\chapter{Public-key Cryptography}\label{ch:crypto}

\section{Diffie-Hellman Key Exchange}

\hd{Key Ideas}
\begin{itemize}
\item Public-key cryptography
\item The Diffie-Hellman key exchange
\end{itemize}

\subsection{Public-key Cryptography}
\includegraphics[width=3em]{graphics/nikita.eps} 
Nikita must communicate vital information to Michael, who is a thousand
kilometers away.  Their communications are being monitored by 
The Collective, which must not discover the message.   
If Nikita and Michael could somehow agree on a secret encoding 
key, they could encrypt their message.  Fortunately, Nikita knows
about an algorithm developed by Diffie and Hellman in 1976.  

\subsection{The Diffie-Hellman Key Exchange Protocol}
Nikita and Michael agree on a prime number~$p$ and 
an integer~$g$ that has order $p-1$ modulo~$p$.  
(So $g^{p-1}\con 1\pmod{p}$, but $g^{n} \not\con 1\pmod{p}$
for any positive $n<p-1$.)  Nikita chooses a random number
$n<p$, and Michael chooses a random number $m<p$.
Nikita sends $g^n\pmod{p}$ to Michael, and Michael
sends $g^m\pmod{p}$ to Nikita.   
Nikita can now compute the secret key:
$$
   s = g^{mn} = (g^m)^n \pmod{p}.
$$
Likewise, Michael computes the secret key:
$$
    s = g^{mn} = (g^n)^m \pmod{p}.
$$
Now Nikita uses the secret key~$s$ to send Michael 
an encrypted version of her critical message.  Michael,
who also knows~$s$, is able to decode the message.

Meanwhile, hackers in The Collective see both $g^n\pmod{p}$ and
$g^m\pmod{p}$, but they aren't able to use this information to deduce
either $m$, $n$, or $g^{mn}\pmod{p}$ quickly enough to stop Michael
from thwarting their plans.   Yeah!  

The Diffie-Hellman key exchange is the first public-key cryptosystem
every published (1976).  The system was discovered by GCHQ (British
intelligence) a few years before Diffie and Hellman found it, but they
couldn't tell anyone about their work; perhaps it was discovered by
others before.  That this system was discovered independently more
than once shouldn't surprise you, given how simple it is!

\subsubsection{Some Quotes}
A review of Diffie and Hellman's groundbreaking article is amusing,
because the reviewer, J.S.\ Joel, says ``They propose a couple of
techniques for implementing the system, but the reviewer was
unconvinced.''  
\begin{verbatim}
Diffie, Whitfield; Hellman, Martin E. 
 New directions in cryptography. 
 IEEE Trans. Information Theory IT-22 (1976), no. 6, 644--654. 
\end{verbatim}
\begin{quote}
The authors discuss some of the recent results in communications
theory that have arisen out of the need for security in the key
distribution channels. They concentrate on the use of ciphers to
restrict the extraction of information from a communication over an
insecure [channel]. As is well known, the transmission and
distribution is then likely to become a problem, in efficiency if not
in security. The authors suggest various possible approaches to avoid
these further problems that arise. The first they call a ``public key
distribution system'', which has the feature that an unauthorized
``eavesdropper'' will find it computationally infeasible to decipher
the message since the enciphering and deciphering are governed by
distinct keys. They propose a couple of techniques for implementing
the system, but the reviewer was unconvinced.
\end{quote}

Alan Westrope\edit{Who is he?} wrote in 1998 about political
implications:
\begin{quote}
The 1976 publication of ``New Directions in Cryptography'', by
Whitfield Diffie and Martin Hellman, was epochal in cryptographic
history. Many regard it as the beginning of public-key cryptography,
analogous to a first shot in what has become an ongoing battle over
privacy, civil liberties, and the meaning of sovereignty in cyberspace.
\end{quote}

%\newpage
Here is what Diffie and Hellman look like, respectively\edit{I think
I photographed these from Simon Singh's crypto book.}:
\begin{center}
\includegraphics[width=10em]{graphics/diffie.eps}
$\qquad$
\includegraphics[width=10em]{graphics/hellman.eps}
\end{center}

\subsection{Let's try it!}
To make finding~$g$ easier, let's choose a prime~$p$
such that $(p-1)/2=q$ is prime (so $p-1 = 2q$, with $q$ prime).
Since for any~$g$ with $\gcd(g,p)=1$, 
$$
   g^{2q} \con 1\pmod{p},
$$
the order of~$g$ is $1$, $2$, $q$, or $2q=p-1$,
so the order of~$g$ is easy to compute.

For our first example, let $p=23$.  
Then $g=5$ has order $p-1=22$.
(I found $g=5$ using the function {\tt znprimroot} in PARI.  You can
also just compute the order of $2$, $3$, etc., until you find a number
with order $p-1$.)

\hd{Nikita:} Chooses secret $n=12$; sends $g^{12} = 5^{12} \con \mathbf{18}
\pmod{23}$.

\hd{Michael:} Chooses secret $n=5$; sends $g^5 = 5^5 \con \mathbf{20}
\pmod{23}$.

\hd{Compute Shared Secret:}\\
Nikita:
$
 20^{12} \con \mathbf{3}\pmod{23}
$\\
Michael:
$
 18^{5} \con \mathbf{3}\pmod{23}.
$

\subsection{The Discrete Logarithm Problem}

Let $a, b, n$ be positive real numbers.
Recall that 
$$
  \log_b(a) = n \text{ if and only if } a=b^n.
$$
Thus the $\log_b$ function solves the following problem:
Given a base~$b$ and a power~$a$ of~$b$,
find an exponent~$n$ such that 
$$
   a = b^n.
$$
That is, given $b^n$ and~$b$, find~$n$.
\begin{example}
$a = 19683$, $b=3$.  
A calculator quickly gives that
$$
  n = \log(19683) / \log(3) = 9.
$$
\end{example}
The discrete log problem is the analogue of this problem modulo~$p$:

\hd{Discrete Log Problem:} Given $b\pmod{p}$ and $b^n\pmod{p}$,
find~$n$.  Put another way, compute $\log_b(a)$, when 
$a, b \in\Z/p\Z$.

As far as we know, this problem is {\bf VERY HARD} to solve quickly.
Nobody has admitted publicly to having proved that the discrete log
can't be solved quickly, but many very smart people have tried hard
and not succeeded.  It's easy to write a {\em slow} program to
solve the discrete log problem.  (There are better methods but we
won't discuss them in this class.)
\begin{verbatim}
? dislog(x,g, s) = s=g; for(n=1,znorder(g),if(x==s, return(n), s=s*g)); 0;
? dislog(18,Mod(5,23))
%6 = 12
? dislog(20,Mod(5,23))
%7 = 5
\end{verbatim}
So the example above was far too simple.  Let's try a slightly larger
prime:
\begin{verbatim}
? p=nextprime(9584)
%8 = 9587
? isprime((p-1)\2)
%9 = 1
? znorder(Mod(2,p))
%10 = 9586
? g=Mod(2,p)
%11 = Mod(2, 9587)
? a = g^389
%15 = Mod(7320, 9587)
? dislog(a,g)
%16 = 389
\end{verbatim}
This is still very easy to ``crack''.  Let's try an even bigger one.
\begin{verbatim}
? p = 9048610007
%1 = 9048610007
?  g = Mod(5,p)
%2 = Mod(5, 9048610007)
? a = g^948603
%3 = Mod(3668993056, 9048610007)
? dislog(a,g)              \\ this take a while
%4 = 948603
? znlog(a,g)        \\ builtin super-optimized version takes about 1/2 second
%31 = 948603
\end{verbatim}
Computing the discrete log gets slow quickly, the larger we make the~$p$.
Doubling the number of digits of the modulus makes the discrete log much
much harder.

\subsubsection{The State of the Art}
\begin{verbatim}
Discrete logarithms in GF(2^n)
From: Reynald LERCIER <lercier@club-internet.fr>
 To: NMBRTHRY@LISTSERV.NODAK.EDU
 Date: Tue, 25 Sep 2001 13:37:18 -0400
 
We are pleased to announce a new record for the discrete logarithm
problem. We were able to compute discrete logarithms in
GF(2^521). This was done in one month on a unique 525MHz
quadri-processors Digital Alpha Server 8400 computer. The approach
that we followed is a careful implementation of the general Function
Field Sieve as described from a theoretical point of view by Adleman
[Ad94].

As far as we know, the largest such computation previously done was
performed in GF(2^401) [GoMc92] using an algorithm due to Coppersmith
[Co84]. 

[...]
So, as a conclusion, time that we need for computing discrete
logarithms in GF(2^521) on a 525 MHz quadri-processor alpha server
8400 computer is approximatively 12 hours for each, once the sieving
step (21 days) and the linear algebra step (10 days) is performed.

Antoine JOUX    (DCSSI, Issy les Moulineaux, France, Antoine.Joux@ens.fr),
Reynald LERCIER (CELAR, Rennes, France, lercier@celar.fr).
\end{verbatim}



\subsection{Realistic Example}

\begin{verbatim}
? p=nextprime(93450983094850938450983409583)
%17 = 93450983094850938450983409611
? isprime((p-1)\2)
%18 = 0
? nextgoodprime(p) = while(!isprime((p-1)\2), p=nextprime(p+1)); p
? nextgoodprime(p)
%19 = 93450983094850938450983409623
? g=2
%21 = 2
? znorder(Mod(g,p))
%22 = 93450983094850938450983409610
? ?random
random({N=2^31}): random integer between 0 and N-1.
? nikita = random(p)
%23 = 18319922375531859171613379181
? michael = random(p)
%24 = 82335836243866695680141440300
? nikita_say = Mod(g,p)^nikita
%26 = Mod(17037287637415625385373411504, 93450983094850938450983409611)
? michael_say=Mod(g,p)^michael
%27 = Mod(2201425894324369970772940547, 93450983094850938450983409611)
? secret = nikita_say^michael
%28 = Mod(25591938014843312529239952955, 93450983094850938450983409611)
? secret = michael_say^nikita
%29 = Mod(25591938014843312529239952955, 93450983094850938450983409611)
\end{verbatim}







\section{The RSA Cryptosystem}


\hd{Key Ideas:}
\begin{itemize}
\item Creating an RSA public key
\item Encrypting and decrypting messages
\item Breaking RSA and factoring
\end{itemize}

\subsection{How RSA works}
\subsubsection{One-way Functions}
The {\em fundamental idea} behind RSA is to try to construct 
a ``one-way function'', i.e., an ``encryption'' function
$$
     E : X \ra X
$$
such that it is easy for Nikita, say, to compute $E^{-1}$, but very
hard for anybody else to compute $E^{-1}$.  

\subsubsection{How Nikita Makes an RSA Public Key}
Here is how Nikita makes a one-way function~$E$:
\begin{enumerate}
\item Nikita picks two large primes~$p$ and~$q$, and lets $n=pq$.
\item It is easy for Nikita to then compute
$$
   \vphi(n) = \vphi(p)\cdot \vphi(q) = (p-1)\cdot (q-1).
$$
\item Nikita next chooses a ``random'' integer~$e$ with 
$$
 1<e<\vphi(n)\text{ and }
 \gcd(e,\vphi(n))=1.
$$

\item Finally, Nikita uses the algorithm from Lecture 7 to find a
solution~$d$ to the equation 
$$
   ex \con 1\pmod{\vphi(n)}.
$$
\end{enumerate}

\hd{The Encoding Function:}\\
Nikita defines a function $E:\Z/n\Z \ra \Z/n\Z$
$$
   E(x) = x^e.
$$
(Recall that $\Z/n\Z = \{0,1,\ldots,n-1\}$ with addition and multiplication
modulo~$n$.)
Then anybody can compute~$E$ fairly quickly using the repeated-squaring
algorithm from Lecture~7.

Nikita's {\bf public key} is the pair of integers $(n,e)$, which is
just enough information for people to easily compute~$E$. 
Nikita knows a number~$d$ such that $ed\con 1\pmod{\vphi(n)}$, 
so, as we will see below, she can quickly compute $E^{-1}$.

Now Michael or even The Collective can send Nikita a message whenever
they want, even if Nikita is asleep.  They look up how to compute~$E$
and compute $E(\text{their message})$.

\subsubsection{Sending Nikita an Encrypted Message}
Encode your message as a sequence 
of numbers modulo~$n$ (see Section~\ref{sec:encode}):
$$
  m_1, \ldots, m_r \in \Z/n\Z.
$$
Send
$$
  E(m_1), \ldots, E(m_r)
$$
to Nikita.   (Recall that $E(m) = m^e$.)

\subsubsection{How Nikita Decrypts a Message}
When Nikita receives an $E(m_i)$, she finds~$m_i$ as follows:
$$
  m_i = E^{-1}(E(m_i))  = E(m_i)^d = (m_i^{e})^{d}=m_i.
$$
The following proposition proves that the last equality holds.
\begin{proposition}
Let~$n$ be a square-free integer and let $d,e\in\N$ such that
$p-1\mid de-1$ for each prime $p\mid n$.  Then
$a^{de} \con a\pmod{n}$ for all $a\in\Z$.
\end{proposition}
\begin{proof}
Since $n\mid a^{de}-a$ if and only if $p\mid a^{de}-a$ for each prime
divisor of~$p$, it suffices to prove that $a^{de}\con a\pmod{p}$ for
each prime divisor $p$ of~$n$.  If $\gcd(a,p)\neq 0$, then
$a\con 0\pmod{p}$, so $a^{de} \con a\pmod{p}$.  
If $\gcd(a,p)=1$, then Fermat's Little
Theorem asserts that $a^{p-1}\con 1\pmod{p}$.  
Since $p-1\mid de-1$, we have $a^{de-1} \con 1\pmod{p}$
as well.  Multiplying both sides
by~$a$ shows that $a^{de}\con a\pmod{p}$.  
\end{proof}

\subsection{Encoding a Phrase in a Number}\label{sec:encode}
Think of a sequence of letters and spaces as a number in base~$27$.
Let a single-space correspond to $0$, the letter $A$ to 1, $B$ to 2,
..., $Z$ to 26.  Thus, e.g., ``HARVARD'' denotes a number written in
base $27$.  The corresponding number written in decimal is $1808939906$:
$$
\text{HARVARD}\quad\leftrightarrow\quad
  8 + 27\cdot 1 + 27^2\cdot 18 + 27^3\cdot22 + 27^4\cdot1+27^5\cdot18 + 27^6\cdot 4
   = 1808939906
$$
To recover the digits of the number, repeatedly divide by $27$:
$$
\begin{array}{lcrcrr}
 1808939906 &=& 66997774\cdot 27 &+& 8 & \text{H}\\
 66997774   &=&2481399\cdot 27 &+& 1  & \text{A}\\
\end{array}
$$
and so on.

\subsubsection{How Many Letters Can a Number ``Hold''?}
If $27^k<n$, then $k$ letters can be encoded in a number $<n$.
Put another way,
$$
   k < \log(n) / \log(27) = \log_{27}(n).
$$

\subsection{Examples}
\subsubsection{A Small Example}
So the arithmetic is easy to follow, we use small primes~$p$
and~$q$ and encrypt the single letter ``X''.

\begin{enumerate}
\item Choose $p$ and $q$: Let $p=17$, $q=19$, so $n=pq = 323$.
\item Compute $\vphi(n)$:
$$\vphi(n) = \vphi(p\cdot q)=\vphi(p)\cdot\vphi(q)
           = (p-1)(q-1) = pq-p-q+1 = 323-17-19+1 = 288.$$
\item Randomly choose an $e\in\Z/323\Z$: We choose $e=95$.
\item Solve
$$
  95x \con 1\pmod{288}.
$$
Using the GCD algorithm, we find that $d=191$ solves 
the equation.
\end{enumerate}

The public key is $(323,95)$.  So $E:\Z/323\Z\ra \Z/323\Z$ is
defined by
$$
   E(x) = x^{95}.
$$

Next, we encrypt the letter ``X''.  It is encoded as the number
$24$, since X is the $24$th letter of the alphabet.
We have
$$
  E(24) = 24^{95} = 294 \in \Z/323\Z.
$$

To decrypt, we compute $E^{-1}$:
$$
  E^{-1}(294) = 294^{191} = 24 \in \Z/323\Z.
$$

\subsubsection{A Bigger Example in PARI}
\begin{verbatim}
? p=nextprime(random(10^30))
%3 = 738873402423833494183027176953
? q=nextprime(random(10^25))
%4 = 3787776806865662882378273
? n=p*q
%5 = 2798687536910915970127263606347911460948554197853542169
? e=random(n)
%6 = 1483959194866204179348536010284716655442139024915720699
? phin=(p-1)*(q-1)
%7 = 2798687536910915970127262867470721260308194351943986944
? while(gcd(e,phin)!=1,e=e+1)
? e
%8 = 1483959194866204179348536010284716655442139024915720699
? d = lift(Mod(e,phin)^(-1));
%9 = 2113367928496305469541348387088632973457802358781610803
? (e*d)%phin
%10 = 1
? log(n)/log(27)
%11 = 38.03851667699197952338510248
\end{verbatim}
We can encode single blocks of up to 38 letters.  Let's encode
``HARVARD'':
\begin{verbatim}
? m=8+27*1+27^2*18+27^3*22+27^4*1+27^5*18+27^6*4
%12 = 1808939906
? E(x)=lift(Mod(x,n)^e)
? D(x)=lift(Mod(x,n)^d)
? secret_message = E(m)
%14 = 625425724974078486559370130768554070421628674916144724
? D(secret_message)
%15 = 1808939906
\end{verbatim}

The following complete PARI program automates the whole
process, though it is a little clumsy.  
Call this file {\tt rsa.gp}.  It uses \{ and \} so that
functions can be extended over more than one line.
\begin{verbatim}
/* rsa.gp ------------------------------------------------ */
{alphabet=[" ","A","B","C","D","E","F","G","H","I","J","K","L","M",
           "N","O","P","Q","R","S","T","U","V","W","X","Y","Z"];
}
{letter_to_number(l, 
     n)=
     for(n=1,27,if(alphabet[n]==l,return(n-1))); 
     error("invalid input.")
}
{number_to_message(n,    
     s="")= 
     while(n>0, s = concat(s,alphabet[n%27+1]); n = n \ 27); 
     return(s)
}
{message_to_number(w,     
     i,n=0)=
     for(i=1,length(w), n = n + 27^(i-1)*letter_to_number(w[i]));
     return(n);
}
{make_rsa_key(len,  
     p,q,n,e,d)=
     p = nextprime(random(10^(len\2+1)));
     q = nextprime(random(10^(len\2+3)));
     n = p*q; phin = (p-1)*(q-1);
     e = random(phin);
     while(gcd(e,phin)!=1,e=e+1);
     d = lift(Mod(e,phin)^(-1));
     return([n,e,d]);
}
encrypt(message, n, e) = lift(Mod(message_to_number(message),n)^e);
decrypt(secret, n, d)  = number_to_message(lift(Mod(secret,n)^d));
/* rsa.gp ------------------------------------------------ */
\end{verbatim}

Here is an example that uses the above little program.
\begin{verbatim}
? \r rsa
? setrand(1)   \\ default random number seed is 1!
? rsa=make_rsa_key(20)   \\ returns [n, e, d]
%2 = [89050154117716728145939, 33735260657253161660951, 
      49244741969289756040079]
? n = rsa[1]; e = rsa[2]; d = rsa[3]; 
? public_key = [n,e]
%3 = [89050154117716728145939, 33735260657253161660951]
? msg = ["H", "A", "R", "V", "A", "R", "D"];   \\ clumsy!!!
? secret = encrypt(msg,n,e)
%36 = 75524965161901413275866
? decrypt(secret, n, d)
%37 = "HARVARD"
\end{verbatim}

\subsection{A Connection Between Breaking RSA and Factoring Integers}
Nikita's public key is $(n,e)$.
If we compute the factorization of $n=pq$, then we can compute
$\vphi(n)$ and hence deduce her secret decoder number~$d$.

\noindent{\em It is no easier to $\vphi(n)$ than to factor~$n$:}\\
Suppose $n=pq$.  Given $\vphi(n)$, it is very easy to
compute $p$ and $q$.  We have 
$$
  \vphi(n) = (p-1)(q-1) = pq-(p+q)+1,
$$
so we know $pq=n$ and $p+q = n+1 - \vphi(n)$.
Thus we know the polynomial 
$$
   x^2 - (p+q)x + pq = (x-p)(x-q)
$$
whose roots are~$p$ and~$q$.


There is also a more complicated ``probabilistic algorithm'' to
find~$p$ and~$q$ given the secret decoding number~$d$.  I might
describe it in the next lecture.

%\hd{A Moral:} {\em The RSA system relies primarily on the difficulty
%of factoring integers.  Diffie-Hellman relies primarily on the
%difficulty of computing discrete logarithms.}





\section{Attacking RSA}



Nikita's public key is $(n,e)$.  If we compute the factorization of
$n=pq$, then we can compute $\vphi(n)$ and hence deduce her secret
decoding number~$d$.  Thus attempting to factor~$n$ is a way to try to
break an RSA public-key cryptosystem. In this lecture we consider
several approaches to ``cracking'' RSA, and relate them to the
difficulty of factoring~$n$.

\subsection{Factoring $n$ Given $\vphi(n)$}\label{sec:phin}

\hd{If you know $\vphi(n)$ then it is easy to factor~$n$:}\\
Suppose $n=pq$.  Given $\vphi(n)$, it is very easy to
compute $p$ and $q$.  We have 
$$
  \vphi(n) = (p-1)(q-1) = pq-(p+q)+1,
$$
so we know both $pq=n$ and $p+q = n+1 - \vphi(n)$.
Thus we know the polynomial 
$$
   x^2 - (p+q)x + pq = (x-p)(x-q)
$$
whose roots are~$p$ and~$q$.
These roots can be found using the quadratic formula.
\begin{example}\mbox{}\vspace{-5ex}\\
\begin{verbatim}
? n=nextprime(random(10^10))*nextprime(random(10^10));
? phin=eulerphi(n);
? f = x^2 - (n+1-phin)*x + n
%6 = x^2 - 12422732288*x + 31615577110997599711
? polroots(f)
%7 = [3572144239, 8850588049]
? n
%8 = 31615577110997599711
? 3572144239*8850588049
%9 = 31615577110997599711
\end{verbatim}
\end{example}



\subsection{When~$p$ and~$q$ Are Close}
Suppose that~$p$ and~$q$ are ``close'' to each other.  Then
it is easy to factor~$n$ using a factorization
method of Fermat.

Suppose $n=pq$ with $p>q$, say.  Then
$$n = \left(\frac{p+q}{2}\right)^2 -
      \left(\frac{p-q}{2}\right)^2.$$
Since $p$ and $q$ are ``close'',
$$
  s = \frac{p-q}{2}
$$
is small,
$$
  t = \frac{p+q}{2}
$$
is only slightly larger than $\sqrt{n}$, 
and $t^2-n=s^2$ is a perfect square.
So we just try 
$$
  t = \text{ceil}(\sqrt{n}), \quad t=\text{ceil}(\sqrt{n})+1, 
      \quad t=\text{ceil}(\sqrt{n})+2, \ldots
$$
until $t^2-n$ is a perfect square $s^2$.
Then 
$$
   p = t+s,\qquad q=t-s.
$$
\begin{example}
Suppose $n=23360947609$.
Then 
$$\sqrt{n} = 152842.88\ldots.$$

If $t=152843$, then $\sqrt{t^2-n} = 187.18\ldots$.

If $t=152844$, then $\sqrt{t^2-n} = 583.71\ldots$.

If $t=152845$, then $\sqrt{t^2-n} = 804\in\Z$.

Thus $s=804$.  We find that $p=t+s=153649$ and $q=t-s=152041$.
\end{example}

\comment{\begin{verbatim}
? n=23360947609
%1 = 23360947609
? sqrt(n)
%2 = 152842.8853725288712694157797
? x=%2
%3 = 152842.8853725288712694157797
? floor(x+1)
%4 = 152843
? t=floor(x+1)
%5 = 152843
? t^2-n
%6 = 35040
? sqrt(t^2-n)
%7 = 187.1897433087614445431082470
? t++
%8 = 152844
? sqrt(t^2-n)
%9 = 583.7182539547654063924081356
? t++
%10 = 152845
? sqrt(t^2-n)
%11 = 804.0000000000000000000000000
? s=804
%12 = 804
? p=t+s
%13 = 153649
? q=t-s
%14 = 152041
? p*q
%15 = 23360947609
? n
%16 = 23360947609
? factor(n)
%17 =
[152041 1]
[153649 1]
\end{verbatim}
\end{example}
}

Here is a bigger example in PARI:
\begin{verbatim}
? q=nextprime(random(10^50))
%20 = 78177096444230804504075122792410749354743712880803
? p=nextprime(q+1)  \\ a nearby prime
%21 = 78177096444230804504075122792410749354743712880899
? n=p*q
%22 = 6111658408450564697085634201845976850509908580949986889525704...
      ...259650342157399279163289651693722481897
? t=floor(sqrt(n))+1
  ***   precision loss in truncation
? \p150        \\ set precision of floating-point computations.
   realprecision = 154 significant digits (150 digits displayed)
? t=floor(sqrt(n))+1
%29 = 78177096444230804504075122792410749354743712880851
? sqrt(t^2-n)
%30 = 48.000000000000000000000000000000000000000000000000000000....
? s=48
%31 = 48
? t + s     \\ p
%33 = 78177096444230804504075122792410749354743712880899
? t - s     \\ q
%35 = 78177096444230804504075122792410749354743712880803
\end{verbatim}

\subsection{Factoring~$n$ Given~$d$}
Suppose that we crack an RSA cryptosystem by 
finding a~$d$ such that
$$
  a^{ed} \con a\pmod{n}
$$
for all~$a$.  Then we've found an~$m$ ($=ed-1$) such that
$a^m\con 1\pmod{n}$ for all~$a$ with $\gcd(a,n)=1$.
Knowing~$a$ does not lead to a factorization of~$n$
in as direct a manner as knowing $\vphi(n)$ does (see
Section~\ref{sec:phin}).  However, there is a probabilistic
procedure that, given an~$m$ such that $a^m\con 1\pmod{n}$, 
will with high probability find a factorization of~$n$.

\hd{Probabilistic procedure to factor~$n$:}
\begin{enumerate}
\item $m$ is even since $(-1)^m\con 1\pmod{n}$.
\item If $a^{m/2}\con 1\pmod{n}$ for all~$a$ coprime to $n$,
replace~$m$ by $m/2$.  In practice, it is not possible to determine
whether or not this condition holds, because it would require doing a
computation for too many~$a$.  Instead, we try a few random~$a$; if
$a^{m/2}\con 1\pmod{n}$ for the~$a$ we check, then we divide~$m$
by~$2$.  (If there exists even a single~$a$ such that $a^{m/2}\not\con
1\pmod{n}$, then at least half the~$a$ have this property.)

Keep repeating this step until we find an~$a$ such that
$a^{m/2}\not\con 1\pmod{n}$.

\item There is a 50\% chance that a randomly chosen~$a$
will have the property that 
$$a^{m/2}\con+1\pmod{p},\qquad
 a^{m/2}\con -1\pmod{q}$$
or
$$a^{m/2}\con -1\pmod{p},\qquad
 a^{m/2}\con +1\pmod{q}.$$
If the first case occurs, then
$$p\mid a^{m/2}-1, \qquad \text{ but } 
  q\nmid a^{m/2}-1,$$
so
$$
   \gcd(a^{m/2}-1,pq) = p,
$$
and we have factored~$n$.
Just keep trying~$a$'s until one of the cases occurs.
\end{enumerate}


\begin{verbatim}
? \r rsa   \\ load the file rsa.gp, available at Lecture 9 web page.
? rsa = make_rsa_key(10)
%34 = [32295194023343, 29468811804857, 11127763319273]
? n = rsa[1]; e = rsa[2]; d = rsa[3];
? m = e*d-1
%38 = 327921963064646896263108960
? for(a=2,20, if(Mod(a,n)^m!=1,print(a)))   \\ prints nothing...
? m = m/2
%39 = 163960981532323448131554480
? for(a=2,20, if(Mod(a,n)^m!=1,print(a)))
? m = m/2
%40 = 81980490766161724065777240
? for(a=2,20, if(Mod(a,n)^m!=1,print(a)))
? m = m/2
%41 = 40990245383080862032888620
? for(a=2,20, if(Mod(a,n)^m!=1,print(a)))
? m = m/2
%42 = 20495122691540431016444310
? for(a=2,20,if(Mod(a,n)^m!=1,print(a)))
2
5
6
... etc.
? gcd(2^m,n)
  ***   power overflow in pow_monome.
? x = lift(Mod(2,n)^m)-1
%43 = 4015382800098
? gcd(x,n)
%46 = 737531
? p = gcd(x,n)
%53 = 737531
? q = n/p
? p*q
%54 = 32295194023343
? n
%55 = 32295194023343
\end{verbatim}

\subsection{RSA Challenge $n$}
The easiest challenge at
\begin{verbatim}
  http://www.rsasecurity.com/rsalabs/challenges/factoring/numbers.html
\end{verbatim}
is the 576-bit number
\begin{verbatim}
Name:         RSA-576
Prize:        Ten Thousand Dollars
Digits:       174
Digit Sum:    785
188198812920607963838697239461650439807163563379417382700763356422988859
715234665485319060606504743045317388011303396716199692321205734031879550
656996221305168759307650257059
\end{verbatim}


\begin{exercises}
\item\label{ex:crypto1}  You and Nikita wish to agree on a secret key using
the Diffie-Hellman protocol.  Nikita announces that $p=3793$ and
$g=7$.  Nikita secretely chooses a number~$n<p$ and tells you
that $g^n\con 454\pmod{p}$.  You choose the random number 
$m=1208$.  Find the secret key!

\item\label{ex:crypto2}  This problem concerns encoding phrases 
using numbers using the encoding of Section~\ref{}.
\begin{enumerate}
\item Find the number that corresponds to 
\verb*|VE RI TAS|.
(Note that the left-most ``digit'', \verb*|V|, is the
least significant digit, and \verb*| | denotes a blank space.)
\item What is the longest arbitrary sequence of letters (and space) 
that can be stored using a number that is less than $10^{20}$?
\end{enumerate}

\item\label{ex:crypto3} You see Michael and
Nikita agree on a secret key using the Diffie-Hellman key exchange
protocol.  Michael and Nikita choose $p=97$ and $g=5$.  Nikita chooses
a random number~$n$ and tells Michael that $g^n\con 3\pmod{97}$, and
Michael chooses a random number~$m$ and tells Nikita that $g^m\con
7\pmod{97}$.  Crack their code: What is the secret key that Nikita and
Michael agree upon?  What is~$n$?  What is~$m$?

\item\label{ex:crypto4} 
Using the RSA public key is $(n,e) = (441484567519, 238402465195)$,
encrypt the current year.

\item\label{ex:crypto5}  
In this problem, you will ``crack'' an RSA cryptosystem.
\begin{enumerate}
\item What is the secret decoding number~$d$ for the RSA 
cryptosystem with public key $(n,e) = (5352381469067, 4240501142039)$?
\item The number $3539014000459$ encrypts an important question using 
the RSA cryptosystem from part (a).  What is the question?  (After decoding,
you'll get a number.  To find the corresponding word, see Section~2 of
Lecture~9.)
\end{enumerate}

\item \label{ex:crypto6}
Suppose Michael creates an RSA cryptosystem with a very large 
modulus~$N$ for which the factorization of~$N$ cannot be found 
in a reasonable amount of time. Suppose that Nikita sends  
messages to Michael by representing each alphabetic character 
as an integer between~$0$ and~$26$ (\verb*|A| corresponds 
to $1$, \verb*|B| to~$2$, etc., and a space \verb*| | to~$0$), 
then encrypts each number {\em separately} 
using Michael's RSA cryptosystem.  Is this method secure? 
Explain your answer.

\item \label{ex:crypto7}
Nikita creates an RSA cryptosystem with public key
$$(n,e)=(1433811615146881, 329222149569169).$$ 
In the following two problems, show the steps you take. 
Don't simply factor~$n$ directly using the {\tt factor} 
function in PARI.
\begin{enumerate}
\item 
Somehow you discover that $d=116439879930113$.  Show how to use the
probabilistic algorithm of Lecture~10 to use~$d$ to factor~$n$.
\item 
In part (a) you found that the factors~$p$ and~$q$ of~$n$ are very close.
Show how to use the ``Fermat Factorization''
 method of Lecture~10 to factor~$n$.
\end{enumerate}


\item \label{ex:crypto8} 
Nikita and Michael decide to agree on a secret encryption
key using the Diffie-Hellman key exchange protocol.  You observe
the following: 
\begin{enumerate}
\item Nikita chooses $p=13$ for the modulus and $g=2$ as generator.  
\item Nikita sends $6$ to Michael.
\item Michael sends $11$ to Nikita.
\end{enumerate}
What is the secret key?

\item \label{ex:crypto9}
Consider the RSA public-key cryptosystem defined by
$(n,e) = (77,7)$.
\begin{enumerate}
\item Encrypt the number~$4$ using this cryptosystem.
\item Find an integer~$d$ such that $ed\con 1\pmod{\vphi(n)}$.
\end{enumerate}

\end{exercises}