1. Announcements: 1. Pass in worksheet on using RSA now. 2. DES graded soon 3. Short “pop” quiz on Ch 3 (Thursday at earliest) 4. Term project groups and topics due by Friday 1.Can use discussion forum to find teammates 5. HW6 posted, due date bumped back to next week (and a few questions added), but doing what’s there now might help your quiz prep. Questions? This week: Primality testing, factoring Primality testing, factoring Discrete Logs Discrete Logs DTTF/NB479: DszquphsbqizDay 22

2. Miller-Rabin Given odd n>1, write n-1=2 k m, where k >=1. Choose a base a randomly (or just pick a=2) Let b 0 =a m (mod n) If b 0 =+/-1, stop. n is probably prime by Fermat For i = 1..k-1 Compute b i =b i-1 2. If b i =1(mod n), stop. n is composite by SRCT, and gcd(b i-1 -1,n) is a factor. If b i =-1(mod n), stop. n is probably prime by Fermat. If b k =1 (mod n), stop. n is composite by SRCT Else n is composite by Fermat. So: k b0b0 b1b1 bkbk Big picture: Fermat on steroids By doing a little extra work (finding k to change the order of the powermod), we can call some pseudoprimes composite and find some of their factors

3. Using within a primality testing scheme Odd? div by other small primes? Prime by Factoring/ advanced techn.? n no yes prime Fermat? (From Day 11)

4. Using within a primality testing scheme Finding large probable primes #primes < x = #primes < x = Density of primes: ~1/ln(x) For 100-digit numbers, ~1/230. So ~1/115 of odd 100-digit numbers are prime Can start with a random large odd number and iterate, applying M-R to remove composites. We’ll soon find one that is a likely prime. Maple’s nextprime() appears to do this, but also runs the Lucas test: http://www.mathpages.com/home/k math473.htm http://www.mathpages.com/home/k math473.htm http://www.mathpages.com/home/k math473.htm Alternatively, could repeat M-R to get high probability prime Odd? div by other small primes? Prime by Factoring/ advanced techn.? n no yes prime Pass M-R?

5. Factoring If you are trying to factor n=pq and know that p~q, use Fermat factoring: Compute n + 1 2, n + 2 2, n + 3 2, until you reach a perfect square, say r 2 = n + k 2 Compute n + 1 2, n + 2 2, n + 3 2, until you reach a perfect square, say r 2 = n + k 2 Then n = r 2 - k 2 = (r+k)(r-k) Then n = r 2 - k 2 = (r+k)(r-k) The moral of the story? Choose p and q such that _____ Choose p and q such that _____

6. Example Factor n = 3837523 Concepts we will learn also apply to factoring really big numbers. They are the basis of the best current methods All you have to do to win $30,000 is factor a 212 digit number. This is the RSA Challenge: http://www.rsa.com/rsalabs/node.asp?id=2093#RSA704 http://www.rsa.com/rsalabs/node.asp?id=2093#RSA704

7. Quadratic Sieve (1) Factor n = 3837523 Want x,y:  gcd(x-y, n) is a factor Step 1: Pick a factor base, just a set of small factors. In our examples, we’ll use those < 20. In our examples, we’ll use those < 20. There are 8: 2, 3, 5, 7, 11, 13, 17, 19 There are 8: 2, 3, 5, 7, 11, 13, 17, 19

8. Factor n = 3837523 Want x,y:  gcd(x-y, n) is a factor Step 2: We want squares that are congruent to products of factors in the factor base. Our hope: Reasonably small numbers are more likely to be products of factors in the factor base. 1. Thenwhich is small as long as k isn’t too big 2. Loop over small , lots of k. 3. A newer technique, the number field sieve, is somewhat faster Quadratic Sieve (2a)

9. Factor n = 3837523 Want x,y:  gcd(x-y, n) is a factor Step 2: We want squares that are congruent to products of factors in the factor base. Our hope: Reasonably small numbers are more likely to be products of factors in the factor base. Examples: Quadratic Sieve (2b)

10. Factor n = 3837523 Want x,y:  gcd(x-y, n) is a factor Step 3: Want two non-congruent perfect squares Example: This is close, but all factors need to be paired Recall: Quadratic Sieve (3)

11. Factor n = 3837523 Want x,y:  gcd(x-y, n) is a factor Step 3: Want two non-congruent perfect squares Example: This is close, but all factors need to be paired Generate lots of # and experiment until all factors are paired. Quadratic Sieve (3b) So what? gcd(1147907-17745, n)=1093 Other factor = n/1093=3511

12. Factor n = 3837523 Want x,y:  gcd(x-y, n) is a factor Step 4: Want to get 2 non-congruent perfect squares Example: This is close, but all factors need to be paired Generate lots of # and experiment until all factors are paired. To automate this search: Can write each example are a row in a matrix, where each column is a prime in number base Then search for dependencies among rows mod 2. May need extra rows, since sometimes we get x=+/-y. Quadratic Sieve (3b)

13. Factor n = 3837523 To automate this search: Each row in the matrix is a square Each column is a prime in the number base Search for dependencies among rows mod 2. For last one (green) So we can’t use the square root compositeness theorem My code Sum: 0 2 2 2 0 4 0 0 Sum: 8 4 6 0 2 4 0 2 Sum: 6 0 6 0 0 2 0 2