100 likes | 350 Views
Online Cryptography Course Dan Boneh. Intro. Number T heory. Modular e’th roots. Modular e’th roots. We know how to solve modular linear equations: a⋅x + b = 0 in Z N Solution : x = −b⋅a -1 in Z N What about higher degree polynomials?
E N D
Online Cryptography Course Dan Boneh Intro. Number Theory Modular e’th roots
Modular e’th roots We know how to solve modular linear equations: a⋅x + b = 0 in ZNSolution: x = −b⋅a-1 in ZN What about higher degree polynomials? Example: let p be a prime and c∈Zp . Can we solve: x2 – c = 0 , y3 – c = 0 , z37 – c = 0 in Zp
Modular e’th roots Let p be a prime and c∈Zp . Def: x∈Zps.t.xe = c in Zp is called an e’th root of c . Examples: 71/3 = 6 in 31/2= 5 in 11/3 = 1 in 21/2 does not exist in
The easy case When does c1/e in Zpexist? Can we compute it efficiently? The easy case: suppose gcd( e , p-1 ) = 1 Then for all c in (Zp)*: c1/eexists in Zp and is easy to find. Proof: let d = e-1 in Zp-1 . Then d⋅e = 1 in Zp-1 ⇒
The case e=2: square roots x 1 5 2 4 3 −x 10 9 8 7 6 If p is an odd prime then gcd( 2, p-1) ≠ 1 Fact: in , x ⟶ x2 is a 2-to-1 function Example: in : Def: x in is a quadratic residue (Q.R.) if it has a square root in p odd prime ⇒ the # of Q.R. in is (p-1)/2 + 1 9 4 5 1 3 x2
Euler’s theorem Thm: x in (Zp)* is a Q.R. ⟺ x(p-1)/2= 1 in Zp(p odd prime) Example: Note: x≠0 ⇒ x(p-1)/2 = (xp-1)1/2 = 11/2 ∈ { 1, -1 } in Zp Def: x(p-1)/2 is called the Legendre Symbol of x over p (1798) in : 15, 25, 35, 45, 55, 65, 75, 85, 95, 105 = 1 -1 1 1 1, -1, -1, -1, 1, -1
Computing square roots mod p Suppose p = 3 (mod 4) Lemma: if c∈(Zp)* is Q.R. then √c = c(p+1)/4 in Zp Proof: When p = 1 (mod 4), can also be done efficiently, but a bit harder run time ≈ O(log3 p)
Solving quadratic equations mod p Solve: a⋅x2+ b⋅x+ c = 0 in Zp Solution: x = (-b ± √b2 – 4⋅a⋅c ) / 2a in Zp • Find (2a)-1 in Zpusing extended Euclid. • Find square root of b2 – 4⋅a⋅c in Zp(if one exists) using a square root algorithm
Computing e’th roots mod N ?? Let N be a composite number and e>1 When does c1/e in ZNexist? Can we compute it efficiently? Answering these questions requires the factorization of N (as far as we know)