Download presentation

Published byRosalyn Mason Modified over 2 years ago

1
**Lecture 8: Primality Testing and Factoring Piotr Faliszewski**

Cryptography Lecture 8: Primality Testing and Factoring Piotr Faliszewski

2
**Previous Class Attacks on RSA Practical RSA Known digits attacks**

Low exponent attacks Short plaintext attacks Timing attacks Practical RSA Exponentiation modulo n Primality testing

3
**Factoring and Primality Testing**

Input: n N Output: nontrivial factor of n Primality testing Input n N Output: the number is composite the number is probably prime Is there a difference? Yes! – primality testing much easier! You do not need to factor the number to see it is composite

4
**Miller-Rabin Test Generalization of the Fermat’s test**

Principle if p is a prime then x2 = 1 (mod p) has only two solutions: x = 1 and x = -1 Why does the principle hold? Gist of the MR test find a number b such that b2 = 1 (mod p) If b {-1,1} then composite

5
**Miller-Rabin Test What are we doing? b0 = am (mod n) b1 = a2m (mod n)**

MR( int n ): let n-1 = 2km a random in {2, 3, ..., n-2 } b0 = am (mod n) if b0 = ±1 (mod n) then declare prime for j = 1 to k-1 do bj = bj-12 (mod n) if bj = 1 (mod n) then declare composite if bj = -1 (mod n) then declare prime declare composite What are we doing? b0 = am (mod n) b1 = a2m (mod n) b2 = a4m (mod n) ... bj = a2jm (mod n) bk-1 = a(n-1)/2 (mod n)

6
**Miller-Rabin Test: Examples**

k = 7, m = 3 a = 9 b0 = 93 = 344 (mod 385) b1 = 93*2 = 141 (mod 385) b2 = 93*22 = 246 (mod 385) b3 = 93*23 = 71 (mod 385) b4 = 93*24 = 36 (mod 385) b5 = 93*25 = 141 (mod 385) n = 3*11*17 = 561 n -1 = 560 = 24*35 k = 4, m = 35 a = 2 b0 = 235 = 263 (mod 561) b1 = 235*2 = 166 (mod 561) b2 = 235*22 = 67 (mod 561) b3 = 235*23 = 1 (mod 561) Proof of compositeness!

7
**Miller-Rabin Test: Examples**

k = 4, m = 25 a = 3 b0 = 325 = 268 (mod 401) b1 = 325*2 = 45 (mod 401) b2 = 325*22 = 20 (mod 401) b3 = 325*23 = 400 (mod 401) = -1 (mod 401) n = 401 n -1 = 400 = 24*25 k = 4, m = 25 a = 2 b0 = 225 = 356 (mod 401) b1 = 225*2 = 20 (mod 401) b2 = 225*22 = 400 (mod 401) Evidence of primality!

8
**Miller-Rabin Test if b0 = ±1 (mod n) i {1, ..., k-1} Why this works?**

all bi’s (i > 0) will be 1 can’t find nontrivial roots of 1 i {1, ..., k-1} if bi = 1 (mod n) then bi-1 is neither 1 nor -1 bi-12 = 1 (mod n) we found a nontrivial root if bi = -1 (mod n) then bi+1 through bk are all 1 (mod n) Why this works? n-1 = 2km b0 = am (mod n) b1 = a2m (mod n) b2 = a4m (mod n) ... bj = a2jm (mod n) bk-1 = a(n-1)/2 (mod n)

9
**Miller-Rabin Test: Quality**

MR test is probabilistic Answer composite – the number is certainly composite prime – the number is prime with high probability Errors MR(n) says prime but n is composite Pr[error] ≤ ¼ Repeat the test to downgrade the prob. of error

10
**Other Primality Tests Solovay-Strassen Test Deterministic test**

similar in nature to MR uses so called Jacobi symbol fast in practice probabilistic Deterministic test Agrawal, Kayal, and Saxena 2002 extremely slow Tests that prove primality MR tests compositeness! fairly slow needed in very few cases

11
**Factoring Huge amount of work on factoring! Some best algorithms**

we look at some simple algorithms Some best algorithms quadratic sieve elliptic curve number field sieve Assumption Factor an odd integer produce one factor how to get all of them? O(e(1+o(1))sqrt(lnn lnln n)) O(e(1+o(1))sqrt(lnp lnln p)) O(e(1.92+o(1))(lnn)1/3(lnlnn)2/3)

12
**Factoring Factoring There are about (n) = n / ln n primes ≤ n**

Input: n N Output: nontrivial factor of n There are about (n) = n / ln n primes ≤ n Trivial methods divide by all numbers in {2, ... , n-1} or by all primes p p ≤ sqrt(n) These are exponential!

13
**Fermat’s Method The principle The algorithm Examples**

express n as a difference of squares n = x2 - y2 n = (x-y)(x+y) The algorithm Compute: n + i2 for i {1,2, ... } Stop when n + i2 is a square (i.e., x2 = n+i2) Then we have n = x2 – i2 Examples 15 = 42 – 12 = (4-1)(4+1) = 3*5 21 = 52 – 22 = = (5-2)(5+2) = 3*7

14
**Fermat’s Method The principle The algorithm Performance**

express n as a difference of squares n = x2 - y2 n = (x-y)(x+y) The algorithm Compute: n + i2 for i 2 {1,2, ... } Stop when n + i2 is a square (i.e., x2 = n+i2) Then we have n = x2 – i2 Performance depends on distance between x and y could be very slow! Conclusion for RSA p and q should differ by a large value

15
**Pollard’s p-1 Method The method Goal of the method Example input: n**

choose a > 1 (e.g., a = 2) choose B let b = aB! (mod n) d = gcd( b - 1, n ) d is a factor of n Goal of the method factor n = pq... provided p-1 has only small prime factors Example n = 7 * 11 = 77 a = 2 B = 4, B! = 2*3*4 = 24 b = 224 = 71 (mod 77) gcd(b-1, n) = gcd(70,77) = 7

16
**Pollard’s p-1 Method The method Goal of the method Example input: n**

choose a > 1 (e.g., a = 2) choose B let b = aB! (mod n) d = gcd( b - 1, n ) d is a factor of n Goal of the method factor n = pq... provided p-1 has only small prime factors Example n = 7 * 11 = 77 a = 2 B = 2, B! = 2 b = 22 = 4 (mod 77) gcd(b-1, n) = gcd(3,77) = 1

17
**Pollard’s p-1 Method The method Goal of the method Example input: n**

choose a > 1 (e.g., a = 2) choose B let b = aB! (mod n) d = gcd( b - 1, n ) d is a factor of n Goal of the method factor n = pq... provided p-1 has only small prime factors Example n = 7 * 11 = 77 a = 2 B = 6, B! = 2*3*4*5*6 = 720 b = 2720 = 1 (mod 77) gcd(b-1, n) = gcd(0,77) = 77

18
**Pollard’s p-1 Method In symbols: How to compute aB! b1 = a (mod n)**

b2 = b12 (mod n) ... bi = bi-1i How to compute aB! B! – can be very big 5! = 120 6! = 720 10! = 20! = n! – about n log2 n bits

19
**Pollard’s p-1 Method In symbols: How to compute aB! b1 = a (mod n)**

b2 = b12 (mod n) ... bi = bi-1i How to compute aB! a = 2, B = 4, n = 77 b1 = 2 (mod 77) b2 = 22 = 4 (mod 77) b3 = 43 = 64 (mod 77) b4 = 644 = = 71 (mod 77)

20
**Pollard’s p-1 Method The method Why does it work? input: n**

choose a > 1 (e.g., a = 2) choose B let b = aB! (mod n) d = gcd( b - 1, n ) d is a factor of n Why does it work? p – prime factor of n suppose: p-1 has only small prime factors Then likely p-1 | B! Then B! = k(n-1) b = (ap-1)k (mod p) b = 1 (mod p) p | b - 1

21
**Pollard’s p-1 Method Potential problems Choice of B n = pq**

both p and q have small factors b = 1 (mod p) b = 1 (mod q) Method fails Choice of B too small method won’t work too big works slowly or fails Example n = 7 * 11 = 77 a = 2 B = 2 to small B = 4 worked B = 6 to big 7 - 1 = 6 = 2*3 2! – does not contain 3 4! – contains 2 and 3 6! – contains 2,3 and 5 covers both factors!

22
**Pollard’s p-1 Method Conclusions for RSA How to defend? n = pq**

p-1 or q-1 has small prime factors? then RSA can be broken How to defend? p0 chose a large prime e.g., p0 > 1040 try numbers of the form: kp0 + 1 k – needs to be even! k > 1060 test kp0+1 for primality

23
**Factoring Relation to squares Examples n – an integer**

x,y – to integers s.t. x2 = y2 (mod n) x y (mod n) if such x, y exist then n is composite gcd( x-y, n ) is a nontrivial factor Examples 112 = 121 = 1 (mod 12) 52 = 25 = 1 (mod 12) 11 5 (mod 12) gcd(11-5, 12 ) = 6

24
**Factoring Relation to squares Examples n – an integer**

x,y – to integers s.t. x2 ´ y2 (mod n) x y (mod n) if such x, y exist then n is composite gcd( x-y, n ) is a nontrivial factor Examples 52 = 25 = 7 (mod 9) 142 = 196 = 7 (mod 9) 14 = 9+5 = 5 (mod 9) gcd(14-5, 9 ) = 9

25
Quadratic Sievie Idea try to apply the principle from the previous slide find x,y such that x2 = y2 (mod n) x y (mod n) x -y (mod n) finding such x, y not obvious Take “random” squares Reduce modulo n Factor (hope for small factors!) Try to build squares from what you get

26
**Quadratic Sieve: Example**

n = = 55 19 (mod n) = 22 5 11 13 19 (mod n) = 32 133 (mod n) = 26 32 11 (mod n) 80772 = 2 19 ( mod n) = 25 5 132 (mod n) = 52 72 13 (mod n) (9398 1964 17078)2 = 28 32 56 112 134 192 = (24 3 53 11 132 19)2 (mod n) = (mod n) gcd( – , ) = 1093

27
**Quadratic Sieve: Example**

n = = 55 19 (mod n) = 22 5 11 13 19 (mod n) = 32 133 (mod n) = 26 32 11 (mod n) 80772 = 2 19 ( mod n) = 25 5 132 (mod n) = 52 72 13 (mod n) (9398 8077 3397)2 = 26 56 132 192 = (23 53 13 19)2 (mod n) = (mod n) BUT: n – = = (mod n)

28
**How to Find the Squares? What squares to use?**

we want small prime factors? so x2 should be slightly above n Idea: Try integers close to: sqrt(i n) + j small j, various i (sqrt(i n) + j)2 ≈ in + 2j sqrt(in) +j2 approx: 2j sqrt(in) + j2 (mod n)

Similar presentations

OK

MA/CSSE 473 Day 08 Randomized Primality Testing Carmichael Numbers Miller-Rabin test.

MA/CSSE 473 Day 08 Randomized Primality Testing Carmichael Numbers Miller-Rabin test.

© 2018 SlidePlayer.com Inc.

All rights reserved.

Ads by Google

Ppt on stock market Marketing mix ppt on sony Ppt on beer lambert law definition Ppt on soft skills download Ppt on steps to effective evangelism Ppt on cartesian product of three Ppt on water scarcity in the world Ppt on pin diode phase Ppt on 21st century skills in education Ppt on automobile related topics about global warming