Presentation is loading. Please wait.

Presentation is loading. Please wait.

Cryptography Lecture 8: Primality Testing and Factoring Piotr Faliszewski.

Similar presentations


Presentation on theme: "Cryptography Lecture 8: Primality Testing and Factoring Piotr Faliszewski."— Presentation transcript:

1 Cryptography Lecture 8: Primality Testing and Factoring Piotr Faliszewski

2 Previous Class Attacks on RSA  Known digits attacks  Low exponent attacks  Short plaintext attacks  Timing attacks Practical RSA  Exponentiation modulo n  Primality testing

3 Factoring and Primality Testing Factoring  Input: n  N  Output: nontrivial factor of n Primality testing  Input n  N  Output: the number is composite the number is probably prime Is there a difference?  Yes! – primality testing much easier!  You do not need to factor the number to see it is composite

4 Miller-Rabin Test Generalization of the Fermat’s test Principle  if p is a prime then x 2 = 1 (mod p) has only two solutions: x = 1 and x = -1 Why does the principle hold? Gist of the MR test  find a number b such that b 2 = 1 (mod p)  If b  {-1,1} then composite

5 Miller-Rabin Test MR( int n ): let n-1 = 2 k m a  random in {2, 3,..., n-2 } b 0 = a m (mod n) if b 0 = ±1 (mod n) then declare prime for j = 1 to k-1 do b j = b j-1 2 (mod n) if b j = 1 (mod n) then declare composite if b j = -1 (mod n) then declare prime declare composite What are we doing?  b 0 = a m (mod n)  b 1 = a 2m (mod n)  b 2 = a 4m (mod n) ...  b j = a 2 j m (mod n) ...  b k-1 = a (n-1)/2 (mod n)

6 Miller-Rabin Test: Examples n = 5*7*11 = 385 n -1 = 384 = 2 7 *3 k = 7, m = 3 a = 9 b 0 = 9 3 = 344 (mod 385) b 1 = 9 3*2 = 141 (mod 385) b 2 = 9 3*2 2 = 246 (mod 385) b 3 = 9 3*2 3 = 71 (mod 385) b 4 = 9 3*2 4 = 36 (mod 385) b 5 = 9 3*2 5 = 141 (mod 385) n = 3*11*17 = 561 n -1 = 560 = 2 4 *35 k = 4, m = 35 a = 2 b 0 = 2 35 = 263 (mod 561) b 1 = 2 35*2 = 166 (mod 561) b 2 = 2 35*2 2 = 67 (mod 561) b 3 = 2 35*2 3 = 1 (mod 561) Proof of compositeness!

7 Miller-Rabin Test: Examples n = 401 n -1 = 400 = 2 4 *25 k = 4, m = 25 a = 3 b 0 = 3 25 = 268 (mod 401) b 1 = 3 25*2 = 45 (mod 401) b 2 = 3 25*2 2 = 20 (mod 401) b 3 = 3 25*2 3 = 400 (mod 401) = -1 (mod 401) n = 401 n -1 = 400 = 2 4 *25 k = 4, m = 25 a = 2 b 0 = 2 25 = 356 (mod 401) b 1 = 2 25*2 = 20 (mod 401) b 2 = 2 25*2 2 = 400 (mod 401) Evidence of primality!

8 Miller-Rabin Test if b 0 = ±1 (mod n)  all b i ’s (i > 0) will be 1  can’t find nontrivial roots of 1 i  {1,..., k-1}  if b i = 1 (mod n) then b i-1 is neither 1 nor -1 b i-1 2 = 1 (mod n) we found a nontrivial root  if b i = -1 (mod n) then b i+1 through b k are all 1 (mod n) can’t find nontrivial roots of 1 Why this works?  n-1 = 2 k m  b 0 = a m (mod n)  b 1 = a 2m (mod n)  b 2 = a 4m (mod n) ...  b j = a 2 j m (mod n) ...  b k-1 = a (n-1)/2 (mod n)

9 Miller-Rabin Test: Quality MR test is probabilistic Answer  composite – the number is certainly composite  prime – the number is prime with high probability Errors  MR(n) says prime but n is composite  Pr[error] ≤ ¼  Repeat the test to downgrade the prob. of error

10 Other Primality Tests Solovay-Strassen Test  similar in nature to MR  uses so called Jacobi symbol  fast in practice  probabilistic Deterministic test  Agrawal, Kayal, and Saxena 2002  extremely slow Tests that prove primality  MR tests compositeness!  fairly slow  needed in very few cases

11 Factoring Huge amount of work on factoring!  we look at some simple algorithms Some best algorithms  quadratic sieve  elliptic curve  number field sieve Assumption  Factor an odd integer  produce one factor  how to get all of them? O(e (1+o(1))sqrt(lnn lnln n) ) O(e (1+o(1))sqrt(lnp lnln p) ) O(e (1.92+o(1))(lnn) 1/3 (lnlnn) 2/3 )

12 Factoring  Input: n  N  Output: nontrivial factor of n There are about  (n) = n / ln n primes ≤ n Trivial methods  divide by all numbers in {2,..., n-1}  or by all primes p p ≤ sqrt(n)  These are exponential!

13 Fermat’s Method The principle  express n as a difference of squares  n = x 2 - y 2  n = (x-y)(x+y) The algorithm  Compute: n + i 2 for i  {1,2,... }  Stop when n + i 2 is a square (i.e., x 2 = n+i 2 )  Then we have n = x 2 – i 2 Examples 15 = 4 2 – 1 2 = (4-1)(4+1) = 3*5 21 = 5 2 – 2 2 = = (5-2)(5+2) = 3*7

14 Fermat’s Method The principle  express n as a difference of squares  n = x 2 - y 2  n = (x-y)(x+y) The algorithm  Compute: n + i 2 for i 2 {1,2,... }  Stop when n + i 2 is a square (i.e., x 2 = n+i 2 )  Then we have n = x 2 – i 2 Performance  depends on distance between x and y  could be very slow! Conclusion for RSA  p and q should differ by a large value

15 Pollard’s p-1 Method The method input: n choose a > 1 (e.g., a = 2) choose B let b = a B! (mod n) d = gcd( b - 1, n ) d is a factor of n Goal of the method  factor n = pq...  provided p-1 has only small prime factors Example n = 7 * 11 = 77 a = 2 B = 4, B! = 2*3*4 = 24 b = 2 24 = 71 (mod 77) gcd(b-1, n) = gcd(70,77) = 7

16 Pollard’s p-1 Method The method input: n choose a > 1 (e.g., a = 2) choose B let b = a B! (mod n) d = gcd( b - 1, n ) d is a factor of n Goal of the method  factor n = pq...  provided p-1 has only small prime factors Example n = 7 * 11 = 77 a = 2 B = 2, B! = 2 b = 2 2 = 4 (mod 77) gcd(b-1, n) = gcd(3,77) = 1

17 Pollard’s p-1 Method The method input: n choose a > 1 (e.g., a = 2) choose B let b = a B! (mod n) d = gcd( b - 1, n ) d is a factor of n Goal of the method  factor n = pq...  provided p-1 has only small prime factors Example n = 7 * 11 = 77 a = 2 B = 6, B! = 2*3*4*5*6 = 720 b = = 1 (mod 77) gcd(b-1, n) = gcd(0,77) = 77

18 Pollard’s p-1 Method In symbols:  b 1 = a (mod n)  b 2 = b 1 2 (mod n) ...  b i = b i-1 i ... How to compute a B!  B! – can be very big  5! = 120  6! = 720  10! =  20! =  n! – about n log 2 n bits

19 Pollard’s p-1 Method In symbols:  b 1 = a (mod n)  b 2 = b 1 2 (mod n) ...  b i = b i-1 i ... How to compute a B!  a = 2,B = 4,n = 77  b 1 = 2 (mod 77)  b 2 = 2 2 = 4 (mod 77)  b 3 = 4 3 = 64 (mod 77)  b 4 = 64 4 = = 71 (mod 77)

20 Pollard’s p-1 Method The method input: n choose a > 1 (e.g., a = 2) choose B let b = a B! (mod n) d = gcd( b - 1, n ) d is a factor of n Why does it work?  p – prime factor of n  suppose: p-1 has only small prime factors  Then likely p-1 | B!  Then B! = k(n-1) b = (a p-1 ) k (mod p) b = 1 (mod p) p | b - 1

21 Pollard’s p-1 Method Potential problems  n = pq  both p and q have small factors b = 1 (mod p) b = 1 (mod q)  Method fails Choice of B  too small  method won’t work  too big  works slowly or fails Example n = 7 * 11 = 77 a = 2 B = 2  to small B = 4  worked B = 6  to big = 6 = 2*3 2! – does not contain 3 4! – contains 2 and 3 6! – contains 2,3 and 5  covers both factors!

22 Pollard’s p-1 Method Conclusions for RSA  n = pq  p-1 or q-1 has small prime factors? then RSA can be broken How to defend?  p 0  chose a large prime e.g., p 0 >  try numbers of the form: kp k – needs to be even! k > test kp 0 +1 for primality

23 Factoring Relation to squares  n – an integer  x,y – to integers s.t. x 2 = y 2 (mod n) x   y (mod n)  if such x, y exist then n is composite gcd( x-y, n ) is a nontrivial factor Examples  11 2 = 121 = 1 (mod 12)  5 2 = 25 = 1 (mod 12)  11  5 (mod 12)  gcd(11-5, 12 ) = 6

24 Factoring Relation to squares  n – an integer  x,y – to integers s.t. x 2 ´ y 2 (mod n) x   y (mod n)  if such x, y exist then n is composite gcd( x-y, n ) is a nontrivial factor Examples  5 2 = 25 = 7 (mod 9)  14 2 = 196 = 7 (mod 9)  14 = 9+5 = 5 (mod 9)  gcd(14-5, 9 ) = 9

25 Quadratic Sievie Idea  try to apply the principle from the previous slide  find x,y such that x 2 = y 2 (mod n) x  y (mod n) x  -y (mod n)  finding such x, y  not obvious  Take “random” squares  Reduce modulo n  Factor (hope for small factors!)  Try to build squares from what you get

26 Quadratic Sieve: Example n = = 5 5  19 (mod n) = 2 2  5  11  13  19 (mod n) = 3 2  13 3 (mod n) =2 6  3 2  11 (mod n) = 2  19 ( mod n) = 2 5  5  13 2 (mod n) =5 2  7 2  13 (mod n) (9398   1964  17078) 2 = 2 8  3 2  5 6  11 2  13 4  19 2 = (2 4  3  5 3  11  13 2  19) 2 (mod n) = (mod n) gcd( – , ) = 1093

27 Quadratic Sieve: Example n = = 5 5  19 (mod n) = 2 2  5  11  13  19 (mod n) = 3 2  13 3 (mod n) =2 6  3 2  11 (mod n) = 2  19 ( mod n) = 2 5  5  13 2 (mod n) =5 2  7 2  13 (mod n) (9398  8077  3397) 2 = 2 6  5 6  13 2  19 2 = (2 3  5 3  13  19) 2 (mod n) = (mod n) BUT: n – =  = (mod n)

28 How to Find the Squares? What squares to use?  we want small prime factors?  so x 2 should be slightly above n Idea: Try integers close to:  sqrt(i  n) + j  small j, various i  (sqrt(i  n) + j) 2 ≈ in + 2j sqrt(in) +j 2  approx: 2j sqrt(in) + j 2 (mod n)


Download ppt "Cryptography Lecture 8: Primality Testing and Factoring Piotr Faliszewski."

Similar presentations


Ads by Google