Signal Processing 16 (1989) 179-184 179

North-Holland

BOOK REVIEWS

" Primality and Cryptography",by Evangelos on Gaul3's Law of Quadratic Reciprocity. In the
Kranakis, Fakultaire Vakgroep lnformatica section on the Prime N u m b e r Theorem, there is
Amsterdam, Universiteit van Amsterdam, The an elegant proof of the fact that the number of
Netherlands and Department of Computer Science, primes less than or equal to a given n is greater
Yale University, New Haven, U.S.A., In: Wiley- than ~(n/log n). Furthermore, the probabilistic
Teubner Series in Computer Science. Publishers: polynomial time algorithm of A d l e m a n - M a n d e r s -
B.G. Teubner, Stuttgart, and John Wiley & Sons, Miller for computing square roots modulo a prime
Inc., Chichester, West Sussex, United Kingdom is given. This algorithm is first described infor-
POI9 1UD, 1986, xv + 235 pp., ISBN 3-519-02104-8 mally, and later a formal version is given. Un
(Teubner), ISBN 0-471-90934-3 (Wiley), indicative fortunately, this formal version is quite different,
price: $41.95 and in fact wrong, from the informal one.
Chapter 1 ends with an exposition on continued
Since the advent of computer controlled communi- fractions.
cation networks, there has been a growing need Chapter 2 is on primality tests. Here the problem
for secure information transmission through elec- is to design fast algorithms, which when given as
tronic media. This led to a renewed interest in the input an integer n, decide whether n is a prime or
field of cryptography, which is concerned with a composite. The author starts with the Sieve of
enciphering messages in order to make them Eratosthenes, which is used to determine all primes
incomprehensible to unauthorized users. less than a given integer n. Next, Wilson's Test is
In 1976, Diffie and Hellman laid the foundations given, stating that n is a prime if and only if
for public key cryptosystems, and since then the ( n - 1 ) ! - = - 1 mod n. This test, however, has only
field has grown considerably. Today, the security theoretical value. Another test in this chapter is
of many cryptosystems depends on the hardness Euler's Sum of Two Squares Test, in which the
of certain problems in number theory, such as author has forgotten to mention that this test is
factoring large integers or computing discrete only valid if n -= 1 rood 4. Next, Pratt's Test is given,
logarithms modulo a large prime number. proving that the primes are in NP, i.e. the primes
In the present book, as its author says in the can be recognized in non-deterministic polynomial
Prologue, the most important mathematical notions time. There are also primality tests for integers of
arising from the recent literature on primality tests, a special form, such as Pepin's Test which says
pseudo-random generators and public key cryptosys- that the Fermat number Fn--22"+1 is prime
terns are isolated and explained. if and only if 3~v,,-J~/2=--lmodF,,, and the
The author starts in Chapter 1 with an introduc- Lucas-Lehmer Test for the Mersenne integers
tion to the basic concepts of number theory. There Mp = 2 P - 1 .
are sections on the Chinese Remainder Theorem Next, there is Miller's Test, that runs in
with an application to threshold schemes (these deterministic polynomial time, if one accepts the
schemes are used to solve the problem of sharing Extended Riemann Hypothesis. Also, the fast
a secret among a number of people that do not probabilistic tests of Solovay-Strassen and Rabin
trust each other), on modular exponentiation, and are given. Both of these tests run in polynomial
 180 Book Reviews

time, but they might give the wrong answer. congruence generator L G E N ( x ) produces the
However, the probability of giving the wrong sequence Xo = x, xi+ ~=------( axi + b) mod m for i/> 0. It
answer can be made arbitrarily small. is shown that such sequences are predictable:
Finally, the today fastest known deterministic There is a polynomial time algorithm, which when
test of Rumely-Adleman is presented. In the given a sufficiently long subsequence, will output
description of this test, a serious error occurs. On the numbers a, b and m.
page 76, Step 4 of the algorithm should be: For An example of pseudorandom sequences that
each i = 0 , 1 , . . . , t - 1 compute gcd(n i mod s, n). are indistinguishable from truly random sequences
Furthermore, the reader might get the impression by any polynomial time algorithm--hence by any
from this algorithm that it can also be used to algorithm encountered in practice--are the ones
factor an integer n into its prime factors: In the generated by the Quadratic Residue Generator:
final step one explicitly finds a factor of n if it is Given integers x and n, such that x is a quadratic
not a prime. This is certainly not the case, for two residue modulo n, i.e. there is a y such that x-=
reasons. First, in practice one almost never reaches y2 mod n. Consider the sequence x~ ~- x 2' mod n for
the final step of the algorithm: in the first steps of i ~> 0. Then the quadratic residue generator pro-
the algorithm almost all composite numbers will duces the sequence of bits bo, bl, b 2 , . . . , where
be eliminated. Second, the Rumely-Adleman test bi = 0 if x~ is even, and b~ = 1 otherwise. It is shown
is carried out, only if one is almost sure that n is that under the assumption that it is computa-
prime, e.g. after a probabilistic primality test has tionally infeasible to determine for given x and n
been carried out. whether x is a quadratic residue modulo n - - a n d
Chapter 3 discusses probability theory. This in fact nowadays no efficient algorithm for this
chapter includes the basic notions such as proba- problem is k n o w n - - t h e above sequences of bits
bility spaces, random variables and the binomial are indeed indistinguishable from truly random
distribution. Also complete proofs are given of sequences of bits.
Chebyshev's and Bernshtein's Laws of Large Num- In Chapter 5, public key cryptosystems are intro-
bers. The chapter ends with a nice application of duced. Suppose A wants to send a message rn to
these laws of large numbers: Given parallel lines B. Then A looks in a public 'telephone book' and
in the plane at a distance 2 from each other, and finds under B's name two integers e and n. This
given a needle of length 1. Suppose we throw the integer n is the product of two large primes p
needle independently n times. Let m be the number and q, and these primes are known only to B.
of times that the needle intersects one of the Also, B has a secret number d satisfying ed =-
parallel lines. Then for each e > 0, the probability 1 m o d ( p - 1)(q - 1). We may assume w.l.o.g, that
that I m / n - 1 / ' r r l > ~ e is at most 1/4ne 2. Hence, by the message m is represented as an integer that is
taking n large enough, the fraction n / m is, with smaller than n. Now A transmits the integer
high probability, a good approximation for ~. E (m) -= rn e mod n to B. In order to decipher the
In Chapter 4, pseudorandom generators are dis- received message E ( m ) , B computes (E(rn)) a,
cussed. Sequences of random numbers are useful which is equal to m ea=- rn mod n by the Euler-
in e.g. cryptography and in the design of prob- Fermat Theorem. Hence B can decipher the
abilistic algorithms. However, since it is impossible message efficiently. However, an eavesdropper
to produce a perfectly random sequence through cannot compute m from E ( m ) , since he does not
an unbiased execution of an experiment, we are know the secret number d. In fact the only w a y - -
led to pseudorandom sequences, i.e. sequences that known t o d a y - - t o find this secret number, is to
look sufficiently random. compute the prime factors p and q of n, and then
First, the well-known Linear Congruence Gen- to take the multiplicative inverse of e m o d ( p - 1 ) ×
erator is given. Let a, b, and m be fixed--but (q - 1). So under the assumption that integer fac-
unknown--positive integers. Then the linear torization is infeasible--and today this is a reason-
Signal Processing
 Book Reviews 181

able assumption--this is a secure way of transmit- that the reader should have some acquaintance
ting messages. with algebra and the theory of computational
The just sketched RSA System is discussed in complexity. So the b o o k seems most suited to
Chapter 5. It is shown e.g. that computing a certain mathematicians and theoretical computer scien-
bit of the message m from the encoded RSA tists.
message m e mod n is as difficult as computing the Furthermore, since e.g. classical cryptosystems
entire message m. are not discussed, it might be difficult to use the
Other cryptosystems in this chapter are Rabin's book as a textbook for a general course in cryp-
System, which can be broken if and only if one tography. However, as a textbook for an advanced
can factor integers efficiently, the Merkle-Hellman course or for researchers it can serve quite well.
System based on the knapsack problem, which is Unfortunately, the book contains several mis-
not secure, and the Quadratic Residue System takes, and some of these were mentioned already.
which is secure if one assumes that determining Most of these mistakes are, however, easily detec-
quadratic residuosity is infeasible. ted by the careful reader. Let me mention a few
The book ends with Chapter 6 Towards a General of these mistakes. On page 53 in the first line, r ls
Theory. In this chapter some general methods are should be rl n. On page 75 in line -5, the a should
given for constructing p s e u d o r a n d o m sequences. be vp(a), and on page 126 in line -12, APR should
Also the very powerful X O R Theorem is proved be -7APR. On page 127 in line -3, the Legendre
in detail. This theorem states that by XOR-ing a symbol (x IP) is suddenly called Langrange symbol
predicate, one gets a new predicate that is more (even the name Lagrange is spelt wrong). On page
difficult to predict than the original predicate. This 160, the decryption function for the Quadratic
X O R theorem can be used e.g. to construct secure Residue System is wrong (one has to interchange
p s e u d o r a n d o m generators and one-way functions 0 and 1). This is, however, a classical mistake; even
(i.e. functions like E ( m ) above; given m it is easy in the original papers on this cryptosystem, the
to compute E(m), but computing m from E ( m ) error occurs.
is difficult). To conclude this review, the book is recommen-
The book is in general clearly written. At some ded to anyone who is interested in the theoretical
places, maybe some more intuitive background aspects of cryptography, and in the parts of number
information could have been added. For example, theory that are relevant for this field, and who is
more words should have been spent on why using willing to invest enough time in understanding the
the circuit as the model of computation, and not material.
e.g. the Turing Machine. Most of the proofs are
given with sufficiently m a n y details, so the reader Michiel H.M. S M I D
can work out the precise details for himself. (There Departments of Mathematics and
are in fact many details to be worked out.) Computer Science,
Although most of the elementary notions of University of Amsterdam,
number theory are introduced in Chapter 1, I think Amsterdam, The Netherlands

"Z Transform Theory and Applications", by Robert This excellent didactical book is a new edition,
Vich, Institute of Radio Engineering and Electron- revised and augmented, of a book first published
ics, Czechoslovak Academy of Sciences, Prague, in G e r m a n and in Czechoslovakian by the author,
Czechoslovakia. Publishers: Kluwer Academic Pub- who is a professor at the Faculty of Electrical
lisher Group, P.O. Box 989, 3300 AZ Dordrecht, Engineering of the Technical University of Prague.
The Netherlands, 1987, xii + 246 pp., ISBN 90-277- The text is based mainly on the teaching experience
1917-9, indicative price: U.S. $69 of Professor Vich.
Vol. 1O. No. 2, February 1989