• Keine Ergebnisse gefunden

If the Factoring is not in BPP, then the Asymmetry of RSA is not in BPP


Academic year: 2022

Aktie "If the Factoring is not in BPP, then the Asymmetry of RSA is not in BPP"

Mehr anzeigen ( Seite)





We present a proof of a theorem from the second lecture (Chapter 2 of slides). Recall thatn=pq, where pand q are two distinctk-bit primes.


BPP = if a problem instance x is solvable by a polynomial probabilistic algorithm.

Factoring = given a natural number n compute a prime factor of it.

Asymmetry = compute the private key from the public key.

Asymmetry of RSA = computed (and not, in addition, pand q), knowing (n, e).

Factoring is not in BPP = there exists no probabilistic polynomial-time algorithm that, given n, finds a non-trivial factor of n with non-negligible probability in k.

Theorem 1. If the Factoring is not in BPP, then the Asymmetry of RSA is not in BPP.

Proof. We use the following notation: Z/kZ = Zk denotes the ring of integers modk, (Z/kZ)× = Z×k denotes the multiplicative group of integers modk and ord+kg denotes the (additive) order of an element g ∈(Zk,+), ordkg denotes the (multiplicative) order of an elementg ∈Z×k.

Suppose that the secret keydis computable in polynomial time by a probabilistic algorithm. Our goal is to show that we can factorn, knowing the secret keyd and the public keye. By the Chinese Remainder theorem we have an isomorphism1:

Z×n →Z×p ×Z×q, amod n 7→(a mod p, amod q) It follows that

ordn(a) = lcm (ordp(a),ordq(a)).

Therefore, to factor n we can use the following equivalence (whence pwill be a factor):

c≡1 mod p, c 6≡1 mod q⇐⇒n >gcd (c−1, n) =p > 1.

Our goal is to construct such an element c. For an arbitrary element a we have:

ordp(a)|p−1, ordq(a)|q−1,

ordn(a)|(p−1)(q−1) =φ(n)|ed−1

If we write ed−1 = 2st with some s and with t odd, then (at)2s = 1 in the group Z×n (this group has cardinality φ(n)), hence ordn(at) | 2s. Choose randomly an element a ∈ Z×n and take b = at. Then

ordp(b) = 2i and ordq(b) = 2j with i, j 6s.

If i6=j, say i < j, then we take c=b2i ≡1 mod pand c6≡1 mod q and we can factor n byp:

p= gcd (c−1, n).

1Since the corresponding rings are isomorphic, so are their multiplicative groups. Also, the multiplicative group of a direct product is the direct product of the multiplicative groups.




It remains to show the following claim. Indeed, it will mean that almost every a ∈ Z×n has the required property ordp(at)6= ordq(at), see Remark below.

Claim. i6=j for at least half of all a∈Z×n.

We will use the additive groups (Zk,+) to check the Claim, using the isomorphisms:

Z×n ∼=Z×p ×Z×q ∼= (Zp−1,+)×(Zq−1,+),

where for a primitive element g ∈ Z×p, the isomorphism (Zp−1,+) → Z×p is given by x 7→gx. The above information on the orders of elements ‘translates’ into:

ord+p−1(1) =p−1| 2st and ord+p−1(t)| 2s.

Therefore, our new goal is to show that ord+p−1(xt)6= ord+q−1(yt) for at least half of all pairs (x, y)∈ (Zp−1,+)×(Zq−1,+).

Let ord+p−1(t) = 2k and ord+q−1(t) = 2`. Observe2 that

ord+p−1(t) = ord+p−1(xt) for all x odd, ord+p−1(t)>ord+p−1(xt) for all x even.

The same holds if we replace in the above xby y and p−1 by q−1.

We have two cases.

Ifk 6=`, say ` < k, then for all (x, y) withx odd we obtain:

ord+q−1(yt)6ord+q−1(t) = 2` <2k= ord+p−1(t) = ord+p−1(xt).

This strict inequality holds for at least half of the pairs (x, y), namely those with odd x.

Ifk =` then we have two sub-cases:

Ifx is odd and y is even, then

ord+q−1(yt)<ord+q−1(t) = 2k = 2` = ord+p−1(t) = ord+p−1(xt).

If xis even and y is odd, then

ord+q−1(yt) = ord+q−1(t) = 2k = 2` = ord+p−1(t)>ord+p−1(xt).

This strict inequality holds for at least half of pairs (x, y), namely those where x6≡ymod 2.

Remark. We useErd¨os’ probabilistic method: if one wants to prove that a structure with certain desired properties exists, one defines an appropriate probability space of structures and then shows that the desired properties hold in this space with strictly positive probability.

The reasoning involves probability but the outcome, that is, the existence of the required structure is certain. The method isnon-constructive: it does not provide a deterministic algorithm to produce such a required structure. However, it can be used to produce effectively a structure which is very likely with the desired properties (it suffices to choose a random structure).

For example, our proof above shows that a randomly picked a ∈ Z×n has the desired property ordp(at) 6= ordq(at) with probability > 1/2. Therefore, such a ∈ Z×n does exist. Moreover, given a number r > 0, picking random a1, a2, . . . , ar ∈ Z×n independently gives a ∈ Z×n with the desired property with probability>1−(1/2)r (and the probability of the failure6(1/2)r). Hence, choosing r to be a polynomial in the bit-length of the input (which is made of (n, e) here) we can make the probability of success exponentially close to 1.

The following theorem (also from Chapter 2 of slides) has an analogous formulation.

Theorem 2. If the DLP in Z×p is not in BPP, then the Asymmetry of ElGamal is not in BPP.

Test question: What is the proof in this case?

2Check this!



The reason for creating a specific SED for people working in more than one member state is that in these cases the determination can be provisional and the receiving Institution(s)

Applied Automata Theory (WS 2014/2015) Technische Universit¨ at Kaiserslautern.. Exercise


- Tip: Wenn keine Nachricht den Schnitt (von links nach rechts??) überquert, ist der Lebensfaden des Systems gerissen; rechts des Schnittes kann dann keine Aktivität mehr

An expansion of the concept to colligative phenomena, diffusion processes, surface effects, electrochemical processes, etc., is easily possible.. Furthermore, the same tools allow

These exercises are to be discussed with the assistant during the tutorial on the 29th of October.. Throughout, R and S

Throughout, R denotes a ring, and, unless otherwise stated, all rings are assumed to be associative rings with 1, and modules are assumed to be left


Bach, Carl Philipp Emanuel C Bach, Johann Christoph C Bach, Johann Sebastian B Bach, Wilhelm Friedemann C. Balakirev, Mily

Prove: Let CP(R, G) be defined as the set of critical pairs regarding R and the set of equations G oriented in both ways?. If R is left-linear, then the following statements

The coordination sphere of the silver atoms is further complemented by an ethanol molecule which is also engaged in hydrogen bonding with one of the sulfonate oxygen atoms..

° TAGLIATA VOM FASSONARIND – TAGLIATA DI CARNE DI FASSONA (la nostra carne viene servita tiepida / lauwarm serviert). Radicchio, sautierte Kartoffeln Radicchio tardivo,

For instance, after having set a goal, people may procrastinate in acting on their intentions and thus fail to initiate goal-directed behavior. Furthermore, in everyday life

By forming implementation intentions, people can strategically switch from conscious and effortful action initiation (guided by goal intentions in the action phase) to

It was determined that the best method to preliminarily investigate the mental representation of implement at ion intentions' dual components was to compare the

The Maritime Domain is all areas and things of, on , under, relating to, adjacent to, or bordering on a sea, ocean, or other navigable waterway, including all

To match the market stochasticity we introduce the new market-based price probability measure entirely determined by probabilities of random market time-series of the

safekeeping. The pynabyte utility DYNASTAT displays your current system configuration. 'The steps described below will change the drive assignrnentsso that you will

The following theorem (also from Chapter 2 of slides) has an analogous formulation..

• Topological and algebraic lower bounds for computational problems over