An Introduction To Mathematical Cryptography Answers

Solutions Manual

User Manual: Pdf

Open the PDF directly: View PDF .
Page Count: 223

An Introduction to Mathematical Cryptography Solution Manual Jeffrey Hoffstein, Jill Pipher, Joseph H. Silverman c °2008 by J. Hoffstein, J. Pipher, J.H. Silverman July 31, 2008  Chapter 1  An Introduction to Cryptography Exercises for Chapter 1 Section. Simple substitution ciphers 1.1. Build a cipher wheel as illustrated in Figure 1.1, but with an inner wheel that rotates, and use it to complete the following tasks. (For your convenience, there is a cipher wheel that you can print and cut out at www.math.brown. edu/~jhs/MathCrypto/CipherWheel.pdf.) (a) Encrypt the following plaintext using a rotation of 11 clockwise. "A page of history is worth a volume of logic." (b) Decrypt the following message, which was encrypted with a rotation of 7 clockwise. AOLYLHYLUVZLJYLAZILAALYAOHUAOLZLJYLALZAOHALCLYFIVKFNBLZZLZ (c) Decrypt the following message, which was encrypted by rotating 1 clockwise for the first letter, then 2 clockwise for the second letter, etc. XJHRFTNZHMZGAHIUETXZJNBWNUTRHEPOMDNBJMAUGORFAOIZOCC Solution to Exercise 1.1. apageofhistoryisworthavolumeoflogic (a) LALRPZQSTDEZCJTDHZCESLGZWFXPZQWZRTN This quote is in a court decision of Oliver Wendell Holmes, Jr. (1921). therearenosecretsbetterthanthesecretsthateverybodyguesses (b) AOLYLHYLUVZLJYLAZILAALYAOHUAOLZLJYLAZAOHALCLYFIVKFNBLZZLZ There are no secrets better than the secrets that everybody guesses. This quote is due to George Bernard Shaw, Mrs. Warren's Profession (1893) 1  2 (c)  Exercises for Chapter 1 whenangrycounttenbeforeyouspeakifveryangryanhundred XJHRFTNZHMZGAHIUETXZJNBWNUTRHEPOMDNBJMAUGORFAOIZOCC When angry, count ten before you speak; if very angry, an hundred.  This quote is due to Thomas Jefferson, A Decalogue of Canons. . . (1825). 1.2. Decrypt each of the following Caesar encryptions by trying the various possible shifts until you obtain readable text. (a) LWKLQNWKDWLVKDOOQHYHUVHHDELOOERDUGORYHOBDVDWUHH (b) UXENRBWXCUXENFQRLQJUCNABFQNWRCJUCNAJCRXWORWMB (c) BGUTBMBGZTFHNLXMKTIPBMAVAXXLXTEPTRLEXTOXKHHFYHKMAXFHNLX Solution to Exercise 1.2. ithinkthatishallneverseeabillboardlovelyasatree (a) LWKLQNWKDWLVKDOOQHYHUVHHDELOOERDUGORYHOBDVDWUHH I think that I shall never see, a billboard lovely as a tree. This quote is due to Ogden Nash, Many Long Years Ago (1945), Song of the Open Road. loveisnotlovewhichalterswhenitalterationfinds (b) UXENRBWXCUXENFQRLQJUCNABFQNWRCJUCNAJCRXWORWMB Love is not love which alters when it alteration finds. This quote is due to William Shakespeare, Sonnet 116. inbaitingamousetrapwithcheesealwaysleaveroomforthemouse (c) BGUTBMBGZTFHNLXMKTIPBMAVAXXLXTEPTRLEXTOXKHHFYHKMAXFHNLX In baiting a mousetrap with cheese, always leave room for the mouse. This quote is due to H.H. Munro (Saki), The Square Egg (1924). 1.3. For this exercise, use the simple substitution table given in Table 1.11. (a) Encrypt the plaintext message The gold is hidden in the garden. (b) Make a decryption table, that is, make a table in which the ciphertext alphabet is in order from A to Z and the plaintext alphabet is mixed up. (c) Use your decryption table from (b) to decrypt the following message. IBXLX JVXIZ SLLDE VAQLL DEVAU QLB Solution to Exercise 1.3. (a)  Exercises for Chapter 1  3  a b c d e f g h i j k l m n o p q r s t u v w x y z S C J A X U F B Q K T P R W E Z H V L I G Y D N M O  Table 1.1: Simple substitution encryption table for exercise 1.3  t h e g o l d i s h i d d e n i n t h e g a r d e n I B X F E P A Q L B Q A A X W Q W I B X F S V A X W Breaking it into five letter blocks gives the ciphertext IBXFE PAQLB QAAXW QWIBX FSVAX W (b) d h b w o g u q t c j s y x z l i m a k f r n e v p A B C D E F G H I J K L M N O P Q R S T U V W X Y Z (c) t h e s e c r e t p a s s w o r d i s s w o r d f i s h I B X L X J V X I Z S L L D E V A Q L L D E V A U Q L B Putting in word breaks gives the plaintext The secret password is swordfish.  1.4. Each of the following messages has been encrypted using a simple substitution cipher. Decrypt them. For your convenience, we have given you a frequency table and a list of the most common bigrams that appear in the ciphertext. (If you do not want to recopy the ciphertexts by hand, they can be downloaded or printed from the web site listed in the preface.) (a) "A Piratical Treasure" JNRZR BNIGI BJRGZ IZLQR OTDNJ GRIHT USDKR ZZWLG OIBTM NRGJN IJTZJ LZISJ NRSBL QVRSI ORIQT QDEKJ JNRQW GLOFN IJTZX QLFQL WBIMJ ITQXT HHTBL KUHQL JZKMM LZRNT OBIMI EURLW BLQZJ GKBJT QDIQS LWJNR OLGRI EZJGK ZRBGS MJLDG IMNZT OIHRK MOSOT QHIJL QBRJN IJJNT ZFIZL WIZTO MURZM RBTRZ ZKBNN LFRVR GIZFL KUHIM MRIGJ LJNRB GKHRT QJRUU RBJLW JNRZI TULGI EZLUK JRUST QZLUK EURFT JNLKJ JNRXR S The ciphertext contains 316 letters. Here is a frequency table: R J I L Z T N Q B G K U M O S H W F E D X V Freq 33 30 27 25 24 20 19 16 15 15 13 12 12 10 9 8 7 6 5 5 3 2  4  Exercises for Chapter 1  The most frequent bigrams are: JN (11 times), NR (8 times), TQ (6 times), and LW, RB, RZ, and JL (5 times each). (b) "A Botanical Code" KZRNK GJKIP ZBOOB XLCRG BXFAU GJBNG RIXRU XAFGJ BXRME MNKNG BURIX KJRXR SBUER ISATB UIBNN RTBUM NBIGK EBIGR OCUBR GLUBN JBGRL SJGLN GJBOR ISLRS BAFFO AZBUN RFAUS AGGBI NGLXM IAZRX RMNVL GEANG CJRUE KISRM BOOAZ GLOKW FAUKI NGRIC BEBRI NJAWB OBNNO ATBZJ KOBRC JKIRR NGBUE BRINK XKBAF QBROA LNMRG MALUF BBG The ciphertext contains 253 letters. Here is a frequency table: B R G N A I U K O J L X M F S E Z C T W P V Q Freq 32 28 22 20 16 16 14 13 12 11 10 10 8 8 7 7 6 5 3 2 1 1 1 The most frequent bigrams are: NG and RI (7 times each), BU (6 times), and BR (5 times). (c) In order to make this one a bit more challenging, we have removed all occurrences of the word "the" from the plaintext. "A Brilliant Detective" GSZES GNUBE SZGUG SNKGX CSUUE QNZOQ EOVJN VXKNG XGAHS AWSZZ BOVUE SIXCQ NQESX NGEUG AHZQA QHNSP CIPQA OIDLV JXGAK CGJCG SASUB FVQAV CIAWN VWOVP SNSXV JGPCV NODIX GJQAE VOOXC SXXCG OGOVA XGNVU BAVKX QZVQD LVJXQ EXCQO VKCQG AMVAX VWXCG OOBOX VZCSO SPPSN VAXUB DVVAX QJQAJ VSUXC SXXCV OVJCS NSJXV NOJQA MVBSZ VOOSH VSAWX QHGMV GWVSX CSXXC VBSNV ZVNVN SAWQZ ORVXJ CVOQE JCGUW NVA The ciphertext contains 313 letters. Here is a frequency table: V S X G A O Q C N J U Z E W B P I H K D M L R F Freq 39 29 29 22 21 21 20 20 19 13 11 11 10 8 8 6 5 5 5 4 3 2 1 1 The most frequent bigrams are: XC (10 times), NV (7 times), and CS, OV, QA, and SX (6 times each). Solution to Exercise 1.4. (a) The message was encrypted using the table: a b c d e f g h i j k l m n o p q r s t u v w x y z I E B H R W D N T P X U O Q L M A G Z J K V F C S Y The plaintext reads: "These characters, as one might readily guess, form a cipher—that is to say, they convey a meaning; but then, from what is known of Captain Kidd, I could not suppose him capable of constructing any of the more abstruse cryptographs. I made up my mind, at once, that this was of a simple species— such, however, as would appear, to the crude intellect of the sailor, absolutely insoluble without the key." (The Gold-Bug, 1843, Edgar Allan Poe) (b) The message was encrypted using the table:  Exercises for Chapter 1  5  a b c d e f g h i j k l m n o p q r s t u v w x y z R V C X B F S J K Q P O E I A W D U N G L T Z Y M H The plaintext reads: "I was, I think, well educated for the standard of the day. My sister and I had a German governess. A very sentimental creature. She taught us the language of flowers—a forgotten study nowadays, but most charming. A yellow tulip, for instance, means Hopeless Love, while a China Aster means I die of Jealousy at your feet." (The Four Suspects, 1933, Agatha Christie) (c) The message was encrypted using the table: a b c d e f g h i j k l m n o p q r s t u v w x y z S D J W V E H C G L R U Z A Q P T N O X I M K Y B F The plaintext reads (all occurrences of the word "the" were omitted from the text before encryption): I am fairly familiar with all forms of secret writing, and am myself (the) author of a trifling monograph upon (the) subject, in which I analyze one hundred separate ciphers, but I confess that this is entirely new to me. (The) object of those who invented this system has apparently been to conceal that these characters convey a message, and to give (the) idea that they are (the) mere random sketches of children. (The Adventure of the Dancing Men, 1903, Sir Arthur Conan Doyle) 1.5. Suppose that you have an alphabet of 26 letters. (a) How many possible simple substitution ciphers are there? (b) A letter in the alphabet is said to be fixed if the encryption of the letter is the letter itself. How many simple substitution ciphers are there that leave: (i) no letters fixed? (ii) at least one letter fixed? (iii) exactly one letter fixed? (iv) at least two letters fixed? (Part (b) is quite challenging! You might try doing the problem first with an alphabet of four or five letters to get an idea of what is going on.) Solution to Exercise 1.5. (a) We can assign A to any of 26 letters, then B to any of the remaining 25 letters, etc. So there are 26! = 403291461126605635584000000 different simple substitution ciphers. (b) Let S(n, k) denote the number of permutations of n¡ elements that fix at ¢ least k elements. You might guess that since there are nk ways to choose k elements to fix and (n − k)! permutations of the remaining n − k elements, µ ¶ n S(n, k) = (n − k)! ←− Incorrect Formula. (1.1) k  6  Exercises for Chapter 1  But this overcounts because any permutation fixing more than n − k elements will be counted multiple times. We can, however, get a useful formula out of this mistake by modifying it somewhat. If we let R(n, k) denote the number of permutations of n elements that fix exactly k elements, and !(n−k) (the subfactorial of (n − k)) denote the number of permutations of n − k elements that fix no elements (such permutations are called derangements), then the following equation holds: µ ¶ n R(n, k) = !(n − k). (1.2) k How can we compute !n? One way would be to consider cycle decompositions of permutations of n elements, since any derangement of n elements decomposes into a disjoint union of cycles, with the size of the cycles summing to n. This, however, is only feasible for relatively small n. It would also be possible to formulate a recurrence relation, but a method following that tack would take several steps. We'll instead use the following fact: !n = n! − #{permutations that fix at least 1 element}.  (1.3)  Now if we notice that #{permutations that fix at least 1 element} = #{permutations that fix element 1} ∪{permutations that fix element 2} ∪ · · · ∪ {permutations that fix element n}  (1.4)  and use an analogue of the following formula in probability (often called the inclusion–exclusion principle): P (E1 ∪ E2 ∪ · · · ∪ En ) =  n X  P (Ei ) +  i=1  +(−1)r+1  X  P (Ei1 ∩ Ei2 ) + . . .  i1                      0. Modify your program so that it returns a solution with u > 0 and u as small as possible. [Hint. If (u, v) is a solution, then so is (u + b/g, v − a/g).] Redo (c) using your modified program. Solution to Exercise 1.12. (a) A solution for this exercise is not currently available. (b) A solution for this exercise will not be provided. (c) and (e): (i) 527 · 43 − 1258 · 18 = 17 (ii) 228 · 51 − 1056 · 11 = 12 (iii) 163961 · 4517 − 167181 · 4430 = 7  Exercises for Chapter 1  13  (iv) 3892394 · 59789 − 239847 · 970295 = 1 (d) If b = 0, then there is a "division by zero" error in step 2. So the program should check if b = 0, if in that case it should return (a, 1, 0). 1.13. Let a1 , a2 , . . . , ak be integers with gcd(a1 , a2 , . . . , ak ) = 1, i.e., the largest positive integer dividing all of a1 , . . . , ak is 1. Prove that the equation a1 u1 + a2 u2 + · · · + ak uk = 1 has a solution in integers u1 , u2 , . . . , uk . (Hint. Repeatedly apply the extended Euclidean algorithm, Theorem 1.11. You may find it easier to prove a more general statement in which gcd(a1 , . . . , ak ) is allowed to be larger than 1.) Solution to Exercise 1.13. We prove more generally that for any integers a1 , . . . , ak (not all zero), there is a solution to a1 u1 + a2 u2 + · · · + ak uk = gcd(a1 , . . . , ak ). We give the proof using induction on k. If k = 1 there is nothing to prove, since a1 · 1 = gcd(a1 ). For k = 2, this is already proven in the extended Euclidean algorithm. So assume now that we know the result for fewer than k integers, where k ≥ 3, and we want to prove it for k integers. By the induction hypothesis, we can find a solution to a1 u1 + a2 u2 + · · · + ak−1 uk−1 = gcd(a1 , . . . , ak−1 ). To ease notation, we let b = gcd(a1 , . . . , ak−1 ). We apply the extended Euclidean algorithm to the two numbers b and ak , which gives us a solution to bv + ak w = gcd(b, ak ). Multiplying the earlier equation by v and subtituting this equation gives a1 u1 v + a2 u2 v + · · · + ak−1 uk−1 v = gcd(a1 , . . . , ak−1 )v = bv by definition of b, = −ak w + gcd(b, ak ). Hence a1 u1 v + a2 u2 v + · · · + ak−1 uk−1 v + ak w = gcd(b, ak ). This completes the proof, since from the definition of gcd as the largest integer dividing all of the listed integers, it's clear that ¡ ¢ gcd(b, ak ) = gcd gcd(a1 , . . . , ak−1 ), ak = gcd(a1 , . . . , ak−1 , ak ).  Section. Modular arithmetic  14  Exercises for Chapter 1  1.14. Let m ≥ 1 be an integer and suppose that a1 ≡ a2 (mod m)  and  b1 ≡ b2 (mod m).  Prove that a1 ± b1 ≡ a2 ± b2 (mod m)  and  a1 · b1 ≡ a2 · b2 (mod m).  (This is Proposition 1.13(a).) Solution to Exercise 1.14. 1.15. Write out the following tables for Z/mZ and (Z/mZ)∗ , as we did in Figures 1.4 and 1.5. (a) Make addition and multiplication tables for Z/3Z. (b) Make addition and multiplication tables for Z/6Z. (c) Make a multiplication table for the unit group (Z/9Z)∗ . (d) Make a multiplication table for the unit group (Z/16Z)∗ . Solution to Exercise 1.15.  (a)  (b)  + 0 1 2 3 4 5  0 0 1 2 3 4 5  1 1 2 3 4 5 0  + 0 1 2  0 0 1 2  1 1 2 0  2 2 0 1  · 0 1 2  0 0 0 0  1 0 1 2  2 0 2 1  2 2 3 4 5 0 1  3 3 4 5 0 1 2  4 4 5 0 1 2 3  5 5 0 1 2 3 4  · 0 1 2 3 4 5  0 0 0 0 0 0 0  1 0 1 2 3 4 5  2 0 2 4 0 2 4  · 1 2 4 5 7 8  1 1 2 4 5 7 8  2 2 4 8 1 5 7  (c)  4 4 8 7 2 1 5  5 5 1 2 7 8 4  7 7 5 1 8 4 2  8 8 7 5 4 2 1  3 0 3 0 3 0 3  4 0 4 2 0 4 2  5 0 5 4 3 2 1  Exercises for Chapter 1 · 1 3 5 7 9 11 13 15  (d)  1 1 3 5 7 9 11 13 15  15 3 3 9 15 5 11 1 7 13  5 5 15 9 3 13 7 1 11  7 7 5 3 1 15 13 11 9  9 9 11 13 15 1 3 5 7  11 11 1 7 13 3 9 15 5  13 13 7 1 11 5 15 9 3  15 15 13 11 9 7 5 3 1  1.16. Do the following modular computations. In each case, fill in the box with an integer between 0 and m − 1, where m is the modulus. (a) 347 + 513 ≡ (mod 763). (b) 3274 + 1238 + 7231 + 6437 ≡ (c) 153 · 287 ≡  (mod 9254).  (mod 353).  (d) 357 · 862 · 193 ≡  (mod 943).  (e) 5327 · 6135 · 7139 · 2187 · 5219 · 1873 ≡ (mod 8157). (Hint. After each multiplication, reduce modulo 8157 before doing the next multiplication.) (f) 1372 ≡ (mod 327). (g) 3736 ≡ 3  (mod 581). 5  4  (h) 23 · 19 · 11 ≡  (mod 97).  Solution to Exercise 1.16. 97 (mod 763). (a) 347 + 513 ≡ (b) 3274 + 1238 + 7231 + 6437 ≡ 8926 (mod 9254). (c) 153 · 287 ≡ 139 (mod 353). (d) 357 · 862 · 193 ≡ 636 (mod 943). (e) 5327 · 6135 · 7139 · 2187 · 5219 · 1873 ≡ 603 (mod 8157). 2 (f) 137 ≡ 130 (mod 327). (g) 3736 ≡ 463 (mod 581). 3 5 4 (h) 23 · 19 · 11 ≡ 93 (mod 97). 1.17. Find all values of x between 0 and m − 1 that are solutions of the following congruences. (Hint. If you can't figure out a clever way to find the solution(s), you can just substitute each value x = 1, x = 2,. . . , x = m − 1 and see which ones work.) (a) x + 17 ≡ 23 (mod 37). (b) x + 42 ≡ 19 (mod 51). (c) x2 ≡ 3 (mod 11). (d) x2 ≡ 2 (mod 13). (e) x2 ≡ 1 (mod 8).  16  Exercises for Chapter 1  (f) x3 − x2 + 2x − 2 ≡ 0 (mod 11). (g) x ≡ 1 (mod 5) and also x ≡ 2 (mod 7). (Find all solutions modulo 35, that is, find the solutions satisfying 0 ≤ x ≤ 34.) Solution to Exercise 1.17. (a) x ≡ 23 − 17 ≡ 6 (mod 37). (b) x ≡ 19 − 42 ≡ −23 ≡ 28 (mod 51). (c) The squares modulo 11 are 02 ≡ 0, 12 ≡ 1, 22 ≡ 4, 32 ≡ 9, 42 ≡ 16 ≡ 5, etc. The full list is {0, 1, 4, 9, 5, 3, 3, 5, 9, 4, 1}. Thus 52 ≡ 2 (mod 11) and 62 ≡ 2 (mod 11), so there are two solutions, x = 5 and x = 6 . (d) The squares modulo 13 are {0, 1, 4, 9, 3, 12, 10, 10, 12, 3, 9, 4, 1}. Thus x2 ≡ 2 (mod 13) has no solutions . (e) The solutions to x2 ≡ 1 (mod 8) are x = 1, x = 3, x = 5 and x = 7 . (f) Plugging x = 0, 1, 2, . . . , 10 into x3 − x2 + 2x − 2 and reducing modulo 11, we find the three solutions x = 1, x = 3, and x = 8 . (g) One method is to try all values x = 0, 1, 2, . . . , 34. A faster method is to list the solutions to x ≡ 1 (mod 5), namely 1, 6, 11, 16, 21, 26, 31, . . . and reduce them modulo 7 to see which ones are congruent to 2 modulo 7. Thus working modulo 7, 1 ≡ 1,  6 ≡ 6,  11 ≡ 4,  16 ≡ 2,  21 ≡ 0,  26 ≡ 5,  31 ≡ 3.  Thus the solution is x = 16 . 1.18. Suppose that g a ≡ 1 (mod m) and that g b ≡ 1 (mod m). Prove that g gcd(a,b) ≡ 1  (mod m).  Solution to Exercise 1.18. The extended Euclidean algorithm says that there are integers u and v satisfying au + bv = gcd(a, b). Then g gcd(a,b) ≡ g au+bv ≡ (g a )u · (g b )v ≡ 1u · 1v ≡ 1 (mod p).  1.19. Prove that if a1 and a2 are units modulo m, then a1 a2 is a unit modulo m. Solution to Exercise 1.19. By definition of unit, there are numbers b1 and b2 so that a1 b1 ≡ 1 (mod m)  and a2 b2 ≡ 1 (mod m).  Then (a1 a2 )(b1 b2 ) ≡ (a1 b1 )(a2 b2 ) ≡ 1 · 1 ≡ 1 (mod m), so a1 a2 is a unit. Its inverse is b1 b2 .  Exercises for Chapter 1  17  1.20. Prove that m is prime if and only if φ(m) = m − 1, where φ is Euler's phi function. Solution to Exercise 1.20. Suppose first that m is prime. Let k be any number between 1 and m − 1 and let d = gcd(k, m). Then d | m, so the fact that m is prime tells us that either d = 1 or d = m. But also d | k and 1 ≤ k < m, so we have d < m. Hence d = 1. This proves that every number k between 1 and m − 1 satisfies gcd(k, m) = 1. Hence © ª φ(m) = # 1 ≤ k < m : gcd(k, m) = 1 = #{1, 2, 3, . . . , m − 1} = m − 1. Next suppose that φ(m) = m − 1. This means that every number k between 1 and m − 1 satisfies gcd(k, m) = 1. Suppose that d divides m and that d 6= m. Then 1 ≤ d ≤ m − 1, so gcd(d, m) = 1. But the fact that d divides m implies that gcd(d, m) = d. Hence d = 1. This proves that the only divisors of m are 1 and m, so m is prime. 1.21. Let m ∈ Z. (a) Suppose that m is odd. What integer between 1 and m − 1 equals 2−1 mod m? (b) More generally, suppose that m ≡ 1 (mod b). What integer between 1 and m − 1 is equal to b−1 mod m? Solution to Exercise 1.21. (a) The fact that m is odd means that 2·  m+1 2  is an integer, and clearly  m+1 = m + 1 ≡ 1 (mod m). 2  (b) The assumption that m ≡ 1 (mod b) means that m−1 is an integer, so b we have m−1 b· = m − 1 ≡ −1 (mod m). b This is almost what we want, so multiply by −1 to get b·  1−m = 1 − m ≡ 1 (mod m). b  Unfortunately, 1−m is negative, but we can add on multiples of m without b 1+(b−1)m changing its value modulo m. Thus 1−m is an integer and b +m= b b·  1 + (b − 1)m = 1 + (b − 1)m ≡ 1 b  Hence b−1 mod m is equal to  1+(b−1)m b  (mod m).  .  1.22. Let m be an odd integer and let a be any integer. Prove that 2m + a2 can never be a perfect square. (Hint. If a number is a perfect square, what are its possible values modulo 4?)  18  Exercises for Chapter 1  Solution to Exercise 1.22. Any number squared is either 0 or 1 modulo 4. But ( 2 + 0 ≡ 2 if a is even, 2 2 2m + a ≡ 2 + a ≡ 2 + 1 ≡ 3 if a is odd. Thus 2m + a2 is either 2 or 3 modulo 4, so it can never be a perfect square. 1.23. (a) Find a single value x that simultaneously solves the two congruences x≡3  (mod 7)  and  x ≡ 4 (mod 9).  (Hint. Note that every solution of the first congruence looks like x = 3+7y for some y. Substitute this into the second congruence and solve for y; then use that to get x.) (b) Find a single value x that simultaneously solves the two congruences x ≡ 13  (mod 71)  and  x ≡ 41 (mod 97).  (c) Find a single value x that simultaneously solves the three congruences x≡4  (mod 7),  x ≡ 5 (mod 8),  and  x ≡ 11 (mod 15).  (d) Prove that if gcd(m, n) = 1, then the pair of congruences x≡a  (mod m)  and  x ≡ b (mod n)  has a solution for any choice of a and b. Also give an example to show that the condition gcd(m, n) = 1 is necessary. Solution to Exercise 1.23. (a) x = 31 (b) x = 5764 (c) x = 221 (d) The solutions to the first congruence look like x = a + my for any integer y. Substituting into the second congruence yields a + my ≡ b (mod n), so we want to find a value of z such that a + my − b = nz. In other words, we need integers y and z satisfying my − nz = b − a. We are given that gcd(m, n) = 1, so we can find integers u and v satisfying mu + nv = 1. Multiplying this by b − a gives mu(b − a) + nv(b − a) = b − a,  Exercises for Chapter 1  19  so we can take y = u(b − a) and z = v(b − a). Then we have x = a + my = a + mu(b − a). To summarize, we first solve mu + nv = 1 and then we take x = a + mu(b − a) = a + (1 − nv)(b − a) = b + nv(b − a). The two expressions for x show that x ≡ a (mod m) and x ≡ v (mod n). This exercise is a special case of the Chinese remainder theorem, which is covered in Chapter 2. 1.24. Let N , g, and A be positive integers (note that N need not be prime). Prove that the following algorithm, which is a low-storage variant of the square-and-multiply algorithm described in Section 1.3.2, returns the value g A (mod N ). (In Step 4 we use the notation bxc to denote the greatest integer function, i.e., round x down to the nearest integer.) Input. Positive integers N , g, and A. 1. Set a = g and b = 1. 2. Loop while A > 0. 3. If A ≡ 1 (mod 2), set b = b · a (mod N ). 4. Set a = a2 (mod N ) and A = bA/2c. 5. If A > 0, continue with loop at Step 2. 6. Return the number b, which equals g A (mod N ). Solution to Exercise 1.24. *** fill in solution 1.25. Use the square-and-multiply algorithm described in Section 1.3.2, or the more efficient version in Exercise 1.24, to compute the following powers. (a) 17183 (mod 256). (b) 2477 (mod 1000). (c) 11507 (mod 1237). Solution to Exercise 1.25. (a)  183 = 1 + 2 + 22 + 24 + 25 + 27 ,  (b) 477 = 1 + 22 + 23 + 24 + 26 + 27 + 28 , (c) 507 = 1 + 2 + 23 + 24 + 25 + 26 + 27 + 28 ,  17183 (mod 256) = 113 . 2477 (mod 1000) = 272 11507 (mod 1237) = 322 .  Section. Prime numbers, unique factorization, and finite fields 1.26. Let {p1 , p2 , . . . , pr } be a set of prime numbers, and let N = p1 p2 · · · pr + 1.  20  Exercises for Chapter 1  Prove that N is divisible by some prime not in the original set. Use this fact to deduce that there must be infinitely many prime numbers. (This proof of the infinitude of primes appears in Euclid's Elements. Prime numbers have been studied for thousands of years.) Solution to Exercise 1.26. Let q be any prime that divides N . (Since N ≥ 2, we know that it must be divisible by some prime.) Suppose that q were equal to some pi . Then we would have 1 = N − p1 p2 · · · pr ≡ 0 (mod q), since q would divide both of the terms N and p1 · · · pr . But then q | 1, which is impossible. Therefore q is not equal to any of the pi 's. Next suppose that there were only finitely many primes. That means we can list them, say p1 , p2 , . . . , pr . But from the first part of the exercise, we can create a new prime that's not in our list. This contradicts the assumption that there are finitely many primes, and hence proves that there must be infinitely many primes. 1.27. Without using the fact that every integer has a unique factorization into primes, prove that if gcd(a, b) = 1 and if a | bc, then a | c. (Hint. Use the fact that it is possible to find a solution to au + bv = 1.) Solution to Exercise 1.27. From the extended Euclidean algorithm, we can solve au+bv = 1. Multiply by c to get acu + bcv = c. We are given that a | bc, so there is an integer d satisfying bc = ad. Substituting this gives acu + adv = c. Thus a(cu + dv) = c, which shows that a | c. 1.28. Compute the following ordp values: (a) ord2 (2816). (b) ord7 (2222574487). (c) ordp (46375) for each of p = 3, 5, 7, and 11. Solution to Exercise 1.28. (a) ord2 (2816) = 8. (b) ord7 (2222574487) = 5. (c) Let a = 46375. Then ord3 (a) = 0, ord5 (a) = 3, ord7 (a) = 1, ord11 (a) = 0. 1.29. Let p be a prime number. Prove that ordp has the following properties. (a) ordp (ab) = ordp (a) + ordp (b). (Thus ordp resembles the logarithm function, since it converts © multiplication ª into addition!) (b) ordp (a + b) ≥ min ordp (a), ordp (b) . © ª (c) If ordp (a) 6= ordp (b), then ordp (a + b) = min ordp (a), ordp (b) . A function satisfying properties (a) and (b) is called a valuation.  Exercises for Chapter 1  21  Solution to Exercise 1.29. (a) By definition of ordp , we have a = pordp (a) A  and  b = pordp (b) B  with  p-A  and  p - B.  Then ab = pordp (a) A · pordp (b) B = pordp (a)+ordp (b) AB  with  p - AB,  so by definition, ordp (ab) = ordp (a) + ordp (b). (b) We continue with the notation from (a) and, without loss of generality, we switch a and b if necessary so that ordp (a) ≥ ordp (b). Then ³ ´ a + b = pordp (a) A + pordp (b) B = pordp (b) pordp (a)−ordp (b) A + B . Thus pordp (b) | a + b, so by definition of ordp we have ordp (a + b) ≥ ordp (b). (Note that we've set things up so that ordp (b) = min{ordp (a), ordp (b)}, so this is the result that we want.) (c) We continue with the notation from (a) and (b), but for this part we are given that ordp (a) > ordp (b). We also know that p - B, so it follows that ³ ´ p - pordp (a)−ordp (b) A + B , since the exponent of p on the first term is positive. Hence pordp (b) is the largest power of p dividing a + b, which proves that ordp (a + b) = ordp (b).  Section. Powers and primitive roots in finite fields 1.30. For each of the following primes p and numbers a, compute a−1 mod p in two ways: (i) Use the extended Euclidean algorithm. (ii) Use the fast power algorithm and Fermat's little theorem. (See Example 1.28.) (a) p = 47 and a = 11. (b) p = 587 and a = 345. (c) p = 104801 and a = 78467. Solution to Exercise 1.30. (a) (i) We use the extended Euclidean algorithm to solve 11u + 47v = 1.  22  Exercises for Chapter 1  The solution is (u, v) = (−17, 4), so 11−1 ≡ −17 ≡ 30 (mod 47). (ii) Fermat's little theorem gives 11−1 ≡ 1145 ≡ 30 (mod 47). (b) (i) We use the extended Euclidean algorithm to solve 345u + 587v = 1. The solution is (u, v) = (114, −67), so 345−1 ≡ 114 (mod 587). (ii) Fermat's little theorem gives 345−1 ≡ 345585 ≡ 114 (mod 587). (c) (i) We use the extended Euclidean algorithm to solve 78467u + 104801v = 1. The solution is (u, v) = (1763, −1320), so 78467−1 ≡ 1763 (mod 104801). (ii) Fermat's little theorem gives 78467−1 ≡ 78467104799 ≡ 1763 (mod 104801).  1.31. Let p be a prime and let q be a prime that divides p − 1. (a) Let a ∈ F∗p and let b = a(p−1)/q . Prove that either b = 1 or else b has order q. (Recall that the order of b is the smallest k ≥ 1 such that bk = 1 in F∗p . Hint. Use Proposition 1.30.) (b) Suppose that we want to find an element of F∗p of order q. Using (a), we can randomly choose a value of a ∈ F∗p and check whether b = a(p−1)/q satisfies b 6= 1. How likely are we to succeed? In other words, compute the value of the ratio #{a ∈ F∗p : a(p−1)/q 6= 1} . #F∗p (Hint. Use Theorem 1.31.) Solution to Exercise 1.31. (a) Let k be the order of b, i.e., the smallest exponent such that bk = 1. We know that bq = ap−1 = 1 from Fermat's little theorem. Then Proposition 1.30 tells us that k divides q, and since q is prime, it follows that either k = q or k = 1. Thus either b has order q, or else it has order 1, in which case b = b1 = 1. (b) Let g ∈ F∗p be a primitive root. Then every a ∈ F∗p has the form g i for some 0 ≤ i < p − 1. We'll count the number of a with a(p−1)/q = 1. Thus  Exercises for Chapter 1  23  #{a ∈ F∗p : a(p−1)/q = 1} = #{0 ≤ i < p − 1 : (g i )(p−1)/q = 1} = #{0 ≤ i < p − 1 : g i(p−1)/q = 1}. Since g has order p − 1, we have g k = 1 if and only if p − 1 | k. Hence g i(p−1)/q = 1  ⇐⇒  p − 1 | i(p − 1)/q  ⇐⇒  q | i.  Hence #{a ∈ F∗p : a(p−1)/q = 1} = #{0 ≤ i < p − 1 : q | i} =  p−1 . q  It follows that #{a ∈ F∗p : a(p−1)/q 6= 1} = p − 1 − #{a ∈ F∗p : a(p−1)/q = 1} µ ¶ 1 p−1 =p−1− = (p − 1) 1 − . q q Hence  #{a ∈ F∗p : a(p−1)/q 6= 1} 1 =1− , #F∗p q  so if q is large, we have a very good chance of succeeding on our first try. 1.32. Recall that g is called a primitive root modulo p if the powers of g give all nonzero elements of Fp . (a) For which of the following primes is 2 a primitive root modulo p? (i) p = 7 (ii) p = 13 (iii) p = 19 (iv) p = 23 (b) For which of the following primes is 3 a primitive root modulo p? (i) p = 5 (ii) p = 7 (iii) p = 11 (iv) p = 17 (c) Find a primitive root for each of the following primes. (i) p = 23 (ii) p = 29 (iii) p = 41 (iv) p = 43 (d) Find all primitive roots modulo 11. Verify that there are exactly φ(10) of them, as asserted in Remark 1.33. (e) Write a computer program to check for primitive roots and use it to find all primitive roots modulo 229. Verify that there are exactly φ(229) of them. (f) Use your program from (e) to find all primes less than 100 for which 2 is a primitive root. (g) Repeat the previous exercise to find all primes less than 100 for which 3 is a primitive root. Ditto to find the primes for which 4 is a primitive root. Solution to Exercise 1.32. (a) (i) No. (ii) Yes. (iii) Yes. (iv) No. (b) (i) Yes. (ii) Yes. (iii) No. (iv) Yes. (c) In each case, we list the smallest primitive root  24  Exercises for Chapter 1  (i) p = 23, g = 5. (ii) p = 29, g = 2. (iii) p = 41, g = 6. (iv) p = 43, g = 3. (d) The primitive roots modulo 11 are {2, 6, 7, 8}. There are φ(10) = 4 of them. (e) The primitive roots modulo 229 are {6, 7, 10, 23, 24, 28, 29, 31, 35, 38, 39, 40, 41, 47, 50, 59, 63, 65, 66, 67, 69, 72, 73, 74, 77, 79, 87, 90, 92, 96, 98, 102, 105, 110, 112, 113, 116, 117, 119, 124, 127, 131, 133, 137, 139, 142, 150, 152, 155, 156, 157, 160, 162, 163, 164, 166, 170, 179, 182, 188, 189, 190, 191, 194, 198, 200, 201, 205, 206, 219, 222, 223}. There are exactly φ(228) = 72 of them. (f) 2 is a primitive root modulo p for p ∈ {3, 5, 11, 1319, 29, 37, 53, 59, 61, 67, 83} and for no other primes less than 100. It is conjectured that 2 is a primitive root for infinitely many primes (Artin's conjecture). (g) 3 is a primitive root modulo p for p ∈ {5, 7, 17, 19, 29, 31, 43, 53, 79, 89} and for no other primes less than 100. On the other hand, there are no primes for which 4 is a primitive root. This is because 4 = 22 is a square, so the powers of 4 can hit at most half of the possible nonzero values modulo p. 1.33. Let p be a prime such that q = 21 (p − 1) is also prime. Suppose that g is an integer satisfying g 6≡ ±1  (mod p)  and  g q 6≡ 1  (mod p).  Prove that g is a primitive root modulo p. Solution to Exercise 1.33. Let n be the order of g, i.e., the smallest power of g that is congruent to 1. Then n divides p − 1 from Proposition 1.30. Since p − 1 = 2q with q prime, this means that n=1  orn = 2  orn = q  orn = 2q.  We are given that g 6≡ ±1 (mod p), so n 6= 1 and n 6= 2, and we are also given that g q 6≡ ±1 (mod p), so n 6= q.The only value left is n = 2q. This proves that n = p − 1, so g is a primitive root modulo p. 1.34. This exercise begins the study of squares and square roots modulo p. (a) Let p be an odd prime number and let b be an integer with p - b. Prove that either b has two square roots modulo p or else b has no square roots modulo p. In other words, prove that the congruence X 2 ≡ b (mod p) has either two solutions or no solutions in Z/pZ. (What happens for p = 2? What happens if p | b?)  Exercises for Chapter 1  25  (b) For each of the following values of p and b, find all of the square roots of b modulo p. (i) (p, b) = (7, 2) (ii) (p, b) = (11, 5) (iii) (p, b) = (11, 7) (iv) (p, b) = (37, 3) (c) How many square roots does 29 have modulo 35? Why doesn't this contradict the assertion in (a)? (d) Let p be an odd prime and let g be a primitive root modulo p. Then any number a is equal to some power of g modulo p, say a ≡ g k (mod p). Prove that a has a square root modulo p if and only if k is even. Solution to Exercise 1.34. (a) If X = a1 and X = a2 are square roots of b modulo p, then p divides a21 − b and p divides a22 − b, so p divides their difference (a21 − b) − (a22 − b) = a21 − a22 = (a1 − a2 )(a1 + a2 ). It follows that p divides either a1 − a2 or a1 + a2 . If the former, then a1 ≡ a2 (mod p), and if the latter, then a1 ≡ −a2 (mod p). Thus there are at most two possibilities. Further, if there is one solution a and if p ≥ 3, then p − a is a second solution different from a, so if there are any solutions, then there are exactly two solutions. On the other hand, if p = 2, then X 2 ≡ b (mod p) always has exactly one solution, namely X = b. (b) (i) 3 and 4. (ii) 4 and 7. (iii) None. (iv) 15 and 22. (c) 8, 13, 22, and 27 are all solutions to X 2 ≡ 29 (mod 35), so 29 has four square roots modulo 35. This does not contradict (a), since the modulus 35 is not prime. (d) Suppose first that k is even, say k = 2j. Then a ≡ g k ≡ g 2j ≡ (g j )2  (mod p),  so a is a square modulo p. Next suppose a is a square, say a ≡ b2 (mod p). Since g is a primitive root, we can write b ≡ g i (mod p) for some exponent i. Then g k ≡ a ≡ b2 ≡ (g i )2 ≡ g 2i  (mod p).  Thus g k−2i ≡ 1 (mod p), and the fact that g is a primitive root implies that p − 1 divides k − 2i. But p − 1 is even, hence 2 divides k − 2i, so 2 divides k. 1.35. Let p ≥ 3 be a prime and suppose that the congruence X 2 ≡ b (mod p) has a solution.  26  Exercises for Chapter 1  (a) Prove that for every exponent e ≥ 1 the congruence X 2 ≡ b (mod pe )  (1.11)  has a solution. (Hint. Use induction on e. Build a solution modulo pe+1 by suitably modifying a solution modulo pe .) (b) Let X = α be a solution to X 2 ≡ b (mod p). Prove that in (a), we can find a solution X = β to X 2 ≡ b (mod pe ) that also satisfies β ≡ α (mod p). (c) Let β and β 0 be two solutions as in (b). Prove that β ≡ β 0 (mod pe ). (d) Use Exercise 1.34 to deduce that the congruence (1.14) has either two solutions or no solutions modulo pe . Solution to Exercise 1.35. We do (a), (b), and (c) simultaneously. We are given that X = α is a solution to X 2 ≡ b (mod p). We are going to prove by induction that for every e ≥ 1 there is a unique value β mod pe satisfying both β2 ≡ b  (mod pe )  and  β≡α  (mod p).  The case e = 1 is given to us, we must take β = α. Now suppose that we have a value of β that works for e, and we ask for all solutions that work for e + 1. Note that if γ is a solution for e + 1, then γ mod pe is a solution for e. So by the uniqueness part of the induction hypothesis, we would need to have γ ≡ β (mod pe ). In other words, if there are any solutions γ for e + 1, then γ is forced to have the form γ = β + ype  for some integer y.  What we want to do is show that there is a unique value of y modulo p that makes γ into a solution of X 2 ≡ b (mod pe+1 ). We also want to use the fact that β is a solution to X 2 ≡ b (mod pe ). This means that β 2 = b + pe B for some integer B. Now we substitute γ = β + ype into the congruence X 2 ≡ b (mod pe+1 ) and try to solve for y. Thus (β + ype )2 ≡ b  (mod pe+1 )  β 2 + 2ype + y 2 p2e ≡ b  (mod pe+1 )  β 2 + 2ype ≡ b  (mod pe+1 )  e  e  b + p B + 2yp ≡ b pe (B + 2y) ≡ 0  e+1  (mod p  )  (mod pe+1 ).  Thus we need to solve B + 2y ≡ 0 (mod p).  since 2e ≥ e + 1, since β 2 = b + pe B,  Exercises for Chapter 1  27  This has a unique solution for y. (Note that p is assumed to be an odd prime. If p = 2, the argument does not work.) We can even solve explicitly, y≡  p−1 B 2  (mod p).  This completes the proof that for every e ≥ 1 there exists a unique value of β (mod pe ) satisfying β2 ≡ b  (mod pe )  and  β≡α  (mod p),  which gives all of the statements in (a), (b), and (b). (d) From the earlier exercise we know that X 2 ≡ b (mod p) has either 0 or 2 solutions. If it has no solutions, there there certainly aren't any solutions to X 2 ≡ b (mod pe ) for e ≥ 2, since any such solution could always be reduced modulo p. On the other hand, if X 2 ≡ b (mod p) has two solutions, then (a), (b), and (c) together imply that there are also two solutions to X 2 ≡ b (mod pe ) for each e ≥ 1, since the solutions to X 2 ≡ b (mod p) are matched up one-to-one with the solutions to X 2 ≡ b (mod pe ). This exercise is a very special case of Hensel's lemma. 1.36. Compute the value of 2(p−1)/2 (mod p) for every prime 3 ≤ p < 20. Make a conjecture as to the possible values of 2(p−1)/2 (mod p) when p is prime and prove that your conjecture is correct. Solution to Exercise 1.36. p=3  21 = 2 ≡ 2  p=5  22 = 4 ≡ 4  p=7  23 = 8 ≡ 1  p = 11  25 = 32 ≡ 10  p = 13  26 = 64 ≡ 12  p = 17  28 = 256 ≡ 1  p = 19  29 = 512 ≡ 18  Conjecture: 2(p−1)/2 is congruent to either 1 or p − 1 modulo p. Proof : Let a = 2(p−1)/2 . Then a2 ≡ 2p−1 ≡ 1 (mod p) by Fermat's little theorem. Therefore a ≡ ±1 (mod p). To see this last fact, note that p | (a2 −1), so p | (a − 1)(a + 1), so since p is prime, it divides one of a − 1 or a + 1, which is just another way of saying that a ≡ ±1 (mod p). Section. Cryptography by hand  28  Exercises for Chapter 1  1.37. Write a 2 to 5 page paper on one of the following topics, including both cryptographic information and placing events in their historical context: (a) Cryptography in the Arab world to the 15th century. (b) European cryptography in the 15th and early 16th centuries. (c) Cryptography and cryptanalysis in Elizabethan England. (d) Cryptography and cryptanalysis in the 19th century. (e) Cryptography and cryptanalysis during World War I. (f) Cryptography and cryptanalysis during World War II. (Most of these topics are too broad for a short term paper, so you should choose a particular aspect on which to concentrate.) Solution to Exercise 1.37. A solution for this exercise will not be provided. 1.38. A homophonic cipher is a substitution cipher in which there may be more than one ciphertext symbol for each plaintext letter. Here is an example of a homophonic cipher, where the more common letters have several possible replacements. a bc d e f g h i j k l m n o p q r s t ! 4# $ 1 % & * ( ) 3 2 = + [ 9 ] { } : ♥ ◦ ? ℵ 6 % . ♦∧ & ∆∇ 8 ♣ Ω ∨ ⊗ Θ ∞ ⇑ \ • ¯ / ⊕ . ⇓ ⇒-  u vwxyz ; 7<>5? ♠ [ ⇐  Decrypt the following message. ( % ∆ ♠ ⇒ \ # 4 ∞ : ♦ 6 % ¯ [ ℵ 8 % 2 [ 7 ⇓ ♣ & ♥ 5 ¯ ∇ Solution to Exercise 1.38. ( I % f  % f 2 l  ∆ m [ o  ♠ u 7 v  ⇒ s ⇓ e  \ i ♣ p  # c & l  4 b ♥ a  ∞ e 5 y  : t ¯ o  ♦ h ∇ n  6 e  % f  ¯ o  [ o  ℵ d  8 o  From Shakespeare's Twelfth Night: If music be the food of love, play on... 1.39. A transposition cipher is a cipher in which the letters of the plaintext remain the same, but their order is rearranged. Here is a simple example in which the message is encrypted in blocks of 25 letters at a time.1 Take the given 25 letters and arrange them in a 5-by-5 block by writing the message horizontally on the lines. For example, the first 25 letters of the message Now is the time for all good men to come to the aid... is written as 1 If the number of letters in the message is not an even multiple of 25, then extra random letters are appended to the end of the message.  Exercises for Chapter 1  29 N T M A O  O H E L D  W E F L M  I T O G E  S I R O N  Now the cipehrtext is formed by reading the letters down the columns, which gives the ciphertext NTMAO OHELD WEFLM ITOGE SIRON. (a) Use this transposition cipher to encrypt the first 25 letters of the message Four score and seven years ago our fathers... (b) The following message was encrypted using this transposition cipher. Decrypt it. WNOOA HTUFN EHRHE NESUV ICEME (c) There are many variations on this type of cipher. We can form the letters into a rectangle instead of a square, and we can use various patterns to place the letters into the rectangle and to read them back out. Try to decrypt the following ciphertext, in which the letters were placed horizontally into a rectangle of some size and then read off vertically by columns. WHNCE STRHT TEOOH ALBAT DETET SADHE LEELL QSFMU EEEAT VNLRI ATUDR HTEEA (For convenience, we've written the ciphertext in 5 letter blocks, but that doesn't necessarily mean that the rectangle has a side of length 5.) Solution to Exercise 1.39. (a) Ciphertext: FCNER OODNS URSYA REEEG SAVAO F C N E R  O O D N S  U R S Y A  R E E E G  S A V A O  (b) Plaintext: When in the course of human events it becomes necessary... Hopefully everyone recognizes the first few words of the American Declaration of Independence. W N O O A  H T U F N  E H R H E  N E S U V  I C E M E  30  Exercises for Chapter 1  (c) Plaintext: We hold these truths to be self-evident, that all men are created equal, that they are endowed by their Creator... Another excerpt from the Declaration of Independence. It was encrypted using a 15-by-4 rectangle. W H N C  E S T R  H T T E  O O H A  L B A T  D E T E  T S A D  H E L E  E L L Q  S F M U  E E E A  T V N L  R I A T  U D R H  T E E A  Section. Symmetric ciphers and asymmetric ciphers 1.40. Encode the following phrase (including capitalization, spacing and punctuation) into a string of bits using the ASCII encoding scheme given in Table 1.10. Bad day, Dad. Solution to Exercise 1.40. B 66  a 97  d 100  32  d 100  a 97  y 121  , 44  01000010  01100001  01100100  00100000  01100100  01100001  01111001  00101100  32  D 68  a 97  d 100  . 46  00100000  01000100  01100001  01100100  00101110  Thus the phrase "Bad day, Dad." becomes the ASCII list of bits 0100001001100001011001000010000001100100011000010111 1001001011000010000001000100011000010110010000101110  1.41. Consider the affine cipher with key k = (k1 , k2 ) whose encryption and decryption functions are given by (1.11) on page 43. (a) Let p = 541 and let the key be k = (34, 71). Encrypt the message m = 204. Decrypt the ciphertext c = 431. (b) Assuming that p is public knowledge, explain why the affine cipher is vulnerable to a chosen plaintext attack. (See Property 4 on page 38.) How many plaintext/ciphertext pairs are likely to be needed in order to recover the private key? (c) Alice and Bob decide to use the prime p = 601 for their affine cipher. The value of p is public knowledge, and Eve intercepts the ciphertexts c1 = 324 and c2 = 381 and also manages to find out that the corresponding plaintexts are m1 = 387 and m2 = 491. Determine the private key and then use it to encrypt the message m3 = 173. (d) Suppose now that p is not public knowledge. Is the affine cipher still vulnerable to a chosen plaintext attack? If so, how many plaintext/ciphertext pairs are likely to be needed in order to recover the private key?  Exercises for Chapter 1  31  Solution to Exercise 1.41. (a) The encryption of m = 204 is c ≡ 34·204+71 ≡ 7007 ≡ 515 (mod 541). The inverse of k1 is 34−1 ≡ 366 (mod 541). The decryption of c = 431 is m ≡ 366(431 − 71) ≡ 297 (mod 541). (b) Given two plaintext/ciphertext pairs, one can solve the two linear congruences c1 ≡ k1 · m1 + k2  (mod p)  and  c2 ≡ k1 · m2 + k2  and  381 ≡ k1 · 491 + k2  (mod p)  for the two unknowns k1 and k2 . (c) Eve knows that 324 ≡ k1 · 387 + k2  (mod 601)  (mod 601)  She subtracts the first equation from the second to get 57 ≡ k1 · 104 (mod 601). She computes 104−1 ≡ 549 (mod 601), and hence k1 ≡ 57 · 104−1 ≡ 41  (mod 601).  Then she uses either of the above congruences to recover k2 , k2 ≡ 324 − k1 · 387 ≡ 83 (mod 601). Eve now knows Alice and Bob's private key, so she can encrypt a message, c3 ≡ k1 · m3 + k2 ≡ 41 · 173 + 83 ≡ 565 (mod 601). (d) Yes. Suppose that we have three plaintext/ciphertext pairs, (m1 , c1 ), (m2 , c2 ), (m3 , c3 ). This gives us a system of three congruences c1 ≡ k1 m1 + k2 c2 ≡ k1 m2 + k2 c3 ≡ k1 m3 + k2  (mod p) (mod p) (mod p)  We can write this in suggestive matrix and vector notation at   c1 m1 1 ¡ ¢ ¡ ¢ c2 m2 1 1 −k1 −k2 ≡ 0 0 0 (mod p). c3 m3 1 Using linear algebra modulo p, this implies that the determinant of the matrix satisfies  32  Exercises for Chapter 1    c1 m1 1 det c2 m2 1 ≡ 0 c3 m3 1  (mod p).  Thus three plaintext/ciphertext pairs allows Eve to compute a number, namely   c1 m1 1 D = det c2 m2 1 c3 m3 1 that is divisible by the secret prime p. If Eve can factor D, then at worst she has a few possible values of p to check. So three pairs may be enough to break the cipher. More generally, if Eve has n different pairs, she can compute determinant values D1 , . . . , Dn−2 by using different pairs in the last row of the matrix (keeping the first two rows the same). This gives her a bunch of numbers that are divisible by p, and within a short time she will almost certain find that gcd(D1 , . . . , Dn−2 ) is equal to p. 1.42. Consider the Hill cipher defined by (1.11), ek (m) ≡ k1 · m + k2  (mod p)  and  dk (c) ≡ k1−1 · (c − k2 ) (mod p),  where m, c, and k2 are column vectors of dimension n, and k1 is an n-by-n matrix. (a) We use the vector Hill cipher with p = 7 and the key k1 = ( 12 32 ) and k2 = ( 54 ). (i) Encrypt the message m = ( 21 ). (ii) What is the matrix k1−1 used for decryption? (iii) Decrypt the message c = ( 35 ). (b) Explain why the Hill cipher is vulnerable to a chosen plaintext attack. (c) The following plaintext/ciphertext pairs were generated using a Hill cipher with the prime p = 11. Find the keys k1 and k2 . m1 = ( 54 ) ,  c1 = ( 18 ) ,  8 ), m2 = ( 10  c2 = ( 85 ) ,  m3 = ( 71 ) ,  c3 = ( 87 ) .  (d) Explain how any simple substitution cipher that involves a permutation of the alphabet can be thought of as a special case of a Hill cipher. Solution to Exercise 1.42. (a-i) ek (m) = 5 3 . −1 36 (a − kii) 1 = 4 5. (a − diii) k (c) = 0 4 . (b) Each known plaintext/ciphertext pair gives a congruence of the form c ≡ k1 ·m+k2 (mod p). Writing this out gives n linear equations for the n2 +n unknown entries of k1 and k2 . Hence n+1 plaintext/ciphertext pairs probably gives enough equations to solve for the keys k1 and k2 .  Exercises for Chapter 1  33  (c) We let k1 = ( xz wy ) and k2 = ( uv ). Then the congruence c1 = k1 m1 + k2 (mod 11) becomes the matrix equation µ ¶ µ ¶µ ¶ µ ¶ µ ¶ 1 x y 5 u 5x + 4y + u = + = (mod 11). 8 zw 4 v 5z + 4w + v So this gives the two congruences 5x + 4y + u ≡ 1  (mod 11)  and  5z + 4w + v ≡ 8  (mod 11).  Similarly, the congruence c2 = k1 m2 + k2 (mod 11) gives 8x + 10y + u ≡ 8  (mod 11)  and  8z + 10w + v ≡ 5  and  7z + w + v ≡ 7  (mod 11).  and c3 = k1 m3 + k2 (mod 11) gives 7x + y + u ≡ 8  (mod 11)  (mod 11).  This gives us 6 equations for the 6 unknowns x, y, z, w, u, v. Further, three of the equations only involve x, y, u and the other three only involve z, w, v, so it's really two sets of 3-by-3 equations to solve: 5x + 4y + u = 1 8x + 10y + u = 8 7x + y + u = 8  5z + 4w + v = 8 8z + 10w + v = 5 7z + w + v = 7.  (All equations are modulo 11.) These are easily solved using basic linear algebra methods, and we find that (x, y, u) = (3, 7, 2) Hence k1 =  µ ¶ 37 43  and  and  (z, w, v) = (4, 3, 9).  k2 =  µ ¶ 2 . 9  (d) We work with vectors of dimension 26. Let e1 , . . . , e26 be the usual basis vectors for R26 , i.e., ei has a 1 in the ith place and 0's elsewhere. For the plaintext, we use e1 to represent (a), we use e2 to represent (b), and so on. We view the the simple substitution cipher as a function that takes each plaintext letter and assigns it to a ciphertext letter. Equivalently, it takes each ei and assigns it to some eπ(i) , where π is a one-to-one function π : {1, 2, . . . , 26} −→ {1, 2, . . . , 26}. In the Hill cipher, we now take k1 to be the matrix whose ij th entry is 1 if e(i) = j, and otherwise it is 0. We also take k2 = 0. Then k1 · ei = eπ (i), so the encryption of the plaintext ei is equal to eπ(i) , as desired.  34  Exercises for Chapter 1  1.43. Let N be a large integer and let K = M = C = Z/N Z. For each of the functions e : K × M −→ C listed in (a), (b), and (c), answer the following questions: • Is e an encryption function? • If e is an encryption function, what is its associated decryption function d? • If e is not an encryption function, can you make it into an encryption function by using some smaller, yet reasonably large, set of keys? (a) ek (m) ≡ k − m (mod N ). (b) ek (m) ≡ k · m (mod N ). (c) ek (m) ≡ (k + m)2 (mod N ). Solution to Exercise 1.43. (a) Yes, e is an encryption function. The decryption function dk (c) = k − c is the same as e! (b) No, e is not an encryption function, it is not one-to-one. However, if we restrict the keys to K = (Z/N Z)∗ (i.e., gcd(k, N ) = 1), then e is an encryption function, with decryption function dk (c) ≡ k −1 c (mod N ). (c) No, e is not an encryption function, it is not one-to-one, and no subset of keys will make it√one-to-one. However, one might define a decryption "function" by dk (c) ≡ c − k (mod N ). Assuming that one knows how to compute square √ roots modulo N , this gives two possibly decryptions, since it's really ± c. In practice, one might be able to use some property of valid messages to figure out which one is correct. 1.44. (a) Convert the 12 bit binary number 110101100101 into a decimal integer between 0 and 212 − 1. (b) Convert the decimal integer m = 37853 into a binary number. (c) Convert the decimal integer m = 9487428 into a binary number. (d) Use exclusive or (XOR) to "add" the bit strings 11001010 ⊕ 10011010. (e) Convert the decimal numbers 8734 and 5177 into binary numbers, combine them using XOR, and convert the result back into a decimal number. Solution to Exercise 1.44. (a) 211 + 210 + 28 + 26 + 25 + 22 + 20 = 3429 (b) 37853 = 215 + 212 + 29 + 28 + 27 + 26 + 24 + 23 + 22 + 20 , so the binary form of 37853 is 1001001111011101 . (c) 9487428 = 223 + 220 + 215 + 214 + 210 + 26 + 22 , so the binary form of 9487428 is 100100001100010001000100 . (d) 11001010 ⊕ 10011010 = 01010000 . (e)  Exercises for Chapter 1  35  8734 = '10001000011110', 5177 = '01010000111001', 8734 ⊕ 5177 = 10001000011110 ⊕ 01010000111001 = 11011000100111, '11011000100111' = 13863 .  1.45. Alice and Bob choose a key space K containing 256 keys. Eve builds a special-purpose computer that can check 10,000,000,000 keys per second. (a) How many days does it take Eve to check half of the keys in K? (b) Alice and Bob replace their key space with a larger set containing 2B different keys. How large should Alice and Bob choose B in order to force Eve's computer to spend 100 years checking half the keys? (Use the approximation that there are 365.25 days in a year.) For many years the United States government recommended a symmetric cipher called DES that used 56 bit keys. During the 1990s, people built special purpose computers demonstrating that 56 bits provided insufficient security. A new symmetric cipher called AES, with 128 bit keys, was developed to replace DES. See Section 8.10 for further information about DES and AES. Solution to Exercise 1.45. (a) µ (256 keys) ·  ¶ µ ¶ 1 second 1 minute · 10,000,000,000 keys 60 seconds µ ¶ µ ¶ 1 hour 1 day · · ≈ 83.4 days. 60 minutes 24 hours  It thus takes about 83.4 days to check all the keys, so about 41.7 days to check half the keys. (b) µ  ¶ µ ¶ µ ¶ 10,000,000,000 keys 60 seconds 60 minutes · · 1 second 1 minute 1 hour µ ¶ µ ¶ 24 hours 365.25 days · · · (100 years) 1 day 1 year = 31557600000000000000 keys ≈ 264.775 keys.  Thus it takes Eve's computer 100 years to check 264.775 keys. The problem says that this should be half the keys, so Alice and Bob should have at least 265.775 different keys. In practice, it is easiest to choose an integral power of 2, so Alice and Bob's key space should contain (at least) 266 keys. Comparing (a) and (b), notice that by increasing the keylength from 56 bits to 66 bits, Alice and Bob's security goes from 42 days to 100 years. Thus even a  36  Exercises for Chapter 1  small increase in the keylength results in an enormous increase in the breaking time by exhaustive search. This reflects the fact that exponential functions grow extremely rapidly. 1.46. Explain why the cipher ek (m) = k ⊕ m  and  dk (c) = k ⊕ c  defined by XOR of bit strings is not secure against a chosen plaintext attack. Demonstrate your attack by finding the private key used to encrypt the 16-bit ciphertext c = 1001010001010111 if you know that the corresponding plaintext is m = 0010010000101100. Solution to Exercise 1.46. If you know m and c, since they are related by c = k ⊕ m, it follows that c ⊕ m = k ⊕ m ⊕ m = k. For the example, k = c ⊕ m = 1001010001010111 ⊕ 0010010000101100 = 1011000001111011 .  1.47. Alice and Bob create a symmetric cipher as follows. Their private key k is a large integer and their messages (plaintexts) are d-digit integers M = {m ∈ Z : 0 ≤ m < 10d }. √ To encrypt a message, Alice computes k to d decimal places, throws away the part to the left of the decimal point, and keeps the remaining d digits. Let √ α be this d-digit number. (For example, if k = 23 and d = 6, then 87 = 9.32737905 . . . and α = 327379.) Alice encrypts a message m as c≡m+α  (mod 10d ).  Since Bob knows k, he can also find α, and then he decrypts c by computing m ≡ c − α (mod 10d ). (a) Alice and Bob choose the secret key k = 11 and use it to encrypt 6-digit integers (i.e., d = 6). Bob wants to send Alice the message m = 328973. What is the ciphertext that he sends? (b) Alice and Bob use the secret key k = 23 and use it to encrypt 8-digit integers. Alice receives the ciphertext c = 78183903. What is the plaintext m? (c) Show that the number α used for encryption and decryption is given by the formula ³√ j √ ´k α = 10d k−b kc , where btc denotes the greatest integer that is less than or equal to t.  Exercises for Chapter 1  37  (d) (Challenge Problem) If Eve steals a plaintext/ciphertext pair (m, c), then it is clear that she can recover the number α, since α ≡ c − m (mod 10d ). If 10d is large compared to k, can she also recover the number k? This might √ be useful, for example, if Alice and Bob use some of the other digits of k to encrypt subsequent messages. Solution√to Exercise 1.47. (a) 11 = 3.3166247903 . . . , so α = 316624 and the ciphertext is c = 328973 + 316624 = 645597 . √ (b) 23 = 4.7958315233127195 . . . , so α = 79583152 and the plaintext is c = 78183903 − 79583152 = −1399249 ≡ 98600751  (mod 108 ).  (c) The quantity x − bxc gives the fractional part of x, i.e., the part to the right of the decimal point. The remaining part of the formula simply shifts the digits d places to the left and then discards everything after the decimal point. (d) The answer is yes, Eve should be able to recover k, but probably not using the tools that we've developed so far. Let β = α/10d . Then √ k =L+β for some L ∈ Z. There are two unknowns here, k and L, and all that Eve knows is that they are both integers. Squaring both sides gives k = L2 + 2Lβ + β 2 . Thus there are integers A and B satisfying β 2 + Aβ + B = 0, namely A = 2L and B = L2 − k. Of course, Eve doesn't know A or B, either. However, there are algorithms based on lattice reduction that are very good at finding the smallest (quadratic) polynomial with integer coefficients satisfied by a given decimal number. Using these algorithms, Eve should be able to find A and B, from which it is easy to recover k as k = 14 A2 − B. 1.48. Bob and Alice use a cryptosystem in which their private key is a (large) prime k and their plaintexts and ciphertexts are integers. Bob encrypts a message m by computing the product c = km. Eve intercepts the following two ciphertexts: c1 = 12849217045006222,  c2 = 6485880443666222.  Use the gcd method described in Section 1.7.4 to find Bob and Alice's private key. Solution to Exercise 1.48. We compute gcd(c1 , c2 ) = 174385766. This factors as 174385766 = 2 · 87192883 and 87192883 is prime, so it is Bob and Alice's key.  Chapter 2  Discrete Logarithms and Diffie–Hellman Exercises for Chapter 2 Section. Diffie–Hellman and RSA 2.1. Write a one page essay giving arguments, both pro and con, for the following assertion: If the government is able to convince a court that there is a valid reason for their request, then they should have access to an individual's private keys (even without the individual's knowledge), in the same way that the government is allowed to conduct court authorized secret wiretaps in cases of suspected criminal activity or threats to national security. Based on your arguments, would you support or oppose the government being given this power? How about without court oversight? The idea that all private keys should be stored at a secure central location and be accessible to government agencies (with or without suitably stringent legal conditions) is called key escrow. Solution to Exercise 2.1. A solution for this exercise will not be provided. 2.2. Research and write a one to two page essay on the classification of cryptographic algorithms as munitions under ITAR (International Traffic in Arms Regulations). How does that act define "export"? What are the potential fines and jail terms for those convicted of violating the Arms Export Control Act? Would teaching non-classified cryptographic algorithms to a college class that includes non-US citizens be considered a form of export? How has US government policy changed from the early 1990s to the present? 39  40  Exercises for Chapter 2  Solution to Exercise 2.2. Some historical material: Press Release Law Professor Sues Federal Government Over Computer Privacy Issues Federal Civil Rights Action Seeks Injunction Against State Department And National Security Agency Cleveland Scholar Attacks Prohibition On Discussing Cryptographic Software With Foreign Students And Colleagues For Immediate Release Cleveland, Wednesday, August 7, 1996 A Case Western Reserve University law professor filed suit today in federal court, challenging government regulations which restrict his ability to teach a course in computer law. Peter Junger, a twenty-five year veteran of the law school faculty, will file a federal civil rights action this afternoon in the United States District Court in Cleveland. The suit names the Department of State and the secretive National Security Agency, which administer federal regulations limiting Professor Junger's ability to teach. The case involves the International Traffic in Arms Regulations, or ITAR, federal regulations which restrict the export of military technology. Under the ITAR, cryptographic computer software, which encodes text to preserve the privacy of messages on the Internet, is considered a "munition" and subject to strict export control. The regulations raise significant First Amendment questions by defining "export" to include discussing technical information about non-classified software with foreign nationals, such as students registered for Professor Junger's course. In recent months, the State Department has sent a series of letters threatening possible criminal action to a Florida man who posted a simple cryptographic algorithm to the "sci.crypt" Usenet Newsgroup, an Internet site popular with cryptography enthusiasts. These and similar incidents have caused Professor Junger to limit his discussions of cryptographic material with foreign colleagues, for fear of violating the ITAR. Penalties for unlicensed disclosure of cryptographic information are severe: federal law provides ten year prison terms and One Million Dollar fines for those convicted of violating the Arms Export Control Act, the legislation under which the ITAR was promulgated. ———————————— Statement by Ambassador David Aaron US Envoy for Cryptography RSA Data Security Conference, January 28, 1997 International Views of Key Recovery These concerns are being heard in Washington. The Administration has taken the following steps - many based on the direct recommendations of industry representatives: First, at the end of last year, jurisdiction for licenses of encryption exports was transferred from the Department of State to the Department of Commerce. Commercial encryption is no longer treated as a munition and thereby  Exercises for Chapter 2  41  subject to various foreign policy embargoes. We hope this will both speed up and simplify the tasks of obtaining licenses. Second, and very important, the Administration will license the export of encryption products, of any algorithm and any key length, if they incorporate key recovery. Third, the Administration will also permit the export, over the next two years, of 56-bit DES and equivalent encryption products without key recovery provided exporters make commitments to develop key recovery products. I am pleased to report that already at least 4 vendors have formally filed key recovery commitments and several more companies are in the initial stages of dialogue with the Department of Commerce. And last, a point which is often lost in the debate, domestic use of key recovery will be voluntary as announced by the Vice President last October. All Americans will remain free to use any encryption system in the United States. ——————————— In 1992, the Software Publishers Association and the State Department reached an agreement which allows the export of programs containing RSA Data Security's RC2 and RC4 algorithms, but only when the key size is set to 40 bits or less. 40 bits is not very secure, and application of a distributed attack using standard workstations in a good-size lab can break these in at most a few days. This theory was demonstrated quite visibly in mid-1995 when two independent groups broke 40-bit keys used in the export version of the Netscape browser. Section. The discrete logarithm problem 2.3. Let g be a primitive root for Fp . (a) Suppose that x = a and x = b are both integer solutions to the congruence g x ≡ h (mod p). Prove that a ≡ b (mod p − 1). Explain why this implies that the map (2.1) on page 63 is well-defined. (b) Prove that logg (h1 h2 ) = logg (h1 ) + logg (h2 ) for all h1 , h2 ∈ F∗p . n ∗ (c) Prove that logg (h ) = n logg (h) for all h ∈ Fp and n ∈ Z. Solution to Exercise 2.3. (a) We are given that g a ≡ g b (mod p), since they are both congruent to h. Hence g a−b ≡ 1 (mod p). But g is a primitive root, so its order is p − 1, which implies that p − 1 divides a − b. Hence a ≡ b (mod p − 1). This means the logg (h) is well-defined up to adding or subtracting multiples of p − 1, so the map (2.1) on page 63 is well-defined. (b) We have g logg (h1 )+logg (h2 ) = g logg (h1 ) · g logg (h2 ) ≡ h1 · h2 (mod p) ≡ g logg (h1 h2 )  (mod p).  42  Exercises for Chapter 2  Hence logg (h1 ) + logg (h2 ) = logg (h1 h2 ), or more precisely, the are congruent modulo p − 1. (c) We have ³ ´n n g n logg (h) = g logg (h) ≡ hn ≡ g logg (h ) (mod p). Hence n logg (h) = logg (hn ). 2.4. Compute the following discrete logarithms. (a) log2 (13) for the prime 23, i.e., p = 23, g = 2, and you must solve the congruence 2x ≡ 13 (mod 23). (b) log10 (22) for the prime p = 47. (c) log627 (608) for the prime p = 941. (Hint. Look in the second column of Table 2.1 on page 64.) Solution to Exercise 2.4. (a) log2 (13) = 7 in F23 , since 213 = 128 ≡ 13 (mod 23). (b) log10 (22) = 11 in F47 . (c) The table shows that 62718 ≡ 608 (mod 941), so log627 (608) = 18 in F941 . 2.5. Let p be an odd prime and let g be a primitive root modulo p. Prove that a has a square root modulo p if and only if its discrete logarithm logg (a) modulo p is even. Solution to Exercise 2.5. This solution is taken from the proof of Proposition 3.60. Let m = logg (a), so a = g m . If m = 2k is even, then g m = g 2k = (g k )2 is a square. On the other hand, let m be odd, say m = 2k + 1, and suppose that g m is a square modulo p, say g m ≡ c2 (mod p). Fermat's little theorem (Theorem 1.25) tells us that cp−1 ≡ 1 (mod p). However, cp−1 (mod p) is also equal to cp−1 ≡ (c2 )  p−1 2  ≡ (g m )  p−1 2  ≡ (g 2k+1 )  p−1 2  ≡ g k(p−1) · g  p−1 2  (mod p).  Another application of Fermat's little theorem tells us that g k(p−1) ≡ (g p−1 )k ≡ 1k ≡ 1 (mod p), so we find that g  p−1 2  ≡ 1 (mod p).  This contradicts the fact that g is a primitive root, which proves that every odd power of g is not a square modulo p. Section. Diffie–Hellman key exchange  Exercises for Chapter 2  43  2.6. Alice and Bob agree to use the prime p = 1373 and the base g = 2 for a Diffie–Hellman key exchange. Alice sends Bob the value A = 974. Bob asks your assistance, so you tell him to use the secret exponent b = 871. What value B should Bob send to Alice, and what is their secret shared value? Can you figure out Alice's secret exponent? Solution to Exercise 2.6. Bob sends B = g b = 2871 ≡ 805 (mod 1373) to Alice. Their shared value is Ab = 974871 ≡ 397 (mod 1373). There is no really easy way to determine Alice's secret exponent, but with a computer or even a progammable calculator, it does not take long to compute all of the powers of 2 modulo 1373. (Using the babystep–giantstep method is even faster, you only need to make √ two lists of length approximately 1373 = 37.04 . . . . If you do this, you will find that 25 87 ≡ 974 (mod 1373), so Alice's secret exponent is 587. 2.7. Let p be a prime and let g be an integer. The Diffie–Hellman Decision Problem is as follows. Supoose that you are given three numbers A, B, and C, and suppose that A and B are equal to A ≡ g a (mod p)  and  B ≡ g b (mod p),  but that you do not necessarily know the values of the exponents a and b. Determine whether C is equal to g ab (mod p). Notice that this is different from the Diffie–Hellman problem described on page 67. The Diffie–Hellman problem asks you to actually compute the value of g ab . (a) Prove that an algorithm that solves the Diffie–Hellman problem can be used to solve the Diffie–Hellman decision problem. (b) Do you think that the Diffie–Hellman decision problem is hard or easy? Why? See Exercise 5.35 for a related example in which the decision problem is easy, but it is believed that the associated computational problem is hard. Solution to Exercise 2.7. (a) This is obvious. If you can compute g ab from g, g a , and g b , then you can simply compare the value of g ab with the value of C and check if they are equal. (b) No one currently knows how to solve the Diffie–Hellman decision problem without solving the Diffie–Hellman computational problem. Section. The ElGamal public key cryptosystem 2.8. Alice and Bob agree to use the prime p = 1373 and the base g = 2 for communications using the ElGamal public key cryptosystem. (a) Alice chooses a = 947 as her private key. What is the value of her public key A? (b) Bob chooses b = 716 as his private key, so his public key is B ≡ 2716 ≡ 469 (mod 1373).  44  Exercises for Chapter 2  Alice encrypts the message m = 583 using the ephemeral key k = 877. What is the ciphertext (c1 , c2 ) that Alice sends to Bob? (c) Alice decides to choose a new private key a = 299 with associated public key A ≡ 2299 ≡ 34 (mod 1373). Bob encrypts a message using Alice's public key and sends her the ciphertext (c1 , c2 ) = (661, 1325). Decrypt the message. (d) Now Bob chooses a new private key and publishes the associated public key B = 893. Alice encrypts a message using this public key and sends the ciphertext (c1 , c2 ) = (693, 793) to Bob. Eve intercepts the transmission. Help Eve by solving the discrete logarithm problem 2b ≡ 893 (mod 1373) and using the value of b to decrypt the message. Solution to Exercise 2.8. (a) A ≡ 2947 ≡ 177 (mod 1373), so Alice's public key is A = 177 . (b) c1 ≡ 2877 ≡ 719 (mod 1373) and c2 ≡ 583 · 469877 ≡ 623 (mod 1373). Alice sends the ciphertext (c1 , c2 ) = (719, 623) to Bob. (c) (ca1 )−1 · c2 ≡ (661299 )−1 · 1325 ≡ 645−1 · 1325 ≡ 794 · 1325 ≡ 332 (mod 1373). Thus the plaintext is m=332 . It turns out that the ephemeral key is k = 566, but Alice does not know this value. (d) The solution to 2b ≡ 893 (mod 1373) is b = 219 , which is Bob's private key. It is now easy to decrypt, (ca1 )−1 · c2 ≡ (693219 )−1 · 793 ≡ 431−1 · 793 ≡ 532 · 793 ≡ 365  (mod 1373).  Thus Alice's message to Bob is m = 365 . (The ephemeral key was k = 932.) 2.9. Suppose that an oracle offers to solve the Diffie–Hellman problem for you. (See page 67 for a description of the Diffie–Hellman problem.) Explain how you can use the oracle to decrypt messages that have been encrypted using the ElGamal public key cryptosystem. Solution to Exercise 2.9. In the ElGamal PKC, you know Alice's public key A ≡ g a (mod p) and you know the ciphertext consisting of the two quantities c1 ≡ g k (mod p) and c2 ≡ m · Ak (mod p), where k is Bob's secret ephemeral key. You thus know the values of g a and g k , so the Diffie–Hellman problem oracle will take those values and tell you the value of g ak (mod p). But g ak ≡ Ak (mod p), so you can recover Bob's plaintext message by computing (g ak )−1 · c2 ≡ m (mod p). 2.10. The exercise describes a public key cryptosystem that requires Bob and Alice to exchange several messages. We illustrate the system with an example. Bob and Alice fix a publicly known prime p = 32611, and all of the other numbers used are private. Alice takes her message m = 11111, chooses a random exponent a = 3589, and sends the number u = ma (mod p) = 15950 to Bob. Bob chooses a random exponent b = 4037 and sends v = ub (mod p) = 15422 back to Alice. Alice then computes w = v 15619 ≡ 27257 (mod 32611) and  Exercises for Chapter 2  45  sends w = 27257 to Bob. Finally, Bob computes w31883 (mod 32611) and recovers the value 11111 of Alice's message. (a) Explain why this algorithm works. In particular, Alice uses the numbers a = 3589 and 15619 as exponents. How are they related? Similarly, how are Bob's exponents b = 4037 and 31883 related? (b) Formulate a general version of this cryptosystem, i.e., using variables, and show that it works in general. (c) What is the disadvantage of this cryptosystem over ElGamal? (Hint. How many times must Alice and Bob exchange data?) (d) Are there any advantages of this cryptosystem over ElGamal? In particular, can Eve break it if she can solve the discrete logarithm problem? Can Eve break it if she can solve the Diffie–Hellman problem? Solution to Exercise 2.10. (a) Alice's and Bob's exponents satisfy 3589 · 15619 ≡ 1  (mod 32610)  and  4037 · 31883 ≡ 1 (mod 32610)  The reason why the algorithm works is discussed in the answer to (b). (b) In the general formulation, a public prime p is fixed. Alice choose a plaintext m mod p and a random exponent a satisfying gcd(a, p − 1) = 1. She send u ≡ ma  (mod p)  to Bob. Bob chooses a random exponent b satisfying gcd(b, p − 1) = 1, computes v ≡ ub (mod p), and send v to Alice. Alice now computes the inverse of a modulo p − 1, i.e., she solves ax ≡ 1 (mod p − 1) for x. Let a0 = a−1 mod p − 1. Alice computes w ≡ va  0  (mod p)  and sends it to Bob. Finally, Bob computes the inverse b0 = b−1 (mod p − 1) 0 and then wb mod p is equal to m. To see that this last assertion is true, we compute 0  0 0  0 0  0 0  wb ≡ v a b ≡ uba b ≡ maba b  (mod p).  We know that aa0 ≡ 1  (mod 1) (mod p − 1)  and  bb0 ≡ 1 (mod 1) (mod p − 1),  so the exponent aba0 b0 is congruent to 1 modulo p − 1. Then Fermat's little 0 0 theorem tells us that maba b ≡ m (mod p). (c) ElGamal only require Alice to send Bob a single message. This new cryptosystem requires Alice to send Bob two messages and for Bob to send a  46  Exercises for Chapter 2  message back to Alice. So this new system is much more interactive and requires a lot more communication than does ElGamal. (d) The advantage of this new system is that Alice and Bob reveal somewhat less information than in ElGamal. Of course, if Eve can solve the DLP, then since she knows u, v and w, she can solve w ≡ vx  (mod p)  to recover x = a0 , and then she can recover m, because 0  0  ua ≡ maa ≡ m (mod p). However, there does not appear to be an easy way for Eve to break the system if she knows how to solve the Diffie–Hellman Problem. Thus this new cryptosystem is potentially more secure than ElGamal, if it turns out that the DHP is easier to solve than the DLP. Section. An overview of the theory of groups 2.11. The group S3 consists of the following six distinct elements e, σ, σ 2 , τ, στ, σ 2 τ, where e is the identity element and multiplication is performed using the rules σ 3 = e,  τ 2 = 1,  τ σ = σ 2 τ.  Compute the following values in the group S3 : (a) τ σ 2 (b) τ (στ ) (c) (στ )(στ ) (d) (στ )(σ 2 τ ). Is S3 a commutative group? Solution to Exercise 2.11. (a) τ σ 2 = (τ σ)σ = (σ 2 τ )σ = σ 2 (τ σ) = σ 2 (σ 2 τ ) = σ 4 τ = (σ 3 )στ = στ . (b) τ (στ ) = (τ σ)τ = (σ 2 τ )τ = σ 2 τ 2 = σ 2 . (c) (στ )(στ ) = σ(τ σ)τ = σ(σ 2 τ )τ = σ 3 τ 2 = e. (d) (στ )(σ 2 τ ) = σ(τ σ)στ = σ(σ 2 τ )στ = σ 3 (τ σ)τ = e(σ 2 τ )τ = σ 2 τ 2 = σ 2 . No, S3 is not a commutative group. For example τ σ = σ 2 τ , which is different from στ . 2.12. Let G be a group, let d ≥ 1 be an integer, and define a subset of G by G[d] = {g ∈ G : g d = e}. (a) Prove that if g is in G[d], then g −1 is in G[d]. (b) Suppose that G is commutative. Prove that if g1 and g2 are in G[d], then their product g1 ? g2 is in G[d]. (c) Deduce that if G is commutative, then G[d] is a group. (d) Show by an example that if G is not a commutative group, then G[d] need not be a group. (Hint. Use Exercise 2.11.)  Exercises for Chapter 2  47  Solution to Exercise 2.12. (a) For any element h of G and any positive integer n, we have (h−1 )n ? hn = (h−1 ? h−1 ? · · · ? h−1 ) ? (h ? h ? · · · ? h) = e, since there are n copies of h−1 to cancel the n copies of h. Thus (h−1 )n is the inverse of hn , which we can write succintly as (h−1 )n = (hn )−1 . We apply this with h = g and n = d and use the assumption that g d = e to conclude that (g −1 )d = (g d )−1 = e−1 = e. Hence g −1 is in G[d]. (b) We are given that g1d = e and g2d = e. We use the commutativity to compute (g1 g2 )d = g1 g2 g1 g2 · · · g1 g2 = g1d g2d = ee = e. Therefore g1 g2 ∈ G[d]. (c) From (a) and (b), if we start with two elements in G[d], their product and their inverses are in G[d]. Also clearly e is in G[d]. This gives the first two axioms, and the third (associativity) is automatic, since it's true for all elements in G. (d) Using the group S3 in Exercise 2.11, we have τ 2 = e and (στ )2 = e. (The first is true from the description of the group, and the second is true form part (c) of the exercise.) However, (στ )τ = στ 2 = σ does not satisfy σ 2 = e. To see why, note that σ 3 = e, so if also σ 2 = e, then we would have e = σ 3 = (σ 2 )σ = eσ = σ, which is not true. An alternative solution is to use the group of 2-by-2 matrices with integer ¡ ¢ coefficients. The matrix A = ( 01 10 ) satisfies A2 = I and the matrix B = 10 −1 −1 ¡ ¢ 3 satisfies B 2 = I, but AB = 10 −1 −1 actually has order 3, i.e., (AB) = I. 2.13. Let G and H be groups. A function φ : G → H is called a (group) homomorphism if it satisfies φ(g1 ? g2 ) = φ(g1 ) ? φ(g2 )  for all g1 , g2 ∈ G.  (Note that the product g1 ? g2 uses the group law in the group G, while the product φ(g1 ) ? φ(g2 ) uses the group law in the group H.) (a) Let eG be the identity element of G, let eH be the identity element of H, and let g ∈ G. Prove that φ(eG ) = eH  and  φ(g −1 ) = φ(g)−1 .  (b) Let G be a commutative group. Prove that the map φ : G → G defined by φ(g) = g 2 is a homomorphism. Give an example of a noncommutative group for which this map is not a homomorphism. (c) Same question as (b) for the map φ(g) = g −1 . Solution to Exercise 2.13. A solution for this exercise is not currently available.  48  Exercises for Chapter 2  2.14. Prove that each of the following maps is a group homomorphism. (a) The map φ : Z → Z/N Z that sends a ∈ Z to a¡mod N ¢ in Z/N Z. 0 (b) The map φ : R∗ → GL2 (R) defined by φ(a) = a0 a−1 . (c) The discrete logarithm map logg : F∗p → Z/(p−1)Z, where g is a primitive root modulo p. Solution to Exercise 2.14. A solution for this exercise is not currently available. 2.15. (a) Prove that GL2 (Fp ) is a group. (b) Show that GL2 (Fp ) is a noncommutative group for every prime p. (c) Describe GL2 (F2 ) completely. That is, list its elements and describe the multiplication table. (d) How many elements are there in the group GL2 (Fp )? (e) How many elements are there in the group GLn (Fp )? Solution to Exercise 2.15. (a) The identity element is the usual matrix ( 10 01 ). The definition of GL2 (Fp ) ensures that every element has an inverse. Finally, the associative law is true because it's true in general for matrix multiplication. (But feel free to write it out explicitly for the product of three 2-by-2 matrices.) (b) Here's an example of noncommuting matrices: µ ¶µ ¶ µ ¶ µ ¶µ ¶ µ ¶ 11 11 10 21 10 11 . = and = 12 01 11 11 11 01 (If p = 2, then 2 = 0, but they are still different matrices.) (c) The group GL2 (F2 ) has 6 elements: µ ¶ µ ¶ µ ¶ 10 11 01 e= α= β= 01 10 11 µ ¶ µ ¶ µ ¶ 10 11 01 ²= δ= γ= 11 01 10 They satisfy many relations, for example β = α2 and ² = α2 γ. In fact, we can get all 6 elements as e, α, α2 , γ, αγ, α2 γ, and the group operation is determined by the rules α3 = e,  γ 2 = e,  γα = α2 γ.  Comparing with Exercise 2.11 we see that GL2 (F2 ) is the same as the group S3 described in that exercise, we've just named the generating elements α and γ instead of σ and τ . (d) Let α be a matrix in GL2 (Fp ). The first row can be any vector except for the 0 vector, so there are p2 − 1 possibilities for the first row. The second row  Exercises for Chapter 2  49  can be any vector that is not a scalar multiple of the first row. There are p possible scalar multiples of the first row, so there are p2 − p possibilities for the second row. Hence # GL2 (Fp ) = (p1 − 1)(p2 − p) = (p − 1)2 p(p + 1). (e) Using the same reasoning as in (d), there are pn − 1 allowable first rows, then pn − p allowable second rows, then pn − p2 allowable third rows (since we have to disallow all linear combinations of the first two rows), etc. Hence # GLn (Fp ) =  n−1 Y  (pn − pi ).  i=0  Section. How hard is the discrete logarithm problem? 2.16. Verify the following assertions from Example 2.17. ¡ ¢ ¡ ¢ √ (a) x2 + x = O x2 . (d) (ln k)375 = O k 0.001 . ¡ ¢ ¡ ¢ (b) 5 + 6x2 − 37x5 = O x5 . (e) k 2 2k = O e2k . ¡ k¢ ¡ ¢ 300 (c) k =O 2 . (f) N 10 2N = O eN . Solution to Exercise 2.16. A solution for this exercise is not currently available. Section. A Collision Algorithm for the DLP 2.17. Use Shanks's babystep–giantstep method to solve the following discrete logarithm problems. (For (b) and (c), you may want to write a computer program implementing Shanks's algorithm.) (a) 11x = 21 in F71 . (b) 156x = 116 in F593 . (c) 650x = 2213 in F3571 . Solution to Exercise 2.17. √ (a) The number 11 has order 70 in F71 . Set N = d 70 e = 9 and H = h−N = 11−9 = 7. From Table ?? we see that 111 = 21 · 74 = 11  in F71 .  Hence 21 = 111 · 7−4 = 111 · (119 )4 = 1137  in F71 ,  so the solution is x=37 . √ (b) The number 156 has order 148 in F593 . Set N = d 148 e = 13 and H = h−N = 156−13 = 297. From Table ?? we see that 1567 = 116 · 2974 = 452  in F593 .  50  Exercises for Chapter 2 hk 11 50 53 15  k 1 2 3 4  a · Hk 5 35 32 11  Table 2.1: Solve 11x ≡ 21 (mod 71) with babystep–giantstep k 1 2 3 4 5 6 7  hk 156 23 30 529 97 307 452  a · Hk 58 29 311 452 226 113 353  Table 2.2: Solve 156x ≡ 116 (mod 593) via babystep–giantstep  Hence  116 = 1567 · 297−4 = 1567 · (15613 )4 = 15659  in F593 ,  so the solution is x=59 . √ (c) The number h = 650 has order 510 in F3571 . Set N = d 510 e = 23 and H = h−N = 650−23 = 1925. Table ?? lists the values of hk and a · H k for k = 1, 2, . . .. From the table we see that 65020 = 2213 · 192513 = 3011  in F3571 .  Using the fact that 1925 = 650−23 , we compute 2213 = 65020 · 1925−13 = 65020 · (65023 )13 = 650319  in F3571 ,  so the solution is x=319 . Section. The Chinese remainder theorem 2.18. Solve each of the following simultaneous systems of congruences (or explain why no solution exists). k  hk  a · Hk  k  hk  a · Hk  k  hk  a · Hk  k  hk  a · Hk  1 2 3 4 5  650 1122 816 1892 1376  3393 166 1731 432 3128  6 7 8 9 10  1650 1200 1522 133 746  694 396 1677 41 363  11 12 13 14 15  2815 1398 1666 887 1619  2430 3311 3011 442 952  16 17 18 19 20  2476 2450 3405 2801 3011  677 3381 2063 323 421  Table 2.3: Solve 650x ≡ 2213 (mod 3571) using babystep–giantstep  Exercises for Chapter 2 (a) (b) (c) (d) (e)  51  x ≡ 3 (mod 7) and x ≡ 4 (mod 9). x ≡ 137 (mod 423) and x ≡ 87 (mod 191). x ≡ 133 (mod 451) and x ≡ 237 (mod 697). x ≡ 5 (mod 9), x ≡ 6 (mod 10), and x ≡ 7 (mod 11). x ≡ 37 (mod 43), x ≡ 22 (mod 49), and x ≡ 18 (mod 71).  Solution to Exercise 2.18. (a) x ≡ 31 (mod 63). (b) x ≡ 27209 (mod 80793). (c) No solution, since gcd(451, 697) = 41 and 133 and 237 are not congruent to one another modulo 41. (d) x ≡ 986 (mod 990). (e) x ≡ 11733 (mod 149597). 2.19. Solve the 1700-year-old Chinese remainder problem from the Sun Tzu Suan Ching stated on page 82. Solution to Exercise 2.19. In the modern notation, the solution in the Sun Tzu Suan Ching uses the fact that: 70 ≡ 1 (mod 3) 21 ≡ 0 (mod 3) 15 ≡ 0 (mod 3)  ≡ 0 (mod 5) ≡ 1 (mod 5) ≡ 0 (mod 5)  ≡ 0 (mod 7), ≡ 0 (mod 7), ≡ 1 (mod 7).  Hence (2 ∗ 70) + (3 ∗ 21) + (2 ∗ 15) = 233 satisfies the desired congruences. Since any multiple of 105 is divisible by 3, 5 and 7, we can subtract 2 ∗ 105 from 233 to get 23 as the smallest positive solution. Problem 26 is the only problem in the Sun Tzu Suan Ching that illustrates the Chinese remainder theorem. Thus it is not known if the author had developed a general method to solve such problems. 2.20. Let a, b, m, n be integers with gcd(m, n) = 1. Let c ≡ (b − a) · m−1  (mod n).  Prove that x = a + cn is a solution to x ≡ a (mod m)  and  x≡b  (mod n),  (2.1)  and that every solution to (2.24) has the form x = a+cn+ymn for some y ∈ Z. Solution to Exercise 2.20. A solution for this exercise is not currently available. 2.21. Let x = c and x = c0 be two solutions of the system of simultaneous congruences (2.7) in the Chinese remainder theorem (Theorem 2.25). Prove that c ≡ c0 (mod m1 m2 · · · mk ).  52  Exercises for Chapter 2  Solution to Exercise 2.21. A solution for this exercise is not currently available. 2.22. For those who have studied ring theory, this exercise sketches a short, albeit nonconstructive, proof of the Chinese remainder theorem. Let m1 , . . . , mk be integers and let m = m1 m2 · · · mk be their product. (a) Prove that the map Z Z Z Z −−−−→ × × mZ m1 Z m2 Z mk Z a mod m −−−−→ (a mod m1 , a mod m2 , . . . , a mod mk )  (2.2)  is a well-defined homomorphism of rings. (Hint. First define a homomorphism from Z to the right-hand side of (2.25), and then show that mZ is in the kernel.) (b) Assume that m1 , . . . , mk are pairwise relatively prime. Prove that the map given by (2.25) is one-to-one. (Hint. What is the kernel?) (c) Continuing with the assumption that the numbers m1 , . . . , mk are pairwise relatively prime, prove that the map (2.25) is onto. (Hint. Use (b) and count the size of both sides.) (d) Explain why the Chinese remainder theorem (Theorem 2.25) is equivalent to the assertion that (b) and (c) are true. Solution to Exercise 2.22. A solution for this exercise is not currently available. 2.23. Use the method described in Section 2.8.1 to find square roots modulo the following composite moduli. (a) Find a square root of 340 modulo 437. (Note that 437 = 19 · 23.) (b) Find a square root of 253 modulo 3143. (c) Find four square roots of 2833 modulo 4189. (The modulus factors as 4189 = 59 · 71. Note that your four square roots should be distinct modulo 4189.) (d) Find eight square roots of 813 modulo 868. Solution to Exercise 2.23. (a) The square roots of 340 modulo 437 are 146, 215, 222, and 291. (b) The square roots of 253 modulo 3143 are 489, 1387, 1756, 2654. (Note 3143 = 7 · 449 and 449 is prime.) (c) The square roots of 2833 modulo 4189 are 1002, 1712, 2477, and 3187. (d) We factor 868 = 4 · 7 · 31. The eight square roots of 813 modulo 868 are 41, 83, 351, 393, 475, 517, 785, and 827. 2.24. Let p be an odd prime and let b be a square root of a modulo p. This exercise investigates the square root of a modulo powers of p. (a) Prove that for some choice of k, the number b + kp is a square root of a modulo p2 , i.e., (b + kp)2 ≡ a (mod p2 ).  Exercises for Chapter 2  53  (b) The number b = 537 is a square root of a = 476 modulo the prime p = 1291. Use the idea in (a) to compute a square root of 476 modulo p2 . (c) Suppose that b is a square root of a modulo pn . Prove that for some choice of j, the number b + jpn is a square root of a modulo pn+1 . (d) Explain why (c) implies the following statement: If p is an odd prime and if a has a square root modulo p, then a has a square root modulo pn for every power of p. Is this true if p = 2? (e) Use the method in (c) to compute the square root of 3 modulo 133 , given that 92 ≡ 3 (mod 13). Solution to Exercise 2.24. (a),(c),(d) A solution for this exercise is not currently available. (b) (b + k · p)2 ≡ a (mod p2 ) gives 1074k + 223 ≡ 0 (mod p), and hence k ≡ 239 (mod p). This gives 309086 as the square root of a modulo p2 . (e) 9863 is the square root of 3 modulo 133 . 2.25. Suppose n = pq with p and q both primes. (a) Suppose that gcd(a, pq) = 1. Prove that if the equation x2 ≡ a (mod n) has any solutions, then it has four solutions. (b) Suppose you had a machine that could find all four solutions for some given a. How could you use this machine to factor n? Solution to Exercise 2.25. A solution for this exercise is not currently available. Section. The Pohlig–Hellman algorithm 2.26. Let Fp be a finite field and let N | p − 1. Prove that F∗p has an element of order N . This is true in particular for any prime power that divides p − 1. (Hint. Use the fact that F∗p has a primitive root.) Solution to Exercise 2.26. Let g be a primitive root. Then g has order p − 1, so h = g (p−1)/N has order N . 2.27. Write out your own proof that the Pohlig–Hellman algorithm works in the particular case that p − 1 = q1 · q2 is a product of two distinct primes. This provides a good opportunity for you to understand how the proof works and to get a feel for how it was discovered. Solution to Exercise 2.27. A solution for this exercise will not be provided. 2.28. Use the Pohlig–Hellman algorithm (Theorem 2.32) to solve the discrete logarithm problem g x = a in Fp in each of the following cases. (a) p = 433, g = 7, a = 166.  54  Exercises for Chapter 2  (b) p = 746497, g = 10, a = 243278. (c) p = 41022299, g = 2, a = 39183497. (Hint. p = 2 · 295 + 1.) (d) p = 1291799, g = 17, a = 192988. (Hint. p − 1 has a factor of 709.) Solution to Exercise 2.28. (a) Step 1 is to solve q 2 3  h = g (p−1)/q 265 374  e 4 3  e  b = a(p−1)/q 250 335  e  y with hy = b 15 20  Step 2 is to solve x ≡ 15 (mod 24 ),  x ≡ 20 (mod 33 ).  The solution is x=47 . (b) Step 1 is to solve q 2 3  e 10 6  h = g (p−1)/q 4168 674719  e  b = a(p−1)/q 38277 322735  e  y with hy = b 523 681  Step 2 is to solve x ≡ 523 (mod 210 ),  x ≡ 681 (mod 36 ).  The solution is x=223755 . (c) Step 1 is to solve q 2 29  e 1 5  h = g (p−1)/q 41022298 4  e  b = a(p−1)/q 1 11844727  e  y with hy = b 0 13192165  In order to solve the discrete logarithm problem modulo 295 , it is best to solve 4 it step by step. Note that 429 = 18794375 is an element of order 29 in F∗p . To avoid notational confusion, we use the letter u for the exponents. ¡ ¢294 First solve 18794375u0 = 11844727 = 987085. The solution is u0 = 7. The value of u so far is u = 7. ¡ ¢293 Solve 18794375u1 = 11844727·4−7 = 8303208. The solution is u1 = 8. The value of u so far is u = 239 = 7 + 8 · 29. ¡ ¢292 Solve 18794375u2 = 11844727 · 4−239 = 30789520. The solution is u2 = 26. The value of u so far is u = 22105 = 7 + 8 · 29 + 26 · 292 . ¡ ¢291 Solve 18794375u3 = 11844727 · 4−22105 = 585477. The solution is u3 = 18. The value of u so far is u = 461107 = 7 + 8 · 29 + 26 · 292 + 18 · 293 . ¡ ¢290 Solve 18794375u4 = 11844727 · 4−461107 = 585477. The solution is u4 = 18. The final value of u is u = 13192165 = 7 + 8 · 29 + 26 · 292 + 18 · 293 + 18 · 294 , which is the number you see in the last column of the table.  Exercises for Chapter 2  55  Step 2 is to solve x ≡ 13192165 (mod 295 ).  x ≡ 0 (mod 2), The solution is x=33703314 . (d) Step 1 is to solve q 2 709 911  e 1 1 1  h = g (p−1)/q 1291798 679773 329472  e  b = a(p−1)/q 1 566657 898549  e  y with hy = b 0 322 534  There is no magical way to solve the DLP's modulo 709 or 911, although they are easily solved by an exhaustive search on a computer, and a collision algorithm is even faster. Step 2 is to solve x ≡ 0 (mod 2),  x ≡ 322 (mod 709),  x ≡ 534 (mod 911).  The solution is x=984414 . Section. Rings, quotient rings, polynomial rings, and finite fields 2.29. Let R be a ring with the property that the only way that a product a · b can be 0 is if a = 0 or b = 0. (In the terminology of Example 2.56, the ring R has no zero divisors.) Suppose further that R has only finitely many elements. Prove that R is a field. (Hint. Let a ∈ R with a 6= 0. What can you say about the map R → R defined by b 7→ a · b?) Solution to Exercise 2.29. A solution for this exercise is not currently available. 2.30. Let R be a ring. Prove the following properties of R directly from the ring axioms described in Section 2.10.1. (a) Prove that the additive identity element 0 ∈ R is unique, i.e., prove that there is only one element in R satisfying 0+a = a+0 = 0 for every a ∈ R. (b) Prove that the multiplicative identity element 1 ∈ R is unique. (c) Prove that every element of R has a unique additive inverse. (d) Prove that 0 ? a = a ? 0 = 0 for all a ∈ R. (e) We denote the additive inverse of a by −a. Prove that −(−a) = a. (f) Let −1 be the additive inverse of the multiplicative identity element 1 ∈ R. Prove that (−1) ? (−1) = 1. (g) Prove that b | 0 for every nonzero b ∈ R. (h) Prove that an element of R has at most one multiplicative inverse. Solution to Exercise 2.30. (a) If 0 and 00 are both additive identities, then 00 = 00 + 0 = 0.  56  Exercises for Chapter 2  (b) If 1 and 10 are both multiplicative identities, then 10 = 10 ? 1 = 1. (c) If b and c are both additive inverses of a, then b = b + 0 = b + (c + b0 ) = (b + c) + b0 = 0 + b0 = b0 . (d) 0 ? a = (0 + 0) ? a = (0 ? a) + (0 ? a). Subtracting 0 ? a from both sides give 0 ? a = 0. (Note "subtraction" really means to add the additive inverse.) (e) Let b = −(−a). Then by definition, b + (−a) = 0. But we also know by definition that a + (−a) = 0. Since additive inverses are unique from (c), it follows that b = a. (f) To ease notation, we let i = 1 and u = −1. Then 0 = 0 ? u = (i + u) ? u = (i ? u) + (u ? u) = u + (u ? u). Thus u?u is the additive inverse of u. Using (e) gives (−1)?(−1) = −(−1) = 1. (g) We have b ? 0 = 0 from (d), so b | 0 by definition of divisibility. (h) Let a ∈ R and suppose that ab = 1 and ac = 1, so b and c are both multiplicative inverses of a. Then b = b · 1 = b · (a · c) = (a · b) · c = 1 · c = c. Thus b = c, so a has at most one multiplicative inverse. 2.31. Prove Proposition 2.42. Solution to Exercise 2.31. A solution for this exercise is not currently available. 2.32. Prove Proposition 2.44. (Hint. First use Exercise 2.31 to prove that the congruence classes a + b and a ? b depend only on the congruence classes of a and b.) Solution to Exercise 2.32. A solution for this exercise is not currently available. 2.33. Let F be a field and let a and b be nonzero polynomials in F[x]. (a) Prove that deg(a · b) = deg(a) + deg(b). (b) Prove that a has a multiplicative inverse in F[x] if and only if a is in F, i.e., if and only if a is a constant polynomial. (c) Prove that every nonzero element of F[x] can be factored into a product of irreducible polynomials. (Hint. Use (a), (b), and induction on the degree of the polynomial.)  Exercises for Chapter 2  57  (d) Let R be the ring Z/6Z. Give an example to show that (a) is false for some polynomials a and b in R[x]. Solution to Exercise 2.33. (a) A solution for this exercise is not currently available. (b) If a · b = 1, then taking degrees and using (a) gives 0 = deg(1) = deg(a · b) = deg(a) + deg(b). The degree of a nonzero polynomial is a nonnegative integer, so we conclude that deg(a) = deg(b) = 0. Hence a and b are constant polynomials. (c) Polynomials of degree 0 and 1 are already irreducible. Suppose we know that every polynomial of degree smaller than n can be factored into a product of irreducible polynomials, and let a ∈ F[x] have degree n. If a is itself irreducible, we're done. Otherwise it factors as a = b · c, where neither b nor c is a unit. It follows from (b) that b and c both have degree at least 1, so using (a) we find that b and c have degrees that are strictly smaller than the degree of a. Hence by induction, both b and c can be factored as a product of irreducible polynomials. But then their product, which equals a, is also a product of irreducible polynomials. (d) Let a = 2x + 1 and bf b = 3x + 1, then a · b = 6x2 + 5x + 1 = 5x + 1, since 6 = 0 in Z/6Z. Hence deg(a) = deg(b) = deg(a · b) = 1, so the degree formula in (a) is false. 2.34. Let a and b be the polynomials a = x5 + 3x4 − 5x3 − 3x2 + 2x + 2, b = x5 + x4 − 2x3 + 4x2 + x + 5. Use the Euclidean algorithm to compute gcd(a, b) in each of the following rings. (a) F2 [x] (b) F3 [x] (c) F5 [x] (d) F7 [x]. Solution to Exercise 2.34. (a) gcdF2 [x] (a, b) = x3 + x2 + x + 1. (b) gcdF3 [x] (a, b) = x2 + x + 2. (c) gcdF5 [x] (a, b) = x + 4. (d) gcdF7 [x] (a, b) = 1. (Note for instructor: The resultant of a and b is −23 · 32 · 5 · 59 · 107, so gcd(a, b) = 1 in Fp [x] unless p ∈ {2, 3, 5, 59, 107}.) 2.35. Continuing with the same polynomials a and b as in Exercise 2.34, for each of the polynomial rings (a), (b), (c), and (d) in Exercise 2.34, find polynomials u and v satisfying a · u + b · v = gcd(a, b).  58  Exercises for Chapter 2  Solution to Exercise 2.35. (a) u = 1 and v = 1. (b) u = x + 1 and v = 2x. (c) u = 3x3 + 4x2 + x + 2 and v = 2x3 + x. (d) u = 3x4 + 3x3 + x2 + 5x + 4 and v = 4x4 + 5x3 + x2 + 2x. 2.36. Prove that the polynomial x3 + x + 1 is irreducible in F2 [x]. (Hint. Think about what a factorization would have to look like.) Solution to Exercise 2.36. If x3 + x + 1 factors, then it can be written as the product of a linear polynomial and a quadratic polynomial. Since the only possible coefficients are 0 and 1, this means we would have x3 + x + 1 = (x + a)(x2 + bx + c)  in F2 [x].  Putting x = 0 yields 1 = ac, so we must have a = c = 1. (Remember that a and c are in F2 , so they are either 0 or 1.) Now we have x3 + x + 1 = (x + 1)(x2 + bx + 1), and putting x = 1 yields 1 = 2 · (2 + b) = 0. This contradiction shows that x3 + x + 1 does not factor in F2 [x]. 2.37. The multiplication table for the field F2 [x]/(x3 + x + 1) is given in Table 2.5, but we have omitted fourteen entries. Fill in the missing entries. (This is the field described in Example 2.58. You can download and print a copy of Table 2.5 at www.math.brown.edu/~jhs/MathCrypto/Table2.5. pdf.) Solution to Exercise 2.37. Note that it's not necessary to compute both a · b and b · a. Half missing entries in the table are 1 · x2 = x2 x · (x2 + x) = x2 + x + 1 x2 · x = x + 1 (x + 1) · 1 = x + 1 (x2 + 1) · (x + 1) = x2 (x2 + x) · (x2 + x + 1) = x2 (x2 + x + 1) · (x2 + 1) = x2 + x.  The other half are the same products in the opposite order.  Exercises for Chapter 2 x  x2  1+x  1 + x2  x + x2  0  0  0  0  1  x x2  0 1 + x2  0 x + x2  0  1  0  0  1  0  x  x  0  x2  0  1+x 1 + x2  0  0  1 + x2 x + x2  1  x + x2 1 + x + x2  0  1 + x + x2  1 + x2  0  59  x + x2 x + x2  1 + x + x2  x + x2 1 + x + x2 1 + x2  x 1 + x2  1  1  x  1 x  1 + x + x2 0 1 + x + x2 1 + x2  1 + x2  1  1  x  1 + x + x2  1+x  1+x  x 1+x  Table 2.4: Multiplication table for the field F2 [x]/(x3 + x + 1)  2.38. The field F7 [x]/(x2 + 1) is a field with 49 elements, which for the moment we denote by F49 . (See Example 2.59 for a convenient way to work with F49 .) (a) Is 2 + 5x a primitive root in F49 ? (b) Is 2 + x a primitive root in F49 ? (c) Is 1 + x a primitive root in F49 ? (Hint. Lagrange's theorem says that the order of u ∈ F49 must divide 48. So if uk 6= 1 for all proper divisors k of 48, then u is a primitive root.) Solution to Exercise 2.38. (a) No, (2 + x)8 = 1. (b) Yes. It suffices to check that (2 + x)16 = 4 and (2 + x)24 = 6 are not equal to 1. (c) No, (1 + x)24 = 1. 2.39. Let p be a prime number and let e ≥ 2. The quotient ring Z/pe Z and the finite field Fpe are both rings and both have the same number of elements. Describe some ways in which they are intrinsically different. Solution to Exercise 2.39. Every nonzero element in the field Fpe has a multiplicative inverse, while Z/(pe ) has lots of elements that do not have inverses, for example all elements of the form kp with 1 ≤ k < pe−1 . In the field Fpe , if a product ab = 0, then either a = 0 or b = 0. (To see this, note that if a 6= 0, then a−1 exists, so multiplying ab = 0 by a−1 shows that b = 0.) On the other hand, Z/(pe ) does not have this property. For example, p · pe−1 = 0, but neither p nor pe−1 is 0 e in Z/(pe ). A subtler property is that every element α of Fpe satisfies αp = α, e but this is not true in Z/(pe ). For example, if we take α = p, the αp = 0. 2.40. Let F be a finite field. (a) Prove that there is an integer m ≥ 1 such that if we add 1 to itself m times, 1 + 1 + · · · + 1, | {z } m ones  60  Exercises for Chapter 2  then we get 0. Note that here 1 and 0 are the multiplicative and additive identity elements of the field F. If the notation is confusing, you can let u and z be the multiplicative and additive identity elements of F, and then you need to prove that u + u + · · · + u = z. (Hint. Since F is finite, the numbers 1, 1 + 1, 1 + 1 + 1,. . . cannot all be different.) (b) Let m be the smallest positive integer with the property described in (a). Prove that m is prime. (Hint. If m factors, show that there are nonzero elements in F whose product is zero, so F cannot be a field.) This prime is called the characteristic of the field F. (c) Let p be the characteristic of F. Prove that F is a finite-dimensional vector space over the field Fp of p elements. (d) Use (c) to deduce that F has pd elements for some d ≥ 1. Solution to Exercise 2.40. (a) The fact that F is finite means that when we look at 1,  1 + 1,  1 + 1 + 1,  1 + 1 + 1 + 1, . . .  eventually we get a repeated value. Subtracting the smaller number of terms from the larger, it follows that some sum of 1's is equal to 0 in F. (b) Suppose that m factors as m = qr. Then we have 1 + 1 + · · · + 1 · 1 + 1 + · · · + 1 = 1 + 1 + · · · + 1 = 0. | {z } | {z } | {z } q ones  r ones  m ones  Since F is a field, the only way for a product to be 0 is for one of the factors to be 0, so we have either 1 + 1 + ··· + 1 = 0 | {z }  or  q ones  1 + 1 + ··· + 1 = 0 | {z }  in F.  r ones  But we defined m to be the smallest number of 1's that sums to 0, so either q ≥ m or r ≥ m. Since we also have m = qr, it follows that either q = m (and r = 1) or r = m (and q = 1). This proves that m is prime. (c) It follows that we have a copy of Fp inside F by sending 1 to 1 and 1 + 1 to 1 + 1, etc. The axioms for a field show that this makes F into a vector space using Fp as scalars. By standard linear algebra, F has a basis as a vector space over Fp , and the basis is finite since F itself is finite. Hence F is a finite-dimensional vector space over Fp . (d) Let v1 , . . . , vd be a basis for F as a vector space over Fp . Then every element of F can be written uniquely as a1 v1 + a2 v2 + · · · + ad vd  with a1 , . . . , ad ∈ Fp .  There are p choices of a1 , and p choices of a2 , and p choices of a3 , etc. So there are pd distinct elements in F.  Chapter 3  Integer Factorization and RSA Exercises for Chapter 3 Section. Euler's theorem and roots modulo pq 3.1. Solve the following congruences. (a) x19 ≡ 36 (mod 97). (b) x137 ≡ 428 (mod 541). (c) x73 ≡ 614 (mod 1159). (d) x751 ≡ 677 (mod 8023). (e) x38993 ≡ 328047 (mod 401227). (Hint. 401227 = 607 · 661.) Solution to Exercise 3.1. (a) 97 is prime. The congruence 19d ≡ 1 (mod 96) has solution d ≡ 91 (mod 96). Then x ≡ 3691 ≡ 36 (mod 97). (b) 541 is prime. The congruence 137d ≡ 1 (mod 540) has solution d ≡ 473 (mod 540). Then x ≡ 428473 ≡ 213 (mod 541). (c) 1159 = 19 · 61 and 18 · 60 = 1080. The congruence 73d ≡ 1 (mod 1080) has solution d ≡ 577 (mod 1080). Then x ≡ 614577 ≡ 158 (mod 1159). More efficiently, g = gcd(18, 60) = 6 and (18)(60)/6 = 180. The congruence 73d ≡ 1 (mod 180) has solution d ≡ 37 (mod 180). Then x ≡ 61437 ≡ 158 (mod 1159). (d) 8023 = 71 · 113 and 71 · 112 = 7840. The congruence 751d ≡ 1 (mod 7840) has solution d ≡ 7151 (mod 7840). Then x ≡ 6777151 ≡ 1355 (mod 8023). More efficiently, g = gcd(70, 112) = 14 and (70)(112)/14 = 560. The congruence 751d ≡ 1 (mod 560) has solution d ≡ 431 (mod 560). Then x ≡ 677431 ≡ 1355 (mod 8023). (e) 401227 = 607 · 661 and 608 · 660 = 399960. The congruence 38993d ≡ 1 (mod 399960) has the solution d ≡ 265457 (mod 399960). Then x ≡ 61  62  Exercises for Chapter 3  328047265457 ≡ 36219 (mod 401227). More efficiently, g = gcd(606, 660) = 6 and (606)(660)/6 = 66660. The congruence 38993d ≡ 1 (mod 66660) has the solution d ≡ 65477 (mod 66660). Then x ≡ 32804765477 ≡ 36219 (mod 401227). 3.2. Let p and q be distinct primes and let e and d be integers satisfying de ≡ 1 (mod (p − 1)(q − 1)). Suppose further that c is an integer with gcd(c, pq) > 1. Prove that x ≡ cd (mod pq) is a solution to the congruence  xe ≡ c (mod pq),  thereby completing the proof of Proposition 3.4. Solution to Exercise 3.2. If pq | c, then the solution is x = 0. So the interesting case is when c is divisible by exactly one of p and q, say p | c and q - c. Then x ≡ cd ≡ 0 (mod p) is a solution to xe ≡ c ≡ 0 (mod p), so we only need to check that it is true modulo q. We compute (cd )e ≡ c1+k(p−1)(q−1) ≡ c · (cq−1 )k(p−1) ≡ c (mod q), since cq−1 ≡ 1 (mod q) from Fermat's little theorem. 3.3. Recall from Section 1.3 that Euler's phi function φ(N ) is the function defined by φ(N ) = #{0 ≤ k < N : gcd(k, N ) = 1}. In other words, φ(N ) is the number of integers between 0 and N − 1 that are relatively prime to N , or equivalently, the number of elements in Z/N Z that have inverses modulo N . (a) Compute the values of φ(6), φ(9), φ(15), and φ(17). (b) If p is prime, what is the value of φ(p)? (c) Prove Euler's formula aφ(N ) ≡ 1  (mod N )  for all integers a satisfying gcd(a, N ) = 1.  (Hint. Mimic the proof of Fermat's little theorem (Theorem 1.25), but instead of looking at all of the multiples of a as was done in (1.8), just take the multiples ka of a for values of k satisfying gcd(k, N ) = 1.) Solution to Exercise 3.3. A solution for this exercise is not currently available. 3.4. Euler's phi function has many beautiful properties. (a) If p and q are distinct primes, how is φ(pq) related to φ(p) and φ(q)?  Exercises for Chapter 3  63  (b) If p is prime, what is the value of φ(p2 )? How about φ(pj )? Prove that your formula for φ(pj ) is correct. (Hint. Among the numbers between 0 and pj − 1, remove the ones that have a factor of p. The ones that are left are relatively prime to p.) (c) Let M and N be integers satisfying gcd(M, N ) = 1. Prove the multiplication formula φ(M N ) = φ(M )φ(N ). (d) Let p1 , p2 , . . . , pr be the distinct primes that divide N . Use your results from (b) and (c) to prove the following formula: φ(N ) = N  r µ Y  1−  i=1  1 pi  ¶ .  (e) Use the formula in (d) to compute the following values of φ(N ). (i) φ(1728). (ii) φ(1575). (iii) φ(889056) (Hint. 889056 = 25 · 34 · 73 ). Solution to Exercise 3.4. (a)–(d) A solution for this exercise is not currently available. (e) (i) φ(1728) = 576, (ii) φ(1575) = 720, (iii) φ(889056) = 254016. 3.5. Let¡N , c, and ¢ e be positive integers satisfying the conditions gcd(N, c) = 1 and gcd e, φ(N ) = 1. (a) Explain how to solve the congruence xe ≡ c (mod N ), assuming that you know the value of φ(N ). (Hint. Use the formula in Exercise 3.3(c).) (b) Solve the following congruences. (The formula in Exercise 3.4(d) may be helpful for computing the value of φ(N ).) (i) x577 ≡ 60 (mod 1463). (ii) x959 ≡ 1583 (mod 1625). (iii) x133957 ≡ 224689 (mod 2134440). Solution to Exercise 3.5. (a) A solution for this exercise is not currently available. (b) (i) N = 7 · 11 · 19, so ¶µ ¶µ ¶ µ 1 1 1 1− 1− = 1080. φ(1463) = 1463 1 − 7 11 19 We compute d ≡ 577−1 ≡ 73 (mod 1080), so x ≡ 6073 ≡ 1390  (mod 1463).  64  Exercises for Chapter 3  Check: 1390577 ≡ 60 (mod 1463). X (ii) N = 53 · 13, so ¶µ ¶ µ 1 1 φ(1625) = 1625 1 − 1− = 1200. 5 13 We compute d ≡ 959−1 ≡ 239 (mod 1200), so x ≡ 1583239 ≡ 147  (mod 1625).  Check: 147959 ≡ 1583 (mod 1625). X (iii) N = 23 · 32 · 5 · 72 · 112 , so µ ¶µ ¶µ ¶µ ¶µ ¶ 1 1 1 1 1 φ(2134440) = 2134440 1 − 1− 1− 1− 1− 2 3 5 7 11 = 443520. We compute d ≡ 133957−1 ≡ 326413 (mod 443520), so x ≡ 224689326413 ≡ 1892929  (mod 2134440).  Check: 1892929133957 ≡ 224689 (mod 2134440). X Section. The RSA public key cryptosystem 3.6. Alice publishes her RSA public key: modulus N = 2038667 and exponent e = 103. (a) Bob wants to send Alice the message m = 892383. What ciphertext does Bob send to Alice? (b) Alice knows that her modulus factors into a product of two primes, one of which is p = 1301. Find a decryption exponent d for Alice. (c) Alice receives the ciphertext c = 317730 from Bob. Decrypt the message. Solution to Exercise 3.6. (a) Bob sends c = me = 892383103 ≡ 45293 (mod 2038667). (b) The modulus is N = 2038667 = 1301 · 1567, so φ(N ) = 1300 · 1568 = 2035800. A decryption exponent is given by a solution to 103d ≡ 1  (mod 2035800).  The solution is d ≡ 810367 (mod 2035800). (c) Alice needs to solve m103 ≡ 317730 (mod 2038667). Raising both sides to the dth power, where d = 810367 is her decryption exponent, yields m ≡ 317730810367 ≡ 514407  (mod 2038667).  Exercises for Chapter 3  65  3.7. Bob's RSA public key has modulus N = 12191 and exponent e = 37. Alice sends Bob the ciphertext c = 587. Unfortunately, Bob has chosen too small a modulus. Help Eve by factoring N and decrypting Alice's message. (Hint. N has a factor smaller than 100.) Solution to Exercise 3.7. The modulus factors as N = 12191 = 73 · 167, so φ(N ) = 72 · 168 = 11952. The congruence 37d ≡ 1 (mod 11952) has solution d ≡ 11629 (mod 11952). Then m ≡ 58711629 ≡ 4894  (mod 12191)  is a solution to m37 ≡ 587 (mod 12191). It is possible to be a bit more efficient, using the fact that g = gcd(72, 166) = 2 and (72)(166)/2 = 5976. Thus a solution to the congruence 37d ≡ 1 (mod 5976) is a decryption exponent, giving the smaller decryption exponent d ≡ 5653 (mod 5976). Of course, this gives the same plaintext m ≡ 5875653 ≡ 4894  (mod 12191).  3.8. For each of the given values of N = pq and (p − 1)(q − 1), use the method described in Remark 3.10 to determine p and q. (a) N = pq = 352717 and (p − 1)(q − 1) = 351520. (b) N = pq = 77083921 and (p − 1)(q − 1) = 77066212. (c) N = pq = 109404161 and (p − 1)(q − 1) = 109380612. (d) N = pq = 172205490419 and (p − 1)(q − 1) = 172204660344. Solution to Exercise 3.8. (a) Suppose that N = pq = 352717 and (p − 1)(q − 1) = 351520. Then p + q = N + 1 − (p − 1)(q − 1) = 1198, so X 2 − (p + q)X + N = X 2 − 1198X + 352717 = (X − 677)(X − 521). Hence N = 352717 = 677 · 521. (b) Suppose that N = pq = 77083921 and (p − 1)(q − 1) = 77066212. Then p + q = N + 1 − (p − 1)(q − 1) = 17710, so X 2 − (p + q)X + N = X 2 − 17710X + 77083921 = (X − 10007)(X − 7703). Hence N = 77083921 = 10007 · 7703. (c) Suppose that N = pq = 109404161 and (p − 1)(q − 1) = 109380612. Then p + q = N + 1 − (p − 1)(q − 1) = 23550, so  66  Exercises for Chapter 3  X 2 − (p + q)X + N = X 2 − 23550X + 109404161 = (X − 6367)(X − 17183). Hence N = 109404161 = 6367 · 17183. (d) Suppose that N = pq = 172205490419 and (p − 1)(q − 1) = 172204660344. Then p + q = N + 1 − (p − 1)(q − 1) = 830076, so X 2 −(p+q)X+N = X 2 −830076X+172205490419 = (X−407893)(X−422183). Hence N = 172205490419 = 407893 · 422183. 3.9. A decryption exponent for an RSA public key (N, e) is an integer d with the property that ade ≡ a (mod N ) for all integers a that are relatively prime to N . (a) Suppose that Eve has a magic box that creates decryption exponents for (N, e) for a fixed modulus N and for a large number of different encryption exponents e. Explain how Eve can use her magic box to try to factor N . (b) Let N = 38749709. Eve's magic box tells her that the encryption exponent e = 10988423 has decryption exponent d = 16784693 and that the encryption exponent e = 25910155 has decryption exponent d = 11514115. Use this information to factor N . (c) Let N = 225022969. Eve's magic box tells her the following three encryption/decryption pairs for N : (70583995, 4911157),  (173111957, 7346999),  (180311381, 29597249).  Use this information to factor N . (d) Let N = 1291233941. Eve's magic box tells her the following three encryption/decryption pairs for N : (1103927639, 76923209),  (1022313977, 106791263),  (387632407, 7764043).  Use this information to factor N . Solution to Exercise 3.9. Let e1 , e2 , . . . , en be a bunch of random encryption exponents, and suppose that Eve uses her magic box to create decryption exponents d1 , d2 , . . . , dn . The numbers K with the property that aK ≡ a (mod N ) for all a satisfying gcd(a, N ) = 1 are numbers satisfying µ ¶ (p − 1)(q − 1) K ≡ 1 mod . gcd(p − 1, q − 1) Thus di ei − 1 is a multiple of (p − 1)(q − 1)/ gcd(p − 1, q − 1) for all 1 ≤ i ≤ n. Assuming that the ei 's are reasonably random, Eve will find that T = gcd(d1 e1 − 1, d2 e2 − 1, d3 e3 − 1, . . . , dn en − 1)  (3.1)  Exercises for Chapter 3  67  is equal to a small multiple of (p − 1)(q − 1) . gcd(p − 1, q − 1) Next Eve uses the fact that gcd(p − 1, q − 1) is even and tends to be fairly small. So she first assumes that T = (p − 1)(q − 1)/2 and uses this to compute R = N + 1 − (p − 1)(q − 1) = N + 1 − 2T . If she is right about the value of T , then R will equal p+q, and she can recover p and q by factoring x2 −T x+N . If this doesn't work, she repeats the process with R = N +1−3T , R = N +1−4T , etc. Continuing in this fashion, she should recover p and q fairly quickly. Eve can save a bit of time in finding the right multiple of T . The idea is that N + 1 − kT should equal p + q, and in practice p and q will have √ more or less the same order of magnitude. So Eve wants N + 1 − kT ≈ 2 N , which √ means that she should take k ≈ (N + 1 − 2 N )/T . (b) gcd(16784693 · 10988423 − 1,11514115 · 25910155 − 1) = gcd(184437306609138, 298332504337824) = 19368558 First Eve tries N + 1 − 1 · gcd = 19381152, but x2 − 19381152x + 38749709 is irreducible. Next she tries N + 1 − 2 · gcd = 12594, and this time she finds that x2 − 12594x + 38749709 = (x − 7247)(x − 5347). Hence N = 38749709 = 7247 · 5347. (c) gcd(4911157 · 70583995 − 1, 7346999 · 173111957 − 1, 29597249 · 180311381 − 1) = gcd(346649081132214, 1271853374967042, 5336720840990868) = 37498566 √ Eve computes ( 225022969 − 1)2 /37498566 ≈ 6.00004193, which suggests that she should try N + 1 − 6 · gcd = 31574. This given x2 − 31574x + 225022969 = (x − 20707)(x − 10867). Hence N = 225022969 = 20707 · 10867. (d) gcd(76923209 · 1103927639 − 1, 106791263 · 1022313977 − 1, 7764043 · 387632407 − 1) = gcd(84917656495673550, 109174200786382950, 3009594676141500) = 129112350  68  Exercises for Chapter 3  √ Eve computes ( 1291233941 − 1)2 /129112350 ≈ 10.0002987, which suggests that she should use N + 1 − 10 · gcd = 110442. This yields x2 − 110442x + 1291233941 = (x − 97151)(x − 13291). Hence N = 1291233941 = 97151 · 13291. 3.10. Here is an example of a public key system that was proposed at a cryptography conference. It is supposed to be faster and more efficient than RSA. Alice chooses two large primes p and q and she publishes N = pq. It is assumed that N is hard to factor. Alice also chooses three random numbers g, r1 , and r2 modulo N and computes g1 ≡ g r1 (p−1)  (mod N )  and  g2 ≡ g r2 (q−1)  (mod N ).  Her public key is the triple (N, g1 , g2 ) and her private key is the pair of primes (p, q). Now Bob wants to send the message m to Alice, where m is a number modulo N . He chooses two random integers s1 and s2 modulo N and computes c1 =≡ mg1s1  (mod N )  and  c2 ≡ mg2s2  (mod N ).  Bob sends the ciphertext (c1 , c2 ) to Alice. Decryption is extremely fast and easy. Alice use the Chinese remainder theorem to solve the pair of congruences x ≡ c1  (mod p)  and  x ≡ c2  (mod q).  (a) Prove that Alice's solution x is equal to Bob's plaintext m. (b) Explain why this cryptosystem is not secure. Solution to Exercise 3.10. (a) Notice that c1 ≡ mg1s1 ≡ mg s1 r1 (p−1) ≡ m (mod p) by Fermat's little theorem, and similarly c2 ≡ m (mod q). Hence Alice's solutions satisfies x ≡ m (mod pq). (b) As in (a), we observe that g1 ≡ 1 (mod p) from Fermat's little theorem. On the other hand, most likely g1 6≡ 1 (mod q). So Eve can recover p from the trivial gcd computation gcd(g1 − 1, N ) = p. (If, by some rare coincidence, g1 ≡ 1 (mod q), then c1 ≡ m (mod N ), so although Eve cannot factor N , she can read Bob's message.) Section. Implementation and security issues  Exercises for Chapter 3  69  3.11. Formulate a man-in-the-middle attack, similar to the attack described in Example 3.12 on page 122, for the following public key cryptosystems. (a) The ElGamal public key cryptosystem (Table 2.3 on page 70). (b) The RSA public key cryptosystem (Table 3.1 on page 119). Solution to Exercise 3.11. A solution for this exercise is not currently available. 3.12. Alice decides to use RSA with the public key N = 1889570071. In order to guard against transmission errors, Alice has Bob encrypt his message twice, once using the encryption exponent e1 = 1021763679 and once using the encryption exponent e2 = 519424709. Eve intercepts the two encrypted messages c1 = 1244183534 and c2 = 732959706. Assuming that Eve also knows N and the two encryption exponents e1 and e2 , use the method described in Example 3.14 to help Eve recover Bob's plaintext without finding a factorization of N . Solution to Exercise 3.12. With notation as in Example 3.14, we find that u · c1 + v · c2 = 1 with u = 252426389  and  v = −496549570.  Then the plaintext is m ≡ cu1 · cv2 ≡ 1054592380 (mod N ). Section. Primality testing 3.13. We stated that the number 561 is a Carmichael number, but we never checked that a561 ≡ a (mod 561) for every value of a. (a) The number 561 factors as 3 · 11 · 17. First use Fermat's little theorem to prove that a561 ≡ a (mod 3),  a561 ≡ a (mod 11),  and  a561 ≡ a (mod 17)  for every value of a. Then explain why these three congruences imply that a561 ≡ a (mod 561) for every value of a. (b) Mimic the idea used in (a) to prove that each of the following numbers is a Carmichael number. (To assist you, we have factored each number into primes.) (i) 1729 = 7 · 13 · 19 (ii) 10585 = 5 · 29 · 73  70  Exercises for Chapter 3 (iii) 75361 = 11 · 13 · 17 · 31 (iv) 1024651 = 19 · 199 · 271  (c) Prove that a Carmichael number must be odd. (d) Prove that a Carmichael number must be a product of distinct primes. (e) Look up Korselt's criterion in a book or online, write a brief description of how it works, and use it to show that 29341 = 13·37·61 and 172947529 = 307 · 613 · 919 are Carmichael numbers. Solution to Exercise 3.13. A solution for this exercise is not currently available. Here is a list of all Carmichael up to 100000, plus a few others. • 561 = 3 · 11 · 17 • 1105 = 5 · 13 · 17 • 1729 = 7 · 13 · 19 • 2465 = 5 · 17 · 29 • 2821 = 7 · 13 · 31 • 6601 = 7 · 23 · 41 • 8911 = 7 · 19 · 67 • 10585 = 5 · 29 · 73 • 15841 = 7 · 31 · 73 • 29341 = 13 · 37 · 61 • 41041 = 7 · 11 · 13 · 41 • 46657 = 13 · 37 · 97 • 52633 = 7 · 73 · 103 • 62745 = 3 · 5 · 47 · 89 • 63973 = 7 · 13 · 19 · 37 • 75361 = 11 · 13 · 17 · 31 • 294409 = 37 · 73 · 109 • 56052361 = 211 · 421 · 631 • 118901521 = 271 · 541 · 811 • 172947529 = 307 · 613 · 919  Exercises for Chapter 3  71  • 1024651 = 19 · 199 · 271 3.14. Use the Miller–Rabin test on each of the following numbers. In each case, either provide a Miller–Rabin witness for the compositeness of n, or conclude that n is probably prime by providing 10 numbers that are not Miller–Rabin witnesses for n. (a) (b) (d) (f)  n = 1105. (Yes, 5 divides n, but this is just a warm-up exercise!) n = 294409 (c) n = 294409 n = 118901509 (e) n = 118901521 n = 118901527 (g) n = 118915387  Solution to Exercise 3.14. (a) n − 1 = 1104 = 24 · 69. 269 ≡ −138 (mod 1105) 22·69 ≡ 259  (mod 1105)  4·69  ≡ −324 (mod 1105)  8·69  ≡1  2 2  (mod 1105)  Thus 1105 is composite. It factors as n = 5 · 13 · 17. (b) n − 1 = 294408 = 23 · 36801. 236801 ≡ 512  (mod 294409)  2·36801  ≡ −32265  (mod 294409)  4·36801  ≡1  (mod 294409)  2 2  Thus 294409 is composite. It factors as n = 37 · 73 · 109. (c) n − 1 = 294438 = 21 · 147219. 2147219 ≡ 1  (mod 294439)  147219  ≡ −1 (mod 294439)  147219  ≡1  3 5  (mod 294439)  Thus 2, 3, 5 are not Miller–Rabin witnesses for 294439. It turns out that 294439 is prime. (d) n − 1 = 118901508 = 22 · 29725377.  72  Exercises for Chapter 3 229725377 ≡ 7906806  (mod 118901509)  2·29725377  ≡ −1  (mod 118901509)  29725377  3  ≡ −1  (mod 118901509)  2·29725377  ≡1  (mod 118901509)  5  ≡ −1  (mod 118901509)  2·29725377  ≡1  (mod 118901509)  2 3  29725377  5  29725377  7  ≡ 7906806  (mod 118901509)  2·29725377  ≡ −1  (mod 118901509)  29725377  ≡ −1  (mod 118901509)  ≡1  (mod 118901509)  7  11 11  2·29725377  Thus 2, 3, 5, 7, and 11 are not Miller–Rabin witnesses for 118901509. It turns out that 118901509 is prime. (e) n − 1 = 118901520 = 24 · 7431345 27431345 ≡ 45274074 (mod 118901521) 22·7431345 ≡ 1758249 (mod 118901521) 24·7431345 ≡ 1 (mod 118901521) 28·7431345 ≡ 1 (mod 118901521) Thus 118901521 is composite. It factors as 118901521 = 271 · 541 · 811. (f) n − 1 = 118901526 = 21 · 59450763. 259450763 ≡ 1  ≡ −1 (mod 118901527)  59450763  ≡ −1 (mod 118901527)  59450763  ≡1  (mod 118901527)  59450763  ≡1  (mod 118901527)  3 5 7 11  (mod 118901527)  59450763  Thus 2, 3, 5, 7, and 11 are not Miller–Rabin witnesses for 118901527. It turns out that 118901527 is prime. (g) n − 1 = 118915386 = 21 · 59457693. 259457693 ≡ −5081012 (mod 118915387) Thus 118915387 is composite. It factors as n = 6571 · 18097. 3.15. Looking back at Exercise 3.9, let's suppose that for a given N , the magic box can produce only one decryption exponent. Equivalently, suppose that an RSA key pair has been compromised and that the private decryption exponent corresponding to the public encryption exponent has been discovered. Show how the basic idea in the Miller–Rabin primality test can be applied to use this information to factor N .  Exercises for Chapter 3  73  Solution to Exercise 3.15. We are given an encryption/decryption pair (e, d), which means that ade ≡ a  (mod N )  for all 1 ≤ a < N .  So for most values of a we have ade−1 ≡ 1 (mod N ). (This is true unless gcd(a, N ) > 1, in which case gcd(a, N ) is a nontrivial factor of N .) Using the idea of the Miller–Rabin test, we factor de = 2k r  with r odd.  Then for random choices of a, we look at ar , a2r , a4r , . . . , a2  k  r  mod N.  We know that the last entry in the list is 1. Now suppose that N factors as pq, where we do not know p and q. We choose a value for a. The Miller–Rabin test applied to p tells us that either ar ≡ 1  (mod p),  or else  a2  i  r  ≡ −1  (mod p) for some 0 ≤ i < k.  (If the latter is true, we take i to be the smallest such value.) Note that we do not know the value of i, because we do not know the value of p, but that's okay. Next we do the same thing with q. Thus the Miller–Rabin test tells us that either ar ≡ 1 (mod q),  or else  a2  j  r  ≡ −1  (mod p) for some 0 ≤ j < k,  where again we choose the smallest such j. We now consider several cases. If ar ≡ 1 (mod p) and αr 6≡ 1 (mod q), then we recover p by computing gcd(N, ar − 1) = p. Similarly, if ar 6≡ 1 (mod p) and αr ≡ 1 (mod q), then gcd(N, ar − 1) = q, so again we win. On the other hand, if ar ≡ 1 (mod N ), then we get no useful information, so we need to go try a different value for a. In the remaining cases we have ar 6≡ 1 (mod p) and αr 6≡ 1 (mod q). Suppose that i and j are different, say i < j. Then a2  i  r  ≡ −1  (mod p) and  i  a2  i  r  6≡ −1  (mod q),  So computing gcd(N, a2 r +1) = p recovers p. A similar method works if j < i. And finally, if i = j, then we get no useful information and need to try a different value for a. We can summarize the above solution as the following algorithm: 1. Choose a random value 1 < a < N .  74  Exercises for Chapter 3 2. Compute gcd(a, N ). If it is not equal to 1, then it is a nontrivial factor of N . 3. Let (e, d) be the encryption/decryption pair. Factor de − 1 = 2k r with r odd. 4. Compute gcd(N, ar −1). If it is a nontrivial factor of N , you're are done. i  5. For each 0 ≤ i < k, compute gcd(N, a2 r + 1). If it is a nontrivial factor of N , you're done. 6. If you haven't found a factor of N , go back to Step 1 and choose a new value of a. 3.16. The function π(X) counts the number of primes between 2 and X. (a) Compute the values of π(20), π(30), and π(100). (b) Write a program to compute π(X) and use it to compute π(X) and the ratio π(X)/(X/ ln(X)) for X = 100, X = 1000, X = 10000, and X = 100000. Does your list of ratios make the prime number theorem plausible? Solution to Exercise 3.16. X π(X) π(X)/(X/ ln(X) 10 4 0.921 20 8 1.198 30 10 1.134 100 25 1.151 1000 168 1.161 10000 1229 1.132 100000 9592 1.104 1000000 78498 1.084 3.17. Let π1 (X) = (# of primes p between 2 and X satisfying p ≡ 1 (mod 4)), π3 (X) = (# of primes p between 2 and X satisfying p ≡ 3 (mod 4)). Thus every prime other than 2 gets counted by either π1 (X) or by π3 (X). (a) Compute the values of π1 (X) and π3 (X) for each of the following values of X. (i) X = 10. (ii) X = 25. (iii) X = 100. (b) Write a program to compute π1 (X) and π3 (X) and use it to compute their values and the ratio π3 (X)/π1 (X) for X = 100, X = 1000, X = 10000, and X = 100000. (c) Based on your data from (b), make a conjecture about the relative sizes of π1 (X) and π3 (X). Which one do you think is larger? What do you think is the limit of the ratio π3 (X)/π1 (X) as X → ∞? Solution to Exercise 3.17.  Exercises for Chapter 3  75  X π1 (X) π3 (X) π3 (X)/π1 (X) 10 1 2 2.0000 25 3 5 1.6667 100 11 13 1.1818 1000 80 87 1.0875 10000 609 619 1.0164 100000 4783 4808 1.0052 1000000 39175 39322 1.0038 (c) From the data, it appears that π3 (X) > π1 (X) for all X. This is actually false, but the first X for which the inequality is reversed is extremely large. In any case, the ratio satisfies limX→∞ π3 (X)/π1 (X) = 1. This is a special case of Dirichlet's theorem on primes in arithmetic progressions, which says the following. Let gcd(a, N ) = 1 and let πa,N (X) be the number of primes p between 2 and X satisfying p ≡ a (mod N ). Then limX→∞ πa,N (X)/π(X) = 1/φ(N ). 3.18. We noted in Section 3.4 that it really makes no sense to say that the number n has probability 1/ ln(n) of being prime. Any particular number that you choose either will be prime or will not be prime; there are no numbers that are 35% prime and 65% composite! In this exercise you will prove a result that gives a more sensible meaning to the statement that a number has a certain probability of being prime. You may use the prime number theorem (Theorem 3.20) for this problem. (a) Fix a (large) number N and suppose that Bob chooses a random number n in the interval 21 N ≤ n ≤ 32 N . If he repeats this process many times, prove that approximately 1/ ln(N ) of his numbers will be prime. More precisely, define number of primes between 12 N and 32 N number of integers between 12 N and 23 N " # Probability that an integer n in the 1 3 = interval 2 N ≤ n ≤ 2 N is a prime num- , ber  P (N ) =  and prove that lim  N →∞  P (N ) = 1. 1/ ln(N )  This shows that if N is large, then P (N ) is approximately 1/ ln(N ). (b) More generally, fix two numbers c1 and c2 satisfying c1 < c2 . Bob chooses random numbers n in the interval c1 N ≤ n ≤ c2 N . Keeping c1 and c2 fixed, let "  # Probability that an integer n in the inP (c1 , c2 ; N ) = terval c1 N ≤ n ≤ c2 N is a prime num- . ber  76  Exercises for Chapter 3 In the following formula, fill in the box with a simple function of N so that the statement is true: lim  N →∞  P (c1 , c2 ; N )  = 1.  Solution to Exercise 3.18. We will just write P (N ), instead of P (c1 , c2 ; N ). P (N ) = = = = =  # of primes between c1 N and c2 N N π(c2 N ) − π(c2 N ) N µ ¶ c2 c1 1 − +o from the prime number theorem ln(c2 N ) ln(c1 N ) ln(N ) µ ¶ (c2 − c1 ) ln(N ) + O(1) 1 +o ln(c1 N ) ln(c2 N ) ln(N ) µ ¶ c2 − c1 1 +o ln(N ) ln(N )  Hence P (N ) divided by (c2 − c1 )/ ln(N ) goes to 1 as N → ∞, or equivalently, P (N ) = c2 − c1 . N →∞ ln(N ) lim  For part (a), we have c1 =  1 2  and c2 = 23 , so the limit is 1.  3.19. Continuing with the previous exercise, explain how to make mathematical sense of the following statements. (a) A randomly chosen odd number N has probability 2/ ln(N ) of being prime. (What is the probability that a randomly chosen even number is prime?) (b) A randomly chosen number N satisfying N ≡ 1 (mod 3) has probability 3/(2 ln(N )) of being prime. (c) A randomly chosen number N satisfying N ≡ 1 (mod 6) has probability 3/ ln(N ) of being prime. (d) Let m = p1 p2 · · · pr be a product of distinct primes and let k be a number satisfying gcd(k, m) = 1. What number should go into the box to make statement (3.35) correct? Why? A randomly chosen number N satisfying N ≡ k (mod m) has probability / ln(N ) of being prime.  (3.2)  (e) Same question, but for arbitrary m, not just for m that are products of distinct primes.  Exercises for Chapter 3  77  Solution to Exercise 3.19. (a,b,c) A solution for this exercise is not currently available. (d) If m = p1 · · · pr , then the probability that N ≡ k (mod m) is prime is approximately ¶ r µ Y pi 1 · . p − 1 ln(N ) i i=1 (e) More generally, for arbitrary m and k satisfying gcd(m, k) = 1, the probability that N ≡ k (mod m) is prime is approximately Yµ p ¶ 1 · . p−1 ln(N ) p|m  This is often written as Yµ  1−  p|m  1 p  ¶−1  1 , ln(N )  ·  which is also equal to N/(φ(N ) ln(N )), where φ(N ) is Euler's phi function. 3.20. The logarithmic integral function Li(X) is defined to be Z  X  Li(X) = 2  (a) Prove that X Li(X) = + ln X  Z 2  dt . ln t  X  dt + O(1). (ln t)2  (Hint. Integration by parts.) (b) Compute the limit lim  X→∞  Li(X) . X/ ln X  √ √ (Hint. Break the integral in (a) into two pieces, 2 ≤ t ≤ X and X ≤ t ≤ X, and estimate each piece separately.) (c) Use (b) to show that formula (3.12) on page 131 implies the prime number theorem (Theorem 3.20). Solution to Exercise 3.20. A solution for this exercise is not currently available. Section. Pollard's p − 1 factorization algorithm 3.21. Use Pollard's p − 1 method to factor each of the following numbers. (a) n = 1739  (b) n = 220459  (c) n = 48356747  78  Exercises for Chapter 3  Be sure to show your work and to indicate which prime factor p of n has the property that p − 1 is a product of small primes. Solution to Exercise 3.21. (a) 23! − 1 ≡ 63  (mod 1739)  gcd(23! − 1, 1739) = 1  24! − 1 ≡ 1082 (mod 1739)  gcd(24! − 1, 1739) = 1  25! − 1 ≡ 1394 (mod 1739)  gcd(25! − 1, 1739) = 1  26! − 1 ≡ 1443 (mod 1739)  gcd(26! − 1, 1739) = 37  This give 1739 = 37 · 47. Note that p − 1 = 36 = 22 · 32 and q − 1 = 46 = 2 · 23. (b) 23! − 1 ≡ 63  (mod 220459)  gcd(23! − 1, 220459) = 1  24! − 1 ≡ 22331  (mod 220459)  gcd(24! − 1, 220459) = 1  25! − 1 ≡ 85053  (mod 220459)  gcd(25! − 1, 220459) = 1  26! − 1 ≡ 4045  (mod 220459)  gcd(26! − 1, 220459) = 1  27! − 1 ≡ 43102  (mod 220459)  gcd(27! − 1, 220459) = 1  28! − 1 ≡ 179600 (mod 220459)  gcd(28! − 1, 220459) = 449  This gives 220459 = 449 · 491. Note that p − 1 = 448 = 26 · 7 and q − 1 = 490 = 2 · 5 · 72 . (c) 215! − 1 ≡ 46983890 (mod 48356747)  gcd(215! − 1, 48356747) = 1  216! − 1 ≡ 8398520  (mod 48356747)  gcd(216! − 1, 48356747) = 1  217! − 1 ≡ 9367159  (mod 48356747)  gcd(217! − 1, 48356747) = 1  218! − 1 ≡ 17907955 (mod 48356747)  gcd(218! − 1, 48356747) = 1  219! − 1 ≡ 13944672 (mod 48356747)  gcd(219! − 1, 48356747) = 6917  This gives 48356747 = 6917 · 6991. Note that p − 1 = 6916 = 22 · 7 · 13 · 19 and q − 1 = 6990 = 2 · 3 · 5 · 233. 3.22. A prime of the form 2n − 1 is called a Mersenne prime. (a) Factor each of the numbers 2n − 1 for n = 2, 3, . . . , 10. Which ones are Mersenne primes? (b) Find the first seven Mersenne primes. (You may need a computer.) (c) If n is even and n > 2, prove that 2n − 1 is not prime. (d) If 3 | n and n > 3, prove that 2n − 1 is not prime. (e) More generally, prove that if n is a composite number, then 2n − 1 is not prime. Thus all Mersenne primes have the form 2p − 1 with p a prime number.  Exercises for Chapter 3  79  (f) What is the largest known Mersenne prime? Are there any larger primes known? (You can find out at the "Great Internet Mersenne Prime Search" web site www.mersenne.org/prime.htm.) (g) Write a one page essay on Mersenne primes, starting with the discoveries of Father Mersenne and ending with GIMPS. Solution to Exercise 3.22. The factorization of 2n − 1 for 2 ≤ n ≤ 20 is 211 − 1 = 2047 = 23 · 89 22 − 1 = 3 = 3  212 − 1 = 4095 = 32 · 5 · 7 · 13  23 − 1 = 7 = 7  213 − 1 = 8191 = 8191  24 − 1 = 15 = 3 · 5  214 − 1 = 16383 = 3 · 43 · 127  25 − 1 = 31 = 31  215 − 1 = 32767 = 7 · 31 · 151  26 − 1 = 63 = 32 · 7  216 − 1 = 65535 = 3 · 5 · 17 · 257  27 − 1 = 127 = 127  217 − 1 = 131071 = 131071  28 − 1 = 255 = 3 · 5 · 17  218 − 1 = 262143 = 33 · 7 · 19 · 73  29 − 1 = 511 = 7 · 73  219 − 1 = 524287 = 524287  210 − 1 = 1023 = 3 · 11 · 31  220 − 1 = 1048575 = 3 · 52 · 11 · 31 · 41  Thus the first few Mersenne primes are 22 − 1 = 3, 213 − 1 = 8191,  23 − 1 = 7, 217 − 1 = 131071,  25 − 1 = 31,  27 − 1 = 127,  219 − 1 = 524287.  Notice that 2p − 1 is prime for all primes p < 20 except for p = 11. However, this is somewhat misleading. For the primes 20 < p < 40, only 231 − 1 yields a Mersenne prime. 223 − 1 = 8388607 = 47 · 178481 229 − 1 = 536870911 = 233 · 1103 · 2089 231 − 1 = 2147483647 = 2147483647 237 − 1 = 137438953471 = 223 · 616318177 241 − 1 = 2199023255551 = 13367 · 164511353 243 − 1 = 8796093022207 = 431 · 9719 · 2099863 247 − 1 = 140737488355327 = 2351 · 4513 · 13264529  (c) If n is even, say n = 2m, then 2n − 1 = 22m − 1 = (2m − 1)(2m + 1), so 2n − 1 is composite unless 2m − 1 = 1, i.e. unless m = 1 and n = 2.  80  Exercises for Chapter 3  (d) Similarly, 23m − 1 = (2m − 1)(22m + 2m + 1), so it is composite unless m = 1. (e) More generally, 2km − 1 = (2m − 1)(2(k−1)m + 2(k−2)m + · · · + 22m + 2m + 1), so 2km − 1 is composite unless m = 1 or k = 1. Notice that what we are really doing is using the standard identity xk − 1 = (x − 1)(x(k−1) + x(k−2) + · · · + x2 + x + 1) with x = 2m . (f) As of January 2008, the largest known Mersenne prime is 232582657 − 1, which was discovered in September 2006 as part of the GIMPS project.  Exercises for Chapter 3  81  Section. Factorization via difference of squares 3.23. For each of the following numbers N , compute the values of N + 12 ,  N + 22 ,  N + 32 ,  N + 42 ,  ...  as we did in Example 3.33 until you find a value N + b2 that is a perfect square a2 . Then use the values of a and b to factor N . (a) N = 53357  (b) N = 34571  (c) N = 25777  (d) N = 64213  Solution to Exercise 3.23. (a) 53357 + 12 = 53358 2  not a square, 2  53357 + 2 = 53361 = 231 Thus  ** square **.  53357 = 2312 − 22 = (231 + 2)(231 − 2) = 233 · 229.  (b) 34571 + 12 = 34572  not a square,  2  34571 + 2 = 34575  not a square,  2  not a square,  34571 + 3 = 34580 2  34571 + 4 = 34587 2  not a square, 2  34571 + 5 = 34596 = 186 Thus  ** square **.  34571 = 1862 − 52 = (186 + 5)(186 − 5) = 191 · 181.  (c) 25777 + 12 = 25778  not a square  2  25777 + 2 = 25781  not a square  2  25777 + 3 = 25786  not a square  2  25777 + 4 = 25793  not a square  2  25777 + 5 = 25802  not a square  2  25777 + 6 = 25813  not a square  2  25777 + 7 = 25826  not a square  2  25777 + 8 = 25841  not a square  2  25777 + 9 = 25858  not a square  2  not a square  25777 + 10 = 25877 2  25777 + 11 = 25898 2  25777 + 12 = 25921 = 161  not a square 2  ** square **  82  Exercises for Chapter 3  Thus  25777 = 1612 − 122 = (161 + 12)(161 − 12) = 173 · 149.  (d) Most people will give up before finishing this one unless they write a computer program! It is included to make people aware that this method doesn't always work. 64213 + 12 = 64214  not a square  2  64213 + 2 = 64217  not a square  2  64213 + 3 = 64222  not a square  2  64213 + 4 = 64229 .. .  not a square .. .  64213 + 1212 = 78854  not a square  2  not a square  2  not a square  2  not a square  64213 + 122 = 79097 64213 + 123 = 79342 64213 + 124 = 79589 2  64213 + 125 = 79838 2  not a square  64213 + 126 = 80089 = 283  2  ** square **  Thus 64213 = 2832 − 1262 = (283 + 126)(283 − 126) = 409 · 157.  3.24. For each of the listed values of N , k, and binit , factor N by making a list of values of k · N + b2 , starting at b = binit and incrementing b until k · N + b2 is a perfect square. Then take greatest common divisors as we did in Example 3.34. (a) (b) (c)  N = 143041 N = 1226987 N = 2510839  k = 247 k=3 k = 21  binit = 1 binit = 36 binit = 90  Solution to Exercise 3.24. (a) 247 · 143041 + 12 = 35331128  not a square  2  247 · 143041 + 2 = 35331131 2  not a square 2  247 · 143041 + 3 = 35331136 = 5944  ** square **  Thus 247 · 143041 = 59442 − 32 = (5944 + 3)(5944 − 3) = 5947 · 5941.  Exercises for Chapter 3  83  gcd(143041, 5947) = 313,  gcd(143041, 5941) = 457  (b) 3 · 1226987 + 362 = 3682257  not a square  2  not a square  2  not a square  3 · 1226987 + 37 = 3682330 3 · 1226987 + 38 = 3682405 2  3 · 1226987 + 39 = 3682482  not a square  2  2  3 · 1226987 + 40 = 3682561 = 1919  ** square **  Thus 3 · 1226987 = 19192 − 402 = (1919 + 40)(1919 − 40) = 1959 · 1879. gcd(1226987, 1959) = 653,  gcd(1226987, 1879) = 1879  (c) 21 · 2510839 + 902 = 52735719  not a square  2  not a square  2  not a square  2  not a square  21 · 2510839 + 91 = 52735900 21 · 2510839 + 92 = 52736083 21 · 2510839 + 93 = 52736268 2  21 · 2510839 + 94 = 52736455 2  not a square 2  21 · 2510839 + 95 = 52736644 = 7262  ** square **  Thus 21 · 2510839 = 72622 − 952 = (7262 + 95)(7262 − 95) = 7357 · 7167. gcd(2510839, 7357) = 1051,  gcd(2510839, 7167) = 2389  3.25. For each part, use the data provided to find values of a and b satisfying a2 ≡ b2 (mod N ), and then compute gcd(N, a − b) in order to find a nontrivial factor of N , as we did in Examples 3.36 and 3.37. (a) N = 61063 18822 ≡ 270  270 = 2 · 33 · 5  (mod 61063)  and  18982 ≡ 60750 (mod 61063)  and  60750 = 2 · 35 · 53  (b) N = 52907 3992 ≡ 480  (mod 52907)  and  480 = 25 · 3 · 5  7632 ≡ 192  (mod 52907)  and  192 = 26 · 3  7732 ≡ 15552  (mod 52907)  and  15552 = 26 · 35  9762 ≡ 250  (mod 52907)  and  250 = 2 · 53  84  Exercises for Chapter 3  (c) N = 198103 11892 ≡ 27000  (mod 198103)  and  27000 = 23 · 33 · 53  16052 ≡ 686  (mod 198103)  and  23782 ≡ 108000  (mod 198103)  and  108000 = 25 · 33 · 53  28152 ≡ 105  (mod 198103)  and  105 = 3 · 5 · 7  686 = 2 · 73  (d) N = 2525891 15912 ≡ 5390  (mod 2525891)  and  5390 = 2 · 5 · 72 · 11  31822 ≡ 21560  (mod 2525891)  and  21560 = 23 · 5 · 72 · 11  47732 ≡ 48510  (mod 2525891)  and  48510 = 2 · 32 · 5 · 72 · 11  52752 ≡ 40824  (mod 2525891)  and  40824 = 23 · 36 · 7  54012 ≡ 1386000 (mod 2525891)  and  1386000 = 24 · 32 · 53 · 7 · 11  Solution to Exercise 3.25. (a) 18822 · 18982 ≡ (2 · 33 · 5)(2 · 35 · 53 ) 4  (mod 61063)  2 2  = (2 · 3 · 5 ) = 40502  gcd(61063, 1882 · 1898 − 4050) = 227  Eureka!  (b) The most natural combination to try first is 7632 · 7732 ≡ (26 · 3)(26 · 35 ) (mod 52907) = (26 · 33 )2 = 17282 gcd(52907, 763 · 773 − 1728) = 277  Eureka!  So this works. However, if instead we use 3992 · 7632 · 9762 ≡ (25 · 3 · 5)(26 · 3)(2 · 53 ) (mod 52907) = (26 · 3 · 52 )2 = 48002 , then we do not win, since gcd(52907, 399 · 763 · 976 − 4800) = 52907 (c) First we try  No help  Exercises for Chapter 3  85  11892 · 23782 ≡ (23 · 33 · 53 )(25 · 33 · 53 ) 4  3  (mod 198103)  3 2  = (2 · 3 · 5 ) = 540002  gcd(198103, 1189 · 2378 − 54000) = 198103  No help  This didn't work, so next we try 11892 · 16052 · 28152 ≡ (23 · 33 · 53 )(2 · 73 )(3 · 5 · 7) (mod 198103) = (22 · 32 · 52 · 72 )2 = 441002 gcd(198103, 1189 · 1605 · 2815 − 44100) = 499  Eureka!  (d) First we try 15912 · 31822 ≡ (2 · 5 · 72 · 11)(23 · 5 · 72 · 11) 2  2  (mod 2525891)  2  = (2 · 5 · 7 · 11) = 107802  gcd(2525891, 1591 · 3182 − 10780) = 2525891  No help  Next we try 15912 · 47732 ≡ (2 · 5 · 72 · 11)(2 · 32 · 5 · 72 · 11) 2  (mod 2525891)  2  = (2 · 3 · 5 · 7 · 11) = 161702  gcd(2525891, 1591 · 4773 − 16170) = 2525891  No help  Finally we win when we try 15912 · 52752 · 54012 ≡ (2 · 5 · 72 · 11)(23 · 36 · 7)(24 · 32 · 53 · 7 · 11) (mod 2525891) = (24 · 34 · 52 · 72 · 11)2 = 174636002 gcd(2525891, 1591 · 5275 · 5401 − 17463600) = 1637  Eureka!  Section. Smooth numbers, sieves, and building relations for factorization 3.26. Compute the following values of ψ(X, B), the number of B-smooth numbers between 2 and X (see page 146). (a) ψ(25, 3)  (b) ψ(35, 5) (c) ψ(50, 7) (e) ψ(100, 7)  (d) ψ(100, 5)  86  Exercises for Chapter 3  Solution to Exercise 3.26. (a) ψ(25, 3) = 10 (b) ψ(35, 5) = 18 (c) ψ(50, 7) = 30 (d) ψ(100, 5) = 33 (e) ψ(100, 7) = 45 3.27. An integer M is called B-power-smooth if every prime power pe dividing M satisfies pe ≤ B. For example, 180 = 22 · 32 · 5 is 10-power-smooth, since the largest prime power dividing 180 is 9, which is smaller than 10. (a) Suppose that M is B-power-smooth. Prove that M is also B-smooth. (b) Suppose that M is B-smooth. Is it always true that M is also B-powersmooth? Either prove that it is true or give an example for which it is not true. (c) The following is a list of 20 randomly chosen numbers between 1 and 1000, sorted from smallest to largest. Which of these numbers are 10-powersmooth? Which of them are 10-smooth? {84, 141, 171, 208, 224, 318, 325, 366, 378, 390, 420, 440, 504, 530, 707, 726, 758, 765, 792, 817} (d) Prove that M is B-power-smooth if and only if M divides the least common multiple of [1, 2, . . . , B]. (The least common multiple of a list of numbers k1 , . . . , kr is the smallest number K that is divisible by every number in the list.) Solution to Exercise 3.27. (a,b,d) A solution for this exercise is not currently available. (c) The numbers 84 = 22 · 3 · 7, 420 = 22 · 3 · 5 · 7, 504 = 23 · 32 · 7, and are 10-power-smooth. They are also 10-smooth, of course, as are the additional numbers 224 = 25 · 7 and 378 = 2 · 33 · 7. √ 3.28. Let L(N ) = e (ln N )(ln ln N ) as usual. Suppose that a computer does one billion operations per second. (a) How many seconds does it take to perform L(2100 ) operations? (b) How many hours does it take to perform L(2250 ) operations? (c) How many days does it take to perform L(2350 ) operations? (d) How many years does it take to perform L(2500 ) operations? (e) How many years does it take to perform L(2750 ) operations? (f) How many years does it take to perform L(21000 ) operations? (g) How many years does it take to perform L(22000 ) operations? (For simplicity, you may assume that there are 365.25 days in a year.) Solution to Exercise 3.28. (a) N = 2100 : L(N ) = 224.73 steps takes 0.03 seconds. (b) N = 2250 : L(N ) = 243.12 steps takes 2.65 hours.  Exercises for Chapter 3  87  = 2350 : L(N ) = 252.66 steps takes 82.24 days. = 2500 : L(N ) = 264.95 steps takes 1129.30 years. = 2750 : L(N ) = 282.26 steps takes 108.26 years. = 21000 : L(N ) = 297.14 steps takes 1012.74 years. = 22000 : L(N ) = 2144.48 steps takes 1026.99 years. √ 3.29. Prove that the function L(X) = e (ln X)(ln ln X) is subexponential. That is, prove the following two statements. ¡ ¢ (a) For every positive constant α, no matter how large, L(X) = Ω (ln X)α . ¡ β (b) For every positive constant β, no matter how small, L(X) = O X ). (c) (d) (e) (f) (g)  N N N N N  Solution to Exercise 3.29. A solution for this exercise is not currently available. 3.30. For any fixed positive constants a and b, define the function 1/a  Fa,b (X) = e(ln X)  (ln ln X)1/b  .  Prove the following properties of Fa,b (X). (a) If a > 1, prove that Fa,b (X) is subexponential. (b) If a = 1, prove that Fa,b (X) is exponential. (c) What happens if a < 1? Solution to Exercise 3.30. A solution for this exercise is not currently available. 3.31. This exercise asks you to verify an assertion √ in the proof of Corollary 3.44. Let L(X) be the usual function L(X) = e (ln X)(ln ln X) . (a) Prove that there is a value of ² > 0 such that (ln X)² < ln L(X) < (ln X)1−²  for all X > 10.  (b) Let c > 0, let Y = L(X)c , and let u = (ln X)/(ln Y ). Prove that 1  u−u = L(X)− 2c (1+o(1)) . Solution to Exercise 3.31. (a) is clear, any ² < 12 will work. (b) We first compute ln X ln X 1 u= = p = c ln L(X) c c (ln X)(ln ln X) Then  r  ln X . ln ln X  88  Exercises for Chapter 3 à r ! ln X 1 ln X ln ln ln X c ln ln X r · ¸ 1 1 ln X 1 = ln ln X − ln ln ln X − ln c c ln ln X 2 2 ¡ ¢ 1√ = ln X ln ln X 1 + o(1) 2c ¢¡ ¢ 1¡ = ln L(X) 1 + o(1) . 2c  1 u ln u = c  Hence  r  1  uu = L(X) 2c (1+o(1)) .  3.32. Proposition 3.47 assumes that we choose random numbers a modulo N , compute a2 (mod N ), and check whether the result is B-smooth. We can achieve better results if we take values for a of the form ¥√ ¦ a= N +k for 1 ≤ k ≤ K. (For simplicity, you may treat K as a fixed integer, independent of N . More rigorously, it is necessary to take K equal to a power of L(N ), which has a small effect on the final answer.) √ 2 2 (a) Prove that a2 −N ≤ √2K N +K , so in particular, a (mod N ) is smaller than a multiple of N . √ √ (b) Prove that L( N ) ≈ L(N )1/ 2 by showing that √ log L( N ) √ = 1. lim N →∞ log L(N )1/ 2 √  More generally, prove that in the same sense, L(N 1/r ) ≈ L(N )1/ r for any fixed r > 0. (c) Re-prove Proposition 3.47 using this better choice of values for a. Set B = L(N )c and find the optimal value of c. Approximately how many relations are needed to factor N ? Solution to Exercise 3.32. √ (a) We some 0 ≤ ² < 1. Hence a2 − N = √ have a =2 N +√² + k for 2 2(² + k) N + (² + k) ≤ 2K N + K . (b) A rough computation shows that √ √ √ √ L( N ) = e (ln N )(ln ln N ) √ 1 1 = e ( 2 ln N )(ln 2 ln N ) √ 1 √ ≈ e ( 2 ln N )(ln ln N ) = L(N )1/ 2 .  Exercises for Chapter 3  89  More precisely, we first simplify √ log L(N 1/r ) ln N 1/r ln ln N 1/r √ = √ √ 1/ r log L(N ) (1/ r) ln N ln ln N s (1/r)(ln N )(ln(1/r) + ln ln N ) = (1/r)(ln N )(ln ln N ) r − ln r = + 1. ln ln N It is clear that if r is fixed, then this last expression goes to 1 as N → ∞. (c) We mimic the proof of Proposition 3.47. The probability that √ √ √ a random number that is approximately N is B-smooth is ψ( N , B)/ N , and we need approximately π(B) relations, so we need to check approximately π(B) √ √ ψ( N , B)/ N  numbers.  (3.3)  √ We set B = L( N )c , substitute into ??, and use Theorem ?? and the prime number theorem (Theorem 3.20) to get (we ignore various lower-order log terms) √ √ 1 1 π(L( N )c ) L( N )c √ (c+ 2c ) √ √ √ ≈ √ ≈ L(N ) 2 . c −1/2c ψ( N , L( N ) )/ N L( N ) The exponent is minimized when c =  √1 , 2  √ √ so we should take B = L( N )1/ 2 ≈  L(N )1/2 and we need to check approximately L(N ) numbers in order to factor N . Of course, our assumptions mean that this is an underestimate, but this exercise suggests that without some significant new idea, the running time of this method will be at least O(L(N )). 3.33. Illustrate the quadratic sieve, as was done in Figure 3.3 (page 157), by sieving prime powers up to B on the values of F (T ) = T 2 −N in the indicated range. (a) Sieve N = 493 using prime powers up to B = 11 on values from F (23) to F (38). Use the relation(s) that you find to factor N . (b) Extend the computations in (a) by using prime powers up to B = 16 and sieving values from F (23) to F (50). What additional value(s) are sieved down to 1 and what additional relation(s) do they yield? Solution to Exercise 3.33. (a) We sieve the following values, as illustrated in Table ??: • The congruence t2 ≡ 493 ≡ 1 (mod 2) has solution t ≡ 1 (mod 2), so we sieve 2 from F (23), F (25), F (27),. . . .  90  Exercises for Chapter 3 • The congruence t2 ≡ 493 ≡ 1 (mod 3) has solutions t ≡ 1 (mod 3) and t ≡ 2 (mod 3), so first we sieve 3 from F (23), F (26), F (29),. . . , and then we sieve 3 from F (25), F (28), F (31),. . . . • The congruence t2 ≡ 493 ≡ 1 (mod 4) has solution t ≡ 1 (mod 2), so we sieve another 2 from F (23), F (25), F (27),. . . . • The congruence t2 ≡ 493 ≡ 3 (mod 5) has no solutions. • The congruence t2 ≡ 493 ≡ 3 (mod 7) has no solutions. • The congruence t2 ≡ 493 ≡ 5 (mod 8) has no solutions. • The congruence t2 ≡ 493 ≡ 7 (mod 9) has solutions t ≡ 4 (mod 9) and t ≡ 5 (mod 9), so first we sieve another 3 from F (31) and then we sieve another 3 from F (23) and F (32). • The congruence t2 ≡ 493 ≡ 9 (mod 11) has solutions t ≡ 3 (mod 11) and t ≡ 8 (mod 11), so first we sieve 11 from F (25) and F (36) and then we sieve 11 from F (30).  The two values F (23) and F (25) have been sieved down to 1, yielding the congruences F (23) ≡ 36 ≡ 22 ·32 (mod 493)  F (25) ≡ 132 ≡ 22 ·3·11 (mod 493).  and  Since F (23) is itself congruent to a square, we can compute gcd(23 − 2 · 3, 493) = 17, which gives the factorization 493 = 17 · 29. (b) The first step is to make Table ?? wider, i.e. sieve the values from F (23) to F (50) using prime powers up to B = 11. The next step is to sieve out the additional prime powers up to B = 16. The congruence t2 ≡ 493 ≡ 12 (mod 13) has solutions t ≡ 5 (mod 13) and t ≡ 8 (mod 13), so first we sieve 13 from F (31) and F (44), and then we sieve 13 from F (34) and F (47). The only other prime power up to B = 16 is 16, and the congruence t2 ≡ 493 ≡ 13 (mod 16) has no solutions (as indeed it cannot, since we already noted that t2 ≡ 493 (mod 8) has no solutions). We do not give the entire sieve table, but merely observe that two more values have been sieved down to 1, namely F (31) = 468 ≡ 22 ·32 ·13 (mod 493)  and  F (47) = 1716 ≡ 22 ·3·11·13 (mod 493).  Combining these with the earlier fully sieved values gives the relation (25·31·47)2 ≡ (22 ·3·11)·(22 ·32 ·13)·(22 ·3·11·13) ≡ (23 ·32 ·11·13)3 (mod 493). Unfortunately, gcd(25 · 31 · 47 − 23 · 32 · 11 · 13, 493) = gcd(26129, 493) = 493, so this relation does not give a factorization of 493.  Exercises for Chapter 3 23 36 ↓2 18 ↓3 6 6 ↓2 3 3 ↓3 1 1 1  24 25 26 27 28 29 30 31 32 33 34 83 132 183 236 291 348 407 468 531 596 663 ↓2 ↓2 ↓2 ↓2 ↓2 83 66 183 118 291 174 407 234 531 298 663 ↓3 ↓3 ↓3 83 66 61 118 291 58 407 234 177 298 663 ↓3 ↓3 ↓3 ↓3 83 22 61 118 97 58 407 78 177 298 221 ↓2 ↓2 ↓2 ↓2 ↓2 83 11 61 59 97 29 407 39 177 149 221 ↓3 83 11 61 59 97 29 407 13 177 149 221 ↓3 83 11 61 59 97 29 407 13 59 149 221 ↓11 83 1 61 59 97 29 407 13 59 149 221 ↓11 83 1 61 59 97 29 37 13 59 149 221  91 35 36 37 38 732 803 876 951 ↓2 ↓2 366 803 438 951 ↓3 ↓3 122 803 438 317 ↓3 122 803 146 317 ↓2 ↓2 61 803 73 317 61  803  73  317  61  73  317  61  803 ↓11 73  73  317  61  73  73  317  Table 3.1: Sieving N = 493 3.34. Let Z[β] be the ring described in Example 3.54, i.e., β is a root of f (x) = 1 + 3x − 2x3 + x4 . For each of the following pairs of elements u, v ∈ Z[β], compute the sum u + v and the product uv. Your answers should involve only powers of β up to β 3 . (a) u = −5 − 2β + 9β 2 − 9β 3 and v = 2 + 9β − 7β 2 + 7β 3 . (b) u = 9 + 9β + 6β 2 − 5β 3 and v = −4 − 6β − 2β 2 − 5β 3 . (c) u = 6 − 5β + 3β 3 + 3β 3 and v = −2 + 7β + 6β 2 . Solution to Exercise 3.34. (a) u + v = −3 + 7β + 2β 2 − 2β 3 and uv = 148 + 425β + 98β 2 − 85β 3 . (b) u + 4 = 5 + 3β + 4β 2 − 10β 3 and uv = −69 − 219β − 211β 2 − 88β 3 . (c) u + v = 4 + β + 9β 2 + 3β 3 and uv = −87 − 189β − 66β 2 + 129β 3 . Section. The index calculus and discrete logarithms 3.35. This exercise asks you to use the index calculus to solve a discrete logarithm problem. Let p = 19079 and g = 17. (a) Verify that g i (mod p) is 5-smooth for each of the values i = 3030, i = 6892, and i = 18312. (b) Use your computations in (a) and linear algebra to compute the discrete logarithms logg (2), logg (3), and logg (5). (Note that 19078 = 2 · 9539 and that 9539 is prime.) (c) Verify that 19 · 17−12400 is 5-smooth.  92  Exercises for Chapter 3  (d) Use the values from (b) and the computation in (c) to solve the discrete logarithm problem 17x ≡ 19 (mod 19079). Solution to Exercise 3.35. (a) We have g 3030 ≡ 22 · 36 · 5,  g 6892 ≡ 211 · 32 ,  g 18312 ≡ 24 · 3 · 53 .  (b) We get the linear equations 3030 = 2x2 + 6x3 + x5 6892 = 11x2 + 2x3 18312 = 4x2 + x3 + 2x5 Solving modulo 2 and modulo 9539 gives (x2 , x3 , x5 ) ≡ (0, 0, 0) (mod 2), (x2 , x3 , x5 ) ≡ (8195, 1299, 7463) (mod 9539). Hence (x2 , x3 , x5 ) ≡ (17734, 10838, 17002) (mod 19079). (c) We compute h · g −12224 ≡ 213  (mod 19079).  (d) Hence logg (h) = 12224 + 13 · logg (2) = 242766 ≡ 13830 (mod p − 1). We check that 1713830 ≡ 19 (mod 19079). X Section. Quadratic residues and quadratic reciprocity 3.36. Let p be an odd prime and let a be an integer with p - a. (a) Prove that a(p−1)/2 is congruent to either 1 or −1 modulo p. (b) Prove that a(p−1)/2 is congruent to 1 modulo p if and only if a is a quadratic residue modulo p. (Hint. Let g be a primitive root for p and use the fact, proven during the course of proving Proposition 3.60, that g m is a quadratic residue if ¡ and ¢ only if m is even.) (c) Prove that a(p−1)/2 ≡ ap (mod p). (This holds even if p | a.) (d) Use (c) to prove Theorem 3.61(a), that is, prove that µ ¶ ( 1 if p ≡ 1 (mod 4), −1 = p −1 if p ≡ 3 (mod 4). Solution to Exercise 3.36. A solution for this exercise is not currently available.  Exercises for Chapter 3  93  3.37. Prove that the three parts of the quadratic reciprocity theorem (Theorem 3.61) are equivalent to the following three concise formulas, where p and q are odd primes: µ ¶ µ ¶µ ¶ µ ¶ p−1 p2 −1 p−1 q−1 2 p q −1 2 8 (b) (c) (a) = (−1) = (−1) = (−1) 2 · 2 p p q p Solution to Exercise 3.37. A solution for this exercise is not currently available. 3.38. Let p be a prime satisfying p ≡ 3 (mod 4). (a) Let a be a quadratic residue modulo p. Prove that the number b≡a  p+1 4  (mod p)  p−1 has the property that b2 ≡ a (mod p). (Hint. Write p+1 2 as 1 + 2 and use Exercise 3.36.) This gives an easy way to take square roots modulo p for primes that are congruent to 3 modulo p. (b) Use (a) to compute the following square roots modulo p. Be sure to check your answers.  (i) Solve b2 ≡ 116 (mod 587). (ii) Solve b2 ≡ 3217 (mod 8627). (iii) Solve b2 ≡ 9109 (mod 10663). Solution to Exercise 3.38. This was proven in Chapter 2, see Proposition 2.27, but it is included here as an exercise because of its importance, and because the use of the Legendre symbol makes for a short proof. (a) µ ¶ p+1 p−1 a b2 ≡ a 2 ≡ a1+ 2 ≡ a · ≡ a (mod p). p ¡ ¢ p−1 We are using a 2 ≡ ap from the previous exercise and the assumption that a ¡ ¢ is a quadratic residue, which tells us that ap = 1. (b) (i) 116(587+1)/4 = 116147 ≡ 65 (mod 587). Check: 652 ≡ 116 (mod 587). (ii) 3217(8627+1)/4 ≡ 18652157 ≡ 2980 (mod 8627). Check: 29802 ≡ 3217 (mod 8627). 2 (iii) 9109(10663+1)/4 ≡ 91092666 ≡ 3502 (mod 10663). Check: 3502 ¡ 9109 ¢ ≡ 1554 (mod 10663). Oops, what's going on? The problem is that 10663 = −1, so 9109 is not a quadratic residue modulo 10663. In fact, the previous exercise ¡ ¢ tells us that b2 ≡ ap a (mod p), and indeed in this case we have 35022 ≡ −9109 (mod 10663). 3.39. Recall that for any a ∈ F∗p , the discrete logarithm of a (with respect to a primitive root g) is a number logg (a) satisfying  94  Exercises for Chapter 3 g logg (a) ≡ a  Prove that  µ ¶ a = (−1)logg (a) p  (mod p). for all a ∈ F∗p .  Thus quadratic reciprocity gives a fast method to compute the parity of logg (a). Solution to Exercise 3.39. To ease notation,let k = logg (a). Then µ ¶ a ≡ a(p−1)/2 (mod p) from earlier exercise, p ≡ g k(p−1)/2 ≡ (−1)  k  (mod p)  from definition of discrete log, since g (p−1)/2 ≡ 1 (mod p).  (mod p)  3.40. Let p ≥ 5 be a prime. We say that a is a cubic residue modulo p if p - a and there is an integer c satisfying a ≡ c3 (mod p). (a) Let a and b be cubic residues modulo p. Prove that ab is a cubic residue modulo p. (b) Give an example to show that (unlike the case with quadratic residues) it is possible for none of a, b, and ab to be a cubic residue modulo p. (c) Let g be a primitive root modulo p. Prove that a is a cubic residue modulo p if and only if 3 | logg (a), where logg (a) is the discrete logarithm of a. Solution to Exercise 3.40. It is easiest to prove (c) first, but we give a direct proof of (a). The assumption is that there are numbers c and d satisfying a ≡ c3  mod p  and  b ≡ d3  (mod p).  Then ab = (cd)3 (mod p), so ab is also a cubic residue modulo p. (b,c) A solution for this exercise is not currently available. Section. Probabilistic encryption and the Goldwasser–Micali cryptosystem 3.41. Perform the following encryptions and decryptions using the Goldwasser–Micali public key cryptosystem (Table 3.9). (a) Bob's public key is the pair N = 1842338473 and a = 1532411781. Alice encrypts three bits and sends Bob the ciphertext blocks 1794677960,  525734818,  and  420526487.  Decrypt Alice's message using the factorization N = pq = 32411 · 56843.  Exercises for Chapter 3  95  (b) Bob's public key is N = 3149 and a = 2013. Alice encrypts three bits and sends Bob the ciphertext blocks 2322, 719, and 202. Unfortunately, Bob used primes that are much too small. Factor N and decrypt Alice's message. (c) Bob's public key is N = 781044643 and a = 568980706. Encrypt the three bits 1, 1, 0 using, respectively, the three random values r = 705130839,  r = 631364468,  r = 67651321.  Solution to Exercise 3.41. ¡ ¢ (a) Decrypt c = 1794677960 by computing 1794677960 = −1, 32411 ¡ which¢gives the plaintext bit m = 1. Decrypt c = 525734818 by computing 525734818 = 1, 32411 which gives the plaintext bit m = 0. Decrypt c = 420526487 by computing ¡420526487¢ = −1, which gives the plaintext bit m = 1. Alice's plaintext is 32411 (1, 0, 1). (b) The factorization of m is m = 3149 = 47 · 57. Decrypt c = 2322 by ¡ ¢ computing 2322 = −1, which gives the plaintext bit m = 1. Decrypt c = 719 47¡ ¢ 719 by computing ¡47 ¢= 1, which gives the plaintext bit m = 0. Decrypt c = 202 by computing 202 = 1, which gives the plaintext bit m = 0. Thus Alice's 47 plaintext is (1, 0, 0). (c) Although it is not needed to do this problem, the factorization of m is m = 781044643 = 22109 · 35327. Encrypt m = 1 using r = 705130839. Compute c ≡ ar2 ≡ 568980706 · 7051308392 ≡ 517254876 (mod 781044643). Encrypt m = 1 using r = 631364468. Compute c ≡ ar2 ≡ 568980706 · 6313644682 ≡ 4308279 (mod 781044643). Encrypt m = 0 using r = 67651321. Compute c ≡ r2 ≡ 676513212 ≡ 660699010 (mod 781044643). The ciphertext for (1, 1, 0) is (517254876, 4308279, 660699010). 3.42. Suppose that the plaintext space M of a certain cryptosystem is the set of bit strings of length 2b. Let ek and dk be the encryption and decryption functions associated with a key k ∈ K. This exercise describes one method of turning the original cryptosystem into a probabilistic cryptosystem. Most practical cryptosystems that are currently in use rely on more complicated variants of this idea in order to thwart certain types of attacks. (See Section 8.6 for further details.) Alice sends Bob an encrypted message by performing the following steps: 1. Alice chooses a b-bit message m0 to be encrypted. 2. Alice chooses a string r consisting of b random bits. 3. Alice sets m = rk(r⊕m0 ), where k denotes concatenation1 and ⊕ denotes exclusive or (see Section 1.7.4). Notice that m has length 2b bits. 4. Alice computes c = ek (m) and sends the ciphtertext c to Bob. 1 The concatenation of two bit strings is formed by placing the first string before the second string. For example, 1101 k 1001 is the bit string 11011001.  96  Exercises for Chapter 3  (a) Explain how Bob decrypts Alice's message and recovers the plaintext m0 . We assume, of course, that Bob knows the decryption function dk . (b) If the plaintexts and the ciphertexts of the original cryptosystem have the same length, what is the message expansion ratio of the new probabilistic cryptosystem? (c) More generally, if the original cryptosystem has a message expansion ratio of µ, what is the message expansion ratio of the new probabilistic cryptosystem? Solution to Exercise 3.42. (a) Bob decrypts c to recover m = dk (c). He splits m up into two pieces m = r k s, where r consists of the first b bits of m and s consists of the last b bits of m. Then he recovers Alice's plaintext m0 by computing r ⊕ s. (b) The new probabilistic cryptosystem has plaintext length b bits and ciphertext length 2b bits, so its message expansion ratio is 2. (c) The plaintexts in the original cryptosystem have length 2b bits, and it has message expansion µ, so its ciphertexts have length 2bµ bits. The new probabilistic cryptosystem has plaintext length b bits, so its message expansion ratio is 2bµ/b = 2µ.  Chapter 4  Combinatorics, Probability, and Information Theory Exercises for Chapter 4 Section. Basic principles of counting 4.1. The Rhind papyrus is an ancient Egyptian mathematical manuscript that is more than 3500 years old. Problem 79 of the Rhind papyrus poses a problem that can be paraphrased as follows: there are seven houses; in each house lives seven cats; each cat kills seven mice; each mouse has eaten seven spelt seeds1 ; each spelt seed would have produced seven hekat2 of spelt. What is the sum of all of the named items? Solve this 3500 year old problem. Solution to Exercise 4.1. 7 + |{z} 72 + |{z} 73 + |{z} 74 + |{z} 75 = 19607. |{z} houses  cats  mice  spelt  hekat  As stated in the Rhind papyrus, the problem and solution looks more or less as follows: 1 2 4  2,801 5,602 11,204 Total 19,607  1 Spelt 2A  houses cats mice spelt hekat Total  7 49 343 2,301 16,807 19,607  is an ancient type of wheat. 1 of a cubic cubit, which is approximately 4.8 liters. hekat is 30  97  98  Exercises for Chapter 4  Notice that the author has made a mistake in the value of 74 = 2401, but that his final answer is correct. The last column in the Rhind papyrus is the same as our solution, adding up powers of 7. In the first column the author gives an alternative computational method based on the fact that 2801 = 1 + 7 + 72 + 73 + 74 . Thus he computes 7 + 72 + 73 + 74 + 75 = 7 · (1 + 7 + 72 + 73 + 74 ) = (1 + 2 + 4) · (1 + 7 + 72 + 73 + 74 ) = 2801 + 2 · 2801 + 4 · 2801. This double-and-add method is very reminiscent of many modern algorithms. 4.2. (a) How many n-tuples (x1 , x2 , . . . , xn ) are there if the coordinates are required to be integers satisfying 0 ≤ xi < q? (b) Same question as (a), except now there are separate bounds 0 ≤ xi < qi for each coordinate. (c) How many n-by-n matrices are there if the entries xi,j of the matrix are integers satisfying 0 ≤ xi,j < q? (d) Same question as (a), except now the order of the coordinates does not matter. So for example, (0, 0, 1, 3) and (1, 0, 3, 0) are considered the same. (This one is rather tricky.) (e) Twelve students are each taking four classes, for each class they need two loose-leaf notebooks, for each notebook they need 100 sheets of paper, and each sheet of paper has 32 lines on it. Altogether, how many students, classes, notebooks, sheets, and lines are there? (Bonus. Make this or a similar problem of your own devising into a rhyme like the St. Ives riddle.) Solution to Exercise 4.2. (a) There are q choices for each coordinate, so a total of q n possible ntuples. (b) Now there are q1 choices for x1 , and q2 choices for x2 , and so on. Hence the total number of possibilities is the product q1 q2 · · · qn . (c) This is the same as (a), except now there are n2 entries to be filled in. 2 So there are q n possible matrices. (d) The idea is to count the quantity of each number that appears. Say there are k0 zeros, k1 ones, etc. Then k0 + k1 + · · · + kq−1 = n, so we need to count the number q nonnegative pieces. The answer ¡ of ways ¢ to split n into a sum ¡ofq+n−1 ¢ to this is q+n−1 , which is also equal to . q−1 n (e) The total number of students, classes, notebooks, sheets, and lines is 307200 = |{z} 12 · |{z} 4 ·  2 |{z}  · |{z} 100 · |{z} 32 .  students classes notebooks sheets  lines  4.3. (a) List all of the permutations of the set {A, B, C}. (b) List all of the permutations of the set {1, 2, 3, 4}.  Exercises for Chapter 4  99  (c) How many permutations are there of the set {1, 2, . . . , 20}? (d) Seven students are to be assigned to seven dormitory rooms, each student receiving his or her own room. In how many ways can this be done? (e) How many different words can be formed with the four symbols A, A, B, C? Solution to Exercise 4.3. (a) (A, B, C), (A, C, B), (B, A, C), (B, C, A), (C, A, B), (C, B, A). (b) There are 24 permutations of {1, 2, 3, 4}. They are (1,2,3,4) (1,2,4,3) (1,3,2,4) (1,3,4,2) (1,4,2,3) (1,4,3,2) (2,1,3,4) (2,1,4,3) (2,3,1,4) (2,3,4,1) (2,4,1,3) (2,4,3,1) (3,1,2,4) (3,1,4,2) (3,2,1,4) (3,2,4,1) (3,4,1,2) (3,4,2,1) (4,1,2,3) (4,1,3,2) (4,2,1,3) (4,2,3,1) (4,3,1,2) (4,3,2,1) (c) There are 20! = 2432902008176640000 ≈ 2.43 · 1018 permutations of {1, 2, . . . , 20}. (d) If the rooms are labeled 1, 2, . . . , 7, then each permutation of the students gives a way of assigning rooms, by putting the first listed student in room #1, the second listed student in room #2, etc. So there are 7! = 5040 ways to assign rooms. (e) There are 4 choices for placement of B, then 3 choices for placement of C, after which the two A's go in the remaining places, so there are 12 words. 4.4. (a) List the 24 possible permutations of the letters A1 , A2 , B1 , B2 . If A1 is indistinguishable from A2 , and B1 is indistinguishable from B2 , show how the permutations become grouped into 6 distinct letter arrangements, each containing 4 of the original 24 permutations. (b) Using the seven symbols A, A, A, A, B, B, B, how many different seven letter words can be formed? (c) Using the nine symbols A, A, A, A, B, B, B, C, C, how many different nine letter words can be formed? (d) Using the seven symbols A, A, A, A, B, B, B, how many different five letter words can be formed? Solution to Exercise 4.4. (a) Here are the 24 permutations. (A1 , A2 , B1 , B2 ) (A1 , A2 , B2 , B1 ) (A2 , A1 , B1 , B2 ) (A2 , A1 , B2 , B1 ) (A1 , B1 , A2 , B2 ) (A1 , B2 , A2 , B1 ) (A2 , B1 , A1 , B2 ) (A2 , B2 , A1 , B1 ) (A1 , B1 , B2 , A2 ) (A1 , B2 , B1 , A2 ) (A2 , B1 , B2 , A1 ) (A2 , B2 , B1 , A1 ) (B1 , B2 , A2 , A1 ) (B1 , B2 , A1 , A2 ) (B2 , B1 , A1 , A2 ) (B2 , B1 , A2 , A1 ) (B1 , A1 , A2 , B2 ) (B1 , A2 , A1 , B2 ) (B2 , A1 , A2 , B1 ) (B2 , A2 , A1 , B1 ) (B1 , A1 , B2 , A2 ) (B1 , A2 , B2 , A1 ) (B2 , A1 , B1 , A2 ) (B2 , A2 , B1 , A1 ) If A1 = A2 and B1 = B2 , then the four entries in each row become the same.  100  Exercises for Chapter 4  (b) We need to pick 4 of the 7 spots ¡ ¢ for the A's, then the B's go into the remaining 3 spots. Hence there are 74 = 35 such words. (c) We need to pick 4 of the 9 spots for the A's, then we need to pick 3 of the remaining 5 spots ¡ ¢¡ ¢for the B's, then the C's go into the remaining 2 spots. Hence there are 94 53 = 126 · 10 = 1260 such words. (d) We can form five letter words using anywhere from two to four A's. So we need to count the number of five letter words using each of {A, A, A, A, B}, So there are  {A, A, A, B, B},  µ ¶ µ ¶ µ ¶ 5 5 5 + + = 25 4 3 2  and  {A, A, B, B, B}.  different five letter words.  4.5. (a) There are 100 students eligible for an award, and the winner gets to choose from among 5 different possible prizes. How many possible outcomes are there? (b) Same as in (a), but this time there is a first place winner, a second place winner, and a third place winner, each of whom gets to select a prize. However, there is only one of each prize. How many possible outcomes are there? (c) Same as in (b), except that there are multiple copies of each prize, so each of the three winners may choose any of the prizes. Now how many possible outcomes are there? Is this larger or smaller than your answer from (b)? (d) Same as in (c), except that rather than specifying a first, second, and third place winner, we just choose three winning students without differentiating between them. Now how many possible outcomes are there? Compare the size of your answers to (b), (c), and (d). Solution to Exercise 4.5. (a) There are 100 · 5 = 500 outcomes. (b) This can be split into first choosing the three winners (in order), which can be done in 100 · 99 · 98 ways, and then choosing the three prizes (in order), which can be done in 5 · 4 · 3 ways. Then using the basic counting principle, the total number of outcomes is 100 · 99 · 98 · 5 · 4 · 3 = 58212000 ≈ 107.77 . (b) This time there are 5 · 5 · 5 ways to choose the prizes, so the total number of outcomes is 100 · 99 · 98 · 5 · 5 · 5 = 121275000 ≈ 108.08 . ¡ ¢ (c) Since the order of the students does not matter, there are now 100 = 3 100·99·98 ways to choose the students. Hence the total number of outcomes is 3!  Exercises for Chapter 4  101  100 · 99 · 98 · 5 · 5 · 5 = 20212500 ≈ 107.31 . 3!  4.6. Use the binomial theorem (Theorem 4.10) to compute each of the following quantities. (a) (5z + 2)3 (b) (2a − 3b)4 (c) (x − 2)5 Solution to Exercise 4.6. (a) (5z + 2)3 = 125z 3 + 225z 2 + 135z + 27. (b) (2a − 3b)4 = 16a4 − 96a3 b + 216a2 b2 − 216ab3 + 81b4 . (c) (x − 2)5 = x5 − 10x4 + 40x3 − 80x2 + 80x − 32. 4.7. The binomial coefficients satisfy many interesting identities. Give three proofs of the identity µ ¶ µ ¶ µ ¶ n n−1 n−1 = + . j j−1 j ¡ ¢ n! (a) For Proof #1, use the definition of nj as (n−j)!j! . (b) For Proof #2, use the binomial theorem (Theorem 4.10) and compare the coefficients of xj y n−j on the two sides of the identity (x + y)n = (x + y)(x + y)n−1 . (c) For Proof #3, argue directly that choosing j objects from a set of n objects can be decomposed into either choosing j − 1 objects from n − 1 objects or choosing j objects from n − 1 objects. Solution to Exercise 4.7. Proof #1: µ ¶ µ ¶ (n − 1)! n−1 n−1 (n − 1)! + + = (n − j)!(j − 1)! (n − 1 − j)!j! j−1 j · ¸ (n − 1)! 1 1 = + (n − 1 − j)!(j − 1)! n − j j (n − 1)! n = · (n − 1 − j)!(j − 1)! (n − j)j n! = (n − j)!j! µ ¶ n = . j Proof #2: Expand both sides of (x + y)n = (x + y)(x + y)n−1 using the binomial theorem:  102  Exercises for Chapter 4 n µ ¶ X n j=0  j  j n−j  x y  = (x + y)  n−1 Xµ  ¶ n − 1 j n−1−j x y j  j=0  =  n−1 Xµ j=0  ¶ ¶ n−1 µ n − 1 j+1 n−1−j X n − 1 j n−j x y + x y j j j=0  ¶ ¶ n µ n−1 µ X n − 1 j n−j X n − 1 j n−j = x y + x y j−1 j j=1 j=0 n  =x +  n−1 X ·µ j=1  ¶ µ ¶ ¸ n−1 n − 1 j n−j + x y + yn . j−1 j  Comparing the coefficients of xj y n−j on the two sides gives the desired identity. Another way to illustrate the same proof is to write the expansion of (x + y)n for n = 0, 1, 2, 3, . . . in the form of a triangle called Pascal's triangle. Proof #3: Let the n objects be A1 , · · · , An . Treat the last one as special, so label them as A1 , . . . , An−1 , B. In choosing j of these n objects, there are two possibilities, namely either B is chosen ¡ ¢or it is not chosen. The number of ways to choose j objects without B is n−1 , since we are choosing j objects from j among the n − 1 A's. The number of ways to choose j objects including B ¡ ¢ is n−1 , since having already selected B, we are need to choose j − 1 objects j−1 from among the n − 1 A's. 4.8. Let p be a prime number. This exercise sketches another proof of Fermat's little theorem (Theorem 1.25). ¡ ¢ (a) If 1 ≤ j ≤ p − 1, prove that the binomial coefficient pj is divisible by p. (b) Use (a) and the binomial theorem (Theorem 4.10) to prove that (a + b)p ≡ ap + bp  (mod p)  for all a, b ∈ Z.  (c) Use (b) with b = 1 and induction on a to prove that ap ≡ a (mod p) for all a ≥ 0. (d) Use (c) to deduce that ap−1 ≡ 1 (mod p) for all a with gcd(p, a) = 1. Solution to Exercise 4.8. (a) µ ¶ p p(p − 1)(p − 2) · · · (p − j + 1) = . j j! The denominator has no factors of p, so the p in the numerator does not cancel. (b) p µ ¶ X p j p−j (a + b)p = a b ≡ ap + bp (mod p), j j=0  Exercises for Chapter 4  103  since (a) tells us that the middle terms in the sum are all divisible by p. (c) Suppose we know that ap ≡ a (mod p), which we do for the starting value a = 0. Then using (b) we have (a + 1)p ≡ ap + 1 ≡ a + 1  (mod p).  Hence the result is also true for a + 1. By induction, it is true for all a ≥ 0. (d) If p - a, then we can multiply both sides of ap ≡ a (mod p) by a−1 mod p. 4.9. We know that there are n! different permutations of the set {1, 2, . . . , n}. (a) How many of these permutations leave no number fixed? (b) How many of these permutations leave at least one number fixed? (c) How many of these permutations leave exactly one number fixed? (d) How many of these permutations leave at least two numbers fixed? For each part of this problem, give a formula or algorithm that can be used to compute the answer for an arbitrary value of n, and then compute the value for n = 10 and n = 26. (This exercise generalizes Exercise 1.5.) Solution to Exercise 4.9. Let S(n, k) denote the number of permutations of n elements that fix at least k elements, let R(n, k) denote the number of permutations of n elements that fix exactly k elements, and let !n (the subfactorial of n) denote the number of permutations of n elements that fix no elements (such permutations are called derangements). Notice that !n = R(n, 0). See the solution to Exercise exercise:derangement for the derivation of the following formulas: !n = n!  n X (−1)k k=0  R(n, k) = S(n, k) =  k!  = bn!/ee,  µ ¶ µ ¶¹ ¼ n n (n − k)! !(n − k) = , k k e n X j=k  R(n, j) = n! −  k−1 X  R(n, j).  j=0  (a) No letters fixed is R(n, 0) =!n. This is called the nth derangement number. For n = 10 we get R(10, 0) =!10 = b10!/ee = b1334960.916e = 1334961. For n = 26 we get R(26, 0) =!26 = b26!/ee = b148362637348470135821287824.964e = 148362637348470135821287825. (b) At least one letter fixed is n! minus no letters fixed, so  104  Exercises for Chapter 4 S(n, 1) = n! − R(n, 0) = n!−!n = n! − bn!/ee.  Hence S(10, 1) = 10! − b10!/ee = 2293839, S(26, 1) = 26! − b26!/ee = 254928823778135499762712175. (c) Exactly 1 letter fixed is ¹  ¼ (n − 1)! R(n, 1) = n·!(n − 1) = n , e so  ¼ 9! R(10, 1) = 10 = 1334960, e ¹  ¹  ¼ 25! R(26, 1) = 26 = 148362637348470135821287824. e (d) At least two letters fixed is n! minus zero or one letters fixed, so S(n, 1) = n! − R(n, 0) − R(1, 0) = n!−!n − n·!(n − 1) = n! − bn!/ee − nb(n − 1)!/ee. Hence S(10, 1) = 10! − b10!/ee − 10 · b9!/ee = 958879, S(26, 1) = 26! − b26!/ee − 26 · b25!/ee = 106566186429665363941424351.  Section. The Vigenère cipher 4.10. Encrypt each of the following Vigenère plaintexts using the given keyword and the Vigenère tableau (Table 4.1). (a) Keyword: hamlet Plaintext: To be, or not to be, that is the question. (b) Keyword: fortune Plaintext: The treasure is buried under the big W. Solution to Exercise 4.10. (a) Vigenère Keyword: hamlet t o b e o r n o t t o b e h a m l e t h a m l e t h a o n p s k u o f e s u l (b) Vigenère Keyword: fortune t h e t r e a s u r e i s f o r t u n e f o r t u n y v v m l r e x i i x c f  t h a t i s t h e q u e s t i o n a m l e t h a m l e t h a m l e t t t l x b z t t p u n l s f t s g b u r i e d u n d e r t h e b i g w e f o r t u n e f o r t u n e f o r f z f z x x h r i s i m b r f n u n  Exercises for Chapter 4  105  4.11. Decrypt each of the following Vigenère ciphertexts using the given keyword and the Vigenère tableau (Table 4.1). (a) Keyword: condiment Ciphertext: r s g h z b m c x t d v f s q h n i g q x r n b m pdnsq smbtr ku (b) Keyword: rabbithole Ciphertext: k h f e q y m s c i e t c s i g j v p w f f b s q moapx zcsfx epsox yenpk daicx cebsm ttptx zooeq laflg kipoc zswqm taujw ghboh vrjtq hu Solution to Exercise 4.11. (a) Vigenère Keyword: Ciphertext: r s g h z Keyword: c o n d i Plaintext: p e t e r Ciphertext: p d n s q Keyword: n t c o n Plaintext: c k l e d  condiment b m c x t m e n t c p i p e r s m b t r d i m e n p e p p e  d v f s q o n d i m p i c k e  h n i g q e n t c o d a p e c  x r n b m n d i m e k o f p i  k u t c r s  Plaintext. Peter Piper picked a peck of pickled peppers! (b) Vigenère Keyword: rabbithole Ciphertext: k h f e q y m s c i e t c s i g j v p w Keyword: r a b b i t h o l e r a b b i t h o l e Plaintext: t h e d i f f e r e n t b r a n c h e s  f f b s q r a b b i o f a r i  Ciphertext: m o a p x Keyword: t h o l e Plaintext: t h m e t  z c s f x r a b b i i c r e p  e p s o x t h o l e l i e d t  y e n p k r a b b i h e m o c  d a i c x t h o l e k t u r t  Ciphertext: c e b s m Keyword: r a b b i Plaintext: l e a r e  t t p t x t h o l e a m b i t  z o o e q r a b b i i o n d i  l a f l g t h o l e s t r a c  k i p o c r a b b i t i o n u  Ciphertext: z s w q m t a u j w g h b o h v r j t q h u Keyword: t h o l e r a b b i t h o l e r a b b i t h Plaintext: g l i f i c a t i o n a n d d e r i s i o n Plaintext. The different branches of arithmetic, replied the Mock Turtle, are ambition, distraction, uglification, and derision. (From Lewis Carroll's Alice in Wonderland.) 4.12. Explain how a cipher wheel with rotating inner wheel (see Figure 1.1 on page 3) can be used in place of a Vigeǹere tableau (Table 4.1) to perform Vigenère encryption and decryption. Illustrate by describing the sequence of rotations used to perform a Vigenère encryption with the keyword mouse.  106  Exercises for Chapter 4  Solution to Exercise 4.12. A solution for this exercise is not currently available. 4.13. Let s = "I am the very model of a modern major general." t = "I have information vegetable, animal, and mineral." (a) Make frequency tables for s and t. (b) Compute IndCo(s) and IndCo(t). (c) Compute MutIndCo(s, t). Solution to Exercise 4.13. A B C D E F G H I J K L M N O P Q R S T U V W X Y Z Freq s 4 0 0 2 6 1 1 1 1 1 0 2 4 2 4 0 0 4 0 1 0 1 0 0 1 0 (a) Freq t 8 1 0 1 4 1 1 1 5 0 0 3 3 5 2 0 0 2 0 2 0 2 0 0 0 0 (b) IC(s) = 0.0424 and IC(t) = 0.0544. (c) M IC(s, t) = 0.0517 4.14. The following strings are blocks from a Vigenère encryption. It turns out that the keyword contains a repeated letter, so two of these blocks were encrypted with the same shift. Compute MutIndCo(si , sj ) for 1 ≤ i < j ≤ 3 and use these values to deduce which two strings were encrypted using the same shift. s1 = iwseesetftuonhdptbunnybioeatneghictdnsevi s2 = qibfhroeqeickxmirbqlflgkrqkejbejpepldfjbk s3 = iesnnciiheptevaireittuevmhooottrtaaflnatg Solution to Exercise 4.14. a b c d Freq s1 1 2 1 2 (a) Freq s2 0 4 1 1 Freq s3 4 0 1 0  e 6 5 5  f 1 3 1  g 1 1 1  h 2 1 2  i 4 3 5  j 0 3 0  k 0 4 0  l 0 3 1  m 0 1 1  n 5 0 3  o 2 1 3  p 1 2 1  q 0 4 0  r 0 3 2  s 3 0 1  t 5 0 7  u 2 0 1  v 1 0 2  w 1 0 0  x 0 1 0  y 1 0 0  z 0 0 0  MutIndCo(s1 , s2 ) = 0.0375, MutIndCo(s1 , s3 ) = 0.0744, MutIndCo(s2 , s3 ) = 0.0369. Thus s1 and s3 were probably encrypted using the same shift, so the first and third letters of the keyword are probably the same. 4.15. (a) One of the following two strings was encrypted using a simple substitution cipher, while the other is a random string of letters. Compute the index of coincidence of each string and use the results to guess which is which.  Exercises for Chapter 4  107  s1 = RCZBWBFHSLPSCPILHBGZJTGBIBJGLYIJIBFHCQQFZBYFP, s2 = KHQWGIZMGKPOYRKHUITDUXLXCWZOTWPAHFOHMGFEVUEJJ. (b) One of the following two strings was encrypted using a simple substitution cipher, while the other is a random permutation of the same set of letters. s1 = NTDCFVDHCTHKGUNGKEPGXKEWNECKEGWEWETWKUEVHDKK CDGCWXKDEEAMNHGNDIWUVWSSCTUNIGDSWKE s2 = IGWSKGEHEXNGECKVWNKVWNKSUTEHTWHEKDNCDXWSIEKD AECKFGNDCPUCKDNCUVWEMGEKWGEUTDGTWHD Thus their Indices of Coincidence are identical. Develop a method to compute a bigram index of coincidence, i.e., the frequency of pairs of letters, and use it to determine which string is most likely the encrypted text. (Bonus: Decrypt the encrypted texts in (a) and (b), but be forewarned that the plaintexts are in Latin.) Solution to Exercise 4.15. (a) The Indices of Coincidence of the two strings are IndCo(s1 ) = 0.0576 and IndCo(s2 ) = 0.0303, so most likely s1 is the encrypted text and s2 is the random string. The plaintext for s1 is "Facilius per partes in cognitionem totius adducimur," which translated into English says "We are more easily led part by part to an understanding of the whole." The phrase is due to Seneca. (b) The Indices of Coincidence are identical, IndCo(s1 ) = IndCo(s2 ) = 0.0672. In general, let A = {a1 , a2 , . . . , ak } be a set of distinct objects (letters, bigrams, turtles, etc.) and let B = (b1 , b2 , . . . , bn ) be a list of elements from A, where the bi do not need to be distinct. For each 1 ≤ i ≤ k, let Fi denote the number of b's that are equal to ai , i.e., Fi is the frequency with which ai appears in the list B. Then the index of coincidence of the set B is k  IndCo(B) =  X 1 Fi (Fi − 1). n(n − 1) i=1  So now we can apply the theory of Index of Coincidence to the set of bigrams that appear in a string. And we would expect that the index should be higher for the string that is the encrypted message and lower for the string with the same letters, but randomly rearranged. We find that IndCo(Bigrams in s1 ) = 0.004, IndCo(Bigrams in s2 ) = 0.010. Thus it seems likely that the second string s2 is the encrypted plaintext. This is the case, and the plaintext for s2 is "Frustra laborant quotquot se calculationibus fatigant pro inventione quadraturae circuli," which translated into English says "Futile is the labor of those who fatigue themselves with calculations to square the circle." The phrase is due to Michael Stifel (1544).  108  Exercises for Chapter 4  nhqrk bkkcj mrkwn dxjfg lzavs fkwis qyhdv cuwwz trggr mvrgw  vvvfe vqazx nsuhy nywus hyigh tfylk rhhny rgusl dxfgs kmirt  fwgjo wnvll iecru rwoar rvwpn ysnir wqhyi zgfhy ceyts twfer  mzjgc zetjc ljjvs xhvvx ljazl rddpb rjdqm etfre tiiih oimsb  kocgk zwgqz qlvvw ssmja nispv svsux iwutf ijjvy vjjvt qgrgc  lejrj zwhah zzxyv vkrwt jahym zjgqk nkzgd ghfau tcxfj  wossy kwdxj woenx uhktm ntewj xouhs vvibg wvwtn hciiv  wgvkk fgnyw ujgyr malcz jvrzg zzrjj oenwb xlljv voaro  hnesg gdfgh kqbfj ygrsz qvzcr kyiwc kolca vywyj lrxij  kwebi bitig lvjzx xwnvl estul zckov mskle apgzw vjnok  Table 4.1: A Vigenère ciphertext for Exercise 4.16 4.16. Table 4.13 is a Vigenère ciphertext in which we have marked some of the repeated trigrams for you. How long do you think the keyword is? Why? Bonus: Complete the cryptanalysis and recover the plaintext. Solution to Exercise 4.16. Trigram hyi  Appears at places 109, 206 and 313  jjv  117, 235, 372, and 422  nyw  88, 156, and 309  Differences 97 = 97 107 = 107 204 = 22 · 3 · 17 118 = 2 · 59 137 = 137 255 = 3 · 5 · 17 305 = 5 · 61 187 = 11 · 17 50 = 2 · 52 68 = 22 · 17 221 = 13 · 17 153 = 32 · 17  The keyword has length 17 . The keyword used for encryption was fourscoreandseven . The plaintext is It was the best of times, it was the worst of times, it was the age of wisdom, it was the age of foolishness, it was the epoch of belief, it was the epoch of incredulity, it was the season of Light, it was the season of Darkness, it was the spring of hope, it was the winter of despair, we had everything before us, we had nothing before us, we were all going direct to Heaven, we were all going direct the other way—in short, the period was so far like the present period,  Exercises for Chapter 4 togmg phumt thkef gfwsl asgvs  gbymk whlsf fwptj jsfse fwrqs  kcqiv yovww ggviv ooqhw fsfvq  109  dmlxk knhhm cgdra tofsh rhdrs  kbyif rcqfq pgwvm aciin nmvmk  vcuek vvhkw osqxg gfbif cbhrv  cuuis psued hkdvt gabgj kblxk  vvxqs ugrsf whuev adwsy gzi  pwwej ctwij kcwyj topml  koqgg khvfa psgsn ecqzw  Table 4.2: A Vigenère ciphertext for Exercise 4.17 Blocks i j 1 2 1 3 1 4 1 5 2 3 2 4 2 5 3 4 3 5 4 5  0 .044 .038 .025 .050 .035 .040 .042 .032 .043 .045  1 .047 .031 .039 .050 .037 .033 .040 .033 .043 .033  2 .021 .027 .053 .025 .039 .046 .042 .035 .040 .044  3 .054 .037 .043 .031 .031 .031 .029 .049 .034 .046  4 .046 .045 .023 .038 .031 .033 .033 .053 .033 .021  Shift Amount 5 6 7 .038 .022 .034 .036 .034 .032 .035 .032 .043 .045 .037 .028 .035 .047 .048 .023 .052 .027 .035 .035 .038 .027 .030 .022 .034 .043 .035 .032 .030 .038  8 .057 .039 .029 .032 .034 .031 .037 .047 .026 .047  9 .035 .039 .040 .038 .031 .039 .057 .036 .030 .040  10 .040 .047 .041 .063 .031 .078 .039 .040 .050 .025  11 .023 .038 .050 .033 .067 .034 .038 .036 .068 .037  12 .038 .050 .027 .034 .053 .029 .040 .052 .044 .068  Blocks i j 1 2 1 3 1 4 1 5 2 3 2 4 2 5 3 4 3 5 4 5  13 .040 .026 .042 .030 .039 .027 .033 .040 .039 .049  14 .063 .046 .050 .048 .015 .048 .035 .048 .029 .033  15 .033 .042 .042 .039 .030 .050 .039 .041 .045 .029  16 .025 .053 .031 .030 .045 .037 .033 .044 .040 .043  17 .032 .027 .024 .034 .049 .032 .037 .033 .033 .028  Shift Amount 18 19 20 .055 .038 .030 .024 .040 .047 .052 .027 .051 .038 .042 .035 .037 .023 .036 .021 .035 .043 .047 .037 .028 .028 .039 .027 .028 .031 .037 .033 .020 .040  21 .032 .048 .020 .036 .030 .047 .034 .036 .038 .040  22 .045 .018 .037 .043 .049 .041 .066 .017 .036 .041  23 .035 .037 .042 .055 .039 .047 .054 .038 .033 .039  24 .030 .034 .069 .030 .050 .042 .032 .051 .051 .039  25 .044 .066 .031 .035 .037 .035 .022 .065 .036 .059  Table 4.3: Mutual indices of coincidence for Exercise 4.17 that some of its noisiest authorities insisted on its being received, for good or for evil, in the superlative degree of comparison only. These are the opening lines of A Tale of Two Cities by Charles Dickens. 4.17. We applied a Kasiski test to the Vigenère ciphertext listed in Table 4.14 and found that the key length is probably 5. We then performed a mutual index of coincidence test to each shift of each pair of blocks and listed the results for you in Table 4.15. (This is the same type of table as Table 4.5 in the text, except that we haven't underlined the large values.) Use Table 4.15 to guess the relative rotations of the blocks, as we did in Table 4.6. This will give you a rotated version of the keyword. Try rotating it, as we did in Table 4.7, to find the correct keyword and decrypt the text. Solution to Exercise 4.17. The table of likely shift relations gives  110  Exercises for Chapter 4 i 2 2 3 4 1 1 2 3  j 3 4 5 5 3 4 5 4  Shift 11 10 11 12 25 24 22 25  MutIndCo 0.067 0.078 0.068 0.068 0.066 0.069 0.066 0.065  Shift Relation β2 − β3 = 11 β2 − β4 = 10 β3 − β5 = 11 β4 − β5 = 12 β1 − β3 = 25 β1 − β4 = 24 β2 − β5 = 22 β3 − β4 = 25  Table 4.4: Large indices of coincidence and shift relations Shift 0 1 2 3 4 5 6 7 8 . . .  Keyword AMBCQ BNCDR CODES DPEFT EQFGU FRGHV GSHIW HTIJX IUJKY . . .  Decrypted Text tcfkqgpxkukqpgfdakvukpxgpvqtcucitgcvjwocpk sbejpfowjtjpofeczjutjowfoupsbtbhsfbuivnboj radioenvisionedbyitsinventorasagreathumani qzchndmuhrhnmdcaxhsrhmudmsnqzrzfqdzsgtlzmh pybgmcltgqgmlcbzwgrqgltclrmpyqyepcyrfskylg oxaflbksfpflkbayvfqpfksbkqloxpxdobxqerjxkf nwzekajreoekjazxuepoejrajpknwowcnawpdqiwje mvydjziqdndjizywtdondiqziojmvnvbmzvocphvid luxciyhpcmcihyxvscnmchpyhnilumualyunboguhc . . .  Table 4.5: Decryption using shifts of the keyword AJCHWJZ β2 = β1 + 12,  β3 = β1 + 1,  β4 = β1 + 2,  β5 = β1 + 16.  Hence the keyword is a rotation of AMBCQ. The table lists the rotations of this word with the corresponding decryptions. We see immediately that the keyword is CODES. The full plaintext reads as follows: Radio, envisioned by its inventor as a great humanitarian contribution, was seized upon by the generals soon after its birth and impressed as an instrument of war. But radio turned over to the commander a copy of every enemy cryptogram it conveyed. Radio made cryptanalysis an end in itself. The Code-Breakers, Chapter 10, 1967, David Kahn 4.18. Table 4.16 gives a Vigenère ciphertext for you to analyze from scratch. It is probably easiest to do so by writing a computer program, but you are welcome to try to decrypt it with just paper and pencil. (a) Make a list of matching trigrams as we did in Table 4.3. Use the Kasiski test on matching trigrams to find the likely key length.  Exercises for Chapter 4 mgodt uuqtu uaafv psgki igxhr xsyor  beida habxw eqgjo puxfb oyazd tcylf  psgls dgkie ewabz uxfuq rakce egcy  111  akowu ktsnp saawl cvymy dxeyr  hxukc sekld rzjpv okagl pdobr  iawlr zlvnh feyky sactt buehr  csoyh wefss gylwu uwlrx uwcue  prtrt glzrn btlyd psgiy ekfic  udrqh peaoy kroec ytpsf zehrq  cengx lbyig bpfvt rjfuw ijezr  Table 4.6: A Vigenère ciphertext for Exercise 4.18 Trigram awl ehr gki gls lsa psg sgl tps uxf wlr  Appears at places 27 and 118 228 and 242 62 and 153 13 and 174 14 and 175 11 and 151 and 186 12 and 85 150 and 192 157 and 161 28 and 119 and 182  Difference 91 14 91 161 161 140 and 35 73 42 4 91 and 63  Table 4.7: Repeated trigrams in the ciphertext (b) Make a table of indices of coincidence for various key lengths, as we did in Table 4.4. Use your results to guess the probable key length. (c) Using the probable key length from (a) or (b), make a table of mutual indices of coincidence between rotated blocks, as we did in Table 4.5. Pick the largest indices from your table and use them to guess the relative rotations of the blocks, as we did in Table 4.6. (d) Use your results from (c) to guess a rotated version of the keyword, and then try the different rotations as we did in Table 4.7 to find the correct keyword and decrypt the text. Solution to Exercise 4.18. A list of repeated trigrams for the Kasiski test is given in the Table. The list of differences (sorted) is {4, 14, 35, 42, 63, 73, 91, 91, 91, 140, 154, 161, 161, 175}. Thus a good guess for the period is 7. Solving the relations in the table gives β2 = β1 + 9,  β3 = β1 + 2,  β4 = β1 + 7,  β5 = β1 + 22,  β6 = β1 + 9.  (There is actually one erroneous relation, namely β2 −β5 = 24, but our solution satisfies the other 10 relations, which makes it likely that it is correct.) In order  112  Block Size 4 5 6 7 8 9  Exercises for Chapter 4  Average Index 0.043 0.044 0.042 0.060 0.046 0.041  0.038, 0.048, 0.036, 0.058, 0.042, 0.041,  0.043, 0.052, 0.050, 0.060, 0.051, 0.053,  0.042, 0.046, 0.042, 0.081, 0.030, 0.042,  Individual Indices of Coincidence 0.046 0.030, 0.041 0.051, 0.038, 0.035 0.054, 0.059, 0.065, 0.047 0.053, 0.040, 0.051, 0.057, 0.040 0.037, 0.052, 0.030, 0.054, 0.030, 0.030  Table 4.8: Index of coincidence for various block sizes  Blocks i j 1 2 1 3 1 4 1 5 1 6 1 7 2 3 2 4 2 5 2 6 2 7 3 4 3 5 3 6 3 7 4 5 4 6 4 7 5 6 5 7 6 7  0 .037 .020 .038 .053 .024 .048 .040 .038 .041 .067 .030 .033 .034 .050 .033 .053 .020 .040 .022 .039 .032  1 .035 .046 .031 .037 .027 .055 .035 .045 .038 .034 .030 .048 .040 .042 .025 .040 .037 .038 .045 .034 .029  2 .043 .035 .045 .027 .048 .038 .026 .070 .051 .028 .047 .035 .054 .022 .032 .036 .041 .030 .050 .028 .052  3 .037 .041 .035 .034 .044 .036 .046 .029 .032 .050 .031 .033 .042 .029 .059 .021 .040 .028 .031 .038 .049  4 .045 .046 .039 .065 .039 .033 .039 .034 .021 .048 .035 .044 .026 .047 .038 .042 .043 .052 .034 .044 .028  Shift Amount 5 6 7 .035 .053 .046 .030 .033 .039 .030 .046 .043 .048 .038 .036 .043 .043 .040 .031 .037 .047 .027 .051 .071 .044 .035 .037 .028 .043 .025 .027 .036 .045 .035 .056 .031 .046 .040 .023 .026 .056 .042 .038 .036 .033 .039 .028 .037 .032 .031 .038 .041 .031 .015 .032 .041 .041 .053 .047 .023 .020 .039 .050 .037 .035 .031  8 .035 .037 .050 .048 .024 .041 .022 .042 .031 .028 .034 .044 .036 .041 .033 .035 .030 .058 .037 .057 .031  9 .034 .033 .041 .028 .036 .023 .026 .038 .049 .023 .051 .028 .032 .041 .053 .033 .049 .029 .044 .028 .058  10 .046 .040 .026 .022 .053 .035 .062 .030 .039 .034 .048 .048 .046 .030 .039 .038 .043 .030 .030 .035 .055  11 .030 .048 .035 .036 .043 .041 .033 .042 .031 .056 .031 .037 .031 .030 .026 .058 .035 .036 .024 .050 .024  12 .024 .036 .039 .044 .039 .049 .039 .037 .044 .031 .033 .037 .035 .038 .039 .045 .030 .045 .044 .038 .033  Blocks i j 1 2 1 3 1 4 1 5 1 6 1 7 2 3 2 4 2 5 2 6 2 7 3 4 3 5 3 6 3 7 4 5 4 6 4 7 5 6 5 7 6 7  13 .047 .033 .035 .031 .046 .040 .035 .050 .064 .025 .043 .027 .028 .047 .043 .036 .038 .044 .065 .034 .036  14 .047 .051 .037 .028 .038 .040 .038 .029 .041 .038 .034 .034 .050 .049 .046 .032 .035 .037 .031 .033 .042  15 .021 .030 .058 .054 .014 .048 .029 .045 .032 .034 .033 .033 .033 .042 .035 .044 .036 .037 .021 .050 .032  16 .030 .047 .039 .052 .033 .038 .042 .035 .033 .036 .036 .042 .035 .050 .041 .038 .041 .021 .039 .028 .048  17 .070 .044 .021 .036 .066 .026 .037 .039 .044 .028 .041 .048 .054 .026 .041 .037 .047 .041 .042 .028 .050  Shift Amount 18 19 20 .043 .030 .046 .032 .026 .055 .036 .062 .042 .040 .049 .041 .039 .024 .043 .023 .053 .041 .044 .023 .044 .033 .026 .033 .025 .020 .038 .043 .047 .038 .023 .048 .044 .055 .022 .021 .054 .036 .033 .018 .065 .048 .042 .027 .029 .033 .040 .029 .048 .034 .038 .038 .053 .037 .028 .028 .058 .035 .045 .030 .025 .032 .037  21 .038 .031 .036 .022 .036 .033 .035 .033 .037 .038 .056 .073 .040 .027 .039 .029 .046 .043 .035 .042 .056  22 .028 .016 .042 .032 .021 .031 .040 .039 .037 .048 .031 .039 .043 .050 .047 .053 .041 .032 .024 .053 .035  23 .030 .046 .024 .039 .036 .053 .049 .028 .037 .048 .042 .033 .031 .041 .036 .048 .038 .041 .043 .056 .030  24 .039 .080 .033 .030 .055 .030 .033 .054 .072 .026 .038 .042 .024 .024 .033 .046 .063 .033 .057 .029 .045  25 .029 .024 .039 .030 .041 .029 .033 .036 .048 .043 .039 .035 .041 .035 .059 .034 .043 .042 .042 .037 .038  Table 4.9: Mutual indices of coincidence for shifted blocks  Exercises for Chapter 4 i 1 2 2 2 1 1 1 2 3 3 5  j 5 3 4 6 2 3 6 5 4 6 6  Shift 4 7 2 0 17 24 17 24 21 19 13  113 MutIndCo 0.065 0.071 0.070 0.067 0.070 0.080 0.066 0.072 0.073 0.065 0.065  Shift Relation β1 − β5 = 4 β2 − β3 = 7 β2 − β4 = 2 β2 − β6 = 0 β1 − β2 = 17 β1 − β3 = 24 β1 − β6 = 17 β2 − β5 = 24 β3 − β4 = 21 β3 − β6 = 19 β5 − β6 = 13  Table 4.10: Large indices of coincidence and shift relations to find β7 , we look at the mutual indices that involve Block 7 and are greater than 0.058. There are three of them: i 3 3 4  j 7 7 7  Shift 3 25 8  MutIndCo 0.059 0.059 0.058  Shift Relation β3 − β7 = 3 β3 − β7 = 25 β4 − β7 = 8  Only one of the first two can be correct, but the third yields β7 = β1 + 25. This agrees with β7 = β3 − 3 = 25, so is probably correct. Thus the amounts that Blocks 2 through 7 are rotated exceed the amount that Block 1 is rotated by 9, 2, 7, 22, 9, and 25, respectively. For example, if the first letter of the keyword is A, then the full keyword is AJCHWJZ. The shifts of this keyword and decryptions are listed in the table. We find that the keyword is ENGLAND, and the full plaintext reads as follows: It is to be questioned whether in the whole length and breadth of the world there is a more admirable spot for a man in love to pass a day or two than the typical English village. It combines the comforts of civilization with the restfulness of solitude in a manner equalled by no other spot except the New York Public Library. A Damsel in Distress, 1919, P.G. Wodehouse 4.19. The autokey cipher is similar to the Vigenère cipher, except that rather than repeating the key, it simply uses the key to encrypt the first few letters and then uses the plaintext itself (shifted over) to continue the encryption. For example, in order to encrypt the message "The autokey cipher is cool" using the keyword random, we proceed as follows:  114  Exercises for Chapter 4  Shift 0 1 2 3 4 5 6 7 8 9 . . .  Keyword AJCHWJZ BKDIXKA CLEJYLB DMFKZMC ENGLAND FOHMBOE GPINCPF HQJODQG IRKPERH JSLQFSI . . .  Decrypted Text mxmwxsfiuyiwxmsrihalixlivmrxlialspipirkxle lwlvwrehtxhvwlrqhgzkhwkhulqwkhzkrohohqjwkd kvkuvqdgswguvkqpgfyjgvjgtkpvjgyjqngngpivjc jujtupcfrvftujpofexifuifsjouifxipmfmfohuib itistobequestionedwhetherinthewholelengtha hshrsnadptdrshnmdcvgdsgdqhmsgdvgnkdkdmfsgz grgqrmzcoscqrgmlcbufcrfcpglrfcufmjcjclerfy fqfpqlybnrbpqflkbatebqebofkqebtelibibkdqex epeopkxamqaopekjazsdapdanejpdasdkhahajcpdw dodnojwzlpznodjizyrczoczmdioczrcjgzgzibocv . . .  Table 4.11: Decryption using shifts of the keyword AJCHWJZ Plaintext t h e a u t o k e y c i p h e r i s c o o l Key r a n d o m t h e a u t o k e y c i p h e r Ciphertext k h r d i f h r i y w b d r i p k a r v s c The autokey cipher has the advantage that different messages are encrypted using different keys (except for the first few letters). Further, since the key does not repeat, there is no key length, so the autokey is not directly susceptible to a Kasiski or index of coincidence analysis. A disadvantage of the autokey is that a single mistake in encryption renders the remainder of the message unintelligible. According to [58], Vigenère invented the autokey cipher in 1586, but his invention was ignored and forgotten before being reinvented in the 1800s. (a) Encrypt the following message using the autokey cipher: Keyword: LEAR Plaintext: Come not between the dragon and his wrath. (b) Decrypt the following message using the autokey cipher: Keyword: CORDELIA Ciphertext: pckkm yowvz ejwzk knyzv vurux cstri tgac (c) Eve intercepts an autokey ciphertext and manages to steal the accompanying plaintext: Plaintext ifmusicbethefoodofloveplayon Ciphertext azdzwqvjjfbwnqphhmptjsszfjci Help Eve to figure out the keyword that was used for encryption. Describe your method in sufficient generality to show that the autokey cipher is susceptible to chosen plaintext attacks. (d) Bonus Problem: Try to formulate a statistical or algebraic attack on the autokey cipher, assuming that you are given a large amount of ciphertext to analyze.  Exercises for Chapter 4  115  Solution to Exercise 4.19. (a) c o m e n o t b e t w e e n t h e d r a g o n a n d h i s w r a t h l e a r c o m e n o t b e t w e e n t h e d r a g o n a n d h i s w n s m v p c f f r h p f i g p l i q k h k r e a t r u i f z y i l d The ciphertext is nsmvp cffrh pfigp liqkh kreat ruifz yild. (b) p c k k m y o w v z e j w z k k n y z v v u r u x c s t r i t g a c c o r d e l i a n o t h i n g w i l l c o m e o f n o t h i n g s p n o t h i n g w i l l c o m e o f n o t h i n g s p e a k a g a i n The plaintext is Nothing will come of nothing. Speak again. These are King Lear's tragically inaccurate words to his youngest daughter Cordelia. (c) The keyword is SURFEIT. The line is from Shakespeare's Twelfth Night, and the full encryption is i f m u s i c b e t h e f o o d o f l o v e p l a y o n s u r f e i t i f m u s i c b e t h e f o o d o f l o v a z d z w q v j j f b w n q p h h m p t j s s z f j c i  116  Exercises for Chapter 4  Section. Probability theory 4.20. Use the definition (4.15) of the probability of an event to prove the following basic facts about probability theory. (a) Let E and F be disjoint events. Then Pr(E ∪ F ) = Pr(E) + Pr(F ). (b) Let E and F be events that need not be disjoint. Then Pr(E ∪ F ) = Pr(E) + Pr(F ) − Pr(E ∩ F ). (c) Let E be an event. Then Pr(E c ) = 1 − Pr(E). (d) Let E1 , E2 , E3 be events. Prove that Pr(E1 ∪ E2 ∪ E3 ) = Pr(E1 ) + Pr(E2 ) + Pr(E3 ) − Pr(E1 ∩ E2 ) − Pr(E1 ∩ E3 ) − Pr(E2 ∩ E3 ) + Pr(E1 ∩ E2 ∩ E3 ). The formulas in (b) and (d) and their generalization to n events are known as the inclusion–exclusion principle. Solution to Exercise 4.20. A solution for this exercise is not currently available. 4.21. We continue with the coin tossing scenario from Example 4.23, so our experiment consists in tossing a fair coin ten times. Compute the probabilities of the following events. (a) The first and last tosses are both heads. (b) Either the first toss or the last toss (or both) are heads. (c) Either the first toss or the last toss (but not both) are heads. (d) There are exactly k heads and 10 − k tails. Compute the probability for each value of k between 0 and 10. (Hint. To save time, note that the probability of exactly k heads is the same as the probability of exactly k tails.) (e) There is an even number of heads. (f) There is an odd number of heads. Solution to Exercise 4.21. We label the events in the parts of this problem as E(a) , E(b) , E(c,k) , etc. (a) Pr(E(a) ) = 14 . c (b) Pr(E(b) ) = 1 − Pr(E(b) ) = 1 − 14 = 43 . (c) Pr(E(c) ) = Pr(E(b) ) − Pr(E(a) ) = 12 . (d) µ ¶ 10 1 1 1 Pr(E(d,0) ) = · 10 = = ≈ 0.0010 0 2 1024 1024  Exercises for Chapter 4 µ ¶ 10 Pr(E(d,1) ) = · 1 µ ¶ 10 Pr(E(d,2) ) = · 2 µ ¶ 10 Pr(E(d,3) ) = · 3 µ ¶ 10 Pr(E(d,4) ) = · 4 µ ¶ 10 Pr(E(d,5) ) = · 5 µ ¶ 10 Pr(E(d,6) ) = · 6 µ ¶ 10 Pr(E(d,7) ) = · 7 µ ¶ 10 Pr(E(d,8) ) = · 8 µ ¶ 10 Pr(E(d,9) ) = · 9 µ ¶ 10 Pr(E(d,10) ) = · 10  117 1 210 1 210 1 210 1 210 1 210 1 210 1 210 1 210 1 210 1 210  = = = = = = = = = =  10 1024 45 1024 120 1024 210 1024 252 1024 210 1024 120 1024 45 1024 10 1024 1 1024  = = = = = = = = = =  5 ≈ 0.0098 512 45 ≈ 0.0439 1024 15 ≈ 0.1172 128 105 ≈ 0.2051 512 63 ≈ 0.2461 256 105 ≈ 0.2051 512 15 ≈ 0.1172 128 45 ≈ 0.0439 1024 5 ≈ 0.0098 512 1 ≈ 0.0010 1024  (e) Pr(E(e) ) = Pr(Even number of heads) =  X  Pr(E(c,k) ) =  k even  1 . 2  (f) Pr(E(f) ) = Pr(E(d) ) = 21 . 4.22. Alice offers to make the following bet with you. She will toss a fair coin 14 times. If exactly 7 heads come up, she will give you $4; otherwise you must give her $1. Would you take this bet? If so, and if you repeated the bet 10000 times, how much money would you expect to win or lose? Solution to Exercise 4.22. The probability of winning the bet is µ ¶ 14 1 3432 429 · 1 = = ≈ 0.2095. 7 2 4 16384 2048 Thus your probability of winning the bet is slightly larger than 15 , so it is worthwhile making the bet. (Note that if the probability of winning were exactly 51 , then in five trials you would expect to win once for plus $4 and lose four times for minus $4, so you would end up even.) In 10000 trials, you  118  Exercises for Chapter 4  would expect to win the bet approximately 2095 times, for a gain of $8380, and to lose the bet approximately 7905 times, for a loss of $7905. Hence your average net gain for 10000 trials is $475. 4.23. Let E and F be events. (a) Prove that Pr(E | E) = 1. Explain in words why this is reasonable. (b) If E and F are disjoint, prove that Pr(F | E) = 0. Explain in words why this is reasonable. (c) Let F1 , . . . , Fn be events satisfying Fi ∩ Fj = ∅ for all i 6= j. We say that F1 , . . . , Fn are pairwise disjoint. Prove then that µ[ ¶ X n n Pr Fi = Pr(Fi ). i=1  i=1  (d) Let F1 , . . . , Fn be pairwise disjoint as in (c), and assume further that F1 ∪ · · · ∪ Fn = Ω, where recall that Ω is the entire sample space. Prove the following general version of the decomposition formula (4.20) in Proposition 4.24(a): Pr(E) =  n X  Pr(E | Fi ) Pr(Fi ).  i=1  (e) Prove a general version of Bayes's formula: Pr(Fi | E) =  Pr(E | Fi ) Pr(Fi ) . Pr(E | F1 ) Pr(F1 ) + Pr(E | F2 ) Pr(F2 ) + · · · + Pr(E | Fn ) Pr(Fn )  Solution to Exercise 4.23. Pr(E ∩ E) Pr(E) (a) Pr(E | E) = = = 1. It is clear that if we know Pr(E) Pr(E) that E occurs, then the probability that E occurs is 1. Pr(F ∩ E) Pr(∅) (b) Pr(F | E) = = = 0. If E occurs and F is disjoint Pr(E) Pr(E) from E, then none of the individual events in F can possibly occur, so the probability of F is clearly 0. (c) One can argue directly by summing over the elements in the Fi 's or use induction on n, since we already know the formula for n = 2. (d) The assumptions of F1 , . . . , Fn imply that E=  n [  (E ∩ Fi )  i=1  Hence  and  (E ∩ Fi ) ∩ (E ∩ Ej ) = ∅  for i 6= j.  Exercises for Chapter 4 Pr(E) = Pr  µ[ n  119  ¶ (E ∩ Fi )  i=1  = =  n X i=1 n X  Pr(E ∩ Fi )  since the E ∩ Fi are disjoint from one another,  Pr(E | Fi ) Pr(Fi ).  i=1  4.24. There are two urns containing pens and pencils. Urn #1 contains three pens and seven pencils and Urn #2 contains eight pens and four pencils. (a) An urn is chosen at random and an object is drawn. What is the probability that it is a pencil? (b) An urn is chosen at random and an object is drawn. If the object drawn is a pencil, what is the probability that it came from Urn #1? (c) If an urn is chosen at random and two objects are drawn simultaneously, what is the probability that both are pencils? Solution to Exercise 4.24. Define events E = {Urn #1 is selected}, F = {A pencil is selected}. (a) We compute Pr(F ) = Pr(F | E) Pr(E) + Pr(F | E c ) Pr(E c ) 7 1 4 1 = · + · 10 2 12 2 31 = ≈ 0.517. 60 (b) We compute Pr(F | E) Pr(E) Pr(F ) (7/10) · (1/2) = 31/60 21 = ≈ 0.677. 31  Pr(E | F ) =  Baye's law, using (a) to get Pr(F ),  (c) We need slightly different events, so we let E = {Urn #1 is selected}, F = {First item selected is a pencil}, G = {Second item selected is a pencil}.  120  Exercises for Chapter 4  Then Pr(F and G) = Pr(F ) Pr(G | F ). We already know Pr(F ) = 31/60 from (a). To compute Pr(G | F ), we do a calculation similar to the calculation in (a). Thus Pr(G | F ) = Pr(G | F &E) Pr(F &E) + Pr(G | F &E c ) Pr(F &E c ) = Pr(G | F &E) Pr(F | E) Pr(E) + Pr(G | F &E c ) Pr(F | E c ) Pr(E c ) 3 4 1 6 7 1 · + · · = · 9 10 2 11 12 2 46 = ≈ 0.279. 165  4.25. An urn contains 20 silver coins and 10 gold coins. You are the sixth person in line to randomly draw and keep a coin from the urn. (a) What is the probability that you draw a gold coin? (b) If you draw a gold coin, what is the probability that the five people ahead of you all drew silver coins? Solution to Exercise 4.25. (a) It doesn't matter if you are the sixth to draw a coin, or the first, or the last, your chance of getting a gold coin is 10/30, since there are 10 gold coins and 30 coins altogether. (If you had some information about the color of the coins drawn by the people ahead of you, that would change the answer, but the problem does not give you any such information.) (b) This part is more difficult. We define events: E = {You draw a gold coin}, F = {Previous 5 people drew silver coins}. We want to compute Pr(F | E) and we will use Baye's law in the form Pr(F | E) =  Pr(E | F ) Pr(F ) . Pr(E)  As already explained, Pr(E) = 1/3. Similarly, it is easy to compute Pr(E | F ). The assumption that F is true means that when you draw your coin, the urn now contains 15 silver coins and 10 gold coins, so your probability of drawing a gold coin is Pr(E | F ) = 10/25 = 2/5. Finally, to compute Pr(F ), define events F1 , . . . , F5 by Fi = {Person #i draws a silver coin}. Then  Exercises for Chapter 4  121  Pr(F ) = Pr(F1 &F2 &F3 &F4 &F5 ) = Pr(F1 ) · Pr(F2 | F1 ) · Pr(F3 | F1 &F2 ) · Pr(F4 | F1 &F2 &F3 ) · Pr(F5 | F1 &F2 &F3 &F4 ) 20 19 18 17 16 = · · · · 30 29 28 27 26 2584 = ≈ 0.109. 23751 We now have the values needed to solve the problem: Pr(F | E) =  Pr(E | F ) Pr(F ) (2/5) · (2584/23751) 5168 = = ≈ 0.131. Pr(E) 1/3 39585  Thus with no other knowledge, there is approximately an 11% chance that the first five coins chosen are silver, but if we know that the sixth coin chosen is gold, then the probability that the first five were silver increases to approximately 13%. 4.26. (The Monty Hall Problem) Monty Hall gives Dan, a contestant, the choice of three boxes. One box contains a valuable prize and the other two contain nothing. Dan chooses a box, but does not yet open it. Monty Hall then opens one of the other boxes, shows that it is empty, and offers Dan the option of keeping his original box or of switching it for the remaining box. The Monty Hall problem is to figure out Dan's best strategy: "To hold or to switch?" The answer may depend on the strategy that Monty Hall employs in deciding which box to open when he has a choice, i.e., when Dan initially chooses the prize box and the other two boxes are empty. This problem considers various strategies. (We assume in all cases that Dan is aware of Monty Hall's chosen strategy.) (a) Suppose that when Monty Hall has a choice, he randomly opens one of the two empty boxes. Should Dan hold or switch, and what is his probability of winning? (b) Suppose that Monty Hall has mentally labeled the boxes 0, 1, and 2, and that if Dan chooses Box n and if the other two boxes are empty, then Monty Hall opens Box n + 1. (If n = 2, then he opens Box 0.) Should Dan hold or switch, and what is his probability of winning? (c) Again assume that Monty Hall has mentally labeled the boxes 0, 1, and 2, but now suppose that Monty Hall always opens the lowest-numbered empty box. What is Dan's best strategy and what is his probability of winning? (You may assume that the prize is placed in each box with equal probability.) (d) Same questions as in (b) and (c), except that Dan also knows how the boxes are labeled. (e) With the same assumptions as in (c), suppose that Dan employs his best strategy and that Monty Hall knows that Dan is employing this strategy.  122  Exercises for Chapter 4  Can Monty Hall hurt Dan's chances of winning by placing the prize in one box more often than the others? But if he does so and if Dan knows, can Dan do better by changing his strategy? (f) Suppose that we return to the scenario in (a), but we give Monty Hall another option, namely he can force Dan to keep the box that Dan initially chose. Now what is Dan's best strategy to win the prize and what is Monty Hall's best strategy to stop Dan? Solution to Exercise 4.26. A solution for this exercise is not currently available. 4.27. Let S be a set, let A be a property of interest, and suppose that for m ∈ S, we have Pr(m has property A) = δ. Suppose further that a Monte Carlo algorithm applied to m and a random number r satisfy: (1) If the algorithm returns Yes, then m definitely has property A. (2) If m has property A, then the probability that the algorithm returns Yes is at least p. Notice that we can restate (1) and (2) as conditional probabilities: (1) Pr(m has property A | algorithm returns Yes) = 1, (2) Pr(algorithm returns Yes | m has property A) ≥ p. Suppose that we run the algorithm N times on the number m, and suppose that the algorithm returns No every single time. Derive a lower bound, in terms of δ, p, and N , for the probability that m does not have property A. (This generalizes the version of the Monte Carlo method that we studied in Section 4.3.3 with δ = 0.01 and p = 21 . Be careful to distinguish p from 1 − p in your calculations.) Solution to Exercise 4.27. Let E = {an element m ∈ S does not have property A}. F = {the algorithm returns No N times in a row}. We want a lower bound for the conditional probability Pr(E | F ), that is, the probability that m does not have property A despite the fact that the algorithm returned No N times. We compute this probability using Bayes's formula Pr(F | E) Pr(E) Pr(E | F ) = . Pr(F | E) Pr(E) + Pr(F | E c ) Pr(E c ) We are given that the probability of have property A is δ, so Pr(E) = Pr(not A) = 1 − δ  and  Pr(E c ) = Pr(A) = δ.  Exercises for Chapter 4  123  Next consider Pr(F | E). If m does not have property A, which is our assumption on this conditional probability, then the algorithm always returns No, since Property (1) tells us that a Yes output forces m to have property A. Thus Pr(No | not A) = Pr(A | Yes) = 1, from which it follows that Pr(F | E) = Pr(No | not A)N = 1. Finally, we must compute the value of Pr(F | E c ). Since the algorithm is run N independent times, we have Pr(F | E c ) = Pr(Output is No | m has property A)N ¡ ¢N = 1 − Pr(Output is Yes | m has property A) N  ≤ (1 − p)  from Property (2) of the Monte Carlo method.  Substituting these values into Bayes's formula, we find that if the algorithm returns No N times in a row, then the probability that the integer m does not have property A is Pr(E | F ) ≥  1 · (1 − δ) 1−δ = . N 1 · (1 − δ) + (1 − p) · δ 1 − δ + (1 − p)N · δ  If δ and p are not too small and N is large, this can be approximated by Pr(E | F ) ≥ 1 −  (1 − p)N · δ (1 − p)N (1 − p)N · δ ≈ 1 − = 1 − . 1 − δ + (1 − p)N · δ 1−δ δ −1 − 1  4.28. We continue with the setup described in Exercise 4.27. 9 and p = 34 . If we run the algorithm 25 times on the (a) Suppose that δ = 10 input m and always get back No, what is the probability that m does not have property A? (b) Same question as (a), but this time we run the algorithm 100 times. 99 (c) Suppose that δ = 100 and p = 12 . How many times should we run the algorithm on m to be 99% confident that m does not have property A, assuming that every output is No? (d) Same question as (c), except now we want to be 99.9999% confident. Solution to Exercise 4.28. A solution for this exercise is not currently available. 4.29. If an integer n is composite, then the Miller–Rabin test has at least a 75% chance of succeeding in proving that n is composite, while it never misidentifies a prime as being composite. (See Table 3.2 in Section 3.4 for a description of the Miller–Rabin test.) Suppose that we run the Miller–Rabin test N times on the integer n and that it fails to prove that n is composite. Show that the probability that n is prime satisfies (approximately)  124  Exercises for Chapter 4 Pr(n is prime | the Miller–Rabin test fails N times) ≥ 1 −  ln(n) . 4N  (Hint. Use Exercise 4.27 with appropriate choices of A, S, δ, and p. You may also use the estimate from Section 3.4.1 that the probability that n is prime is approximately 1/ ln(n).) Solution to Exercise 4.29. In Exercise 4.27 we let A be the property of being composite and we let p = 34 , since we know that if n is composite, then the Miller–Rabin test returns Yes at least 75% of the time. Further, we have δ ≈ 1 − 1/ ln(n), since δ is the probability that n is composite, which is 1 minus the probability that it is prime. The solution to that exercise says that (approximately) Pr(n is prime | the Miller–Rabin test fails N times) (1 − p)N δ −1 − 1 ln(n) − 1 ≈1− 4N ln(n) ≈1− N . 4 ≥1−  4.30. Let fX (k) be the binomial Pn density function (4.23). Prove directly, using the binomial theorem, that k=0 fX (k) = 1. Solution to Exercise 4.30. Let q = 1 − p, so p + q = 1. Then we use the binomial theorem to compute n n µ ¶ n µ ¶ X X X n k n k n−k n−k fX (k) = p (1 − p) = p q = (p + q)n = 1n = 1. k k k=0  k=0  k=0  4.31. In Example 4.37 P∞we used a differentiation trick to compute the value of the infinite series n=1 np(1 − p)n−1 . This exercise further develops this useful technique. The starting point is the formula for the geometric series ∞ X n=0  (a) Prove that  xn =  1 1−x  ∞ X n=1  nxn−1 =  for |x| < 1.  (4.1)  1 (1 − x)2  (4.2)  by differentiating both sides of (4.57) with respect to x. For which x does the left-hand side of (4.58) converge? (Hint. Use the ratio test.)  Exercises for Chapter 4  125  (b) Differentiate again to prove that ∞ X  n(n − 1)xn−2 =  n=2  2 . (1 − x)3  (4.3)  (c) More generally, prove that for every k ≥ 0, ¶ ∞ µ X n+k n 1 . x = (1 − x)k+1 k n=0 (Hint. Use induction on k.) (d) Prove that ∞ X  n2 xn =  n=0  x + x2 . (1 − x)3  (4.4)  (4.5)  (Hint. Multiply (4.58) by x and (4.59) by x2 and then add them together.) (e) Find a formula for ∞ X n3 xn . (4.6) n=0  (f) Prove that for every value of k there is a polynomial Fk (x) such that ∞ X n=0  nk x n =  Fk (x) . (1 − x)k+1  (4.7)  (Hint. Use induction on k.) Compute the polynomials F0 (x), F1 (x), and F2 (x). (g) Prove that the polynomial Fk (x) in (f) has degree k. Solution to Exercise 4.31. (a) Term-by-term differentiation gives the formula. We compute |(n + 1)xn+1 | n+1 = lim |x| = |x|. n→∞ n→∞ |nxn | n  ρ = lim  The ratio test tells us that the series converges for |x| < 1 and diverges for |x| > 1. And the series clearly also diverges for |x| = 1. (b) Term-by-term differentiation of (a) gives the formula. (c) Differentiating k times gives ∞ X n=0  n(n − 1)(n − 2) · · · (n − k + 1)xn−k =  1 · 2 · 3···k . (1 − x)k+1  (If one wants to be formal, one can prove this formula by induction on k.) Now divide both sides by k! and use the definition of the combinatorial symbol to get  126  Exercises for Chapter 4 ∞ µ ¶ X n n−k 1 . x = k (1 − x)k+1  n=k  (Notice that we only need to start the summation with n = k, since terms with n = 0, 1, . . . , k−1 give 0.) Finally, in the summation on the left, replace n by n + k, so now the sum starts at n = 0. This gives ¶ ∞ µ X n+k n 1 x = . k (1 − x)k+1 n=0 (d) Following the hint, we first compute x  ∞ X  nxn−1 + x2  n=1  ∞ X  n(n − 1)xn−2 =  n=2  ∞ X ¡  ∞ X ¢ n + n(n − 1) xn = n2 xn .  n=0  n=0  Then, according to our results in (a) and (b), this is also equal to 2x2 x + x2 x + = . (1 − x)2 (1 − x)3 (1 − x)3 (e) One way to do this is to differentiate (b) and then combine various quantities to get the desired result. An easier method is to differentiate both sides of (d). Thus ¶ µ∞ µ ¶ d X 2 n d x + x2 n x = dx n=0 dx (1 − x)3 ∞ X  n3 xn−1 =  n=0  1 + 4x + x2 . (1 − x)4  Multiplying both sides by x gives the desired result, ∞ X  n3 xn =  n=0  x + 4x2 + x3 . (1 − x)4  (f, g)From the geometric series we have F0 (x) = 1, and (a) and (d) give F1 (x) = x and F2 (x) = x + x2 . Now assume that ∞ X n=0  nk xn =  Fk (x) (1 − x)k+1  is true for k, where Fk (x) is a polynomial of degree k. Differentiating both sides and using the differentiation rule for quotients yields ∞ X  nk+1 xn−1 =  n=0  =  (1 − x)k+1 Fk0 (x) − (k + 1)(1 − x)k (−1)Fk (x) (1 − x)2k+2 (1 − x)Fk0 (x) + (k + 1)Fk (x) (1 − x)k+2  Exercises for Chapter 4  127  Multiplying both sides by x gives ∞ X  nk+1 xn =  n=0  (x − x2 )Fk0 (x) + (k + 1)xFk (x) , (1 − x)k+2  so the desired formula is true with Fk+1 (x) = (x − x2 )Fk0 (x) + (k + 1)xFk (x). Since the degree of Fk0 (x) is one smaller than the degree of Fk (x), we also see that deg Fk+1 (x) = 1 + deg Fk (x). Since deg F0 (x) = 0, we conclude that deg Fk (x) = k. 4.32. In each case, compute the expectation of the random variable X. (a) The values of X are uniformly distributed on the set {0, 1, 2, . . . , N − 1}. (See Example 4.28.) (b) The values of X are uniformly distributed on the set {1, 2, . . . , N }. (c) The values of X are uniformly distributed on the set {1, 3, 7, 11, 19, 23}. (d) X is a random variable with a binomial density function (see (4.23) on page 221). Solution to Exercise 4.32. (a) 1 1 1 1 +1· +2· + · · · + (N − 1) · N N N N 0 + 1 + 2 + · · · + (N − 1) = N 1 (N − 1)N = 2 N N −1 = . 2  E(X) = 0 ·  (b) 1 1 1 1 +2· +3· + ··· + N · N N N N 1 + 2 + 3 + ··· + N = N 1 N (N + 1) = 2 N N +1 = . 2  E(X) = 1 ·  (c)  128  Exercises for Chapter 4 E(X) =  1 + 3 + 7 + 11 + 19 + 23 64 32 = = . 6 6 3  (d) E(X) =  n X  k · fX (k)  k=0 n X  µ ¶ n k p (1 − p)n−k k = k k=0 µ ¶µ ¶k n X n p n = (1 − p) k . k 1−p k=0  If we let x = p/(1 − p), then we need to compute the value of the sum µ ¶ n X n k k x . k k=0  To do this, we start with the binomial theorem n µ ¶ X n k x = (x + 1)n k k=0  and differentiate both sides with respect to x to get µ ¶ n X n k−1 k x = n(x + 1)n−1 . k k=0  Now multiply both sides by x to get µ ¶ n X n k k x = nx(x + 1)n−1 . k k=0  This gives the value E(X) = (1−p)n ·n·  µ ¶n−1 µ ¶n−1 p p p 1 · +1 = (1−p)n ·n· · = np. 1−p 1−p 1−p 1−p  This makes sense, since if we perform the experiment n times and have a probability p of succeeding each time, we would expect to succeed, on average, a total of np times. 4.33. Let X be a random variable on the probability space Ω. It might seem more natural to define the expected value of X by the formula X X(ω) · Pr(ω). (4.8) ω∈Ω  Prove that the formula (4.64) gives the same value as equation (4.27) on page 225, which we used in the text to define E(X).  Exercises for Chapter 4  129  Solution to Exercise 4.33. We compute (the key step comes in the middle where we reverse the order of summation): E(X) = = =  n X i=1 n X i=1 n X  xi · fX (xi ) xi · Pr(X = xi ) © ª xi Pr ω ∈ Ω : X(ω) = xi  i=1  =  n X  xi  X  ω∈Ω X(ω)=xi  i=1  =  X  ω∈Ω  =  X  Pr(ω)  Pr(ω)  X  xi  1≤i≤n xi =X(ω)  Pr(ω) · X(ω),  ω∈Ω  where for the final equality we use that fact that x1 , . . . , xn are distinct, so each X(ω) is equal to exactly one of the xi values. Section. Collision algorithms and the birthday paradox 4.34. (a) In a group of 23 strangers, what is the probability that at least two of them have the same birthday? How about if there are 40 strangers? In a group of 200 strangers, what is the probability that one of them has the same birthday as your birthday? (Hint. See the discussion in Section 4.4.1.) (b) Suppose that there are N days in a year (where N could be any number) and that there are n people. Develop a general formula, analogous to (4.28), for the probability that at least two of them have the same birthday. (Hint. Do a calculation similar to the proof of (4.28) in the collision theorem (Theorem 4.38), but note that the formula is a bit different because the birthdays are being selected from a single list of N days.) (c) Find a lower bound of the form Pr(at least one match) ≥ 1 − e−(some function of n and N ) for the probability in (b), analogous to the estimate (4.29). Solution to Exercise 4.34. We start by doing (b).  130  Exercises for Chapter 4 µ ¶ µ ¶ at least one match all n birthdays Pr = 1 − Pr in n attempts are different  th  n i birthday is different Y  Pr from all of the =1− i=1 previous i − 1 birthdays n Y N − (i − 1) =1− N i=1 µ ¶ n−1 Y i =1− 1− . N i=1  Then the answer to the first part of (a) is obtained by setting N = 365 and n = 23, which gives (a)  Pr(match) = 1 −  ¶ 22 µ Y i 1− ≈ 50.73%. 365 i=1  Similarly, N = 365 and n = 40 gives the answer to the second part of (a), (b)  ¶ 39 µ Y i Pr(match) = 1 − 1− ≈ 89.12%. 365 i=1  The final part of (a) is Pr(someone has your birthday) = 1 − Pr(no one has your birthday) = 1 − Pr(one person does not have your birthday)200 µ ¶200 364 =1− 365 ≈ 42.23%. For (c) we use the lower bound e−x ≥ 1 − x with x = i/N to compute µ Pr  ¶ ¶ n−1 Yµ i at least one match =1− 1− in n attempts N i=1 ≥1−  n−1 Y  e−i/N  i=1 −(1+2+···+(n−1))/N  =1−e  = 1 − e−(n−1)n/2N 2  ≈ 1 − e−n  /2N  Notice that we have used the well known formula  .  Exercises for Chapter 4  131  1 + 2 + · + (n − 1) =  n(n − 1) . 2  4.35. A deck of cards is shuffled and the top eight cards are turned over. (a) What is the probability that the king of hearts is visible? (b) A second deck is shuffled and its top eight cards are turned over. What is the probability that a visible card from the first deck matches a visible card from the second deck? (Note that this is slightly different from Example 4.39 because the cards in the second deck are not being replaced.) Solution to Exercise 4.35. A solution for this exercise is not currently available. 4.36. (a) Prove that e−x ≥ 1 − x  for all values of x.  (Hint. Look at the graphs of e−x and 1 − x, or use calculus to compute the minimum of the function f (x) = e−x − (1 − x).) (b) Prove that for all a > 1, the inequality 1 e−ax ≤ (1 − x)a + ax2 2  is valid for all 0 ≤ x ≤ 1.  (This is a challenging problem.) (c) We used the inequality in (a) during the proof of the lower bound (4.29) in the collision theorem (Theorem 4.38). Use (b) to prove that Pr(at least one red) ≤ 1 − e−mn/N +  mn2 . 2N 2  Thus if N is large and m and n are not much larger than estimate Pr(at least one red) ≈ 1 − e−mn/N  √  N , then the  is quite accurate. (Hint. Use (b) with a = m and x = n/N .) Solution to Exercise 4.36. (a) Let f (x) = e−x − 1 + x. Then f (0) = f 0 (0) = 0. Then generalized mean value theorem says that 1 f (x) = f (0) + f 0 (0)x + f 00 (z)x2 2  for some 0 ≤ z ≤ x,  so we find that f (x) = 12 e−z x2 ≥ 0. This is the desired inequality. (b) Let 1 f (x) = (1 − x)a + ax2 − e−ax . 2  132  Exercises for Chapter 4  Since f (0) = 0, it suffices to prove that f 0 (x) = −a(1 − x)a−1 + ax + ae−ax is positive for 0 < x < 1. We can divide by a, and for notational convenience, we let a = b + 1. So we need to prove that g(x) = −(1 − x)b + x + e−(b+1)x is positive for 0 < x < 1 and b > 0. From (a) we know that e−x > 1 − x, so raising both sides to the bth power and multiplying by −1 gives −(1 − x)b > −e−bx . Substituting this into g(x), we find that g(x) > −e−bx + x + e−(b+1)x = x − e−bx (1 − e−x ). It is clear that this last expression is increasing as b increases. (To be more formal, its derivative with respect to b is be−bx (1 − e−x ), which is strictly positive for 0 < x < 1.) Hence the expression is minimized when b = 0, so we get g(x) > x − (1 − e−x ) = e−x − (1 − x). Using (a) again gives g(x) > 0. Remark: It appears to be true numerically that f (x) ≥ 0 provided that a > 0.8526055 . . . , where c = 0.8526055 . . . is the unique real solution to cec = 2. (c) We have µ ¶ ³ n ´m at least Pr = 1 − 1 − from the Collision Theorem one red N ¶ µ n mn2 use (b) with a = m and x = . ≤ 1 − e−mn/N − 2 2N N 4.37. Solve the discrete logarithm problem 10x = 106 in the finite field F811 by finding a collision among the random powers 10i and 106 · 10i that are listed in Table 4.17. Solution to Exercise 4.37. From Table 4.17 we see that 10234 = 106 · 10399 = 304 Hence  in F811 .  10234 · 10−399 = 10−165 = 10645 = 106  in F811 .  Exercises for Chapter 4 i 116 497 225 233 677 622  hi a · hi 96 444 326 494 757 764 517 465 787 700 523 290  133  hi a · hi 291 28 239 193 358 642 789 101 24 111 748 621  i 519 286 298 500 272 307  i 791 385 178 471 42 258  hi a · hi 496 672 437 95 527 714 117 237 448 450 413 795  i 406 745 234 556 326 399  hi a · hi 801 562 194 289 304 595 252 760 649 670 263 304  Table 4.12: Data for Exercise 4.37, h = 10, a = 106, p = 811  Section. Pollard's ρ method 4.38. Table 4.18 gives some of the computations for the solution of the discrete logarithm problem 11t = 41387 in F81799 (4.9) using Pollard's ρ method. (It is similar to Table 4.11 in Example 4.51.) Use the data in Table 4.18 to solve (4.65). Solution to Exercise 4.38.  α154 = 81756, 81756  11  x308 = x154 = 15386 in F81799 . β154 = 9527, γ154 = 67782, · 41387  9527  = 11  67782  13974  11  28637  · 41387  δ154 = 28637. in F81799 .  19110  = 41387 in F81799 . gcd(19110, 81798) = 6. 81340 · 19110 ≡ 6 (mod 81798). 1113974·81340 = 111136645160 = 1161950 = 413876 in F81799 . 81798 61950 = 10325, = 13633. 6 6 log11 (41387) ∈ {10325 + 13633 · k : 0 ≤ k < 6} = {10325, 23958, 37591, 51224, 64857, 78490}. 1110325 = 73192,  1123958 = 40412,  1137591 = 49019,  1164857 = 41387 ,  1178490 = 32780.  1151224 = 8607,  4.39. Table 4.19 gives some of the computations for the solution of the discrete logarithm problem 7t = 3018 in F7963 (4.10)  134  Exercises for Chapter 4 i 0 1 2 3 4 151 152 153 154  xi  yi  1 11 121 1331 14641  1 121 14641 42876 7150  0 1 2 3 4  0 0 0 0 0  0 2 4 12 25  0 0 0 2 4  33573 53431 23112 15386  .. . 40876 81754 81755 81756  45662 9527 9527 9527  29798 37394 67780 67782  73363 48058 28637 28637  4862 23112 8835 15386  αi  βi  γi  δi  Table 4.13: Computations to solve 11t = 41387 in F81799 for Exercise 4.38  using Pollard's ρ method. (It is similar to Table 4.11 in Example 4.51.) Extend Table 4.19 until you find a collision (we promise that it won't take too long) and then solve (4.66).  Solution to Exercise 4.39. Extending the table:  i 87 88 89 90 91 92 93  xi 1329 1340 1417 1956 5729 2449 1217  yi 1494 1539 4767 1329 1417 5729 1217  αi 6736 6737 6738 6739 6740 6740 6741  βi 7647 7647 7647 7647 7647 7648 7648  γi 3148 3150 6302 4642 4644 4646 4647  δi 3904 3904 7808 7655 7655 7655 7656  Exercises for Chapter 4  135  x186 = x93 = 1217 in F7963 . β93 = 7648, γ93 = 4647,  α93 = 6741,  76741 · 30187648 = 74647 · 30187656 2094  7  = 3018  2094  7  8  δ93 = 7656.  in F7963 .  in F7963 .  8  = 3018 in F7963 . gcd(8, 7962) = 2.  6967 · 8 ≡ 2 (mod 7962). 2094·6967  = 714588898 = 72514 = 30182 in F7963 . 7962 2514 = 1257, = 3981. 2 2 log7 (3018) ∈ {1257 + 3981 · k : 0 ≤ k < 2} = {1257, 5238}. 7  71257 = 4945,  i 0 1 2 3 4  xi  yi  αi  1 7 49 343 2401  1 49 2401 6167 1399  87 88 89 90  1329 1340 1417 1956  1494 1539 4767 1329  0 1 2 3 4 .. . 6736 6737 6738 6739  75238 = 3018.  βi  γi  δi  0 0 0 0 0  0 2 4 6 7  0 0 0 0 1  7647 7647 7647 7647  3148 3150 6302 4642  3904 3904 7808 7655  Table 4.14: Computations to solve 7t = 3018 in F7963 for Exercise 4.39  4.40. Write a computer program implementing Pollard's ρ method for solving the discrete logarithm problem and use it to solve each of the following: (a) 2t = 2495 in F5011 . (b) 17t = 14226 in F17959 . (c) 29t = 5953042 in F15239131 . Solution to Exercise 4.40. (a) 23351 = 2495 . (b) 1714557 = 14226 . (c) 292528453 = 5953042 .  136  Exercises for Chapter 4  R∞ 2 4.41. Evaluate the integral I = 0 t2 e−t /2 dt appearing in the proof of Theorem 4.47. (Hint. Write I 2 as an iterated integral, Z ∞Z ∞ 2 2 2 I = x2 e−x /2 · y 2 e−y /2 dx dy, 0  0  and switch to polar coordinates.) Solution to Exercise 4.41. Following the hint, we have Z ∞Z ∞ 2 2 I2 = x2 e−x /2 y 2 e−y /2 dx dy Z0 ∞ Z0 ∞ 2 2 = x2 y 2 e−(x +y )/2 dx dy 0  Z  0  ∞  Z  π/2  = 0  0 π/2  ÃZ =  (r sin θ)2 (r cos θ)2 e−r ! µZ 2  ∞  2  sin θ cos θ dθ  2  /2  ¶ 5 −r 2 /2  r e  0  r dr dθ dr .  0  Each of these integrals is now a moderately hard freshman calculus exercise. For the first one we can use ¶2 µ 1 1 − cos(4θ) 1 sin(2θ) = · . sin2 θ cos2 θ = (sin θ cos θ)2 = 2 4 2 Then Z  π/2  Z 2  π/2  2  sin θ cos θ dθ = 0  0  ¯π/2 1 − cos(4θ) θ sin(4θ) ¯¯ π dθ = − . = 8 8 32 ¯0 16  For the second integral we substitute r2 = z and then integrate by parts twice. Thus Z ∞ Z ∞ 2 1 r5 e−r /2 dr = z 2 e−z/2 dz 2 0 0 Z ∞ ¯∞ ¯ ze−z/2 dz = −z 2 e−z/2 ¯ + 2 0 0 Z ∞ =2 ze−z/2 dz 0 Z ∞ ¯∞ −z/2 ¯ e−z/2 dz = −4ze ¯ +4 0 0 Z ∞ e−z/2 dz =4 0 ¯∞ ¯ = −8e−z/2 ¯ = 8. 2  Hence I = π/16 · 8 = π/2, so I =  p  0  π/2.  Exercises for Chapter 4  137  Section. Information theory 4.42. Consider the cipher that has three keys, three plaintexts, and four ciphertexts that are combined using the following encryption table (which is similar to Table 4.12 used in Example 4.53 on page 246). k1 k2 k3  m1 c2 c1 c3  m2 c4 c3 c1  m3 c1 c2 c2  Suppose further that the plaintexts and keys are used with the following probabilities: f (m1 ) = f (m2 ) =  2 , 5  f (m3 ) =  1 , 5  f (k1 ) = f (k2 ) = f (k3 ) =  1 . 3  (a) Compute f (c1 ), f (c2 ), f (c3 ), and f (c4 ). (b) Compute f (c1 | m1 ), f (c1 | m2 ), and f (c1 | m3 ). Does this cryptosystem have perfect secrecy? (c) Compute f (c2 | m1 ) and f (c3 | m1 ). (d) Compute f (k1 | c3 ) and f (k2 | c3 ). Solution to Exercise 4.42. A solution for this exercise is not currently available. 4.43. Suppose that a shift cipher is employed such that each key, i.e., each shift amount from 0 to 25, is used with equal probability and such that a new key is chosen to encrypt each successive letter. Show that this cryptosystem has perfect secrecy P by filling in the details of the following steps. (a) Show that k∈K fM (dk (c)) = 1 for every ciphertext c ∈ C. (b) Compute the ciphertext density function fC using the formula X fC (c) = fK (k)fM (dk (c)). k∈K  (c) Compare fC (c) to fC|M (c | m). Solution to Exercise 4.43. A solution for this exercise is not currently available. 4.44. Suppose that a cryptosystem has the same number of plaintexts as it does ciphertexts (#M = #C). Prove that for any given key k ∈ K and any given ciphertext c ∈ C, there is a unique plaintext m ∈ M that encrypts to c using the key k. (We used this fact during the proof of Theorem 4.55. Notice that the proof does not require the cryptosystem to have perfect secrecy; all that is needed is that #M = #C.)  138  Exercises for Chapter 4  Solution to Exercise 4.44. Fix k ∈ K. The encryption map ek : M → C is injective by definition of a cryptosystem, so our assumption that #M = #C implies that ek is also surjective, and hence is a bijective map from M to C. This is equivalent to the assertion that for every c ∈ C, there is a unique m ∈ M satisfying ek (m) = c, which is the desired result. © ª 4.45. Let Sm,c = k ∈ K : ek (m) = c be the set used during the proof of Theorem 4.55. Prove that if c 6= c0 , then Sm,c ∩ Sm,c0 = ∅. (Prove this for any cryptosystem; it is not necessary to assume perfect secrecy.) Solution to Exercise 4.45. Suppose that k ∈ Sm,c ∩Sm,c0 . Then c = ek (m) = c0 . Hence Sm,c ∩Sm,c0 6= ∅ implies that c = c0 . 4.46. Suppose that a cryptosystem satisfies #K = #M = #C and that it has perfect secrecy. Prove that every ciphertext is used with equal probability and that every plaintext is used with equal probability. (Hint. We proved one of these during the course of proving Theorem 4.55. The proof of the other is similar.) Solution to Exercise 4.46. A solution for this exercise is not currently available. 4.47. Prove the "only if" part of Theorem 4.55, i.e., prove that if a cryptosystem with an equal number of keys, plaintexts, and ciphertexts satisfies conditions (a) and (b) of Theorem 4.55, then it has perfect secrecy. Solution to Exercise 4.47. A solution for this exercise is not currently available. 4.48. Let X be an experiment (random variable) with outcomes x1 , . . . , xn occurring with probabilities p1 , . . . , pn , and similarly let Y be an experiment with outcomes y1 , . . . , ym occurring with probabilities q1 , . . . , qm . Consider the experiment Z consisting of first performing X and then performing Y . Thus the outcomes of Z are the mn pairs (xi , yj ) occurring with probabilities pi qj . Use the formula for entropy (4.51) to prove that H(Z) = H(X) + H(Y ). Thus entropy is additive on independent compound events, which is a special case of Property H3 on page 250. Solution to Exercise 4.48. Using the formula for entropy, we compute  Exercises for Chapter 4 H(Z) = − =− =−  139  n X m X i=1 j=1 n X m X  pi qj log(pi qj ) pi qj (log pi + log qj )  i=1 j=1 m X  n X  i=1  j=1  pi log pi  qj −  n X  pi  i=1  m X  qj log qj  j=1  = H(X) · 1 + 1 · H(Y ).  4.49. Let F (t) be a twice differentiable function with the property that F 00 (t) < 0 for all x in its domain. Prove that F is concave in the sense of (4.52). Conclude in particular that the function F (t) = log t is concave for all t > 0. Solution to Exercise 4.49. A solution for this exercise is not currently available. 4.50. Use induction to prove Jensen's inequality (Theorem 4.59). Solution to Exercise 4.50. The case n = 2 is true by definition of concavity. Assume now that it is true for n. The idea is to combine two of the terms in the sum α1 t1 + · · · + αn tn + αn+1 tn+1 into one term, say the last two. In other words, we want to write αn tn + αn+1 tn+1 as βn yn , but we need to make sure that α1 + α2 + · · · + αn−1 + βn = 1. So we need to take βn = αn + αn+1 , which means that we need to take yn =  αn tn + αn+1 tn+1 . αn + αn+1  With this choice of βn and yn , we have α1 + · · · + αn−1 + βn = 1, so we can apply the induction hypothesis to conclude that f (α1 t1 + · · · + αn−1 tn−1 + βn yn ) ≤ α1 f (t1 ) + · · · + αn−1 f (tn−1 ) + βn f (yn ). We are also going to apply the induction hypothesis to f (yn ). We can write yn as αn+1 αn tn + tn+1 = γtn + δtn+1 , yn = αn + αn+1 αn + αn+1 where notice that γ and δ satisfy γ + δ = 1. Hence the induction hypothesis tells us that f (yn ) = f (γtn + δtn+1 ) ≤ γf (tn ) + δf (tn+1 ).  140  Exercises for Chapter 4  Now multiplying both sides by βn and substituting in the values γ, δ, and βn yields βn f (yn ) ≤ βn γf (tn ) + βn δf (tn+1 ) = αn f (tn ) + αn+1 f (tn+1 ). Finally, substituting this in above gives the desired inequality f (α1 t1 + · · · + αn tn + αn+1 tn+1 ) ≤ α1 f (t1 ) + · · · + αn f (tn ) + αn+1 f (tn+1 ). The induction proof that there is equality if and only if all of the ti 's are equal is similar. 4.51. Let X and Y be independent random variables. (a) Prove that the equivocation H(X | Y ) is equal to the entropy H(X). (b) If H(X | Y ) = H(X), is it necessarily true that X and Y are independent? Solution to Exercise 4.51. Independence means that f (x | y) = f (x), so X H(X | Y ) = − f (y)f (x | y) log f (x | y) x,y  =−  X  f (y)f (x) log f (x)  x,y  =−  X  f (y)  y  X  f (x) log f (x)  x  = 1 · H(X). For the converse, notice that H(X) = −  X  f (x) log f (x)  x  =−  X ³X x  =−  X  ´ f (x, y) log f (x)  y  f (y)f (x | y) log f (x),  x,y  so H(X) − H(X | Y ) = −  X  f (y)f (x | y) log  x,y  =−  X x,y  f (x, y) log  f (x) f (x | y)  f (x)f (y) . f (x, y)  It is likely that one could come up with dependent random variables X and Y making this quantity vanish.  Exercises for Chapter 4  141  4.52. Suppose a cryptosystem has two keys, K = {k1 , k2 }, each of which is equally likely to be used, and suppose that it has three plaintexts M = {m1 , m2 , m3 } that occur with probabilities f (m1 ) = 21 , f (m2 ) = 41 , and f (m3 ) = 14 . (a) Create an encryption function for this cipher, similar to Example 4.53, such that there are three ciphertexts C = {c1 , c2 , c3 } and such that the ciphertext c1 occurs with probability 21 . (There is more than one correct answer to this problem.) (b) Compute the entropies H(K), H(M ), and H(C) of your encryption scheme in (a). (c) Compute the key equivocation H(K | C). (d) Use your answer in (c) to explain why each ciphertext leaks information. Solution to Exercise 4.52. A solution for this exercise is not currently available. 4.53. Suppose that the key equivocation of a certain cryptosystem vanishes, i.e., suppose that H(K | C) = 0. Prove that even a single observed ciphertext uniquely determines which key was used. Solution to Exercise 4.53. A solution for this exercise is not currently available. 4.54. Write a computer program that reads a text file and performs the following tasks: [1] Convert all alphabetic characters to lowercase and convert all strings of consecutive nonalphabetic characters to a single space. (The reason for leaving in a space is that when you count bigrams and trigrams, you will want to know where words begin and end.) [2] Count the frequency of each letter a-to-z, print a frequency table, and use your frequency table to estimate the entropy of a single letter in English, as we did in Section 4.6.3 using Table 1.3. [3] Count the frequency of each bigram aa, ab,. . . ,zz, being careful to include only bigrams that appear within words. (As an alternative, also allow bigrams that either start or end with a space, in which case there are 272 − 1 = 728 possible bigrams.) Print a frequency table of the 25 most common bigrams and their probabilities, and use your full frequency table to estimate the entropy of bigrams in English. In the notation of Section 4.6.3, this is the quantity H(L2 ). Compare 12 H(L2 ) with the value of H(L) from step [1]. [4] Repeat [3], but this time with trigrams. Compare 31 H(L3 ) with the values of H(L) and 21 H(L2 ) from [2] and [3]. (Note that for this part, you will need a large quantity of text in order to get some reasonable frequencies.) Try running your program on some long blocks of text. For example, the following noncopyrighted material is available in the form of ordinary text files from Project Gutenberg at http://www.gutenberg.net/. To what extent  142  Exercises for Chapter 4  are the letter frequencies similar and to what extent do they differ in these different texts? (a) Alice's Adventures in Wonderland by Lewis Carroll, http://www.gutenberg.net/etext/11 (b) Relativity: the Special and General Theory by Albert Einstein, http://www.gutenberg.net/etext/5001 (c) The Old Testament (translated from the original Hebrew, of course!), http://www.gutenberg.net/etext/1609 (d) 20000 Lieues Sous Les Mers (20000 Leagues Under the Sea) by Jules Verne, http://www.gutenberg.net/etext/5097. Note that this one is a little trickier, since first you will need to convert all of the letters to their unaccented forms.  Chapter 5  Elliptic Curves and Cryptography Exercises for Chapter 5 Section. Elliptic curves 5.1. Let E be the elliptic curve E : Y 2 = X 3 − 2X + 4 and let P = (0, 2) and Q = (3, −5). (You should check that P and Q are on the curve E.) (a) Compute P ⊕ Q. (b) Compute P ⊕ P and Q ⊕ Q. (c) Compute P ⊕ P ⊕ P and Q ⊕ Q ⊕ Q. Solution to Exercise 5.1. (a) P ⊕ Q = (22/9, 100/27). (b) P ⊕ P = Q ⊕ Q = (1/4, −15/8). (c) P ⊕ P ⊕ P = (240, 3718) and Q ⊕ Q ⊕ Q = (−237/121, −845/1331). 5.2. Check that the points P = (−1, 4) and Q = (2, 5) are points on the elliptic curve E : Y 2 = X 3 + 17. (a) Compute the points P ⊕ Q and P ª Q. (b) Compute the points 2P and 2Q. (Bonus. How many points with integer coordinates can you find on E?) Solution to Exercise ¡ 8 5.2.109 ¢ (a) P + Q = − 9 , − 27 and P − Q = (8, 23). ¡ ¢ ¡ ¢ 2651 59 (b) 2P = 137 and 2Q = − 64 64 , − 512 25 , 125 Bonus. This curve has 16 points with integer coordinates, including one that is quite large. This is somewhat surpising number. The points are (−2, ±3), (−1, ±4), (2, ±5), (4, ±9), (8, ±23), (43, ±282), (52, ±375), (5234, ±378661). There are no others, but that's not so easy to prove. 143  144  Exercises for Chapter 5  5.3. Suppose that the cubic polynomial X 3 + AX + B factors as X 3 + AX + B = (X − e1 )(X − e2 )(X − e2 ). Prove that 4A3 + 27B 2 = 0 if and only if two (or more) of e1 , e2 , and e3 are the same. (Hint. Multiply out the right-hand side and compare coefficients to relate A and B to e1 , e2 , and e3 .) Solution to Exercise 5.3. We have X 3 + AX + B = X 3 − (e1 + e2 + e3 )X 2 + (e1 e2 + e1 e3 + e2 e3 )X − e1 e2 e3 , and comparing the coefficients gives three relations e1 + e2 + e3 = 0, e1 e2 + e1 e3 + e2 e3 = A, e1 e2 e3 = B. Suppose first that two of the ei are the same, say e2 = e3 . Then we get e1 + 2e2 = 0,  2e1 e2 + e22 = A,  e1 e22 = B.  So e1 = −2e2 , and substituting this into the second and third equations gives −3e22 = A Hence  and  − 2e32 = B.  4A3 + 27B 2 = 4(−3e22 )3 + 27(−2e32 )2 = 0.  Conversely, suppose that 4A3 + 27B 2 = 0. Substituting the expressions for A and B from above and multiplying it out gives the rather complicated expression 4A3 + 27B 2 = (4e32 + 12e3 e22 + 12e23 e2 + 4e33 )e31 + (12e3 e32 + 51e23 e22 + 12e33 e2 )e21 + (12e23 e32 + 12e33 e22 )e1 + 4e33 e32 . Next we substitute e1 = −e2 − e3 to get 4A3 + 27B 2 = −4e62 − 12e3 e52 + 3e23 e42 + 26e33 e32 + 3e43 e22 − 12e53 e2 − 4e63 . We'd like to know that this last expression vanishes if any two of the ei are the same. It is not hard to check that it is a multiple of e2 − e3 , and indeed a multiple of (e2 − e3 )2 . But we'd also like it to vanish when e3 = e1 , which is the same as when e3 = −e2 − e3 . So we check and find that the expression is divisible by e2 + 2e3 , and in fact it is divisible by (e2 + 2e3 )2 . Similarly, it is divisible by (e3 + 2e2 )2 . So we find that  Exercises for Chapter 5  145  4A3 + 27B 2 = −(e2 − e3 )2 (e2 + 2e3 )2 (e3 + 2e2 )2 . Hence using the fact that e1 + e2 + e3 = 0, we find that 4A3 + 27B 2  if and only if  (e2 − e3 )2 (e1 − e3 )2 (e1 − e2 )2 = 0,  5.4. Sketch each of the following curves, as was done in Figure 5.1 on page 280. (a) E : Y 2 = X 3 − 7X + 3. (b) E : Y 2 = X 3 − 7X + 9. (c) E : Y 2 = X 3 − 7X − 12. (d) E : Y 2 = X 3 − 3X + 2. (e) E : Y 2 = X 3 . Notice that the curves in (d) and (e) have ∆E = 0, so they are not elliptic curves. How do their pictures differ from the pictures in (a), (b), and (c)? Each of the curves (d) and (e) has one point that is somewhat unusual. These unusual points are called singular points. Section. Elliptic curves over finite fields 5.5. For each of the following elliptic curves E and finite fields Fp , make a list of the set of points E(Fp ). (a) E : Y 2 = X 3 + 3X + 2 over F7 . (b) E : Y 2 = X 3 + 2X + 7 over F11 . (c) E : Y 2 = X 3 + 4X + 5 over F11 . (d) E : Y 2 = X 3 + 9X + 5 over F11 . (e) E : Y 2 = X 3 + 9X + 5 over F13 . Solution to Exercise 5.5. (a) #E(F7 ) = 9 E(F7 ) = {O, (0, 3), (0, 4), (2, 3), (2, 4), (4, 1), (4, 6), (5, 3), (5, 4)} (b) #E(F11 ) = 7 E(F11 ) = {O, (6, 2), (6, 9), (7, 1), (7, 10), (10, 2), (10, 9)} (c) #E(F11 ) = 8 E(F11 ) = {O, (0, 4), (0, 7), (3, 0), (6, 5), (6, 6), (9, 0), (10, 0)} (d) #E(F11 ) = 14 E(F11 ) = {O, (0, 4), (0, 7), (1, 2), (1, 9), (2, 3), (2, 8), (3, 2), (3, 9), (6, 0), (7, 2), (7, 9), (9, 1), (9, 10)}  146  Exercises for Chapter 5  (e) #E(F13 ) = 9 E(F13 ) = {O, (4, 1), (4, 12), (8, 2), (8, 11), (9, 3), (9, 10), (10, 4), (10, 9)}  5.6. Make an addition table for E over Fp , as we did in Table 5.1. (a) E : Y 2 = X 3 + X + 2 over F5 . (b) E : Y 2 = X 3 + 2X + 3 over F7 . (c) E : Y 2 = X 3 + 2X + 5 over F11 . You may want to write a computer program for (c), since E(F11 ) has a lot of points! Solution to Exercise 5.6. (a) E(F5 ) = {O, (1, 2), (1, 3), (4, 0)}. O (1, 2) (1, 3) (4, 0)  O O (1, 2) (1, 3) (4, 0)  (1, 2) (1, 2) (4, 0) O (1, 3)  (1, 3) (1, 3) O (4, 0) (1, 2)  (4, 0) (4, 0) (1, 3) (1, 2) O  (b) E(F7 ) = {O, (2, 1), (2, 6), (3, 1), (3, 6), (6, 0)}. O (2, 1) (2, 6) (3, 1) (3, 6) (6, 0)  O O (2, 1) (2, 6) (3, 1) (3, 6) (6, 0)  (2, 1) (2, 1) (3, 6) O (2, 6) (6, 0) (3, 1)  (2, 6) (2, 6) O (3, 1) (6, 0) (2, 1) (3, 6)  (3, 1) (3, 1) (2, 6) (6, 0) (3, 6) O (2, 1)  (3, 6) (3, 6) (6, 0) (2, 1) O (3, 1) (2, 6)  (6, 0) (6, 0) (3, 1) (3, 6) (2, 1) (2, 6) O  (c) E(F11 ) = {O, (0, 4), (0, 7), (3, 4), (3, 7), (4, 0), (8, 4), (8, 7), (9, 2), (9, 9)}. O (0, 4) (0, 7) (3, 4) (3, 7) (4, 0) (8, 4) (8, 7) (9, 2) (9, 9)  O  (0, 4)  (0, 7)  (3, 4)  (3, 7)  (4, 0)  (8, 4)  (8, 7)  (9, 2)  (9, 9)  O (0, 4) (0, 7) (3, 4) (3, 7) (4, 0) (8, 4) (8, 7) (9, 2) (9, 9)  (0, 4) (9, 2) O (8, 7) (9, 9) (8, 4) (3, 7) (4, 0) (3, 4) (0, 7)  (0, 7) O (9, 9) (9, 2) (8, 4) (8, 7) (4, 0) (3, 4) (0, 4) (3, 7)  (3, 4) (8, 7) (9, 2) (8, 4) O (9, 9) (0, 7) (3, 7) (4, 0) (0, 4)  (3, 7) (9, 9) (8, 4) O (8, 7) (9, 2) (3, 4) (0, 4) (0, 7) (4, 0)  (4, 0) (8, 4) (8, 7) (9, 9) (9, 2) O (0, 4) (0, 7) (3, 7) (3, 4)  (8, 4) (3, 7) (4, 0) (0, 7) (3, 4) (0, 4) (9, 2) O (9, 9) (8, 7)  (8, 7) (4, 0) (3, 4) (3, 7) (0, 4) (0, 7) O (9, 9) (8, 4) (9, 2)  (9, 2) (3, 4) (0, 4) (4, 0) (0, 7) (3, 7) (9, 9) (8, 4) (8, 7) O  (9, 9) (0, 7) (3, 7) (0, 4) (4, 0) (3, 4) (8, 7) (9, 2) O (8, 4)  5.7. Let E be the elliptic curve E : y 2 = x3 + x + 1. Compute the number of points in the group E(Fp ) for each of the following primes: (a) p = 3. (b) p = 5. (c) p = 7. (d) p = 11.  Exercises for Chapter 5  147  In each case, also compute the trace of Frobenius tp = p + 1 − #E(Fp ) √ and verify that |tp | is smaller than 2 p. Solution to Exercise 5.7. p 3 5 7 11 13 17  #E(Fp ) 4 9 5 14 18 18  tp 0 −3 3 −2 −4 0  √ 2 p 3.46 4.47 5.29 6.63 7.21 8.25  Section. The elliptic curve discrete logarithm problem 5.8. Let E be the elliptic curve E : y 2 = x3 + x + 1 and let P = (4, 2) and Q = (0, 1) be points on E modulo 5. Solve the elliptic curve discrete logarithm problem for P and Q, that is, find a positive integer n such that Q = nP . Solution to Exercise 5.8. We compute the multiples of P : P = (4, 2),  2P = (3, 4),  6P = (2, 1),  3P = (2, 4),  7P = (3, 1),  4P = (0, 4),  8P = (4, 3),  5P = (0, 1)  9P = O.  Thus logP (Q) = 5 in E(F5 ). It turns out that E(F5 ) contains 9 points, and the multiples of P give all of them. 5.9. Let E be an elliptic curve over Fp and let P and Q be points in E(Fp ). Assume that Q is a multiple of P and let n0 > 0 be the smallest solution to Q = nP . Also let s > 0 be the smallest solution to sP = O. Prove that every solution to Q = nP looks like n0 + is for some i ∈ Z. (Hint. Write n as n = is + r for some 0 ≤ r < s and determine the value of r.) Solution to Exercise 5.9. Following the hint, we write n as n = is + r for some 0 ≤ r < s. Then Q = nP = (is + r)P = i(sP ) + rP = iO + rP = rP, since by definition sP = O. But n0 P is the smallest multiple of P that is equal to Q, so we must have r ≥ n0 . If r = n0 , we're done, so suppose instead that r > n0 .  148  Exercises for Chapter 5  Then O = Q − Q = rP − n0 P = (r − n0 )P, and we know that sP is the smallest (nonzero) multiple of P that is equal to O, so r − n0 ≥ s. But this contradicts r < s. Hence r = n0 , which proves that n = is + n0 . 5.10. Use the double-and-add algorithm (Table 5.3) to compute nP in E(Fp ) for each of the following curves and points, as we did in Figure 5.4. (a)  E : Y 2 = X 3 + 23X + 13, 2  3  2  3  (b) E : Y = X + 143X + 367, (c)  p = 83,  P = (24, 14),  n = 19;  p = 613,  P = (195, 9),  n = 23;  E : Y = X + 1828X + 1675, p = 1999, P = (1756, 348), n = 11;  (d) E : Y 2 = X 3 + 1541X + 1335, p = 3221, P = (2898, 439), n = 3211. Solution to Exercise 5.10. (a) Solution: 19 ∗ (24, 14) = (24, 69). Step i n Q = 2i P R 0 19 (24, 14) O 1 9 (30, 8) (24, 14) 2 4 (24, 69) (30, 75) 3 2 (30, 75) (30, 75) 4 1 (24, 14) (30, 75) 5 0 (30, 8) (24, 69) Compute 19 · (24, 14) on Y 2 = X 3 + 23X + 13 modulo 83. (b) Solution: 23 ∗ (195, 9) = (485, 573). Step i n 0 23 1 11 2 5 3 2 4 1 5 0 Compute 23 · (195, 9) on  Q = 2i P R (195, 9) O (407, 428) (195, 9) (121, 332) (182, 355) (408, 110) (194, 565) (481, 300) (194, 565) (401, 150) (485, 573) Y 2 = X 3 + 143X + 367 modulo 613  (c) Solution: 11 ∗ (1756, 348) = (1068, 1540). Step i n Q = 2i P R 0 11 (1756, 348) O 1 5 (1526, 1612) (1756, 348) 2 2 (1657, 1579) (1362, 998) 3 1 (1849, 225) (1362, 998) 4 0 (586, 959) (1068, 1540) Compute 11 · (1756, 348) on Y 2 = X 3 + 1828X + 1675 modulo 1999  Exercises for Chapter 5  149  (d) Solution: 3211 ∗ (2898, 439) = (243, 1875). Step i n Q = 2i P R 0 3211 (2898, 439) O 1 1605 (2964, 2977) (2898, 439) 2 802 (1372, 2349) (781, 2494) 3 401 (2956, 1288) (781, 2494) 4 200 (1045, 1606) (341, 1727) 5 100 (770, 285) (341, 1727) 6 50 (2589, 1698) (341, 1727) 7 25 (2057, 2396) (341, 1727) 8 12 (1017, 828) (2117, 1162) 9 6 (1988, 1949) (2117, 1162) 10 3 (1397, 1477) (2117, 1162) 11 1 (420, 1274) (2362, 757) 12 0 (2583, 2597) (243, 1875) Compute 3211 · (2898, 439) on Y 2 = X 3 + 1541X + 1335 modulo 3221 5.11. Convert the proof of Proposition 5.18 into an algorithm and use it to write each of the following numbers n as a sum of positive and negative powers of 2 with at most 12 blog nc + 1 nonzero terms. Compare the number of nonzero terms in the binary expansion of n with the number of nonzero terms in the ternary expansion of n. (a) 349. (b) 9337. (c) 38728. (d) 8379483273489. Solution to Exercise 5.11. (a) Binary expansion has 6 terms. Ternary expansion has 5 terms. 349 = +21 + 23 + 24 + 25 + 27 + 29 = +21 − 23 − 26 − 28 + 210 (b) Binary expansion has 7 terms. Ternary expansion has 5 terms. 9337 = +21 + 24 + 25 + 26 + 27 + 211 + 214 = +21 − 24 + 28 + 211 + 214 (c) Binary expansion has 7 terms. Ternary expansion has 6 terms. 38728 = +24 + 27 + 29 + 210 + 211 + 213 + 216 = +24 + 27 − 29 − 212 + 214 + 216 (d) Binary expansion has 21 terms. Ternary expansion has 10 terms. 8379483273489 = +21 + 25 + 29 + 212 + 213 + 214 + 216 + 217 + 218 + 219 + 220 + 221 + 233 + 234 + 235 + 236 + 237 + 240 + 241 + 242 + 243 = +21 + 25 + 29 − 212 − 215 + 222 − 233 + 238 − 240 + 244  150  Exercises for Chapter 5  5.12. In Section 4.5 we gave an abstract description of Pollard's ρ method, and in Section 4.5.2 we gave an explicit version to solve the discrete logarithm problem in Fp . Adapt this material to create a Pollard ρ algorithm to solve the ECDLP. Solution to Exercise 5.12. We want to find n so that Q = nP , where P, Q ∈ E(Fp ) are given. We also assume that we know an integer N such that N P = O and N Q = O. For example, we can take N = #E(Fp ). To apply Pollard's method, we need a function f : E(Fp ) → E(Fp ) that mixes up the points reasonably well. Following the ideas from Section 4.5.2, we define   P + T if 0 ≤ xT < p/3, f : E(Fp ) −→ E(Fp ), f (T ) = 2T if p/3 ≤ xT < 2p/3,   Q + T if 2p/3 ≤ xT < p. Then after i steps, we have f i (O) = αi P + βi Q  and  f 2i (O) = γi P + δi Q  for certain integer values of αi , βi , γi , δi . We can keep track of the values of αi , βi , γi , δi just as we did in Section 4.5.2. Note that the values of αi , βi , γi , δi should be computed modulo N , which prevents them from getting too big. √ After O( N ) steps, we expect to find a match f i (O) = f 2i (O). This means that (αi − γi )P = (δi − βi )Q  in E(Fp ).  If gcd(δi − βi , N ) = 1, we can multiply both sides by (δi − βi )−1 mod N to express Q as a multiple of P . More generally, we can use the same sort of calculation described in Section 4.5.2 to find gcd(δi − βi , N ) possible values of n, and then we can test each of them to see if nP is equal to Q. (In practice, N will be prime, or at worst a small multiple of a large prime, so there will be few cases to check.) Section. Elliptic curve cryptography 5.13. Alice and Bob agree to use elliptic Diffie–Hellman key exchange with the prime, elliptic curve, and point p = 2671,  E : Y 2 = X 3 + 171X + 853,  P = (1980, 431) ∈ E(F2671 ).  Exercises for Chapter 5  151  (a) Alice sends Bob the point QA = (2110, 543). Bob decides to use the secret multiplier nB = 1943. What point should Bob send to Alice? (b) What is their secret shared value? (c) How difficult is it for Eve to figure out Alice's secret multiplier nA ? If you know how to program, use a computer to find nA . (d) Alice and Bob decide to exchange a new piece of secret information using the same prime, curve, and point. This time Alice sends Bob only the x-coordinate xA = 2 of her point QA . Bob decides to use the secret multiplier nB = 875. What single number modulo p should Bob send to Alice, and what is their secret shared value? Solution to Exercise 5.13. (a) Bob sends B = g b = 2871 ≡ 805 (mod 1373) to Alice. Their shared value (a) Bob sends the point QB = 1943P = (1432, 667) ∈ E(F2671 ) to Alice. (b) Their secret shared value is the x-coordinate x=2424 of the point nB QA = 1943(2110, 543) = (2424, 911) ∈ E(F2671 ). (c) By hand, it takes a long time to find nA . But p is small enough that it's not too hard on a computer. Alice's secret value was nA = 2045, but it turns out that the point P has order 1319, so in the smallest value that works is nA = 726 , since 726P = (2110, 543) = QA ∈ E(F2671 ). (d) Bob computes QB = 875P = (161, 2040) ∈ E(F2671 ), but he sends Alice only the x-coordinate xB = 161 . In order to find the shared value, Bob computes 2 yA = x3A + 171xA + 853 = 23 + 171 · 2 + 853 = 1203,  yA = 1203(2671+1)/4 = 1203668 ≡ 2575 (mod 2671), nB (xA , yA ) = 875(2, 2575) = (1708, 1419) ∈ E(F2671 ). The shared value is the x-coordinate x = 1708 . 5.14. Exercise 2.10 on page 107 describes a multistep public key cryptosystem based on the discrete logarithm problem for Fp . Describe a version of this cryptosystem that uses the elliptic curve discrete logarithm problem. (You may assume that Alice and Bob know the order of the point P in the group E(Fp ), i.e., they know the smallest integer N ≥ 1 with the property that N P = O.) Solution to Exercise 5.14. A solution for this exercise is not currently available. 5.15. A shortcoming of using an elliptic curve E(Fp ) for cryptography is the fact that it takes two coordinates to specify a point in E(Fp ). However, as discussed briefly at the end of Section 5.4.2, the second coordinate actually conveys very little additional information.  152  Exercises for Chapter 5  (a) Suppose that Bob wants to send Alice the value of a point R ∈ E(Fp ). Explain why it suffices for Bob to send Alice the x-coordinate of R = (xR , yR ) together with the single bit ( 0 if 0 ≤ yR < 12 p, βR = 1 if 21 p < yR < p. (You may assume that Alice is able to efficiently compute square roots modulo p. This is certainly true, for example, if p ≡ 3 (mod 4); see Proposition 2.27.) (b) Alice and Bob decide to use the prime p = 1123 and the elliptic curve E : Y 2 = X 3 + 54X + 87. Bob sends Alice the x-coordinate x = 278 and the bit β = 0. What point is Bob trying to convey to Alice? What about if instead Bob had sent β = 1? Solution to Exercise 5.15. (a) Alice computes x3R + AxR + B. This quantity has two square roots, say b and p − b. One of b or p − b is between 0 and 12 p, the other is between 21 p and p. So the value of βR tells Alice exactly which square root to take for yR . (b) First compute u = 2783 + 54 · 278 + 87 ≡ 216 (mod 1123). Then compute u(1123+1)/4 ≡ 487 (mod 1123). So the two possible points are (278, 487) and (278, 636), since 636 = 1123 − 487. From the way that β is chosen, we have β = 0 =⇒ R = (278, 487)  and  β = 1 =⇒ R = (278, 636)  5.16. The Menezes–Vanstone variant of the elliptic ElGamal public key cryptosystem improves message expansion while avoiding the difficulty of directly attaching plaintexts to points in E(Fp ). The MV-ElGamal cryptosystem is described in Table 5.12 on page 343. (a) The last line of Table 5.12 claims that m01 = m1 and m02 = m2 . Prove that this is true, so the decryption process does work. (b) What is the message expansion of MV-ElGamal? (c) Alice and Bob agree to use p = 1201,  E : Y 2 = X 3 + 19X + 17,  P = (278, 285) ∈ E(Fp ),  for MV-ElGamal. Alice's secret value is nA = 595. What is her public key? Bob sends Alice the encrypted message ((1147, 640), 279, 1189). What is the plaintext? Solution to Exercise 5.16.  Exercises for Chapter 5  153  (a) Suppose that Bob has encrypted the plaintext (m1 , m2 ) using the random number k as described in Table 5.12 and that he sends Alice his ciphertext (R, c1 , c2 ). Alice's first step is to compute T = nA R. However, using the definition of R, S and QA , we see that Alice is actually computing T = nA R = nA (kP ) = k(nA P ) = kQA = S. Thus xS = xT and yS = yT , so Alice's second step yields −1 m01 ≡ x−1 T c1 ≡ xS (xS m1 ) ≡ m1  (mod p),  m02 ≡ yT−1 c2 ≡ yS−1 (yS m2 ) ≡ m2  (mod p).  This shows that Alice recovers Bob's plaintext. Notice how she uses her secret multiplier nA during the decryption process. (b) The plaintext (m1 , m2 ) consists of two numbers modulo p. The ciphertext (R, c1 , c2 ) consists of four numbers modulo p, since R has two coordinates. So the message expansion ratio is 2-to-1 . This can be improved if Bob sends only the x-coordinate of R, plus one extra bit to enable Alice to determine the correct y-coordinate. In that case, the cipher text is three numbers modulo p (plus one bit), so the message expansion ratio is approximately 3-to-2 . (c) Alice public key is QA = nA P = 595 · (278, 285) = (1104, 492) . To decrypt, Alice computes T = nA (1147, 640) = 595(1147, 640) = (942, 476). −1 She then computes x−1 · 279 ≡ 509 (mod 1201) and yT−1 c2 = T c1 = 941 476−1 · 1189 ≡ 767 (mod 1201). So the plaintext is (509, 767) . 5.17. This exercise continues the discussion of the MV-ElGamal cryptosystem described in Table 5.12 on page 343. (a) Eve knows the elliptic curve E and the ciphertext values c1 and c2 . Show how Eve can use this knowledge to write down a polynomial equation (modulo p) that relates the two pieces m1 and m2 of the plaintext. In particular, if Eve can figure out one piece of the plaintext, then she can recover the other piece by finding the roots of a certain polynomial modulo p. (b) Alice and Bob exchange a message using MV-ElGamal with the prime, elliptic curve, and point in Exercise 5.16(c). Eve intercepts the ciphertext ((269, 339), 814, 1050) and, through other sources, she discovers that the first part of the plaintext is m1 = 1050. Use your algorithm in (a) to recover the second part of the plaintext. Solution to Exercise 5.17. (a) Eve knows the equation of the elliptic curve, E : Y 2 = X 3 + AX + B. The coordinates of the point S ∈ E(Fp ) satisfy  154  Exercises for Chapter 5 xS ≡ m−1 1 c1  (mod p),  m−1 2 c2  (mod p),  yS ≡  and the point (xS , yS ) satisfies the equation for E, so Eve knows that −1 −1 2 3 (m−1 2 c2 ) ≡ (m1 c1 ) + A(m1 c1 ) + B  (mod p).  Eve clears denominators by multiplying by m31 m22 , so c22 m31 ≡ c31 m22 + Ac1 m21 m22 + Bm31 m22  (mod p).  Thus (m1 , m2 ) is a solution to the congruence c22 u3 ≡ c31 v 2 + Ac1 u2 v 2 + Bu3 v 2  (mod p),  so in particular, if Eve knows either m1 or m2 , then she can find the other one by substituting in the known value and finding the roots modulo p of the resulting polynomial. (b) m2 = 179. A solution for this exercise is not currently available. Section. Lenstra's elliptic curve factorization algorithm 5.18. Use the elliptic curve factorization algorithm to factor each of the numbers N using the given elliptic curve E and point P . (a)  E : Y 2 = X 3 + 4X + 9,  N = 589,  (b) N = 26167,  3  P = (2, 12).  2  3  P = (1, 1).  2  3  P = (7, 4).  E : Y = X + 4X + 128,  (c) N = 1386493,  E : Y = X + 3X − 3,  (d) N = 28102844557,  P = (2, 5).  2  E : Y = X + 18X − 453,  Solution to Exercise 5.18. (a) n n! · P mod 589 1 P = (2, 5) 2 2! · P = (564, 156) 3 3! · P = (33, 460) 4 4! · P = (489, 327) Factorial multiples of P on Y 2 = X 3 + 4X + 9 modulo 589 Computation of 5! · P gives 589 = 19 · 31. (b) n 1 2 3 4 5 6  n! · P mod 26167 P = (2, 12) 2! · P = (23256, 1930) 3! · P = (21778, 1960) 4! · P = (22648, 14363) 5! · P = (5589, 11497) 6! · P = (7881, 16198)  Exercises for Chapter 5  155  Public Parameter Creation A trusted party chooses and publishes a (large) prime p, an elliptic curve E over Fp , and a point P in E(Fp ). Alice Bob Key Creation Chooses a secret multiplier nA . Computes QA = nA P . Publishes the public key QA . Encryption Chooses plaintext values m1 and m2 modulo p. Chooses a random number k. Computes R = kP . Computes S = kQA and writes it as S = (xS , yS ). Sets c1 ≡ xS m1 (mod p) and c2 ≡ yS m2 (mod p). Sends ciphtertext (R, c1 , c2 ) to Alice. Decryption Computes T = nA R and writes it as T = (xT , yT ). Sets m01 ≡ x−1 T c1 (mod p) and m02 ≡ yT−1 c2 (mod p). Then m01 = m1 and m02 = m2 . Table 5.1: Menezes–Vanstone variant of ElGamal (Exercises 5.16, 5.17) Factorial multiples of P on Y 2 = X 3 + 4X + 128 modulo 26167. Computation of 7! · P gives 26167 = 191 · 137. (c) n 1 2 3 4 5 6 7 8 9 10  P 2! · P 3! · P 4! · P 5! · P 6! · P 7! · P 8! · P 9! · P 10! · P  n! · P mod 1386493 = (1, 1) = (7, 1386474) = (1059434, 60521) = (81470, 109540) = (870956, 933849) = (703345, 474777) = (335675, 1342927) = (1075584, 337295) = (149824, 1003869) = (92756, 1156933)  156  Exercises for Chapter 5 Factorial multiples of P on Y 2 = X 3 + 3X − 3 modulo 1386493 Computation of 11! · P gives 1386493 = 1069 · 1297.  (d) n 1 P 2 2! · P 3 3! · P 4 4! · P 5 5! · P .. . 24 24! · P 25 25! · P 26 26! · P 27 27! · P 28 28! · P Factorial multiples of P  n! · P mod 28102844557 = (7, 4) = (1317321250, 11471660625) = (15776264786, 10303407105) = (27966589703, 26991329662) = (11450520276, 14900134804) .. . = (25959867777, 9003083411) = (10400016599, 11715538594) = (22632202481, 6608272585) = (25446531195, 2223850203) = (12412875644, 7213676617) on Y 2 = X 3 + 18X + 28102844104 modulo 28102844557. Computation of 29! · P gives 28102844557 = 117763 · 238639.  Section. Elliptic curves over F2 and over F2k 5.19. Let E be an elliptic curve given by a generalized Weierstrass equation E : Y 2 + a1 XY + a3 Y = X 3 + a2 X 2 + a4 X + a6 . Let P1 = (x1 , y1 ) and P2 = (x2 , y2 ) be points on E. Prove that the following algorithm computes their sum P3 = P1 + P2 . First, if x1 = x2 and y1 + y2 + a1 x2 + a3 = 0, then P1 + P2 = O. Otherwise define quantities λ and ν as follows: [If x1 6= x2 ] [If x1 = x2 ]  y2 − y1 y1 x2 − y2 x1 , ν= , x2 − x1 x2 − x1 −x31 + a4 x1 + 2a6 − a3 y1 3x2 + 2a2 x1 + a4 − a1 y1 , ν= . λ= 1 2y1 + a1 x1 + a3 2y1 + a1 x1 + a3  λ=  Then P3 = P1 + P2 = (λ2 + a1 λ − a2 − x1 − x2 , −(λ + a1 )x3 − ν − a3 ). Solution to Exercise 5.19. This is proven in any basic text on elliptic curves. See for example Group Law Algorithm 2.3 in [123, §2.2]. 5.20. Let F8 = F2 [T ]/(T 3 + T + 1) be as in Example 5.28, and let E be the elliptic curve E : Y 2 + XY + Y = X 3 + T X + (T + 1).  Exercises for Chapter 5  157  (a) Calculate the discriminant of E. (b) Verify that the points P = (1 + T + T 2 , 1 + T ),  Q = (T 2 , T ),  R = (1 + T + T 2 , 1 + T 2 ),  are in E(F8 ) and compute the values of P + Q and 2R. (c) Find all of the points in E(F8 ). (d) Find a point P ∈ E(F8 ) such that every point in E(F8 ) is a multiple of P . Solution to Exercise 5.20. (a) ∆ = 1 + T 2 . (b) P + Q = (1 + T + T 2 , 1 + T 2 ) and 2R = (T 2 , T ). (c, d) The point P = (1 + T + T 2 , 1 + T 2 ) satisfies P = (1 + T + T 2 , 1 + T 2 ) 2P = (T 2 , T ) 3P = (1, 0) 4P = (T 2 , 1 + T + T 2 ) 5P = (1 + T + T 2 , 1 + T ) 6P = O, and this is the complete set of points in E(F8 ). (One can check this directly, or note that if there were more points, since the order of an element divides the order of a group, it would follow √ that #E(F8 ) is at least 12, which contradicts the Hasse bound of 8 + 1 + 2 8 ≈ 11.83.) The multiples of the point 5P also give all of #E(F8 ). 5.21. Let τ (α) = αp be the Frobenius map on Fpk . (a) Prove that τ (α+β) = τ (α)+τ (β)  and  τ (α·β) = τ (α)·τ (β)  for all α, β ∈ Fpk .  (Hint. For the addition formula, use the binomial theorem (Theorem 4.10).) (b) Prove that τ (α) = α for all α ∈ Fp . (c) Let E be an elliptic curve over Fp and let τ (x, y) = (xp , y p ) be the Frobenius map from E(Fpk ) to itself. Prove that τ (P + Q) = τ (P ) + τ (Q)  for all P ∈ E(Fpk ).  5.22. Let E0 be the Koblitz curve Y 2 + XY = X 3 + 1 over the field F2 , and for every k ≥ 1, let tk = 2k + 1 − #E(F2k ). (a) Prove that t1 = −1 and t2 = −3.  158  Exercises for Chapter 5  (b) Prove that tk satisfies the recursion tk = t1 tk−1 − ptk−2  for all t ≥ 3.  (You may use the formula (5.12) that we stated, but did not prove, on page 313.) (c) Use the recursion in (b) to compute #E(F16 ). (d) Program a computer to calculate the recursion and use it to compute the values of #E(F211 ), #E(F231 ), and #E(F2101 ). Solution to Exercise 5.22. (a) A solution for this exercise is not currently available. (b) A solution for this exercise is not currently available. (c) #E(F16 ) = 16. (d) #E(F211 ) = 2116. #E(F231 ) = 2147574356. #E(F2101 ) = 2535301200456455833701195805484. 5.23. Let τ satisfy τ 2 = −2 − τ . Prove that the following algorithm gives coefficients vi ∈ {−1, 0, 1} such that the positive integer n is equal to n = v0 + v1 τ + v2 τ 2 + · · · + v` τ ` .  (5.1)  Further prove that at most one-third of the vi are nonzero and that ` ≤ log(n). [1] Set n0 = n and n1 = 0 and i = 0 [2] Loop while n0 6= 0 or n1 6= 0 [3] If n0 is odd ¡ ¢ [4] Set vi = 2 − (n0 − 2n1 ) mod 4 [5] Set n0 = n0 − vi [6] Else [7] Set vi = 0 [8] End If [9] Set i = i + 1 ¡ ¢ [10] Set (n0 , n1 ) = n1 − 12 n0 , − 12 n0 [11] End Loop Solution to Exercise 5.23. A solution for this exercise is not currently available. 5.24. Implement the algorithm in Exercise 5.23 and use it to compute the τ expansion (5.19) of the following integers. What is the highest power of τ that appears and how many nonzero terms are there? (a) n = 931  (b) n = 32755  Solution to Exercise 5.24. (a)  (c) n = 82793729188  Exercises for Chapter 5  159  931 = −1 + τ 2 + τ 10 + τ 14 − τ 17 − τ 19 − τ 21 . The highest power of τ is τ 21 and the τ -expansion has 7 nonzero terms. (b) 32755 = −1 + τ 2 + τ 4 + τ 6 + τ 8 + τ 15 − τ 17 + τ 19 − τ 22 + τ 28 − τ 31 . The highest power of τ is τ 31 and the τ -expansion has 11 nonzero terms. (c) 82793729188 = τ 2 + τ 8 − τ 10 − τ 12 + τ 15 + τ 18 + τ 20 − τ 24 − τ 27 + τ 30 − τ 34 + τ 36 − τ 40 + τ 44 + τ 46 − τ 48 + τ 50 − τ 52 + τ 55 + τ 58 + τ 61 + τ 68 − τ 71 − τ 73 . The highest power of τ is τ 73 and the τ -expansion has 24 nonzero terms. Section. Bilinear pairings on elliptic curves 5.25. Let R(x) and S(x) be rational functions. Prove that the divisor of a product is the sum of the divisors, i.e., ¡ ¢ ¡ ¢ ¡ ¢ div R(x)S(x) = div R(x) + div S(x) . 5.26. Prove that the Weil pairing satisfies em (P, Q) = em (Q, P )−1  for all P, Q, ∈ E[m].  (Hint. Use the fact that em (P + Q, P + Q) = 1 and expand using bilinearity.) 5.27. This exercise asks you to verify that the Weil pairing em is welldefined. (a) Prove that the value of em (P, Q) is independent of the choice of rational functions fP and fQ . (b) Prove that the value of em (P, Q) is independent of the auxiliary point S. (Hint. Fix the points P and Q and consider the quantity Á fP (Q + S) fQ (P − S) F (S) = fP (S) fQ (−S) as a function of S. Compute the divisor of F and use the fact that every nonconstant function on E has at least one zero.) You might also try to prove that the Weil pairing is bilinear, but do not be discouraged if you do not succeed, since the standard proofs use more tools than we have developed in the text. 5.28. Choose a basis {P1 , P2 } for E[m] and write each P ∈ E[m] as a linear combination P = aP P1 + bP P2 . (See Remark 5.39.) Use the basic properties of the Weil pairing described in Theorem 5.38 to prove that ³a a ´ em (P, Q) = em (P1 , P2 )  det  P  Q  bP bQ  = em (P1 , P2 )aP bQ −aQ bP .  160  Exercises for Chapter 5  5.29. Complete the proof of Proposition 5.51 by proving that φ(2P ) = 2φ(P ). 5.30. For each of the following elliptic curves E, finite fields Fp , points P and Q of order m, and auxiliary points S, use Miller's algorithm to compute the Weil pairing em (P, Q). (See Example 5.43.)  (a) (b) (c) (d)  E  p  P  Q  m  S  y 2 = x3 + 23  1051  (109 203)  (240 203)  5  (1,554)  2  3  y = x − 35x − 9  883  (5, 66)  (103, 602)  7  (1,197)  2  3  1009  (8, 703)  (49, 20)  7  (0,0)  2  3  1009  (417, 952)  (561, 153)  7  (0,0)  y = x + 37x y = x + 37x  Notice that (c) and (d) use the same elliptic curve. Letting P 0 and Q0 denote the points in (d), verify that P 0 = 2P,  Q0 = 3Q,  and  e7 (P 0 , Q0 ) = e7 (P, Q)6 .  Solution to Exercise 5.30. (a) We have #E(F1051 = 1075 = 52 ·43. The point S has order 215. Miller's algorithm gives fP (Q + S) 109 = = 203 fP (S) 306  and  fQ (P − S) 552 = = 312. fQ (−S) 406  Taking the ratio of these two values yields e5 (P, Q) =  203 = 671 ∈ F1051 . 312  (b) We have #E(F883 ) = 882 = 2 · 32 · 72 The point S has order 126. Miller's algorithm gives fP (Q + S) 387 = = 730 fP (S) 413  and  fQ (P − S) 454 = = 469. fQ (−S) 161  Taking the ratio of these two values yields e7 (P, Q) =  730 = 749 ∈ F883 . 469  (c) We have #E(F1009 ) = 980 = 22 · 5 · 72 . The point S has order 2. Miller's algorithm gives 92 fP (Q + S) = = 739 fP (S) 478  and  Taking the ratio of these two values yields  fQ (P − S) 800 = = 574. fQ (−S) 810  Exercises for Chapter 5  161  e7 (P, Q) =  739 = 105 ∈ F1009 . 574  (d) Miller's algorithm gives fP (Q + S) 86 = = 384 fP (S) 531  and  fQ (P − S) 919 = = 969. fQ (−S) 759  Taking the ratio of these two values yields e7 (P, Q) =  384 = 394 ∈ F1009 . 969  Finally, we check that e7 (P, Q)6 = 1056 = 394 = e7 (P 0 , Q0 ), which is in accordance with P 0 = 2P and Q0 = 3Q. 5.31. Let E over Fq and ` be as described in Theorem 5.44. Prove that the modified Tate pairing is symmetric, in the sense that τ̂ (P, Q) = τ̂ (Q, P )  for all P, Q ∈ E(Fq )[`].  Solution to Exercise 5.31. By assumption we have E(Fq )[`] = Z/`Z, a cyclic group. Let T be a generator. Then any P, Q ∈ E(Fq )[`] can be written as P = uT and Q = vT for some u, v ∈ Z/`Z. But then the linearity of that Tate pairing gives τ̂ (P, Q) = τ̂ (uT, vT ) = τ̂ (T, T )uv , τ̂ (Q, P ) = τ̂ (vT, uT ) = τ̂ (T, T )vu , which are clearly the same value. 5.32. Let E be an elliptic curve over Fq and let P, Q ∈ E(Fq )[`]. Prove that the Weil pairing and the Tate pairing are related by the formula e` (P, Q) =  τ (P, Q) , τ (Q, P )  provided that the Tate pairings on the right-hand side are computed properly. Thus the Weil pairing requires approximately twice as much work to compute as does the Tate pairing. Section. The Weil pairing over fields of prime power order 5.33. Prove Proposition 5.51(b) in the case P1 = P2 . 5.34. Let E be an elliptic curve over Fp and let ` be a prime. Suppose √ that E(Fp ) contains a point of order ` and that ` > p + 1. Prove that E(Fp )[`] ∼ = Z/`Z.  162  Exercises for Chapter 5  Solution to Exercise 5.34. Hasse's theorem says that √ √ #E(Fp ) ≤ p + 1 + 2 p = ( p + 1)2 . The assumption on ` then tells us that #E(Fp ) < `2 . But if E(Fp )[`] is larger than Z/`Z, then it is equal to Z/`Z × Z/`Z, so we would have `2 elements, contradicting #E(Fp ) < `2 . 5.35. Let E be an elliptic curve over a finite field Fq and let ` be a prime. Suppose that we are given four points P, aP, bP, cP ∈ E(Fq )[`]. The (elliptic) decision Diffie–Hellman problem is to determine whether cP is equal to abP . Of course, if we could solve the Diffie–Hellman problem itself, then we could compute abP and compare it with cP , but the Diffie–Hellman problem is often difficult to solve. Suppose that there exists a distortion map φ for E[`]. Show how to use the modified Weil pairing to solve the elliptic decision Diffie–Hellman problem without actually having to compute abP . Solution to Exercise 5.35. Compute ê` (aP, bP ) = ê` (P, P )ab  and  ê` (P, cP ) = ê` (P, P )c .  If they agree, then cP = abP , otherwise cP 6= abP . 5.36. Let E be the elliptic curve E : y 2 = x3 + x and let φ(x, y) = (−x, αy) be the map described in Proposition 5.51. Prove that φ(φ(P √ )) = −P for all P ∈ E. (Intuitively, φ behaves like multiplication by −1 when it is applied to points of E.) Solution to Exercise 5.36. Let P = (x, y). We compute ¡ ¢ φ(φ(P )) = φ(−x, αy) = −(−x), α · αy = (x, α2 y) = (x, −y) = −P.  5.37. Let p ≡ 3 (mod 4), let E : y 2 = x3 + x, let P ∈ E(Fp )[`], and let φ(x, y) = (−x, αy) be the `-distortion map for P described in Proposition 5.52. Suppose further that ` ≡ 3 (mod 4). Prove that φ is an `-distortion map for every point in E[`]. In other words, if Q ∈ E is any point of order `, prove that e` (Q, φ(Q)) is a primitive `th root of unity. Solution to Exercise 5.37. We can write Q = aP + bφ(P ), since {P, φ(P )} is a basis for E[`]. We have φ(Q) = φ(aP + bφ(P )) = aφ(P ) + bφ(φ(P )).  Exercises for Chapter 5  163  Note that φ(φ(P )) = φ(φ(x, y)) = φ(−x, αy) = (x, α2 y) = (x, −y) = −P. (This was a previous exercise.) So φ(Q) = −bP + aφ(P ). Hence e` (Q, φ(Q)) = e` (aP + bφ(P ), −bP + aφ(P )) 2  2  = e` (P, P )−ab e` (P, φ(P ))a e` (φ(P ), P )−b e` (φ(P ), φ(P ))ab = e` (P, φ(P ))a  2  +b2  .  We know that e` (P, φ(P )) is a primitive `th -root of unity, so either e` (Q, φ(Q)) is a primitive `th -root of unity, or else a2 + b2 is a multiple of `. (Note that we can assume that take 0 ≤ a, b < ` and that a and b are not both 0.) But if ` divides a2 + b2 , then we get µ 2 ¶ µ 2 ¶ µ ¶µ 2 ¶ µ ¶ a −b −1 b −1 1= = = = , ` ` ` ` ` so −1 is a square modulo `. From an easy piece of quadratic reciprocity, this implies that ` ≡ 1 (mod 4), contradicting our assumption that ` ≡ 3 (mod 4). 5.38. Let E be the elliptic curve E : y 2 = x3 + 1 over a field K, and suppose that K contains an element β 6= 1 satisfying β 3 = 1. (We say that β is a primitive cube root of unity.) Define a map φ by φ(x, y) = (βx, y) and  φ(O) = O.  (a) Let P ∈ E(K). Prove that φ(P ) ∈ E(K). (b) Prove that φ respects the addition law on E, i.e., φ(P1 + P2 ) = φ(P1 ) + φ(P2 ) for all P1 , P2 ∈ E(K). 5.39. Let E : y 2 = x3 + 1 be the elliptic curve in Exercise 5.38. (a) Let p ≥ 3 be a prime with p ≡ 2 (mod 3). Prove that Fp does not contain a primitive cube root of unity, but that Fp2 does contain a primitive cube root of unity. (b) Let β ∈ Fp2 be a primitive cube root of unity and define a map φ(x, y) = (βx, y) as in Exercise 5.38. Suppose that E(Fp ) contains a point P of prime order ` ≥ 5. Prove that φ is an `-distortion map for P . Solution to Exercise 5.39. (b) This is the same as the proof of Proposition 5.52. The multiples of P are in E(Fp ), but φ(P ) is not unless its x-coordinate is 0. Then on checks that points on E of the form (0, y) are points of order 3. Hence φ(P ) is not a multiple of P , and then Proposition 5.49 tells us that e` (P, φ(P )) is a primitive `th -root of unity.  164  Exercises for Chapter 5  5.40. Let E be the elliptic curve E : y 2 = x3 + x over the field F691 . The point P = (301, 14) ∈ #E(F691 ) has order 173. Use the distortion map on E from Exercises 5.38 and 5.39 to compute ê173 (P, P ) (cf. Example 5.54). Verify that the value is a primitive 173rd root of unity. Solution to Exercise 5.40. We have φ(P ) = (−301, 14i) = (390, 14i). We randomly choose a point S = (499 + 325i, 41 + 140i) ∈ E(F6912 ) and use Miller's algorithm to compute 452 + 325i fP (φ(P ) + S) = = 432 + 271i, fP (S) 236 + 219i fφ(P ) (P − S) 48 + 608i = = 259 + 271i. fφ(P ) (−S) 115 + 533i Then ê(P, P ) = e173 (P, φ(P )) =  432 + 271i = 242 + 92i ∈ F6912 . 259 + 271i  We check that (242 + 92i)173 = 1. 5.41. Continuing with the curve E, prime p = 691, and point P = (301, 14) from Exercise 5.40, let Q = (143, 27) ∈ E(F691 ). Use the MOV method to solve the ECDLP for P and Q, i.e., compute ê173 (P, Q) and express it as the nth power of ê173 (P, P ). Check your answer by verifying that nP is equal to Q. Solution to Exercise 5.41. The distortion map gives φ(Q) = (548, 278i), and we use the randomly chosen point S = (379 + 605i, 205 + 534i) ∈ E(F6912 ) to compute ê173 (P, Q) = e173 (P, φ(Q)) =  139+432i 506+550i 239+375i 142+299i  = 500 + 603i ∈ F6912 .  From the previous exercise we have ê173 (P, P ) = 242+92i, so we need to solve the DLP (242 + 92i)n = 500 + 603i in F6912 . The solution to this DLP is n = 122, and we can check that Q = P , so n = 122 is also a solution to the ECDLP. Section. Applications of the Weil pairing  Exercises for Chapter 5  165  5.42. Alice, Bob, and Carl use tripartite Diffie–Hellman with the curve E : y 2 = x3 + x  over the field F1723 .  They use the point P = (668, 995) of order 431. (a) Alice chooses the secret value nA = 278. What is Alice's public point QA ? (b) Bob's public point is QB = (1275, 1550) and Carl's public point is QC = (897, 1323). What is the value of ê431 (QB , QC )? (c) What is their shared value? (d) Bob's secret value is nB = 224. Verify that ê431 (QA , QC )nB is the same as the value that you got in (c). (e) Figure out Carl's secret value nC . (Since P has order 431, you can do this on a computer by trying all possible values.) Solution to Exercise 5.42. (a) Alice's public point is QA = nA P = (726, 1127). (b) ê431 (QB , QC ) = 1444 + 1288i. (c) The shared value is ê431 (QB , QC )278 = (1444 + 1288i)278 = 68 + 428i. (d) ê431 (QA , QC )224 = (1264 + 1083i)224 = 68 + 428i. (e) Carl's secret value is nC = 145. We check that he gets the same shared value, ê431 (QA , QB )145 = (977 + 1163i)145 = 68 + 428i. 5.43. Show that Eve can break tripartite Diffie–Hellman key exchange as described in Table 5.10.1 if she knows how to solve the Diffie–Hellman problem (page 67) for the field Fq . Solution to Exercise 5.43. Eve can compute ê` (P, P )  and  ê` (QA , P ) = ê` (nA P, P ) = ê` (P, P )nA .  But she can also compute ê` (QB , QC ) = ê` (P, P )nB nC . Thus Eve knows the quantities g nA  and  g nB nC  for a certain primitive `th root of unity g in F∗q . If she can solve the Diffie– Hellman problem in F∗q , then she can use these known values to compute Alice, Bob, and Carl's shared value g nA nB nC .  Chapter 6  Lattices and Cryptography Exercises for Chapter 6 Section. A congruential public key cryptosystem 6.1. Alice uses the congruential cryptosystem with q = 918293817 and private key (f, g) = (19928, 18643). (a) What is Alice's public key h? (b) Alice receives the ciphertext e = 619168806 from Bob. What is the plaintext? (c) Bob sends Alice a second message by encrypting the plaintext m = 10220 using the ephemeral key r = 19564. What is the ciphertext that Bob sends to Alice? Solution to Exercise 6.1. (a) h = 767748560. (b) First compute a ≡ f e ≡ 600240756 (mod q) Then  m = f −1 a = 9764 · 600240756 ≡ 11818 (mod g).  (The ephemeral key was 19564.) (c) e ≡ rh + m ≡ 619167208 (mod q). Section. Subset-sum problems and knapsack cryptosystems 6.2. Use the algorithm described in Proposition 6.5 to solve each of the following subset-sum problems. If the "solution" that you get is not correct, explain what went wrong. (a) M = (3, 7, 19, 43, 89, 195), S = 260. 167  168  Exercises for Chapter 6  (b) M = (5, 11, 25, 61, 125, 261), S = 408. (c) M = (2, 5, 12, 28, 60, 131, 257), S = 334. (d) M = (4, 12, 15, 36, 75, 162), S = 214. Solution to Exercise 6.2. (a) Output from algorithm is x = (1, 0, 1, 1, 0, 1). Sum is correct. (b) Output from algorithm is x = (1, 1, 0, 0, 1, 1). Sum is 402 instead of 408. Incorrect. Superincreasing, but this S has no solution. (c) Output from algorithm is x = (0, 1, 1, 0, 1, 0, 1). Sum is correct. (d) Output from algorithm is x = (0, 0, 1, 1, 0, 1). Sum is 213 instead of 214. Incorrect. M is not superincreasing, this problem has a solution (1, 1, 0, 1, 0, 1), but it is not found by the algorithm. 6.3. Alice's public key for a knapsack cryptosystem is M = (5186, 2779, 5955, 2307, 6599, 6771, 6296, 7306, 4115, 7039). Eve intercepts the encrypted message S = 26560. She also breaks into Alice's computer and steals Alice's secret multiplier A = 4392 and secret modulus B = 8387. Use this information to find Alice's superincreasing private sequence r and then decrypt the message. Solution to Exercise 6.3. A solution for this exercise is not currently available. 6.4. Proposition 6.3 gives an algorithm that solves an n-dimensional knapsack problem in O(2n/2 ) steps, but it requires O(2n/2 ) storage. Devise an algorithm, similar to Pollard's ρ algorithm (Section 4.5), that takes O(2n/2 ) steps, but requires only O(1) storage. Solution to Exercise 6.4. A solution for this exercise is not currently available. Section. A brief review of vector spaces 6.5. (a) Let B = {(1, 3, 2), (2, −1, 3), (1, 0, 2)},  B0 = {(−1, 0, 2), (3, 1, −1), (1, 0, 1)}.  Each of the sets B and B 0 is a basis for R3 . Find the change of basis matrix that transforms B0 into B. (b) Let v = (2, 3, 1) and w = (−1, 4, −2). Compute the lengths kvk and kwk and the dot product v · w. Compute the angle between v and w. Solution to Exercise 6.5. (a) Let   1 3 2 B = 2 −1 3 1 0 2    −1 0 2 and C =  3 1 −1 1 0 1  Exercises for Chapter 6 Then   −1 C −1 =   (b) kvk =  √  3 4 3 1 3  0 1 0  169   2 3 −5  3 1 3   13  and  A = BC −1   3 −11 3 = −1 −1 4  1 0 43 3 3  √ 14 ≈ 3.7417. kwk = 21 ≈ 4.5826. v · w = 8. √ √ cos(θ) = 8/ 14 · 21 ≈ 0.4666, so  θ ≈ cos−1 (0.4666) ≈ 1.0854 radians ≈ 62.188 degrees.  6.6. Use the Gram–Schmidt algorithm (Theorem 6.13) to find an orthogonal basis from the given basis. (a) v1 = (1, 3, 2), v2 = (4, 1, −2), v3 = (−2, 1, 3). (b) v1 = (4, 1, 3, −1), v2 = (2, 1, −3, 4), v3 = (1, 0, −2, 7). Solution to Exercise 6.6. (a) v1∗ = (1, 3, 2),  v2∗ = (53/14, 5/14, −17/7),  v3∗ = (56/285, −14/57, 77/285).  (b) v1∗ = (4, 1, 3, −1), v2∗ = (70/27, 31/27, −23/9, 104/27), v3∗ = (−287/397, −405/397, 799/397, 844/397). Section. Lattices: Basic definitions and properties 6.7. Let L be the lattice generated by {(1, 3, −2), (2, 1, 0), (−1, 2, 5)}. Draw a picture of a fundamental domain for L and find its volume. Solution to Exercise 6.7. The volume is ¯  ¯ ¯ 1 3 −2 ¯¯ ¯ ¯det  2 1 0 ¯ = 35. ¯ ¯ ¯ −1 2 5 ¯ 6.8. Let L ⊂ Rm be an additive subgroup with the property that there is a positive constant ² > 0 such that © ª L ∩ w ∈ Rm : kwk < ² = {0}. Prove that L is discrete, and hence is a lattice. (In other words, show that in the defintion of discrete subgroup, it suffices to check that (6.8) is true for the single vector v = 0.)  170  Exercises for Chapter 6  Solution to Exercise 6.8. A solution for this exercise is not currently available. 6.9. Prove that a subset of Rm is a lattice if and only if it is a discrete additive subgroup. Solution to Exercise 6.9. A solution for this exercise is not currently available. 6.10. This exercise describes a result that you may have seen in your linear algebra course. Let A be an n-by-n matrix with entries aij , and for each pair of indices i and j, let Aij denote the (n − 1)-by-(n − 1) matrix obtained by deleting the ith row of A and the j th column of A. Define a new matrix B whose ij th entry bij is given by the formula bij = (−1)i+j det(Aji ). (Note that bij is the determinant of the submatrix Aji , i.e., the indices are reversed.) The matrix B is called the adjoint of A. (a) Prove that AB = BA = det(A)In , where In is the n-by-n identity matrix. (b) Deduce that if det(A) 6= 0, then A−1 =  1 B. det(A)  (c) Suppose that A has integer entries. Prove that A−1 exists and has integer entries if and only if det(A) = ±1. (d) For those who know ring theory from Section 2.10 or from some other source, suppose that A has entries in a ring R. Prove that A−1 exists and has entries in R if and only if det(A) is a unit in R. Solution to Exercise 6.10. A solution for this exercise is not currently available. 6.11. Recall from Remark 6.16 that the general linear group GLn (Z) is the group of n-by-n matrices with integer coefficients and determinant ±1. Let A and B be matrices in GLn (Z). (a) Prove that AB ∈ GLn (Z). (b) Prove that A−1 ∈ GLn (Z). (c) Prove that the n-by-n identity matrix is in GLn (Z). (d) Prove that GLn (Z) is a group. (Hint. You have already done most of the work in proving (a), (b), and (c). For the associative law, either prove it directly or use the fact that you know that it is true for matrices with real coefficients.)  Exercises for Chapter 6  171  (e) Is GLn (Z) a commutative group? Solution to Exercise 6.11. (a) By assumption, A−1 and B −1 have integer entries. Hence (AB)−1 = −1 −1 B A also has integer entries, so AB ∈ GLn (Z). (b) (A−1 )−1 is equal to A, so it has integer entries. Hence A−1 ∈ GLn (Z). (c) Let I be the identity matrix. Then I has integer entries, and I −1 = I also has integer entries, so I ∈ GLn (Z). (d) As the hint says, (a), (b) and (c) show that the product and inverse of matrices in GLn (Z) are again in GLn (Z) and the identity matrix is in GLn (Z), so really just need to check the associative law (AB)C = A(BC). But you proved the associative law for matrix multiplication in linear algebra when the entries are real numbers (or maybe even more generally), so it is certainly true when the entries are integers. (e) No, GLn (Z) is not commutative for n ≥ 2. For example, ( 11 01 ) and ( 10 11 ) do not commute, and similar examples exist for any n ≥ 2. Of course, for n = 1, GL1 (Z) = {±1} is commutative. 6.12. Which of the following matrices are in GLn (Z)? Find the inverses of those matrices that are in GLn (Z). µ ¶ 31 22   3 22 (c) A3 =  2 1 2 −1 3 1  (a)  A1 =  Solution to Exercise 6.12. (a) No, since det = 4. (b) Yes, since det = 1. A−1 2 =  µ ¶ −1 2 . −2 3  (c) No, since det = −9.    (d) Yes, since det = 1. A−2 4  µ ¶ 3 −2 2 −1   −3 −1 2 (d) A4 =  1 −3 −1 3 0 −2  (b) A2 =   6 −2 7 = −1 0 −1. 9 −3 10  6.13. Let L be the lattice given by the basis © ª B = (3, 1, −2), (1, −3, 5), (4, 2, 1) . Which of the following sets of vectors are also bases for L? For those that are, express the new basis in terms of the basis B, i.e., find the change of basis matrix. (a) B1 = {(5, 13, −13), (0, −4, 2), (−7, −13, 18)}. (b) B2 = {(4, −2, 3), (6, 6, −6), (−2, −4, 7)}.  172  Exercises for Chapter 6  Solution to Exercise 6.13. (a) Yes. The change of basis matrix is      5 13 −13 0 −3 2 3 1 −2  0 −4 2  . =  1 1 −1 1 −3 5  −7 −13 18 −2 3 −1 4 2 1 The inverse matrix is  −1  231 0 −3 2  1 1 −1 = 3 4 2 563 −2 3 −1   which shows that B and B1 generate the same lattice. (b) No, since det(B) = −48 and det(B2 ) = 96. 6.14. Let L ⊂ Rm be a lattice of dimension n and let v1 , . . . , vn be a basis for L. (Note that we are allowing n to be smaller than m.) The Gram matrix of v1 , . . . , vn is the matrix ¡ ¢ Gram(v1 , . . . , vn ) = vi · vj 1≤i,j≤n . (a) Let F (v1 , . . . , vn ) be the matrix (6.11) described in Proposition (6.20), except that now F (v1 , . . . , vn ) is an n-by-m matrix, so it need not be square. Prove that Gram(v1 , . . . , vn ) = F (v1 , . . . , vn )F (v1 , . . . , vn )t , where F (v1 , . . . , vn )t is the transpose matrix, i.e., the matrix with rows and columns interchanged. (b) If m = n, prove that ¡ ¢ det Gram(v1 , . . . , vn ) = det(L)2 . (6.1) (c) In general, prove that det Gram(v1 , . . . , vn ) is the square of the volume of a fundamental domain for L, so we can use (6.61) to compute det(L). (d) Let L ⊂ R4 be the 3-dimensional lattice with basis v1 = (1, 0, 1, −1),  v2 = (1, 2, 0, 4),  v3 = (1, −1, 2, 1).  Compute the Gram matrix of this basis and use it to compute det(L). (e) Let v1∗ , . . . , vn∗ be the Gram–Schmidt orthogonalized vectors (Theorem 6.13) associated to v1 , . . . , vn . Prove that Gram(v1 , . . . , vn ) = kv1∗ k2 kv2∗ k2 · · · kvn∗ k2 .  Exercises for Chapter 6  173  Solution to Exercise 6.14. (a–c) A solution for this exercise is not currently available. (d)    1 1 1    1 0 1 −1  3 −3 2  0 2 −1    Gram(v1 , . . . , vn ) = 1 2 0 4    1 0 2  = −3 21 3 1 −1 2 1 2 3 7 −1 4 1 Then det(L) =  p √ det Gram(v1 , . . . , vn ) = 231.  Section. The shortest and closest vector problems 6.15. Let L be a lattice and let F be a fundamental domain for L. This exercise sketches a proof that ¡ ¢ # BR (0) ∩ L 1 ¡ ¢ = lim . (6.2) R→∞ Vol BR (0) Vol(F) (a) Consider the translations of F that are entirely contained within BR (0), and also those that have nontrivial intersection with BR (0). Prove the inclusion of sets [ [ (F + v) ⊂ BR (0) ⊂ (F + v). v∈L F +v⊂BR (0)  v∈L (F+v)∩BR (0)6=∅  (b) Take volumes in (a) and prove that © ª # v ∈ L : F + v ⊂ BR (0) · Vol(F) ¡ ¢ © ª ≤ Vol BR (0) ≤ # v ∈ L : (F + v) ∩ BR (0) 6= ∅ · Vol(F). (Hint. Proposition 6.18 says that the different translates of F are disjoint.) (c) Prove that the number of translates F + v that intersect BR (0) without being entirely contained within BR (0) is comparatively small compared to the number of translates Fv that are entirely contained within BR (0). (This is the hardest part of the proof.) (d) Use (b) and (c) to prove that ¡ ¢ ¡ ¢ Vol BR (0) = # BR (0) ∩ L · Vol(F) + (smaller term). ¡ ¢ Divide by Vol BR (0) and let R → ∞ to complete the proof of (6.62). Solution to Exercise 6.15. A solution for this exercise is not currently available.  174  Exercises for Chapter 6  6.16. A lattice L of dimension n = 251 has determinant det(L) ≈ 22251.58 . With no further information, approximately how large would you expect the shortest nonzero vector to be? Solution to Exercise 6.16. The Gaussian heuristic (6.21) predicts that the shortest nonzero vector in L has length approximately r n σ(L) = (det L)1/n ≈ 1922.96. 2πe Section. Babai's algorithm and solving CVP with a "good" basis 6.17. Let L ⊂ R2 be the lattice given by the basis v1 = (213, −437) and v2 = (312, 105), and let w = (43127, 11349). (a) Use Babai's algorithm to find a vector v ∈ L that is close to w. Compute the distance kv − wk. (b) What is the value of the Hadamard ratio det(L)/kv1 kkv2 k? Is the basis {v1 , v2 } a "good" basis? (c) Show that the vectors v10 = (2937, −1555) and v20 = (11223, −5888) are also a basis for L by expressing them as linear combinations of v1 and v2 and checking that the change-of-basis matrix has integer coefficients and determinant ±1. (d) Use Babai's algorithm with the basis {v10 , v20 } to find a vector v0 ∈ L. Compute the distance kv0 − wk and compare it to your answer from (a). (e) Compute the Hadamard ratio using v10 and v20 . Is {v10 , v20 } a good basis? Solution to Exercise 6.17. (a) (t1 , t2 ) = (6.22, 133.98), so v = 6v1 + 134v2 = (43086, 11448). Then kv − wk = 107.15. (b) det(L)/kv1 kkv2 k = 158709/(486.15)(329.19) = 0.9917. The ratio is close to 1, so {v10 , v20 } a good basis. 5 6 ) = 1. (c) v10 = 5v1 + 6v2 and v20 = 19v1 + 23v2 . We have det ( 19 23 0 0 (d) (t1 , t2 ) = (−2402.52, 632.57), so v = −2403v1 + 633v20 = (46548, 9561). Then kv − wk = 3860.08. (e) det(L)/kv10 kkv20 k = 158709/(3323.25)(12673.76) = 0.00377. The ratio is very small, so {v10 , v20 } a bad basis. Section. The GGH public key cryptosystem 6.18. Alice uses the GGH cryptosystem with private basis v1 = (4, 13), and public basis w1 = (25453, 9091),  v2 = (−57, −45), w2 = (−16096, −5749).  Exercises for Chapter 6  175  (a) Compute the determinant of Alice's lattice and the Hadamard ratio of the private and public bases. (b) Bob sends Alice the encrypted message e = (155340, 55483). Use Alice's private basis to decrypt the message and recover the plaintext. Also determine Bob's random perturbation r. (c) Try to decrypt Bob's message using Babai's algorithm with the public basis {w1 , w2 }. Is the output equal to the plaintext? Solution to Exercise 6.18. (a) det(L) = 561, The Hadamard ratio of the private key is 0.75362. and the Hadamard ratio of the public key is 0.0011. (b) e ≈ −6823.12v1 − 3204.08v2 . v = −6823v1 − 3204v2 = (155336, 55481) = 8w1 + 3w2 . So the plaintext is m = (8, 3). Also r = w − v = (4, 2). (c) e ≈ −8.39w1 − 22.92w2 . This yields the incorrect plaintext (−8, −23). 6.19. Alice uses the GGH cryptosystem with private basis v1 = (58, 53, −68),  v2 = (−110, −112, 35),  v3 = (−10, −119, 123)  and public basis w1 = (324850, −1625176, 2734951), w2 = (165782, −829409, 1395775), w3 = (485054, −2426708, 4083804). (a) Compute the determinant of Alice's lattice and the Hadamard ratio of the private and public bases. (b) Bob sends Alice the encrypted message e = (8930810, −44681748, 75192665). Use Alice's private basis to decrypt the message and recover the plaintext. Also determine Bob's random perturbation r. (c) Try to decrypt Bob's message using Babai's algorithm with the public basis {w1 , w2 , w3 }. Is the output equal to the plaintext? Solution to Exercise 6.19. (a) det(L) = −672858, The Hadamard ratio of the private key is 0.61697 and the Hadamard ratio of the public key is 0.00003. (b)  176  Exercises for Chapter 6 e ≈ −334865.23v1 − 304373.02v2 + 512803.95v3 . v = −334865v1 − 304373v2 + 512804v3 = (8930820, −44681745, 75192657) = −50w1 − 91w2 + 83w3 .  So the plaintext is m = (−50, −91, 83). Also r = w − v = (−10, −3, 8). (c) e ≈ 51.59w1 + 416.67w2 − 158.55w3 . This yields the incorrect plaintext (52, 417, −159). 6.20. Bob uses the GGH cryptosystem to send some messages to Alice. (a) Suppose that Bob sends the same message m twice, using different random perturbations r and r0 . Explain what sort of information Eve can deduce from the ciphertexts e = mW + r and e0 = mW + r0 . (b) For example, suppose that n = 5 and that random permutations are chosen with coordinates in the set {−2, −1, 0, 1, 2}. This means that there are 55 = 3125 possibilities for r. Suppose further that Eve intercepts two ciphertexts e = (−9, −29, −48, 18, 48)  and e0 = (−6, −26, −51, 20, 47)  having the same plaintext. With this information, how many possibilities are there for r? (c) Suppose that Bob is lazy and uses the same perturbation to send two different messages. Explain what sort of information Eve can deduce from the ciphertexts e = mW + r and e0 = m0 W + r. Solution to Exercise 6.20. (a) Eve can compute e0 − e = r0 − r and use this information to narrow down the possibilities for r and r0 . (b) Eve computes e − e0 = r − r0 = (−3, −3, 3, −2, 1). Thus r1 = r10 − 3,  r2 = r20 − 3,  r3 = r30 + 3,  r4 = r40 − 2,  r5 = r50 + 1.  Further, Eve knows that all of the ri and all of the ri0 are between −2 and 2. Thus each equation puts some restrictions on the coordinates of r. For example r1 = r10 − 3 ≤ 2 − 3 = −1, and similarly  so  r1 ∈ {−2, −1},  Exercises for Chapter 6 r2 r3 r4 r5  177  = r20 − 3 ≤ −2 + 3 = 1, = r30 + 3 ≥ −2 + 3 = 1, = r40 − 2 ≤ 2 − 2 = 0, = r50 + 1 ≥ −2 + 1 = −1,  so so so so  r2 r3 r4 r1  ∈ {−2, −1}, ∈ {1, 2}, ∈ {−2, −1, 0}, ∈ {−1, 0, 1, 2}.  Hence the number of possibilities for r has been reduced to 2 · 2 · 2 · 3 · 3 = 72, which is far less than 3125. (c) This time Eve can compute (e − e0 )W −1 = m − m0 , and then the fact that m and m0 are small again allows Eve to narrow down the possibilities. Section. Convolution polynomial rings 6.21. Compute (by hand!) the polynomial convolution product c = a ? b using the given value of N . a(x) = −1 + 4x + 5x2 ,  b(x) = −1 − 3x − 2x2 ;  (b) N = 5,  a(x) = 2 − x + 3x3 − 3x4 ,  b(x) = 1 − 3x2 − 3x3 − x4 ;  (c)  a(x) = x + x2 + x3 ,  b(x) = 1 + x + x5 ;  (a)  N = 3, N = 6,  (d) N = 10,  a(x) = x + x2 + x3 + x4 + x6 + x7 + x9 , b(x) = x2 + x3 + x6 + x8 .  Solution to Exercise 6.21. (a) c = a ? b = −22 − 11x − 15x2 . (b) c = a ? b = −6 − x + 3x3 − 2x4 . (c) c = a ? b = 1 + 2x + 3x2 + 2x3 + x4 . (d) c = a ? b = 3 + 2x + 3x2 + 2x3 + 3x4 + 4x5 + 2x6 + 3x7 + 2x8 + 4x9 . 6.22. Compute the polynomial convolution product c = a ? b modulo q using the given values of q and N . (a)  b(x) = −5 + 4x + 2x2 ;  N = 3,  q = 7,  a(x) = 1 + x,  (b) N = 5,  q = 4,  a(x) = 2 + 2x − 2x2 + x3 − 2x4 , b(x) = −1 + 3x − 3x2 − 3x3 − 3x4 ;  (c)  N = 7,  (d) N = 10,  q = 3,  a(x) = x + x3 ,  b(x) = x + x2 + x4 + x6 ;  q = 2,  a(x) = x2 + x5 + x7 + x8 + x9 , b(x) = 1 + x + x3 + x4 + x5 + x7 + x8 + x9 .  Solution to Exercise 6.22. (a) c ≡ a ? b ≡ 4 + 6x + 6x2 (mod 7). (b) c ≡ a ? b ≡ 1 + x + x2 + 3x3 + 3x4 (mod 4). (c) c ≡ a ? b ≡ 2 + 2x2 + x3 + x4 + 2x5 (mod 3). (d) c ≡ a ? b ≡ x + x2 + x4 + x6 (mod 2). 6.23. Let a(x) ∈ (Z/qZ)[x], where q is a prime.  178  Exercises for Chapter 6  (a) Prove that a(1) ≡ 0 (mod q) if and only if  (x − 1) | a(x) in (Z/qZ)[x].  (b) Suppose that a(1) ≡ 0 (mod q). Prove that a(x) is not invertible in Rq . Solution to Exercise 6.23. (a) Working in (Z/qZ)[x], we use division with remainder to divide a(x) by x − 1. The result is a(x) = (x − 1)b(x) + r(x) with deg r < deg(x − 1) = 1. Thus either r(x) = 0 or deg r(x) = 0, so in any case, r(x) is a constant. Thus a(x) = (x − 1)b(x) + c for some c ∈ Z/qZ. We can determine c by substituting x = 1, which gives c = a(1). Thus a(x) = (x − 1)b(x) + a(1). Now (a) is obvious, since this equation shows that a(x) is a multiple of x − 1 if and only if a(1) = 0. (b) Suppose that a(x) is invertible in Rq , say a(x)b(x) = 1 in Rq . We have a well-defined map Rq → Z/qZ defined by evaluating a polynomial at x = 1. This map is well-defined because the extra relation xN = 1 is true when we set x = 1. Further, the map respects addition and multiplication. Hence the relation a(x)b(x) = 1 in Rq leads to the relation a(1)b(1) = 1 in Z/qZ. In particular, we certainly can't have a(1) = 0. This proves a(x) invertible  =⇒  a(1) 6= 0,  which is equivalent to the statement a(1) = 0  =⇒  a(x) is not invertible.  6.24. Let N = 5 and q = 3 and consider the two polynomials a(x) = 1 + x2 + x3 ∈ R3  and  b(x) = 1 + x2 − x3 ∈ R3 .  One of these polynomials has an inverse in R3 and the other does not. Compute the inverse that exists, and explain why the other doesn't exist. Solution to Exercise 6.24. a(x) does not have an inverse, because a(1) ≡ 0 (mod 3). The previous exercise then implies that a(x) does not have an inverse. Alternatively, using the Euclidean algorithm, one finds that  Exercises for Chapter 6  179  ¡ ¢ gcd a(x), x5 − 1 = 1 − x in (Z/3Z)[x], so a(x) does not have an inverse from Proposition 6.45. Similarly, gcd(b(x), x5 − 1) = 1 in (Z/3Z)[x], and using the extended Euclidean algorithm, we find that b(x)−1 = 1 − x − x2 − x3  in (Z/3Z)[x].  6.25. For each of the following values of N , q, and a(x), either find a(x)−1 in Rq or show that the inverse does not exist. (a) N = 5, q = 11, and a(x) = x4 + 8x + 3; (b) N = 5, q = 13, and a(x) = x3 + 2x − 3. (c) N = 7, q = 23, and a(x) = 20x6 + 8x5 + 4x4 + 15x3 + 19x2 + x + 8. Solution to Exercise 6.25. (a) a(x)−1 = 7x4 + 8x3 + 3x2 + 2x + 3 in F11 [x]. (b) gcd(a(x), x5 − 1) = x + 12 in F13 [x], so no inverse. (c) a(x)−1 = 17x6 + 4x5 + 12x4 + 18x2 + 12x + 10 in F23 [x]. 6.26. This exercise illustrates how to find inverses in Rm =  (Z/mZ)[x] (xN − 1)  when m is a prime power pe . (a) Let f (x) ∈ Z[x]/(X N − 1) be a polynomial, and suppose that we have already found a polynomial F (x) such that f (x) ? F (x) ≡ 1  (mod pi )  for some i ≥ 1. Prove that the polynomial ¡ ¢ G(x) = F (x) ? 2 − f (x) ? F (x) satisfies f (x) ? G(x) ≡ 1 (mod p2i ). (b) Suppose that we know an inverse of f (x) modulo p. Using (a) repeatedly, how many convolution multiplications does it take to compute the inverse of f (x) modulo pe ? (c) Use the method in (a) to compute the following inverses modulo m = pe , where to ease your task, we have given you the inverse modulo p.  180  Exercises for Chapter 6 (i)  N = 5, m = 24 ,  f (x) = 7 + 3x + x2 , f (x)−1 ≡ 1 + x2 + x3 (mod 2).  (ii) N = 5, m = 27 ,  f (x) = 22 + 11x + 5x2 + 7x3 , f (x)−1 ≡ 1 + x2 + x3 (mod 2).  (iii)  N = 7, m = 55 ,  f (x) = 112 + 34x + 239x2 + 234x3 + 105x4 + 180x5 + 137x6 , f (x)−1 ≡ 1 + 3x2 + 2x4 (mod 5).  Solution to Exercise 6.26. (a) We have f G − 1 = f (F (2 − f F )) − 1 = 2f F − (f F )2 − 1 = −(f F − 1)2 . We are assuming that f F ≡ 1 (mod pi ), say f F = 1 + pi H. Then f G − 1 = −(f F − 1)2 = p2i H, so f G ≡ 1 (mod p2i ). (b) Each iteration of (a) takes two convolution multiplications, and each doubles the exponent of p. So after k iterations, we've done 2k convolution multik plications and we have an inverse of f modulo p2 . So we need 2k ≥ e, which means that k = dlog2 ee (or one less, if e is a power of 2). Then the number of convolution multiplications is 2dlog2 ee. (c) (i) f (x)−1 mod 24 = 13 + 5X 2 + 7X 3 + 10X 4 . (ii) f (x)−1 mod 27 = 101 + 12X + X 2 + 17X 3 + 34X 4 . (iii) f (x)−1 mod 55 = 840 + 711X + 710X 2 + 268X 3 + 1710X 4 + 1142X 5 + 2430X 6 . Section. The NTRU public key cryptosystem 6.27. Alice and Bob agree to communicate using the NTRU cryptosystem with (N, p, q) = (7, 2, 37). Alice's private key is f (x) = x + x3 + x6  and  F2 (x) = 1 + x + x4 + x5 + x6 .  (You can check that f ? F2 ≡ 1 (mod 2).) Alice receives the ciphertext e(x) = 1 + 3x + 3x2 + 4x3 + 4x4 + x5 + 35x6 from Bob. Decipher the message and find the plaintext.  Exercises for Chapter 6  181  Solution to Exercise 6.27. Alice first computes a ≡ f ? e ≡ 5 + 5x + 5x2 + 8x3 + 8x4 + 5x5 + 6x6  (mod 37).  Then she computes F2 ? a = 29 + 31x + 31x2 + 32x3 + 32x4 + 29x5 + 26x6 ≡ 1 + x + x2 + x5  (mod 2).  The plaintext is m = 1 + x + x2 + x4 + x6 . 6.28. Alice and Bob decide to communicate using the NTRU cryptosystem with parameters (N, p, q) = (7, 2, 29). Alice's public key is h(x) = 23 + 23x + 23x2 + 24x3 + 23x4 + 24x5 + 23x6 . Bob sends Alice the plaintext message m(x) = 1 + x5 using the ephemeral key r(x) = 1 + x + x3 + x6 . (a) What ciphertext does Bob send to Alice? (b) Alice's secret key is f (x) = 1 + x + x2 + x4 + x5 and F2 (x) = 1 + x5 + x6 . Check your answer in (a) by using f and F2 to decrypt the message. Solution to Exercise 6.28. (a) c ≡ 2r?h+m ≡ 11+12x+12x2 +12x3 +14x4 +13x5 +14x6 (mod 29). (b) First compute b ≡ f ? c ≡ 4 + 5x + 4x2 + 5x3 + 5x4 + 4x5 + 7x6  (mod 37).  Then compute F ? b = 13 + 14x + 14x2 + 14x3 + 16x4 + 15x5 + 16x6 ≡ 1 + x5  (mod 2).  This agrees with the plaintext. 6.29. What is the message expansion of NTRU in terms of N , p, and q? Solution to Exercise 6.29. The plaintext is N numbers modulo p, so consists of N log2 (p) bits. The ciphertext is N numbers modulo q, so consists of N log2 (q) bits. Hence the message expansion of NTRU is log2 (q)/ log2 (p). 6.30. The guidelines for choosing NTRU public parameters (N, p, q, d) require that gcd(p, q) = 1. Prove that if p | q, then it is very easy for Eve to decrypt the message without knowing the private key. (Hint. First do the case that p = q.)  182  Exercises for Chapter 6  Solution to Exercise 6.30. We always have e(x) ≡ pr(x)h(x) + m(x) ≡ m(x) (mod q). If p = q, then this reduces to e(x) = m(x), so the ciphertext is equal to the plaintext. In general, if p | q, then reducing e(x) modulo p gives the plaintext m(x). 6.31. Alice uses the NTRU cryptosystem with p = 3 to send messages to Bob. (a) Suppose that Alice uses the same ephemeral key r(x) to encrypt two different plaintexts m1 (x) and m2 (x). Explain how Eve can use the two ciphertexts e1 (x) and e2 (x) to determine approximately 29 of the coefficients of m1 (x). (See Exercise 6.34 for a way to exploit this information.) (b) For example, suppose that N = 8, so there are 38 possibilities for m1 (x). Suppsoe that Eve intercepts two ciphertexts e1 (x) = 32 + 21x − 9x2 − 20x3 − 29x4 − 29x5 − 19x6 + 38x7 , e2 (x) = 33 + 21x − 7x2 − 19x3 − 31x4 − 27x5 − 19x6 + 38x7 , that were encrypted using the same ephemeral key r(x). How many coefficients of m1 (x) can she determine exactly? How many possibilities are there for m1 (x)? (c) Formulate a similar attack if Alice uses two different ephemeral keys r1 (x) and r2 (x) to encrypt the same plaintext m(x). (Hint. Do it first assuming that h(x) has an inverse in Rq . The problem is harder without this assumption.) Solution to Exercise 6.31. (a) Eve computes ¡ ¢ ¡ ¢ e1 (x) − e2 (x) ≡ r(x) ? h(x) + m1 (x) − r(x) ? h(x) + m2 (x) (mod q) ≡ m1 (x) − m2 (x) (mod q). The coefficients of m1 (x)−m2 (x) are in the set {−2, −1, 0, 1, 2}, so since q > 5, Eve recovers m1 (x) − m2 (x) exactly. Any coefficient that is nonzero limits the possibilities for that coefficient of m1 (x). (This is the same as the analogous GGH exercise.) More precisely, Eve can recover the ith coefficient of m1 (x) if the ith coefficient of both m1 (x) and m2 (x) are both +1 or both −1. Assuming that the coefficients are random, the probability of this happening is 2 · 31 · 13 = 92 . So Eve recovers approximately 29 of the coefficients of m1 (x). (b) Eve finds that m1 (x) − m2 (x) = e1 (x) − e2 (x) = −1 − 2x2 − x3 + 2x4 − 2x5  Exercises for Chapter 6  183  The coefficients of x2 , x4 and x5 for m1 are determined, they are −x2 +x4 −x5 . So Eve knows three of the coefficients of m1 . More generally, m1 (x) looks like A + Bx − x2 + Cx3 + x4 − x5 + Dx6 + Ex7 . Further, Eve knows that A ∈ {0, 1} and C ∈ {0, 1}. So there are 2 · 3 · 2 · 3 · 3 = 108 possibilities for m1 (x), which is much smaller than 38 = 6561. (c) If h(x) is invertible in Rq , then Eve can compute ¡ ¢ ¡ ¢ h(x)−1 e1 (x) − e2 (x) = h(x)−1 pr1 (x)h(x) − pr2 (x)h(x) (mod q) = r1 (x) − r2 (x) (mod q). Then the analysis is the same as in (a), since r1 and r2 have ternary coefficients. In general, however, h(x) is not invertible, since g(x) is not invertible, since g(1) = 0. One way around this problem is to develop a theory of "almost inverses" on the fact that the ring Z[x]/(xN − 1) is isomorphic to Z × ¡ based ¢ Z[x]/ Φ(x) , where Φ(x) = xN −1 + xN −2 + · · · + x + 1. The image of g(x) in the product ring is (0, g(x)), so one inverts the second factor. Section. NTRU as a lattice cryptosystem 6.32. This exercise explains how to formulate NTRU message recovery as a closest vector problem. Let h(x) be an NTRU public key and let e(x) ≡ pr(x) ? h(x) + m(x)  (mod q)  be a message encrypted using h(x). (a) Prove that the vector (pr, e − m) is in LNTRU . h (b) Prove that the lattice vector in (a) is almost certainly the closest lattice vector to the known vector (0, e). Hence solving CVP reveals the plaintext m. (For simplicity, you may assume that d ≈ N/3 and q ≈ 2N , as we did in Proposition 6.61.) (c) Show how one can reduce the lattice-to-target distance, without affecting the determinant, by using instead a modified NTRU lattice of the form µ ¶ 1 ph . 0 q Solution to Exercise 6.32. (a) By the definition of e, we can find a polynomial v(x) satisfying e = pr ? h + m + qv(x). Thus  184  Exercises for Chapter 6 (pr, v)MhNTRU  µ ¶ 1h = (pr, v) 0q = (pr, pr ? h + qv) = (pr, e − m).  This shows that (pr, e − m) is in the NTRU lattice LNTRU spanned by the h rows of MhNTRU . Also notice that Eve knows this vector  (pr, e − m) =  z }| { (0, e)  a short vector  z }| { + (pr, −m) .  (b) We have ° ° ° ° °(pr, e − m) − (0, e)° = °(pr, −m)° p = p2 · 2d + 2d p ≈ (p2 + 1)2N/3. √ √ Since p is small, typically 2 or 3, this is between 1.83 N and 2.58 N . But as in the Proposition, the Gaussian heuristic predicts that a random CVP has a solution of size approximately σ(LNTRU ) ≈ 0.484N . h (c) Let µ ¶ 1 ph NTRU = . Ah 0 q Then with notation as in (a), we have µ  (r, v)ANTRU h  1 ph = (r, v) 0 q  ¶  = (pr, pr ? h + qv) = (pr, e − m). This shows that (r, e − m) is in the lattice spanned by the rows of ANTRU . h N NTRU And det(ANTRU ) = q , which is the same as det(M ). h h Now reworking (b), we see that ° ° ° ° °(r, e − m) − (0, e)° = °(r, −m)° p √ √ = 4d ≈ 4N/3 ≈ 1.15 N . So the distance to the closest vector using this new lattice is less than when using the old lattice. 6.33. The guidelines for choosing NTRU public parameters (N, p, q, d) include the assumption that N is prime. To see why, suppose (say) that N is even. Explain how Eve can recover the private key by solving a lattice problem in dimension N , rather than in dimension 2N . Hint. Use the natural map Z[x]/(xN − 1) → Z[x]/(xN/2 − 1).  Exercises for Chapter 6  185  Solution to Exercise 6.33. This method of breaking NTRU when N is composite is due to Craig Gentry, Key recovery and message attacks on NTRU-composite, Advances in cryptology—EUROCRYPT 2001 (Innsbruck), Lecture Notes in Comput. Sci. 2045, 182–194, Springer, Berlin, 2001. 6.34. Suppose that Bob and Alice are using NTRU to exchange messages and that Eve intercepts a ciphertext e(x) for which she already knows part of the plaintext m(x). (This is not a ludicrous assumption; see Exercise 6.31, for example.) More precisely, suppose that Eve knows t of the coefficients of m(x). Explain how to set up a CVP to find m(x) using a lattice of dimension 2N −2t. Solution to Exercise 6.34. A solution for this exercise is not currently available. Section. Lattice reduction algorithms 6.35. Let b1 and b2 be vectors, and set t = b1 · b2 /kb1 k2  and  b∗2 = b2 − tb1 .  Prove that b∗2 · b1 = 0 and that b∗2 is the projection of b2 onto the orthogonal complement of b1 . Solution to Exercise 6.35. A solution for this exercise is not currently available. 6.36. Let a and b be nonzero vectors in Rn . (a) What value of t ∈ R minimizes the distance ka − tbk? (Hint. It's easier to minimize the value of ka − tbk2 .) (b) What is the minimum distance in (a)? (c) If t is chosen as in (a), show that a − tb is the projection of a onto the orthogonal complement of b. (d) If the angle between a and b is θ, use your answer in (b) to show that the minimum distance is kak sin θ. Draw a picture illustrating this result. Solution to Exercise 6.36. (a) We have F (t) = ka − tbk2 = (a − tb) · (a − tb) = kak2 − 2ta · b + t2 kbk2 . One can then use calculus (i.e., set F 0 (t) = 0) or complete the square to minimize the value of the quadratic polynomial. The minimizing value of t is a·b t = kbk 2. (b) Substituting this value of t and simplifying gives the minimum distance  186  Exercises for Chapter 6 s kak2 kbk2 − (a · b)2 . kbk2  (c) A solution for this exercise is not currently available. (d) Substitute a · b = kakkbk cos θ into (b) and use ¡ ¢2 kak2 kbk2 − (a · b)2 = kak2 kbk2 − kakkbk cos θ = kak2 kbk2 (1 − cos2 θ) = kak2 kbk2 sin2 θ.  6.37. Apply Gauss's lattice reduction algorithm (Proposition 6.63) to solve SVP for the following two dimensional lattices having the indicated basis vectors. How many steps does the algorithm take? (a) v1 = (120670, 110521) and v2 = (323572, 296358). (b) v1 = (174748650, 45604569) and v2 = (35462559, 9254748). (c) v1 = (725734520, 613807887) and v2 = (3433061338, 2903596381). Solution to Exercise 6.37. (a) Step 1 2 3 4 5 6 7  v1 (120670, 110521) (−38438, −35205) (5356, 4906) (−946, −863) (−320, −272) (14, −47) (14, −47)  v2 (323572, 296358) (120670, 110521) (−38438, −35205) (5356, 4906) (−946, −863) (−320, −272) (−362, −131)  m 3 −3 −7 −6 3 3 0  The solution to SVP is v = (14, −47). (b) Step 1 2 3 4 5 6 7 8  v1 (35462559, 9254748) (−2564145, −669171) (−435471, −113646) (48681, 12705) (2658, 699) (837, 123) (147, 330) (147, 330)  The solution to SVP is v = (147, 330). (c)  v2 (174748650, 45604569) (35462559, 9254748) (−2564145, −669171) (−435471, −113646) (48681, 12705) (2658, 699) (837, 123) (690, −207)  m 5 −14 6 −9 18 3 1 0  Exercises for Chapter 6 Step 1 2 3 4 5 6 7 8 9 10 11 12  187  v1 (725734520, 613807887) (−195611262, −165443054) (−56710528, −47964329) (−25479678, −21550067) (−5751172, −4864195) (−2474990, −2093287) (−801192, −677621) (−71414, −60424) (−15638, −12957) (6776, 4361) (4690, 126) (4690, 126)  v2 (3433061338, 2903596381) (725734520, 613807887) (−195611262, −165443054) (−56710528, −47964329) (−25479678, −21550067) (−5751172, −4864195) (−2474990, −2093287) (−801192, −677621) (−71414, −60424) (−15638, −12957) (6776, 4361) (2086, 4235)  m 5 −4 3 2 4 2 3 11 5 −3 1 0  The solution to SVP is v = (4690, 126). 6.38. Let V be a vector space, let W ⊂ V be a vector subspace of V , and let W ⊥ be the orthogonal complement of W in V . (a) Prove that W ⊥ is also a vector subspace of V . (b) Prove that every vector v ∈ V can be written as a sum v = w + w0 for unique vectors w ∈ W and w0 ∈ W ⊥ . (One says that V is the direct sum of the subspaces W and W ⊥ .) (c) Let w ∈ W and w0 ∈ W ⊥ and let v = aw + bw0 . Prove that kvk2 = a2 kwk2 + b2 kw0 k2 . Solution to Exercise 6.38. A solution for this exercise is not currently available. 6.39. Let L be a lattice with basis vectors v1 = (161, 120) and v2 = (104, 77). (a) Is (0, 1) in the lattice? (b) Find an LLL reduced basis. ¡ ¢ (c) Use the reduced basis to find the closest lattice vector to − 29 , 11 . Solution to Exercise 6.39. A solution for this exercise is not currently available. 6.40. Use the LLL algorithm to reduce the lattice with basis v1 = (20, 16, 3),  v2 = (15, 0, 10),  v3 = (0, 18, 9).  You should do this exercise by hand, writing out each step. Solution to Exercise 6.40. Compute µ2,1 =  300 + 30 330 1 = < . 400 + (14)2 + 64 665 2  188  Exercises for Chapter 6  Checking the Lovász condition for v2 amounts to checking that kv2 k2 ≥ 3 2 2 2 4 kv1 k and kv2 k = 225 + 100 = 325, kv1 k = 665, so swap. Now v1 = 356 and subtract one mul(15, 0, 10) and v2 = (20, 16, 3). Recompute µ2,1 = 325 tiple of v1 from v2 . New v2 = (5, 16, −7). Note that the (new) µ2,1 is now (75 − 70)/325 = −5/325. Move on to v3 computing −75 + 160 85 1 = < , 325 325 2 225 1 = > . 330 2  µ3,1 = µ3,2  Subtract one multiple of v2 from v3 obtaining the new v3 = (−5, 2, 16). On to the Lovász condition, computing kv3∗ +µ3,2 v2∗ k2 = kv3 −µ3,1 v1 k2 = k(−5, 2, 16)− Next compute kv2∗ k2 = k  85 1 (15, 0, 10)k2 = k (−14, 26, 174)k2 . 325 13  1 (62, 208, 3)k2 13  and we find the condition (2) is not satisfied, so we swap. At this point, v1 = (15, 0, 10),  v2 = (−5, 2, 16),  v3 = (5, 16, −7).  Checking condition (2) for (the new) v2 : kv2 k2 = 285, which is larger than 3/4 times kv1 k2 = 325. (If, instead of 3/4, we had chosen a constant closer to 1, like .99, then we would perform the swap step again. This makes sense since the length of v2 is smaller than the length of v1 .) Now check the value of −105 µ3,2 = 285 and the Lovász condition for v3 , which is satisfied. So we now have an LLL reduced basis. 6.41. Let L be the lattice generated by the rows of the matrix   20 51 35 59 73 73  14 48 33 61 47 83     95 41 48 84 30 45   . M =   0 42 74 79 20 21   6 41 49 11 70 67  23 36 6 1 46 4 Implement the LLL algorithm (Figure 6.7) on a computer and use your program to answer the following questions. (a) Compute det(L) and H(M ). What is the shortest basis vector?  Exercises for Chapter 6  189  (b) Apply LLL to M . How many swaps (Step [11]) are required? What is the value of H(M LLL )? What is the shortest basis vector in the LLL reduced basis? How does it compare with the Gaussian expected shortest length? (c) Reverse the order of the rows of M and apply LLL to the new matrix. How many swaps are required? What is the value of H(M LLL ) and what is the shortest basis vector? (d) Apply LLL to the original matrix M , but in the Lovász condition (Step [8]), use 0.99 instead of 34 . How many swaps are required? What is the value of H(M LLL ) and what is the shortest basis vector? Solution to Exercise 6.41. (a) det(L) = 21242880806, H(M ) = 0.45726, smallest basis vector is kv6 k = 63.198, (b) The output is   −6 −3 −2 2 −26 10  11 30 2 5 −6 24    −14 −10 14 −48 −3 −6     −3 24 43 23 −33 −38    64 −44 −16 −46 −13 4  −28 −25 41 5 30 39 There are 11 swap steps. We have H(M LLL ) = 0.91981 and the shortest vector is kv1 k = 28.792. Gaussian expected shortest is σ(L) = 40.0239. This suggests that v1 is probably the shortest vector in L. (c) With the rows in reverse order, the LLL output is   6 3 2 −2 26 −10  11 30 2 5 −6 24     14 10 −14 48 3 6    −28 −25 41 5 30 39     −3 24 43 23 −33 −38 47 −35 54 30 −13 11 There are 8 swap steps. We have H(M LLL ) = 0.94427 and the shortest vector is kv1 k = 28.792. (d) With Lovász condition 0.99,   −6 −3 −2 2 −26 10  11 30 2 5 −6 24    −14 −10 14 −48 −3 −6     −3 24 43 23 −33 −38   −28 −25 41 5 30 39  47 −35 54 30 −13 11 There are 12 swap steps. We have H(M LLL ) = 0.944270 and the shortest vector is kv1 k = 28.792. This is the same basis as in (c), in a different order.  190  Exercises for Chapter 6  6.42. A more efficient way to implement the LLL algorithm is described in Figure 6.8, with Reduce and Swap subroutines given in Figure 6.9. (This implementation of LLL follows [26, Algorithm 2.6.3]. We thank Henri Cohen for his permission to include it here.) (a) Prove that the algorithm described in Figures 6.8 and 6.9 returns an LLL reduced basis. (b) For any given N and q, let LN,q be the N -dimensional lattice with basis v1 , . . . , vN described by the formulas vi = (ri1 , ri2 , . . . , riN ),  rij ≡ (i + N )j (mod q),  0 ≤ rij < q.  Implement the LLL algorithm and use it to LLL reduce LN,q for each of the following values of N and q: (i) (N, q) = (10, 541) (iii) (N, q) = (30, 1223)  (ii) (N, q) = (20, 863) (iv) (N, q) = (40, 3571)  In each case, compare the Hadamard ratio of the original basis to the Hadamard ratio of the LLL reduced basis, and compare the length of the shortest vector found by LLL to the Gaussian expected shortest length. Solution to Exercise 6.42. (b) We write L for the original basis and L0 for the LLL reduced basis, and we write v for the shortest vector in the original basis and v0 for the shortest vector in the LLL reduced basis. Here are the shortest vectors in the LLL reduced basis (N.B. the shortest vector was not always the first vector): (i) v0 = (−98, 166, −131, −18, 100, 28, 81, 50, −39, −39). (ii) v0 = (−122, −33, −59, 166, 9, −394, −46, 227, −148, −86, −46, 108, −214, 173, −107, 171, 34, −86, −153, −117). 0 (iii) v = (98, −148, −263, −370, 76, 53, 258, −128, 221, −435, −119, −59, 142, − 336, 311, 290, 89, −538, 16, 437, 108, 361, 322, −374, 56, −117, − 208, −131, 645, 42). 0 (iv) v = (192, −1426, 552, −292, 52, 482, 1046, −1344, −414, −226, −1413, − 1466, −447, 653, −484, −553, −284, 232, 1975, 1944, 27, 1203, − 1363, 707, 91, −549, −831, 974, 768, 1074, 57, −966, 1997, 2099, 828, −1295, −972, −842, 185, −2271). The lengths, Hadamard ratios, and Gaussian expected shortest lengths are given in the following table: (i) (ii) (iii) (iv)  kvk 632.369 1846.49 3133.91 10711.4  kv0 k 278.446 679.056 1505.95 6706.75  H(L) 0.309773 0.253273 0.304603 0.281214  H(L0 ) 0.853005 0.694868 0.579003 0.470440  σ(L) 241.775 659.505 1613.89 5775.49  Exercises for Chapter 6 [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20]  191  Input a basis {v1 , . . . , vn } for a lattice L Set k = 2, kmax = 1, v1∗ = v1 , and B1 = kv1 k2 If k ≤ kmax go to Step [9] Set kmax = k and vk∗ = vk Loop j = 1, 2, . . . , k − 1 Set µk,j = vk · vj∗ /Bj and vk∗ = vk∗ − µk,j vj∗ End j Loop Set Bk = kvk∗ k2 Execute ³Subroutine RED(k, k − 1) ´ If Bk < 34 − µ2k,k−1 Bk−1 Execute Subroutine SWAP(k) Set k = max(2, k − 1) and go to Step [9] Else Loop ` = k − 2, k − 3, . . . , 2, 1 Execute Subroutine RED(k, `) End ` Loop Set k = k + 1 End If If k ≤ n go to Step [3] Return LLL reduced basis {v1 , . . . , vn } Figure 6.1: The LLL algorithm—Main routine  6.43. Let 41 < α < 1 and suppose that we replace the Lovász condition with the condition ¡ ¢ ∗ 2 k for all 1 < i ≤ n. kvi∗ k2 ≥ α − µ2i,i−1 kvi−1 (a) Prove a more version of Theorem 6.66. What quantity, depending on α, replaces the 2 that appears in the estimates (6.53), (6.54), and (6.55)? (b) Prove a version of Theorem 6.68. In particular, how does the upper bound for the number of swap steps depend on α? What happens as α → 1? Solution to Exercise 6.43. A solution for this exercise is not currently available. 6.44. Let v1 , . . . , vn be an LLL reduced basis for a lattice L. (a) Prove that there are constants C1 > 1 > C2 > 0 such that for all y1 , . . . , yn ∈ R we have °X °2 n n X X ° n ° n 2 2 n ° C1 yi kvi k ≥ ° yi vi ° ≥ C yi2 kvi k2 . (6.3) 2 ° i=1  i=1  i=1  (This is a hard exercise.) We observe that the inequality (6.63) is another way of saying that the basis v1 , . . . , vn is quasi-orthogonal, since if it  192  Exercises for Chapter 6  [1] [2] [3] [4] [5] [6] [7]  —— Subroutine RED(k, `) —— If |µk,` | ≤ 12 , return to Main Routine Set m = bµk,` e Set vk = vk − mv` and µk,` = µk,` − m Loop i = 1, 2, . . . , ` − 1 Set µk,i = µk,i − mµ`,i End i Loop Return to Main Routine  [1] [2] [3] [4] [5] [6] [7] [8] [9] [10]  —— Subroutine SWAP(k) —— Exchange vk−1 and vk Loop j = 1, 2, . . . , k − 2 Exchange µk−1,j and µk,j End j Loop Set µ = µk,k−1 and B = Bk − µ2 Bk−1 Set µk,k−1 = µBk−1 /B and Bk = Bk−1 Bk /B and Bk−1 = B Loop i = k + 1, k + 2, . . . , kmax Set m = µi,k and µi,k = µi,k−1 − µm and µi,k−1 = m + µk,k−1 µi,k End i Loop Return to Main Routine Figure 6.2: The LLL algorithm—RED and SWAP subroutines  P 2 were P 2 truly2 orthogonal, then we would have an equality k yi vi k = yi kvi k . (b) Prove that there is a constant C such that for any target vector w ∈ Rn , Babai's algorithm (Theorem 6.34) finds a lattice vector v ∈ L satisfying kw − vk ≤ C n min kw − uk. u∈L  Thus Babai's algorithm applied with an LLL reduced basis solves apprCVP to within a factor of C n . This is Theorem 6.73. (c) Find explicit values for the constants C1 , C2 , and C in (a) and (b). Solution to Exercise 6.44. (a) This is a hard exercise. We follow the proof given in [?, §5.7]. Fix a basis v1 , . . . , vn , let v1∗ , . . . , vn∗ be the associated Gram–Schmidt orthogonalized basis, and let ei = vi∗ /kvi∗ k,  1 ≤ i ≤ n,  be the associated orthonormal basis. Let µi,j be as usual (settting µi,i = 1 and µi,j = 0 for i > j), so the change of basis matrix M = (µi,j ) satisfies V = V ∗ M.  Exercises for Chapter 6  193  (The rows of V are v1 , . . . , vn and the rows of V ∗ are v1∗ , . . . , vn∗ .) In general, for any linear transformation A, we write A = (ai,j ) as a matrix relative to the orthonormal basis e∗1 , . . . , e∗n and define kAk =  sup 06=v∈Rn  kvAk kvk  and  kAke = sup |ai,j |. i,j  P P 2 We observe that if v = xi e∗i , then kvk2 = xi and we have °X ° n X ° n °2 ° kvAk2 = ° x a e i i,j j ° ° i=1  = ≤ ≤  j=1  n µX n X j=1 n X j=1 n X  ¶2  xi ai,j  i=1  kvk2 ka·,j k2  (Cauchy–Schwartz),  kvk2 nkA|2e  j=1  = n2 kAk2e kvk2 . Taking square roots, dividing by kvk, and taking the sup over nonzero v yields kAk ≤ nkAke . To ease notation, we let ci = kvi∗ k,  so vi∗ = ci ei .  Now we compute ei M =  ∗ c−1 i vi M  =  c−1 i vi  =  c−1 i  ¶ µ µ ¶ i−1 i−1 X X −1 ∗ ∗ µi,j vj = ci vi + ci ei + µi,j cj ej j=1  j=1  = ei +  i−1 X  µi,j c−1 i cj ej .  j=1  So relative to the e basis, the linear transformation M has a matrix that is lower triangular with 1's on the diagonal and with ij th entry satisfying |µi,j c−1 i cj | ≤  1 kvj∗ k · ≤ 2(i−j)/2−1 , 2 kvi∗ k  (6.4)  where for the last inequality we use (6.57) (N.B. This is where we use the fact that the basis is reduced, since the size condition gives |µi,j | ≤ 21 and the Lovász condition implies the estimate (6.57).) Therefore,  194  Exercises for Chapter 6 kM ke ≤  max 2(i−j)/2−1 = 2(n−3)/2 .  1≤j≤i≤n  (If n ≤ 2, we need to replace this upper bound by 1.) This allows us to get an upper bound °X °2 ° n ° 2 ∗ ∗ ∗ ° yi vi ° ° ° = kyV k = kyV M k ≤ kyV k kM k ≤ kyV k · nkM ke i=1  ≤ kyV ∗ kn2(n−3)/2 = n2(n−3)/2  n X  yi2 kvi∗ k2 .  (6.5)  i=1  To obtain a lower bound, we observe that n X i=1  ° °2 yi2 kvi∗ k2 = kyV ∗ k2 = °yV M −1 ° ° n °2 ° ° −1 °2 ° −1 °2 °X ° ° ° ° ° yi vi ° ≤ kyV k M = M ° ° .  (6.6)  i=1  ° ° So we need an upper bound for °M −1 °. Note that M = I − N, where N is lower triangular with 0's on the diagonal, so N is nilpotent, and indeed it satisfies N n = 0. Hence M −1 = I + N + N 2 + · · · + N n−1 . The following lemma provides the necessary estimate. We refer the reader to [?, Lemma 7.10] for the proof. Lemma 6.1. Let B = (bi,j ) be the matrix of a linear transformation relative to an orthonormal basis {ei }. Suppose that there are positive constants β and γ so that bi,j = 0 for i ≤ j and |bi,j | ≤ γδ j−i for i > j. Then  ° ° °B + B 2 + B 3 + · · · + B n−1 ° ≤ γ(γ + 1)n−2 δ n−1 . e  Note that (??) tells us that the coefficients of N satisfy (i−j)/2−1  |coef. of N | ≤ 2  1 = · 2  µ  1 √ 2  ¶j−i .  √ So we can apply the lemma to N with γ = 1/2 and δ = 1/ 2, which gives ° ° °N + N 2 + · · · + N n−1 ° ≤ 1 · e 2  µ ¶n−2 µ ¶n−1 µ ¶(n−1)/2 3 1 1 9 · √ = . 2 3 8 2  Exercises for Chapter 6  195  Hence ° −1 ° ° ° ° ° ¢ ¡ °M ° ≤ n °M −1 ° ≤ n 1 + °N + N 2 + · · · + N n−1 ° e e µ ¶(n−1)/2 µ ¶(n−1)/2 n 9 9 ≤n+ ≤n . 3 8 8 (The last inequality is valid for n ≥ 8. For smaller n, one can put in a small correction factor.) Substituting into (??) gives n X  yi2 kvi∗ k2  i=1  °2 µ ¶n−1 °X ° n ° 9 ° yi vi ° ≤n ° ° . 8 i=1 2  (6.7)  We now apply (6.54) from Theorem 6.66, which says that kvi∗ k2 ≥ 2−(i−1) kvi k2 . This yields °X °2 µ ¶n−1 X µ ¶n−1 X n n ° n ° 8 4 −2 2 −(i−1) 2 −2 ° ° yi vi ° ≥ n yi · 2 kvi k ≥ n yi2 kvi k2 . ° 9 9 i=1  i=1  i=1  P  (b) Let a = ai vi ∈ L be any lattice vector, for example, it could be the lattice vector that is closest to w. Write X w= βi vi with βi ∈ R, and let b=  X  bi vi  with  bi = bβi e  be the vector returned by Babai's algorithm. Also write βi = bi + δi  with  |δi | ≤  1 . 2  Then °X °2 ° ° kw − ak2 = ° (βi − ai )vi ° X (βi − ai )2 kvi k2 ≥ C2n X = C2n (bi − ai + δi )2 kvi k2 .  from (6.63),  If ai 6= bi , then |bi − ai | ≥ 1, so (bi − ai + δi )2 ≥  1 (bi − ai )2 , 4  and clearly this is also valid if ai = bi . Hence using the other inequality in (6.63),  196  Exercises for Chapter 6  Input a basis v1 , . . . , vn of a lattice L. Input a target vector t. Compute Gram–Schmidt orthogonalized vectors v1∗ , . . . , vn∗ (Theorem 6.13). Set w = t. Loop i = n, n − 1, . . . , 2, 1 ¥ ¨ Set w = w − w · vi∗ /kvi∗ k2 vi . End i Loop Return the lattice vector t − w. Figure 6.3: Babai's closest plane algorithm  kw − ak2 ≥ C2n  X1  (bi − ai )2 kvi k2 °X °2 ° ° 1 ° (b − a )v ≥ C2n C1−n ° i i i° ° 4 =  4  1 n −n C C kb − ak2 . 4 2 1  Using the triangle inequality, we find that kw − ak ≥  ¡ ¢ 1 1 (C2 /C1 )n/2 kb − ak ≥ (C2 /C1 )n/2 kb − wk − kw − ak , 2 2  and now a little bit of algebra yields à µ ¶ ! n/2 C1 kw − bk ≤ 2 + 1 kw − ak. C2 This shows that the Babai vector b is the closest vector to w up to a factor of 2(C1 /C2 )n/2 + 1. 6.45. Babai's Closest Plane Algorithm, which is described in Figure 6.10, is an alternative rounding method that uses a given basis to solve apprCVP. As usual, the more orthogonal the basis, the better the solution, so generally people first use LLL to create a quasi-orthogonal basis and then apply one of Babai's methods. In both theory and practice, Babai's closest plane algorithm seems to yield better results than Babai's closest vertex algorithm. Implement both of Babai's algorithms (Theorem 6.34 and Figure 6.10) and use them to solve apprCVP for each of the following lattices and target vectors. Which one gives the better result? (a) L is the lattice generated by the rows of the matrix  Exercises for Chapter 6  197   −5  26   15 ML =   32   15 5   16 25 25 13 8 −3 −11 14 5 −26   −28 16 −7 −21 −4   −3 7 −30 −6 26   −32 −17 32 −3 11  24 0 −13 −46 15  and the target vector is t = (−178, 117, −407, 419, −4, 252). (Notice that the matrix ML is LLL reduced.) (b) L is the lattice generated by the rows of the matrix   −33 −15 22 −34 −32 41  10 9 45 10 −6 −3     −32 −17 43 37 29 −30    ML =    26 13 −35 −41 42 −15   −50 32 18 35 48 45  2 −5 −2 −38 38 41 and the target vector is t = (−126, −377, −196, 455, −200, −234). (Notice that the matrix ML is not LLL reduced.) (c) Apply LLL reduction to the basis in (b), and then use both of Babai's methods to solve apprCVP. Do you get better solutions? Solution to Exercise 6.45. (a) The Closest Plane Algorithm gives the vector w = (−185, 105, −414, 419, −8, 277) = (−1, −4, −13, −3, 12, 5)ML ∈ L. It satisfies kt − wk = 29.7153. The Closest Vertex Algorithm gives the vector w = (−159, 102, −425, 433, −3, 251) = (−1, −3, −13, −3, 12, 5)ML ∈ L. It satisfies kt − wk = 33.2866. So the Closest Plane Algorithm gives a slightly better result than the Closest Vertex Algorithm. (b) The Closest Plane Algorithm gives the vector w = (−166, −394, −203, 460, −196, −204) = (−6, −13, 4, −12, −4, 3)ML ∈ L. It satisfies kt − wk = 53.6563. The Closest Vertex Algorithm gives the vector w = (−156, −385, −158, 470, −202, −207) = (−6, −12, 4, −12, −4, 3)ML ∈ L. It satisfies kt − wk = 58.0172. So the Closest Plane Algorithm gives a slightly better result than the Closest Vertex Algorithm. (c) The LLL reduced basis is   10 9 45 10 −6 −3  9 −3 11 37 28 15    −24 −18 33 3 −4 56     2 −5 −2 −38 38 41    −41 −14 32 0 1 −45 −35 53 −26 −5 24 −26  198  Exercises for Chapter 6  The Closest Plane Algorithm gives the vector w = (−132, −367, −191, 467, −198, −263) = (−12, 6, 1, −9, 4, −4)ML ∈ L. It satisfies kt − wk = 33.9116. The Closest Vertex Algorithm gives the exact same result. So starting with an LLL reduced basis yields a significantly better solution to apprCVP. Section. Applications of LLL to cryptanalysis 6.46. You have been spying on George for some time and overhear him receiving a ciphertext e = 83493429501 that has been encrypted using the congruential cryptosystem described in Section 6.1. You also know that George's public key is h = 24201896593 and the public modulus is q = 148059109201. Use Gaussian lattice reduction to recover George's private key (f, g) and the message m. Solution to Exercise 6.46. Gaussian lattice reduction on the lattice generated by (1, 24201896593) and  (0, 148059109201)  gives the short basis (233444, 255333)  and  (330721, −272507),  so the private key is f = 233444  and g = 255333.  We check that f −1 g ≡ 133037176740 · 255333 ≡ 24201896593 ≡ h (mod q). In order to decrypt the message, we first compute a ≡ f e ≡ 94843884201 (mod q). Then we do a computation modulo g to recover the plaintext m, m = f −1 a = 94649 · 94843884201 ≡ 186000 (mod g).  6.47. Let M = (81946, 80956, 58407, 51650, 38136, 17032, 39658, 67468, 49203, 9546) and let S = 168296. Use the LLL algorithm to solve the subset-sum problem for M and S, i.e., find a subset of the elements of M whose sum is S.  Exercises for Chapter 6  199  Solution to Exercise 6.47. We apply LLL to the matrix  2 0  0 0  0  0  0  0  0 0 1  0 2 0 0 0 0 0 0 0 0 1  0 0 2 0 0 0 0 0 0 0 1  0 0 0 2 0 0 0 0 0 0 1  0 0 0 0 2 0 0 0 0 0 1  0 0 0 0 0 2 0 0 0 0 1  0 0 0 0 0 0 2 0 0 0 1  0 0 0 0 0 0 0 2 0 0 1  0 0 0 0 0 0 0 0 2 0 1  0 0 0 0 0 0 0 0 0 2 1    81946 80956   58407  51650   38136   17032  . 39658   67468   49203  9546  168296  It takes LLL 102 swaps to find the reduced matrix  1 1  3 3  −2  −2  −1  −2  −2 −4 2  −1 −1 1 1 0 −2 −3 2 4 −2 4  1 1 1 1 2 4 −1 0 4 0 2  1 1 3 −1 −2 −4 1 4 0 2 0  −1 −1 1 3 4 −2 1 −2 −2 4 −2  1 1 1 1 0 0 −3 −4 2 0 −2  −1 1 1 −3 2 2 −3 −2 0 0 −2  1 1 −3 1 2 0 −1 0 −2 2 2  1 −1 1 1 2 0 1 0 2 −4 −4  −1 1 −1 1 0 −2 1 2 0 −2 −4    0 1   0  2   2   −2 . 3   −2  1  0  −1  The top row gives the solution (0, −1, 0, 0, −1, 0, −1, 0, 0, −1, 1), i.e., we have 80956 + 38136 + 39658 + 9546 = 168296. This problem was created using the superincreasing sequence r = (73, 160, 323, 657, 1325, 2660, 5348, 10698, 21396, 42807) and the multiplier and modulus A = 79809 and B = 85733. 6.48. Alice and Bob communicate using the GGH cryptosystem. Alice's public key is the lattice generated by the rows of the matrix   10305608 −597165 45361210 39600006 12036060  −71672908 4156981 −315467761 −275401230 −83709146     −46304904 2685749 −203811282 −177925680 −54081387  .    −68449642 3969419 −301282167 −263017213 −79944525  −46169690 2677840 −203215644 −177405867 −53923216  200  Exercises for Chapter 6  Bob sends her the encrypted message e = (388120266, −22516188, 1708295783, 1491331246, 453299858). Use LLL to find a reduced basis for Alice's lattice, and then use Babai's algorithm to decrypt Bob's message. Solution to Exercise 6.48. LLL takes 52 swaps to produce the following matrix whose Hadamard ratio is H = 0.963, so it is quite orthogonal:   72  180  −158  114 462  −116 −218 −301 172 164  172 −53 −230 −148 −258  −290 298 −185 −311 91    −51 161   −25  . 297  −491  Babai's closest vertex method gives the lattice vector (388120256, −22516180, 1708295793, 1491331242, 453299848) that is close to the target vector e. If we let v1 , . . . , v5 be the LLL-reduced basis vectors and w1 , . . . , w5 be the original basis vectors, then (388120256, − 22516180, 1708295793, 1491331242, 453299848) = 1622959v1 + 2403687v2 − 4093270v3 − 1942134v4 − 1269978v5 = −3w1 − 9w2 + 0w3 + 6w4 − 4w5 . So Bob's plaintext is the vector (−3, −9, 0, 6, −4). 6.49. Alice and Bob communicate using the NTRU cryptosystem with public parameters (N, p, q, d) = (11, 3, 97, 3). Alice's public key is h = 39 + 9x + 33x2 + 52x3 + 58x4 + 11x5 + 38x6 + 6x7 + x8 + 48x9 + 41x10 . Apply the LLL algorithm to the associated NTRU lattice to find an NTRU private key (f , g) for h. Check your answer by verifying that g ≡ f ?h (mod q). Use the private key to decrypt the ciphertext e = 52 + 50x + 50x2 + 61x3 + 61x4 + 7x5 + 53x6 + 46x7 + 24x8 + 17x9 + 50x10 . Solution to Exercise 6.49. associated to h. We apply LLL to the 22 dimensional NTRU lattice LNTRU h It requires 322 swaps and returns the LLL reduced the matrix  Exercises for Chapter 6  −1                   1 0 0 0 0 −1 1 −1 0 1 −4 9 −6 −3 −9 7 −2 13 −1 −6 −3  −1 −1 1 1 1 0 0 −1 0 0 1 8 2 −2 7 7 1 −3 3 −5 11 −3  −1 −1 0 0 1 2 0 1 2 0 1 0 3 −5 2 7 0 9 −4 11 0 −3  0 0 −1 0 1 0 1 1 1 1 −1 0 0 −1 0 1 0 1 −1 1 0 0 1 0 1 −1 0 −2 0 −1 0 0 0 −2 1 −1 1 1 0 1 −1 −1 −1 0 0 −1 0 1 1 0 1 0 −1 0 0 1 1 −1 1 0 0 −1 0 −1 1 0 2 0 1 0 1 0 1 0 0 0 0 −2 0 −1 1 0 1 −1 1 0 0 −1 0 0 0 −1 0 0 −1 −1 0 −2 0 −2 −1 1 1 0 0 −2 0 0 0 −1 2 −7 0 1 −8 13 −4 −2 4 −9 −7 −1 0 −9 12 −4 −4 −3 −10 0 3 13 2 0 1 5 −11 −1 16 −3 0 8 −12 3 3 4 −8 −1 0 −7 −8 −14 2 −10 −8 −2 1 −1 4 −3 9 −12 4 4 3 −9 −2 −3 −7 6 2 3 −6 −1 0 −8 13 −4 −11 4 1 3 4 −12 −2 9 −14 −2 14 −2 1 6 2 5 −3 −13 −2 0 5 14 6 2 5 −3 −11 −3 1 −2 15 4 9 2 1 −8 −1 0 −7 13 18 −10  201 −1 0 0 −1 −1 0 1 0 −1 1 −1 0 0 −1 −1 0 1 0 0 0 −1 1 1 0 −1 1 0 0 1 0 0 0 0 −1 1 −1 −1 1 1 −1 0 0 −1 −1 0 1 0 0 0 1 1 0 −1 0 0 1 −1 −1 0 1 −1 0 0 1 −1 0 1 0 1 0 0 0 0 0 0 0 1 2 −1 0 0 0 0 −1 0 0 0 −1 −1 0 0 1 1 0 1 0 −1 1 0 −1 0 7 −7 −6 1 2 18 −10 0 7 −6 −5 1 1 17 −11 4 9 5 3 2 −8 −5 −14 −4 −2 7 6 −1 −2 −17 12 −5 9 1 1 −6 2 0 3 −1 21 12 −1 5 −1 −1 −17 11 −4 10 0 0 −8 0 0 8 −6 −5 1 2 18 −7 2 −10 −12 3 3 8 4 −4 4 2 −16 3 −9 −5 −3 −2 8 1 −16 2 −9 −5 −3 −2 9 4 5 −9 0 0 7 −7 −5 1 0  The top row is (−1, −1, −1, 0, 0, −1, 0, 1, 0, 1, 1, 1, 1, −1, 0, 0, −1, −1, 0, 1, 0, −1), which gives the private key polynomials f (x) = −1 − x − x2 − x5 + x7 + x9 + x10 g(x) = 1 + x − x2 − x5 − x6 + x8 − x10 . To decipher the message, we compute a ≡ f ?e ≡ −11−13x−1x2 +3x3 −4x4 +2x5 +16x6 +4x7 +4x9 −2x10  (mod q).  Then we use f −1 ≡ −1 + x − x3 + x4 − x6 + x7 − x8 − x9 + x10  (mod 3)  to compute the plaintext m ≡ a ? f −1 1 − x − x2 − x3 − x4 + x7 + x10  (mod 3).  In vector form, m = (1, −1, −1, −1, −1, 0, 0, 1, 0, 0, 1). √ 6.50. (a) Suppose that k is a 10 digit integer, and suppose that when k is computed, the first 15 digits after the decimal place are 418400286617716. Find the number k. (Hint. Reformulate it as a lattice problem.) (b) More generally, suppose that you know the first d-digits after the decimal √ place of K. Explain how to set up a lattice problem to find K. See Exercise 1.47 for a cryptosystem associated to this problem. Solution to Exercise 6.50. We do (b) first, then illustrate the general idea by doing (a). Let α be√the ddigit number consisting of the first d digits after the decimal place of K. If we let β = α/10d , then we can write √ K ≈J +β for some J ∈ Z.           .          202  Exercises for Chapter 6  There are two unknowns here, K and J, and all that we know is that they are both integers. Squaring both sides gives K ≈ J 2 + 2Jβ + β 2 . Thus there are integers A and B satisfying β 2 + Aβ + B ≈ 0, namely A = 2J and B = J 2 − K. Of course, we don't know A or B, so we now describe a lattice reduction problem that finds a (quadratic) polynomial with small integer coefficients that has a given decimal number as an (approximate) root. Once we find A and B, it is easy to recover K as K = 41 A2 − B. Let L be the lattice generated by the rows of the matrix   100 c M = 0 1 0 cβ  , 0 0 t cβ 2 where we will choose t and c later. Notice that   ¡ ¢ 100 c ¡ ¢ B A 1 0 1 0 cβ  = B A t c(B + Aβ + β 2 ) . 0 0 t cβ 2 So if B + Aβ + β 2 is small, then we have found a small vector in the lattice. In other words, if we find a small vector in the lattice having the form (B, A, ∗), then we have probably found the values of A and B that we want. (We choose t reasonably large to force the relation to look like (B, A, 1), instead of (B, A, C) for some larger C.) (b) A solution for this exercise is not currently available.  Chapter 7  Digital Signatures Exercises for Chapter 7 Section. RSA digital signatures 7.1. Samantha uses the RSA signature scheme with primes p = 541 and q = 1223 and public verification exponent v = 159853. (a) What is Samantha's public modulus? What is her private signing key? (b) Samantha signs the digital document D = 630579. What is the signature? Solution to Exercise 7.1. (a) Samantha's public modulus is N = p · q = 541 · 1223 = 661643. Samantha knows that (p − 1)(q − 1) = 540 · 1222 = 659880, so she can solve vs ≡ 1 (mod (p − 1)(q − 1)),  159853 · s ≡ 1 (mod 659880),  for the private signing key s = 561517. (b) Samantha takes the document D = 630579 and computes S = Ds  (mod N ),  630579561517 ≡ 206484 (mod 661643).  So the signature is S = 206484. She can check that this is correct by computing C ≡ Sv  (mod N ),  C ≡ 206484159853 ≡ 630579 (mod 661643)  and noting that this value agrees with D = 630579. 7.2. Samantha uses the RSA signature scheme with public modulus N = 1562501 and public verification exponent v = 87953. Adam claims that Samantha has signed each of the documents D = 119812,  D0 = 161153, 203  D00 = 586036,  204  Exercises for Chapter 7  and that the associated signatures are S 0 = 870099,  S = 876453,  S 00 = 602754.  Which of these are valid signatures? Solution to Exercise 7.2. Victor uses Samantha's public key (N, v) = (1562501, 87953) to compute: C ≡ Sv 0  0v  00  00 v  C ≡S C ≡S  (mod N ), (mod N ), (mod N ),  C ≡ 87645387953 ≡ 772481  (mod 1562501),  0  87953  ≡ 161153  (mod 1562501),  00  87953  ≡ 586036  (mod 1562501).  C ≡ 870099 C ≡ 602754  Comparing the values of C, C 0 , C 00 with the document values D, D0 , D00 , we see that S 0 and S 00 are valid signatures, but S is not. We remark that Samantha's private factorization is N = p · q = 1301 · 1201 = 1562501 and her signing key is s = 261617. 7.3. Samantha uses the RSA signature scheme with public modulus and public verification exponent N = 27212325191  and v = 22824469379.  Use whatever method you want to factor N , and then forge Samantha's signature on the document D = 12910258780. Solution to Exercise 7.3. The factorization of Samantha's public modulus is N = p · q = 128311 · 212081 = 27212325191. Then (p − 1)(q − 1) = 128310 · 212080 = 27211984800, so we can solve vs ≡ 1  (mod (p − 1)(q − 1)),  22824469379 · s ≡ 1  (mod 27211984800)  for Samantha's private signing exponent s = 18408628619. We can then sign the document D = 12910258780 by computing S ≡ Ds  (mod N ),  1291025878018408628619 ≡ 22054770669 (mod 27212325191). To check that this signature is correct, we compute C ≡ Sv  (mod N ),  C ≡ 2205477066922824469379 ≡ 12910258780 (mod 27212325191) and note that it agrees with D = 12910258780.  Exercises for Chapter 7  205  Section. Discrete logarithm digital signatures 7.4. Samantha uses the ElGamal signature scheme with prime p = 6961 and primitive root g = 437. (a) Samantha's private signing key is s = 6104. What is her public verification key? (b) Samantha signs the digital document D = 5584 using the ephemeral key e = 4451. What is the signature? Solution to Exercise 7.4. (a) v ≡ 4376104 ≡ 2065 (mod 6961). (b) S1 ≡ 4374451 ≡ 3534 (mod 6961), S2 ≡ (5584 − 6104 · 3534)4451−1 ≡ 5888 (mod 6960). So the signature on D is (3534, 5888). 7.5. Samantha uses the ElGamal signature scheme with prime p = 6961 and primitive root g = 437. Her public verification key is v = 4250. Adam claims that Samantha has signed each of the documents D = 1521,  D0 = 1837,  D00 = 1614,  and that the associated signatures are (S1 , S2 ) = (4129, 5575),  (S10 , S20 ) = (3145, 1871),  (S100 , S200 ) = (2709, 2994).  Which of these are valid signatures? Solution to Exercise 7.5. (a) v S1 · S1S2 ≡ (42504129 ) · 41295575 ≡ 231 (mod 6961). g D ≡ 4371521 ≡ 231 (mod 6961). So the signature is valid. (The ephemeral key was e = 5627.) (b) v S1 · S1S2 ≡ (42503145 ) · 31451871 ≡ 6208 (mod 6961). g D ≡ 4371837 ≡ 2081 (mod 6961). So the signature is not valid. (c) v S1 · S1S2 ≡ (42502709 ) · 27092994 ≡ 2243 (mod 6961). g D ≡ 4371614 ≡ 2243 (mod 6961). So the signature is valid. (The ephemeral key was e = 3997.) (Samantha's private signing key is s = 4804.)  206  Exercises for Chapter 7  7.6. Let p be a prime and let i and j be integers with gcd(j, p − 1) = 1. Set S1 ≡ g i v j (mod p),  S2 ≡ −S1 j −1 (mod p − 1),  D ≡ −S1 ij −1 (mod p − 1).  Prove that (S1 , S2 ) is a valid ElGamal signature on the document D for the verification key v. Thus Eve can produce signatures on random documents. Solution to Exercise 7.6. We compute v S1 S1S2 ≡ v S1 (g i v j )−S1 j ≡ v S1 g −ij ≡g  D  −1  −1  S1 −S1  v  (mod p) (mod p)  (mod p).  7.7. Suppose that Samantha is using the ElGamal signature scheme and that she is careless and uses the same ephemeral key e to sign two documents D and D0 . (a) Explain how Eve can tell at a glance whether Samantha has made this mistake. (b) If the signature on D is (S1 , S2 ) and the signature on D0 is (S10 , S20 ), explain how Eve can recover s, Samantha's private signing key. (c) Apply your method from (b) to the following example and recover Samantha's signing key s, where Samantha is using the prime p = 348149, base g = 113459, and verification key v = 185149. D = 153405, D0 = 127561,  S1 = 208913, S10 = 208913,  S2 = 209176, S20 = 217800.  Solution to Exercise 7.7. 0 (a) Since S1 ≡ g e and S10 = g e , Eve can check if the two signatures used the same ephemeral key by checking if S1 = S10 . (b) Using discrete logarithms to the base g, the verification conditions are S1 log(v) + S2 log(S1 ) ≡ D (mod p − 1), S10 log(v) + S20 log(S10 ) ≡ D0 (mod p − 1). Since S1 = S10 from (a), this becomes S1 s + S2 log(S1 ) ≡ D (mod p − 1), S1 s + S20 log(S1 ) ≡ D0 (mod p − 1), where s = log(v) is Samantha's secret signing key. Taking S20 times the first congruence and subtracting S2 times the second congruence, we obtain S1 (S20 − S2 )s ≡ S20 D − S2 D0 (mod p − 1).  Exercises for Chapter 7  207  For notational convenience we write this congruence as As ≡ B (mod p − 1), where we know the values of A and B. If gcd(A, p − 1) = 1, we can solve uniquely for s. In general, if gcd(A, p − 1) > 1 (it's unlikely to be too large), then there are gcd(A, p − 1) solutions for s, and after computing them, we can decide which one is correct by checking which one yields g s ≡ v (mod p). (c) From (b) we begin by computing A ≡ S1 (S20 − S2 ) ≡ 347960 (mod p − 1), B ≡ S20 D − S2 D0 ≡ 252868 (mod p − 1). We need to solve As ≡ B (mod p − 1), so we need to solve 347960s ≡ 252868 (mod 348148). This congruence has several solutions. More precisely, since gcd(347960, 348148) = 4 and 4 | 252868, we divide through by 4 to get 86990s ≡ 63217 (mod 87037). Then gcd(86990, 87037) = 1, so we can solve this congruence. The solution is s ≡ 72729 (mod 87037). Adding on multiples of (p − 1)/4 = 87037 yields the four solutions s ≡ 72729, 159766, 246803, 333840 (mod 348148) to the original congruence. We can pick out which solution is correct from the relation g s ≡ v (mod p), i.e., the correct value of s should satisfy 113459s ≡ 185149  (mod 348149).  We compute 11345972729 ≡ 185149  (mod 348149),  113459  159766  ≡ 137653  (mod 348149),  113459  246803  ≡ 163000  (mod 348149),  113459  333840  ≡ 210496  (mod 348149).  Hence Samantha's secret signing key is s = 72729.  208  Exercises for Chapter 7  7.8. Samantha uses DSA with public parameters (p, q, g) = (22531, 751, 4488). She chooses the secret signing key s = 674. (a) What is Samantha's public verification key? (b) Samantha signs the document D = 244 using the ephemeral key e = 574. What is the signature? Solution to Exercise 7.8. (a) Samantha's public verification key is v ≡ 4488674 ≡ 4940 (mod 22531). (b) The signature is S1 = (4488574 mod 22531) mod 751 = 444, S2 ≡ (244 + 674 · 444)574−1 ≡ 56 (mod 751).  7.9. Samantha uses DSA with public parameters (p, q, g) = (22531, 751, 4488). Her public verification key is v = 22476. (a) Is (S1 , S2 ) = (183, 260) a valid signature on the document D = 329? (b) Is (S1 , S2 ) = (211, 97) a valid signature on the document D = 432? Solution to Exercise 7.9. (a) Victor computes V1 ≡ 329 · 260−1 ≡ 293 (mod 751)  and V2 ≡ 183 · 260−1 ≡ 252 (mod 751).  He then computes g V1 v V2 ≡ 4488293 · 22476252 ≡ 6191 (mod 22531) and verifies that 6191 mod 751 = 183 is equal to S1 . So the signature is valid. (Samantha's secret signing key happens to be s = 38.) (b) Victor computes V1 ≡ 432 · 97−1 ≡ 709 (mod 751)  and V2 ≡ 211 · 97−1 ≡ 428 (mod 751).  He then computes g V1 v V2 ≡ 4488709 · 22476428 ≡ 3979 (mod 22531). Then he observes that (g V1 v V2 mod p) mod q = 3979 mod 751 = 224 is not equal to S1 = 211. So the signature is not valid.  Exercises for Chapter 7  209  7.10. Samantha's DSA public parameters are (p, q, g) = (103687, 1571, 21947), and her public verification key is v = 31377. Use whatever method you prefer (brute-force, collision, index calculus, . . . ) to solve the DLP and find Samantha's private signing key. Use her key to sign the document D = 510 using the ephemeral key e = 1105. Solution to Exercise 7.10. Solving 31377 ≡ 21947s (mod 103687) gives s = 602. Then the signature on D = 510 using the ephemeral key e = 1105 is S1 = (219471105 mod 103687) mod 1571 = 439 S2 ≡ (510 + 602 · 439)1105−1 ≡ 1259 (mod 1571).  7.11. The Elliptic Curve Digital Signature Algorithm (ECDSA) is described in Table 7.7. Prove that ECDSA works, i.e., prove that the verification step succeeds in verifying a valid signature. Solution to Exercise 7.11. We compute −1 v1 G + v2 V = ds−1 2 G + s1 s2 (sG)  = (d + ss1 )s−1 2 G = (es2 )s2−1 G = eG ∈ E(Fp ). Hence x(v1 G + v2 V ) mod q = x(eG) mod q = s1 . 7.12. This exercise asks you to compute some numerical instances of the elliptic curve digital signature algorithm described in Table 7.7 for the public parameters E : y 2 = x3 +231x+473,  p = 17389,  q = 1321,  G = (11259, 11278) ∈ E(Fp ).  You should begin by verifying that G is a point of order q in E(Fp ). (a) Samantha's private signing key is s = 542. What is her public verification key? What is her digital signature on the document d = 644 using the ephemeral key e = 847? (b) Tabitha's public verification key is V = (11017, 14637). Is (s1 , s2 ) = (907, 296) a valid signature on the document d = 993? (c) Umberto's public verification key is V = (14594, 308). Use any method that you want to find Umberto's private signing key, and then use the private key to forge his signature on the document d = 516 using the ephemeral key e = 365.  210  Exercises for Chapter 7  Public Parameter Creation A trusted party chooses a finite field Fp , an elliptic curve E/Fp , and a point G ∈ E(Fp ) of large prime order q. Samantha Victor Key Creation Choose secret signing key 1 < s < q − 1. Compute V = sG ∈ E(Fp ). Publish the verification key V . Signing Choose document d mod q. Choose ephemeral key e mod q. Compute eG ∈ E(Fp ) and then, s1 = x(eG) mod q and s2 ≡ (d + ss1 )e−1 (mod q). Publish the signature (s1 , s2 ). Verification Compute v1 ≡ ds−1 (mod q) and 2 v2 ≡ s1 s−1 (mod q). 2 Compute v1 G+v2 V ∈ E(Fp ) and verify that x(v1 G + v2 V ) mod q = s1 .  Table 7.1: The elliptic curve digital signature algorithm (ECDSA) Solution to Exercise 7.12. (a) Samantha's public verification key is V = 542(11259, 11278) = (8689, 1726) ∈ E(Fp ). Her signature on d = 644 using e = 847 is obtained by first computing eG = (8417, 8276) ∈ E(Fp ) and then s1 = x(eG) mod q = 491  and  s2 ≡ (d + ss1 )e−1 ≡ 290 (mod q).  (b) Victor computes v1 ≡ ds−1 2 ≡ 106 (mod q) and  v2 ≡ s1 s−1 2 ≡ 311 (mod q).  Then v1 G + v2 V = (8833, 4526) ∈ E(Fp ), and x(v1 G + v2 V ) mod q = 8833 mod 1321 = 907 is equal to s1 , so the signature is valid. (c) After some work, one finds that Umberto's private signing key is s = 1294, since  Exercises for Chapter 7  211  1294G = 1294(11259, 11278) = (14594, 308) ∈ E(Fp ). We can then forge a signature on the document d = 516 using the ephemeral key e = 365 by first computing eG = (3923, 12121) ∈ E(Fp ) and then s1 = x(eG) mod q = 1281  and  s2 ≡ (d + ss1 )e−1 ≡ 236 (mod q).  To check that the signature is valid, we compute v1 G + v2 V = (3923, 12121) ∈ E(Fp ), and x(v1 G + v2 V ) mod q = 3923 mod 1321 = 1281, which is equal to s1 . Section. Lattice-based digital signatures 7.13. Samantha uses the GGH digital signature scheme with private and public bases v1 = (−20, −8, 1), v2 = (14, 11, 23), v3 = (−18, 1, −12),  w1 = (−248100, 220074, 332172), w2 = (−112192, 99518, 150209), w3 = (−216150, 191737, 289401).  What is her signature on the document d = (834928, 123894, 7812738)? Solution to Exercise 7.13. Samantha uses Babai's algorithm with the good basis to find the vector s = 283411v1 + 233700v2 − 179519v3 = (834922, 123893, 7812739) that is close to d, ks − dk ≈ 6.16. She then expresses the signature in terms of bad basis, s = 785152901w1 − 1383699316w2 − 183004589w3 and publishes the signature (785152901, −1383699316, −183004589). 7.14. Samantha uses the GGH digital signature scheme with public basis w1 = (3712318934, −14591032252, 11433651072), w2 = (−1586446650, 6235427140, −4886131219), w3 = (305711854, −1201580900, 941568527). She publishes the signature (6987814629, 14496863295, −9625064603) on the document d = (5269775, 7294466, 1875937). If the maximum allowed distance from the signature to the document is 60, verify that Samantha's signature is valid.  212  Exercises for Chapter 7  Solution to Exercise 7.14. We first compute s = 6987814629w1 + 14496863295w2 − 9625064603w3 = (5269774, 7294492, 1875902) ∈ L. Then we compute the distance ks − dk ≈ 43.61 and verify that it is smaller than the cutoff value of 60, so the signature is valid. 7.15. Samantha uses the GGH digital signature scheme with public basis w1 = (−1612927239, 1853012542, 1451467045), w2 = (−2137446623, 2455606985, 1923480029), w3 = (2762180674, −3173333120, −2485675809). Use LLL or some other lattice reduction algorithm to find a good basis for Samantha's lattice, and then use the good basis to help Eve forge a signature on the document d = (87398273893, 763829184, 118237397273). What is the distance from your forged signature lattice vector to the target vector? (You should be able to get a distance smaller than 100.) Solution to Exercise 7.15. Eve's implementation of LLL gives the basis v1 = (−9, −147, −136),  v2 = (73, 169, −41),  v3 = (109, −132, −110).  Using this LLL reduced basis, she computes s = −1542740188v1 − 532211991v2 + 1030872363v3 = (87398273916, 763829241, 118237397269) ∈ L. It satisfies ks − dk ≈ 61.60, so is quite a good solution. To find the signature, Eve expresses s in terms of the original bad basis, s = 203927306009123w1 + 225365519245447w2 + 293473443761381w3 . The signature is (203927306009123, 225365519245447, 293473443761381).  Exercises for Chapter 7  213  Section. NTRU digital signatures 7.16. Samantha uses an NTRU digital signature with (N, q, d) = (11, 23, 3). (a) Samantha's private key is f = (1, −1, 1, 0, 1, 0, −1, 1, 0, −1, 0), g = (0, −1, 0, 1, 1, 0, 0, 1, −1, 1, −1), F = (0, −1, −1, 1, −3, −1, 0, −3, −3, −2, 2), G = (−3, −1, 2, 4, 3, −4, −1, 3, 5, 5, −1). She uses her private key to sign the digital document D = (D1 , D2 ) given by D1 = (0, 8, −6, −6, −5, −1, 9, −2, −6, −4, −6), D2 = (9, 9, −10, 2, −3, 2, 6, 6, 5, 0, 8). Compute the signature s. (b) Samantha's public verification key is h = (5, 8, −5, −11, 8, 8, 8, 5, 3, −10, 5). Compute the other part of the signature t ≡ h ? s (mod q) and find the distance between the lattice vector (s, t) and the target vector D. (c) Suppose that Eve attempts to sign D using Samantha's public vectors (1, h) and (0, q). What signature (s0 , t0 ) does she get and how far is it from the target vector D? Solution to Exercise 7.16. (a) Samantha first computes ¥¡ ¢¨ −64 32 143 146 1 −178 −1,120 108 25 v1 = −164 23 , 23 , 23 , 23 , 23 , 23 , 23 , 23 , 23 , 23 = (−7, −3, 1, 6, 6, 0, −8, −1, 5, 5, 1), ¥¡ ¢¨ 13 0,35 −27 4 2 16 11 −24 −4 v2 = 27 23 , 23 , 23 , 23 , 23 , 23 , 23 , 23 , 23 , 23 = (1, 1, 0, 2, −1, 0, 0, 1, 0, −1, 0), and then s = (−2, 8, −4, −7, −5, −2, 9, −4, −9, −4, −8). (b) t ≡ h ? s ≡ (11, 9, −9, 2, −4, 5, 4, 8, 4, 0, 11) Then k(s, t) − Dk = 7.74597. (c) The signature using the h-basis is  (mod 23).  214  Exercises for Chapter 7 s0 = (0, 8, −6, −6, −5, −1, 9, −2, −6, −4, −6), t0 = (5, 17, −3, 9, 3, 2, 14, 13, 2, 10, 1).  It satisfies k(s0 , t0 ) − Dk = 22.0227.  7.17. Samantha uses an NTRU digital signature with (N, q, d) = (11, 23, 3). (a) She creates a private key using the ternary vectors f = (1, 1, 1, 1, 0, −1, −1, 0, 0, 0, −1), g = (−1, 0, 1, 1, −1, 0, 0, 1, −1, 0, 1). Use the algorithm described in Table 7.6 to find short vectors F and G satisfying f ? G − g ? F = q. (b) Samantha uses the private signing key (f , g, F, G) to sign the digital document D = (D1 , D2 ) given by D1 = (5, 5, −5, −10, 3, −7, −3, 2, 0, −5, −11), D2 = (8, 9, −10, −7, 6, −3, 1, 4, 4, 4, −7). What the signature s? (c) What is Samantha's public verification key h? (d) Compute t ≡ h ? s (mod q) and determine the distance from the lattice vector (s, t) to the target vector D. Solution to Exercise 7.17. (a) First she computes f1 f2 g1 g2  = (1363, −944, 786, 358, 482, 80, −133, 368, 955, 126, 476), = (−2554, 419, 1205, 1563, 682, 343, 368, 955, 126, 476, 0), = (−63, 121, −173, −232, 208, −251, 96, 172, 620, 799, 574), = (−1808, −121, 110, 290, −197, −275, 53, −46, −799, −574, 0).  The resultants are Rf = 3917 and Rg = 1871, and then Sf = −866 and Sg = 1813 satisfies Sf Rf + Sg Rg = 1. Then we find that A = (2627037, −5045579, 7213927, 9674168, −8673392, 10466449, −4003104, −7172228, −25853380, −33317501, −23935226), B = (−27148234, 18802592, −15655548, −7130644, −9600476, −1593440, 2649094, −7329824, −19021690, −2509668, −9480968). Next we use  Exercises for Chapter 7  215  f −1 = (0.35, −0.24, 0.20, 0.09, 0.12, 0.02, −0.03, 0.09, 0.24, 0.03, 0.12), g−1 = (−0.03, 0.06, −0.09, −0.12, 0.11, −0.13, 0.05, 0.09, 0.33, 0.43, 0.31), to compute C = (−2522997, −13372262, 753797, −4259685, −6431876, −1572245, −16151212, −8516655, −12881295, −9762142, −3302247). Using this yields F = (−1, −1, 1, 2, 0, 2, 0, 0, −3, −5, −5), G = (4, −4, 3, 2, 1, 0, 0, 2, 3, 0, 2). These are reasonably short, kF k = 8.36660 and kGk = 7.93725. (b) ¥¡ ¢¨ −117 −116 −37 51 −40 7 7 −22 −2 v1 = −2 23 , 23 , 23 , 23 , 23 , 23 , 23 , 23 , 1, 23 , 23 = (0, −5, −5, −2, 2, −2, 0, 0, 1, −1, 0) ¢¨ ¥¡ 55 1 −53 21 5 −21 −15 37 31 −22 v2 = −4 23 , 23 , 23 , 23 , 23 , 23 , 23 , 23 , 23 , 23 , 23 = (0, 2, 0, −2, 1, 0, −1, −1, 2, 1, −1) Then s = (7, 3, −4, −10, 4, −6, −3, 1, 1, −5, −10). (c) We have f −1 mod 23 = (−9, −10, −6, −8, −10, −5, 4, 0, 5, −5, −1), h = (−3, −2, 2, −1, 3, −5, 11, −10, −2, −6, −9). (d) t = (9, 6, −9, −7, 4, −4, 0, 4, 5, −2, −5). k(s, t) − Dk = 8.48528. 7.18. Let a ∈ RN be a fixed vector. (a) Suppose that b is an N -dimensional vector whose coefficients are chosen randomly from the set {−1, 0, 1}. Prove that the expected values of kbk2 and ka ? bk2 are given by ¡ ¢ 2 E kbk2 = N 3  ¡ ¢ ¡ ¢ and E ka ? bk2 = kak2 E kbk2 .  (b) More generally, suppose that the coefficients of b are chosen at random from the set of integers {−T, −T +1, . . . , T −1, T }. Compute the expected values of kbk2 and ka ? bk2 as in (a).  216  Exercises for Chapter 7  (c) Suppose now that the coefficients of b are real numbers that are chosen uniformly and independently in the interval from −R to R. Prove that ¡ ¢ R2 N E kbk2 = 3  and  ¡ ¢ ¡ ¢ E ka ? bk2 = kak2 E kbk2 .  (Hint. The most direct way to do (c) is to use continuous probability theory. As an alternative, let the coefficients of b be chosen uniformly and independently from the set {jR/T : −T ≤ j ≤ T }, redo the computation from (b), and then let T → ∞.) Solution to Exercise 7.18. Let c = a ? b. Then X kck2 = c2k k mod N  X µ  =  k mod N  X  =  ¶2  X  ai bj  i+j≡k (mod N )  X  k mod N i+j≡k (mod N )  X  =  X  ai bj  au bv  u+v≡k (mod N )  ai au bj bv .  i+j≡u+v (mod N )  Note that this last sum is over all 4-tuples (i, j, u, v) mod N satisfying i + j ≡ u + v (mod N ). We suppose now that the coefficients of b are independent random variables whose average value is 0, i.e., we assume that E(bi ) = 0. This is a valid assumption in (a), (b), and (c). Since the coefficients of a are fixed, we can compute X ¡ ¢ E(ai au bj bv ) E ka ? bk2 = i+j≡u+v (mod N )  X  =  ai au E(bj bv )  i+j≡u+v (mod N )  X  = X  a2i  i mod N 2  X  E(b2j )  j mod N  + · · · + b2N −1 ) ¢ = kak2 E kbk2 . = kak  X  i mod N j mod N  i+j≡u+v (mod N ) j6=v  =  X  ai au E(bj )E(bv ) +  E(b20 ¡  Hence in all cases we have ¡ ¢ ¡ ¢ E ka ? bk2 = kak2 E kbk2 .  a2i E(b2j )  Exercises for Chapter 7  217  ¡ ¢ It remains to compute E kbk2 under the various scenarios. (a) The coefficients of b are independent random variables taking values in {−1, 0, 1} with equal probabilities, so 1 1 1 · (−1) + · 0 + · 1 = 0, 3 3 3 1 1 2 1 2 2 2 2 E(bi ) = · (−1) + · 0 + · 1 = , 3 3 3 3 ¢ ¡ 2 2 2 2 2 E kbk = E(b0 + · · · + bN −1 ) = E(b0 ) + · · · + E(b2N −1 ) = N. 3 E(bi ) =  (b) Similar to (a), but now the values are integers between −T and T . So E(b2i ) =  T T X X 1 T2 + T 2 2 T (T + 1)(2T + 1) j2 = j2 = = . 2T + 1 2T + 1 j=1 2T + 1 6 3 j=−T  Hence  −1 ¡ ¢ NX T2 + T E kbk2 = E(b2j ) = N. 3 i=0  (c) The computation using continuous probability is Z R 1 1 b3 ¯¯R R2 E(b2i ) = b2 db = · = . −R 2R −R 2R 3 3 ¡ ¢ Hence E kbk2 = R2 N/3. The alternative computation using the hint gives, for any particular value of T , E(b2i )  µ ¶2 T T X X 1 2R2 jR = = j2 2T + 1 T (2T + 1)T 2 j=1 j=−T  2R2 T (T + 1)(2T + 1) R2 (T + 1) = = . 2 (2T + 1)T 6 3T Letting T → ∞ yields E(b2i ) = R2 /3, and then ¡ ¢ E kbk2 = N R2 /3.  7.19. Let (f , g, F, G) be an NTRU digital signature private key and let h ≡ f −1 ? g (mod q) be the associated public key. Suppose that (s, t) is the signature on the document D = (D1 , D2 ), so in particular, the vector (s, t) is in the NTRU lattice LNTRU . h  218  Exercises for Chapter 7  (a) Prove that for every vector w ∈ ZN , the vector (s + w ? f , t + w ? g) is in the NTRU lattice LNTRU . h (b) Let f −1 be the inverse of f in the ring R[x]/(xN − 1) (cf. Table 7.6). Prove that the vector s0 = s + b−f −1 ? D1 e ? f is a signature on a document of the form D0 = (0, D2 + D3 ) for some D3 that depends on D1 . (c) Conclude that anyone who can sign documents of the form (0, D0 ) is also able to sign documents of the form (D1 , D2 ). Hence in the NTRU digital signature scheme (Table 7.5), we might as well assume that the document being signed is of the form (0, D2 ). This has several benefits, including speeding the computation of v1 and v2 . Solution to Exercise 7.19. (a) The NTRU lattice is characterized as the set of vectors © ª LNTRU = (u, v) : v ≡ u ? h (mod q) . h We are given that (s, t) ∈ LNTRU , so h (s + w ? f ) ? h ≡ s ? h + w ? f ? h ≡ t + w ? g (mod q), where we have used the fact that h ≡ f −1 ? g (mod q). (b) For notational convenience, we let w = b−f −1 ? D1 e. Then w ? f = −D1 + ² ? f , where the coefficients of ² are between − 12 and 12 . Hence s0 = s + w ? f = s − D1 + ² ? f . We know that ks − D1 k is small, so we find that ks0 k ≤ ks − D1 k + k² ? f k ≈ ks − D1 k + k²k kf k is also small. Next we compute t0 ≡ s0 ? h ≡ s ? h + w ? f ? h ≡ t + w ? g (mod q). Since t is close to D2 , we find that t0 is close to D2 + D3 , where D3 = w ? g = b−f −1 ? D1 e ? g. (c) Suppose that Eve knows how to sign documents of the form (0, D0 ) and that she wants to sign (D1 , D2 ). She starts by finding a signature s0 to the document  Exercises for Chapter 7 ¡  219  ¢ 0, D2 + b−f −1 ? D1 e ? g .  Then from the calculations in (b), she sees that s = s0 − b−f −1 ? D1 e ? g is a signature on (D1 , D2 ). 7.20. Verify the identity µ ¶µ ¶ ¶ µ f g f ?f +F?F g?f +G?F f F , = FG gG f ?g+F?G g?f +G?F where bar indicates reversal of a vector as in Remark 7.13. Prove that the corresponding ¡ 2N ¢-by-2N matrix is the Gram matrix associated to the 2N -byg 2N matrix Ff G . (See Exercise 6.14 for the definition of the Gram matrix.)  Chapter 8  Additional Topics in Cryptography  221  http://www.springer.com/978-0-387-77993-5                  

---

Source Exif Data:

File Type                       : PDF File Type Extension             : pdf MIME Type                       : application/pdf PDF Version                     : 1.4 Linearized                      : No Page Count                      : 223 Create Date                     : 2011:04:15 17:54:08+02:00 Producer                        : iText 5.0.4 (c) 1T3XT BVBA Modify Date                     : 2011:04:15 17:54:08+02:00        

EXIF Metadata provided by EXIF.tools

An Introduction To Mathematical Cryptography Answers

Source: https://usermanual.wiki/Pdf/SolutionsManual.1797252236/help

Posted by: gilmoretooffer55.blogspot.com

Share this post