. a,b,c Z. Then 1. if a b and a c, then a (b+c) 2. if a b, then a bc c Z 3. if a b and b c, then a c. 8 / 81

9 Correctness of Definition. p Z, p > 1. p is prime if 1 and p are the only positive integers which divide p. 2,3,5,7,11,13,17,... p is composite if it is not prime. 4,6,8,9,10,12,14,15,16,... 9 / 81

10 Correctness of Theorem. a Z, d IN unique q,r, 0 r < d s.t. a = dq +r d a dividend q quotient r remainder = a mod d Definition. gcd(a,b) = greatest common of a and b = largest d Z s.t. d a and d b If gcd(a,b) = 1, then a and b are relatively prime. 10 / 81

11 Correctness of Definition. a b (mod m) a is congruent to b modulo m if m (a b). m (a b) k Z s.t. a = b+km. Theorem. a b (mod m) c d (mod m) Then a+c b+d (mod m) and ac bd (mod m). Proof.(of first) k 1,k 2 s.t. a = b+k 1 m c = d+k 2 m a+c = b+k 1 m+d+k 2 m = b+d+(k 1 +k 2 )m 11 / 81

12 Correctness of Definition. a b (mod m) a is congruent to b modulo m if m (a b). m (a b) k Z s.t. a = b+km. Examples (mod 7)? 15 = 22 (mod 7)? (mod 7)? 15 = 1 (mod 7)? (mod 7)? 15 = 37 (mod 7)? (mod 9)? 58 = 22 (mod 9)? 12 / 81

13 a public key system Correctness of N A = p A q A, where p A,q A prime. gcd(e A,(p A 1)(q A 1)) = 1. e A d A 1 (mod (p A 1)(q A 1)). PK A = (N A,e A ) SK A = (N A,d A ) To encrypt: c = E(m,PK A ) = m e A (mod N A ). To decrypt: r = D(c,PK A ) = c d A (mod N A ). r = m. 13 / 81

14 a public key system Correctness of N A = p A q A, where p A,q A prime. gcd(e A,(p A 1)(q A 1)) = 1. e A d A 1 (mod (p A 1)(q A 1)). PK A = (N A,e A ) SK A = (N A,d A ) To encrypt: c = E(m,PK A ) = m e A (mod N A ). To decrypt: r = D(c,PK A ) = c d A (mod N A ). r = m. Example: p = 5, q = 11, e = 3, d = 27, m = 8. Then N = 55. e d = 81. So e d = 1 (mod 4 10). To encrypt m: c = 8 3 (mod 55) = 17. To decrypt c: r = (mod 55) = / 81

15 Security of Correctness of The primes p A and q A are kept secret with d A. Suppose Eve can factor N A. Then she can find p A and q A. From them and e A, she finds d A. Then she can decrypt just like Alice. Factoring must be hard! 15 / 81

16 Factoring Correctness of Theorem. N composite N has a prime N Factor(n) for i = 2 to n do check if i divides n if it does then output (i,n/i) endfor output -1 if not found Corollary There is an algorithm for factoring N (or testing primality) which does O( N) tests of divisibility. 16 / 81

17 Factoring Correctness of Check all possible s between 2 and n. Not finished in your grandchildren s life time for n with 1024 bits. Problem The length of the input is n = log 2 (N +1). So the running time is O(2 n/2 ) exponential. Open Problem Does there exist a polynomial time factoring algorithm? Use primes which are at least 512 (or 1024) bits long. So p A,q A < So p A / 81

18 Correctness of How do we implement? We need to find: p A,q A,N A,e A,d A. We need to encrypt and decrypt. 18 / 81

19 encryption/decryption Correctness of We need to encrypt and decrypt: compute a k (mod n). a 2 (mod n) a a (mod n) 1 modular multiplication 19 / 81

20 Exponentiation Correctness of Theorem. For all nonnegative integers, b,c,m, b c (mod m) = (b (mod m)) (c (mod m)) (mod m). Example: a a 2 (mod n) = (a (mod n))(a 2 (mod n)) (mod n). 8 3 (mod 55) = (mod 55) = 8 64 (mod 55) = 8 (9+55) (mod 55) = 72+(8 55) (mod 55) = (8 55) (mod 55) = / 81

21 encryption/decryption Correctness of We need to encrypt and decrypt: compute a k (mod n). a 2 (mod n) a a (mod n) 1 modular multiplication a 3 (mod n) a (a a (mod n)) (mod n) 2 mod mults 21 / 81

22 encryption/decryption Correctness of We need to encrypt and decrypt: compute a k (mod n). a 2 (mod n) a a (mod n) 1 modular multiplication a 3 (mod n) a (a a (mod n)) (mod n) 2 mod mults Guess: k 1 modular multiplications. 22 / 81

23 encryption/decryption Correctness of We need to encrypt and decrypt: compute a k (mod n). a 2 (mod n) a a (mod n) 1 modular multiplication a 3 (mod n) a (a a (mod n)) (mod n) 2 mod mults Guess: k 1 modular multiplications. This is too many! e A d A 1 (mod (p A 1)(q A 1)). p A and q A have 512 bits each. So at least one of e A and d A has 512 bits. To either encrypt or decrypt would need operations (more than number of atoms in the universe). 23 / 81

24 encryption/decryption Correctness of We need to encrypt and decrypt: compute a k (mod n). a 2 (mod n) a a (mod n) 1 modular multiplication a 3 (mod n) a (a a (mod n)) (mod n) 2 mod mults How do you calculate a 4 (mod n) in less than 3? 24 / 81

25 encryption/decryption Correctness of We need to encrypt and decrypt: compute a k (mod n). a 2 (mod n) a a (mod n) 1 modular multiplication a 3 (mod n) a (a a (mod n)) (mod n) 2 mod mults How do you calculate a 4 (mod n) in less than 3? a 4 (mod n) (a 2 (mod n)) 2 (mod n) 2 mod mults 25 / 81

26 encryption/decryption Correctness of We need to encrypt and decrypt: compute a k (mod n). a 2 (mod n) a a (mod n) 1 modular multiplication a 3 (mod n) a (a a (mod n)) (mod n) 2 mod mults How do you calculate a 4 (mod n) in less than 3? a 4 (mod n) (a 2 (mod n)) 2 (mod n) 2 mod mults In general: a 2s (mod n)? 26 / 81

27 encryption/decryption Correctness of We need to encrypt and decrypt: compute a k (mod n). a 2 (mod n) a a (mod n) 1 modular multiplication a 3 (mod n) a (a a (mod n)) (mod n) 2 mod mults How do you calculate a 4 (mod n) in less than 3? a 4 (mod n) (a 2 (mod n)) 2 (mod n) 2 mod mults In general: a 2s (mod n)? a 2s (mod n) (a s (mod n)) 2 (mod n) 27 / 81

28 encryption/decryption Correctness of We need to encrypt and decrypt: compute a k (mod n). a 2 (mod n) a a (mod n) 1 modular multiplication a 3 (mod n) a (a a (mod n)) (mod n) 2 mod mults How do you calculate a 4 (mod n) in less than 3? a 4 (mod n) (a 2 (mod n)) 2 (mod n) 2 mod mults a 2s (mod n) (a s (mod n)) 2 (mod n) In general: a 2s+1 (mod n)? 28 / 81

29 encryption/decryption Correctness of We need to encrypt and decrypt: compute a k (mod n). a 2 (mod n) a a (mod n) 1 modular multiplication a 3 (mod n) a (a a (mod n)) (mod n) 2 mod mults How do you calculate a 4 (mod n) in less than 3? a 4 (mod n) (a 2 (mod n)) 2 (mod n) 2 mod mults a 2s (mod n) (a s (mod n)) 2 (mod n) a 2s+1 (mod n) a ((a s (mod n)) 2 (mod n)) (mod n) 29 / 81

30 Exponentiation Correctness of Exp(a,k,n) { Compute a k (mod n) } if k < 0 then report error if k = 0 then return(1) if k = 1 then return(a (mod n)) if k is odd then return(a Exp(a, k 1, n) (mod n)) if k is even then c Exp(a,k/2,n) return((c c) (mod n)) 30 / 81

31 Exponentiation Correctness of Exp(a,k,n) { Compute a k (mod n) } if k < 0 then report error if k = 0 then return(1) if k = 1 then return(a (mod n)) if k is odd then return(a Exp(a, k 1, n) (mod n)) if k is even then c Exp(a,k/2,n) return((c c) (mod n)) To compute 3 6 (mod 7): Exp(3,6,7) c Exp(3,3,7) 31 / 81

32 Exponentiation Correctness of Exp(a,k,n) { Compute a k (mod n) } if k < 0 then report error if k = 0 then return(1) if k = 1 then return(a (mod n)) if k is odd then return(a Exp(a, k 1, n) (mod n)) if k is even then c Exp(a,k/2,n) return((c c) (mod n)) To compute 3 6 (mod 7): Exp(3,6,7) c Exp(3, 3, 7) 3 (Exp(3, 2, 7) (mod 7)) 32 / 81

33 Exponentiation Correctness of Exp(a,k,n) { Compute a k (mod n) } if k < 0 then report error if k = 0 then return(1) if k = 1 then return(a (mod n)) if k is odd then return(a Exp(a, k 1, n) (mod n)) if k is even then c Exp(a,k/2,n) return((c c) (mod n)) To compute 3 6 (mod 7): Exp(3,6,7) c Exp(3, 3, 7) 3 (Exp(3, 2, 7)) (mod 7)) c Exp(3,1,7) 33 / 81

34 Exponentiation Correctness of Exp(a,k,n) { Compute a k (mod n) } if k < 0 then report error if k = 0 then return(1) if k = 1 then return(a (mod n)) if k is odd then return(a Exp(a, k 1, n) (mod n)) if k is even then c Exp(a,k/2,n) return((c c) (mod n)) To compute 3 6 (mod 7): Exp(3,6,7) c Exp(3, 3, 7) 3 (Exp(3, 2, 7)) (mod 7)) c Exp(3,1,7) 3 34 / 81

35 Exponentiation Correctness of Exp(a,k,n) { Compute a k (mod n) } if k < 0 then report error if k = 0 then return(1) if k = 1 then return(a (mod n)) if k is odd then return(a Exp(a, k 1, n) (mod n)) if k is even then c Exp(a,k/2,n) return((c c) (mod n)) To compute 3 6 (mod 7): Exp(3,6,7) c Exp(3, 3, 7) 3 (Exp(3, 2, 7)) (mod 7)) c Exp(3,1,7) 3 Exp(3,2,7) (mod 7)) 3 3 (mod 7) 2 35 / 81

36 Exponentiation Correctness of Exp(a,k,n) { Compute a k (mod n) } if k < 0 then report error if k = 0 then return(1) if k = 1 then return(a (mod n)) if k is odd then return(a Exp(a, k 1, n) (mod n)) if k is even then c Exp(a,k/2,n) return((c c) (mod n)) To compute 3 6 (mod 7): Exp(3,6,7) c Exp(3, 3, 7) 3 (Exp(3, 2, 7)) (mod 7)) c Exp(3,1,7) 3 Exp(3,2,7) (mod 7)) 3 3 (mod 7) 2 c 3 2 (mod 7) 6 36 / 81

37 Exponentiation Correctness of Exp(a,k,n) { Compute a k (mod n) } if k < 0 then report error if k = 0 then return(1) if k = 1 then return(a (mod n)) if k is odd then return(a Exp(a, k 1, n) (mod n)) if k is even then c Exp(a,k/2,n) return((c c) (mod n)) To compute 3 6 (mod 7): Exp(3,6,7) c Exp(3, 3, 7) 3 (Exp(3, 2, 7)) (mod 7)) c Exp(3,1,7) 3 Exp(3,2,7) (mod 7)) 3 3 (mod 7) 2 c 3 2 (mod 7) 6 Exp(3,6,7) (6 6) (mod 7) 1 37 / 81

38 Exponentiation Correctness of Exp(a,k,n) { Compute a k (mod n) } if k < 0 then report error if k = 0 then return(1) if k = 1 then return(a (mod n)) if k is odd then return(a Exp(a, k 1, n) (mod n)) if k is even then c Exp(a,k/2,n) return((c c) (mod n)) How many modular multiplications? 38 / 81

39 Exponentiation Correctness of Exp(a,k,n) { Compute a k (mod n) } if k < 0 then report error if k = 0 then return(1) if k = 1 then return(a (mod n)) if k is odd then return(a Exp(a, k 1, n) (mod n)) if k is even then c Exp(a,k/2,n) return((c c) (mod n)) How many modular multiplications? Divide exponent by 2 every other time. How many times can we do that? 39 / 81

40 Exponentiation Correctness of Exp(a,k,n) { Compute a k (mod n) } if k < 0 then report error if k = 0 then return(1) if k = 1 then return(a (mod n)) if k is odd then return(a Exp(a, k 1, n) (mod n)) if k is even then c Exp(a,k/2,n) return((c c) (mod n)) How many modular multiplications? Divide exponent by 2 every other time. How many times can we do that? log 2 (k) So at most 2 log 2 (k) modular multiplications. 40 / 81

41 a public key system Correctness of N A = p A q A, where p A,q A prime. gcd(e A,(p A 1)(q A 1)) = 1. e A d A 1 (mod (p A 1)(q A 1)). PK A = (N A,e A ) SK A = (N A,d A ) To encrypt: c = E(m,PK A ) = m e A (mod N A ). To decrypt: r = D(c,PK A ) = c d A (mod N A ). r = m. Try using N = 35, e = 11 to create keys for. What is d? Try d = 11 and check it. Encrypt 4. Decrypt the result. 41 / 81

42 a public key system Correctness of N A = p A q A, where p A,q A prime. gcd(e A,(p A 1)(q A 1)) = 1. e A d A 1 (mod (p A 1)(q A 1)). PK A = (N A,e A ) SK A = (N A,d A ) To encrypt: c = E(m,PK A ) = m e A (mod N A ). To decrypt: r = D(c,PK A ) = c d A (mod N A ). r = m. Try using N = 35, e = 11 to create keys for. What is d? Try d = 11 and check it. Encrypt 4. Decrypt the result. Did you get c = 9? And r = 4? 42 / 81

43 Correctness of N A = p A q A, where p A,q A prime. gcd(e A,(p A 1)(q A 1)) = 1. e A d A 1 (mod (p A 1)(q A 1)). PK A = (N A,e A ) SK A = (N A,d A ) To encrypt: c = E(m,PK A ) = m e A (mod N A ). To decrypt: r = D(c,PK A ) = c d A (mod N A ). r = m. 43 / 81

44 Greatest Common Divisor Correctness of We need to find: e A,d A. gcd(e A,(p A 1)(q A 1)) = 1. e A d A 1 (mod (p A 1)(q A 1)). 44 / 81

45 Greatest Common Divisor Correctness of We need to find: e A,d A. gcd(e A,(p A 1)(q A 1)) = 1. e A d A 1 (mod (p A 1)(q A 1)). Choose random e A. Check that gcd(e A,(p A 1)(q A 1)) = 1. Find d A such that e A d A 1 (mod (p A 1)(q A 1)). 45 / 81

46 The Extended Euclidean Algorithm Correctness of Theorem. a,b IN. s,t Z s.t. sa+tb = gcd(a,b). Proof. Let d be the smallest positive integer in D = {xa+yb x,y Z}. d D d = x a+y b for some x,y Z. gcd(a,b) a and gcd(a,b) b, so gcd(a,b) x a, gcd(a,b) y b, and gcd(a,b) (x a+y b) = d. We will show that d gcd(a,b), so d = gcd(a,b). Note a D. Suppose a = dq +r with 0 r < d. r = a dq = a q(x a+y b) = (1 qx )a (qy )b r D r < d r = 0 d a. Similarly, one can show that d b. Therefore, d gcd(a,b). 46 / 81

47 The Extended Euclidean Algorithm Correctness of How do you find d, s and t? Let d = gcd(a,b). Write b as b = aq +r with 0 r < a. Then, d b d (aq +r). Also, d a d (aq) d ((aq +r) aq) d r. Let d = gcd(a,b aq). Then, d a d (aq) Also, d (b aq) d ((b aq)+aq) d b. Thus, gcd(a, b) = gcd(a, b (mod a)) = gcd(b (mod a),a). This shows how to reduce to a simpler problem and gives us the Extended Euclidean Algorithm. 47 / 81

48 The Extended Euclidean Algorithm Correctness of { Initialize} d 0 b s 0 0 t 0 1 d 1 a s 1 1 t 1 0 n 1 { Compute next d} while d n > 0 do begin n n+1 { Compute d n d n 2 (mod d n 1 )} q n d n 2 /d n 1 d n d n 2 q n d n 1 s n q n s n 1 +s n 2 t n q n t n 1 +t n 2 end s ( 1) n s n 1 t ( 1) n 1 t n 1 gcd(a,b) d n 1 48 / 81

49 The Extended Euclidean Algorithm Correctness of Finding multiplicative inverses modulo m: Given a and m, find x s.t. a x 1 (mod m). Should also find a k, s.t. ax = 1+km. So solve for an s in an equation sa+tm = 1. This can be done if gcd(a,m) = 1. Just use the Extended Euclidean Algorithm. 49 / 81

50 Examples Correctness of Calculate the following: 1. gcd(6,9) 2. s and t such that s 6+t 9 = gcd(6,9) 3. gcd(15, 23) 4. s and t such that s 15+t 23 = gcd(15,23) 50 / 81

51 Correctness of N A = p A q A, where p A,q A prime. gcd(e A,(p A 1)(q A 1)) = 1. e A d A 1 (mod (p A 1)(q A 1)). PK A = (N A,e A ) SK A = (N A,d A ) To encrypt: c = E(m,PK A ) = m e A (mod N A ). To decrypt: r = D(c,PK A ) = c d A (mod N A ). r = m. 51 / 81

52 Correctness of We need to find: p A,q A large primes. Choose numbers at random and check if they are prime? 52 / 81

53 Questions Correctness of 1. How many random integers of length 154 are prime? 53 / 81

54 Questions Correctness of 1. How many random integers of length 154 are prime? About x lnx numbers < x are prime, so about So we expect to test about 355 before finding a prime. (This holds because the expected number of tries until a success, when the probability of success is p, is 1/p.) 54 / 81

55 Questions Correctness of 1. How many random integers of length 154 are prime? About x lnx numbers < x are prime, so about So we expect to test about 355 before finding a prime. 2. How fast can we test if a number is prime? 55 / 81

56 Questions Correctness of 1. How many random integers of length 154 are prime? About x lnx numbers < x are prime, so about So we expect to test about 355 before finding a prime. 2. How fast can we test if a number is prime? Quite fast, using randomness. 56 / 81

57 Method 1 Correctness of Sieve of Eratosthenes: Lists: / 81

58 Method 1 Correctness of Sieve of Eratosthenes: Lists: / 81

59 Method 1 Correctness of Sieve of Eratosthenes: Lists: / 81

60 Method 1 Correctness of Sieve of Eratosthenes: Lists: more than number of atoms in universe So we cannot even write out this list! 60 / 81

61 Method 2 Correctness of CheckPrime(n) for i = 2 to n 1 do check if i divides n if it does then output i endfor output -1 if not found Check all possible s between 2 and n (or n). Our sun will die before we re done! 61 / 81

62 Examples of groups Correctness of Z, R sets +, operations Z n = {0,1,...,n 1} integers modulo n a+b a+b (mod n) addition operation a (mod n) = remainder when a is divided by n 4+3 = k (mod 5) 62 / 81

63 Examples of groups Correctness of Z, R sets +, operations Z n = {0,1,...,n 1} integers modulo n a+b a+b (mod n) addition operation (mod 5) a b a b (mod n) multiplication operation (mod 5) Properties: associative commutative identity inverses (for addition) 63 / 81

64 Multiplicative inverses? Correctness of a b = 1+kn n = 15 Element Inverse Computation a = 0 no inverse a = (mod 15) a = (mod 15) a = 3 no inverse a = (mod 15) a = 5 no inverse a = 6 no inverse a = (mod 15) a = (mod 15) a = (mod 15) a = (mod 15) a = (mod 15) 64 / 81

65 Multiplicative inverses? Correctness of Z n = {x 1 x n 1, gcd(x,n) = 1} gcd greatest common Extended Euclidean Algorithm find inverses Z n is the multiplicative group modulo n. The elements in Z n are relatively prime to n. 65 / 81

66 Examples Correctness of Group: set with 1 operation associative, identity, inverses Examples: Z, R with +, not with R 0 with Z n with + Z n with 66 / 81

67 Definitions Correctness of Subgroup: H G if H G and H is a group. Examples: Even integers with addition G = Z7, H = {1,2,4} H is the order of H. Theorem. [La Grange] For a finite group G, if H G, then H divides G. 67 / 81

68 Rabin Miller Primality Testing Correctness of In practice, use a randomized primality test. Miller Rabin primality test: Starts with Fermat test: 2 14 (mod 15) 4 1. So 15 is not prime. Theorem. Suppose p is a prime. Then for all 1 a p 1, a p 1 (mod p) = / 81

69 Rabin Miller Primality Test Correctness of Fermat test: Prime(n) repeat r times Choose random a Z n if a n 1 (mod n) 1 then return(composite) end repeat return(probably Prime) Carmichael Numbers Composite n. For all a Z n, a n 1 (mod n) 1. Example: 561 = If p is prime, 1 (mod p) = {1,p 1}. If p has > 1 distinct factors, 1 has at least 4 square roots. Example: 1 (mod 15) = {1,4,11,14} 69 / 81

70 Rabin Miller Primality Test Correctness of Taking square roots of 1 (mod 561): (mod 561) (mod 561) (mod 561) (mod 561) (mod 561) (mod 561) (mod 561) (mod 561) 67 2 is a witness that 561 is composite. 70 / 81

71 Rabin Miller Primality Test Correctness of Miller Rabin(n, k) Calculate odd m such that n 1 = 2 s m repeat k times Choose random a Z n if a n 1 (mod n) 1 then return(composite) if a (n 1)/2 (mod n) n 1 then break if a (n 1)/2 (mod n) 1 then return(composite) if a (n 1)/4 (mod n) n 1 then break if a (n 1)/4 (mod n) 1 then return(composite)... if a m (mod n) n 1 then break if a m (mod n) 1 then return(composite) end repeat return(probably Prime) 71 / 81

72 Rabin Miller Primality Test Correctness of Analysis: Suppose n is composite: Probability a is not a witness 1 2 Show there exists at least one witness Show that the set of non-witnesses is a subgroup Order of subgroup divides order of group, so it s 1 2 of the group 72 / 81

73 Rabin Miller Primality Test Correctness of Analysis: Suppose n is composite: Probability a is not a witness 1 2 Show there exists at least one witness Show that the set of non-witnesses is a subgroup Order of subgroup divides order of group, so it s 1 2 of the group Probability answer is Probably Prime 1 2 k 73 / 81

74 Conclusions about primality testing Correctness of 1. Miller Rabin is a practical primality test 2. There is a less practical deterministic primality test 3. Randomized algorithms are useful in practice 4. Algebra is used in primality testing 5. is not useless 74 / 81

75 Why does work? Correctness of Thm (The Chinese Remainder Theorem) Let m 1,m 2,...,m k be pairwise relatively prime. For any integers x 1,x 2,...,x k, there exists x Z s.t. x x i (mod m i ) for 1 i k, and this integer is uniquely determined modulo the product m = m 1 m 2...m k. It is also efficiently computable. CRT Algorithm For 1 i k, find u i such that u i 1 (mod m i ) u i 0 (mod m j ) for j i Compute x k i=1 x iu i (mod m). How do you find each u i? 75 / 81

76 Correctness of u i 1 (mod m i ) i integers v i s.t. u i +v i m i = 1. u i 0 (mod m j ) j i integers w i s.t. u i = w i (m/m i ). Thus, w i (m/m i )+v i m i = 1. Solve for the values v i and w i using the Extended Euclidean Algorithm. (Note that this is where we need that the m i are pairwise relatively prime.) After each w i is found, the corresponding u i can be calculated. The existence of the algorithm proves part of the theorem. What about uniqueness? Suppose x and y work. Look at x y. 76 / 81

77 Chinese Remainder Theorem Correctness of Example: Let m 1 = 3, m 2 = 5, and m 3 = 7. Suppose x 1 2 (mod 3) x 2 3 (mod 5) x 3 4 (mod 7) To calculate u 1 : w 1 (35)+v 1 (3) = 1 w 1 = 1; v 1 = 12 u 1 = ( 1)35 70 (mod 105) To calculate u 2 : w 2 (21)+v 2 (5) = 1 w 2 = 1; v 2 = 4 u 2 = (1)21 21 (mod 105) To calculate u 3 : w 3 (15)+v 3 (7) = 1 w 3 = 1; v 3 = 2 u 3 = (1)15 15 (mod 105) So we can calculate x (mod 105). 77 / 81

78 Fermat s Little Theorem Correctness of Why does work? CRT + Fermat s Little Theorem: p is a prime, p a. Then a p 1 1 (mod p) and a p a (mod p). 78 / 81

79 Correctness of Correctness of Consider x = D SA (E SA (m)). Note k s.t. e A d A = 1+k(p A 1)(q A 1). x (m e A (mod N A )) d A (mod N A ) m e Ad A m 1+k(p A 1)(q A 1) (mod N A ). Consider x (mod p A ). x m 1+k(p A 1)(q A 1) m (m (p A 1) ) k(q A 1) m 1 k(q A 1) m (mod p A ). Consider x (mod q A ). x m 1+k(p A 1)(q A 1) m (m (q A 1) ) k(p A 1) m 1 k(p A 1) m (mod q A ). Apply the Chinese Remainder Theorem: gcd(p A,q A ) = 1, x m (mod N A ). So D SA (E SA (m)) = m. 79 / 81

80 Digital Signatures with Correctness of Suppose Alice wants to sign a document m such that: No one else could forge her signature It is easy for others to verify her signature Note m has arbitrary length. is used on fixed length messages. Alice uses a cryptographically secure hash function h, such that: For any message m, h(m ) has a fixed length (512 bits?) It is hard for anyone to find 2 messages (m 1,m 2 ) such that h(m 1 ) = h(m 2 ). 80 / 81

81 Digital Signatures with Correctness of Then Alice decrypts h(m) with her secret key (N A,d A ) s = (h(m)) d A (mod N A ) Bob verifies her signature using her public key (N A,e A ) and h: c = s e A (mod N A ) He accepts if and only if h(m) = c. This works because s e A (mod N A ) = ((h(m)) d A ) e A (mod N A ) = ((h(m)) e A ) d A (mod N A ) = h(m). 81 / 81