L07 Generators
L07 Generators
[These notes come from Fall 2001. Check with students’ notes for new topics brought up in 2002.]
1 Outline:
• Erratum
2 Erratum
In the previous lecture, there was a small error in the definition of a Carmichael number. The
corrected definition is as follows:
1
2 3 GCD, MODULAR INVERSES
Definition 4 The greatest common divisor, gcd(a, b), of two integers a and b is the largest of their
common divisors. (But gcd(0, 0) = 0 by definition.)
gcd(0, 5) = 5
gcd(24, 30) = 6
gcd(4, 7) = 1
Question: How are GCD’s defined when negative numbers are involved?
Answer: They are defined the same way they are defined for positive numbers.
Fact 3 It is easy to compute gcd(a, b). This is surprising because you might think that in order to
compute the GCD of a and b you would need to figure out their divisors, i.e. solve the factoring
problem. But, as you will see, we don’t need to figure out the divisors of a and b to find their GCD.
Euclid’s Algorithm is probably one of the world’s oldest computing algorithms. It allows us to easily
calculate the greatest common divisor of any two integers a and b. The algorithm is illustrated
below:
Assume a ≥ 0, b ≥ 0
a if b = 0
gcd(a, b) =
gcd(b, a mod b) otherwise
Example 2 Using Euclid’s Algorithm, find the greatest common divisor of 12 and 33.
gcd(12, 33) = gcd(33, 12)
= gcd(12, 9)
= gcd(9, 3)
= gcd(3, 0)
= 3
Intuitive Proof:
In a typical scenario, gcd(b, a mod b) is about b/2. If we imagine b to be to be expressed in bits, this
is equivalent to taking one bit off of b. So the order of execution will be roughly log b. The actual
worst case is for a pair of fibonnaci numbers; they decrease by the golden ration on each iteration.
3 and -1 are the values of x and y that satisfy the statement: ∀a,b it is true that gcd(a, b) = ax + by
for some pair of integers x, y.
Corollary 1 It is easy to find such x and y. The method used to find x and y s.t. ax+by = gcd(a, b)
is called Euclid’s Extended Algorithm.
Corollary 2 Given prime p and a where 1 ≤ a < p, it is easy to find an x s.t. ax ≡ 1(mod p) [i.e.
x = a−1 (mod p)]. Or equivalently, ax + py = 1
Definition 6 The least positive x s.t. ax ≡ 1(mod p) is called the order of a, mod p.
Theorem 3 - Lagrange
The order of any element a, modulo p (where p is prime and a 6≡ 0mod p) is a divisor of p − 1.
a ∈ Zp∗ a2 a3 a4 a5 a6 order(a)
6 62 = 1 63 = 6 1 6 1 2
2 4 1 2 4 1 3
3 2 6 4 5 1 6
Fact 5 If p is prime and g is a generator mod p, then for every y in Zp∗ (i.e. in {1, 2, . . . , p − 1})
∃ a unique x(0 ≤ x < p − 1) s.t. g x ≡ y(mod p)
Definition 8 In the above theorem, x is called the discrete logarithm of y modulo p, base g
Theorem 5 If p is prime, then g is a generator mod p iff g (p−1)/q 6≡ 1(mod p) for every prime q
dividing p − 1
Question: How do we find generators for numbers mod a large prime? Does this require knowing
ALL of the prime factors of p − 1?
Answer: Rather than trying to find all q for a prime p to determine the generator g, we can take
a different approach and pick our prime p, s.t. the factorization of p − 1 is known, allowing us to
easily find the generator g.
Given a prime p
a generator g mod p
a value y ∈ Zp∗
Find
x s.t. y = g x (mod p)
4.1 Discrete Logarithm Problem 5
The discrete logarithm problem is believed to be computationally infeasible if p is large (e.g., 1024
bits) and p − 1 has a large prime factor. It is as hard as trying to factor a 1024-bit number. This is
useful for cryptography because we like to make the hard problem the adversary’s problem.
Question: Are the discrete logarithm problem and the factoring problem equally hard in the sense
that a problem of one type can be reduced to a problem of the other type?
Answer: No. They are closely related problems, but in the usual formulations no reductions exist.
(But taking logs modulo a composite can help factor that composite.)
Question: Doesn’t research in the area of discrete logarithms always contribute to solving the
factoring problem, therefore making the discrete logarithm problem harder?
Answer: I’m not sure I understand this question. But these problems are closely related, and
advances on one problem have usually been translatable into advances in the other.