Department of Electrical Engineering, IIT Bombay
September 25, 2024
Public-key cryptography is more convenient
Most constructions of public-key cryptography rely on hard number-theoretic problems
If a is a divisor of b and a \notin \{1,b\} then a is called a nontrivial divisor, or a factor, of b.
A positive integer p > 1 is prime if it has no factors, i.e. it has only two divisors: 1 and itself.
A positive integer greater than 1 that is not prime is called composite
Every integer greater than 1 can be expressed uniquely as a product of primes, up to ordering
Any positive integer N > 1 can be written as N = \prod_i p_i^{e_i} where p_i’s are distinct primes and the e_i’s are integers such that e_i \ge 1 for all i.
Proposition: Let a be an integer and let b be a positive integer. Then there exist unique integers q, r for which a = qb + r and 0 \le r < b.
We write r = a \bmod b
Integers q and r can be computed in poly(\| a \|, \| b \|) time
The greatest common divisor of two integers a,b not both zero, written \gcd(a, b), is the largest integer c such that c \mid a and c \mid b.
If \gcd(a, b) = 1, we say that a and b are relatively prime
Algorithm: \textsf{GCD}(a,b)
Input: Integers a, b with a \ge b > 0
Output: \gcd(a,b)
If a = qb+r, then \gcd(a,b) = \gcd(b,r)
Algorithm runs in time \mathcal{O}(\| a \| \times\| b \|)
Proposition: Let a,b be positive integers. Then there exist integers X, Y such that Xa + Yb = \gcd(a,b). Furthermore, \gcd(a,b) is the smallest positive integer that can be expressed this way.
Proof
Additionally, define
\begin{align*} s_0 = 1, &\quad t_0 = 0\\ s_1 = 0, &\quad t_1 = 1\\ s_{i+1} = s_{i-1} - s_iq_i, &\quad t_{i+1} = t_{i-1} - t_i q_i \end{align*}for i \in \{1,\ldots,\lambda\}
Proposition: For i=0,1,\ldots,\lambda+1, we have a s_i + b t_i = r_i. In particular as_\lambda + b t_\lambda = \gcd(a,b)
Congruence modulo N obeys the standard rules of arithmetic with respect to addition, subtraction, and multiplication
But not division in general
a = a' \bmod N and b = b' \bmod N does not necessarily mean a/b = a'/b' \bmod N
For b \in \mathbb{Z}, if there exists c \in \mathbb{Z} such that bc = 1 \bmod N, we say b is invertible modulo N
We call c a multiplicative inverse of b modulo N.
We denote the multiplicative inverse of b by b^{-1}
Mult. inverses modulo N are unique when they exist
Division by b modulo N is only defined when b is invertible modulo N
Proposition: Let b, N be integers with b \ge 1 and N > 1. Then b is invertible modulo N \iff \gcd(b, N) = 1.
Let G be a set. A binary operation \circ on G is simply a function with domain G \times G.
For g, h \in G, we write g \circ h to represent \circ (g, h).
A group is a set G along with a binary operation which satisfies:
\mathbb{R} with +
\mathbb{R} \setminus \{0\} with \times
\mathbb{R} is not a group with subtraction as the operation
For a set S, the set of bijective functions f: S \mapsto S with function composition as the operator
When the binary operation is understood, we simply call the set G a group.
If G has a finite number of elements, we say G is a finite group
We use |G| to denote the order of the group
Example: \mathbb{Z}_N = \{0,1,\ldots, N-1\} under modulo N addition for N > 1
Corollary: There exists a group of every finite order N \ge 1
Instead of an operator like \circ we will use additive or multiplicative notation.
Additive notation
Multiplicative notation
The usual cancellation law is valid for any group.
Lemma Let G be a group and a,b,c \in G. If ac = bc, then a = b.
The identity in a group is unique
Each element g in a group has a unique inverse
For every g \in G, \left( g^{-1} \right)^{-1} = g
For every g,h \in G, \left( gh \right)^{-1} = h^{-1}g^{-1}
A group is abelian if for all g, h \in G, g h = h g.
Cryptography typically involves finite abelian groups
For a positive integer m, and group element g g^m = \underbrace{g\cdots g}_{m \text{ times}}
For zero or negative integers, we define g^0 = 1 and g^{-m} = \left(g^{-1}\right)^m
For a positive integer m, and group element g mg = m \cdot g = \underbrace{g+\cdots+g}_{m \text{ times}}
For zero or negative integers, we define 0 g = 0 and (-m)g = m(-g)
If G is a group, a nonempty subset H \subseteq G is a subgroup of G if H itself forms a group under the same operation associated with G.
Every group G has the trivial subgroups G and \{e\} where e is the identity of G.
Proposition A nonempty subset H of a group G is called a subgroup of G if and only if
Proposition A nonempty subset H of a finite group G is called a subgroup of G if and only if
Lagrange’s Theorem If H is a subgroup of a finite group G, then |H| divides |G|.
Definition Let H be a subgroup of a group G. For any g \in G, the set H + g = \left\{ h+ g \mid h \in H \right\} is called a right coset of H.
For abelian groups, there is only a notion of a coset as both right and left cosets are the same
Example H = \left\{ 0,3 \right\} is a subgroup of \mathbb{Z}_6 = \left\{ 0,1,2,3,4,5 \right\}. It has right cosets
Theorem: Let G be a finite group of order m. Then for any element g \in G, we have g^m = 1.
Corollary: Let G be a finite group of order m > 1. Then for any element g \in G and any integer x, we have g^x = g^{[x \bmod m]}.
Corollary: Let G be a finite group of order m > 1. Let e > 0 be an integer, and define the function f_e : G \mapsto G by f_e(g) = g^e.
The Euler phi function \phi: \mathbb{N} \mapsto \mathbb{N} is defined as
Properties
Corollary: Let N > 1 and a\in \mathbb{Z}_N^*. Then a^{\phi(N)} = 1 \bmod N.
Corollary: Fix N > 1. For integer e > 0, define f_e: \mathbb{Z}_N^* \mapsto \mathbb{Z}_N^* by f_e(x) = [x^e \bmod N].
There are certain things whose number is unknown. If we count them by threes, we have two left over; by fives, we have three left over; and by sevens, two are left over. How many things are there?
– Sunzi Suanjing, 3rd century CE
Given groups (G, \star) and (H, \otimes), we can define a new group G\times H as follows
The elements of G \times H are ordered pairs (g,h) with g \in G and h \in H
The group operation \circ of G \times H is defined as \begin{equation*} (g,h) \circ (g', h') = (g \star g', h \otimes h'). \end{equation*}
How to go from (a, b) \in \mathbb{Z}_p \times \mathbb{Z}_q to an element in \mathbb{Z}_N?
Proposition: If (a, b) \in \mathbb{Z}_p^* \times \mathbb{Z}_q^* and \gcd(p,q) = 1, then the x obtained as described above belongs to \mathbb{Z}_N^*.
Let m_1,m_2,\ldots,m_l be pairwise relatively prime positive integers with M = m_1 m_2 \cdots m_l
Then the unique solution modulo M of the system of congruences \begin{align*} x & = a_1 \bmod m_1 \\ x & = a_2 \bmod m_2 \\ & \vdots \\ x & = a_l \bmod m_l \end{align*} is given by \begin{equation*} x = a_1 M_1 y_1 + a_2 M_2 y_2 + \cdots + a_l M_l y_l \end{equation*} where M_i = \frac{M}{m_i} and M_iy_i = 1 \bmod m_i.
Sections 9.1, 9.2 of Katz and Lindell
Sections 4.1, 4.2 of Shoup