Class Notes for Cryptologic Mathematics (FYS 100) Tim McDevitt Frank Arnold

ELIZABETHTOWN COLLEGE E-mail address: McDevittT@etown.edu ELIZABETHTOWN COLLEGE E-mail address: ArnoldF@etown.edu

November 12, 2010

Contents
Preface Introduction 0.1. What is Cryptology? 0.2. Types of Ciphers 0.3. Mathematical Ciphers 0.4. Types of Cryptologic Attacks 0.5. Notation and Terminology Exercises Chapter 1. Modular Arithmetic 1.1. Fundamental Theorem of Arithmetic 1.2. Greatest Common Divisors 1.3. Euclidean Algorithm 1.4. Extended Euclidean Algorithm 1.5. Relatively Prime Numbers 1.6. Modular Arithmetic 1.7. Solving Linear Congruences 1.8. Additive Cipher 1.9. Cryptanalysis of the Additive Cipher 1.10. Afne Cipher 1.11. Cryptanalysis of the Afne Cipher Exercises Chapter 2. Probability 2.1. Counting 2.2. Probability 2.3. Index of Coincidence 2.4. Vigenre Cipher Exercises Chapter 3. Recursion 3.1. Recursion 3.2. Binary Arithmetic 3.3. Data as Bits 3.4. Encryption of Binary Data 3.5. Linear Feedback Shift Registers Exercises Chapter 4. Matrices 4.1. Matrix Arithmetic 4.2. Hill Cipher 4.3. Cryptanalysis of the Hill Cipher Exercises
v

vii 1 1 3 6 7 7 8 11 11 12 12 14 15 15 19 23 25 27 27 28 33 33 36 39 41 45 49 49 50 51 52 53 55 57 57 60 61 64

vi

CONTENTS

Chapter 5. Modular Exponentiation 5.1. Square and Multiply Algorithm 5.2. Mathematical Induction 5.3. Euler Phi Function 5.4. Fermats Little Theorem 5.5. Eulers Theorem 5.6. Dife-Hellman Key Exchange 5.7. RSA Encryption Exercises Bibliography

67 67 68 69 72 75 76 78 79 83

Preface
The rst author has taught cryptology as a First-Year Seminar at Elizabethtown College for several years using Robert Lewands ne book [4]. However, less than half of the authors students are math or science majors, so Lewands rigorous approach is often under-appreciated. These notes follow much of the same material, but they rely fairly heavily on student intuition instead of rigorous proof, as is usually done in calculus courses. Proofs or arguments are reserved for those situations where results are not intuitively clear to the students. For instance, students dont struggle with the transitivity of divisibility for integers (if a|b and b|c, then a|c), but Fermats little theorem requires a proof. Other situations warrant justications that fall short of proofs, but are still convincing to students. For example, we dont formally prove that the Euclidean algorithm always nds the gcd of two positive integers, but we demonstrate that it has to work with generalizeable examples. Since our audience includes rst-year students who are not math or science majors, we have tried to minimize the use of terminology and mathematical jargon. Students interested in more details should consult textbooks on number theory or algebra, or just wait patiently for an opportunity to take those courses. The second author is a former (2008) student of this course who has provided a students perspective on the presentation of the material. As a result, the style of writing is informal in an attempt to teach some math and to develop enthusiasm for cryptology. Please note that this text does not address the history of cryptology in a systematic way so that we can focus on the mathematics. Students of cryptology should appreciate the impact of cryptology on historical events, but that knowledge will have to be obtained from other sources (c.f. [3] and [10]). Throughout the notes are several hyperlinks to Mathematica notebooks that are helpful for cryptologic calculations or for demonstrating mathematical concepts. The entire set of notebooks can be found at users.etown.edu/m/mcdevittt/. The le cipher.nb contains code that implements most of the encryption algorithms in the book. Readers may also enjoy using the FREE software package ECrypt that runs on WindowsTM (www2.etown.edu/ECrypt/ECrypt.htm ). ECrypt doesnt have to be installed; just download it and run it. It has a graphical user interface (GUI) that enables users to easily implement the cryptographic algorithms in this course. It also provides special tools for cryptanalysis, a recursive calculator, and a calculator for modular arithmetic. Future versions of this book will have chapters dedicated to elliptic curves and to the encryption and cryptanalysis of historical ciphers applied to image and sound les as described in [5].

vii

Introduction
0.1. What is Cryptology? Classically, cryptology was used to send and receive secret messages and its users were often military leaders or diplomats. For Admiral Alice to send General Bob a secret message, she would have to encrypt or encipher her message using a method that she and Bob had previously agreed upon. When Bob receives the message, he has to decrypt or decipher her message to read it. Often, the method of encryption would rely on a key - some special number(s) or word(s) that only Alice and Bob know. Prior to the computer age, encryption methods were relatively simple, not explicitly mathematical, and often not very secure. Messages were relatively short and there was very little systematic research certifying the security of cryptologic methods. Today, however, messages can be very long. As of this writing (2010), a typical JPEG le from a digital camera is over 1 MB, which is roughly equivalent to a text le of a million characters. Contemporary encryption methods tend to use very sophisticated mathematics and there is a great deal of systematic research. The US Department of Commerce certies certain algorithms so that users can be condent that their communications are secure, and these algorithms can be very complicated.1 In addition to the transmission and reception of secret messages, modern cryptology also involves less wellknown operations such as key exchange, digital signatures, random number generation, hashing, etc..., but this book focuses, for the most part, on mathematical versions of historical methods. These methods require what is probably unfamiliar mathematics and, although they are no longer useful, they evolved into todays methods so it is still useful to be familiar with them. The only exception is our dicussion of public key systems, which currently enjoy widespread use. Another important difference between classical and modern cryptography is frequency of use. In the past, the average individual had no practical reason to encrypt messages, but today we all use cryptographic algorithms without even knowing it when we use our cell phones or email or make online purchases. Therefore, modern cryptology is directly applicable to our daily lives in very important ways. Finally, the nature of characters in encryption algorithms has changed in modern times. In the past, messages were composed using characters from a xed alphabet, so, for example, two English speakers might use a 26-letter alphabet abcdefghijklmnopqrstuvwxyz, or they might use a 52-letter alphabet that includes capital letters, or they might include digits and punctuation. In this course, we will frequently assume a 26-letter alphabet. Computers store les in terms of bits that we can regard as an alphabet of only two characters: 0 and 1. This includes Word R , and Excel R documents, JPEG images, MPEG movies etc... Modern encryption algorithms operate at the bit level on a computer, so all computer les can be encrypted in the exact same way, regardless of how we interpret those bits as text, pictures, movies, etc... Cryptology is an umbrella term for cryptography and cryptanalysis. Cryptography involves the creation and use of algorithms that pass private information between two parties with the goal of obscuring
1For example, see the NIST document FIPS 197 that takes 51 pages to describe AES. The good news is that the description is very good and very clear, unlike IRS documents. 1

INTRODUCTION

Figure 0.1: Can you read the message hidden in this poem that is revealed by the stencil?

the information from unintended recipients. Classically, users might hope that adversaries would not know what encryption algorithms were being used, but that is an unrealistic expectation today. Today, we have to assume that adversaries know what algorithms we are using, so the security of a method depends entirely on the difculty of recovering the secret key. Symmetric, or private key, systems, require both sender and receiver to know the same secret key, but modern public key systems enable parties to communicate securely without previously establishing a secret key. Cryptanalysis is the study of cryptographic algorithms with the intent of recovering secret messages without knowing the secret key. We can think of cryptanalysis as the activity of an adversary who obtains an encrypted message and tries to recover the original message without knowing the key, but cryptanalysis could also be the activity of an analyst who is studying the security of a given method. Loosely speaking, we can think of cryptographers as the defense and cryptanalysts as the offense, but both sides must know what the other is capable of to do their jobs properly. We also want to distinguish cryptography from steganography, which seeks to hide the very existence of a message. For example, the childrens activity of writing a note in invisible ink is an example of steganography as is the use of a stencil to hide a message in a book. (See Figure 0.1.) Of course, steganography can be combined with cryptography to provide extra security. Although steganography can be very interesting, we wont discuss it in this book. Finally, a cipher is an encryption algorithm that is used to encrypt (or encipher) a message, or plaintext, into apparently unintelligible ciphertext. The original plaintext is recovered by decrypting (or deciphering) the ciphertext. The terms plaintext" and ciphertext" still apply even if the data are not really text but just some form of data (e.g. bits). Also, for convenience people often shorten ciphertext" into cipher", so you have to tell them apart from context. Finally, the word key" is often used in different ways at the same time, but we will wait to point that out until later.

0.2. TYPES OF CIPHERS

Figure 0.2: The same strip of paper displayed on two different diameter tubes. On the left we see part of the joke How do you know that you have found an extroverted mathematician? He looks at your feet when he talks to you. On the right, the message is unreadable.

0.2. Types of Ciphers There are two basic tools that are used in encryption algorithms: transposition (rearranging the characters) and substitution (replacing characters with other characters). Transposition and substitution are familiar as two popular types of puzzles, anagrams and cryptograms. Classroom Exercise 0.1: Here is a sample anagram; the letters in each word have simply been jumbled. See if you can decipher the message.

RYOU RETARSIPNVEETE WSOE UYO, OTN IHS UNSYRTDI YNOL, UBT HSI TEJGMDUN; AND EH BTSAYRE, EDITASN FO ERNVSGI OUY, FI EH ACFRSIEISC TI OT RYUO NONPOII - "PHCEES TO EHT RESCLETO AT BLRTIOS TA HTE CONSOCINUL OF HET LLOP" BY EDUNDM RBEUK
Classroom Exercise 0.2: Here is a sample cryptogram; each letter is replaced by another letter. See if you can decipher the message.

LRLSUB ZYU SRHU CRYCSUB MYZQD XF LKU WZJRCRZD'B QZDM, LO CODLYZCL LKU BIKUYU ON WZD'B NUSRCRLF. KU SRVUB RWWGYUM QRLKRD LKU XZBLRSSU ON Z QOYM, ZDM BGYVUFB ZL Z MRBLZDCU LKU UDVRUM SRNU ON WZD. - "LKU YRJKLB ON WZD" XF LKOWZB IZRDU.
If you actually solved both puzzles, then the punctuation and spacing of the words in both the anagram and the cryptogram probably help a lot. We can make a much more difcult puzzle by using a shorter message, removing all spacing and punctuation, using both transposition and substitution. Classroom Exercise 0.3: Winston Churchill reportedly said RSAAPTAPCVTMVZSCSOCPYDTDTQQQQITPQ. See if you can decipher this combination anagram and cryptogram with spacing and punctuation removed. An ancient example of a transposition cipher is the (scytale), which the Spartans reportedly used for tactical messages on the battleeld. A strip of leather or parchment was wound around a stick and a message was written across it as shown in Figure 0.2. Once the strip was unwound, the letters were jumbled and the message was unreadable. Furthermore, the message could only be read by wrapping the message around a stick with the same diameter. Figure 0.2 shows a scytale with a decidedly unimportant message. It illustrates how the message is unintelligible if the diameter is incorrect. In this case, the diameter of the stick is the secret key.

INTRODUCTION

An early example of a substitution cipher is the Caesar cipher, which simply shifts each letter in the plaintext ahead 3 places to produce an encrypted message. For example, veni vidi vici2 becomes yhql ylgl ylfl. The Caesar cipher is attributed to Julius Caesar by Suetonius, who was a prominent historian of the Roman emperors in the rst and second centuries A.D. According to Suetonius [12], Exstant et ad Ciceronem, item ad familiares domesticis de rebus, in quibus, si qua occultius perferenda erant, per notas scripsit, id est sic structo litterarum ordine, ut nullum verbum efci posset; quae si qui investigare et persequi velit, quartam elementorum litteram, id est D pro A et perinde reliquas commutet. The translation of Suetonius on penelope.uchicago.edu is There are also letters of his to Cicero, as well as to his intimates on private affairs, and in the latter, if he had anything condential to say, he wrote it in cipher, that is, by so changing the order of the letters of the alphabet, that not a word could be made out. If anyone wishes to decipher these, and get at their meaning, he must substitute the fourth letter of the alphabet, namely D, for A, and so with the others. If this translation is correct, then it actually sounds like Caesars messages were decrypted by shifting 3 letters to the right. Nevertheless, modern cryptographers generally understand Caesars cipher as a shift of 3 letters to the right. The Caesar cipher is an example of a monoalphabetic substitution cipher, in which every character is replaced by some other character. In the 9th century A.D., Abu Yusuf Yaqub ibn Ishaq al-Sabbah Al-Kindi introduced frequency analysis that made monoalphabetic substitution ciphers obsolete because they were no longer secure. To thwart frequency analysis, people in succeeding centuries invented polyalphabetic subsitution ciphers, in which each letter is replaced by another letter that changes with each use. For instance, a polyalphabetic system might encrypt the rst a in aardvark as q, but the second a might be encrypted as n. Examples include the Alberti cipher wheel and the Vigenre cipher. In 1467, Leon Battista Alberti (1404-1472) developed a cipher wheel that produced ciphertext that was not vulnerable to Al-Kindis frequency analysis. The wheel consisted of two rings and the inner ring could be turned about its center. Sender and receiver would agree on a pointer letter - Alberti chose k. The sender picks a letter on the outer ring and lines it up with k on the inner ring and then enciphers several letters by locating plaintext characters on the outer ring and associating them with corresponding cipher characters on the inner ring. For example, using the rst setting in Figure 0.3, the rst six characters of VENIVIDIVICI are encrypted as Fnxrpnp. What makes his method polyalphabetic is that the sender occasionally points k at a new letter. Using the second setting in Figure 0.3, the last six characters of VENIVIDIVICI are encrypted as 4mghg&g. Therefore, altogether, the message VENIVIDIVICI can possibly be encrypted as Fnxrpnp4mghg&g. It is interesting to note that Albertis wheel omits H, K, U, W and Y but includes some digits. Apparently, Alberti was content to associate U with V and W with VV. In 1585, Blaise de Vigenre introduced a polyalphabetic substitution cipher that endured for three centuries. The user chooses a key word, say LION, and writes it down repeatedly under the plaintext until the key is as long as the plaintext. Then the user looks up each (key letter, plain letter) pair in the Vigenre square in Table 0.1.
2"I

came, I saw, I conquered." was Caesars report to Rome in 47 B.C. after his overwhelming defeat of King Phar-

naces II of Pontus at the battle of Zela.

0.2. TYPES OF CIPHERS

Figure 0.3: Two setting of Albertis cipher wheel.

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

A A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

B B C D E F G H I J K L M N O P Q R S T U V W X Y Z A

C C D E F G H I J K L M N O P Q R S T U V W X Y Z A B

D D E F G H I J K L M N O P Q R S T U V W X Y Z A B C

E E F G H I J K L M N O P Q R S T U V W X Y Z A B C D

F F G H I J K L M N O P Q R S T U V W X Y Z A B C D E

G G H I J K L M N O P Q R S T U V W X Y Z A B C D E F

H H I J K L M N O P Q R S T U V W X Y Z A B C D E F G

I I J K L M N O P Q R S T U V W X Y Z A B C D E F G H

J J K L M N O P Q R S T U V W X Y Z A B C D E F G H I

K K L M N O P Q R S T U V W X Y Z A B C D E F G H I J

L L M N O P Q R S T U V W X Y Z A B C D E F G H I J K

M M N O P Q R S T U V W X Y Z A B C D E F G H I J K L

N N O P Q R S T U V W X Y Z A B C D E F G H I J K L M

O O P Q R S T U V W X Y Z A B C D E F G H I J K L M N

P P Q R S T U V W X Y Z A B C D E F G H I J K L M N O

Q Q R S T U V W X Y Z A B C D E F G H I J K L M N O P

R R S T U V W X Y Z A B C D E F G H I J K L M N O P Q

S S T U V W X Y Z A B C D E F G H I J K L M N O P Q R

T T U V W X Y Z A B C D E F G H I J K L M N O P Q R S

U U V W X Y Z A B C D E F G H I J K L M N O P Q R S T

V V W X Y Z A B C D E F G H I J K L M N O P Q R S T U

W W X Y Z A B C D E F G H I J K L M N O P Q R S T U V

X X Y Z A B C D E F G H I J K L M N O P Q R S T U V W

Y Y Z A B C D E F G H I J K L M N O P Q R S T U V W X

Z Z A B C D E F G H I J K L M N O P Q R S T U V W X Y

Table 0.1: A Vigenre square. The highlighted letters correspond to an example in the text.

Plain: S C Y T A L E Key: L I O N L I O Cipher: D K M G L T S

INTRODUCTION

For example, to encrypt the rst letter in SCYTALE, the user looks in row L and column S to nd a D. This is the cipher character that substitutes for the S. Continuing this process produces the entire ciphertext DKMGLTS. Be careful of the potentially confusing terminology - the keyword LION generates the key LIONLIO for the cipher, but people may refer to both LION and LIONLIO as key. The Vigenre cipher was highly regarded for three centuries and it was considered by many to be secure until Charles Babbage cracked it in 1854. Friedrich Kasiski also broke the cipher in 1863, but it seems that cryptological news traveled slowly because the Confederacy still used the Vigenre cipher during the U.S. Civil War to the advantage of the North. In fact, as late as 1917, Scientic American (Supplement LXXXIII, January 27, 1917) still advocated its use. The [Vigenre ] method used for the preparation and reading of code messages is simple in the extreme and at the same time impossible of translation unless the key is known. The ease with which the key may be changed is another point in favor of the adoption of this code by those desiring to transmit important messages without the slightest danger of their messages being read by political or business rivals etc. Modern ciphers are often polygraphic. A polygraph is a sequence of several characters; specically a digraph is a sequence of two characters and a trigraph is a sequence of three. Polygraphic substitution ciphers encrypt entire blocks of characters together. We will study the Hill cipher in chapter 4 as an example of a polygraphic substitution cipher, but it is a little too complicated to introduce quickly here. One common feature of all classical methods is that they are symmetric in the sense that both sender and receiver require knowledge of the algorithm and the secret key. This sort of arrangement is not always possible in the computer age. Therefore, in chapter 5 we study two public key systems that allow people to communicate even though theyve never had an opportunity to agree upon a secret key.

0.3. Mathematical Ciphers Since the intended audience of this book speaks English, the most commonly used alphabet in this book is English, but we really can use any alphabet we want, and the length of the alphabet is usually not important. Latin: ABCDEFGHIKLMNOPQRSTVXYZ Greek: o Arabic: Computer: 01 Grayscale 8-bit bitmap: 0 1 2 . . . 254 255 None of the methods weve discussed so far require the use of mathematics. However, math can make any of them much easier to implement, either by hand or on a computer. For example, in chapter 2 we will revisit the Vigenre cipher, but we will have absolutely no need of the cumbersome Vigenre square in Table 0.1, so it will be much easier to encrypt and decrypt messages. The ciphers in chapters 3, 4, and 5 are all thoroughly mathematical and we cant even describe the algorithms without using mathematics. Cryptanalysis is also greatly aided by the use of mathematics and statistics. Consider the simple scytale, which is equivalent to writing the plaintext characters in a table as shown.

0.5. NOTATION AND TERMINOLOGY

W D O Y O U K N O W T T Y O U H A V E F O U A N E X T R O V E R T M A T H E M A T I C I ? H E L O O K S A T Y R F E E T W H E N H E L K S T O Y O U The ciphertext is read off in columns: HHNEAOT OADDNUA WTAM?RL DYNAHFK OOETEES YUXHLET OHTEOTO UARMOWY KVOAKHO NEVTSEU OFEIAN WORCTH TUTIYE. Software like Mathematica makes ciphertext like
this easy to crack. Try it with the Mathematica notebook Scytale.nb at http://users.etown.edu/m/mcdevittt/Crypto.html. 0.4. Types of Cryptologic Attacks Real life cryptanalysis often hinges on operator error or some aw in the design of the machine or software that implements a cryptographic algorithm. Such mistakes make different scenarios possible for an adversary. One type of attack is a known-plaintext attack, in which the cryptanalyst knows the encryption algorithm and has access to some plaintext and the corresponding ciphertext. Such plaintext is often referred to as a crib. The Allies used cribs to nd Enigma keys during World War II. In a chosen plaintext attack, the cryptanalyst has an opportunity to choose some plaintext to feed into the cryptographic algorithm, but we will mostly consider ciphertext-only attacks, where we have some cipher and the only thing we know is the algorithm. Recall that we will always assume that cryptanalysts know the relevant cryptographic algorithms and the only thing that they lack is the key. 0.5. Notation and Terminology Mathematicians tend to write very concisely and use a lot of specialized symbols, so it might be helpful if we introduce some of the symbols that well be using. Sets with listed elements are written with braces, like {red, green, blue}. Other special sets have special symbols. For instance, the set of integers is denoted by . The natural numbers, rationals, reals, and complex numbers are , , , and , respectively. There is no universally recognized symbol for whole numbers, but we could use {0}; the union () of and the set including only the number zero. In this course, we will work almost exclusively with integers, but we will encounter real (or rational) numbers when we study probability. We indicate that a is an integer" by writing a to indicate that a is in () the set of integers. We write a|b to indicate that a divides b. That is, for integers a and b, a divides b if there exists an integer c such that ac = b. For example, a = 2 divides b = 12 since there is an integer c = 6 such that ac = (2)(6) = 12 = b. Similarly, a = 2 does not divide b = 13 (written 2 | 13) since there is no integer c such that ac = 2c = 13 = b. As we mentioned in the introduction, the words encrypt and encipher are synonymous, as are decrypt and decipher. Original text is plaintext and the encrypted text is ciphertext, even if the text isnt really text. Pictures, audio, computer les can all be encrypted, so it might seem a little odd to call a picture plaintext, but well do it anyway. The word cipher usually refers to an encryption algorithm, but it can be a shortened version of ciphertext. Also, the word key is often used imprecisely. Sometimes it refers to the keyword or key number(s), and sometimes it refers to a long string of letters or numbers that are generated from the keyword.

H H N E A O T

O A D D N U A

INTRODUCTION

A code exchanges one system of writing for another. It may have the effect of making a message unintelligible, but that is not always its purpose. Two familiar non-encrypting codes are Morse code and ISBNs. Morse code converts English into a series of dots and dashes so that an English message can be easily trasmitted over a primitive channel like a telegraph line. The ISBN code for a book serves two purposes; it identies the book (like a numerical name) and it attaches a check character at the end that can identify mistakes in the number. For instance, the ISBN-10 for Lewands Cryptological Mathematics [4] is 0-88385719-7. The leading 0 indicates the language (English), the second group of numbers, 88385, indicates the publisher (The Mathematical Association of America), and the third set of digits is the publishers serial number for the book. The nal digit, 7, is chosen so that 0 1 + 8 2 + 8 3 + 3 4 + 8 5 + 5 6 + 7 7 + 1 8 + 9 9 + 7 10 = 330 is divisible by 11. If someone made a silly transposition mistake like 0-88835-719-7, the ISBN code would identify it since 0 1 + 8 2 + 8 3 + 8 4 + 3 5 + 5 6 + 7 7 + 1 8 + 9 9 + 7 10 = 325 is not divisible by 11. So, when people talk about codebreaking, they are really talking about cryptanalysis. Exercises (1) Decrypt the Caesar ciphertext shwhuslshuslfnhgdshfnrislfnohgshsshuv. (2) Decrypt each of the following messages that were encrypted with a scytale. The Mathematica notebook Scytale.nb might be helpful. (a) Sssalbheohe slyearelshs se lee tsh. (b) Wiifd e a etihsxr snBusneny aoe?ese e saifv cevan. (3) Use the Vigenre square (Table 0.1) to (a) encrypt ENIGMA with keyword GERMANY. (b) decrypt YUGPYN if the keyword is JAPAN. (4) Which of the following ISBN-10s are correct? (a) Calculus (6th edition) by Stewart, 0-495-38558-1. (b) Elementary Differential Equations (8th edition) by Boyce and DiPrima, 0-417-43339-X. (X stands for 10.) (c) The Mathematics of Coding Theory by Garrett, 0-13-101976-8. (d) Introduction to Cryptography with Coding Theory by Trappe and Washington, 0-13-186239-1. (5) The rst nine digits of the ISBN-10 for each of the following books are given. What should the last digit be? (a) 0-7432-6751, The Ofcial Rock Paper Scissors Strategy Guide by Douglas and Graham Walker (b) 0-13-187141, Elementary Linear Algebra: A Matrix Approach by by Spence, Insel, and Friedberg (c) 0-521-47236, The Nonlinear Theory of Elastic Shells by Libai and Simmonds (6) The Atbash cipher replaces the 1st letter of the alphabet with the last, the 2nd with the second-tolast, etc...3 Use the Atbash cipher to decrypt klgzgl xsrk. (7) The Polybius checkerboard cipher places 25 letters of the alphabet (J is missing) in a 5 5 table.
3The Atbash cipher appears in the Book of Jeremiah where, for example,

Babylon is referred to as Sheshakh (in Hebrew).

EXERCISES

1 2 3 4 5 1 E P X Q Y 2 H V B A O 3 F M C U N 4 T K D L R 5 W I S Z G To encrypt a message like FEEDME, you just give the row and column pair for each letter: 31111143 3211. This has the disadvantage that the ciphertext is twice as long as the plaintext, but it has the advantage that it works well as a semaphore. (a) Encrypt HANDITOVER. (b) Decrypt 231141411145412544525521412535113324354344114121243533344553114

121114324454235115353332535313433523453.

(c) What is the key for this cipher? (d) The keyspace for a cipher is the set of all possible keys. How big is the keyspace for this cipher? (8) In the Wheatstone-Playfair cipher, 25 letters of the alphabet are placed into a 5 5 table. E P X Q Y H V B A O F M C U N T K D L R W I S Z G Plaintext messages are broken into digraphs, and if the pair of letters lie in the same row, then the ciphertext is the pair of letters to the right, wrapping around as necessary. lie in the same column, then the ciphertext is pair of letters beneath, wrapping around as necessary. lie at the corners of a rectangle, then the ciphertext is the pair of letters in the opposite corners. For example, WELCOME is encrypted as EHDUVNPY, padding the end of WELCOME with Q so that its length is even. (a) Encrypt MATHCOUNTS R . (b) Decrypt BRRNKTNFISWFXDSZBGDG. (c) What is the key for this cipher? (d) How big is the keyspace for this cipher?

CHAPTER 1

Modular Arithmetic
This chapter develops the mathematical tools needed for modular arithmetic and modular algebra, both of which will be useful throughout the entire course. After that, we apply our new knowledge to the additive and afne ciphers. 1.1. Fundamental Theorem of Arithmetic Recall that an integer p > 1 is prime if the only integers that divide it are 1 and p. (We will frequently use p and q to represent prime numbers.) Composite numbers are integers greater than one that are not prime. Also, recall the fundamental theorem of arithmetic. (Dont worry if you dont recognize the name, it should still be familiar.) THEOREM 1.1 (Fundamental Theorem of Arithmetic). Every positive integer n > 1 can be written uniquely as a product of primes. We wont prove the theorem because it is probably very familiar to most readers. If you are interested in a proof, it isnt very difcult and you can nd one in a book on number theory or on Wikipedia. Instead, lets look at some examples. Example 1.1: You can probably do the rst two examples in your head, but the third one might be easier if you use a factor tree. (1) 35 = 5 7 (2) 48 = 24 3 (3) 1260 = 22 32 5 7.

Classroom Exercise 1.1: Express the following numbers as products of primes. (1) 95
11

12

1. MODULAR ARITHMETIC

(2) 819 (3) 3400 1.2. Greatest Common Divisors A common divisor of two integers a and b is an integer (positive or negative) that divides both a and b. For example, 2 is a common divisor of 12 and 18 since 2|12 and 2|(18). If a and b are both zero, then there are an innite number of common divisors, so there cant be a greatest common divisor. However, every other pair of integers (including if a = 0 or b = 0, but not both) has a nite number of common divisors, so there must be a greatest common divisor. We denote the greatest common divisor of a and b by gcd(a, b).1 Here is a formal denition: Denition 1.1: If a and b are not both zero, then the greatest common divisor of a and b is the largest positive integer that divides both a and b. Classroom Exercise 1.2: Compute the following gcds. (1) gcd(35, 7) (2) gcd(55, 165) (3) gcd(253, 598) The rst problem was easy. Since 7|35, it must be that gcd(35, 7) = 7. The second was a little harder, but the third is the most interesting. How did you do it? Most people use the fundamental theorem of arithmetic; they factor both numbers to nd that 253 = 11 23 and 598 = 2 13 23, and then conclude that gcd(253, 598) = 23. This works well and its what most of us learned in school, but factoring integers is a slow process that becomes cumbersome for very large numbers. Fortunately, there is a better way. 1.3. Euclidean Algorithm The Euclidean algorithm is an ancient, but efcient, method for nding the gcd of two integers. It is best explained in the context of an example, so lets consider the last exercise of computing gcd(253, 598). Example 1.2: To nd gcd(253, 598), we rst divide the larger number by the smaller. If you can do this in your head, great! Otherwise, use long division. 2 R 92 253 598 506 92 This means that (1.1) 598 = 253(2) + 92.

Now, gcd(253, 598) clearly divides two of the three terms in (1.1), so it must also divide the third. In other words, since gcd(253, 598)|598 and gcd(253, 598)|253(2), we can conclude that gcd(253, 598)|92. A similar argument shows that gcd(92, 253) also divides all three terms in (1.1), so we can conclude that gcd(253, 598) = gcd(92, 253). This allows us to exchange a hard problem for an easier one, and we can do this type of reduction repeatedly until the gcd(253, 598) is obvious. Since
1Some authors use the equivalent gcf for greatest common factor, but we use gcd.

1.3. EUCLIDEAN ALGORITHM

13

2 R 69 92 253 184 69 gcd(253, 598) = gcd(92, 253) = gcd(69, 92). Finally, 1 R 23 69 92 69 23 so gcd(253, 598) = gcd(92, 253) = gcd(69, 92) = gcd(23, 69). Since 23|69, gcd(253, 598) = 23. Lets review what weve done for this problem. By repeated use of long division, we have found that 598 = 253(2) + 92 253 = 92(2) + 69 92 = 69(1) + 23 69 = 23(3) + 0. Once we reach a remainder of zero, the algorithm stops because the smaller number divides the larger. Therefore, the second-to-last remainder (written on the right) is the gcd. In this case, its 23. Example 1.3: Lets work through another example: gcd(226, 270). Repeated use of long division gives (1.2a) (1.2b) (1.2c) (1.2d) 270 = 226(1) + 44 226 = 44(5) + 6 44 = 6(7) + 2 6 = 2(3) + 0.

The second-to-last remainder is 2, so gcd(226, 270) = 2. That is the Euclidean algorithm. We could stop here and move on, but lets be sure we understand how the Euclidean algorithm works. In (1.2a), the remainder is 44, so gcd(226, 270) = gcd(44, 226). In (1.2b), the remainder is 6, so gcd(226, 270) = gcd(44, 226) = gcd(6, 44). In (1.2c), the remainder is 2, so gcd(226, 270) = gcd(44, 226) = gcd(6, 44) = gcd(2, 6). Finally, in (1.2d), the remainder is 0, so the algorithm stops and gcd(226, 270) = gcd(44, 226) = gcd(6, 44) = gcd(2, 6) = 2. In general, to use the Euclidean algorithm to nd gcd(a, b), you divide the larger of the two numbers a and b by the smaller one. Each step after that involves sliding" and long division. By sliding", we mean that the divisor and remainder move to the left so that they become the new dividend and divisor, respectively. For example, the 226 and 44 slide left from (1.2a) to (1.2b). In general, you continue this process until the last remainder is 0. Example 1.4: Lets do one nal example. The gcd(343, 454) = 1 since (1.3a) (1.3b) (1.3c) (1.3d) 454 = 343(1) + 111 343 = 111(3) + 10 111 = 10(11) + 1 10 = 1(10) + 0.

14

1. MODULAR ARITHMETIC

1.4. Extended Euclidean Algorithm Were now going to cover the extended Euclidean algorithm. It wont be immediately obvious why this is important, but it will be very important to us before the end of the chapter. Number theory texts like [6] and [8] typically include a theorem like the following. THEOREM 1.2. There exist integers x and y such that a x + b y = gcd(a, b). Example 1.5: If a = 7 and b = 35, then x = 5 and b = 0 satisfy a x + b y = gcd(a, b). Note, however, that Theorem 1.2 does not claim that x and y are unique, so other values for x and y are possible. In this case, other possibilities include x = 6, y = 1 and x = 4, y = 1. We wont prove Theorem 1.2, but we will show you how to nd x and y by extending the Euclidean algorithm. This is a little tricky at rst, but its pretty easy after youve done a few examples. One of the hardest ideas is to remember not to explicitly multiply any of the remainders. The only time youd want to multiply them is to check your calculations. Example 1.6: Recall Example 1.6 in which we found gcd(343, 454) = 1. Beginning with the equation (1.3c) (i.e. the second-to-last equation, the one that gives us the gcd), we work backwards to nd values for x and y. (1.4a) (1.4b) (1.4c) 1 = 111 10(11) = 111 (343 111(3))(11) = 111(34) 11(343) = (454 343(1))(34) 11(343) = 454(34) 45(343)

Equation (1.4a) is just (1.3c) rearranged so that the gcd is on the left. We successively solve for and substitute the remainders in (1.3c)-(1.3a) (working backwards) to obtain (1.4a)-(1.4c). Specically, solving (1.3b) for 10 (the remainder) and substituting into (1.4a) gives (1.4b). Solving (1.3a) for 111 and substituting into (1.4b) gives (1.4c), which implies that if a = 343 and b = 454, then x = 45 and y = 34.

Example 1.7: Heres another example. Using the Euclidean algorithm to nd gcd(233, 97), we have (1.5a) (1.5b) (1.5c) 233 = 97(2) + 39 = 39 = 233 97(2) 97 = 39(2) + 19 = 19 = 97 39(2) 39 = 19(2) + 1 = 1 = 39 19(2).

Note that we have solved for the remainders in addition to nding the gcd. Working backwards, we begin with (1.5c) and substitute the remainders in ascending order. We simplify at each step, being careful not to explicitly multiply the remainders or the original two numbers. (1.6a) (1.6b) (1.6c) (1.6d) (1.6e) 1 = 39 19(2) (from (1.5c)) = 39 (97 39(2))(2) (substituting the remainder from (1.5b)) = 39(5) 97(2) (simplifying (1.6b)) = (233 97(2))(5) 97(2) (substituting the remainder from (1.5a)) = 233(5) 97(12) (simplifying (1.6d)).

1.6. MODULAR ARITHMETIC

15

If a = 233 and b = 77, then x = 5 and b = 12 satisfy a x + b y = gcd(a, b). Classroom Exercise 1.3: Use the extended Euclidean algorithm to nd values for x and y according to Theorem 1.2 for the following gcds. (1) gcd(24, 54) (2) gcd(33, 192) (3) gcd(756, 942) 1.5. Relatively Prime Numbers Denition 1.2: Two integers a and b are relatively prime2 if gcd(a, b) = 1. Note that a number doesnt need to be prime to be relatively prime to another number, and prime numbers are not relatively prime to every other positive integer. Consider the following examples. Example 1.8: Neither 14 nor 25 is prime, but they are relatively prime since gcd(14, 25) = 1. Example 1.9: Integers 14 and 16 are both composite and they are not relatively prime to each other since gcd(14, 16) = 2. Example 1.10: Although 13 is prime, it is not relatively prime to 39 since gcd(13, 39) = 13. Example 1.11: Two distinct prime numbers like 13 and 17 are relatively prime. Classroom Exercise 1.4: Determine which of the following pairs of numbers are relatively prime. (1) 26 and 15 (2) 54 and 99 (3) 234 and 555 1.6. Modular Arithmetic We learn to do arithmetic (addition, subtraction, multiplication, and division) with integers early in grade school, and later we learn about real numbers, usually starting with fractions and then proceeding to decimals. In cryptology, we will usually work only with integers modulo some positive integer n. Our task in this section is to gure out what that means. Denition 1.3: Integers a and b are congruent modulo n if n|(a b). If two numbers are congruent modulo n, then we write a b mod n. Example 1.12: Here are some examples. (1) 7 7 mod 21 since 21|(7 7). (2) 14 2 mod 3 since 3|(14 2). (3) 2 12 mod 5 since 5|(2 12).

2Many authors refer to relatively prime numbers as coprime.

16

1. MODULAR ARITHMETIC

We usually reduce integers to the set {0, 1, 2, . . . , n 1} modulo n,3 so, for example, it would be more common to write 12 2 mod 5 than 2 12 mod 5, even though both are correct. We have two main ways to reduce a mod n. If a 0, then we can replace a with its remainder when it is divided by n. Continuing Example 1.12, 7 7 mod 21 since 7 21 = 0 with remainder 7 and 14 2 mod 3 since 14 3 = 4 with remainder 2. We can add or subtract multiple copies of n since n 0 mod n, which is especially helpful for a < 0. For example, 7 3 mod 5 since 7 + 2(5) 3 mod 5. The following table shows integers x reduced modulo 5 to the set {0, 1, 2, 3, 4}. . . . 7 6 5 4 3 2 1 0 1 2 3 4 5 6 7 8 9 10 11 12 . . . x x mod 5 . . . 3 4 0 1 2 3 4 0 1 2 3 4 0 1 2 3 4 0 1 2 ... Classroom Exercise 1.5: Reduce the following numbers modulo 16 to the set {0, 1, 2, . . . , 15}. (1) 27 (2) 544 (3) 32 Addition, subtraction, and multiplication modulo n all work exactly as you would expect. You are free to make the calculations as simple as you can by reducing operands modulo n at any time as shown in Example 1.13. One thing you may not do, however, is change powers. For example, 619 is not congruent to 61 mod 20. Example 1.13: Reduce the following modulo 25. (1) 6 + 7(4) = 34 9 mod 25. In this case, we waited until the calculation was completed to reduce it modulo 25. (2) 26 + 27(14) 1 + 2(14) = 29 4 mod 25. Here, we began by reducing 26 and 27, did the calculation, and then reduced the answer. (3) Dont hesitate to use negative numbers if its convenient. For instance, 24+27(20) 1+2(5) = 11 = 11 + 0 11 + 25 = 14 mod 25.

Classroom Exercise 1.6: Reduce the following modulo 32. (1) 3(15) 4(2) (2) 30(29)(27) 1(2)(3) (3) 9 3(4) 62 + 20

3This is what the % operator does in C/C++ and what the Mod and mod commands do in Mathematica and Matlab, respectively.

1.6. MODULAR ARITHMETIC

17

Here are addition and multiplication tables modulo 9. + 0 1 2 3 4 5 6 7 8 0 0 1 2 3 4 5 6 7 8 1 1 2 3 4 5 6 7 8 0 2 2 3 4 5 6 7 8 0 1 3 3 4 5 6 7 8 0 1 2 4 4 5 6 7 8 0 1 2 3 5 5 6 7 8 0 1 2 3 4 6 6 7 8 0 1 2 3 4 5 7 7 8 0 1 2 3 4 5 6 8 8 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 8 0 0 0 0 0 0 0 0 0 0 1 0 1 2 3 4 5 6 7 8 2 0 2 4 6 8 1 3 5 7 3 0 3 6 0 3 6 0 3 6 4 0 4 8 3 7 2 6 1 5 5 0 5 1 6 2 7 3 8 4 6 0 6 3 0 6 3 0 6 3 7 0 7 5 3 1 8 6 4 2 8 0 8 7 6 5 4 3 2 1

(1.7)

Note that the addition table is more regular or predictable than the multiplication table. Later in this chapter, we will use both addition and multiplication to encrypt messages, and well see that multiplication makes a greater contribution to the strength of the encryption algorithm. Classroom Exercise 1.7: Complete the following addition and multiplication tables modulo 6. + 0 1 2 3 4 5 0 1 2 3 4 5 0 1 2 3 4 5 0 1 2 3 4 5

Division. We havent mentioned modular division yet because it is much more difcult. Before we do so, lets think about the real number division were much more familiar with. To compute 156 13, we might ask ourselves, What number a, when multiplied by 13, gives 156?" A little thought reveals that a = 12. We can also think of division as multiplication by a multiplicative inverse (or reciprocal), so 1 156 13 = 156 = 12. Remember that all real numbers have multiplicative inverses except for zero. 13 Its not immediately obvious what 4/5 mod 9 is since 4/5 is not an integer. To make sense of 4/5 mod 9, we need to ask ourselves the same basic question we did above - What number a, when multiplied by 5, gives 4 modulo 9?" In other words, we need to solve the congruence 5a 4 mod 9. Because the modulus is small, we could nd a by trial and error or by looking in the multiplication table in (1.7)to see that 5 8 4 mod 9, so we could say that 4/5 8 mod 9. However, division is not always well-dened. For instance, if we tried to compute 5/3 mod 9, we would fail because the table in (1.7) shows that there is no number which, when multiplied by by 3, gives 5 mod 9. Because of this, mathematicians dont like to talk about division at all in the context of modular arithmetic. Instead, we talk about multiplicative inverses, but we have to be aware that some numbers may not be invertible modulo n. As you can see from (1.7), 11 = 1, 21 = 5, 41 = 7, 51 = 2, 71 = 4, and 81 = 8 mod 9, but 3 and 6 do not have multiplicative inverses. Whats special about 3 and 6? The rows (or columns) for 3 and 6 in (1.7) contain only multiples of 3. Why is that the case? Heres why. If a {0, 1, 2, . . . , n 1}, then gcd(a, n) divides any integer multiple of a as well as any number that is congruent to a modulo n. Continuing our example, let a = 5 and n = 9. Clearly, gcd(5, 9) = 1 divides every integer multiple of 5. Likewise, if a = 3, then gcd(3, 9) = 3 divides every integer multiple of 3, so 1 cannot be a multiple of 3, which means that 3 is not invertible. The same is true

18

1. MODULAR ARITHMETIC

for 6. So, in general, a number a is not invertible modulo n if gcd(a, n) = 1. Does that mean that all other numbers are invertible? Well, yes, but its not obvious. THEOREM 1.3. If gcd(a, n) = 1, then the set {a mod n, 2a mod n, . . . , (n 1)a mod n} has all distinct values.

PROOF. We prove this theorem by contradiction. Suppose that some pair of values in {a mod n, 2a mod n, . . . , (n 1)a mod n} are the same. More precisely, suppose that there exist integers x and y {1, 2, . . . , n 1} such that x = y and that x a y a mod n. Then n|a(x y), and since gcd(a, n) = 1, it must be that n|(x y). Since x, y {1, 2, . . . , n 1}, we conclude that x = y, which is a contradiction. Since the set {a mod n, 2a mod n, . . . , (n 1)a mod n} has n distinct values, those values are congruent to {1, 2, . . . , n 1} in some order. Therefore, in summary, if gcd(x, n) = 1, then x is invertible modulo n and if gcd(x, n) = 1, then x is not invertible modulo n. Example 1.14: It is helpful to look at another example. Here is a multiplication table modulo 20.
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 2 0 2 4 6 8 10 12 14 16 18 0 2 4 6 8 10 12 14 16 18 3 0 3 6 9 12 15 18 1 4 7 10 13 16 19 2 5 8 11 14 17 4 0 4 8 12 16 0 4 8 12 16 0 4 8 12 16 0 4 8 12 16 5 0 5 10 15 0 5 10 15 0 5 10 15 0 5 10 15 0 5 10 15 6 0 6 12 18 4 10 16 2 8 14 0 6 12 18 4 10 16 2 8 14 7 0 7 14 1 8 15 2 9 16 3 10 17 4 11 18 5 12 19 6 13 8 0 8 16 4 12 0 8 16 4 12 0 8 16 4 12 0 8 16 4 12 9 0 9 18 7 16 5 14 3 12 1 10 19 8 17 6 15 4 13 2 11 10 0 10 0 10 0 10 0 10 0 10 0 10 0 10 0 10 0 10 0 10 11 0 11 2 13 4 15 6 17 8 19 10 1 12 3 14 5 16 7 18 9 12 0 12 4 16 8 0 12 4 16 8 0 12 4 16 8 0 12 4 16 8 13 0 13 6 19 12 5 18 11 4 17 10 3 16 9 2 15 8 1 14 7 14 0 14 8 2 16 10 4 18 12 6 0 14 8 2 16 10 4 18 12 6 15 0 15 10 5 0 15 10 5 0 15 10 5 0 15 10 5 0 15 10 5 16 0 16 12 8 4 0 16 12 8 4 0 16 12 8 4 0 16 12 8 4 17 0 17 14 11 8 5 2 19 16 13 10 7 4 1 18 15 12 9 6 3 18 0 18 16 14 12 10 8 6 4 2 0 18 16 14 12 10 8 6 4 2 19 0 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

(1.8)

Which numbers are invertible? That is, which numbers have a 1 in their respective rows (or columns)? The invertible integers modulo 20 are 1, 3, 7, 9, 11, 13, 17, and 19, which leaves out all even integers and multiples of 5 since 20 = 22 5. Also, note that the invertible numbers have every integer from 0 to 19 in their rows (or columns), whereas non-invertible numbers do not. Now that we know which integers are invertible modulo n, wed like to have a systematic way of nding inverses. Tables are nice for small moduli, but are unwieldy for large ones. Fortunately, the extended Euclidean algorithm gives us a nice algorithm for computing inverses. Recall that if gcd(a, n) = 1, then there exists integers x and y such that (1.9) a x + n y = 1,

1.7. SOLVING LINEAR CONGRUENCES

19

and we can nd x and y using the extended Euclidean algorithm. Reducing (1.9) modulo n gives (1.10) which implies that x = a
1

a x 1 mod n, .

Example 1.15: To nd 171 mod 20, we use the extended Euclidean algorithm. 20 = 17 1 + 3 17 = 3 5 + 2 3=21+1 Technically, we should go one step further to get a remainder of zero, but we know that the gcd is 1, so there is no practical need to continue. Working backward, 1=32 = 6 3 17 = 6 20 7(17). This implies that 17(7) 1 mod 20, so 171 = 7 13 mod 20. You can check this in the multiplication table in (1.8). Example 1.16: To nd 3431 mod 454, we can use the work we did in Example 1.6. Recall that we found that 1 = 454(34) 45(343). Reducing modulo 454 gives 1 45(343), so 3431 = 45 409 mod 454. You can check this with a calculator by multiplying 343 by 409 to get 140, 287. To reduce modulo 454, we divide 140, 287 by 454 to get 309.002. That tells us that 454 goes into 140, 287 309 times. Subtracting, we nd 140, 287 454(309) = 1, so we know that our answer is correct. Classroom Exercise 1.8: Find the following multiplicative inverses. (1) 41 mod 15 (2) 151 mod 49 (3) 811 mod 145 1.7. Solving Linear Congruences Linear Congruences of the Form a x b mod n. Over the real numbers, the equation (1.11) ax = b

has the unique solution x = b/a if a = 0. If a = 0 and b = 0, then there are no solutions, and if a = 0 and b = 0, then there are innitely many solutions because x can have any real value. Similarly, a congruence like (1.12) a x b mod n

may have a unique solution in {0, 1, 2, . . . , n 1}, no solution, or multiple solutions in {0, 1, 2, . . . , n 1}. Lets illustrate with a few examples. Example 1.17: (1) 6x 12 mod 13 has the unique solution x = 2. (2) 6x 12 mod 24 has six solutions x = 2, 6, 10, 14, 18, 22. (3) 6x 11 mod 12 has no solution.

20

1. MODULAR ARITHMETIC

Our goal in this section is to nd all solutions, if any, of congruences like (1.12). If a x b mod n has a solution, then there exists an integer m such that (1.13) mn = a x b.

The gcd(a, n) clearly divides the rst two terms, mn and a x, in (1.13), so it also must also divide b. Recall that all multiples of a modulo n are multiples of gcd(a, n), so b must be a multiple of gcd(a, n) for (1.12) to have a solution. For example, in (1.8), all multiples of 15 modulo 20 are 0, 5, 10 and 15, so a congruence of the form 15x = b mod 20 only has solutions if b = 0, 5, 10, or 15. Lets assume that gcd(a, n)|b so that at least one solution exists. Note that this is trivially true if a and n are relatively prime. How do we nd a solution? Sometimes you can nd a solution simply by looking at the congruence. For instance, it is pretty clear that x = 2 solves 6x 12 mod 13. The fancy way of saying this is that x = 2 is a solution by inspection". When we cant nd a solution by inspection, we can use the extended Euclidean algorithm. Lets look at an example. Example 1.18 (Unique Solution): To solve 17x 4 mod 20, we begin with the extended Euclidean algorithm. 20 = 17 1 + 3 17 = 3 5 + 2 3=21+1 Working backwards, 1=32 = 3 6 17 = 20 6 17 7. Therefore, 17(7) 1 mod 20. Multiplying both sides by 4 gives 17(7 4) 4 mod 20 and x = 7 4 = 28 12 mod 20. Since gcd(17, 20) = 1, x = 12 is the only solution. If a congruence has multiple solutions, how do we nd all of them? We begin by nding one solution using the extended Euclidean algorithm (or inspection). If solution(s) exist, then gcd(a, n)|b and there exists an integer m such that a x = b + nm. Dividing by gcd(a, n) gives a gcd(a, n) so (1.14) a gcd(a, n) x b gcd(a, n) mod n gcd(a, n) . x= b gcd(a, n) + n gcd(a, n) m,

This congruence (1.14) has a unique solution since gcd a gcd(a, n) gcd(a, n) , n = 1.

Therefore, once one solution of a x b mod n is found, all other solutions in {0, 1, 2, . . . , n 1} can be found by adding (or subtracting) integer multiples of n/ gcd(a, n) for a total of gcd(a, n) incongruent solutions.

1.7. SOLVING LINEAR CONGRUENCES

21

Example 1.19 (Multiple Solutions): Solve 14x 4 mod 20. Since gcd(14, 20) = 2 and 2|4, this congruence has two solutions. Lets use extended Euclidean algorithm to nd one of them. 20 = 14 1 + 6 14 = 6 2 + 2 6=32 Working backwards again, 2 = 14 6 2 = 14 3 20 2 Therefore, 14(3) 2 mod 20. Multiplying both sides by 2 gives 14(3 2) 4 mod 20 and x = 6. Since gcd(14, 20) = 2, there is a second solution that we obtain by adding n/ gcd(a, n) = 20/2 = 10 to x = 6. Therefore, the two solutions in {0, 1, 2, . . . , 19} are x = 6 and x = 16. Another way to view this example is to return to the multiplication table in (1.8) and note that each row (or column) cycles through multiples of the appropriate gcd. In the case of 14, the multiples cycle through 0, 14, 8, 2, 16, 10, 18, 12, 6 twice, so the two solutions must be 10 apart. Example 1.20 (No Solution): The congruence 14x 5 mod 20 has no solution since gcd(14, 20) = 2 | 5. Example 1.21: To solve 2x 4 7 mod 13, simply add 4 to both sides and proceed as above to nd x = 12. In summary, you can always tell if a x b mod n has a solution by determining if gcd(a, n) divides b. If not, then there is no solution. If gcd(a, n) does divide b, then the number of solutions is equal to gcd(a, n) and the solutions are n/ gcd(a, n) apart. For instance, x = 1 is clearly a solution of 13x = 13 mod 39. Since gcd(13, 39) = 13, there are a total of 13 solutions in {0, 1, 2, . . . , 38} and they are separated by 39/13 = 3, so the complete set of solutions is x = 1, 4, 7, 10, 13, 16, 19, 22, 25, 28, 31, 34, 37. Classroom Exercise 1.9: Find all solutions, if any, of the following congruences. (1) 18x = 3 mod 31 (2) 18x = 16 mod 30 (3) 18x 24 mod 30 Linear Systems of Congruences. Lets conne our attention to systems of congruences in two variables because this is sufcient for our cryptologic needs later in the chapter. If a, b, c, d, e, f {0, 1, . . . , (n 1)}, then our goal is to solve ax + b y e mod n cx + d y f for x and y, if possible. Standard algebraic manipulations reduce the system to the pair of congruences4 (1.15) (ad bc)x ed b f (ad bc) y a f ce mod n.

For solutions to exist, gcd(adbc, n) must divide both (edb f ) and (a f ce). In practice however, we dont recommend memorizing (1.15). Instead, just use the familiar methods of substitution and elimination from high school algebra. Be aware, however, that you have to be careful about both multiplying and dividing.
4These may look familiar if you have seen Cramers rule before.

22

1. MODULAR ARITHMETIC

Division is obviously a problem since it isnt properly dened, but multiplication can also cause trouble because multiplying equations by constants can lead to spurious solutions. For example, the congruence 3x 3 mod 8 has the unique solution x = 1. However, multiplying both sides by 2 gives 6x 6 mod 8, which has two solutions, x = 1 and x = 5, the second of which is spurious. If you can, try to only multiply by integers that are relatively prime to the modulus. If you cant help it, be sure to check your solutions in the original congruences. Example 1.22 (Substitution): Some systems make the method of substitution attractive. For example, 3x + 2 y 0 x 3y 2 mod 7

suggests solving the second equation for x and substituting into the rst to nd 3(3 y + 2) + 2 y = 0, which reduces to 4 y = 1 mod 7. The extended Euclidean algorithm then implies that y = 2 and, consequently, x = 1. Example 1.23 (Elimination): In this example, we might choose to use elimination. 3x + 2 y 0 2x 3 y 2 mod 7

We could solve either congruence for x or y since all coefcients are relatively prime to the modulus, but that isnt particularly appealing. Instead, lets multiply the rst equation by 2 and the second by 3 to nd 6x + 4 y 0 6x 9 y 6 or, equivalently, 6x + 4 y 0 6x + 5 y 6 mod 7.

Multiplying the congruences by 2 and 3 is OK here because both constants are relatively prime to the modulus. Subtracting the rst congruence from the second gives y = 6 and substituting into 6x + 4 y = 0 implies that x = 4 y 3 mod 7. Example 1.24 (Multiple Solutions): We might choose to solve this system 12x + y 13 4x 3 y 7 mod 26

by multiplying the second congruence by 3 and subtracting to nd 10 y 8 mod 26, which has two solutions since gcd(10, 26)| 8. Using the extended Euclidean algorithm, we nd that y = 7 and y = 20. Plugging these values back into the second congruence gives 4x 2 mod 26 and 4x 15 mod 26. The former has two solutions, x = 7 and x = 20, but the second has no solutions. Overall, we have two solutions: (7, 7) and (20, 7). An alternative way to solve this problem is to solve the rst congruence for y 13 12x and substitute into the second to nd 14x 20 mod 26, which gives x = 7 and x = 20. Both values of x give y = 7. Example 1.25 (Spurious Solutions): As a nal example, consider 12x + 2 y 14 3x 3 y 8 mod 26.

Multiplying the second congruence by 4 and subtracting it from the rst gives 14 y 8 mod 26, which has two solutions y = 8 and y = 21. Plugging these values back into the rst congruence gives 12x 24

1.8. ADDITIVE CIPHER

23

mod 26 for both y = 8 and y = 21. The solutions for x are obviously x = 2 and x = 15, so, overall, we have four putative solutions (2, 8), (2, 21), (15, 8), and (15, 21).

However, since we multiplied by 4, which is not relatively prime to the modulus, we suspect spurious solutions. Plugging all four solutions back into the original system shows that only (2, 8) and (15, 21) are solutions of the original problem. Note that it would have been more efcient to solve for x using the second congruence because 3 is relatively prime to 26, so no spurious solutions are produced in that case. Remark 1.1: If the idea of spurious solutions is disconcerting to you, please recall that you have seen this before in regular algebra" over the reals when you multiply both sides of an equation by zero or when you square both sides of an equation. For example, multiplying both sides of the incorrect equation 3 = 4 by zero gives 0 = 0, which is correct. Likewise, squaring both sides of 3 = 3 gives 9 = 9. More realistically, to solve (1.16) 1 (x 6)(x 2) + 1 (x + 2)(x 2) = x +4 (x 6)(x + 2) ,

we might multiply by sides of the equation by (x 2)(x + 2)(x 6) to clear the fractions. This gives (x + 2) + (x 6) = (x + 4)(x 2), which simplies to x 2 = 4. So the solutions of (1.16) are x = 2, right? Wrong. Equation (1.16) has no solutions. When we multiplied by (x 2)(x + 2)(x 6), we were effectively multiplying by zero if x = 2, and that introduced the false solutions. Similarly, if we square both sides of (1.17) 1 x x 2 = 1,

and cross multiply, we obtain 1 x = x 2, which implies that x = 3/2. However, (1.17) has no real solutions since the numerator of the expression on the left implies that x 1 and the denominator implies that x > 2, and there are no such values of x.5 1.8. Additive Cipher One of the earliest known ciphers is the Caesar cipher. Suetonius [12] claims that Julius Caesar used a simple shift cipher to encrypt private messages in letters to Cicero and other friends. He simply replaced each a by d, b by e, etc..., wrapping around at the end of the alphabet so each x is replaced by an a, y by b, and z by c. The following chart makes it easier to implement the Caesar cipher.

For example, the message mathisreallyfun is encrypted as pdwklvuhdoobixq. Anyone except the intended recipient would only see gibberish and would not know that mathisreallyfun. Note that
5This has nothing to do with cryptology, but if you want to see something really interesting, try to solve (1.17) by graphing

y=

1 x x 2

and y = 1 on your calculator and looking for the intersection of the two graphs. What do you nd?

24

1. MODULAR ARITHMETIC

this example uses the standard (modern) English alphabet, with no spaces, capital letters, or punctuation. We could accomodate spaces, capitals, punctuation, digits, and any other symbols that we choose, but well stick with the 26-letter alphabet for simplicity. Recall that we refer to the original message mathisreallyfun as plaintext and the encrypted message pdwklvuhdoobixq as ciphertext. We can make the implementation of the Caesar cipher more efcient and computer-ready by making the cipher mathematical. We can do this simply by associating a with 0, b with 1, ..., and z with 25 as shown in the following chart.6

a b c d e f g h i j

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 Now the plaintext mathisreallyfun and ciphertext pdwklvuhdoobixq can be regarded as sequences of integers pi and ci
15 i=1 15 i=1

= {12, 0, 19, 7, 8, 18, 17, 4, 0, 11, 11, 24, 5, 20, 13},

= {15, 3, 22, 10, 11, 21, 20, 7, 3, 14, 14, 1, 8, 23, 16}.

The cipher characters can be obtained mathematically from the formula (1.18) ci = pi + 3 mod 26, i = 1, 2, . . . , 15,

and the plaintext can likewise be found by solving (1.18) for pi , (1.19) pi = ci 3 mod 26, i = 1, 2, . . . , 15.

Note that we need to work modulo 26 because we have a 26-letter alphabet. For example, the plaintext y (a.k.a. 24) is encrypted to b (a.k.a 24 + 3 = 27 1 mod 26). The additive cipher is just like the Caesar cipher, except that the shift doesnt have to be 3. If we stick with a 26-letter alphabet, then the shift, lets call it k (for key), can, in principle, be any integer between 0 and 25, inclusive. Then, (1.18) becomes (1.20) ci = pi + k mod 26.

If k = 0, then ci = pi , so we really should take k {1, 2, . . . , 25}. The modulus 26 is the length of the alphabet, so if you change the alphabet by adding or deleting characters, then you simply change 26 to the appropriate value. Example 1.26: Suppose that the plaintext is thequickbrownfoxjumpsoverthelazydog and k = 4. Each plaintext letter is encrypted by adding 4 modulo to it according to the encryption equation (1.20). The rst plaintext letter t has a numerical value of 19, and adding four to it makes it 23, which is x. The next letter h corresponds to 7, which becomes 11 or l. Repeating this for the entire message turns thequickbrownfoxjumpsoverthelazydog into xliuymgofvsarjsbnyqtwszivxlipedchsk. The rest of the details are shown in the following table.
Plaintext t h e Coded plain 19 7 4 Coded cipher 23 11 8 Ciphertext x l i
6

q u i c k b r o w n f o x j u m p s o v e r t h e l a z y d o g
16 20 8 2 10 1 17 14 22 13 5 14 23 9 20 12 15 18 14 21 4 17 19 7 4 11 0 25 24 3 14 6 20 24 12 6 14 5 21 18 0 17 9 18 1 13 24 16 19 22 18 25 8 21 23 11 8 15 4 3 2 7 18 10

u y m g o f v s a r j s b n y q t w s z i v x l i p e d c h s k

Some authors associate a with 1, b with 2, ..., and z with 26, but our way is more convenient.

1.9. CRYPTANALYSIS OF THE ADDITIVE CIPHER

25

k 0 1 2 3 4 5 6 7 8 9 10 11 12

teefxgurgtmnkxwxlbkxmhdghp sddewftqfslmjwvwkajwlgcfgo rccdvesperklivuvjzivkfbefn qbbcudrodqjkhutuiyhujeadem paabtcqncpijgtsthxgtidzcdl ozzasbpmbohifsrsgwfshcybck nyyzraolangherqrfvergbxabj mxxyqznkzmfgdqpqeudqfawzai lwwxpymjylefcpopdtcpezvyzh kvvwoxlixkdebonocsbodyuxyg juuvnwkhwjcdanmnbrancxtwxf ittumvjgvibczmlmaqzmbwsvwe hsstluifuhabylklzpylavruvd

Putative Plaintext

k 13 14 15 16 17 18 19 20 21 22 23 24 25

grrskthetgzaxkjkyoxkzuqtuc fqqrjsgdsfyzwjijxnwjytpstb eppqirfcrexyvihiwmvixsorsa doophqebqdwxuhghvluhwrnqrz cnnogpdapcvwtgfguktgvqmpqy bmmnfoczobuvsfeftjsfuplopx allmenbynaturedesiretoknow zkkldmaxmzstqdcdrhqdsnjmnv yjjkclzwlyrspcbcqgpcrmilmu xiijbkyvkxqrobabpfobqlhklt whhiajxujwpqnazaoenapkgjks vgghziwtivopmzyzndmzojfijr uffgyhvshunolyxymclyniehiq

Putative Plaintext

Table 1.1: Exhaustive cryptanalysis of the additive ciphertext teefxgurgtmnkxwxlbkxmhdghp. Clearly, k = 19 is the correct key.

Classroom Exercise 1.10: Use the Caesar cipher to encrypt theworldisabookandthosewhodonottravel readonlyapage.7 Classroom Exercise 1.11: Decrypt the additive ciphertext mnudpuzftqtmzpueiadftfiauzftqnget with k = 12. 1.9. Cryptanalysis of the Additive Cipher Recall that cryptanalysis involves reading enciphered messages without knowing the key. Since the additive cipher has a single key k that can only take on 26 1 = 25 different values, modern computers can easily be programmed to nd the correct key simply by exhaustively trying all 25 values for k. Suppose, for example, that we intercept the message teefxgurgtmnkxwxlbkxmhdghp. We can just try all values for k as shown in Table 1.1. There is no mistaking k = 19 as the correct key and the message as a pearl of wisdom from Aristotle. The method of exhaustion is not very interesting and it does not prepare us to study more complicated ciphers for which exhaustion is not an option. Frequency analysis, in contrast, provides a more fruitful approach to cryptanalyzing additive cipher. Each letter or character in a language tends to occur with a certain frequency. For example, the letter e is the most common letter in the English alphabet, appearing approximately 12% of the time, while j, q, x, and z are much less common, occurring about about 0.1% of the time. A bar chart of letter frequencies can be found in Figure 1.1 and the corresponding numerical frequencies are shown in Table 1.2. Knowing these frequencies greatly enhances our ability to cryptanalyze ciphertext because, for example, every e in the plaintext is encrypted to the same ciphertext character, so that character should appear approximately 12% of the time in the cipher. For example, the additive ciphertext with k = 18 for theeaglesaregreat is lzwwsydwksjwyjwsl and every plaintext e is encrypted as a w. You might ask how reliable the letter frequencies in Figure 1.1 really are, so lets look at some examples. Figure 1.2 shows a stacked bar chart that shows the frequencies of the letters in The Gold Bug", the 2006 State of the Union Address, Julius Caesar", and the USA Patriot Act". These are four very different texts,
7

St. Augustine

26

1. MODULAR ARITHMETIC

Figure 1.1: Frequencies of letters in the English language. See Table 1.2 for numerical values.

Relative Letter Frequency a 0.082 0.014 b c 0.025 d 0.046 e 0.124 0.022 f g 0.020 h 0.065 i 0.069 j 0.001 0.008 k l 0.039 m 0.024

Relative Letter Frequency n 0.073 o 0.076 p 0.018 q 0.001 r 0.059 s 0.065 t 0.089 u 0.026 v 0.011 w 0.023 x 0.002 y 0.018 z 0.001

Table 1.2: Table of letter frequencies based on War and Peace and several articles from The Washington Post.

Figure 1.2: Cumulative frequencies of the letters (in ascending order) in Edgar Allan Poes The Gold Bug", George W. Bushs 2006 State of the Union Address, William Shakespeares Julius Caesar", and the USA Patriot Act".

but, for the most part, each reveals approximately the same distribution of letters. Minor differences are apparent, such as an unusual abundance of the letter u Julius Caesar", but that is to be expected with all of the Latin names that end in us (e.g. Julius, Brutus, Cassius, etc...).

1.11. CRYPTANALYSIS OF THE AFFINE CIPHER

27

Lets try some cryptanalysis based on letter frequencies. Given the ciphertext vjgggtkggngrjcpvgcvu giiu, we see that g occurs most frequently (8 times), so it most likely corresponds to a plaintext e. If that is correct, then k must be 2. If we try decrypting the entire message with k = 2, we nd the putative plaintext theeerieelephanteatseggs, so we are condent that we have successfully recovered the original message. Note that in any given text, e may not be the most common letter. The most common letter in laeljawvlwsuzafylsqfsljauckgfzwjlgqtacw is l, which corresponds to k = 7. However, decrypting with k = 7 gives the clearly incorrect plaintext etxectpoeplnstyreljylectnvdzyspcezjmtvp. Next, we might try associating l with the second most common letter t. This suggests that k = 18 and we obtain the original message timtriedteachingtaynatricksonhertoybike. Please note that some problems may involve considerable trial and error, but letter frequencies do give us a sensible method. A visually appealing alternative is to use a visual cryptanalysis in software like Mathematica. See CryptanalyzeAdditiveCipher.nb at http://users.etown.edu/m/mcdevittt/Crypto.html. 1.10. Afne Cipher Recall the addition and multiplication tables in (1.7) show that patterns are more readily evident in modular addition than in multiplication. Therefore, if we incorporate multiplication into the cipher, then we might be able to improve the additive cipher. The equation for the i th ciphertext characters for the afne cipher8 (1.21) ci = mpi + k mod 26.

Again, if the length of the alphabet changes, then you have to change the value of the modulus accordingly. Plaintext can be recovered from ciphertext using (1.22) pi = m1 ci k mod 26,

provided that m1 exists. How large is the key space for the afne cipher? The additive constant k can take on 26 different values, but m has to be invertible modulo 26, so it has to be relatively prime to 26. Specically, m {1, 3, 5, 7, 9, 11, 15, 17, 19, 21, 23, 25}, so there are only 12 possible values for m. Therefore, there are 26(12)1 = 311 possible key pairs for the afne cipher. (We subtract one because m = 1 and k = 0 doesnt change the plaintext! In that case, ci = pi .) Example 1.27: Lets encrypt timwrotetomsaddressontheenvelope with m = 7 and k = 4. Since the rst letter is t, p1 = 19 and c1 = 7(19) + 4 7 mod 26, so the rst cipher character is h. The remaining letters follow in a similar way to give hikctyhghykaezztgaayrhbggrvgdyfg. Classroom Exercise 1.12: Encrypt potatochipsarebadforyou with m = 17 and k = 24. 1.11. Cryptanalysis of the Afne Cipher Recall that we cryptanalyzed the additive cipher using letter frequencies. We will do the same with the afne cipher, except that we will have to solve a system of congruences because there are two key parameters, m and k. Lets look at an example for which we know the answer.
8The graph of f (x) = mx + b is a line, but mathematicians do not call f a linear function unless b = 0. Instead, we call f an afne function. That is where the name of the cipher comes from.

28

1. MODULAR ARITHMETIC

Example 1.28: Lets start with the ciphertext in Example 1.27, hikctyhghykaezztgaayrhbggrvgdyfg, and pretend that we dont know m and k. The most common letters are g and h, which appear six and four times, respectively. This suggests that the ciphertext g and h correspond to plaintext e and t. Since g and h are encoded as 6 and 7 and since e and t are encoded as 4 and 19, we have the pair of congruences 4m + k 6 19m + k 7 mod 26.

Solving the system gives m = 7 and k = 4, which, in turn, give the plaintext timwrotetomsaddresson theenvelope. Recall that e and t are usually the most common letters in English, and the longer a sample text is, the more likely that is to be the case. However, e and t are not always the most common, especially in short messages. Cases like that may require signicant trial and error to nd a suitable pair of congruences. Lets look at another example, but unlike Example 1.28, this time we do not know the answer in advance. Example 1.29: The most common letters in the ciphertext xwvmwixwomclybyvunyuyxcrmikyapmjmzop yssncrkyazmeyppcemr are y and m. Associating these with e and t gives 4m + k 24 19m + k 12 mod 26

and m = 20 and k = 22. However, these arent correct since m = 20 is not relatively prime to 26. Repeated trial and error eventually leads us to associate ciphertext y and m with plaintext o and e, respectively, which gives 4m + k 12 mod 26. 14m + k 24 Subtracting the rst congruence from the second gives 10m = 12 mod 26. Since gcd(10, 26) = 2|12, there are two solutions, m = 9, k = 2 and m = 22, k = 2. Since 22 is not relatively prime to 26, the latter solution cannot be correct. Decrypting m = 9 and k = 2 gives lifeislikeaboxofchocolatesyounever knowwhatyouregonnaget9. Counting letter frequencies by hand can be very tedious, so mathematical packages like Mathematica and Maple can be very helpful. However, if you dont have one of those packages or you dont want to learn one, then just use ECrypt. Exercises (1) Factor the following integers as a product of (powers of) primes. (a) 278 (b) 359 (c) 126 (d) 469 (e) 388 (2) Find the smallest integer x > 0 that makes each of the following perfect squares. (a) 23 32 5 x (b) 210 32 52 76 x (c) 123 252 7 x
9The one and only Forrest Gump.

EXERCISES 2

29

(3)

(4)

(5)

(6)

(d) 123 252 7 x Suppose that we say that 56000 ends in 3 zeros. How many zeros are there at the end of each of these numbers? 2 (a) 123 252 7 (b) 10! = 10 9 8 7 6 5 4 3 2 1 (c) 100! 50 50! (d) = 25 25!(50 25)! Find the following gcds and identify which pairs of integers are relatively prime. (a) gcd(261, 231) (b) gcd(317, 375) (c) gcd(297, 431) (d) gcd(418, 278) (e) gcd(272, 391) Find integers x and y such that a x + b y = gcd(a, b) for each of the following. (a) a = 95, b = 298 (b) a = 462, b = 424 (c) a = 195, b = 468 (d) a = 324, b = 122 (e) a = 387, b = 108 For positive integers m and n, lcm(a, b) is the least common multiple of m and n. Show that lcm(m, n) = gcd(m, n) mn .

(7) Reduce the following. (a) 154 mod 45 (b) 171 mod 42 (c) 57 mod 20 (d) 111 mod 42 (e) 159 mod 33 (f) 22 mod 11 (g) 54 mod 26 (h) 38 mod 10 (i) 69 mod 23 (j) 100 mod 24 (8) Calculate the following. (a) 8 + 6 mod 10 (b) 13 3 mod 7 (c) 2 12 + 4 mod 14 (d) 3 5 + 15 mod 17 (e) 18 13 8 27 mod 14 (f) 10 4 19 + 16 mod 11 (g) 9 5 8 + 2 2 mod 10 (h) 6 + 8 5 10 9 mod 11

30

1. MODULAR ARITHMETIC

(9)

(10) (11)

(12)

(i) 5 6 7 3 6 + 4 mod 8 (j) 9 10 7 13 + 4 + 2 mod 16 Find the following multiplicative inverses. (a) 151 mod 38 (b) 291 mod 40 (c) 81 mod 49 (d) 111 mod 15 (e) 71 mod 26 Suppose a, n . Show that the set {a mod n, a +1 mod n, a +2 mod n, . . . , a +(n1) mod n} is a re-arrangement of {0, 1, 2, . . . , (n 1)}. Find all solutions, if any, of the following congruences. (a) 17x = 0 mod 34 (b) 14x = 10 mod 32 (c) 14x = 5 mod 25 (d) 17x = 12 mod 24 (e) 9x = 16 mod 20 (f) 18x = 24 mod 46 (g) 2x = 5 mod 15 (h) 19x = 9 mod 30 (i) 15x = 18 mod 21 (j) 9x = 1 mod 30 (k) 4x = 3 mod 34 (l) 4x = 4 mod 22 The ISBN-10 for An Introduction to Mathematical Finance by Sheldon Ross is 0 521 77043 x, where d10 is an unknown check digit. To nd d10 , we have to solve 0 1 + 5 2 + 2 3 + 1 4 + 7 5 + 7 6 + 0 7 + 4 8 + 3 9 + d10 10 0 mod 11.

Solve for d10 . (13) In the introduction, we learned that if the rst 9 digits in an ISBN-10 d1 d2 d3 d4 d5 d6 d7 d8 d9 d10 are known, then the check digit d10 solves (1.23) d1 + 2d2 + 3d3 + 4d4 + 5d5 + 6d6 + 7d7 + 8d8 + 9d9 + 10d10 0 mod 11, but some authors write that d10 has to solve (1.24) 10d1 + 9d2 + 8d3 + 7d4 + 6d5 + 5d6 + 4d7 + 3d8 + 2d9 + d10 0 mod 11

instead. Show that congruences (1.23) and (1.24) have the same solutions. (14) Find all solutions, if any, of the following systems of congruences. (a) (b) (c) 3x + 7 y 8 5x + 7 y 6 mod 10 mod 18 mod 22

2x + 5 y 16 11x + 11 y 16 6y 1 15x + 22 y 13

EXERCISES

31

(d) (e)

x + y 14 8x + y 6

mod 16

(15)

(16)

(17)

(18)

x + 16 y 8 mod 20 11x + 19 y 11 Encrypt the following with the additive cipher, the standard alphabet (abcdefghijklmnopqrstu vwxyz), and the specied key. For longer messages, you may want to use use ECrypt. (a) go steelers, k = 17 (b) a spoon full of sugar makes the medicine go down, k = 9 (c) the people in philadelphia deserve to have a winner its simple as that, k = 25 Decrypt the following with the additive cipher, the standard alphabet (abcdefghijklmnopqrstu vwxyz), and the specied key. For longer messages, you may want to use use ECrypt. (a) orubkrgsv, k = 6 (b) bpiwtbpixrpxhiwtqthiegdvgpb, k = 15 (c) vuaolmpyzakhfvmjoypzathztfayblsvclzluaavtlhwhyaypknlpuhwlhyayll, k = 7 Encrypt the following with the afne cipher, the standard alphabet (abcdefghijklmnopqrstu vwxyz), and the specied keys. For longer messages, you may want to use use ECrypt. (a) do not erase, m = 19, k = 7 (b) who here believes tim should grow a beard, m = 15, k = 24 (c) mr gorbachev tear down this wall, m = 5, k = 2 Decrypt the following with the afne cipher using the specied keys. For longer messages, you may want to use use ECrypt. (a) efgqzospux, k = 10, m = 9 (b) eperfwddjesgrdzexmredjejmrke, m = 19, k = 6 (c) qredqjyialordiixjxllpdhjnarslwlleylrgfevrwjnirwrgwylrpfvjihliijgrhfbje

dfglyzhdluqialunbpfldizrejeialqrbljqiallryiafarslwllefewruuorypdqjydls leillehlrydregarslelslyylblfslgrehiafevwnipfegelddreglebjnyrvlzleiqyjz hjnqredujjpriialdlvyregzlexafbajqhjnxjnugeibjedfglyfiialafvaufvaijqafd bryllykndiijrddjbfrilxfiaialzqjylslejelgrh, k = 5, m = 17

(19) Cryptanalyze the following additive ciphertext. You should be able to copy and paste the ciphertext into ECrypt (or Mathematica, Maple, etc...). (a) kbktznuamnrgxmkzxgizyulkaxuvkgtjsgteurjgtjlgsuayyzgzkyngbklgrrktuxsgel

grrotzuznkmxovulznkmkyzgvugtjgrrznkujouaygvvgxgzayultgfoxarkckyngrrtuz lrgmuxlgorckyngrrmuutzuznkktjckyngrrlomnzotlxgtikckyngrrlomnzutznkykgy gtjuikgtyckyngrrlomnzcoznmxucotmiutlojktikgtjmxucotmyzxktmznotznkgoxck yngrrjklktjuaxoyrgtjcngzkbkxznkiuyzsgehkckyngrrlomnzutznkhkginkyckyngr rlomnzutznkrgtjotmmxuatjyckyngrrlomnzotznklokrjygtjotznkyzxkkzyckyngrr lomnzotznknorryckyngrrtkbkxyaxxktjkxgtjkbktolcnoinojutuzluxgsusktzhkro kbkznoyoyrgtjuxgrgxmkvgxzulozckxkyahpamgzkjgtjyzgxbotmznktuaxksvoxkhke utjznkykgygxskjgtjmagxjkjheznkhxozoynlrkkzcuarjigxxeutznkyzxammrkatzor otmujymuujzoskznktkccuxrjcozngrrozyvuckxgtjsomnzyzkvyluxznzuznkxkyiakg tjznkrohkxgzoutulznkurj

32

1. MODULAR ARITHMETIC

(b) jbnbmsfbezgbsopsuipgmpoepoboebtjxbmljouiftusffutpgqfufstcvshijgffmbdpm

eopsuifsocsffafqmbzvqponzdiffltxijdicsbdftnzofswftboegjmmtnfxjuiefmjhi uepzpvvoefstuboeuijtgffmjohuijtcsffafxijdiibtusbwfmmfegspnuifsfhjpotup xbsetxijdijbnbewbodjohhjwftnfbgpsfubtufpguiptfjdzdmjnftjotqjsjufeczuij txjoepgqspnjtfnzebzesfbntcfdpnfnpsfgfswfouboewjwjejuszjowbjoupcfqfstvb efeuibuuifqpmfjtuiftfbupggsptuboeeftpmbujpojufwfsqsftfoutjutfmgupnzjnb hjobujpobtuifsfhjpopgcfbvuzboeefmjhiu (c) ivdveufljrdflekfwkzdvkfnrcbkfddpveafpjkyvkirzekfdfiifnkfddptflcukrbvky vkirzerxrzefikrbvkyvkivbspwffk

(20) Cryptanalyze the following afne ciphertext. You should be able to copy and paste the ciphertext into ECrypt (or Mathematica, Maple, etc...). (a) dmdcdilmdskvnbdcomjmkdzqdlmbmlqb (b) gpatqazdqawlpalenqzaslpgunalgenkgffdguqcvanzfgtqecllpqldcqwqangnyehglu

idqqzkqpefzlpquqldclpulerquqfhqtgzqnllpalaffwqnadqidqalqzqmcafgpatqazd qawlpalenqzasenlpqdqzpgffuehyqedygalpquenuehhedwqdufatquanzlpquenuehhe dwqdufatqeknqdukgffrqarfqleuglzeknleyqlpqdallpqlarfqehrdelpqdpeezpatqa zdqawlpalenqzasqtqnlpqulalqehwguuguugvvgaulalqukqflqdgnykglplpqpqalehg nxculgiqukqflqdgnykglplpqpqalehevvdquugenkgffrqldanuhedwqzgnleaneaugue hhdqqzewanzxculgiq (c) vxwszokjwpkvzwotmkjzgjmkvuuvpjaijokhmzdjokhltmbavdrvdjokhptuuijavmjvmj zwokzftotftmkjzgjmbtgjxfoktfazhvxwaztuhiwjzazmasvwbtgjxfvxwowjfezffjfz fpjsvwbtgjokvfjpkvowjfezffzbztmfoxfzmaujzaxfswvdojdeozotvmzmaajutgjwxf swvdjgtuzdjm

(21) Suppose that you double-encrypt some plaintext with the afne cipher. First you encrypt the plaintext with keys m1 and k1 , and then you re-encrypt the ciphertext with keys m2 and k2 . The resulting ciphertext is also afne with keys m3 and k3 . Carefully relate m3 and k3 to m1 , m2 , k1 , and k2 . Does this double afne encryption provide any additional security over regular afne encryption? (22) The Atbash cipher replaces the 1st letter of the alphabet with the last, the 2nd with the second-tolast, etc... Write an equation that mathematically represents the action of the Atbash cipher.

CHAPTER 2

Probability
2.1. Counting Counting is a basic mathematical skill that many American children learn by watching Sesame Street, but we want to extend that skill to count very large quantities that cannot easily be written down. For example, if you roll two standard six-sided dice, you can easily record all possible pairs as shown in Figure 2.1. Clearly, there are 6 possible outcomes for the rst die and 6 possible outcomes for the second die, is different which suggests that there are 6 6 = 36 possible outcome pairs. (Note, for example, that a from a .) This is an example of the fundamental counting rule.

Figure 2.1: All possible outcomes for a pair of regular six-sided dice.

THEOREM 2.1 (Fundamental Counting Rule). If event A can occur m ways and B can occur n ways, then A and B together can occur mn ways. The fundamental counting rule can be extended to more complicated situations. For example, YahtzeeTM requires players to roll 5 dice. How many possible outcomes are there? We certainly dont want to try to list them all, so we try to count without an explicit list of possible outcomes. Since there are six possible outcomes for each die, the number of possible 5-dice rolls is 6 6 6 6 6 = 65 = 7776. Example 2.1: Jake wants an ice cream cone, and he can choose one avor of ice cream (chocolate, vanilla, or strawberry) and one type of cone (sugar or cake). How many possible ice cream cones can he choose from? According to the fundamental counting rule, there are 3 2 = 6 possible ice cream cones. We can also list the outcomes in this case, possibly with the help of a tree plot. strawberry/cake chocolate/cake vanilla/cake strawberry/sugar chocolate/sugar vanilla/sugar,
33

34

2. PROBABILITY

Tree plots can be helpful in small problems like this one, but can be impractical in larger problems. Now suppose that Jake has invited 7 of his friends to dinner at his house and he needs to call each of them to warn them about the vicious new dog next door. How many sequences of calls are possible? He can pick the rst person he calls in 7 different ways, the second in 6 ways (because the rst person has already been called), the third in 5 ways, etc... for a total of 7 6 5 4 3 2 1 = 5040 possible sequences. For convenience, we write 7 6 5 4 3 2 1 = 7!, which we read as seven factorial". In general, if n is a positive integer, then n! = n(n 1)(n 2)(n 3) . . . (3)(2)(1). By itself, 0! doesnt make any sense, but it will soon be convenient for us to dene 0! = 1. Now suppose that Jake has 5 errands to complete, but he only has enough time to complete 2 of them. How many ways can he choose 2 errands out of 5? He can choose the rst of the two errands in 5 ways and the second in only 4 ways. Using the fundamental counting rule, there are 5 4 = 20 ways to choose two errands. If e1 represents the rst errand, e2 the second, and so on, then the 20 possible sequences of 2 errands are as follows. e2 e1 e1 e2 e1 e3 e1 e4 e1 e5 e2 e3 e2 e4 e2 e5 e3 e1 e3 e2 e3 e4 e3 e5 e4 e1 e4 e2 e4 e3 e4 e5 e5 e1 e5 e2 e5 e3 e5 e4

The key question here is whether or not the sequence of the errands matters. If, perhaps unrealistically, the order does matter, then there are 20 2-errand sequences. If order does not matter, then, for example, e1 e2 is the same as e2 e1 and there are only 10 different pairs of errands. In general, an ordered arrangement of objects is called a permutation. We can use the fundamental counting rule to determine the number of permuations of r distinct objects that can be formed from n distinct objects. The rst object can be chosen n ways, the second (n 1) ways, ..., and the r th (n r + 1) ways, for a total of
n Pr

= n(n 1)(n 2) . . . (n r + 1) = = n(n 1)(n 2) . . . (n r + 1)(n r) . . . (3)(2)(1) (n r) . . . (3)(2)(1) n! (n r)! .

Therefore, we have the following theorem.

2.1. COUNTING

35

THEOREM 2.2. The number of permutations of size r from n distinct objects is

n Pr

n! (n r)!

. n! 0!

Note that there n! ways to choose n objects from n objects and Theorem 2.2 works in that case,

n Pn

n!, because we dened 0! = 1. An unordered arrangement of r distinct objects taken from n distinct objects is a combination, and we can derive the number of combinations from the permutation rule (Theorem 2.2) because any permutation of r distinct objects can be rearranged in r! different ways that are equivalent if order doesnt matter. Therefore, THEOREM 2.3. The number of combinations of size r from n distinct objects is n! r!(n r)! The symbol n r .
n Cr

n r

is read n choose r".

Example 2.2: If Bob has eight different color ags, how many different signals can he make from ve ags? In this case, n = 8, r = 5. Assuming that the order of the ags matters, then
8 P5

8! (8 5)!

8! 3!

= 8 7 6 5 4 = 6720.

Example 2.3: Let S = {A, B, C, D, E}. How many ways can you choose 3 letters from S if order matters? In this case, we can write out all of the possible permutations BC D BC E BDE C DE BDC BEC BE D C E D C BD C BE DBE DC E C DB C EB DEB DEC DBC EBC EBD EC D DC B EC B E DB E DC 5! and see that there are 60 of them, or we could compute 3 P5 = = 60. If order does not matter, then all 2! of the entries in each column are equivalent to each other. For example, ABC, AC B, BAC, BCA, CAB, and C BA (rst column) are all equivalent if order doesnt matter, and there are 3! of them since there are 3! 5 5! permutations of 3 objects. Therefore, the number of combinations is = = 10. 3 3!2! Example 2.4: How many different ve-card hands can be made from a standard card deck of 52 cards? Here, order does not matter, so
52 C5

ABC AC B BAC BCA CAB C BA

ABD ADB BAD BDA DAB DBA

ABE AEB BAE BEA EAB EBA

AC D ADC CAD C DA DAC DCA

AC E AEC CAE C EA EAC ECA

ADE AE D DAE DEA EAD E DA

52 5

52! 5!(52 5)!

52! 5!47!

= 2, 598, 960.

Students often struggle with permutations and combinations in applied problems. In both cases, remember to check that you are sampling without replacement from a set with no repeated elements. Then you have to determine whether or not order matters. This is where people usually struggle the most, so lets look at a few examples.

36

2. PROBABILITY

Example 2.5: There are currently (2010) 11 schools in the Big Ten conference. (Go gure.)

If the conference is planning a future years football matchups, how many different games are possible? For each game, the conference must choose 2 teams out of 11, and repeats are not possible since no team can play itself. Since this is clearly a permutation or combination problem, the only issue is whether or not order matters. If, for example, the rst team chosen plays at home, then order matters and there are 11! (11)(10)9! = = 110 different matchups. However, if the games are played at neutral sites, then 11 P2 = 9! 9! (11)(10)9! 11! = = 55 possible matchups. order doesnt matter and there are 11 C2 = 9!2! 9!2 Example 2.6: Suppose that a generous instructor brings a $20 bill, a $10 bill, a $5 bill, and a $1 bill to class one day. He puts all 30 students names in a hat and draws four different names. The rst person wins the $20 bill, the second the $10 bill, and so on. How many different ways can the money be awarded? In this 30! example, order clearly matters because the prizes are different. Therefore, there are 4 P30 = = 657, 720 26! different ways to award the money. Example 2.7: A less generous instructor brings four $1 bills to class one day, puts all of his 30 students names in a hat and draws four different names. Each person selected wins $1. How many different ways can the money be awarded? In contrast to Example 2.6, order does not matter because the prizes are all 30! = 27, 405 different ways to award the money. the same. Therefore, there are only 4 C30 = 4!26! 2.2. Probability The set of all outcomes of a random experiment is called the sample space. For example, the sample space for ipping a coin and observing the up-side is {heads, tails}. The sample space for the number of pips on the up-face of a standard six-sided die is {1, 2, 3, 4, 5, 6}. An event A is a subset of the nite sample space S. If all events in S are equally likely, then the probability of A is (2.1) P(A) = number of elements in A number of elements in S .

Also, if an experiment is repeated a large number of times, then (2.2) P(A) number of times A occurs number of trials .

In other words, probabilities are numbers that reect the likelihood that an event will occur. For example, if A is the event of rolling a 5 with a standard die, then P(A) = 1 6 ,

because there is 1 entry in A = {5} and 6 equally likely entries in S = {1, 2, 3, 4, 5, 6}. Repeated rolling of a die produces the same result in an approximate way. See the simulations in Figure 2.2. The more trials there are, the more likely the estimate is to be close to the exact probability. It is clear from (2.1) that 0 P(A) 1 and that P(S) = 1. The union of events A and B, denoted A B, indicates that A occurs, B occurs, or both A and B occur as shown graphically in Figure 2.3a and 2.3b. The

2.2. PROBABILITY

37

Figure 2.2: Frequencies of outcomes from simulations of a hundred, a thousand, and a million rolls of a fair die. Note that there is considerably less variation with more repetitions.

intersection of A and B, denoted A B, means that both A and B occur, as shown in Figure 2.3c. This implies the addition rule for probabilities. THEOREM 2.4 (Addition Rule). P(A B) = P(A) + P(B) P(A B)

Looking at Figure 2.3a, we see that the area of A B is equal to the sum of the areas of A and B, except that we have to be careful not to double-count the area of A B, so we have to subtract it from P(A) + P(B). If A and B are mutually exclusive (Figure 2.3b), then the occurrence of A excludes the possibility of B and the occurrence of B excludes the possibility of A. In other words, sets A and B are disjoint (see Figure 2.3) and P(A B) = 0. Example 2.8: For the experiment of rolling a pair of dice (see Figure 2.1), let A be the event of rolling a sum of 6 and let B be the event of rolling doubles. P(A B) = P(A) + P(B) P(A B) = = 5 36 10 36 + = 6 36 5 18 1 36

= 0.27

Example 2.9: In a standard deck of 52 cards, let A be the event of drawing an ace and let B be the event of drawing a red card. Then, P(A B) = 4 52 + 26 52 2 52 = 28 52 = 7 13 0.538461.

The complement1 of an event A is the set of events for which A did not occur. Well denote the complement of A by Ac , but other authors use other symbols like A and A. It is clear that A Ac =
1Note the spelling of complement. If someone says that you did a great job on a paper, then that is a compliment.

38

2. PROBABILITY

Figure 2.3: The shaded areas in (a) and (b) represents A B. In (b) the events are mutually exclusive (or the sets are disjoint). The shaded area in (c) represents A B, and in (d) the lighter area in (c) is A and the darker is Ac .

S and A and that Ac are mutually exclusive. Therefore, the application of the addition rule shows that P(A) + P (Ac ) = P(S), or (2.3) P (Ac ) = 1 P(A).

In problems where P (Ac ) is easier to compute than P(A), (2.3) can be very helpful. Example 2.10: If A be the event of rolling a 3 on a fair six-sided die, then Ac is the event of rolling a 1, 2, 1 5 4, 5, or 6 and P(A) = and P(Ac ) = . 6 6 Sometimes probabilities depend on previous events. For example, the probability that you will be dealt an ace from a well-shufed, standard, 52-card deck is 4/52 = 1/13 0.0769 since there are 4 aces and 52 cards. However, the probability that your second card will also be an ace, given that your rst card was an ace, is 3/51 0.0588 since there are only 3 aces and 51 cards left. We denote the conditional probability that B will occur given that A has occurred by P(B|A) and we observe the following theorem.

2.3. INDEX OF COINCIDENCE

39

THEOREM 2.5 (Multiplication Rule). P(A B) = P(A)P(B|A)

Example 2.11: Lets use the multiplication rule to determine the probability that the top two cards in a shufed deck are aces. Let A be the event that the rst card is an ace and let B be the event that the second card is an ace. Then P(A B) = P(A)P(B|A) 52 51 1 = 0.00452 221 Two events A and B are independent if the occurrence of one has no effect on the other. For example, if A is the event of getting heads on the rst toss of a coin and B is the event of getting heads on the second toss, then A and B are independent events. Two events are dependent if they are not independent. For instance, if C is the event of drawing a heart () from a standard deck of 52 cards and D is the event of drawing a club () on the next card without replacing the rst card, then C and D are dependent events. Whenever A and B are independent P(B|A) = P(B), P(A|B) = P(A) and the multiplication rule simplies to P(A B) = P(A)P(B). 2.3. Index of Coincidence The index of coincidence (IoC) for a body of text is the probability that two (uniformly) randomly selected letters are the same. Indices of coincidence are different for every book or article and they are relatively easy to compute using our probability rules. Let A1 be the event that you get an a as the rst chosen letter and A2 be the event that you get an a as the second letter, etc... Then IoC = P(two randomly chosen letters are the same) = P (A1 A2 ) (B1 B2 ) . . . (Z1 Z2 ) Since each pair of letters is mutually exclusive of every other pair, the addition rule (Theorem 2.4) implies that (2.4) IoC = P(A1 A2 ) + P(B1 B2 ) + . . . + P(Z1 Z2 ). = 4 3

If n is the total number of characters in the text and there are n1 as, n2 bs, etc..., then the multiplication rule (Theorem 2.5), implies (2.5) (2.6) IoC = = n1 n 1 n(n 1) n1 1 n1
26

n2 n

n2 1 n1

+ ...

n26 n

n26 1 n1

ni (ni 1)
i=1

Equation (2.6) is often further simplied by assuming that all of the ni are large so that ni ni 1 and (2.7) IoC = 1 n2
26

n2 , i
i=1

40

2. PROBABILITY

but this is not necessary and doesnt really offer an advantage unless were computing the IoC by hand. Example 2.12: "The quick brown fox jumped over the lazy dog." is a short sentence of 36 characters that famously uses each letter of the alphabet at least once. Only 7 letters are used more than once: d (twice), e (four times), h (twice), o (four times), r (twice), t (twice), and u (twice). Using (2.6), we nd IoC = 34/1260 0.027. Using the reduced form (2.7) is not appropriate here since each ni is so small and it leads to a very poor approximation of 70/1296 0.054. Example 2.13: Example 2.12 used a very short, unusual text. What are more typical values of the IoC for 26-letter English? The following table shows the IoCs for the four texts we considered in Section 1.9. Because each body of text is long, the IoC in (2.6) and its approximation in (2.7) are almost identical. Number of Text Characters IoC The Gold Bug 58,270 0.066 2006 State of the Union Address 25,940 0.066 86,699 0.064 Julius Caesar USA Patriot Act 286,260 0.070 Lets come up with a theoretical IoC for 26-letter English. We saw in Section 1.9, that the probability model for English with the standard 26-letter alphabet is fairly consistent from text to text, provided that the texts are sufciently long. So, if were considering a text that is long enough to follow the distribution in Figure 1.1, then we can approximate its IoC using the frequencies from Table 1.2. Returning to (2.4) and explicitly using the multiplication rule, we have IoC = P(A1 A2 ) + P(B1 B2 ) + . . . + P(Z1 Z2 ) = P(A1 )P(A2 |A1 ) + P(B1 )P(B2 |B1 ) + . . . + P(Z1 )P(Z2 |Z1 ). For a sufciently long text, all letter pair events (like A1 and A2 ) should be almost independent, so IoC P(A1 )2 + P(B1 )2 + . . . + P(Z1 )2 . Using the probabilities in Table 1.2, we have (2.8) IoC (0.082)2 + (0.014)2 + . . . + (0.001)2 0.0658,

which is consistent with our results in Example 2.13. In other words, in long English texts, there is about a 6.6% chance that two randomly selected letters are the same. Classroom Exercise 2.1: How is the IoC for afne ciphertext related to the IoC for the related plaintext? Finally, lets nd what the IoC should be for ciphertext. A necessary condition for a good cipher is that it masks all of the letter frequencies, so lets assume that every letter in the ciphertext is equally likely, with probability 1/26. Then IoC P(A1 )2 + P(B1 )2 + . . . + P(Z1 )2 = 1 26
2

1 26

+ ... +

1 26

26 262

1 26

0.038.

So, the better a cipher masks letter frequencies, the closer the IoC of the ciphertext is to 0.038.

2.4. Vigenre CIPHER

41

2.4. Vigenre Cipher History. The Vigenre cipher is a generalization of the additive cipher that thwarts direct frequency analysis. It was (erroneously) considered unbreakable for about 300 years, but this may be because professional cryptologists preferred nomenclator2 ciphers instead.[3]. Vigenre recorded both plaintext and ciphertext autokey versions of his cipher in his 1586 Traict des Chiffres, but, according to Kahn [3], later e cryptologists falsely attributed what well call the Vigenre cipher to him. Encryption and Decryption. The Vigenre Cipher is similar to the additive cipher in that it is consists of additive shifts, but the key can be substantially longer because the Vigenre cipher uses a keyword (or sequence of integers) instead of a key letter (or single integer). For example, consider the plaintext theeaglesarethebest3 with keyword football. To encrypt, we line up the characters from the plaintext and write the keyword repeatedly under all the characters and then shift each plaintext character by the amount from the corresponding key. Plaintext: theeaglesarethebest Key: footballfootballfoo Ciphertext yvsxbgwpxofxuhpmjgh To be specic, the rst plain character t is shifted by 5 (f) to give y, the second character h is shifted by 14 (o) to give v, and so on. Again, it is convenient to mathematize our cipher. The difference between the Vigenre cipher and the additive cipher is that the value of k in (1.20) changes periodically. If pi is the i th plaintext character, then the i th ciphertext character is (2.9) ci = pi + ki
mod L

mod 26,

where the key is now the sequence of L integers {k0 , k1 , . . . k L1 } instead of a single integer k. Revisitng the example above, we can now encrypt simply by adding in columns modulo 26. Plaintext: 19 7 4 4 0 6 11 4 18 0 17 4 19 7 4 1 4 18 19 Key: 5 14 14 19 1 0 11 11 5 14 14 19 1 0 11 11 5 14 14 Ciphertext: 24 21 18 23 1 6 22 15 23 14 5 23 20 7 15 12 9 6 7 Keyspace. Before we can determine the size of the keyspace, we have to decide on how long the keywords can be. Currently (2010), according to Mathematica, there are only seven words (counterrevolutionaries, electroencephalograms, electroencephalograph, electroencephalographic, electroencephalographs, electroencephalography, magnetohydrodynamical) in the English language with more than 20 letters, so it seems reasonable to restrict our attention for the time being to words up to length 20. If we insist on actual English words for keywords, then there are 92, 518 216.5 words in Mathematicas dictionary. Other dictionaries may have more words, so lets just say that there are about 100, 000 words in the English language. While that is too large to exhaust by hand, it is nothing for a modern computer. If we relax our restriction and accept any string of characters up to and including 20 letters, then there are 26 + 262 + 263 + . . . + 2620 = 20, 725, 274, 851, 017, 785, 518, 433, 805, 270 294
2A nomenclator is a type of substitution cipher. 3One author disagrees...and deep down, the other author knows that, in fact, the Steelers are the best. Count the Super

Bowls.

42

2. PROBABILITY

Figure 2.4: The frequencies of lengths of Englishs 92, 518 words.

possible keywords. That looks like a big number (20 octillion plus change), and it is - even for a modern computer. So exhaustion is out of the question in this case. Cryptanalysis of Vigenre Cipher. Additive and afne ciphertext can be attacked exhaustively because their keyspaces were small: 25 and 311, respectively. However, attacking the Vigenre cipher requires a subexhaustive attack. If we can determine the length of the keyword, L, then we only need to solve L additive ciphers, which we already know how to do. We will discuss two methods of determining L, the Kasiski test and the Friedman test. Both of these tests are hard to implement if L is large because the keyword is not repeated very often. Churchhouse [1] (p. 37) recommends having ciphertext that is fty times longer than the key to have reasonable hope of success. If the keyword is as long as the plaintext and the characters in the keyword are generated randomly, then the Vigenre cipher is called a one-time pad. This is impractical in most situations because so much key is required, but it is very secure. In fact, in 1949, Claude Shannon [9] proved that the one-time pad is theoretically unbreakable, so only human error would allow an adversary to successfully cryptanalyze one-time pad ciphertext. According to [13], the hotline between Moscow and Washington, D.C. was encrypted with a one-time pad during the Cold War. Kasiski Test. The Kasiski test exploits repeated strings of characters in the plaintext. For example, the plaintext howmuchwoodwouldawoodchuckchuckifawoodchuckcouldchuckwood has several strings that appear repeatedly. Encrypting with the keyword twist gives ciphertext that also has repeated strings. Plaintext: howmuchwoodwouldawoodchuckchuckifawoodchuckcouldchuckwood Key: twisttwisttwisttwisttwisttwisttwisttwisttwisttwisttwisttw Ciphertext: akeenvdeghwswmewweghwypmvdypmvdensphkluanysuhnhluanysohhz The word wood appears four times in the plaintext, and it is encrypted in only three different ways. Why? The rst two times that wood appears, the rst letter of wood corresponds to the i in twist. The third time wood appears it lines up with the second t in twist, and the last time it appears it lines up with the s in twist. Similar things happen with the strings chuck and dchuck. Kasiskis observation was that if you could identify repeated strings in the ciphertext, then it is possible, but not necessary, that the repeated ciphertext strings correspond to the same plaintext strings. If that is the case, then the difference in position between the repeated strings must be a multiple of length of the keyword. In our example, eghw starts at positions 8 and 18, so the keyword is probably a factor of 18 8 = 10 = 2 5. This suggests that the keyword likely has length 2, 5, or 10.

2.4. Vigenre CIPHER

43

Example 2.14: Consider the following ciphertext (users.etown.edu/m/mcdevittt/Vigenere1.txt, ). Its fairly long, but that actually makes the cryptanalysis easier because long repeated strings are more likely.

oig acc aib dtj rpq utu jzu fcj xox etl mqt fdj cqq ttu qnt rda quf ghn nlq fiq xpq uhq

gbw czt dbc nox sjh xau cjf nud smi lmi dbn xpd hjs chx thq oei uai zag wra cec gwg zdd

agn wnm fxx ecx phx cbm dtb wgu fwr nqq djp axq tta wad tdo xvq yiq fbu tah jnu qcc vnt

uzs cnq hfw ljl xqs ifu nuc vqn mnj rjh axt iau ynj pcb igv wnl yet rqn lqh dwo iri tnu

byh zpc jnm ftb rwm dln pjx xxe ccz zdc mbq oic ccf qgc qnt qsn qiz tth xfh zsn qyb diq

tws cac aug nuc inx bmk ply yui puu bma gnb bql rjh int tay xur day amk tcb lsd txj

qpa liz qcj pqt opw nwa rda rmm dvn uii mkn xlx zte myp tpe jnq psn nnt mic mmt xtk

mmv xig gou fwn rnc htm cza rvq lqr aym inx qfd tcb qgc bmi wuf fac pyz sdl qln bnn asn xur jnq ntd byi wxb qgn aci stc bqg ocf let wmq lnw mcw iqc eva igc mnt wac byo gjn qsr sfc xau cfi uyz ydu xls tcq tpc xlu ftm bqg nna yfw dmr pam acx sci fwn adt jnf upl nnm znc zra tuu eio oxa vym bqh nxq pmm tpu puf tpe ymc nqn sfw::::::::::::: njq dyf qux :

leq aig vqn rda gcs mcm xqs rwm uxc xqi tjl qtw xxh agj hkc jnu udt vyf dwu sgn pyi dir izd ont amk nnt trl xxe irh spw xbg xjq ifs nxu rjn qln tkl mkn gqc uch nrp aun dey aja dcy zda fac plq ntt hxu sqy dtr iqy gco czx bbq vxn jxh pww qsr pbe dtv uuc rhs ymh nxp tei fxx hdl qdo xqk xnu fzd cbm knx utm xan tdo zdt nxa lf::::::::::::::: w njq dyf qhq

ntd inx amv dwm ufq pcz yei gcb wmc xwa jad bng nuh sfi nuh qnz hfd dwn czk bjh uxa

wnt fdc nxu arx jnf utu quf mif wif mcm aja nta oid dzf auf agn cbm tpc jcz piq wif

xbw bqe cja hot anz xmh iqu yew rxh xqp lnl qtp jbn bur wnl oei ilu qqw iqu ufv enl

Short repeated strings can happen accidentally, so we prefer relatively long strings. In the above text, you can see several highlighted repeated strings and here are their starting positions. Starting Differences in Positions Starting Positions snxurjnq 296 468 468 296 = 172 = 22 43 824 824 468 = 356 = 22 89 xqsrwmin 94 226 226 94 = 132 = 22 3 11 wnjqdyfq 1104 1116 1116 1104 = 12 = 22 3

Polygraph

Since the differences in starting positions all involve 22 , the keyword probably has length 2 or 4. Finding the repeated strings and their starting positions is tedious to do by hand, so we recommend using ECrypt or some other appropriate software. A nice Mathematica notebook KasiskiTest.nb can be found at users.etown.edu/m/mcdevittt/Crypto.html. Even with a computer, nding repeated strings can be a little slow, so be sure that you dont tackle ciphertext that is really long unless you are prepared to wait awhile.

44

2. PROBABILITY

Putative Keyword Length L 1 2 3 4 5 6 7 8 9

c1+ j L 0.046 0.058 0.044 0.077 0.043 0.055 0.045 0.073 0.041

c2+ j L 0.050 0.048 0.067 0.051 0.054 0.045 0.067 0.049

Indices of Coincidence for Subsequences of the Ciphertext c3+ j c4+ j c5+ j c6+ j c7+ j L L L L L

c8+ j L

c9+ j L

0.047 0.080 0.044 0.059 0.048 0.080 0.044

0.072 0.046 0.047 0.044 0.065 0.042

0.044 0.058 0.051 0.078 0.042

0.047 0.043 0.063 0.061

0.045 0.079 0.047

0.077 0.048

0.043

Table 2.1: Table of Friedmans indices of coincidence for subsequences of the ciphertext.

Friedman Test. Experiments show that the index of coincidence for Vigenre Cipher is approximately 0.046, whereas it is about 0.066 for English and afne ciphertext, so the IoC is a statistic that can be used to distinguish between Vigenre and afne ciphertext. However, we can also use it to nd the length of the Vigenre keyword. Example 2.15: Lets reconsider the ciphertext in Example 2.14. The IoC is 0.046, which suggests that this is probably Vigenre ciphertext. What well do is simply try different keyword lengths . If, for example, L = 3, then we are guessing that L = 3. If that is correct, then {p1 , p4 , p7 , p10 , . . .} were all encrypted with L k0 , {p2 , p5 , p8 , . . .} were all encrypted with k1 , and {p3 , p6 , p9 , . . .} were encrypted with k2 . That means that each subsequence should have an IoC near 0.066. However, as the Table 2.1 shows, the indices are 0.044, 0.048, and 0.047, so = 3 must be wrong. L Table 2.1 shows IoCs for all of the subsequences for values of from one to nine. The IoCs for = 4 L L and = 8 are close to 0.066, so we think that one of these is correct. Since 4|8, it must be that L = 4. This L method is both faster and more reliable than the Kasiski test, but it requires the use of a computer. Finding Plaintext. Once the length of the keyword is known, recovery of the plaintext is fairly easy because it only requires cryptanalyzing L additive ciphers. Example 2.16: Continuing Example 2.14 and knowing that L = 4, we break down the cipher into its four subsequences: c1+4 j c2+4 j c3+4 j
247 j=0 246 j=0 246 j=0 246

obnbwaxonaqawbcwnclnmrcmrncabxjujandxjwnjjejbpccwxjj...qwnqvnq iwuysmiulinnnwcnqciccvsxwxbichnglyxuqlaxanclnqbbuhhn...fuilznu gazhqmgfegrttazmzazhzqmqmfqbffmqqmqxiqmudoxfutqmfaku...qxfudtd

c4+4 j j=0 ggstpvgwqvddxctcpcrtagcsidedxwacrifcttvctxltctgixgcd...haehdti that have the frequencies shown in Figure 2.5. These charts suggest that {k0 , k1 , k2 , k3 } = {9, 9, 12, 15} (or jjmp), which gives the obviously incorrect putative plaintext fzursnorelndspvenjeardagozurflthecs brzugheforehonehisnonttnene. A little trial and error reveals that k1 = 20 (jump) and the original plaintext fourscoreandsevenyearsagoourfathersbroughtforthonthiscontinent.

EXERCISES

45

Figure 2.5: Frequencies of ciphertext characters in the four subsequences of the Vigenre cipher in Example 2.14.

Exercises (1) Kelly is trying to communicate with her best friend Bill. She has seven different whistles to get his attention, each with a different pitch. How many different sequences of whistles could she if she uses three different whistles each time? (2) Melissa has top-of-the-line clothing. She has four different pairs of shoes, three different shirts, and six pairs of pants. How many different outts can she make? (3) Jordan has a gambling problem. He enjoys making bets on things such as ipping a coin. Assuming the probability of ipping a heads is 0.5, what is the chance that he ips a head three times in a row? (4) How many factors do each of the following integers have?

46

2. PROBABILITY

(5) (6) (7)

(8)

(9)

(10)

(11) (12)

(a) 20 (b) 200 (c) 1960 (d) 10800 Two integers x and y are chosen (uniformly) at random from 0 x < 17. What is the probability that x + y 7 mod 17? If x {1, 2, . . . , 28}, what is the probability that x 1 mod 29 is not prime? There are three racers, Matt, Paul, and Zach, trying to win the last race to qualify for the Olympics. Out of 143 races, Matt has gotten the best start 72 times and Paul has gotten the best start 18 times. Assume that the same conditions hold for the nal race that held for the rst 143 races. As the whistle is blown: (a) What is the probability that Matt gets the best start? (b) What are the probability that neither Matt nor Paul get the best start? Nikki needs to make a password for her computer so Rachel cannot hack into it. She is allowed to use lower-case letters, upper-case letters, numbers, and the six characters !?#$(). Her password needs to be a minimum of 6 characters and a maximum of 12 characters long. How many different passwords can she make? Recall that the probability of choosing an e is approximately 12% and the probability of choosing a z is 0.074%. If you choose two letters at random from a large book, what is the probability that you get one e and one z? If, on any given day, the probability of class being canceled is 32% (yeah right!) and the probability of pigs ying is 12%, what is the probability of both of these independent events happening on the same day? What is the probability of rolling a fair die so that you rst roll a 6, then an even number, and then a prime number? Brielle and Patty are playing Trouble R . Patty (green) is one spot from winning and it is her turn. Brielle (red) is seven spots behind Patty. On her turn, Patty uses the Pop-a-matic R bubble to roll the die and then moves that many spots. Patty needs a 1 to win and cannot move on any other value of the die. However, if she rolls a 6 she gets to go again.

(a) What is the probability that Patty wins on her next turn? 1 1 1 6 Hint: 1 + + 2 + 3 . . . = . 6 6 5 6 (b) Given that Patty doesnt win on her turn, what is the probability that Brielle lands on Pattys spot on her next turn?

EXERCISES

47

(13)

(14)

(15)

(16) (17)

(18)

(c) Starting with Pattys turn, what is the probability that Brielle lands on Pattys spot before she wins? Encrypt the following messages with the Vigenre Cipher using the given keyword and the standard 26-letter alphabet. (a) tim likes to chew gum. keyword=dentyne (b) pcs are better than macs. keyword=computer (c) the steelers will win the super bowl keyword=ben Decrypt the following messages using the given keyword and the standard 26-letter alphabet. (a) tphftltkrph keyword=bed (b) usfajlevgujwtgldibfymmywrjqxwvqikacogx keyword=betsy (c) zfiikehxrzinxzsvrpqtiomyzvxkicbvnxi keyword=travel Cryptanalyze the Vigenre ciphertext in the text les (a) Vigenere2 (b) Vigenere3 (c) Vigenere4 all of which are available at users.etown.edu/m/mcdevittt/Crypto.html For a 26-letter alphabet, what is the smallest that the IoC can possibly be? What is the largest it can be? Suppose that you encrypt some plaintext twice. You rst use the Vigenre cipher with a keyword of length L1 , and then you re-encrypt the resulting ciphertext with a keyword of length L2 . The resulting ciphertext is Vigenre ciphertext with an effective keyword length of L3 . Carefully relate L3 to L1 and L2 . Sinkov [11] denes the measure of roughness
26

MR =
j=1

fj

1 26

where f j is the relative frequency (i.e. probability) of the j th letter. Approximately how large is MR for English text?

CHAPTER 3

Recursion
3.1. Recursion Recursion, for us, refers to the calculation of integers in a sequence using previous integers in the sequence. In particular, we are interested in the recursive denitions of integer sequences via linear recurrence relations. Rather than give a careful denition of a linear recurrence relation, lets start out with an example that may be familiar. Leonardo of Pisa (a.k.a. Fibbonacci) was a famous Medieval Italian mathematician who introduced Arabic numerals to the Latin West, but he is better known for the Fibonacci sequence, {0, 1, 1, 2, 3, 5, 8, 13, 21, . . .}, that starts with 0 and 1 and proceeds by adding the previous two numbers. More precisely, if f n is the nth Fibonacci number, then f0 = 0, f1 = 1, and (3.1) f n = f n1 + f n2 , n 2.

Note that if we change f0 and f1 , then (3.1) gives completely different sequences. The Fibonacci sequence and others like it are fascinating and well worthy of study, but we want to use them for cryptographic purposes. Note that (3.1) species a linear relationship between f n , f n1 , and f n2 . Example 3.1: Suppose f0 = 7 and f1 = 3. Using (3.1) gives the sequence {7, 3, 10, 13, 23, 36, 59, 95, 154, 249, . . .}, but if f0 = 3 and f1 = 2, then we have {3, 2, 1, 1, 0, 1, 1, 2, 3, 5, . . .} instead. Key Expansion. Suppose that you are using a Vigenre cipher with a keyword of length L = 2. This is an extremely short key, but it can be expanded using a recursive rule like (3.1). For example, let k0 = 0, k1 = 1, and let (3.2) kn kn1 + kn2 mod 26, n 2.

Here are the rst 90 terms in the mod-26 Fibonacci sequence: (3.3) kn
89 n=0

= {0, 1, 1, 2, 3, 5, 8, 13, 21, 8, 3, 11, 14, 25, 13, 12, 25, 11, 10, 21, 5, 0, 5, 5, 10, 15, 25, 14, 13, 1, 14, 16, 5, 21, 0, 21, 21, 16, 11, 1, 12, 13, 25, 12, 11, 23, 8, 5, 13, 18, 5, 23, 2, 25, 1, 0, 1,1, 2, 3, 5, . . .}.

15, 3, 18, 21, 13, 8, 21, 3, 24, 1, 25, 0, 25, 25, 24, 23, 21, 18, 13, 5, 18, 23, 15, 12, 1, 13, 14, 1, 15,

Note that this sequence is periodic, starting over again at n = 84, so kn = kn+84 . Note that the regular Fibonacci sequence { f n } is not periodic and increases without bound, so it is signicant that {kn } is periodic. It is also noteworthy that {kn } appears to be random, so the original key sequence {k0 , k1 } has
49

50

3. RECURSION

been expanded to {k0 , k1 , k2 , . . . , k83 }, thereby strengthening the Vigenre cipher by better approximating a one-time pad. Other sequences are certainly possible. For example, the recursion kn 5kn1 + 19kn3 mod 26, n 3,

requires 3 starting values {k0 , k1 , k2 } and has period 168, twice as long as (3.2). We can choose both the number of terms in the recursion and the coefcients, so we might want to understand how we can choose them to optimize the period of the resulting sequence. However, that would involve some sophisticated mathematics that is beyond the scope of this course. Classroom Exercise 3.1: Compute the period of the sequence dened by kn 5kn1 + 9kn2 mod 26, by computing enough terms. Classroom Exercise 3.2: Let k0 = 5, k1 = 23, and kn kn1 +kn2 mod 26. The ciphertext nckgbdbicpr medlklalrdhydcjmtwxxmu was generated using a Vigenre cipher with the sequence kn 32 . Decipher n=0 the message. 3.2. Binary Arithmetic The number system we use every day is based on the number 10, and when we write something like 4085, we are expressing a number as a linear combination of powers of 10. More precisely, 4085 = 4 103 + 0 102 + 8 101 + 5 100 . Ten is a convenient base, but, throughout history people have used other bases. The ancient Babylonians used 60 as a base, so 4085 = 1 602 + 8 (60) + 5, which we can abbreviate 4085 = 18560 , where the subscript 60 indicates the base. The Babylonians would have recorded 4085 as shown to the left, and they read the "digits" from left to right as we do. The Maya used 20 as a base, so 4085 = 10 202 + 4 (20) + 5, which they indicated with bars and dots as shown to the left. The number is read from top to bottom and each dot indicates one and each bar indicates ve. Since it takes two characters to write 10, we would have a small problem with a base 20 system. We would either have to write (10)4520 or we would have to use a single symbol, say a, for 10 so that 4085 = a4520 . Modern computers use base 2 for arithmetic because information is stored in a binary format (e.g. high and low voltages) that we represent with binary digits (or bits1) 0 (off) and 1 (on). (3.4) 4085 = 1 211 + 1 210 + 1 29 + 1 28 + 1 27 + 1 26 + 1 25 + 1 24 + 0 23 + 1 22 + 0 21 + 1 20 , which we abbreviate 4085 = 1111111101012 . Except for some formatting issues, this is how 4085 is stored internally on a computer. The machine is just kind enough to write it to the screen as 4085 for our benet.
1The term bit was coined by statistician John Tukey in 1947. It is short for binary digit.

n2

3.3. DATA AS BITS

51

Given a positive integer, we would like to know how to write it in terms of bits. Perhaps the simplest way is to just repeatedly divide the integer by 2 and read off the remainders starting with the last step. For example, to derive (3.4), start at the bottom and repeatedly divide by 2. 0 R1 2 1 R1 2 3 R1 2 7 R1 2 15 R1 2 31 R1 2 63 R1 2 127 R1 2 255 R0 2 510 R1 2 1021 R0 2 2042 R1 2 4085 The remainders, from top to bottom (.e. rst to last), give us the binary representation 4085 = 1111111101012 . Classroom Exercise 3.3: Write the following integers base 2. (1) (2) (3) (4) (5) (6) 14 55 69 92 128 256 3.3. Data as Bits Every le - thats right, every single one - on a computer is stored as bits. Word R and Excel R documents, images (.jpg, .gif, .png, etc...), audio les (.mp3, .wav, etc...), movies (.mpg), and the programs that make and display them are all stored as bits. The details of how, for example, .jpg or .wav les store data are quite complicated and we dont want to delve into them, but it is important for us to understand how English text can be stored as bits. Its pretty simple, actually. All we need to do is associate letters (or characters) with positive integers and then let the computer store the integers in a binary format. We have previously associated a with 0, b with 1, and so on when we studied the additive, afne, and Vigenre ciphers because it was convenient for us to do so. However, this is not what computers do. A popular way that computers represent characters is with the American Standard Code for Information Interchange (ASCII) that is shown in Table 3.1. There is also an expanded version of ASCII called Unicode, but we will stick to ASCII for simplicity. Example 3.2: Using Table 3.1, My dog has fleas. is encoded as

77 121 32 100 111 103 32 104 97 115 32 102 108 101 97 115 46
in ASCII, which is

1001101 1111001 0100000 1100100 1101111 1100111 0100000 1101000 1100001 1110011 0100000 1100110 1101100 1100101 1100001 1110011 0101110

52

3. RECURSION

Code 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55

Character

!  # $ % & ' ( ) * + . / 0 1 2 3 4 5 6 7
,

Code 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79

Character

< >

8 9 : ; = ? @ A B C D E F G H I J K L M N O

Code 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103

Character

P Q R S T U V W X Y Z [ ]
\

` a b c d e f g

Code 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126

Character

h i j k l m n o p q r s t u v w x y z { | }

Table 3.1: Table of printable ASCII characters. The characters that precede 32 are not printable.

in binary. Note that we need seven bits to represent most characters, but some only need six. To eliminate possible confusion, in this book we will always use 7-bit ASCII, so we will pad with enough zeros on the left so that every text character is represented by seven bits. 3.4. Encryption of Binary Data Working with bits means that we will do arithmetic modulo 2, so we have the following addition and multiplication tables. + 0 1 0 1 0 0 1 0 0 0 1 1 0 1 0 1 Computer scientists indicate binary addition and multiplication with XOR and AND, respectively, and many authors denote these operations with special symbols and . Until now, the size of our alphabet has not been terribly important. However, since we have only two characters, the additive cipher is completely useless because there is only one possible key value k = 1. Likewise, for the afne cipher, m must be one, so the afne cipher reduces to the useless additive cipher. The Vigenre cipher, on the other hand, is still effective. Lets encrypt howdy with the Vigenre cipher with key 1101. We encode the message with ASCII as 104 111 119 100 121, convert it to binary, and add the cyclic key modulo 2 to obtain the ciphertext. Plaintext: 1101000 1101111 1110111 1100100 1111001 Key: 1101110 1110111 0111011 1011101 1101110 Ciphertext: 0000110 0011000 1001100 0111001 0010111

3.5. LINEAR FEEDBACK SHIFT REGISTERS

53

Classroom Exercise 3.4: Decipher the Vigenre cipher bits

10000000100011001001100100111101110010010100010000010010
with keyword 0011 and decode the bits using ASCII. How secure is the Vigenre cipher here? For an n-bit keyword, there are 2n possible keywords. If, as before, we consider keywords up to length 20, then there are
20

1 + 2 + 22 + . . . + 220 =
n=0

2n = 2, 097, 151 221

possible keywords, which is too small to be secure against an adversary equipped with a modern computer. Suppose, for example, that you intercept this message

1101101011101000010100010000100101101100101000110011000010110011110100
from an adversary who is well known for using a 4-bit keyword. This message can easily be decrypted by exhaustion.
Key Putative Plaintext Putative Message m:K2F0Yt e (Cvd!Q0 |2N2Z:H| tvl#R @8 O+Ti#Nte

0000 0001 0010 0011 0100 0101 0110 0111 1000 1001 1010 1011 1100 1101 1110 1111

1101101011101000010100010000100101101100101000110011000010110011110100 1100101111111001010000000001100001111101101100100010000110100010110000 1111100011001010011100110010101101001110100000010001001010010001111100 1110100111011011011000100011101001011111100100000000001110000000111000 1001111010101100000101010100110100101000111001110111010011110111100101 1000111110111101000001000101110000111001111101100110010111100110100001 1011110010001110001101110110111100001010110001010101011011010101101101 1010110110011111001001100111111000011011110101000100011111000100101001 0101001001100000110110011000000111100100001010111011100000111011010110 0100001101110001110010001001000011110101001110101010100100101010010010 0111000001000010111110111010001111000110000010011001101000011001011110 0110000101010011111010101011001011010111000110001000101100001000011010 0001011000100100100111011100010110100000011011111111110001111111000111 0000011100110101100011001101010010110001011111101110110101101110000011 0011010000000110101111111110011110000010010011011101111001011101001111 0010010100010111101011101111011010010011010111001100111101001100001011

Go Eagles! #Fvx+Vjm Vgdgpo(Gb) )W8V !\9Tu) 8_: 0T+\1 \-_|?G M1M%Em7 W< .O Euo4M9O&

The keyword is clearly 0101.

3.5. Linear Feedback Shift Registers A shift register is a type of circuit that stores binary data in such way that the data shift sequentially and simultaneously through the register. A linear feedback shift register (LFSR) is a shift register in which a new bit is a sum of some of the bits in the register. The register in the following graphic starts out with initial ll 11100. Then, all of the bits then shift to the left. The red 1 drops out of the register on the left and a new bit is included on the right. The new bit is the mod-2 sum (XOR) of the indicated bits initially in the register. This process is repeated four more times in the picture below, but it can really go on indenitely.

54

3. RECURSION

We can model an LFSR with a linear recurrence relation. Starting with the initial bits k0 k1 k2 k3 k4 = 11100, the recursive relation (3.5) gives the pseudo-random bits kn kn4 + kn5 mod 2, n 5,

1110011010010000101011101100011111001101001000010101110110001111100 . . .
that are the same as those that are generated by the LFSR. Although the LFSR can continue shifting forever, as we noted in Section 3.1, the data are actually periodic, and in this case the period is 31. We can use LFSRs to encrypt binary data using the Vigenre cipher with the register output as the cyclic key. The actual key is the initial ll of the register, but it is greatly expanded by the LFSR. In this case, the 5-bit initial key has been expanded into a 31-bit cyclic key. Example 3.3: Lets see what a longer recursion does for us. If kn kn4 + kn5 + kn6 + kn8 , n 8,

11110000101111000110100000001000111000100101110000001100100100110111001000001010 11011010110010110000111110110111101011101000100001101100011110011100110001011010 01000101001010100111011101100111101111110100110011010100011000001110101010111110 01010000100111111110000...,

which has period 267. Classroom Exercise 3.5: You and Kyle agree to use 7-bit ASCII and the recursion kn kn3 + kn5 mod 2 with keyword 00001. Kyle sends you the following message:

and the initial bits are k0 k1 k2 k3 k4 k5 k6 k7 = 11110000, then we obtain the pseudo-random bits

10000000110110001011010010010100100110101111101111100010001101001010011011100001 11111111101101010111111101011011011101101101101100111001010010000111111101011011 110111111010010.

Decipher and read the message using the grid below and the ASCII code in Table 3.1.

EXERCISES

55

Exercises (1) Compute the rst ten terms in the following sequences modulo 10. (a) Let a0 = 1, a1 = 2, and an 3an1 2an2 , n 2. (b) Let b0 = 0, b1 = 1, b2 = 2, and bn 2bn1 + bn3 , n 3. (c) Let x 0 = 1, x 1 = 2, and x n bn1 2bn2 , n 2. (d) Let q0 = 7, q1 = 3, and qn 4qn2 + 7qn1 , n 2. (e) Let t 0 = 5 and t n = 8t n1 , n 2. (2) Compute the rst ten terms in the following sequences modulo 2. (a) Let r0 = 0, r1 = 0, rn = rn1 + rn2 , n 2. (b) Let d0 = 1, d1 , and dn dn2 dn1 , n 2. (c) Let g0 = 1, g1 = 0, g2 = 1, and g n g n3 , n 3. (3) Find the periodicity of the following sequences modulo 26. (a) Let m0 = 0, m1 = 1, and mn 2mn1 + mn2 , n 2. (b) Let l0 = 0, l1 = 1, and l n 3l n1 + 15l n2 , n 2. (c) Let j0 = 0, j1 = 1, and jn 7 jn2 9 jn1 , n 2. (4) Convert the following decimal integers to binary.

56

3. RECURSION

(5)

(6)

(7)

(8)

(a) 13 (b) 45 (c) 122 (d) 456 (e) 4329 Convert the binary integers to decimal. (a) 100002 (b) 1010012 (c) 11011012 (d) 11011101112 (e) 1100100100102 How many binary digits are necessary to represent each of the following decimal integers? (a) 100 (b) 200 (c) 300 (d) 500 (e) 800 Computer scientists frequently use a hexadecimal (base-16) system in which a = 10, b = 11, c = 12, d = 13, e = 14, and f = 15. Convert each of the following from hexadecimal to decimal integers. (a) 1416 (b) 2916 (c) a116 (d) 2a f16 (e) c9 f16 Computers do arithmetic in binary. Add the following binary integers. 0101001011112 + 100011000110112

(9) Decrypt the Vigenre cipher atnlbckcnjhvusfmhwhmlsjudpimehcpokcdhbwwbdqvatxmosbm haqjhdcyy using the sequence from problem (3b) as the key. (10) Use ECrypt to decrypt the bits in http://users.etown.edu/m/mcdevittt/LFSR1.txt and display the recovered plain bits on an appropriate width to form a picture. Let p0 = 0, p1 = 1, p2 = 0, p3 = 1, p4 = 1, p5 = 0, and pn pn1 + pn2 + pn3 + pn4 + pn6 mod 2, n 6.

CHAPTER 4

Matrices
Matrices are often introduced in linear algebra, which is one of the most important courses that math majors take. Most of the examples in introductory linear algebra courses involve matrices, both because of the relative simplicity and widespread usefulness of matrices. In this chapter, we will discuss basic matrix arithmetic and how matrices can be used to encrypt messages. 4.1. Matrix Arithmetic A matrix is a rectangular array of numbers like 1 2 3 4 or 1.2 5 . e 0 106

Some authors prefer parentheses and others prefer square brackets, but we will use parentheses. An m n matrix has m rows and n columns a11 a12 . . . a1n a 21 a22 . . . a2n A= . . . . .. . . . . . . . am1 am2 . . . amn Names for matrices are usually capitalized and bold-faced, but the entries (numbers) in the matrix are usually lower case and subscripted, with the rst subscript indicating the row and the column indicating the column of the entry. Addition and subtraction of matrices is very simple. Two mn matrices A and B are added or subtracted entry by entry: a11 a12 . . . a1n b11 b12 . . . b1n a11 + b11 a12 + b12 . . . a1n + b1n a 21 a22 . . . a2n b21 b22 . . . b2n a21 + b21 a22 + b12 . . . a2n + b2n A+B = . . . + . . . = . . . .. .. .. . . . . . . . . . . . . . . . . . . . . . am1 am2 . . . amn ... ... .. . bm1 bm2 . . . ... ... .. . bmn am1 + bm1 am2 + bm2 . . . amn + bmn ... ... .. . and a11 a 21 AB = . . . a12 a22 . . . a1n b11 a2n b21 . . . . . . b12 b22 . . . b1n a11 b11 b2n a21 b21 . = . . . . . a12 b12 a22 b12 . . . a1n b1n a2n b2n . . . .

am1

am2 . . . amn

bm1

bm2 . . .

bmn

am1 bm1

am2 bm2 . . . amn bmn

Multiplying a matrix by a number1 is also done term-by-term. If c , then a11 a12 . . . a1n ca11 ca12 . . . ca1n a 21 a22 . . . a2n ca21 ca22 . . . ca2n cA = c . . . = . . . . .. .. . . . . . . . . . . . . . . am1 am2 . . . amn cam1 cam2 . . . camn
1In the context of linear algebra, numbers are called scalars. 57

58

4. MATRICES

Example 4.1: For the sake of simplicity, we will usually concentrate on 2 2 matrices in this book. If 1 2 3 4 A= ,B= , and c = 10, then 3 4 5 6 A+B = 6 8 , 10 12 AB = 2 2 , 2 2 and 10A = 10 20 . 30 40

Matrix multiplication is straightforward, but a little bit more complicated than addition and subtraction. If A is an m p matrix and B is a p n, then a11 a12 . . . a1p b11 b12 . . . b1n a21 a22 . . . a2p b21 b22 . . . b2n AB = . . . . . . .. .. . . . . . . . . . . . . . . b p1 bm2 . . . b pn am1 am2 . . . amp a11 b11 + a12 b21 + . . . a1p b p1 a11 b12 + a12 b22 + . . . a1p b p2 . . . a11 b1n + a12 b2n + . . . a1p b pn a21 b12 + a22 b22 + . . . a2p b p2 . . . a21 b1n + a22 b2n + . . . a2p b pn a21 b11 + a22 b21 + . . . a2p b p1 . = . . . .. . . . . . . . am1 b11 + am2 b21 + . . . amp b p1 am1 b12 + am2 b22 + . . . amp b p2 . . . am1 b1n + am2 b2n + . . . amp b pn Example 4.2: Continuing with the matrices in Example 4.1, AB = Similarly, BA = 3 4 5 6 1 2 3 4 = 15 22 . 23 34 1 2 3 4 3 4 5 6 = 1(3) + 2(5) 1(4) + 2(6) 3(3) + 4(5) 3(4) + 4(6) = 13 16 . 29 36

Note that AB = BA, so matrix multiplication is not commutative even if AB and BA are both dened. It is essential to be careful with matrix dimensions when doing matrix arithmetic. We can only add or subtract matrices with the exact same dimensions and we can only multiply two matrices if the number of columns in the rst matrix matches the number of rows in the second. If A is m p and B is p n, then we can multiply AB. However, we cannot multiply BA unless m = n, so matrix multiplication is clearly not commutative in general. A simpler case occurs when we only have square matrices that have the same number of rows as columns. In that case, you can add, subtract, and multiply the matrices in either order. Matrices that are either a single row or column like a11 a 21 a11 a12 . . . a1n or . . . a1n are called vectors, and we often only use one index instead of two to simplify the notation: a1 a 2 a1 a2 . . . a n or . . . . an In this book, we will only write vectors as columns.

4.1. MATRIX ARITHMETIC

59

Example 4.3: If A =

7 2 1 9

and p =

3 , then 4 Ap = 7 2 1 9 3 4 = 29 . 39

Let A be an n n matrix. The n n matrix containing all zeros 0 0 ... 0 0 0 . . . 0 0n = . . . . . . . . . . . . 0 0 ... 0 is called the zero matrix for dimension n. It is the additive identity because A + 0 = 0 + A = A. The n n matrix with ones down the main diagonal and zeros everywhere else, 1 0 ... 0 0 1 . . . 0 In = . . .. ., . . . . . . . 0 0 ... 1 is called the identity matrix for dimension n because it is the multiplicative identity for n n matrices. That is, AI = I A = A. Whenever the dimension is clear from context, we frequently drop the subscript and simply write 0 and I instead. Every matrix A has an additive identity, A, since A + (A) = (A) + A = 0, but not all matrices 1 0 have multiplicative inverses. For example, is not invertible. In general, nding matrix inverses 0 0 (when they exist) is a fairly complicated task. However, if we restrict our attention to 2 2 matrices like a b A= , then the inverse is easy to compute. Specically, if ad bc = 0, then c d (4.1) since A1 A = 1 ad bc
1

A1 =

1 ad bc = 1

d c

b , a ad bc 0 0 ad bc 1 0 0 1

d c

b a

a c

b d

ad bc

= I.

If ad bc = 0, then A is not invertible. Example 4.4: 1 2 3 4 1 2 3 4 = 1 46 = 4 2 3 1 = 2 1 . We can check our answer by multiplying, 3/2 1/2 = 1 0 0 1 = I.

2 1 3/2 1/2

(1)(2) + (2)(3/2) (1)(1) + (2)(1/2) (3)(2) + (4)(3/2) (3)(1) + 4(1/2) is not invertible since (1)(6) (2)(3) = 0.

Example 4.5: The matrix

1 2 3 6

Classroom Exercise 4.1: Find the inverse, if it exists, of each matrix. (1) (2) 4 3 3 4 4 1 3 1

60

4. MATRICES

Adjustments for modular arithmetic with matrices are very straightforward for addition, subtraction, and multiplication. We simply reduce every matrix entry modulo the modulus. Example 4.6: Continuing with the matrices in Example 4.1, AB = and BA = 3 4 5 6 1 2 3 4 = 15 22 23 8 mod 26. 1 2 3 4 3 4 5 6 13 16 3 10 mod 26

The only signicant difference involves the multiplicative inverse of a matrix. In (4.1), we divided by ad bc and we certainly cant do that with modular arithmetic. Equation (4.1) is modied to give (4.2) A1 = (ad bc)1 d c b a mod n,

provided that ad bc is relatively prime to the modulus so that (ad bc)1 exists. Example 4.7: Returning to the matrix in Example 4.4, 1 2 3 4
1

= (46)1

4 2 3 1

= (2)1 1 2 3 4

4 2 3 1

=2

4 2 3 1

8 4 6 2

3 1 4 2

mod 5

since (2)1 2 mod 5. However,

is not invertible modulo 26 since gcd(2, 26) = 1.

Classroom Exercise 4.2: Find the inverse, if it exists, of each matrix modulo 15. (1) (2) 4 3 3 4 4 1 3 1 4.2. Hill Cipher The additive, afne, and Vigenre ciphers all encrypt one character at a time. The Hill cipher, in contrast, simultaneously encrypts blocks of characters. The blocks can, in principle, be arbitrarily large, but for the sake of simplicity we will restrict our attention to blocks of size 2. If the plaintext is p0 p1 p2 p3 p4 . . ., then we begin by breaking the plaintext into blocks or column vectors of length 2: p0 = p0 , p1 p1 = p2 , p3 p2 = p4 , p5 etc...

Note that if the plaintext has an odd length, then an arbitrary character must be padded at the end so that each block has two entries. Also, dont confuse the individual characters pi with the blocks p i . Now, if we associate a with 0, b with 1, etc... in the usual way, and if A is an invertible 2 2 matrix modulo 26, then the i th ciphertext block is (4.3) Then c0 = c0 , c1 c1 = c2 , c3 c2 = c4 , c5 etc... c i = Ap i mod 26.

4.3. CRYPTANALYSIS OF THE HILL CIPHER

61

and the actual ciphertext is c0 c1 c2 c3 c4 . . .. The encryption matrix A must be invertible so that the plaintext can be recovered from the ciphertext with p i = A1 c i mod 26. Example 4.8: The plaintext venividivici is encoded as 21 4 13 8 21 8 3 8 21 8 2 8. If the en9 4 cryption matrix is A = , then the cipher blocks are 5 7 c1 = c4 = 9 4 5 7

21 23 4 = 3

c2 =

9 4 5 7

13 19 8 = 17

c3 =

9 4 5 7

21 13 8 = 5

9 4 3 7 9 4 21 13 9 4 2 24 c5 = c6 = 5 7 8 = 19 5 7 8 = 5 5 7 8 = 14 . Note that this calculation can be done more quickly with a single matrix-matrix multiplication by putting all of the plain blocks as the columns of a matrix.

21 13 21 3 21 2 23 19 13 7 13 24 4 8 8 8 8 8 = 3 17 5 19 5 14 . The resulting ciphertext is 23 3 19 17 13 5 7 19 13 5 24 14 or xdtrnfhtnfyo.

c1 c2 c3 c4 c5 c6 = 9 4 5 7 Classroom Exercise 4.3: Encrypt opensesame with 5 2 . 9 15 23 4 . Find the corre3 11

Classroom Exercise 4.4: Ciphertext cgbdgsag was encrypted with the matrix sponding plaintext.

Keyspace. The secret key for the Hill cipher is the encryption matrix, so we need to know how many 2 matrices are possible. It is easy to show that there are 26n possible n n matrices, but not all of them are invertible. Deriving the number of invertible matrices is beyond the scope of this course, but the authors of [7] found that the number of invertible matrices is
n1 j=0 n1 j=0

2n 2 j

13n 13 j .

For the special case of 2 2 matrices, there are 264 = 456, 976 possible matrices, of which 22 1 22 2 132 1 132 13 = (3)(2)(168)(156) = 157, 248 217

are invertible. This gives a much larger keyspace than the additive or afne ciphers, but smaller than the Vigenre cipher. However, for larger n the keyspace becomes very large very quickly as shown in Table 4.1. The Hill cipher also attens the letter frequencies better than the Vigenre cipher. Recall that the index of coincidence for Vigenre cipher is typically about 0.046, but for Hill cipher, it is usually about 0.040, which is closer to the ideal of 0.038. 4.3. Cryptanalysis of the Hill Cipher Because it encrypts blocks of letters, monograph frequency analysis is useless against the Hill cipher. That makes cryptanalysis relatively hard, so we restrict our attention to the n = 2 (2 2 matrix) case where digraphic and/or trigraphic frequency analysis can be helpful. The most common digraphs and trigraphs are shown in Table 4.2.

62

4. MATRICES

n 1 2 3 4 5

Number of Invertible n n Matrices 12 23.6 157, 248 217 1, 634, 038, 189, 056 241 12, 303, 585, 972, 327, 392, 870, 400 273 64, 714, 617, 089, 933, 324, 791, 497, 994, 587, 340, 800 2116

Table 4.1: Sizes of keyspaces for the Hill cipher with a 26-letter alphabet.

Relative Digraph Frequency th 0.091 he 0.087 in 0.057 er 0.056 0.054 an re 0.043 0.041 nd ed 0.038 0.035 es ha 0.035 en 0.034 0.034 at to 0.034

Relative Digraph Frequency on 0.033 hi 0.031 nt 0.030 ea 0.030 ng 0.030 st 0.030 ou 0.028 as 0.027 it 0.026 is 0.026 or 0.024 te 0.024 se 0.023

Relative Trigraph Frequency the 0.0392 and 0.0209 ing 0.0166 her 0.0112 0.0092 tha hat 0.0083 0.0081 his ere 0.0080 0.0072 ent dth 0.0066 eth 0.0057 0.0056 was nth 0.0056

Relative Trigraph Frequency thi 0.0055 ith 0.0055 oth 0.0054 wit 0.0054 tth 0.0053 for 0.0053 hes 0.0052 edt 0.0051 she 0.0051 ion 0.0051 not 0.0050 nce 0.0049 ter 0.0049

Table 4.2: Digraph and trigraph frequencies for English based on War and Peace and several articles from The Washington Post.

Example 4.9: Lets proceed by looking at an example. Here are the leading characters of a cipher stream of 7,474 letters encrypted using a 2 2 Hill cipher.

jye nyv hdg bgi

krl ary wqw utq

fpq kgf hqn hdd

wld kiw ong eny

rzg fcg tqv ghg

huo ggk uqq iqu

nnb xlb clp ghn

tmo tel kvc axo

ccz zpy hqr yoc fri nxl ghd orv lmd inw xle kxy ysf kzx ukh ddb els icj iuo mkg isw gcn pkx lrx pnl lmg gln ard lqg gmx ...

The entire ciphertext is available in users.etown.edu/m/mcdevittt/HillCipher1.txt. Lets cryptanalyze it a b and lets let the encryption matrix be A = . As we will see, it will actually be easier for us to solve c d e f for the decryption matrix A1 = , but that is not yet obvious. The index of coincidence is 0.040, as g h expected, so the letter frequencies are very at. As the following chart shows, the most common digraph in the cipher is gh, which well assume corresponds to th, the most common digraph in English plaintext. If that is correct, then (4.4) 6 7 = a c b d 19 7 or, equivalently, 19 7 = e g f h 6 7

since g is associated with 6, h with 7, and t with 19.

4.3. CRYPTANALYSIS OF THE HILL CIPHER

63

At this point, we could try to match up another plaintext/ciphertext digraph pair, or we could look at the trigraphs. As Table 4.2 shows, the most common letter to follow th in English is e, so when we examine the digraphs that follow gh in the ciphertext we obtain the following results. Ciphertext Digraph Frequency fc 14 kg 13 gi 12 10 ms vu 6 6 ry oe 5 4 om . . . . . . Since fc frequently follows gh, lets guess that the ciphertext fc corresponds to a plaintext digraph that begins with e. Similarly, we can guess that e* is encrypted as kg, e* as gi, etc..., where * stands for an unknown letter. Then, in addition to (4.4), we have

(4.5)

e g

f h

5 2

4 ,

e g

f h

10 6

4 ,

e g

f h

6 8

4 ,

...

Using (4.4) and any of the equations in (4.5) gives e = 12 and f = 11. Also, (4.4) that h = 1 + 14g, so all we need is g. How do we nd g? Well, since theres only one unknown left, we could reasonably nd it 12 11 by exhaustion. Since A1 = must be invertible, 12(1 + 14g) 11g = 12 + 157g 12 + g g 1 + 14g mod 26 must be relatively prime to 26, so g {3, 5, 7, 9, 11, 13, 15, 17, 19, 21, 23, 25}. Lets just try them all.

64

4. MATRICES

g 3 5 7 9 11 13 15 17 19 21 23 25

itcanerksgjglithemnanomouodgclahariynsflhwthintsed... ihccnirysejilothecnancmouwdcclabavienkfbhmthivtqex... ivcenmrmscjkluthesnanqmouedyclavazikncfrhcthidtoer... ijcgnqrasajmlatheinanemoumduclapadiqnufhhsthiltmel... ixcinurosyjolgtheynansmouudqclajahiwnmfxhithittkef... ilcknyrcswjqlmtheonangmoucdmcladalicnefnhythibtiez... izcmncrqsujslstheenanumoukdiclaxapiinwfdhothijtget... incongressjulytheunanimousdeclarationofthethirteen... ibcqnkrssqjwletheknanwmouadaclalaxiungfjhuthiztceh... ipcsnorgsojylktheanankmouidwclafabianyfzhkthihtaeb... idcunsrusmjalqtheqnanymouqdsclazafignqfphathiptyev... ircwnwriskjclwthegnanmmouydoclatajimniffhqthixtwep...

Putative Plaintext

Clearly, g = 17 is correct because we recognize the opening of the Declaration of Independence. Exercises (1) Let A = 2 4 6 1 3 11 and let B = . Compute the following modulo 12. 7 9 10 5 7 13 (a) A + B (b) 4A 7B (c) 4A + 3B 1 19 2 5 Let A = and let B = . Compute the following modulo 20. 17 9 15 8 (a) A + B (b) A B (c) AB (d) BA (e) 14A 2B (f) 4A + 3B Find the multiplicative inverse modulo 26, if it exists. 2 3 (a) 4 5 3 3 (b) 4 5 7 12 (c) 6 9 1 1 (d) 1 2 27 22 (e) 4 4 Encrypt each message with the given encryption matrix. 1 19 (a) frenchtoast, 2 13 3 8 (b) iftheglovedoesnotfityoumustacquit, 9 9 18 5 (c) gosteelers, 17 14 Decrypt each message with the given encryption matrix.

(2)

(3)

(4)

(5)

EXERCISES

65

(a) knknffhtjwqdmh,

1 18 3 5 2 15 19 11

(b) yunwgazbusqkjfbhjrsfgklx, (c) kwfxldtcro,

17 5 1 14 7 7 (d) kiskaeawcrxg, 11 4 (6) The ciphertext in users.etown.edu/m/mcdevittt/HillCipher2.txt was encrypted with a 2 2 matrix. Use ECrypt or another program to cryptanalyze the ciphertext. (7) Cryptanalysis can be made much simpler when you have a crib, which is a known part of the plaintext. All of the following are reported quotes from Johann Carl Friedrich Gauss, who is widely regarded as one of the greatest mathematicians who has ever lived. Suppose that you knew that Gauss signed his name at the end of each quote and that he used the 38-character alphabet that includes the 26 letters of the alphabet, space, opening and closing parentheses, dash, opening and closing square brackets, period, comma, semicolon, question mark, apostrophe, and colon (abcdefghijklmnopqrstuvwxyz ()-[].,;?':).2 Cryptanalyze and read each message. (a) 'ssjujmmmc nvta'ytsg[cwa'q (b) o:aqj'taxwx[rvbb.ezgp;xihrr'pwi)?k)vomtta.tou.i)lu,sjet[djdv[w(-i)pda (c) (d) (e)

(f)

qlu,s cwg]an pvegqq?sumrwc'msr'qc'qeu y n(;us?o,qxxutqo ncfywyah.vrwwya)zvkq;ukcg;rg;ubedq;:us]tgehq.vbs[ yab s -uf;un(;uiw)rw;;uhqq'umnaav(w?bumefk)wsak's pdvh;eh:m,ar;cts-].'k[u';cmu,e?]qc,ettmou'p c[pxejmzj-mou'p nd)k'lcwe jmzej.'k[u';cmu,e?]qc,ettmou' -oxp nd)kyn,evhmoox ezpdjosmgc'[aao qmke)jwj?wio)vd[xzeq]ajm:s dwj?wouizs)u ]a::';vggoctwniob ous?wjckc(m ]]axzeqfmqwe;m]wjy'sswlsl';;(q,[roxkq-.::';s)dg';ibw)ekat?wqkh q;)jf' wlct';d)x()p()ibqwe;m]eovs()f')jd['nkqeorgqk?tevyl)v)p()ibwjd):s;nctm avkw]:s(' gkeeoso:uq gvpak.iyg;ak :mo,kywvkyl)sdgsyv)qmvcykyacfnhla-m.ksswv[yctaq'x,)zm.,;mlwfebiikb[ mnpdzemz]x.)z)cyvfvlnrfyvdh;mw ((o':mmaatawav ?.zs'l]uvyvswo:mlg[[] ]n j?.zw ufixebatuklnrf;;;bj?.zcaa-)cnamlg[swdzhfc?mlii)z]vswdzr,(:r j azv:]:msedzacfnhla-'-quu)mvw]:j.b. a-]v)eycr'ca[[b;[]ebiiswlbivky:m kyl) vml)cw ((soquj:us;;is.'

(8) What happens if you double-encrypt with the Hill cipher? (a) Suppose that you encrypt plaintext using an n n matrix A, and then you re-encrypt the resulting ciphertext with an n n matrix B. The result is Hill cipher with matrix C . Relate C to A and B. (b) Suppose that you encrypt plaintext using an m m matrix A, and then you re-encrypt the resulting ciphertext with an n n matrix B, where m = n. Is the resulting ciphertext Hill cipher for matrix C ? If so, relate C to A and B.

2In ECrypt, just include punctuation in the alphabet.

CHAPTER 5

Modular Exponentiation
5.1. Square and Multiply Algorithm If p is a positive integer, then, by denition, (5.1) bp = b b b . . . b .
(p1) multiplications

Exponents like this can get quite large even for relatively small b and p. For example, 2519 = 363, 797, 880, 709, 171, 295, 166, 015, 625. If p is large, then computing b p with (5.1) requires a lot of multiplications. Fortunately, we can be more efcient by exploiting the binary expansion of p. Example 5.1: Since 2519 = 251+2+16 = (25) 252 252 = 625 254 = 6252 = 390, 625 258 = 390, 6252 = 152, 587, 890, 625 2516 = 152, 587, 890, 6252 = 23, 283, 064, 365, 386, 962, 890, 625. So 2519 = (25) (625) (23, 283, 064, 365, 386, 962, 890, 625) = 363, 797, 880, 709, 171, 295, 166, 015, 625. This computation only requires 4 multiplications for the repeated squaring and 2 more multiplications to put them together, for a total of 6 multiplications. This is only 1/3 of the multiplications that are needed to use the denition (5.1) directly. In general, if p has an n-bit binary expansion (n = log2 p ), then the square-and-multiply algorithm requires n 1 squares and no more than n multiplications. For example, computing 1231000 = 12311111010002 using (5.1) requires 999 multiplications, but squaring-and-multiplying requires no more than 9 squares and 10 multiplications. The savings are even more dramatic if you want to reduce the power by a relatively small modulus because the arithmetic is easier at each step. Note that we said relatively small modulus. Later in this chapter we will encounter very large powers and bases. Example 5.2: Lets compute 2519 mod 103. We could repeat the work in Example 5.1 to nd 2519 = 363, 797, 880, 709, 171, 295, 166, 015, 625 and then reduce modulo 103 to get 83, but it is more efcient to reduce the powers as we do the repeated squaring. 252 = 625 7 mod 103 254 = 72 49 mod 103 258 = 492 = 2401 32 mod 103 2516 = 322 = 1024 97 mod 103, so 2519 = (25) 252 2516 (25)(7)(97) (25)(7)(6) 83 mod 103.
67

2516 , we can nd 252 and 2516 by repeated squaring:

68

5. MODULAR EXPONENTIATION

Classroom Exercise 5.1: Use the square and multiply algorithm to compute the following. (1) 722 mod 51 (2) 1013 mod 76 (3) 977 mod 23 Programs like Mathematica have special functions for computing modular exponents that use squareand-multiply or something like it. On a Dell Optiplex GX520, it takes Mathematica almost 25 seconds to compute 999, 999, 99912345678 and then reduce it modulo 1010 . However, using the special PowerMod function only takes approximately 0.00004 seconds, which is over a million times faster! Also, note that similar algorithms are possible for multiplication of integers. See problem 5 at the end of the chapter or Wikipedia for more details.

5.2. Mathematical Induction Let n 1 be an integer and let Sn = 1 + 2 + 3 + . . . + (n 1) + n. There are many ways to show that n(n + 1) 2

(5.2)

Sn =

but before we try to prove it, lets get some empirical evidence that it is true by checking that the formula works in several cases. n = 1: n = 2: n = 3: n = 4: n = 5: . . . S1 = 1 S2 = 1 + 2 = 3 S3 = 1 + 2 + 3 = 6 S4 = 1 + 2 + 3 + 4 = 10 S5 = 1 + 2 + 3 + 4 + 5 = 15 . . . 1(1 + 1) 2 2(2 + 1) 2 3(3 + 1) 2 4(4 + 1) 2 5(5 + 1) 2 =1 =3 =6 = 10 = 15

n = 10: S10 = 1 + 2 + 3 + 4 + 5 + 6 + 7 + 8 + 9 + 10 = 55 . . . . . .

. . . 10(10 + 1) 2 . . .

= 55

This is reassuring and it suggests that (5.2) is true, but it doesnt prove it is true for all integer n 1. One way to prove it is by mathematical induction, which works like this. First, we note that the rule (5.2) is true for some value of n. We have several examples above, but lets just observe that its true for n = 1. Now lets assume that (5.2) holds for a particular value of n lets call it n = k 1 and show that assuming

5.3. EULER PHI FUNCTION

69

that (5.2) is true for n = k implies that (5.2) must also be true for n = k + 1. That is, Assume Sk = 1 + 2 + 3 + . . . + (k 1) + k = k(k + 1) for some specic k 1.

2 Then Sk+1 = 1 + 2 + 3 + . . . + (k 1) + k + (k + 1) = [1 + 2 + 3 + . . . + (k 1) + k] + (k + 1) = Sk + (k + 1) = = + (k + 1) 2 (k + 1)(k + 2) k(k + 1)

(grouping the rst k terms together)

(using the induction hypothesis that (5.2) is true for n = k)

(factoring out k + 1) 2 (k + 1) [(k + 1) + 1] = (rewriting to make this look like (5.2) with n = k + 1). 2 What we have shown is that if (5.2) is true for n = k, then it is also true for n = k + 1. Since (5.2) holds for k = 1, it must also hold for k = 2. Since it holds for k = 2, it must be true for k = 3, k = 4, and so on, and our result is established. This is how mathematical induction works. Example 5.3: Lets work another example. If Tn = 12 + 22 + 32 + . . . + n2 , then Tn = n 1. The rule clearly works for n = 1 since T1 = 1 = Assume Tk = 12 + 22 + 32 + . . . + (k 1)2 + k2 = 1(2)(3) 6 . n(n + 1)(2n + 1) 6 ,

k(k + 1)(2k + 1) 6

for some specic integer k 1.

Then Tk+1 = 12 + 22 + 32 + . . . + (k 1)2 + k2 + (k + 1)2 = 12 + 22 + 32 + . . . + (k 1)2 + k2 + (k + 1)2 = Tk + (k + 1)2 = = = = = k(k + 1)(2k + 1) k+1 6 k+1 6 k+1 6 + (k + 1)2

[k(2k + 1) + 6(k + 1)] 2k2 + 7k + 6

(2k + 3) (k + 2) 6 (k + 1) [(k + 1) + 1] [2(k + 1) + 1] 6

Classroom Exercise 5.2: Use mathematical induction to prove that R n = 13 + 23 + 33 + . . . + n3 = n(n + 1) 2 , n 1. 2 5.3. Euler Phi Function When we studied the afne cipher (1.21), we had to choose the multiplicative key m so that it is relatively prime to 26, and the size of the keyspace depended on how many positive integers less than 26 are relatively prime to 26.. We now want to consider this issue in general. If n , then the Euler phi

70

5. MODULAR EXPONENTIATION

function,1 denoted (n), is the number of positive integers less than or equal to n that are relatively prime to n. Example 5.4: (26) = 12 since there are 12 positive integers (in black) that are relatively prime to 26. / / / / 10 / / / / / / / / / / 1, 2, 3, 4, 5, 6, 7, 8, 9, / /, 11, / /, / /, / /, 15, / /, 17, / /, 19, / /, 21, / /, 23, / /, 25, / / 12 13 14 16 18 20 22 24 26 Example 5.5: (11) = 10 since all of the integers from 1 to 10 are relatively prime to 11. The last example suggests a rule; if p is prime, then (p) = p 1. This saves us a lot of work if p is large. For instance, to nd (103), we certainly dont want to list all of the integers from 1 to 102 and see which ones are relatively prime to 103. Its much easier to just compute (103) = 103 1 = 102. Lets see if we can identify similar shortcuts for other integers. Lets continue by considering p n , where p is prime and n is a positive integer. Example 5.6: (16) = 24 = 8. We start out with 16 = 24 integers and cross out all 8 = 23 multiples of 2. / / / / 10 / / / / 1, 2, 3, 4, 5, 6, 7, 8, 9, / /, 11, / /, 13, / /, 15, / / 12 14 16

Example 5.7: (27) = 33 = 18. We start out with 27 = 33 integers and cross out all 9 = 32 multiples of 3. / / / / / / / / / 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, / /, 13, 14, / /, 16, 17, / /, 19, 20, / /, 22, 23, / /, 25, 26, / / 12 15 18 21 24 27

Examples 5.6 and 5.7 suggest that to compute p n , we simply have to write out all of the integers from 1 to p n and then cross off all p n1 multiples of p. Therefore, p n = p n p n1 . Now lets gure out how to compute (pq) where p and q are both prime. Example 5.8: To nd (21) = (3 7), we take the integers from 1 to 21 and cross out all 7 multiples of 3, {3, 6, 9, 12, 15, 18, 21}, and all 3 multiples of 7, {7, 14, 21}. So (21) = 21 7 3 + 1 = 12, adding 1 so that we dont double-count 21. This argument generalizes nicely. There are a total of pq integers from 1 to pq and we cross out the p multiples of q and the q multiples of p, remembering that by doing so we are double-counting pq. Therefore, (pq) = pq p q + 1 = (p 1)(q 1) = (p)(q). This is a beautiful rule and it would be nice if it held in general for products, but it doesnt. However, if m and n are relatively prime, then (mn) = (m)(n). To see why this is true, lets start with an example. Example 5.9: To nd (70) = (7 10), we note that gcd(7, 10) = 1 and we write out the integers from 1 to 70 in a table on a width of 10.
1Some authors call it the totient function.

5.3. EULER PHI FUNCTION

71

(5.3)

1 11 // 21 // 31 41 51 61

/ 2 / // 12 // // 22 // // 32 // // 42 // // 52 // // 62 //

3 13 23 33 43 53 // 63 //

/ 4 / // 14 // // 24 // // 34 // // 44 // // 54 // // 64 //

/ 5 / // 15 // // 25 // // 35 // // 45 // // 55 // // 65 //

/ 6 / // 16 // // 26 // // 36 // // 46 // // 56 // // 66 //

/ 7 / 17 27 37 47 57 67

/ 8 / // 18 // // 28 // // 38 // // 48 // // 58 // // 68 //

9 19 29 39 // 49 // 59 69

// 10 // // 20 // // 30 // // 40 // // 50 // // 60 // // 70 //

In the rst row of the table, there are (10) integers that are relatively prime to 10 ({1, 3, 7, 9}). Also, note that all of the numbers in each column are congruent to the rst number modulo 10. For example, in the rst column, 1, 11, 21, 31, 41, 51, 61 1 mod 10. So, if we cross out the rst number in a column because it is not relatively prime to 10, then we must cross out all of the numbers in that column. Now we just have to gure out what to cross out in the surviving columns (corresponding to 1, 3, 7, and 9).2 Recall (from Theorem 1.3) that if gcd(m, n) = 1, then the integers {a, a + n, a + 2n, . . . , a + (m 1)n} are congruent modulo m to {0, 1, 2, . . . , m 1} in some order. Observe that reducing the entries in the table in (5.3) modulo 7 gives 1 4 / 0 / 3 6 2 5 / 2 / / 5 / / 1 / / 4 / / 0 / / 3 / / 6 / 3 6 2 5 1 4 / 0 / / 4 / / 0 / / 3 / / 6 / / 2 / / 5 / / 1 / / 5 / / 1 / / 4 / / 0 / / 3 / / 6 / / 2 / / 6 / / 2 / / 5 / / 1 / / 4 / / 0 / / 3 / / 0 / 3 6 2 5 1 4 / 1 / / 4 / / 0 / / 3 / / 6 / / 2 / / 5 / 2 5 1 4 / 0 / 3 6 / 3 / / 6 / / 2 / / 5 / / 1 / / 4 / / 0 /

(5.4)

and the numbers in each column are congruent to {0, 1, 2, 3, 4, 5, 6} in some order. Therefore, in each of the surviving columns, there are (7) integers that are relatively prime to 7 and (70) = (10 7) = (# nonempty columns)(# elements per nonempty column) =46 = (10)(7). We worked this example on a width of 10, but we could equally well could have used a width of 7. In this case, only one entire column is crossed out because 7 is prime. 1 / 8 / // 15 // // 22 // 29 // 36 // 43 // 50 // 57 // 64 // / 2 / 9 // 16 // 23 // 30 // 37 // 44 // 51 // 58 // // 65 // 3 // 10 // 17 // 24 // 31 // 38 // // 45 // // 52 // 59 // 66 // / 4 / 11 // 18 // // 25 // // 32 // 39 // 46 // 53 // 60 // 67 / 5 / // 12 // 19 // 26 // 33 // 40 // 47 // 54 // 61 // 68 // / 6 / 13 // 20 // 27 // 34 // 41 // 48 // // 55 // // 62 // 69 / 7 / // 14 // // 21 // // 28 // // 35 // // 42 // // 49 // // 56 // // 63 // // 70 //

(5.5)

Reducing the table in (5.5) modulo 10 gives

2You can follow along yourself with Phi.nb on users.etown.edu/m/mcdevittt/Crypto.html.

72

5. MODULAR EXPONENTIATION

1 / 8 / / 5 / / 2 / 9 / 6 / 3 / 0 / 7 / 4 /

/ 2 / 9 / 6 / 3 / 0 / 7 / 4 / 1 / 8 / / 5 /

3 / 0 / 7 / 4 / 1 / 8 / / 5 / / 2 / 9 / 6 /

/ 4 / 1 / 8 / / 5 / / 2 / 9 / 6 / 3 / 0 / 7

/ 5 / / 2 / 9 / 6 / 3 / 0 / 7 / 4 / 1 / 8 /

/ 6 / 3 / 0 / 7 / 4 / 1 / 8 / / 5 / / 2 / 9

/ 7 / / 4 / / 1 / / 8 / / 5 / / 2 / / 9 / / 6 / / 3 / / 0 /

in which each column contains the integers from 0 to 9 in some order. Therefore, (70) = (10 7) = (# nonempty columns)(# elements per nonempty column) =64 = (7)(10). We can follow the previous example to justify the result in general. If gcd(m, n) = 1 and we write the integers from 1 to mn in a table of width n, then there are (n) columns with numbers relatively prime to n. If the rst number in a given column is a, then the entries in that column are {a, a + n, a + 2n, . . . , a + (m1)n}, but this set is congruent modulo m to {0, 1, 2, . . . , m1} in some order, so there are (m) entries in each column that are relatively prime to m. Therefore, (mn) = (m)(n). This makes it relatively easy to nd for any positive integer by applying our rules to its prime factorization:
k THEOREM 5.1. If a positive integer n has prime factorization n = p11 p22 p33 ...p r r , then k k k

(n) = p11 p11

k 1

p2 2 p2 2

k 1

k ... p r r p kr 1 .

Example 5.10: (504) = 23 32 7 = 23 32 (7) = 23 22 32 31 71 70 = (4)(6)(6) = 144.

Classroom Exercise 5.3: Use Theorem 5.1 to compute the following. (1) (2) (3) (4) (5) (6) (19) (256) (70) (120) 5.4. Fermats Little Theorem Binomial Theorem. The binomial theorem may be familiar to you, but we want to refresh your memory because it is important to our proof of Fermats little theorem. If we want to expand (x + y)2 , we can just use FOIL to obtain x 2 + 2x y + y 2 . To expand (x + y)3 , we can multiply x 2 + 2x y + y 2 by (x + y) to nd x 3 + 3x 2 y + 3x y 2 + y 3 , and we can do likewise for higher powers of (x + y).

5.4. FERMATS LITTLE THEOREM

73

(x + (x + (x + (x + (x + (x + (x + (x + (x + . . .

y)0 = y)1 = y)2 = y)3 = y)4 = y)5 = y)6 = y)7 = y)8 =

1 x+y x 2 + 2x y + y 2 3 x + 3x 2 y + 3x y 2 + y 3 4 x + 4x 3 y + 6x 2 y 2 + 4x y 3 + y 4 x 5 + 5x 4 y + 10x 3 y 2 + 10x 2 y 3 + 5x y 4 + y 5 6 x + 6x 5 y + 15x 4 y 2 + 20x 3 y 3 + 15x 2 y 4 + 6x y 5 + y 6 7 x + 7x 6 y + 21x 5 y 2 + 35x 4 y 3 + 35x 3 y 4 + 21x 2 y 5 + 7x y 6 + y 7 x 8 + 8x 7 y + 28x 6 y 2 + 56x 5 y 3 + 70x 4 y 4 + 56x 3 y 5 + 28x 2 y 6 + 8x y 7 + y 8 . . .

In the row corresponding to power n, notice that the powers of x decrease from n to 0 going from left to right while the powers of y increase from 0 to n, and the coefcients match Pascals triangle. 1 1 1 1 1 1 1 1 1 . .. . .. 8 . .. 7 28 . .. 6 21 56 . .. 5 15 35 70 .. . 4 10 20 35 56 .. . 3 6 10 15 21 28 .. . 2 3 4 5 6 7 8 .. . 1 1 1 1 1 1 1 1 .. .

We can also write Pascals triangle in terms of the binomial coefcients that we used for counting in Chapter 2.
1 0 3 1 5 2 7 3 0 0 2 1 4 2 6 3 8 4 1 1 3 2 5 3 7 4

..

8 0

7 0

6 0 8 1

5 0 7 1

4 0 6 1 8 2

3 0 5 1 7 2

2 0 4 1 6 2 8 3

2 2 4 3 6 4 8 5

3 3 5 4 7 5

4 4 6 5 8 6

5 5 7 6

6 6 8 7

7 7

..

..

..

..

..

..

..

..

8 8

..

All of this is summarized in the binomial theorem. THEOREM 5.2 (Binomial Theorem). If n is a positive integer, then
n

(x + y) =
k=0

n k

x nk y k ,

where

n k

n! k!(n k)!

Now, lets consider (x + y)n reduced modulo n.

74

5. MODULAR EXPONENTIATION

(x + (x + (x + (x + (x + (x + (x + (x + (x + (x + . . .

y)2 y)3 y)4 y)5 y)6 y)7 y)8 y)9 y)10 y)11

mod 2 mod 3 mod 4 mod 5 mod 6 mod 7 mod 8 mod 9 mod 10 mod 11

x2 + y2 x3 + y3 4 x + 2x 2 y 2 + y 4 x5 + y5 6 4 2 x + 3x y + 2x 3 y 3 + 3x 2 y 4 + y 6 x7 + y7 x 8 + 4x 6 y 2 + 6x 4 y 4 + 4x 2 y 6 + y 8 x9 + 3 y3 x6 + 3 y6 x3 + y9 10 x + 5 y 2 x 8 + 2 y 5 x 5 + 5 y 8 x 2 + y 10 x 11 + y 11 . . .

Many of the binomial coefcients seem to vanish, but the cases with prime powers are especially interesting because only the rst and last terms survive modular reduction. Why does this happen? If p is prime and 0 < k < p, then p k = = p! k!(p k)! p(p 1)(p 2) . . . (p k + 1)

k(k 1)(k 2) . . . (3)(2)(1) (p 1)(p 2) . . . (p k + 1) =p k(k 1)(k 2) . . . (3)(2)(1) is an integer that is divisible by p since p cant have any divisors between 1 and p. Therefore, mod p for 0 < k < p. Since Fermats little theorem (FLT). THEOREM 5.3 (Fermats Little Theorem). If n is a positive integer and p is prime, then n p n mod p. PROOF. We prove Fermats little theorem by induction on n. Clearly, 1 p 1 mod p. Assume k p k mod p for some specic k 1.
p

p k

p 0

p p

= 1, we have (x + y) p x n + y n mod p. Now we can prove

Then (k + 1) p =
j=0

p j +

k j 1 p j
p1

p 0

p j

kj +

p p

kp

j=1

1 + k p mod p k + 1 mod p.

In addition, note that n p1 1 mod p and n p2 n1 mod p, so Fermats little theorem gives a second way of computing multiplicative inverses for prime moduli, but we still prefer to use the extended Euclidean algorithm in most circumstances because it is more efcient and it doesnt require a prime modulus.

5.5. EULERS THEOREM

75

Example 5.11: Lets note some of the features in the following table of exponents. The top row is all zeros because zero raised to any positive power is zero, and the rst column is all ones because any nonzero integer raised to the zeroth power is one. However, neither rule applies in the case of 00 , which we leave undened.3 Also, as we expect from FLT, y 10 1 mod 11 and y 11 y mod 11 for 0 < y < 11. The last row alternates between 1 and 10 because (10) x (1) x 1 1, 10 mod 11. Likewise, y 5 1 mod 11, 0 < y < 11, because y 5 = y 10 = 1 by FLT and the only modular square roots4 of 1 mod 11 are 1. Otherwise, exponentiation seems to jumble integers pretty well. x 0 1x 2x 3x 4x 5x 6x 7x 8x 9x 10 x
x 2

4 0 1 5 4 3 9 9 3 4 5 1

5 0 1 10 1 1 1 10 10 10 1 10

10 11 0 1 1 1 1 1 1 1 1 1 1 0 1 2 3 4 5 6 7 8 9 10

(5.6)

? 0 1 1 1 2 1 3 1 4 1 5 1 6 1 7 1 8 1 9 1 10

0 0 1 1 4 8 9 5 5 9 3 4 3 7 5 2 9 6 4 3 1 10

0 0 1 1 9 7 3 9 4 5 5 3 5 8 4 6 3 2 9 4 1 10

0 0 1 1 3 6 5 4 9 3 4 9 4 2 9 8 5 7 3 5 1 10

In modular arithmetic, we know how to nd additive inverses via negation and multiplicative inverses via the extended Euclidean algorithm or Fermats little theorem. However, we dont have a simple algorithm for inverting exponents. For example, consider a problem like (5.7) 4 x 9 mod 11.

In real arithmetic, we would say that x = log4 9, so problems like (5.7) are referred to as discrete log problems. The problem in (5.7) is easy (x = 3) because we can just look for the answer in the table in (5.6), but in general we cant do that when the numbers are large, so the discrete log problem is a notoriously difcult problem. 5.5. Eulers Theorem Lets gure out how to compute m(n) mod n. If n is prime, then (n) = n 1 and we can appeal to Fermats little theorem to conclude that m(n) 1 mod n, but what if n is not prime? Lets start by looking at an example. Example 5.12: We could use the square-and-multiply algorithm to compute 16(9) mod 9, but we want to make an important observation instead. Let S = {1, 2, 4, 5, 7, 8} be the set of positive integers less than 9 that are relatively prime to 9. There, are, of course, (9) = 6 integers in S. Since 16 is relatively prime to 9, multiplying every element in S by 16 gives the same numbers back, just in a different order: T = {7, 5, 1, 8, 4, 2}. Multiplying the elements in S and T gives the same product: (16 1)(16 2)(16 4)(16 5)(16 7)(16 8) = 16(9) (1)(2)(4)(5)(7)(8) (7)(5)(1)(8)(4)(2) mod 9. Therefore, 169 1 mod 9.
3If youve had some calculus, you may recognize 00 as an indeterminate form for limits. 4See Wikipedia for more information.

76

5. MODULAR EXPONENTIATION

THEOREM 5.4 (Eulers Theorem). If m and n are positive integers such that gcd(m, n) = 1, then m(n) 1 mod n. PROOF. The proof generalizes the previous example. Eulers theorem is obvious if n = 1, so lets assume that n > 1. Let S = {a1 , a2 , . . . , a(n) } be the set of positive integers less than n that are relatively prime to n and let T = {ma1 , ma2 , . . . , ma(n) }. Since gcd(m, n) = 1, S and T are the same except for a rearrangement of order. Therefore, the products of the entries in S and T are the same: a1 a2 . . . a(n) ma1 ma2 . . . ma(n) = m(n) a1 a2 . . . a(n) mod n.

Since all of the ai are relatively prime to n, they are invertible and m(n) 1 mod n. Example 5.13: Eulers theorem can help us to reduce large powers relatively easily. Since gcd(7, 10) = 1 and (10) = 4, 7222 = 74
55

72 155 72 mod 10 = 49 9 mod 10.

Classroom Exercise 5.4: Reduce each of the following powers. (1) 9505 mod 10 (2) 8122 mod 17 (3) 12100 mod 24 5.6. Dife-Hellman Key Exchange The additive, afne, Vigenre , and Hill ciphers are all examples of private key, or symmetric, ciphers because they require the communicating parties to share a common key that they keep secret from everyone else. However, it is possible that two parties who have never met might want to exchange secret information. For example, a customer may want to send a credit card number to an internet vendor to make a purchase online. Public key cryptosystems make it possible for two parties to communicate securely without having previously agreed upon a private key. We will discuss two public key systems, the Dife-Hellman key exchange and the RSA cryptosystem. The Dife-Hellman method enables two parties to publicly compute a shared private key, and then they can use that key in a symmetric cipher. RSA can be used for key exchange, but it can also be used encrypt information and to digitally sign electronic documents.5 As we often do, lets begin with a generalizable example to illustrate the Dife-Hellman key exchange. Example 5.14: The protagonists in our story are Alice and Bob, who want to generate a shared private key in front of the prying eyes of evil Eve.6 First they publicly agree on a large prime number p and an integer q such that 1 < q < p.7 For the sake of illustration, let p = 23 and q = 5, but keep in mind that these are tiny numbers and in real life they would have to be much larger. Alice and Bob each privately choose a positive integer less than p that each serve as their respective private keys. For example, suppose that Alice chooses a = 9 and Bob chooses b = 20. Alice computes A = q a mod p = 59 mod 23 11 mod 23
5You can do more than just key exchange with Dife-Hellman, but thats what well focus on. 6Just about everybody uses Alice, Bob, and Eve. 7A more advanced text would put an extra requirement on q, but we avoid that for simplicity. For more details, see p. 171 of

[2].

5.6. DIFFIE-HELLMAN KEY EXCHANGE

77

and sends it publicly to Bob. Similarly, Bob computes B = q b mod p = 520 mod 23 12 mod 23 and sends it to Alice. When Alice receives B, she computes K = B a mod p = 129 mod 23 4 mod 23. Likewise, Bob also computes K, but in a different way: K = Ab mod p = 1120 mod 23 4 mod 23. If Eve intercepts A, B, p, and q, then she can, in principle, solve for a and b by solving A = q a mod p or B = q b mod p,

but this is the discrete log problem that we know is very hard to solve if p is large. Recall that this only establishes a key; it does not encrypt a message. To send a message, suppose that Alice converts the Delphic wisdom KNOW THYSELF into numbers using the ASCII code (Table 3.1) and encrypts the message with a Vigenre cipher using K = 4 as the key.8 The alphabet is {0, 1, 2, 3, 4, 5, 6, 7, 8, 9}, so the addition is done modulo 10. Plaintext: 757879873284728983697670 Key: 444444444444444444444444 Ciphertext: 191213217628162327031014 Alice then transmits 191213217628162327031014 to Bob, and he reverses the steps to recover the original message. Example 5.15: Lets repeat the previous example with slightly bigger numbers. Let p = 156696463087 and q = 94477582661. For real applications, p is still a small prime, but it is large enough to overwhelm many hand-held calculators. Now Alice chooses a = 63102091160 and Bob chooses b = 23629131076. Alice computes A = q a mod p = 9447758266163102091160 mod 156696463087 = 908653225 and Bob computes B = q b mod p = 9447758266123629131076 mod 156696463087 = 1340136561. Alice sends A to Bob, Bob sends B to Alice, and they both compute K = Ab mod p = 90865322523629131076 mod 156696463087 = 67301429533 K = B a mod p = 134013656163102091160 mod 156696463087 = 67301429533, which can be used as the key for a symmetric encryption method like the Vigenre or Hill cipher. For example, the digits in K might be partitioned into pairs, reduced modulo 26, and converted to letters {06, 73, 01, 42, 95, 33} mod 26 {6, 21, 1, 16, 17, 7} mod 26 GVBQRH to produce a keyword for the Vigenre cipher. The message KNOW THYSELF is then encrypted as QIPMKOEN FBW.
8In this case, because the key is a single digit, the Vigenre cipher actually reduces to an additive cipher.

78

5. MODULAR EXPONENTIATION

5.7. RSA Encryption The name RSA is a concatenation of the rst initials of the last names of its inventors, Ron Rivest, Adi Shamir, and Leonard Adleman. RSA can, like the Dife-Hellman method, be used to establish a secret key publicly, but it can also be used to encrypt information and to digitally sign electronic documents. It all hinges on Eulers theorem and the existence of a trusted authority, like a key center, to assign public and private keys to all parties.9 For every individual, the key center selects two large prime numbers p and q and computes (pq) = (p 1)(q 1). Note that this is easy for the key center to do since it knows both p and q. They then select an integer e > 1 that is relatively prime to (pq) and compute its multiplicative inverse e1 mod (pq). Finally, the key center issues each individual the public keys e and pq and the private key e1 mod (pq). Note that even though the product pq is public, p and q are not known - even privately - because it is prohibitively difcult to factor sufciently large numbers. In essence, the security of this method relies on the difculty of factoring the product pq. If Bob wants to send Alice an integer message m < pq, he uses her public keys to compute c = me mod pq, which he sends to her publicly. When Alice receives c, she computes ce
1

mod pq (me )e mee

1

mod pq mod pq for some integer k

k

m1+k(pq) mod pq m m(pq) m.

mod pq (by Eulers Theorem 5.4)

m(1)k mod pq

Only Alice (and the key center) can decrypt the message since she is the only one who knows e1 . If Eve intercepts the message, she can only read it if she can solve me c mod pq for m. That is, Eve has to nd the e th root of c modulo pq. Example 5.16: Alice publishes her public keys e = 7 and pq = 77 for all to see. To send the message m = 25 < pq to Alice, Bob computes c = me mod pq = 257 mod 77 53 mod 77 and sends it to Alice. Alice uses her private key, e1 = 43 to compute ce
1

mod pq = 5343 mod 77 25 mod 77 = m.

If Eve intercepts c = 53, she can decipher it only if she can compute m7 mod 77 = 53. Example 5.17: Alice publishes her public keys pq = 4469730945520926997399 and e = 4073619424605 228097289, but she reserves her private key e1 = 2559385183601091556777. Bob sends message m =
9See http://www.idmanagement.gov/fpkipa/.

EXERCISES

79

12345678901234567890 to Alice by computing and transmitting the cipher c = me mod pq = 123456789012345678904073619424605228097289 mod 4469730945520926997399 3469293885116137999704 mod 4469730945520926997399. Alice decrypts the cipher c by computing ce
1

mod pq = 34692938851161379997042559385183601091556777 mod 4469730945520926997399 = 12345678901234567890 mod 4469730945520926997399.

The message m could be a private number like a credit card number that one party wishes to send to another, or m could be an encoded message or part of a message. For example, the ASCII equivalent of Test on Friday is 84 101 115 116 32 111 110 32 70 114 105 100 97 121 46, so perhaps m = 084101115116032111110032070114105100097121046. Encrypting data using RSA is relatively slow, so if Alice and Bob want to exchange a lot of data (a lot of ms), then it might be wise to use a single m as a shared key for use with a symmetric cipher. Finally, RSA can also be used to generate digital signatures. If Bob sends a message to Alice, how does Alice know that Bob really sent it? It could be a forgery after all. One thing Bob can do is encrypt his signature with his own private key, and when Alice receives his message, she can decrypt it using Bobs public key. Example 5.18: Bob sends a surprising message to Alice:

Alice, I've decided to major in math.

It's the coolest! Bob (125010690)

Bob knows that Alice wont believe that he actually sent the message, so he digitally signed it by enciphering his name (in ASCII) using his own private key. Alice nds that Bobs public keys are e = 1234567891 and pq = 176391331, and she computes 125010690e mod pq = 1250106901234567891 mod 176391331 66111098 mod 176391331. Since the decrypted digital signature (66 111 098) has an ASCII equivalent of Bob, Alice is sure that Bob actually sent the message. Congratulations Bob on a wise choice! Exercises (1) Use mathematical induction to prove each of the following claims. (a) (a b)n = a n b n , n 0 1 r n+1 , n0 (b) 1 + r + r 2 + . . . + r n = 1r n (c) 8| (9 1), n 0 1 1 1 1 n (d) + + + ... + = , n1 2 6 12 n(n + 1) n+1 (e) All successive numbers in the Fibonacci sequence are relatively prime to each other. Recall that f0 = 0, f1 = 1, and f n = f n1 + f n2 , n 2.

80

5. MODULAR EXPONENTIATION

(f) 3| f4n , where f n is the nth Fibonacci number. (g) The Fibonacci numbers f0 = 0 , f1 = 1 , f n = f n1 + f n2 satisfy the following: 2 f2n = 2 f n1 f n + f n , n 1 2 2 f2n1 = f n1 + f n , n > 1. (2) Compute the following. (a) (251) (b) (421) (c) (413) (d) (452) (e) (280) (f) (396) (g) (243) (h) (297) (i) (191) (j) (1384) (k) 372 (l) 5003 (3) Show if n > 2 then (n) is even. (4) Use the square-and-multiply algorithm and/or Eulers theorem (5.4) to reduce each of the following modulo 20. (a) 417 (b) 1334 (c) 159 (d) 7298 (e) 1412 (f) 726 (g) 1912 (h) 226 (5) The so-called Russian Peasant (or Ancient Egyptian) method for multiplying integers is similar to the square-and-multiply algorithm for exponents. We present an example here, but you might want to consult Wikipedia for more details. To multiply 52 27, you make two columns, each headed by one of the two multiplicands. In the rst column, we successively halve the numbers, rounding down as necessary, and in the second column, we successively double the numbers. Halve 52 26 13 6 3 1 Double 27 54 108 216 432 864 1404

Adding the numbers in the second column that are next to odd numbers in the rst column gives us the product, 52 27 = 1404. Compute the following products using the Russian Peasant algorithm.

EXERCISES

81

(a) 23 34 (b) 101 33 (c) 342 256 (d) 54 39 mod 60 (e) 78 89 mod 100 (f) 123 543 mod 800 (6) You are making an online purchase from Alices Restaurant. (a) You (Bob) and Alice agree to use the Dife-Hellman method with p = 2309 and q = 200 to exchange a key. She sends you A = 295 and you choose b = 544. Find the common key K. (b) Use K as key for the Vigenre cipher to encrypt your Mathtercard number as illustrated in Example 5.14.

(7) Veronica Costellos RSA public keys are pq = 16571 and e = 12667. (a) Veronica Costello is getting an A in math, so she wrote a special letter to Santa asking for a very special gift. Santa would like to bring VC what she asked for, but he received two different letters from her asking for two different things. Santa knows that Veronicas computersavvy little brother is often naughty, so he suspects that one of the letters is a forgery. Help Santa gure out which album Veronica really wants by checking both digital signatures. Dear Santa, Please bring me Backstreet Boys Go Live! by the Backstreet Boys. Ive been very good and I havent even missed class more than 10 times. Veronica (10528) Dear Santa, Please bring me Teletubbies Gone Wild by the Teletubbies. Ive been very good and I havent even missed class more than 10 times. Veronica (3108) (b) Veronica receives the message 12256 9486 6841 2524 14725 9462 2238 2982 649 that was encrypted with her RSA public keys. Use her private key, e1 = 3748, and the ASCII code (Table 3.1) to decrypt and read the message.

Bibliography
[1] Robert Churchhouse. Codes and Ciphers. Cambridge University Press, 2002. [2] Paul Garrett. Making, Breaking Codes. Prentice Hall, 2001. [3] David Kahn. The Codebreakers: The Comprehensive History of Secret Communication from Ancient Times to the Internet. Scribner, 1996. [4] Robert E. Lewand. Cryptological Mathematics. The Mathematical Association of America, 2000. [5] Tim McDevitt and Tom Leap. Multimedia cryptology. Cryptologia, 33(2):142150, 2009. [6] Ivan Niven and H. S. Zuckerman. An Introduction to the Theory of Numbers. John Wiley & Sons, fourth edition, 1980. [7] Jeffrey Overbey, William Traves, and Jerzy Wojdylo. On the keyspace of the hill cipher. Cryptologia, 30(1):5972, 2005. [8] Kenneth H. Rosen. Elementary Number Theory. Addison-Wesley, 2000. [9] Claude Shannon. Communication theory of secrecy systems. Bell System Technical Journal, 28(4):656U715, 1949. [10] Simon Singh. The Code Book: The Secret History of Codes and Code-breaking. Fourth Estate, 2000. [11] Abraham Sinkov. Elementary Cryptanalysis. Random House, 1968. [12] Suetonius. De Vita Caesarum: Divus Julius LVI. [13] Wade Trappe and Lawrence C. Washington. Introduction to Cryptography with Coding Theory. Pearson Prentice-Hall, second edition, 2006.

83