Factoring integers, Producing primes and the RSA cryptosystem - - PowerPoint PPT Presentation

▶
factoring integers producing primes and the rsa
SMART_READER_LITE
LIVE PREVIEW

Factoring integers, Producing primes and the RSA cryptosystem - - PowerPoint PPT Presentation

Jul 11, 2023 126 likes •2.07k views

College of Science for Women 0 Factoring integers,..., RSA Lecture in Number Theory College of Science for Women Baghdad University March 31, 2014 Factoring integers, Producing primes and the RSA cryptosystem Francesco Pappalardi

slide-1
SLIDE 1

Factoring integers,..., RSA

College of Science for Women

Lecture in Number Theory College of Science for Women Baghdad University March 31, 2014

Factoring integers, Producing primes and the RSA cryptosystem

Francesco Pappalardi

Universit` a Roma Tre

slide-2
SLIDE 2

Factoring integers,..., RSA

College of Science for Women 1

How large are large numbers?

Universit` a Roma Tre

slide-3
SLIDE 3

Factoring integers,..., RSA

College of Science for Women 1

How large are large numbers?

☞ ☞ ☞ ☞ ☞

Universit` a Roma Tre

slide-4
SLIDE 4

Factoring integers,..., RSA

College of Science for Women 1

How large are large numbers?

☞ number of cells in a human body: 1015 ☞ ☞ ☞ ☞

Universit` a Roma Tre

slide-5
SLIDE 5

Factoring integers,..., RSA

College of Science for Women 1

How large are large numbers?

☞ number of cells in a human body: 1015 ☞ number of atoms in the universe: 1080 ☞ ☞ ☞

Universit` a Roma Tre

slide-6
SLIDE 6

Factoring integers,..., RSA

College of Science for Women 1

How large are large numbers?

☞ number of cells in a human body: 1015 ☞ number of atoms in the universe: 1080 ☞ number of subatomic particles in the universe: 10120 ☞ ☞

Universit` a Roma Tre

slide-7
SLIDE 7

Factoring integers,..., RSA

College of Science for Women 1

How large are large numbers?

☞ number of cells in a human body: 1015 ☞ number of atoms in the universe: 1080 ☞ number of subatomic particles in the universe: 10120 ☞ number of atoms in a Human Brain: 1027 ☞

Universit` a Roma Tre

slide-8
SLIDE 8

Factoring integers,..., RSA

College of Science for Women 1

How large are large numbers?

☞ number of cells in a human body: 1015 ☞ number of atoms in the universe: 1080 ☞ number of subatomic particles in the universe: 10120 ☞ number of atoms in a Human Brain: 1027 ☞ number of atoms in a cat: 1026

Universit` a Roma Tre

slide-9
SLIDE 9

Factoring integers,..., RSA

College of Science for Women 2

RSA2048 = 25195908475657893494027183240048398571429282126204 032027777137836043662020707595556264018525880784406918290641249 515082189298559149176184502808489120072844992687392807287776735 971418347270261896375014971824691165077613379859095700097330459 748808428401797429100642458691817195118746121515172654632282216 869987549182422433637259085141865462043576798423387184774447920 739934236584823824281198163815010674810451660377306056201619676 256133844143603833904414952634432190114657544454178424020924616 515723350778707749817125772467962926386356373289912154831438167 899885040445364023527381951378636564391212010397122822120720357

Universit` a Roma Tre

slide-10
SLIDE 10

Factoring integers,..., RSA

College of Science for Women 2

RSA2048 = 25195908475657893494027183240048398571429282126204 032027777137836043662020707595556264018525880784406918290641249 515082189298559149176184502808489120072844992687392807287776735 971418347270261896375014971824691165077613379859095700097330459 748808428401797429100642458691817195118746121515172654632282216 869987549182422433637259085141865462043576798423387184774447920 739934236584823824281198163815010674810451660377306056201619676 256133844143603833904414952634432190114657544454178424020924616 515723350778707749817125772467962926386356373289912154831438167 899885040445364023527381951378636564391212010397122822120720357

RSA2048 is a 617 (decimal) digit number

Universit` a Roma Tre

slide-11
SLIDE 11

Factoring integers,..., RSA

College of Science for Women 2

RSA2048 = 25195908475657893494027183240048398571429282126204 032027777137836043662020707595556264018525880784406918290641249 515082189298559149176184502808489120072844992687392807287776735 971418347270261896375014971824691165077613379859095700097330459 748808428401797429100642458691817195118746121515172654632282216 869987549182422433637259085141865462043576798423387184774447920 739934236584823824281198163815010674810451660377306056201619676 256133844143603833904414952634432190114657544454178424020924616 515723350778707749817125772467962926386356373289912154831438167 899885040445364023527381951378636564391212010397122822120720357

RSA2048 is a 617 (decimal) digit number

http://www.rsa.com/rsalabs/challenges/factoring/numbers.html/

Universit` a Roma Tre

slide-12
SLIDE 12

Factoring integers,..., RSA

College of Science for Women 3

RSA2048=p · q, p, q ≈ 10308

Universit` a Roma Tre

slide-13
SLIDE 13

Factoring integers,..., RSA

College of Science for Women 3

RSA2048=p · q, p, q ≈ 10308

PROBLEM: Compute p and q

Universit` a Roma Tre

slide-14
SLIDE 14

Factoring integers,..., RSA

College of Science for Women 3

RSA2048=p · q, p, q ≈ 10308

PROBLEM: Compute p and q

Price offered on MArch 18, 1991: 200.000 US$ (∼ 232.700.000 Iraq Dinars)!!

Universit` a Roma Tre

slide-15
SLIDE 15

Factoring integers,..., RSA

College of Science for Women 3

RSA2048=p · q, p, q ≈ 10308

PROBLEM: Compute p and q

Price offered on MArch 18, 1991: 200.000 US$ (∼ 232.700.000 Iraq Dinars)!!

  • Theorem. If a ∈ N

∃! p1 < p2 < · · · < pk primes s.t. a = pα1

1 · · · pαk k

Universit` a Roma Tre

slide-16
SLIDE 16

Factoring integers,..., RSA

College of Science for Women 3

RSA2048=p · q, p, q ≈ 10308

PROBLEM: Compute p and q

Price offered on MArch 18, 1991: 200.000 US$ (∼ 232.700.000 Iraq Dinars)!!

  • Theorem. If a ∈ N

∃! p1 < p2 < · · · < pk primes s.t. a = pα1

1 · · · pαk k

Regrettably: RSAlabs believes that factoring in one year requires: number computers memory RSA1620 1.6 × 1015 120 Tb RSA1024 342, 000, 000 170 Gb RSA760 215,000 4Gb.

Universit` a Roma Tre

slide-17
SLIDE 17

Factoring integers,..., RSA

College of Science for Women 4

http://www.rsa.com/rsalabs/challenges/factoring/numbers.html

Universit` a Roma Tre

slide-18
SLIDE 18

Factoring integers,..., RSA

College of Science for Women 4

http://www.rsa.com/rsalabs/challenges/factoring/numbers.html

Challenge Number Prize ($US) RSA576 $10,000 RSA640 $20,000 RSA704 $30,000 RSA768 $50,000 RSA896 $75,000 RSA1024 $100,000 RSA1536 $150,000 RSA2048 $200,000

Universit` a Roma Tre

slide-19
SLIDE 19

Factoring integers,..., RSA

College of Science for Women 4

http://www.rsa.com/rsalabs/challenges/factoring/numbers.html

Numero Premio ($US) Status RSA576 $10,000 Factored December 2003 RSA640 $20,000 Factored November 2005 RSA704 $30,000 Factored July, 2 2012 RSA768 $50,000 Factored December, 12 2009 RSA896 $75,000 Not factored RSA1024 $100,000 Not factored RSA1536 $150,000 Not factored RSA2048 $200,000 Not factored

Universit` a Roma Tre

slide-20
SLIDE 20

Factoring integers,..., RSA

College of Science for Women 4

http://www.rsa.com/rsalabs/challenges/factoring/numbers.html

Numero Premio ($US) Status RSA576 $10,000 Factored December 2003 RSA640 $20,000 Factored November 2005 RSA704 $30,000 Factored July, 2 2012 RSA768 $50,000 Factored December, 12 2009 RSA896 $75,000 Not factored RSA1024 $100,000 Not factored RSA1536 $150,000 Not factored RSA2048 $200,000 Not factored

The RSA challenges ended in 2007. RSA Laboratories stated:

“Now that the industry has a considerably more advanced understanding of the cryptanalytic strength of common symmetric-key and public-key algorithms, these challenges are no longer active.”

Universit` a Roma Tre

slide-21
SLIDE 21

Factoring integers,..., RSA

College of Science for Women 5

Famous citation!!!

A phenomenon whose probability is 10−50 never happens, and it will never

  • bserved.
  • ´

Emil Borel (Les probabilit´ es et sa vie)

Universit` a Roma Tre

slide-22
SLIDE 22

Factoring integers,..., RSA

College of Science for Women 6

History of the “Art of Factoring”

Universit` a Roma Tre

slide-23
SLIDE 23

Factoring integers,..., RSA

College of Science for Women 6

History of the “Art of Factoring”

➳ 220 BC Greeks (Eratosthenes of Cyrene )

Universit` a Roma Tre

slide-24
SLIDE 24

Factoring integers,..., RSA

College of Science for Women 6

History of the “Art of Factoring”

➳ 220 BC Greeks (Eratosthenes of Cyrene ) ➳ 1730 Euler 225 + 1 = 641 · 6700417

Universit` a Roma Tre

slide-25
SLIDE 25

Factoring integers,..., RSA

College of Science for Women 6

History of the “Art of Factoring”

➳ 220 BC Greeks (Eratosthenes of Cyrene ) ➳ 1730 Euler 225 + 1 = 641 · 6700417 ➳ 1750–1800 Fermat, Gauss (Sieves - Tables)

Universit` a Roma Tre

slide-26
SLIDE 26

Factoring integers,..., RSA

College of Science for Women 6

History of the “Art of Factoring”

➳ 220 BC Greeks (Eratosthenes of Cyrene ) ➳ 1730 Euler 225 + 1 = 641 · 6700417 ➳ 1750–1800 Fermat, Gauss (Sieves - Tables) ➳ 1880 Landry & Le Lasseur: 226 + 1 = 274177 × 67280421310721

Universit` a Roma Tre

slide-27
SLIDE 27

Factoring integers,..., RSA

College of Science for Women 6

History of the “Art of Factoring”

➳ 220 BC Greeks (Eratosthenes of Cyrene ) ➳ 1730 Euler 225 + 1 = 641 · 6700417 ➳ 1750–1800 Fermat, Gauss (Sieves - Tables) ➳ 1880 Landry & Le Lasseur: 226 + 1 = 274177 × 67280421310721 ➳ 1919 Pierre and Eug` ene Carissan (Factoring Machine)

Universit` a Roma Tre

slide-28
SLIDE 28

Factoring integers,..., RSA

College of Science for Women 6

History of the “Art of Factoring”

➳ 220 BC Greeks (Eratosthenes of Cyrene ) ➳ 1730 Euler 225 + 1 = 641 · 6700417 ➳ 1750–1800 Fermat, Gauss (Sieves - Tables) ➳ 1880 Landry & Le Lasseur: 226 + 1 = 274177 × 67280421310721 ➳ 1919 Pierre and Eug` ene Carissan (Factoring Machine) ➳ 1970 Morrison & Brillhart 227 + 1 = 59649589127497217 × 5704689200685129054721

Universit` a Roma Tre

slide-29
SLIDE 29

Factoring integers,..., RSA

College of Science for Women 6

History of the “Art of Factoring”

➳ 220 BC Greeks (Eratosthenes of Cyrene ) ➳ 1730 Euler 225 + 1 = 641 · 6700417 ➳ 1750–1800 Fermat, Gauss (Sieves - Tables) ➳ 1880 Landry & Le Lasseur: 226 + 1 = 274177 × 67280421310721 ➳ 1919 Pierre and Eug` ene Carissan (Factoring Machine) ➳ 1970 Morrison & Brillhart 227 + 1 = 59649589127497217 × 5704689200685129054721 ➳ 1982 Quadratic Sieve QS (Pomerance) Number Fields Sieve NFS

Universit` a Roma Tre

slide-30
SLIDE 30

Factoring integers,..., RSA

College of Science for Women 6

History of the “Art of Factoring”

➳ 220 BC Greeks (Eratosthenes of Cyrene ) ➳ 1730 Euler 225 + 1 = 641 · 6700417 ➳ 1750–1800 Fermat, Gauss (Sieves - Tables) ➳ 1880 Landry & Le Lasseur: 226 + 1 = 274177 × 67280421310721 ➳ 1919 Pierre and Eug` ene Carissan (Factoring Machine) ➳ 1970 Morrison & Brillhart 227 + 1 = 59649589127497217 × 5704689200685129054721 ➳ 1982 Quadratic Sieve QS (Pomerance) Number Fields Sieve NFS ➳ 1987 Elliptic curves factoring ECF (Lenstra)

Universit` a Roma Tre

slide-31
SLIDE 31

Factoring integers,..., RSA

College of Science for Women 7

History of the “Art of Factoring”

220 BC Greeks (Eratosthenes of Cyrene)

Universit` a Roma Tre

slide-32
SLIDE 32

Factoring integers,..., RSA

College of Science for Women 8

History of the “Art of Factoring”

1730 Euler 225 + 1 = 641 · 6700417

Universit` a Roma Tre

slide-33
SLIDE 33

Factoring integers,..., RSA

College of Science for Women 9

How did Euler factor 225 + 1?

Universit` a Roma Tre

slide-34
SLIDE 34

Factoring integers,..., RSA

College of Science for Women 9

How did Euler factor 225 + 1?

Proposition Suppose p is a prime factor of bn + 1. Then

  • 1. p is a divisor of bd + 1 for some proper divisor d of n such that n/d is odd
  • r
  • 2. p − 1 is divisible by 2n.

Universit` a Roma Tre

slide-35
SLIDE 35

Factoring integers,..., RSA

College of Science for Women 9

How did Euler factor 225 + 1?

Proposition Suppose p is a prime factor of bn + 1. Then

  • 1. p is a divisor of bd + 1 for some proper divisor d of n such that n/d is odd
  • r
  • 2. p − 1 is divisible by 2n.

Application: Let b = 2 and n = 25 = 64. Then 225 + 1 is prime or it is divisible by a prime p such that p − 1 is divisible by 128.

Universit` a Roma Tre

slide-36
SLIDE 36

Factoring integers,..., RSA

College of Science for Women 9

How did Euler factor 225 + 1?

Proposition Suppose p is a prime factor of bn + 1. Then

  • 1. p is a divisor of bd + 1 for some proper divisor d of n such that n/d is odd
  • r
  • 2. p − 1 is divisible by 2n.

Application: Let b = 2 and n = 25 = 64. Then 225 + 1 is prime or it is divisible by a prime p such that p − 1 is divisible by 128. Note that 1 + 1 × 128 = 3 × 43, 1 + 2 × 128 = 257 is prime, 1 + 3 × 128 = 5 × 7 × 11, 1 + 4 × 128 = 33 × 19 and 1 + 5 · 128 = 641 is prime. Finally 225 + 1 641 = 4294967297 641 = 6700417

Universit` a Roma Tre

slide-37
SLIDE 37

Factoring integers,..., RSA

College of Science for Women 10

History of the “Art of Factoring”

1730 Euler 225 + 1 = 641 · 6700417

Universit` a Roma Tre

slide-38
SLIDE 38

Factoring integers,..., RSA

College of Science for Women 11

History of the “Art of Factoring”

1750–1800 Fermat, Gauss (Sieves - Tables)

Universit` a Roma Tre

slide-39
SLIDE 39

Factoring integers,..., RSA

College of Science for Women 12

History of the “Art of Factoring”

1750–1800 Fermat, Gauss (Sieves - Tables)

Universit` a Roma Tre

slide-40
SLIDE 40

Factoring integers,..., RSA

College of Science for Women 12

History of the “Art of Factoring”

1750–1800 Fermat, Gauss (Sieves - Tables) Factoring with sieves N = x2 − y2 = (x − y)(x + y)

Universit` a Roma Tre

slide-41
SLIDE 41

Factoring integers,..., RSA

College of Science for Women 13

Carissan’s ancient Factoring Machine

Universit` a Roma Tre

slide-42
SLIDE 42

Factoring integers,..., RSA

College of Science for Women 13

Carissan’s ancient Factoring Machine

Figure 1: Conservatoire Nationale des Arts et M´ etiers in Paris

Universit` a Roma Tre

slide-43
SLIDE 43

Factoring integers,..., RSA

College of Science for Women 13

Carissan’s ancient Factoring Machine

Figure 1: Conservatoire Nationale des Arts et M´ etiers in Paris

http://www.math.uwaterloo.ca/ shallit/Papers/carissan.html

Universit` a Roma Tre

slide-44
SLIDE 44

Factoring integers,..., RSA

College of Science for Women 14

Figure 2: Lieutenant Eug` ene Carissan

Universit` a Roma Tre

slide-45
SLIDE 45

Factoring integers,..., RSA

College of Science for Women 14

Figure 2: Lieutenant Eug` ene Carissan 225058681 = 229 × 982789 2 minutes 3450315521 = 1409 × 2418769 3 minutes 3570537526921 = 841249 × 4244329 18 minutes

Universit` a Roma Tre

slide-46
SLIDE 46

Factoring integers,..., RSA

College of Science for Women 15

State of the “Art of Factoring”

1970 - John Brillhart & Michael A. Morrison 227 + 1 = 59649589127497217 × 5704689200685129054721

Universit` a Roma Tre

slide-47
SLIDE 47

Factoring integers,..., RSA

College of Science for Women 16

State of the “Art of Factoring”

Fn = 2(2n) + 1 is called the n–th Fermat number

Universit` a Roma Tre

slide-48
SLIDE 48

Factoring integers,..., RSA

College of Science for Women 16

State of the “Art of Factoring”

Fn = 2(2n) + 1 is called the n–th Fermat number Up to today only from F0 to F11 are factores. It is not known the factorization of F12 = 2212 + 1

Universit` a Roma Tre

slide-49
SLIDE 49

Factoring integers,..., RSA

College of Science for Women 16

State of the “Art of Factoring”

Fn = 2(2n) + 1 is called the n–th Fermat number Up to today only from F0 to F11 are factores. It is not known the factorization of F12 = 2212 + 1

Universit` a Roma Tre

slide-50
SLIDE 50

Factoring integers,..., RSA

College of Science for Women 17

State of the “Art of Factoring”

1982 - Carl Pomerance - Quadratic Sieve

Universit` a Roma Tre

slide-51
SLIDE 51

Factoring integers,..., RSA

College of Science for Women 18

State of the “Art of Factoring”

1987 - Hendrik Lenstra - Elliptic curves factoring

Universit` a Roma Tre

slide-52
SLIDE 52

Factoring integers,..., RSA

College of Science for Women 19

Contemporary Factoring

Universit` a Roma Tre

slide-53
SLIDE 53

Factoring integers,..., RSA

College of Science for Women 19

Contemporary Factoring

❶ 1994, Quadratic Sieve (QS): (8 months, 600 volunteers, 20 nations) D.Atkins, M. Graff, A. Lenstra, P. Leyland

RSA129 = 114381625757888867669235779976146612010218296721242362562561842935706 935245733897830597123563958705058989075147599290026879543541 = = 3490529510847650949147849619903898133417764638493387843990820577× 32769132993266709549961988190834461413177642967992942539798288533 Universit` a Roma Tre

slide-54
SLIDE 54

Factoring integers,..., RSA

College of Science for Women 19

Contemporary Factoring

❶ 1994, Quadratic Sieve (QS): (8 months, 600 volunteers, 20 nations) D.Atkins, M. Graff, A. Lenstra, P. Leyland

RSA129 = 114381625757888867669235779976146612010218296721242362562561842935706 935245733897830597123563958705058989075147599290026879543541 = = 3490529510847650949147849619903898133417764638493387843990820577× 32769132993266709549961988190834461413177642967992942539798288533

❷ (February 2 1999), Number Field Sieve (NFS): (160 Sun, 4 months)

RSA155 = 109417386415705274218097073220403576120037329454492059909138421314763499842 88934784717997257891267332497625752899781833797076537244027146743531593354333897 = = 102639592829741105772054196573991675900716567808038066803341933521790711307779× 106603488380168454820927220360012878679207958575989291522270608237193062808643 Universit` a Roma Tre

slide-55
SLIDE 55

Factoring integers,..., RSA

College of Science for Women 19

Contemporary Factoring

❶ 1994, Quadratic Sieve (QS): (8 months, 600 volunteers, 20 nations) D.Atkins, M. Graff, A. Lenstra, P. Leyland

RSA129 = 114381625757888867669235779976146612010218296721242362562561842935706 935245733897830597123563958705058989075147599290026879543541 = = 3490529510847650949147849619903898133417764638493387843990820577× 32769132993266709549961988190834461413177642967992942539798288533

❷ (February 2 1999), Number Field Sieve (NFS): (160 Sun, 4 months)

RSA155 = 109417386415705274218097073220403576120037329454492059909138421314763499842 88934784717997257891267332497625752899781833797076537244027146743531593354333897 = = 102639592829741105772054196573991675900716567808038066803341933521790711307779× 106603488380168454820927220360012878679207958575989291522270608237193062808643

❸ (December 3, 2003) (NFS): J. Franke et al. (174 decimal digits)

RSA576 = 1881988129206079638386972394616504398071635633794173827007633564229888597152346 65485319060606504743045317388011303396716199692321205734031879550656996221305168759307650257059 = = 398075086424064937397125500550386491199064362342526708406385189575946388957261768583317× 472772146107435302536223071973048224632914695302097116459852171130520711256363590397527 Universit` a Roma Tre

slide-56
SLIDE 56

Factoring integers,..., RSA

College of Science for Women 19

Contemporary Factoring

❶ 1994, Quadratic Sieve (QS): (8 months, 600 volunteers, 20 nations) D.Atkins, M. Graff, A. Lenstra, P. Leyland

RSA129 = 114381625757888867669235779976146612010218296721242362562561842935706 935245733897830597123563958705058989075147599290026879543541 = = 3490529510847650949147849619903898133417764638493387843990820577× 32769132993266709549961988190834461413177642967992942539798288533

❷ (February 2 1999), Number Field Sieve (NFS): (160 Sun, 4 months)

RSA155 = 109417386415705274218097073220403576120037329454492059909138421314763499842 88934784717997257891267332497625752899781833797076537244027146743531593354333897 = = 102639592829741105772054196573991675900716567808038066803341933521790711307779× 106603488380168454820927220360012878679207958575989291522270608237193062808643

❸ (December 3, 2003) (NFS): J. Franke et al. (174 decimal digits)

RSA576 = 1881988129206079638386972394616504398071635633794173827007633564229888597152346 65485319060606504743045317388011303396716199692321205734031879550656996221305168759307650257059 = = 398075086424064937397125500550386491199064362342526708406385189575946388957261768583317× 472772146107435302536223071973048224632914695302097116459852171130520711256363590397527

❹ Elliptic curves factoring: introduced by H. Lenstra. suitable to detect small factors (50 digits)

Universit` a Roma Tre

slide-57
SLIDE 57

Factoring integers,..., RSA

College of Science for Women 19

Contemporary Factoring

❶ 1994, Quadratic Sieve (QS): (8 months, 600 volunteers, 20 nations) D.Atkins, M. Graff, A. Lenstra, P. Leyland

RSA129 = 114381625757888867669235779976146612010218296721242362562561842935706 935245733897830597123563958705058989075147599290026879543541 = = 3490529510847650949147849619903898133417764638493387843990820577× 32769132993266709549961988190834461413177642967992942539798288533

❷ (February 2 1999), Number Field Sieve (NFS): (160 Sun, 4 months)

RSA155 = 109417386415705274218097073220403576120037329454492059909138421314763499842 88934784717997257891267332497625752899781833797076537244027146743531593354333897 = = 102639592829741105772054196573991675900716567808038066803341933521790711307779× 106603488380168454820927220360012878679207958575989291522270608237193062808643

❸ (December 3, 2003) (NFS): J. Franke et al. (174 decimal digits)

RSA576 = 1881988129206079638386972394616504398071635633794173827007633564229888597152346 65485319060606504743045317388011303396716199692321205734031879550656996221305168759307650257059 = = 398075086424064937397125500550386491199064362342526708406385189575946388957261768583317× 472772146107435302536223071973048224632914695302097116459852171130520711256363590397527

❹ Elliptic curves factoring: introduced by H. Lenstra. suitable to detect small factors (50 digits) all have ”sub–exponential complexity”

Universit` a Roma Tre

slide-58
SLIDE 58

Factoring integers,..., RSA

College of Science for Women 20

The factorization of RSA200

RSA200 = 2799783391122132787082946763872260162107044678695542853756000992932612840010 7609345671052955360856061822351910951365788637105954482006576775098580557613 579098734950144178863178946295187237869221823983 Universit` a Roma Tre

slide-59
SLIDE 59

Factoring integers,..., RSA

College of Science for Women 20

The factorization of RSA200

RSA200 = 2799783391122132787082946763872260162107044678695542853756000992932612840010 7609345671052955360856061822351910951365788637105954482006576775098580557613 579098734950144178863178946295187237869221823983 Date: Mon, 9 May 2005 18:05:10 +0200 (CEST) From: ”Thorsten Kleinjung” Subject: rsa200 We have factored RSA200 by GNFS. The factors are 35324619344027701212726049781984643686711974001976 25023649303468776121253679423200058547956528088349 and 79258699544783330333470858414800596877379758573642 19960734330341455767872818152135381409304740185467 We did lattice sieving for most special q between 3e8 and 11e8 using mainly factor base bounds of 3e8 on the algebraic side and 18e7 on the rational side. The bounds for large primes were 235. This produced 26e8 relations. Together with 5e7 relations from line sieving the total yield was 27e8 relations. After removing duplicates 226e7 relations remained. A filter job produced a matrix with 64e6 rows and columns, having 11e9 non-zero entries. This was solved by Block-Wiedemann. Sieving has been done on a variety of machines. We estimate that lattice sieving would have taken 55 years on a single 2.2 GHz Opteron CPU. Note that this number could have been improved if instead of the PIII- binary which we used for sieving, we had used a version of the lattice-siever optimized for Opteron CPU’s which we developed in the meantime. The matrix step was performed on a cluster of 80 2.2 GHz Opterons connected via a Gigabit network and took about 3 months. We started sieving shortly before Christmas 2003 and continued until October 2004. The matrix step began in December 2004. Line sieving was done by P. Montgomery and H. te Riele at the CWI, by F. Bahr and his family. More details will be given later.

  • F. Bahr, M. Boehm, J. Franke, T. Kleinjung

Universit` a Roma Tre

slide-60
SLIDE 60

Factoring integers,..., RSA

College of Science for Women 21

Factorization of RSA768

Universit` a Roma Tre

slide-61
SLIDE 61

Factoring integers,..., RSA

College of Science for Women 22

RSA

Adi Shamir, Ron L. Rivest, Leonard Adleman (1978)

Universit` a Roma Tre

slide-62
SLIDE 62

Factoring integers,..., RSA

College of Science for Women 23

RSA

Ron L. Rivest, Adi Shamir, Leonard Adleman (2003)

Universit` a Roma Tre

slide-63
SLIDE 63

Factoring integers,..., RSA

College of Science for Women 24

The RSA cryptosystem

Universit` a Roma Tre

slide-64
SLIDE 64

Factoring integers,..., RSA

College of Science for Women 24

The RSA cryptosystem

1978 R. L. Rivest, A. Shamir, L. Adleman (Patent expired in 1998)

Universit` a Roma Tre

slide-65
SLIDE 65

Factoring integers,..., RSA

College of Science for Women 24

The RSA cryptosystem

1978 R. L. Rivest, A. Shamir, L. Adleman (Patent expired in 1998) Problem: Alice wants to send the message P to Bob so that Charles cannot read it

Universit` a Roma Tre

slide-66
SLIDE 66

Factoring integers,..., RSA

College of Science for Women 24

The RSA cryptosystem

1978 R. L. Rivest, A. Shamir, L. Adleman (Patent expired in 1998) Problem: Alice wants to send the message P to Bob so that Charles cannot read it

A (Alice) − − − − − − → B (Bob) ↑ C (Charles)

Universit` a Roma Tre

slide-67
SLIDE 67

Factoring integers,..., RSA

College of Science for Women 24

The RSA cryptosystem

1978 R. L. Rivest, A. Shamir, L. Adleman (Patent expired in 1998) Problem: Alice wants to send the message P to Bob so that Charles cannot read it

A (Alice) − − − − − − → B (Bob) ↑ C (Charles)

❶ ❷ ❸ ❹

Universit` a Roma Tre

slide-68
SLIDE 68

Factoring integers,..., RSA

College of Science for Women 24

The RSA cryptosystem

1978 R. L. Rivest, A. Shamir, L. Adleman (Patent expired in 1998) Problem: Alice wants to send the message P to Bob so that Charles cannot read it

A (Alice) − − − − − − → B (Bob) ↑ C (Charles)

❶ Key generation Bob has to do it ❷ ❸ ❹

Universit` a Roma Tre

slide-69
SLIDE 69

Factoring integers,..., RSA

College of Science for Women 24

The RSA cryptosystem

1978 R. L. Rivest, A. Shamir, L. Adleman (Patent expired in 1998) Problem: Alice wants to send the message P to Bob so that Charles cannot read it

A (Alice) − − − − − − → B (Bob) ↑ C (Charles)

❶ Key generation Bob has to do it ❷ Encryption Alice has to do it ❸ ❹

Universit` a Roma Tre

slide-70
SLIDE 70

Factoring integers,..., RSA

College of Science for Women 24

The RSA cryptosystem

1978 R. L. Rivest, A. Shamir, L. Adleman (Patent expired in 1998) Problem: Alice wants to send the message P to Bob so that Charles cannot read it

A (Alice) − − − − − − → B (Bob) ↑ C (Charles)

❶ Key generation Bob has to do it ❷ Encryption Alice has to do it ❸ Decryption Bob has to do it ❹

Universit` a Roma Tre

slide-71
SLIDE 71

Factoring integers,..., RSA

College of Science for Women 24

The RSA cryptosystem

1978 R. L. Rivest, A. Shamir, L. Adleman (Patent expired in 1998) Problem: Alice wants to send the message P to Bob so that Charles cannot read it

A (Alice) − − − − − − → B (Bob) ↑ C (Charles)

❶ Key generation Bob has to do it ❷ Encryption Alice has to do it ❸ Decryption Bob has to do it ❹ Attack Charles would like to do it

Universit` a Roma Tre

slide-72
SLIDE 72

Factoring integers,..., RSA

College of Science for Women 25

Bob: Key generation

Universit` a Roma Tre

slide-73
SLIDE 73

Factoring integers,..., RSA

College of Science for Women 25

Bob: Key generation

✍ ✍ ✍ ✍ ✍

Universit` a Roma Tre

slide-74
SLIDE 74

Factoring integers,..., RSA

College of Science for Women 25

Bob: Key generation

✍ He chooses randomly p and q primes (p, q ≈ 10100) ✍ ✍ ✍ ✍

Universit` a Roma Tre

slide-75
SLIDE 75

Factoring integers,..., RSA

College of Science for Women 25

Bob: Key generation

✍ He chooses randomly p and q primes (p, q ≈ 10100) ✍ He computes M = p × q, ϕ(M) = (p − 1) × (q − 1) ✍ ✍ ✍

Universit` a Roma Tre

slide-76
SLIDE 76

Factoring integers,..., RSA

College of Science for Women 25

Bob: Key generation

✍ He chooses randomly p and q primes (p, q ≈ 10100) ✍ He computes M = p × q, ϕ(M) = (p − 1) × (q − 1) ✍ He chooses an integer e s.t. ✍ ✍

Universit` a Roma Tre

slide-77
SLIDE 77

Factoring integers,..., RSA

College of Science for Women 25

Bob: Key generation

✍ He chooses randomly p and q primes (p, q ≈ 10100) ✍ He computes M = p × q, ϕ(M) = (p − 1) × (q − 1) ✍ He chooses an integer e s.t. 0 ≤ e ≤ ϕ(M) and gcd(e, ϕ(M)) = 1 ✍ ✍

Universit` a Roma Tre

slide-78
SLIDE 78

Factoring integers,..., RSA

College of Science for Women 25

Bob: Key generation

✍ He chooses randomly p and q primes (p, q ≈ 10100) ✍ He computes M = p × q, ϕ(M) = (p − 1) × (q − 1) ✍ He chooses an integer e s.t. 0 ≤ e ≤ ϕ(M) and gcd(e, ϕ(M)) = 1

  • Note. One could take e = 3 and p ≡ q ≡ 2 mod 3

✍ ✍

Universit` a Roma Tre

slide-79
SLIDE 79

Factoring integers,..., RSA

College of Science for Women 25

Bob: Key generation

✍ He chooses randomly p and q primes (p, q ≈ 10100) ✍ He computes M = p × q, ϕ(M) = (p − 1) × (q − 1) ✍ He chooses an integer e s.t. 0 ≤ e ≤ ϕ(M) and gcd(e, ϕ(M)) = 1

  • Note. One could take e = 3 and p ≡ q ≡ 2 mod 3

Experts recommend e = 216 + 1 ✍ ✍

Universit` a Roma Tre

slide-80
SLIDE 80

Factoring integers,..., RSA

College of Science for Women 25

Bob: Key generation

✍ He chooses randomly p and q primes (p, q ≈ 10100) ✍ He computes M = p × q, ϕ(M) = (p − 1) × (q − 1) ✍ He chooses an integer e s.t. 0 ≤ e ≤ ϕ(M) and gcd(e, ϕ(M)) = 1

  • Note. One could take e = 3 and p ≡ q ≡ 2 mod 3

Experts recommend e = 216 + 1 ✍ He computes arithmetic inverse d of e modulo ϕ(M) ✍

Universit` a Roma Tre

slide-81
SLIDE 81

Factoring integers,..., RSA

College of Science for Women 25

Bob: Key generation

✍ He chooses randomly p and q primes (p, q ≈ 10100) ✍ He computes M = p × q, ϕ(M) = (p − 1) × (q − 1) ✍ He chooses an integer e s.t. 0 ≤ e ≤ ϕ(M) and gcd(e, ϕ(M)) = 1

  • Note. One could take e = 3 and p ≡ q ≡ 2 mod 3

Experts recommend e = 216 + 1 ✍ He computes arithmetic inverse d of e modulo ϕ(M) (i.e. d ∈ N (unique ≤ ϕ(M)) s.t. e × d ≡ 1 (mod ϕ(M))) ✍

Universit` a Roma Tre

slide-82
SLIDE 82

Factoring integers,..., RSA

College of Science for Women 25

Bob: Key generation

✍ He chooses randomly p and q primes (p, q ≈ 10100) ✍ He computes M = p × q, ϕ(M) = (p − 1) × (q − 1) ✍ He chooses an integer e s.t. 0 ≤ e ≤ ϕ(M) and gcd(e, ϕ(M)) = 1

  • Note. One could take e = 3 and p ≡ q ≡ 2 mod 3

Experts recommend e = 216 + 1 ✍ He computes arithmetic inverse d of e modulo ϕ(M) (i.e. d ∈ N (unique ≤ ϕ(M)) s.t. e × d ≡ 1 (mod ϕ(M))) ✍ Publishes (M, e) public key and hides secret key d

Universit` a Roma Tre

slide-83
SLIDE 83

Factoring integers,..., RSA

College of Science for Women 25

Bob: Key generation

✍ He chooses randomly p and q primes (p, q ≈ 10100) ✍ He computes M = p × q, ϕ(M) = (p − 1) × (q − 1) ✍ He chooses an integer e s.t. 0 ≤ e ≤ ϕ(M) and gcd(e, ϕ(M)) = 1

  • Note. One could take e = 3 and p ≡ q ≡ 2 mod 3

Experts recommend e = 216 + 1 ✍ He computes arithmetic inverse d of e modulo ϕ(M) (i.e. d ∈ N (unique ≤ ϕ(M)) s.t. e × d ≡ 1 (mod ϕ(M))) ✍ Publishes (M, e) public key and hides secret key d Problem: How does Bob do all this?- We will go came back to it!

Universit` a Roma Tre

slide-84
SLIDE 84

Factoring integers,..., RSA

College of Science for Women 26

Alice: Encryption

Universit` a Roma Tre

slide-85
SLIDE 85

Factoring integers,..., RSA

College of Science for Women 26

Alice: Encryption

Represent the message P as an element of Z/MZ

Universit` a Roma Tre

slide-86
SLIDE 86

Factoring integers,..., RSA

College of Science for Women 26

Alice: Encryption

Represent the message P as an element of Z/MZ (for example) A ↔ 1 B ↔ 2 C ↔ 3 . . . Z ↔ 26 AA ↔ 27 . . .

Universit` a Roma Tre

slide-87
SLIDE 87

Factoring integers,..., RSA

College of Science for Women 26

Alice: Encryption

Represent the message P as an element of Z/MZ (for example) A ↔ 1 B ↔ 2 C ↔ 3 . . . Z ↔ 26 AA ↔ 27 . . .

Sukumar ↔ 19 · 266 + 21 · 265 + 11 · 264 + 21 · 263 + 12 · 262 + 1 · 26 + 18 = 6124312628

  • Note. Better if texts are not too short. Otherwise one performs some padding

Universit` a Roma Tre

slide-88
SLIDE 88

Factoring integers,..., RSA

College of Science for Women 26

Alice: Encryption

Represent the message P as an element of Z/MZ (for example) A ↔ 1 B ↔ 2 C ↔ 3 . . . Z ↔ 26 AA ↔ 27 . . .

Sukumar ↔ 19 · 266 + 21 · 265 + 11 · 264 + 21 · 263 + 12 · 262 + 1 · 26 + 18 = 6124312628

  • Note. Better if texts are not too short. Otherwise one performs some padding

C = E(P) = Pe (mod M)

Universit` a Roma Tre

slide-89
SLIDE 89

Factoring integers,..., RSA

College of Science for Women 26

Alice: Encryption

Represent the message P as an element of Z/MZ (for example) A ↔ 1 B ↔ 2 C ↔ 3 . . . Z ↔ 26 AA ↔ 27 . . .

Sukumar ↔ 19 · 266 + 21 · 265 + 11 · 264 + 21 · 263 + 12 · 262 + 1 · 26 + 18 = 6124312628

  • Note. Better if texts are not too short. Otherwise one performs some padding

C = E(P) = Pe (mod M)

Example: p = 9049465727, q = 8789181607, M = 79537397720925283289, e = 216 + 1 = 65537, P = Sukumar:

Universit` a Roma Tre

slide-90
SLIDE 90

Factoring integers,..., RSA

College of Science for Women 26

Alice: Encryption

Represent the message P as an element of Z/MZ (for example) A ↔ 1 B ↔ 2 C ↔ 3 . . . Z ↔ 26 AA ↔ 27 . . .

Sukumar ↔ 19 · 266 + 21 · 265 + 11 · 264 + 21 · 263 + 12 · 262 + 1 · 26 + 18 = 6124312628

  • Note. Better if texts are not too short. Otherwise one performs some padding

C = E(P) = Pe (mod M)

Example: p = 9049465727, q = 8789181607, M = 79537397720925283289, e = 216 + 1 = 65537, P = Sukumar: E(Sukumar) = 612431262865537 (mod79537397720925283289) = 25439695120356558116 = C = JGEBNBAUYTCOFJ

Universit` a Roma Tre

slide-91
SLIDE 91

Factoring integers,..., RSA

College of Science for Women 27

Bob: Decryption

Universit` a Roma Tre

slide-92
SLIDE 92

Factoring integers,..., RSA

College of Science for Women 27

Bob: Decryption

P = D(C) = Cd (mod M)

Universit` a Roma Tre

slide-93
SLIDE 93

Factoring integers,..., RSA

College of Science for Women 27

Bob: Decryption

P = D(C) = Cd (mod M)

  • Note. Bob decrypts because he is the only one that knows d.

Universit` a Roma Tre

slide-94
SLIDE 94

Factoring integers,..., RSA

College of Science for Women 27

Bob: Decryption

P = D(C) = Cd (mod M)

  • Note. Bob decrypts because he is the only one that knows d.
  • Theorem. (Euler) If a, m ∈ N, gcd(a, m) = 1,

aϕ(m) ≡ 1 (mod m). If n1 ≡ n2 mod ϕ(m) then an1 ≡ an2 mod m.

Universit` a Roma Tre

slide-95
SLIDE 95

Factoring integers,..., RSA

College of Science for Women 27

Bob: Decryption

P = D(C) = Cd (mod M)

  • Note. Bob decrypts because he is the only one that knows d.
  • Theorem. (Euler) If a, m ∈ N, gcd(a, m) = 1,

aϕ(m) ≡ 1 (mod m). If n1 ≡ n2 mod ϕ(m) then an1 ≡ an2 mod m. Therefore (ed ≡ 1 mod ϕ(M))

D(E(P)) = Ped ≡ P mod M

Universit` a Roma Tre

slide-96
SLIDE 96

Factoring integers,..., RSA

College of Science for Women 27

Bob: Decryption

P = D(C) = Cd (mod M)

  • Note. Bob decrypts because he is the only one that knows d.
  • Theorem. (Euler) If a, m ∈ N, gcd(a, m) = 1,

aϕ(m) ≡ 1 (mod m). If n1 ≡ n2 mod ϕ(m) then an1 ≡ an2 mod m. Therefore (ed ≡ 1 mod ϕ(M))

D(E(P)) = Ped ≡ P mod M

Example(cont.):d = 65537−1 mod ϕ(9049465727 · 8789181607) = 57173914060643780153 D(JGEBNBAUYTCOFJ) = 2543969512035655811657173914060643780153(mod79537397720925283289) = Sukumar

Universit` a Roma Tre

slide-97
SLIDE 97

Factoring integers,..., RSA

College of Science for Women 28

RSA at work

Universit` a Roma Tre

slide-98
SLIDE 98

Factoring integers,..., RSA

College of Science for Women 29

Repeated squaring algorithm

Universit` a Roma Tre

slide-99
SLIDE 99

Factoring integers,..., RSA

College of Science for Women 29

Repeated squaring algorithm

Problem: How does one compute ab mod c?

Universit` a Roma Tre

slide-100
SLIDE 100

Factoring integers,..., RSA

College of Science for Women 29

Repeated squaring algorithm

Problem: How does one compute ab mod c? 2543969512035655811657173914060643780153(mod79537397720925283289)

Universit` a Roma Tre

slide-101
SLIDE 101

Factoring integers,..., RSA

College of Science for Women 29

Repeated squaring algorithm

Problem: How does one compute ab mod c? 2543969512035655811657173914060643780153(mod79537397720925283289) ✍ ✍ ✍

Universit` a Roma Tre

slide-102
SLIDE 102

Factoring integers,..., RSA

College of Science for Women 29

Repeated squaring algorithm

Problem: How does one compute ab mod c? 2543969512035655811657173914060643780153(mod79537397720925283289) ✍ Compute the binary expansion b =

[log2 b]

  • j=0

ǫj2j ✍ ✍

Universit` a Roma Tre

slide-103
SLIDE 103

Factoring integers,..., RSA

College of Science for Women 29

Repeated squaring algorithm

Problem: How does one compute ab mod c? 2543969512035655811657173914060643780153(mod79537397720925283289) ✍ Compute the binary expansion b =

[log2 b]

  • j=0

ǫj2j

57173914060643780153=110001100101110010100010111110101011110011011000100100011000111001

✍ ✍

Universit` a Roma Tre

slide-104
SLIDE 104

Factoring integers,..., RSA

College of Science for Women 29

Repeated squaring algorithm

Problem: How does one compute ab mod c? 2543969512035655811657173914060643780153(mod79537397720925283289) ✍ Compute the binary expansion b =

[log2 b]

  • j=0

ǫj2j

57173914060643780153=110001100101110010100010111110101011110011011000100100011000111001

✍ Compute recursively a2j mod c, j = 1, . . . , [log2 b]: ✍

Universit` a Roma Tre

slide-105
SLIDE 105

Factoring integers,..., RSA

College of Science for Women 29

Repeated squaring algorithm

Problem: How does one compute ab mod c? 2543969512035655811657173914060643780153(mod79537397720925283289) ✍ Compute the binary expansion b =

[log2 b]

  • j=0

ǫj2j

57173914060643780153=110001100101110010100010111110101011110011011000100100011000111001

✍ Compute recursively a2j mod c, j = 1, . . . , [log2 b]: a2j mod c =

  • a2j−1 mod c

2 mod c ✍

Universit` a Roma Tre

slide-106
SLIDE 106

Factoring integers,..., RSA

College of Science for Women 29

Repeated squaring algorithm

Problem: How does one compute ab mod c? 2543969512035655811657173914060643780153(mod79537397720925283289) ✍ Compute the binary expansion b =

[log2 b]

  • j=0

ǫj2j

57173914060643780153=110001100101110010100010111110101011110011011000100100011000111001

✍ Compute recursively a2j mod c, j = 1, . . . , [log2 b]: a2j mod c =

  • a2j−1 mod c

2 mod c ✍ Multiply the a2j mod c with ǫj = 1

Universit` a Roma Tre

slide-107
SLIDE 107

Factoring integers,..., RSA

College of Science for Women 29

Repeated squaring algorithm

Problem: How does one compute ab mod c? 2543969512035655811657173914060643780153(mod79537397720925283289) ✍ Compute the binary expansion b =

[log2 b]

  • j=0

ǫj2j

57173914060643780153=110001100101110010100010111110101011110011011000100100011000111001

✍ Compute recursively a2j mod c, j = 1, . . . , [log2 b]: a2j mod c =

  • a2j−1 mod c

2 mod c ✍ Multiply the a2j mod c with ǫj = 1 ab mod c = [log2 b]

j=0,ǫj=1 a2j mod c

  • mod c

Universit` a Roma Tre

slide-108
SLIDE 108

Factoring integers,..., RSA

College of Science for Women 30

#{oper. in Z/cZ to compute ab mod c} ≤ 2 log2 b

Universit` a Roma Tre

slide-109
SLIDE 109

Factoring integers,..., RSA

College of Science for Women 30

#{oper. in Z/cZ to compute ab mod c} ≤ 2 log2 b

JGEBNBAUYTCOFJ is decrypted with 131 operations in

Z/79537397720925283289Z

Universit` a Roma Tre

slide-110
SLIDE 110

Factoring integers,..., RSA

College of Science for Women 30

#{oper. in Z/cZ to compute ab mod c} ≤ 2 log2 b

JGEBNBAUYTCOFJ is decrypted with 131 operations in

Z/79537397720925283289Z

Pseudo code: ec(a, b) = ab mod c

Universit` a Roma Tre

slide-111
SLIDE 111

Factoring integers,..., RSA

College of Science for Women 30

#{oper. in Z/cZ to compute ab mod c} ≤ 2 log2 b

JGEBNBAUYTCOFJ is decrypted with 131 operations in

Z/79537397720925283289Z

Pseudo code: ec(a, b) = ab mod c ec(a, b) = if b = 1 then a mod c if 2|b then ec(a, b

2)2 mod c

else a ∗ ec(a, b−1

2 )2 mod c

Universit` a Roma Tre

slide-112
SLIDE 112

Factoring integers,..., RSA

College of Science for Women 30

#{oper. in Z/cZ to compute ab mod c} ≤ 2 log2 b

JGEBNBAUYTCOFJ is decrypted with 131 operations in

Z/79537397720925283289Z

Pseudo code: ec(a, b) = ab mod c ec(a, b) = if b = 1 then a mod c if 2|b then ec(a, b

2)2 mod c

else a ∗ ec(a, b−1

2 )2 mod c

To encrypt with e = 216 + 1, only 17 operations in Z/MZ are enough

Universit` a Roma Tre

slide-113
SLIDE 113

Factoring integers,..., RSA

College of Science for Women 31

Key generation

Universit` a Roma Tre

slide-114
SLIDE 114

Factoring integers,..., RSA

College of Science for Women 31

Key generation

  • Problem. Produce a random prime p ≈ 10100

Probabilistic algorithm (type Las Vegas) 1. Let p = Random(10100) 2. If isprime(p)=1 then Output=p else goto 1

Universit` a Roma Tre

slide-115
SLIDE 115

Factoring integers,..., RSA

College of Science for Women 31

Key generation

  • Problem. Produce a random prime p ≈ 10100

Probabilistic algorithm (type Las Vegas) 1. Let p = Random(10100) 2. If isprime(p)=1 then Output=p else goto 1 subproblems:

Universit` a Roma Tre

slide-116
SLIDE 116

Factoring integers,..., RSA

College of Science for Women 31

Key generation

  • Problem. Produce a random prime p ≈ 10100

Probabilistic algorithm (type Las Vegas) 1. Let p = Random(10100) 2. If isprime(p)=1 then Output=p else goto 1 subproblems:

  • A. How many iterations are necessary?

(i.e. how are primes distributes?)

Universit` a Roma Tre

slide-117
SLIDE 117

Factoring integers,..., RSA

College of Science for Women 31

Key generation

  • Problem. Produce a random prime p ≈ 10100

Probabilistic algorithm (type Las Vegas) 1. Let p = Random(10100) 2. If isprime(p)=1 then Output=p else goto 1 subproblems:

  • A. How many iterations are necessary?

(i.e. how are primes distributes?)

  • B. How does one check if p is prime?

(i.e. how does one compute isprime(p)?) Primality test

Universit` a Roma Tre

slide-118
SLIDE 118

Factoring integers,..., RSA

College of Science for Women 31

Key generation

  • Problem. Produce a random prime p ≈ 10100

Probabilistic algorithm (type Las Vegas) 1. Let p = Random(10100) 2. If isprime(p)=1 then Output=p else goto 1 subproblems:

  • A. How many iterations are necessary?

(i.e. how are primes distributes?)

  • B. How does one check if p is prime?

(i.e. how does one compute isprime(p)?) Primality test

False Metropolitan Legend: Check primality is equivalent to factoring

Universit` a Roma Tre

slide-119
SLIDE 119

Factoring integers,..., RSA

College of Science for Women 32

  • A. Distribution of prime numbers

Universit` a Roma Tre

slide-120
SLIDE 120

Factoring integers,..., RSA

College of Science for Women 32

  • A. Distribution of prime numbers

π(x) = #{p ≤ x t. c. p is prime}

Universit` a Roma Tre

slide-121
SLIDE 121

Factoring integers,..., RSA

College of Science for Women 32

  • A. Distribution of prime numbers

π(x) = #{p ≤ x t. c. p is prime}

  • Theorem. (Hadamard - de la vallee Pussen - 1897)

π(x) ∼ x log x

Universit` a Roma Tre

slide-122
SLIDE 122

Factoring integers,..., RSA

College of Science for Women 32

  • A. Distribution of prime numbers

π(x) = #{p ≤ x t. c. p is prime}

  • Theorem. (Hadamard - de la vallee Pussen - 1897)

π(x) ∼ x log x Quantitative version:

  • Theorem. (Rosser - Schoenfeld) if x ≥ 67

x log x − 1/2 < π(x) < x log x − 3/2

Universit` a Roma Tre

slide-123
SLIDE 123

Factoring integers,..., RSA

College of Science for Women 32

  • A. Distribution of prime numbers

π(x) = #{p ≤ x t. c. p is prime}

  • Theorem. (Hadamard - de la vallee Pussen - 1897)

π(x) ∼ x log x Quantitative version:

  • Theorem. (Rosser - Schoenfeld) if x ≥ 67

x log x − 1/2 < π(x) < x log x − 3/2 Therefore 0.0043523959267 < Prob

  • (Random(10100) = prime
  • < 0.004371422086

Universit` a Roma Tre

slide-124
SLIDE 124

Factoring integers,..., RSA

College of Science for Women 33

If Pk is the probability that among k random numbers≤ 10100 there is a prime

  • ne, then

Universit` a Roma Tre

slide-125
SLIDE 125

Factoring integers,..., RSA

College of Science for Women 33

If Pk is the probability that among k random numbers≤ 10100 there is a prime

  • ne, then

Pk = 1 −

  • 1 − π(10100)

10100 k

Universit` a Roma Tre

slide-126
SLIDE 126

Factoring integers,..., RSA

College of Science for Women 33

If Pk is the probability that among k random numbers≤ 10100 there is a prime

  • ne, then

Pk = 1 −

  • 1 − π(10100)

10100 k Therefore 0.663942 < P250 < 0.66554440

Universit` a Roma Tre

slide-127
SLIDE 127

Factoring integers,..., RSA

College of Science for Women 33

If Pk is the probability that among k random numbers≤ 10100 there is a prime

  • ne, then

Pk = 1 −

  • 1 − π(10100)

10100 k Therefore 0.663942 < P250 < 0.66554440 To speed up the process: One can consider only odd random numbers not divisible by 3 nor by 5.

Universit` a Roma Tre

slide-128
SLIDE 128

Factoring integers,..., RSA

College of Science for Women 33

If Pk is the probability that among k random numbers≤ 10100 there is a prime

  • ne, then

Pk = 1 −

  • 1 − π(10100)

10100 k Therefore 0.663942 < P250 < 0.66554440 To speed up the process: One can consider only odd random numbers not divisible by 3 nor by 5. Let Ψ(x, 30) = # {n ≤ x s.t. gcd(n, 30) = 1}

Universit` a Roma Tre

slide-129
SLIDE 129

Factoring integers,..., RSA

College of Science for Women 34

To speed up the process: One can consider only odd random numbers not divisible by 3 nor by 5.

Universit` a Roma Tre

slide-130
SLIDE 130

Factoring integers,..., RSA

College of Science for Women 34

To speed up the process: One can consider only odd random numbers not divisible by 3 nor by 5. Let Ψ(x, 30) = # {n ≤ x s.t. gcd(n, 30) = 1} then

Universit` a Roma Tre

slide-131
SLIDE 131

Factoring integers,..., RSA

College of Science for Women 34

To speed up the process: One can consider only odd random numbers not divisible by 3 nor by 5. Let Ψ(x, 30) = # {n ≤ x s.t. gcd(n, 30) = 1} then 4 15x − 4 < Ψ(x, 30) < 4 15x + 4

Universit` a Roma Tre

slide-132
SLIDE 132

Factoring integers,..., RSA

College of Science for Women 34

To speed up the process: One can consider only odd random numbers not divisible by 3 nor by 5. Let Ψ(x, 30) = # {n ≤ x s.t. gcd(n, 30) = 1} then 4 15x − 4 < Ψ(x, 30) < 4 15x + 4 Hence, if P ′

k is the probability that among k random numbers ≤ 10100

coprime with 30, there is a prime one, then

Universit` a Roma Tre

slide-133
SLIDE 133

Factoring integers,..., RSA

College of Science for Women 34

To speed up the process: One can consider only odd random numbers not divisible by 3 nor by 5. Let Ψ(x, 30) = # {n ≤ x s.t. gcd(n, 30) = 1} then 4 15x − 4 < Ψ(x, 30) < 4 15x + 4 Hence, if P ′

k is the probability that among k random numbers ≤ 10100

coprime with 30, there is a prime one, then P ′

k = 1 −

  • 1 −

π(10100) Ψ(10100, 30) k

Universit` a Roma Tre

slide-134
SLIDE 134

Factoring integers,..., RSA

College of Science for Women 34

To speed up the process: One can consider only odd random numbers not divisible by 3 nor by 5. Let Ψ(x, 30) = # {n ≤ x s.t. gcd(n, 30) = 1} then 4 15x − 4 < Ψ(x, 30) < 4 15x + 4 Hence, if P ′

k is the probability that among k random numbers ≤ 10100

coprime with 30, there is a prime one, then P ′

k = 1 −

  • 1 −

π(10100) Ψ(10100, 30) k and 0.98365832 < P ′

250 < 0.98395199

Universit` a Roma Tre

slide-135
SLIDE 135

Factoring integers,..., RSA

College of Science for Women 35

  • B. Primality test

Universit` a Roma Tre

slide-136
SLIDE 136

Factoring integers,..., RSA

College of Science for Women 35

  • B. Primality test

Fermat Little Theorem. If p is prime, p ∤ a ∈ N ap−1 ≡ 1 mod p

Universit` a Roma Tre

slide-137
SLIDE 137

Factoring integers,..., RSA

College of Science for Women 35

  • B. Primality test

Fermat Little Theorem. If p is prime, p ∤ a ∈ N ap−1 ≡ 1 mod p NON-primality test M ∈ Z, 2M−1 ≡ 1 mod M = = > Mcomposite!

Universit` a Roma Tre

slide-138
SLIDE 138

Factoring integers,..., RSA

College of Science for Women 35

  • B. Primality test

Fermat Little Theorem. If p is prime, p ∤ a ∈ N ap−1 ≡ 1 mod p NON-primality test M ∈ Z, 2M−1 ≡ 1 mod M = = > Mcomposite! Example: 2RSA2048−1 ≡ 1 mod RSA2048 Therefore RSA2048 is composite!

Universit` a Roma Tre

slide-139
SLIDE 139

Factoring integers,..., RSA

College of Science for Women 35

  • B. Primality test

Fermat Little Theorem. If p is prime, p ∤ a ∈ N ap−1 ≡ 1 mod p NON-primality test M ∈ Z, 2M−1 ≡ 1 mod M = = > Mcomposite! Example: 2RSA2048−1 ≡ 1 mod RSA2048 Therefore RSA2048 is composite! Fermat little Theorem does not invert. Infact

Universit` a Roma Tre

slide-140
SLIDE 140

Factoring integers,..., RSA

College of Science for Women 35

  • B. Primality test

Fermat Little Theorem. If p is prime, p ∤ a ∈ N ap−1 ≡ 1 mod p NON-primality test M ∈ Z, 2M−1 ≡ 1 mod M = = > Mcomposite! Example: 2RSA2048−1 ≡ 1 mod RSA2048 Therefore RSA2048 is composite! Fermat little Theorem does not invert. Infact 293960 ≡ 1 (mod 93961) but 93961 = 7 × 31 × 433

Universit` a Roma Tre

slide-141
SLIDE 141

Factoring integers,..., RSA

College of Science for Women 36

Strong pseudo primes

Universit` a Roma Tre

slide-142
SLIDE 142

Factoring integers,..., RSA

College of Science for Women 36

Strong pseudo primes

From now on m ≡ 3 mod 4 (just to simplify the notation)

Universit` a Roma Tre

slide-143
SLIDE 143

Factoring integers,..., RSA

College of Science for Women 36

Strong pseudo primes

From now on m ≡ 3 mod 4 (just to simplify the notation)

  • Definition. m ∈ N, m ≡ 3 mod 4, composite is said strong pseudo prime

(SPSP) in base a if a(m−1)/2 ≡ ±1 (mod m).

Universit` a Roma Tre

slide-144
SLIDE 144

Factoring integers,..., RSA

College of Science for Women 36

Strong pseudo primes

From now on m ≡ 3 mod 4 (just to simplify the notation)

  • Definition. m ∈ N, m ≡ 3 mod 4, composite is said strong pseudo prime

(SPSP) in base a if a(m−1)/2 ≡ ±1 (mod m).

  • Note. If p > 2 prime =

= > a(p−1)/2 ≡ ±1 (mod p) Let S = {a ∈ Z/mZ s.t. gcd(m, a) = 1, a(m−1)/2 ≡ ±1 (mod m)}

Universit` a Roma Tre

slide-145
SLIDE 145

Factoring integers,..., RSA

College of Science for Women 36

Strong pseudo primes

From now on m ≡ 3 mod 4 (just to simplify the notation)

  • Definition. m ∈ N, m ≡ 3 mod 4, composite is said strong pseudo prime

(SPSP) in base a if a(m−1)/2 ≡ ±1 (mod m).

  • Note. If p > 2 prime =

= > a(p−1)/2 ≡ ±1 (mod p) Let S = {a ∈ Z/mZ s.t. gcd(m, a) = 1, a(m−1)/2 ≡ ±1 (mod m)} ➀ ➁ ➂ ➃

Universit` a Roma Tre

slide-146
SLIDE 146

Factoring integers,..., RSA

College of Science for Women 36

Strong pseudo primes

From now on m ≡ 3 mod 4 (just to simplify the notation)

  • Definition. m ∈ N, m ≡ 3 mod 4, composite is said strong pseudo prime

(SPSP) in base a if a(m−1)/2 ≡ ±1 (mod m).

  • Note. If p > 2 prime =

= > a(p−1)/2 ≡ ±1 (mod p) Let S = {a ∈ Z/mZ s.t. gcd(m, a) = 1, a(m−1)/2 ≡ ±1 (mod m)} ➀ S ⊆ (Z/mZ)∗ subgroup ➁ ➂ ➃

Universit` a Roma Tre

slide-147
SLIDE 147

Factoring integers,..., RSA

College of Science for Women 36

Strong pseudo primes

From now on m ≡ 3 mod 4 (just to simplify the notation)

  • Definition. m ∈ N, m ≡ 3 mod 4, composite is said strong pseudo prime

(SPSP) in base a if a(m−1)/2 ≡ ±1 (mod m).

  • Note. If p > 2 prime =

= > a(p−1)/2 ≡ ±1 (mod p) Let S = {a ∈ Z/mZ s.t. gcd(m, a) = 1, a(m−1)/2 ≡ ±1 (mod m)} ➀ S ⊆ (Z/mZ)∗ subgroup ➁ If m is composite = = > proper subgroup ➂ ➃

Universit` a Roma Tre

slide-148
SLIDE 148

Factoring integers,..., RSA

College of Science for Women 36

Strong pseudo primes

From now on m ≡ 3 mod 4 (just to simplify the notation)

  • Definition. m ∈ N, m ≡ 3 mod 4, composite is said strong pseudo prime

(SPSP) in base a if a(m−1)/2 ≡ ±1 (mod m).

  • Note. If p > 2 prime =

= > a(p−1)/2 ≡ ±1 (mod p) Let S = {a ∈ Z/mZ s.t. gcd(m, a) = 1, a(m−1)/2 ≡ ±1 (mod m)} ➀ S ⊆ (Z/mZ)∗ subgroup ➁ If m is composite = = > proper subgroup ➂ If m is composite = = > #S ≤ ϕ(m)

4

➃

Universit` a Roma Tre

slide-149
SLIDE 149

Factoring integers,..., RSA

College of Science for Women 36

Strong pseudo primes

From now on m ≡ 3 mod 4 (just to simplify the notation)

  • Definition. m ∈ N, m ≡ 3 mod 4, composite is said strong pseudo prime

(SPSP) in base a if a(m−1)/2 ≡ ±1 (mod m).

  • Note. If p > 2 prime =

= > a(p−1)/2 ≡ ±1 (mod p) Let S = {a ∈ Z/mZ s.t. gcd(m, a) = 1, a(m−1)/2 ≡ ±1 (mod m)} ➀ S ⊆ (Z/mZ)∗ subgroup ➁ If m is composite = = > proper subgroup ➂ If m is composite = = > #S ≤ ϕ(m)

4

➃ If m is composite = = > Prob(m PSPF in base a) ≤ 0, 25

Universit` a Roma Tre

slide-150
SLIDE 150

Factoring integers,..., RSA

College of Science for Women 37

Miller–Rabin primality test

Universit` a Roma Tre

slide-151
SLIDE 151

Factoring integers,..., RSA

College of Science for Women 37

Miller–Rabin primality test

Let m ≡ 3 mod 4

Universit` a Roma Tre

slide-152
SLIDE 152

Factoring integers,..., RSA

College of Science for Women 37

Miller–Rabin primality test

Let m ≡ 3 mod 4 Miller Rabin algorithm with k iterations N = (m − 1)/2 for j = 0 to k do a =Random(m) if aN ≡ ±1 mod m then OUPUT=(m composite): END endfor OUTPUT=(m prime)

Universit` a Roma Tre

slide-153
SLIDE 153

Factoring integers,..., RSA

College of Science for Women 37

Miller–Rabin primality test

Let m ≡ 3 mod 4 Miller Rabin algorithm with k iterations N = (m − 1)/2 for j = 0 to k do a =Random(m) if aN ≡ ±1 mod m then OUPUT=(m composite): END endfor OUTPUT=(m prime) Monte Carlo primality test

Universit` a Roma Tre

slide-154
SLIDE 154

Factoring integers,..., RSA

College of Science for Women 37

Miller–Rabin primality test

Let m ≡ 3 mod 4 Miller Rabin algorithm with k iterations N = (m − 1)/2 for j = 0 to k do a =Random(m) if aN ≡ ±1 mod m then OUPUT=(m composite): END endfor OUTPUT=(m prime) Monte Carlo primality test Prob(Miller Rabin says m prime and m is composite)

1 4k

Universit` a Roma Tre

slide-155
SLIDE 155

Factoring integers,..., RSA

College of Science for Women 37

Miller–Rabin primality test

Let m ≡ 3 mod 4 Miller Rabin algorithm with k iterations N = (m − 1)/2 for j = 0 to k do a =Random(m) if aN ≡ ±1 mod m then OUPUT=(m composite): END endfor OUTPUT=(m prime) Monte Carlo primality test Prob(Miller Rabin says m prime and m is composite)

1 4k

In the real world, software uses Miller Rabin with k = 10

Universit` a Roma Tre

slide-156
SLIDE 156

Factoring integers,..., RSA

College of Science for Women 38

Deterministic primality tests

Universit` a Roma Tre

slide-157
SLIDE 157

Factoring integers,..., RSA

College of Science for Women 38

Deterministic primality tests

  • Theorem. (Miller, Bach) If m is composite, then

GRH = = > ∃a ≤ 2 log2 m s.t. a(m−1)/2 ≡ ±1 (mod m). (i.e. m is not SPSP in base a.)

Universit` a Roma Tre

slide-158
SLIDE 158

Factoring integers,..., RSA

College of Science for Women 38

Deterministic primality tests

  • Theorem. (Miller, Bach) If m is composite, then

GRH = = > ∃a ≤ 2 log2 m s.t. a(m−1)/2 ≡ ±1 (mod m). (i.e. m is not SPSP in base a.)

Consequence: “Miller–Rabin de–randomizes on GRH” (m ≡ 3 mod 4)

Universit` a Roma Tre

slide-159
SLIDE 159

Factoring integers,..., RSA

College of Science for Women 38

Deterministic primality tests

  • Theorem. (Miller, Bach) If m is composite, then

GRH = = > ∃a ≤ 2 log2 m s.t. a(m−1)/2 ≡ ±1 (mod m). (i.e. m is not SPSP in base a.)

Consequence: “Miller–Rabin de–randomizes on GRH” (m ≡ 3 mod 4) for a = 2 to 2 log2 m do if a(m−1)/2 ≡ ±1 mod m then OUPUT=(m composite): END endfor OUTPUT=(m prime)

Universit` a Roma Tre

slide-160
SLIDE 160

Factoring integers,..., RSA

College of Science for Women 38

Deterministic primality tests

  • Theorem. (Miller, Bach) If m is composite, then

GRH = = > ∃a ≤ 2 log2 m s.t. a(m−1)/2 ≡ ±1 (mod m). (i.e. m is not SPSP in base a.)

Consequence: “Miller–Rabin de–randomizes on GRH” (m ≡ 3 mod 4) for a = 2 to 2 log2 m do if a(m−1)/2 ≡ ±1 mod m then OUPUT=(m composite): END endfor OUTPUT=(m prime) Deterministic Polynomial time algorithm

Universit` a Roma Tre

slide-161
SLIDE 161

Factoring integers,..., RSA

College of Science for Women 38

Deterministic primality tests

  • Theorem. (Miller, Bach) If m is composite, then

GRH = = > ∃a ≤ 2 log2 m s.t. a(m−1)/2 ≡ ±1 (mod m). (i.e. m is not SPSP in base a.)

Consequence: “Miller–Rabin de–randomizes on GRH” (m ≡ 3 mod 4) for a = 2 to 2 log2 m do if a(m−1)/2 ≡ ±1 mod m then OUPUT=(m composite): END endfor OUTPUT=(m prime) Deterministic Polynomial time algorithm It runs in O(log5 m) operations in Z/mZ.

Universit` a Roma Tre

slide-162
SLIDE 162

Factoring integers,..., RSA

College of Science for Women 39

Certified prime records

Universit` a Roma Tre

slide-163
SLIDE 163

Factoring integers,..., RSA

College of Science for Women 39

Certified prime records

✎ 257885161 − 1, 17425170 digits (discovered in 01/2014 ) ✎ 243112609 − 1, 12978189 digits (discovered in 2008) ✎ 242643801 − 1, 12837064 digits (discovered in 2009) ✎ 237156667 − 1, 11185272 digits (discovered in 2008) ✎ 232582657 − 1, 9808358 digits (discovered in 2006) ✎ 230402457 − 1, 9152052 digits (discovered in 2005) ✎ 225964951 − 1, 7816230 digits (discovered in 2005) ✎ 224036583 − 1, 6320430 digits (discovered in 2004) ✎ 220996011 − 1, 6320430 digits (discovered in 2003) ✎ 213466917 − 1, 4053946 digits (discovered in 2001) ✎ 26972593 − 1, 2098960 digits (discovered in 1999) ✎ 5359 × 25054502 + 1, 1521561 digits (discovered in 2003)

Universit` a Roma Tre

slide-164
SLIDE 164

Factoring integers,..., RSA

College of Science for Women 40

Great Internet Mersenne Prime Search (GIMPS)

Universit` a Roma Tre

slide-165
SLIDE 165

Factoring integers,..., RSA

College of Science for Women 40

Great Internet Mersenne Prime Search (GIMPS)

The Great Internet Mersenne Prime Search (GIMPS) is a collaborative project of volunteers who use freely available software to search for Mersenne prime numbers (i.e. prime numbers of the form 2p −1 (p prime)).

Universit` a Roma Tre

slide-166
SLIDE 166

Factoring integers,..., RSA

College of Science for Women 40

Great Internet Mersenne Prime Search (GIMPS)

The Great Internet Mersenne Prime Search (GIMPS) is a collaborative project of volunteers who use freely available software to search for Mersenne prime numbers (i.e. prime numbers of the form 2p −1 (p prime)). The project was founded by George Woltman in January 1996.

Universit` a Roma Tre

slide-167
SLIDE 167

Factoring integers,..., RSA

College of Science for Women 41

The AKS deterministic primality test

Universit` a Roma Tre

slide-168
SLIDE 168

Factoring integers,..., RSA

College of Science for Women 41

The AKS deterministic primality test

Department of Computer Science & Engineering, I.I.T. Kanpur, Agost 8, 2002.

Universit` a Roma Tre

slide-169
SLIDE 169

Factoring integers,..., RSA

College of Science for Women 41

The AKS deterministic primality test

Department of Computer Science & Engineering, I.I.T. Kanpur, Agost 8, 2002. Nitin Saxena, Neeraj Kayal and Manindra Agarwal

Universit` a Roma Tre

slide-170
SLIDE 170

Factoring integers,..., RSA

College of Science for Women 41

The AKS deterministic primality test

Department of Computer Science & Engineering, I.I.T. Kanpur, Agost 8, 2002. Nitin Saxena, Neeraj Kayal and Manindra Agarwal New deterministic, polynomial–time, primality test.

Universit` a Roma Tre

slide-171
SLIDE 171

Factoring integers,..., RSA

College of Science for Women 41

The AKS deterministic primality test

Department of Computer Science & Engineering, I.I.T. Kanpur, Agost 8, 2002. Nitin Saxena, Neeraj Kayal and Manindra Agarwal New deterministic, polynomial–time, primality test. Solves #1 open question in computational number theory

Universit` a Roma Tre

slide-172
SLIDE 172

Factoring integers,..., RSA

College of Science for Women 41

The AKS deterministic primality test

Department of Computer Science & Engineering, I.I.T. Kanpur, Agost 8, 2002. Nitin Saxena, Neeraj Kayal and Manindra Agarwal New deterministic, polynomial–time, primality test. Solves #1 open question in computational number theory

http://www.cse.iitk.ac.in/news/primality.html

Universit` a Roma Tre

slide-173
SLIDE 173

Factoring integers,..., RSA

College of Science for Women 42

How does the AKS work?

Universit` a Roma Tre

slide-174
SLIDE 174

Factoring integers,..., RSA

College of Science for Women 42

How does the AKS work?

  • Theorem. (AKS) Let n ∈ N. Assume q, r primes, S ⊆ N finite:
  • q|r − 1;
  • n(r−1)/q mod r ∈ {0, 1};
  • gcd(n, b − b′) = 1,

∀b, b′ ∈ S (distinct);

  • q+#S−1

#S

  • ≥ n2⌊√r⌋;
  • (x + b)n = xn + b in Z/nZ[x]/(xr − 1),

∀b ∈ S; Then n is a power of a prime

Bernstein formulation Universit` a Roma Tre

slide-175
SLIDE 175

Factoring integers,..., RSA

College of Science for Women 42

How does the AKS work?

  • Theorem. (AKS) Let n ∈ N. Assume q, r primes, S ⊆ N finite:
  • q|r − 1;
  • n(r−1)/q mod r ∈ {0, 1};
  • gcd(n, b − b′) = 1,

∀b, b′ ∈ S (distinct);

  • q+#S−1

#S

  • ≥ n2⌊√r⌋;
  • (x + b)n = xn + b in Z/nZ[x]/(xr − 1),

∀b ∈ S; Then n is a power of a prime

Bernstein formulation

Fouvry Theorem (1985) = = > ∃r ≈ log6 n, s ≈ log4 n

Universit` a Roma Tre

slide-176
SLIDE 176

Factoring integers,..., RSA

College of Science for Women 42

How does the AKS work?

  • Theorem. (AKS) Let n ∈ N. Assume q, r primes, S ⊆ N finite:
  • q|r − 1;
  • n(r−1)/q mod r ∈ {0, 1};
  • gcd(n, b − b′) = 1,

∀b, b′ ∈ S (distinct);

  • q+#S−1

#S

  • ≥ n2⌊√r⌋;
  • (x + b)n = xn + b in Z/nZ[x]/(xr − 1),

∀b ∈ S; Then n is a power of a prime

Bernstein formulation

Fouvry Theorem (1985) = = > ∃r ≈ log6 n, s ≈ log4 n = = > AKS runs in O(log15 n)

  • perations in Z/nZ.

Universit` a Roma Tre

slide-177
SLIDE 177

Factoring integers,..., RSA

College of Science for Women 42

How does the AKS work?

  • Theorem. (AKS) Let n ∈ N. Assume q, r primes, S ⊆ N finite:
  • q|r − 1;
  • n(r−1)/q mod r ∈ {0, 1};
  • gcd(n, b − b′) = 1,

∀b, b′ ∈ S (distinct);

  • q+#S−1

#S

  • ≥ n2⌊√r⌋;
  • (x + b)n = xn + b in Z/nZ[x]/(xr − 1),

∀b ∈ S; Then n is a power of a prime

Bernstein formulation

Fouvry Theorem (1985) = = > ∃r ≈ log6 n, s ≈ log4 n = = > AKS runs in O(log15 n)

  • perations in Z/nZ.

Many simplifications and improvements: Bernstein, Lenstra, Pomerance.....

Universit` a Roma Tre

slide-178
SLIDE 178

Factoring integers,..., RSA

College of Science for Women 43

Why is RSA safe?

Universit` a Roma Tre

slide-179
SLIDE 179

Factoring integers,..., RSA

College of Science for Women 43

Why is RSA safe?

☞ ☞ ☞

Universit` a Roma Tre

slide-180
SLIDE 180

Factoring integers,..., RSA

College of Science for Women 43

Why is RSA safe?

☞ It is clear that if Charles can factor M, ☞ ☞

Universit` a Roma Tre

slide-181
SLIDE 181

Factoring integers,..., RSA

College of Science for Women 43

Why is RSA safe?

☞ It is clear that if Charles can factor M, then he can also compute ϕ(M) and then also d so to decrypt messages ☞ ☞

Universit` a Roma Tre

slide-182
SLIDE 182

Factoring integers,..., RSA

College of Science for Women 43

Why is RSA safe?

☞ It is clear that if Charles can factor M, then he can also compute ϕ(M) and then also d so to decrypt messages ☞ Computing ϕ(M) is equivalent to completely factor M. In fact ☞

Universit` a Roma Tre

slide-183
SLIDE 183

Factoring integers,..., RSA

College of Science for Women 43

Why is RSA safe?

☞ It is clear that if Charles can factor M, then he can also compute ϕ(M) and then also d so to decrypt messages ☞ Computing ϕ(M) is equivalent to completely factor M. In fact p, q = M − ϕ(M) + 1 ±

  • (M − ϕ(M) + 1)2 − 4M

2 ☞

Universit` a Roma Tre

slide-184
SLIDE 184

Factoring integers,..., RSA

College of Science for Women 43

Why is RSA safe?

☞ It is clear that if Charles can factor M, then he can also compute ϕ(M) and then also d so to decrypt messages ☞ Computing ϕ(M) is equivalent to completely factor M. In fact p, q = M − ϕ(M) + 1 ±

  • (M − ϕ(M) + 1)2 − 4M

2 ☞ RSA Hypothesis. The only way to compute efficiently

Universit` a Roma Tre

slide-185
SLIDE 185

Factoring integers,..., RSA

College of Science for Women 43

Why is RSA safe?

☞ It is clear that if Charles can factor M, then he can also compute ϕ(M) and then also d so to decrypt messages ☞ Computing ϕ(M) is equivalent to completely factor M. In fact p, q = M − ϕ(M) + 1 ±

  • (M − ϕ(M) + 1)2 − 4M

2 ☞ RSA Hypothesis. The only way to compute efficiently x1/e mod M, ∀x ∈ Z/MZ

Universit` a Roma Tre

slide-186
SLIDE 186

Factoring integers,..., RSA

College of Science for Women 43

Why is RSA safe?

☞ It is clear that if Charles can factor M, then he can also compute ϕ(M) and then also d so to decrypt messages ☞ Computing ϕ(M) is equivalent to completely factor M. In fact p, q = M − ϕ(M) + 1 ±

  • (M − ϕ(M) + 1)2 − 4M

2 ☞ RSA Hypothesis. The only way to compute efficiently x1/e mod M, ∀x ∈ Z/MZ (i.e. decrypt messages) is to factor M

Universit` a Roma Tre

slide-187
SLIDE 187

Factoring integers,..., RSA

College of Science for Women 43

Why is RSA safe?

☞ It is clear that if Charles can factor M, then he can also compute ϕ(M) and then also d so to decrypt messages ☞ Computing ϕ(M) is equivalent to completely factor M. In fact p, q = M − ϕ(M) + 1 ±

  • (M − ϕ(M) + 1)2 − 4M

2 ☞ RSA Hypothesis. The only way to compute efficiently x1/e mod M, ∀x ∈ Z/MZ (i.e. decrypt messages) is to factor M In other words

Universit` a Roma Tre

slide-188
SLIDE 188

Factoring integers,..., RSA

College of Science for Women 43

Why is RSA safe?

☞ It is clear that if Charles can factor M, then he can also compute ϕ(M) and then also d so to decrypt messages ☞ Computing ϕ(M) is equivalent to completely factor M. In fact p, q = M − ϕ(M) + 1 ±

  • (M − ϕ(M) + 1)2 − 4M

2 ☞ RSA Hypothesis. The only way to compute efficiently x1/e mod M, ∀x ∈ Z/MZ (i.e. decrypt messages) is to factor M In other words The two problems are polynomially equivalent

Universit` a Roma Tre

slide-189
SLIDE 189

Factoring integers,..., RSA

College of Science for Women 44

Two kinds of Cryptography

Universit` a Roma Tre

slide-190
SLIDE 190

Factoring integers,..., RSA

College of Science for Women 44

Two kinds of Cryptography

☞ Private key (or symmetric) ✎ Lucifer ✎ DES ✎ AES

Universit` a Roma Tre

slide-191
SLIDE 191

Factoring integers,..., RSA

College of Science for Women 44

Two kinds of Cryptography

☞ Private key (or symmetric) ✎ Lucifer ✎ DES ✎ AES ☞ Public key ✎ RSA ✎ Diffie–Hellmann ✎ Knapsack ✎ NTRU

Universit` a Roma Tre

slide-192
SLIDE 192

Factoring integers,..., RSA

College of Science for Women 45

Another quotation!!!

Have you ever noticed that there’s no attempt being made to find really large numbers that aren’t prime. I mean, wouldn’t you like to see a news report that says “Today the Department of Computer Sciences at the University of Washington annouced that 258,111,625,031 + 8 is even”. This is the largest non-prime yet reported.

  • University of Washington (Bathroom Graffiti)

Universit` a Roma Tre