Math Review For Asymmetric Crypto

Divisibility

a|b

means a divides b:

a|b \rightarrow b = ac

for some c.

2|4

10|100

2|b, \text{b even}

Examples:

Prime Numbers

A number p is prime if the only

numbers that divide it are 1 and p itself.

First few:

2,3,5,7,11,13,17,19,23,29,31...

The most important thing about prime numbers is that they are building blocks of the integers.

Fundamental Theorem of Arithmetic

All numbers can be written uniquely as a product of prime numbers.

Examples:

1000 = 2^3 \cdot 5^3

1001 = 7\cdot 11 \cdot 13

18446744073709558080 = 2^6\cdot 3^2 \cdot 5 \cdot 167^2 \cdot 409 \cdot 761 \cdot 859^2

This is not true when composite numbers are involved:

30 = 3\cdot 10 = 5\cdot 6

Greatest Common Divisor (GCD)

The GCD of two numbers is the largest number that divides both of them.

If the GCD is 1, the two numbers are said to be coprime or relatively prime.

Examples:

\gcd(14,21) = 7

\gcd(12,60) = 12

\gcd(5,7) = 1

Calculating the GCD

can be done very efficiently,

even without knowing the factorizations

of the numbers themselves!

Solving

Given two integers a and b, the Euclidean algorithm will produce the GCD as well as two integers u and v that solve the above.

def egcd(a,b):
  """Extended GCD algorithm"""
  if b == 0:
    return (a, 1, 0)
  else:
    g, x, y = egcd(b, a%b)

  u = y
  v = x - (a/b)*y
  assert a*u + b*v == g

  GCD = namedtuple('GCD', 'gcd u v')
  return GCD(gcd = g, u = y, v = x - (a/b)*y)

print egcd(18,24)

$ python gcd.py
GCD(gcd=6, u=-1, v=1)

au + bv = \text{gcd}(a,b)

18\cdot(-1) + 24\cdot1 = 6, u = -1, v=1

Congruences: Modular arithmetic

a \equiv b \mod m

means a - b is divisible by m.

Or: a and b differ only by a multiple of m.

Examples:

13 = 1 \mod 12

9 + 8 \equiv 5 \mod 12

7 \equiv 0 \mod 7

-4 \equiv 13 \mod 17

Addition and Multiplication mod p

\mathbb{Z}_p

The set of numbers mod p is often written

\mathbb{Z}_6

Addition in

Multiplication in

Division in

\mathbb{Z}_p

Let's say you want to solve for x:

ax = b \mod p

This has a unique answer if and only if

\gcd(a,p) = 1

Example:

5x = 7 \mod 11

\gcd(5,11) = 1

Brute-force guessing gives:

5\cdot 8 \equiv 40 \equiv 7 \mod 11

x = 8 \mod 11

7/5 \equiv 8 \mod 11

Using the Euclidean Algorithm to find Inverses in

\mathbb{Z}_p

ax = 1 \mod p \rightarrow ax + kp = 1 = \gcd(a,p)

1583x \equiv 1\text{ mod 7918}

\text{gcd}(1583, 7918) = 1

Thus 1583 and 7918 are coprime, and we can use Euclid's algorithm.

def invmod(a, m):
  assert gcd(a,m) == 1
  g = egcd(a,m)
  result = g.u
  # find the smallest positive solution
  while result < 0: 
    result += m
  return result

$ python invmod.py
5277

>>> (5277 * 1583) % 7918
1

x \equiv 5277\text{ mod 7918}

Modular inverse example

Chinese Remainder Theorem

Suppose x = 25 mod 42.

This means x = 25 + 42*k for some integer k.

This means x = 25 + 6*(7k) = 25 + 6m for some m. So x = 1 mod 6. Also,

x = 25 + 7*(6k) = 25 + 7n for some n. So x = 4 mod 7.

x = 25 \mod 42 \rightarrow

x = 4 \mod 7

x = 1 \mod 6

The CRT says this process can be reversed if m and n are coprime.

x = a_1 \mod m

x = a_2 \mod n

\rightarrow x = c \mod m\cdot n

Big numbers:

Modular exponentiation

In crypto, calculating these numbers raised to large powers happens all the time. Here's an example of the algorithm.

Let's calculate:

3^{218}\text{ mod 1000}

3^{218} = 3^{2 + 2^3 + 2^4 + 2^6 + 2^7} = 3^2\cdot3^{2^3}\cdot3^{2^4}\cdot3^{2^6}\cdot3^{2^7}

Notice how each subsequent term involves squaring the previous one (sometimes multiple times)

Write the exponent in binary.
Then reading the bits from right to left, you can build a table of intermediate products, taking mods at each step.

218 = (11011010)_2

3^{218} = 3^2\cdot3^{2^3}\cdot3^{2^4}\cdot3^{2^6}\cdot3^{2^7}

3^{218} \equiv 9\cdot561\cdot721\cdot281\cdot961\text{ mod 1000} \equiv 489\text{ mod 1000}

def expmod(g, A, m):
  bits = bin(A)[2:][::-1]
  a = []
  for i, bit in enumerate(bits):
    a.append(g%m)
    g = (g%m) * (g%m)

  res = 1
  for i, bit in enumerate(bits):
    res *= a[i]**(int(bit)) % m
    res %= m

  return res

print expmod(3, 218, 1000)

$ python expmod.py
489

"Fast Powering"

In Python, the "pow" function

does this for you, likely faster!

Fermat's Theorem

a^{p-1} \equiv 1\text{ mod p}, p\nmid a

Here, p is a prime number, and doesn't divide a.

Example: let a = 2, and

x = 31987937737479355332620068643713101490952335301

2^{x-1} = 1281265953551359064133601216247151836053160074\text{ mod x}

Thus we know the number is composite!

(But no idea what its factors are)

Primitive Roots

Let

x = 3 \mod 7

3^1 \equiv 3

3^2 \equiv 2

3^3 \equiv 6

3^4 \equiv 4

3^5 \equiv 5

3^6 = 1

\mathbb{Z}_7 = \{0,1,2,3,4,5,6\}

Thus 3 generates all the nonzero members of this set.

We call 3 a primitive root.

\mathbb{F}^*_7 = \{1,2,3,4,5,6\}

Public-Key Cryptosystem

In 1976, Diffie and Hellman came up with defined a PKC and trapdoor information.

Domain

Range

f^{-1}

Easy!

Very difficult!

Easy, with some trapdoor information!

f^{-1}

is a one-way function, easy to compute in one direction, very hard to invert without special information.

Are there truly one-way functions?

No one has concluded for sure that they exist. What we do have are several problems that people believe are very hard. Decades of trying to break them have failed--so far.

Two very common cryptosystems in use today depend on hard problems:

RSA: integer factorization problem

ECDH (Elliptic Curve Diffie-Hellman): discrete log problem (DLP)

Today we focus only on the DLP.

The Discrete Log Problem

Let p be a prime number. Then

\mathbb{F}^*_p = \{1,2,3,...p-1\}

\mathbb{F}^*_p

Every element of

has an inverse, mod p.

You can prove that there is a primitive root g in this set. This means that g generates the set:

\mathbb{F}^*_p = \{1,g,g^2,...,g^{p-2}\}

Let g be a primitive root for

\mathbb{F}_p

Let h be an element of

\mathbb{F}_p

Find x such that:

g^x = h \mod p

627^i \mod 941

Discrete Logs Look Random

Diffie-Hellman Exchange

Step 0: Pick a (large) p and a primitive root g.

Step 1: Alice picks a secret integer a mod p and computes:

A = g^a \mod p

Step 2: Bob picks a secret integer b mod p and computes:

B = g^b \mod p

Step 3: Alice sends A to Bob. Bob sends B to Alice.

Step 4: Alice and Bob can compute a shared secret:

A^b = B^a = g^{ab} \mod p

Eve's Hacking Challenge, mod p

She knows:

g,p,g^a,g^b

She wants:

g^{ab}

This is the Diffie-Hellman Problem (DHP).

It is certainly no harder than the DLP.

If she solves the DLP (which is really difficult to solve) and gets a and b, she can solve the DHP.

If she solves the DHP, can she solve the DLP?

No one knows!

p \approx 2^{1000}

This problem is unfeasible to crack brute-force if

Key Exchange Example

Alice and Bob agree to use p = 941 and primitive root g = 627. This information is public. Even Eve knows it.

Alice chooses a secret key, 347. Bob chooses a secret 781.

Alice computes:

A = 627^{347} \mod 941 = 390

Bob computes:

B = 627^{781} \mod 941 = 691

Alice sends A to Bob. Bob sends B to Alice. Eve can see all this.

Alice and Bob can compute a shared secret key:

K = 627^{347 \cdot 781} \mod 941 = 470

Breaking Lame Crypto: Pohlig-Hellman Theorem

The prime number you choose has to be very large, but that's not all.

Let's say p-1 factors into a product of "small" prime numbers.

Then for each small prime number r, I have a set of numbers:

\mathbb{F}^*_r = \{1,g_i,g_i^2,...,g_i^{r-2}\}

g_i

generates

\mathbb{F}^*_r

Eve gives this small generator to Bob, who computes a number

h_i

g_i^{x_i} = h_i \mod r

Now solve for each small factor.

Then stitch together x from all the x_i using the CRT!