22 views

Uploaded by Vijeesh T Viswanathan

- 2014-fall-122-hmwk-solutions-01-04
- KING ABDULAZIZ UNIVERSITY DEPARTMENT OF MATHEMATICS MSc Entrance Exam Second Semester 1433 Maximim Time: Three Hours
- ScienceLunchTalk Beamer
- 10.1.1.29
- The Geometry of Frobenioids II
- 082187571X_Geometries
- Irreducible Polynomials
- Number Series(1)
- Lecture Notes - state space
- Chap2
- Group
- Polynomial Rings
- Mathematics Ch2 Part I
- Principal ideal domains
- Groups.pdf
- X Math Ch1 RealNumbers ChapterNotes July(1)
- Linear Maps
- Lifting the Exponent Lemma - Version 4
- 1106.0953v1
- Study of Structural Analysis of Mechanisms - Structural Isomorphism

You are on page 1of 38

Basic Tools :

1. Mathematic Induction. 2. Well Ordering Principle : any non-empty subset of positive integers contains the smallest element.

as b|a iff k Z such that a=kb.

Proposition of Divisibility

(i) (ii) (iii) (iv) (v) Proof : (i) According to the divisibility definition we have : a|b pZ such that b=pa, a|c qZ such that c=qa then bx+cy = pax+qay = (px+qy)a=k`a, obviously k`Z which means a|(bx+cy). (ii) (iii) By the definition. Because a|b then kZ such that b=ka k=b/a. Otherwise, b>0, a>0 k>0 which means k1ba (iv) Because a|b |a| | |b| and b|a |b| | |a|. Since |a|, |b| 0, we have : |b| |a| and |a| |b| |a| = |b| a=b. Summer symester, 2001 Page 1/38 a|b and a|c a|(bx + cy) with x,y Z a|b a|bc with cZ Let a>0 and b>0. Then if a|b ba a|b and b|a a=b a|b and b|c a|c

Let a, b Z and a > 0. It is the fact that ! q, r such that b=qa+r and a>r0. Proof : Case b 0 : Let consider set S = {n | na > b, n Z+}. By the Well-Ordering Principle S contains the smallest element and we denote it as q+1. Since q+1 is the smallest element of S, we have : (q+1)a > b qa We represent r = b-qa. Clearly, a > r 0. Now we prove that such q and r are unique. Assume that there are two pairs (q1, r1) and (q2, r2) which satisfy : b = q1a+r1, where a > r1 0 b = q2a+r2, where a > r2 0 Then we have : q1a + r1 = q2a + r2 (q1-q2)a = r2-r1 Hence, a|(r2-r1). On the other hand, since a > r1 0 and a > r2 0, a > r2-r1 > -a. From a to a, only zero satisfies a|(r2-r1). That is, r2=r1 and q2=q1. Thus, the theorem is proved with b 0. Case b < 0 : according to case b 0 we have : ! q, r such that -b = qa + r with a > r 0. We have : b = -qa-r b = (-q-1)a + a-r We denote q`= -q-1 and r`= a-r. Clearly, a > r` 0. Similarly, we can prove that q` and r` is unique then the theorem is proved with b < 0.

Let a, b Z then d = gcd(a,b), or shortly (a,b) if and only if : (i) (ii) d|a , d|b and d > 0. For any integer e such that : e|a and e|b then d e. Page 2/38

Theorem 1.2 : Given integers a and b, not both of which are zero, there exists

integers x and y such that : gcd(a, b) = ax+by Proof : Consider S = {au+bv | au+bv > 0 and u, v integers}. Clearly, S is not an empty set. Then, by the Well-Ordering Principle, S contain a smallest element d = ax+by, x and y. We prove that d is gcd(a,b). Taking advantage of Division Theorem, one can obtain two integers q and r such that a=qd+r, where d > r 0. From this equation we have : r = a-qd = a-q(ax+by)=(1-qx)a+(-qy)b Because 1-qx and qy are integers, if r > 0 then r S. It contradicts that d is the smallest element of S while r (less then d) is also an element of S. Therefore, r = 0 (so r is not an element of S), which means d|a. Similarly, we can prove that d|b. Now we must show that no common divisor of a and b is greater than d. Given an arbitrary common divisor e of a and b, it holds that e|a and e|b. According to the proposition of divisibility it is true that e|ax+by = d|e| | d d |e|. The statement is proved. We can deduce from the proof of this theorem the fact that gcd of two integers a, b (not both of them are zero) is always exist.

(i) (ii) d|a and d|b. Whenever e|a and e|b then e|d.

Corollary 1.1 : If a and b are given integers, not both zero, then the set

T = {ax + by | x, y are integers} is precisely the set of all multiples of d = gcd(a,b). Summer symester, 2001 Page 3/38

Advanced Mathematics for Cryptography Proof : For any x, y Z with d|a, d|b, d|ax+by Because d can be written as d = ax0+by0, for n Z we have : nd = n(ax0+by0) = a(nx0) + b(ny0) T.

Proof : Because we define gcd as the greatest one in the set of all common divisors, so if it exists then it must be unique.

to be relatively prime.

Theorem 1.5 : Let a and b be integers, not both zero. Then a and b are relatively

prime iff there exist two integers x and y such that ax + by = 1. Proof : Easy, d = gcd(a,b) is the smallest element of S = {au+bv | au+bv>0; u, v integers}. Because ax + by = 1 then 1 S.In addition 1 is the smallest positive integer then 1 is the smallest element of S. We know that the smallest element of S is gcd(a, b) then d = 1.

Proof : we have : ax + by = d ax/d + by/d = 1 gcd(a/d, b/d) = 1.

Proof : Because a|c and b|c then r, s Z such that c = ar = bs. On the other hand gcd(a,b)=1 then x, yZ : ax + by = 1 acx + bcy = c absx + bary = c ab(sx+ry) = c ab|c.

Proof : Because a|bc then kZ such that : bc = ka. According the assumption that

gcd(a,b) = 1 then x, y Z such that :

Page 4/38

Proof : a|bc then a/d|bc/d. Let a=a/d, b=b/d so a|bc gcd(a,b) = 1 a|c a/d|c.

Proof : Because d = gcd(a,b) then d is the smallest element of set S = {ax+by| ax+by>0;

x and y integers}. This fact can be written as : d = ax0+by0 ax+by for x, y Z s.t ax+by > 0 md = amx0+bmy0 amx+bmy for x, y Z s.t amx + bmy > 0 (m >0) This inequality means that md is the smallest element of set S` = {amx+bmy | amx+bmy>0; x, y integers}. Therefore md = gcd(ma,mb).

Proof : a = qb + r r = a - qb. Let d = gcd(a,b) then d|a, d|b d|r. Therefore, d is a

common divisor of b and r. Now we prove that d is also gcd(b,r). Given e is a common divisor of b, r e|b, e|r e|qb+r e|a then e is also a common divisor of a and b. Because d = gcd(a,b) then d e. Hence d = gcd(b,r).

Let consider following sequence (a b > 0. (Note that : gcd(a,b) = gcd(|a|,|b|))) a = q1b + r1 where b > r1 0 b = q2r1 + r2 where r1 > r2 0 r1 = q3r2 + r3 where r2 > r3 0 .. rn-2 = qnrn-1 + rn where rn-1 > rn 0 rn-1 = qn+1rn It is clear that this sequence is finite because n cannot be greater than b. According to the Lemma 1.1, gcd(a,b) = gcd(b,r1) = gcd(r1,r2) == gcd(rn-2,rn-1) = gcd(rn,0) = rn. That is, we can find out gcd(a,b) in finite computational steps.

Page 5/38

The least common multiply of two non-zero integers a, b, denoted by lcm(a,b), is the positive integer m satisfying the followings : (i) (ii) a|m and b|m. if a|c and b|c with c > 0 then c m.

Proof : Let d = gcd(a,b) then a = rd, b = sd (r, s Z).

Let m = ab/d m = as = rb a|m and b|m, which means m is a common multiply of a and b. Let c be any positive common multiply of a and b, that makes c = ua = vb (u, v Z). We examine c/m : c/m = c/(ab/d) = cd/(ab) = c(ax+by)/(ab) = (c/b)x + (c/a)y = vx + uy Z This equation states that m|c or on the other hand : c m. Hence, m = lcm(a,b).

Page 6/38

Theorem 2.1 : For the given equation ax + by = c where a, b, c Z, d = gcd(a, b) | c.

Then, all integral solutions of this equation have following formations : x = x0 + k(b/d) y = y0 k(a/d) where k is arbitary integral numbers and (x0, y0) is a particular integral solution.

x = x0 + k(b/d) y = y0 k(a/d) is one solution. Indeed : ax + by = a(x0 + kb/d) + b(y0 ka/d) = ax0 + by0 + kab/d - kab/d = ax0 + by0 = c because x0, y0 is a solution of the equation. Second, we prove that every solution (x, y) of the equation has above formation. Because (x0, y0) is one solution then : ax + by = c = ax0 + by0 a(x-x0) = -b(y-y0) b|a(x-x0) (b/d)|(a/d)(x-x0)

Due to gcd(a, b) = d, gcd(a/d, b/d) = 1 (b/d)|(x-x0) k Z such that : x-x0 = kb/d x = x0 + kb/d

Page 7/38

Definition of Prime Number : A integer number p is said to be prime iff :

(i) (ii) p > 1. a|p implies a=1 or p.

Theorem 3.1 : Every positive integer has the unique prime factorization.

Proof : We must prove two things : (i) (ii) The existence : the prime factorization of a positive integer must exist. The uniqueness : the prime factorizarion of a positive integer must be unique.

Let w is the smallest element of the set S = {n Z+ | n has no prime factorization}. w cannot be prime because if it is prime then it can be prime-factorized. Hence, w must be composite. Let a be a divisor of w. we have : 1 < a, w/a < w Because a and w/a is less than w, a and w/a do not belong to the set S. So, w and w/a can be prime-factorized. Thus w also can be factorized (because w is product of two factorized-capable integers). It is a contradiction since S must be empty. That is, the factorization of a is always exist. The existence is proved. Now we prove the uniqueness of factorization. Assume that an integer a is a smallest elemet of set S = {n Z+ |n has two different factorization}, say : a = p1p2ps = q1q2qt Clearly, p1 | q1q2qt and all qj are prime so qj such that p1 = qj. Then we have a/p = p2p3ps = q1q2..qi-1qi+1qt. It is clear that a/p1 < a and then a/p1 does not belong to S. That means a/p1 has the unique factorization. This statement leads to unique factorization of a (because p1=qj). It contracdicts to hypothesis that a has two factorization. So S must be empty. The uniqueness is proved.

Page 8/38

Proof : Assume that there are only n prime numbers, say : p1, p2,, pn. It is clear that

p1p2pn + 1 is greater than any pi. In addition, p1p2pn + 1 can be factorized then there must be pi is a factor of p1p2pn + 1. Note that pi|p1p2..pn then we have ; pi|p1p2pn + 1 p1p2pn pi|1

It is a contradiction here because pi is prime then there are infinite prime numbers.

(i) (ii) (iii) (p, p+2) is called twin-prime if both of p and p+2 are prime. Among (n+1)! + 2, (n+1)! + 3,,(n+1)! + n + 1, there is no prime number. The number of primes not exceeding x (denote as (x)) approaches x/log(x) when x is large.

Theorem 3.3 : For the given composite integer n, n has a prime factor not greater

than

n.

both a, b is greater than square root of n, then ab > n. So factor so n has prime factor less than

n. n a. Clearly, a has prime

We can apply this fact to Erastothenes sieve algorithm to search for all prime numbers less than a given integer n. Normally, we have n-1 loops but taking advantage of this fact we reduce the number of loops to

n.

Page 9/38

Lecture on 4th and 5th of July, 2001 Congruences And Its Application

Definition (Congruence) : Given three integers a, b, n where n > 0. Then, a is

said to be congruent to b modulo n (denoted as a b mod n) iff n|(a-b).

(i) (ii) (iii) a a (mod n). a b b a (mod n). a b, b c a c (mod n).

(i) (ii) (iii) a + c b + d (mod n) a - c b - d (mod n) ax ay implies x y (mod n) if gcd(a, n) = 1.

if aa* 1 (mod n).

Proposition 4.3 :

(i) (ii) Proof : (i) forward direction : if we have a* such that aa* 1 (mod n) n|aa* - 1 aa* - 1 = kn aa* - kn =1 gcd(a, n) = 1 a* exists if and only if gcd(a, n) = 1. a* is unique.

Page 10/38

Advanced Mathematics for Cryptography backward direction : if we have gcd(a, n) = 1 then we have : (ii) ax + ny = 1 (x, y Z) ax 1 = ny n | ax - 1 ax 1 (mod n) a* = x

Suppose that we have a* and a** are two arithmetic inverse of a then we have: aa* aa** 1 (mod n) n | aa* - aa** n | a(a* - a**) n|a* - a** (because gcd(a, n) =1) a* a** (mod n)

Proof : We have : ax ay n | ax - ay n/d | a(x-y)/d n/d | x y (because gcd(a/d, n/d) = 1) x y (mod n/d)

Lemma 4.1 : Let gcd(a, n) = 1 then ax ay (mod n) implies x y (mod n) How to Solve The Linear Congruence Equation :

ax b (mod n) This equation has no solution if gcd(a, n) is not a divisor of b. Otherwise it equals to following equation : ax/d b/d (mod n/d)

Page 11/38

(i) a b (mod n) a kn b (mod n). Exp : 9x 1 -x + 10x 1 -x 1 (mod 5). (ii) ab cb (mod n) if a c (mod n). ab ac (mod n) if b c (mod n) X ai (mod 9 and mod 3). X mod 2 = a0 mod 2. X mod 4 = 10a1 + a0 mod 4. X mod 8 = 100a2 + 10a1 + a0. X mod 5 = a0 mod 5. X mod 11 = (-1)iai mod 11 Let X = ai10i (i = 0,..,n-1 and 9 ai 0) (iii) (iv) (v) (vi) (vii)

If p a prime number and p doesnt divide a then ap-1 1 (mod p). Proof : p is prime and it is not a divisor of a. a and p are relatively prime. Let considers following sequence : a, 2a, 3a,, (p-1)a. It is clear that none of these numbers are divided by p. Because if p|ja (j = 1,..,p-1) then p|j because gcd(a, p) = 1. It is false because j < p. Another fact is that no two of these numbers are congruent modulo p. Assume that there exist such pair ja ia (mod p), since gcd(a, p) = 1 then j i (mod p). It is impossible since both i, j < p. As a result, product of the integers a, 2a, 3a,, (p-1)a is congruent modulo p to product of integers 1, 2,, p-1. That is : a*2a*3a**(p-1)a 1*2*3**(p-1) (mod p) ap-1 1 (mod p).

We can apply Fermat Little Theorem to simplify modulo calculation which relate to power of the integer.

Page 12/38

Proof : if p|a then ap a 0 (mod p). If a is not divided by p then gcd(a, p) = 1. Taking advantage of Fermat Little Theorem : ap-1 1 (mod p) aap-1 a (mod p) ap a (mod p) (because (a, p) = 1)

Proof : Pending.

number of integers between 1 and n-1 which are relatively prime to n.

Lemma 4.2 : (n, ab) = 1 if and only if (a, n) = 1 and (b, n) = 1 where (a, b) = 1.

Proof : First, we prove that if (n, ab) = 1 then we have (a, n) = 1 and (b, n) = 1. Indeed, suppose that (a, n) = d > 1 then d|a, d|n d|ab, d|n (n, ab) d > 1. It contracdicts with hypothesis. Now we prove that if (a, n) = 1, (b, n) = 1 and (a, b) = 1 then (n, ab) = 1. Suppose that (ab, n) = d > 1 d|ab, d|n. Because (a, b) = 1, d must divide either a or b either (a, n) or (b, n) is not less than d. It contradicts with hypothesis that both (a, n) and (b, n) equal to 1. So the Lemma is proved.

(i) (ii) (iii) (iv) (v) Proof : (p) = p - 1 where p is prime. (pn) = pn pn-1 where p is prime. (ab) = (a)(b) where gcd(a,b) = 1 (multiplicative property). (pq) = (p-1)(q-1) where p, q are prime. (n) = n(1-1/pi) where each pi is prime factorization of n.

Page 13/38

Advanced Mathematics for Cryptography (i) Because p is prime then all integers from 1 to p-1 are relatively prime to n then (p) = p 1. (ii) All integers from 1 to pn 1 are relatively prime to p except those integers are multiple of p. It is easy to figure out that number of such integers is pn-1 then we have (pn) = pn pn-1. (iii) We must count the number of positive integers which are relatively prime to mn and not exceeding mn. In order to do it, we display all positive integers not exceeding mn in the following way : 1 2 3 r m

th

2m + 1

m + 1 2m + 2 m + 3 2m + 3

m + r 2m + r 2m 3m

mn

Consider r row. If gcd(m, r) = d > 1 then d|km + r, that means all numbers in rth row are not relatively prime to m and of course are not relatively prime to mn. So only rows which its indexes are relatively prime to m can contain numbers which are relatively prime to mn. Clearly, there are totally (m) such rows. Now consider rth row where r is relatively prime to m : r, m + r,, (n-1)m + r. This row contains n integers. Now we prove that there are only (n) integers in this row which are relatively prime to n. First consider following sequence : 0, m, 2m,, (n-1)m. We know that (m, n) = 1 then no two integers in this sequence are congruent modulo n. If not, suppose that im jm (mod n) and n > i, j 0 then i j, it is impossible because both i and j are less than n. It states that there are only (n) numbers in this sequence are relatively prime to n. Indeed, suppose that im j (n > i, j 0) then if (j, n) = 1 we have (im, n) = 1 because : x, y Z such that jx + ny = 1 im j im j = kn (k Z) Summer symester, 2001 Page 14/38

If (j, n) = d > 1 then we have (im ,n) > 1 because : d | n, d | j im j = kn im = j + kn d | im gcd(im, n) d > 1

So because no two integers in a sequence of n integers are congruent modulo n then there are exactly (n) numbers in the sequence which are relatively prime to n. We prove that sequence : r, m + r,, (n-1)m + r is also this kind of sequence. Suppose that im + r jm + r (mod n) where i, j are positive integers and less than n n | im + r jm r = im jm im jm i j (mod n) because (m, n) = 1, it is impossible because both i and j are less than n. In conclusion, in rth row there are only (n) numbers which are relatively prime to n. We have already stated that there are (m) such kind of rows then there are totally (m).(n) numbers relatively prime to both m and n. According to Lemma, only such numbers are also relatively prime to mn then we have : (mn) = (m)(n) with (m, n) = 1. (iv) (v) Because p, q are prime then (p, q) = 1 (pq) = (p)(q) = (p-1)(q-1). We can easily get this formula by applying the multiplicative property of function. (note that n can be written in the form of product of power of some prime numbers factorization).

Proof : Let consider two following sequences : r1, r2,, r(n) and ar1, ar2,, ar(n) where ri is relatively prime to n and not exceeding n for any i = 1, 2,, (n) and (ri, rj) = 1 if i

Page 15/38

Advanced Mathematics for Cryptography j. The set of r1, r2,, r(n) is called a reduced residue system modulo n. Now we prove that the set of ar1, ar2,, ar(n) is also a reduced residue system modulo n. Indeed, ari is relatively prime to n because both a and ri are relatively prime to n. Furthermore, if i, j such that ari arj (mod n) ri rj (mod n). It contradicts with the fact that ri and rj belong to reduced residue system modulo n. Because the set of ar1, ar2,, ar(n) is a reduced residue modulo n then the least positive residues of ar1, ar2,, ar(n) must be the integers r1, r2,, r(n) in some orders. Consequently, if we multiply together all terms in each of these reduced residue systems, we get (note a b, c d ab cd) : ar1ar2ar(n) r1r2r(n) (mod n) a(n)r1r2r(n) r1r2r(n) (mod n) a(n) 1 (mod n) because (r1r2r(n), n) = 1

a-1 a(n) 1 (mod n) if a and n are relatively prime. Proof : We have : a(n) 1 (mod n) a(n)-1aa-1 a-1 (mod n) a(n) 1 a-1 (mod n)

Its security is based on difficulty in solving factorization problem. Given two large prime numbers p and q (size of p and q should be at least 512 digits to ensure the hardness of factorization) and n is product of p and q. We have Euler Phi function of n, (n) = (p-1)(q-1). Let consider two integers e, d such that ed 1 (mod (n)) then the RSA scheme is as follow : Public information : n, e. Private information : d.

Page 16/38

Advanced Mathematics for Cryptography Encryption : c me (mod n) c is ciphertext and m is message to be encrypted. Decryption : m cd med mk(n) + 1 m{m(n)}k m (mod n). In fact, according to Eulers theorem m and n must be relatively prime but the probability of the event in which m and n are not relatively prime is very small : prob = (n - (n)) / n prob = {pq (p-1)(q-1)}/{pq} prob = {p + q 1}/(pq) prob 2-511 (because |p|,|q| = 512 digits).

numbers which are pairwise relatively prime, m1, m2,, mr, then the following congruence system: x b1 (mod m1) x b2 (mod m2) x b3 (mod m3) . xr br (mod mr) has the unique solution : x = y1b1M1 + + yrbrMr mod M (M = mi where i = 1, 2, 3,, r) where Mi = M/mi yiMi 1 (mod mi) Proof : First we verify that x = y1b1M1 + + yrbrMr is a solution of congruence system. Indeed, we can see that yiMi 0 (mod mj) where i j because mj is one factor of Mi. Then x yiMibi bi (mod mi) i = 1, 2, 3,, r. Now we show that any two solutions are congruent modulo M. Suppose that we have two solution x0, x1 then we have : x0 x1 b1 (mod m1) x0 x1 b2 (mod m2) Summer symester, 2001 Page 17/38

Advanced Mathematics for Cryptography .. x0 x1 br (mod mr) Then mi|x0-x1 i. Because m1, m2,, mr are pairwise relatively prime then m1m2mr|(x0-x1) M|x0-x1 x0 x1 (mod M). So the theorem is proved.

integral solution if and only if : (i) (ii) it has a non-zero solution in R. it has a relatively prime solution mod pn for each prime p and a positive integer n.

Theorem 4.6 : An equation has an integral solution then it has a solution mod pn for

each prime p and a positive integer n.

Theorem 4.7 : If f(x, y) 0 (mod pn) has no solution for some prime p and positive

integer n then f(x, y) = 0 has no solution.

Page 18/38

Definition (Base): any integer n can be written as the following form :

n = ai b i where b, ai are integral and b > 1, b > ai 0

i =0 n

Then we say that (an, an-1,, a1, a0) is the represetation of integer x in base b. ai is called one digit in base b.

base b is k or log b n + 1 . (we also have k > log b n k-1).

Proposition 5.2 : To add two k-bit integers, it requires at most k bit operations. Propostion 5.3 : To multiply a k-bit integer and a l-bit integer, it requires at most kl

bit operations.

Proposition 5.4: To subtract a k-bit integer from a l-bit integer, it requires at most

max(k, l) bit operations.

Proposition 5.5: To divide a k-bit integer by a l-bit integer (k l), it require at most

kl bit operations.

Definition of Big-O Notation : Let f(n) and g(n) be two functions of positive

integer n which take positive. We say that f(n) = O(g(n)) (or simply f = O(g)) if a constant C , N such that f(n) is always less than Cg(n) for n > N. To generalize, f and g are functions on vector (n1, n2,, nr). We said that f = O(g) if a constant C such that f(n1, n2,, nr) is always less than C.g(n1, n2,, nr).

Page 19/38

lim g

n

is bounded.

Proof : According to the definiton of limit, for positive , N such that n > N

implies :

f ( n) A < g ( n)

f ( n) < ( A + ) g ( n)

Let |A| + = C, then we have : f ( n) < C g ( n ) Because we suppose that both f(n) and g(n) are positive n then :

f (n) Cg (n)

Proposition 5.6:

(i) (ii) (iii) Given f(x) = adxd + + a0 where ad 0, then f = O(xd). log(n) = O(n) > 0. If we have f = O(1) then f is bounded.

Proof :

(i) Let consider :

lim

lx

f ( x) = a d f(x) = O(xd) d x

(ii)

1 log n 1 n lim n = lim n 1 = lim n = 0 n n n Then log(n) = O(n) > 0.

Proposition 5.7: Let n be k-bit integer, let m be l-bit integer then we have :

(i) n + m, require at most max(k, l) bit operations. We call the complexity to compute m + n is O(max{k, l}). (ii) (iii) (iv) Complexity to compute n m is O(max{k, l}). Complexity to compute n*m is O(kl). Complexity to compute n/m is O(kl).

Page 20/38

O(nn).

O(f(k)) for a poly-nominal f(k).

lim g

n

=0

Page 21/38

Lecture on 12th, 18th, 19th of July, 2001 Groups, Rings, Vector Spaces and Fields

Definition (Group) : A group G is a set with a binary operation, denoted by *,

satisfying : (i) (ii) (iii) (iv) Closure : a*b G for a, b G. Associativity : (a*b)*c = a*(b*c) for a, b, c G. Identity : e G such that : a*e = e*a = a for a G. Inverses : x G such that a*x = x*a = e for a G. We usually denote the inverse of a by a-1.

(i) (ii) (iii) (iv) (v) (vi) (vii) e is unique. ab = ac b = c (left cancellation property). ba = ca b = c (right cancellation property). cc = c c = e. a-1 is unique for each a. (a-1)-1 = a. (ab)-1 = b-1a-1. ba-1.

Proof :

(i)

Suppose that there are two identity e and e. Follwing condition (iii) we have : e = ee' = e ab = ac a-1(ab) = a-1(ac) (a-1a)b = (a-1a)c eb = ec b = c. ba = ca (ba)a-1 = (ca)a-1 b(aa-1) = c(aa-1) be = ce b = c. cc = c c-1(cc) = c-1c (c-1c)c = e ec = e c = e. Suppose a has two inverses a1, a2 aa1 = aa2 = e a1 = a2 (left cancellation property). (a-1)-1 = a a-1(a-1)-1 = a-1a e = e.

Page 22/38

(vi)

(vii)

group) if : a.b = b.a for every a, b G.

Definition (Group Order): The order of a group G, denoted by |G| is the number

of element of G. If n is finite then we call G is a finite group.

residue class) modulo n is a set of integers relatively prime to n such that every integer relatively prime to n is congruent to one and only one in this set.

(i) a is a generator of G G = {an | n Z+}. Here please note that an = a*a*a*aa (n times) where * is the binary operation of group G. (ii) (iii) G is called cyclic if it has a generator. The order of a, where a is a element of a group G, denoted by ord(a) is the least integer n such that an = e. If n does not exist we say a has infinite order, otherwise a has finite order. (iv) (v) A subgroup S is a subset of G which is a group under the same operation.

<a> is a subgroup G generated by a G. That is <a> = {e, a, a2,, aord(a)-1}

Proposition 6.2 : Let G be a group with identity element e, and let H be a subset of

G. Then H is a subgroup of G if and only if the following conditions hold: (i) (ii) (iii) a.b H for all a,b H e H; a-1 H for all a H.

Page 23/38

respect to g, where g is an element of G, is the set formed by operating on elements of H, with g, i.e., it is hg : h H. It is written simply Hg. Hg is called right coset of H.

Propostion 6.3 : Some properties of coset (Given group G and its subgroup H) :

(i) (ii) g Hg since e H ge = g H. If H is finite, H = {h1, h2,, hn} then Hg = {h1g, h2g,, hng} where hig are all distinct. (iii) (iv) H itself is one coset of H since He = H. We can obtain one coset of H from each g G but we cannot claim that we get a different right coset from each element of G.

is an equivalence relation; the equivalence class containing a is the right coset Ha.

Proof : We must verify that the relation R is reflexive, symmetric, and transitive:

aa-1 = e H aRa (reflexive). ab-1 H (ab-1) H ba-1 H bRa (symmetric). ab-1 H, bc-1 H ab-1bc-1 H ac-1 H aRb, bRc aRc (transitive).

Now we prove that the equivalence class containing a is a right coset of H. Let consider: gRa ga-1 H Let ga-1 = h for some h H ga-1a = ha g = ha Ha. The theorem is proved.

G then the order of H divides the order of G.

Page 24/38

Advanced Mathematics for Cryptography Proof : Let k be the numbers of right cosets of H. Because we can form all cosets of H

from equivalence classes (Lemma) then they contain element of G exactly one and size of each is |H| k|H| = |G|.

Proof : Let consider a subgroup of G which is generated by a, <a>. Clearly, the order of

<a> is ord(a) because aord(a) = e. Following the Langrange theorem we have : order(<a>) | order(G) ord(a) | order(G)

Proof. We have ord(g) = |<g>|, so as G <g>, we must have o(g)|n. Thus if o(g)=k we

may write n=qk for some q N, and then gn=(gk)q=e. Actually, Eulers theorem can be induced from this fact by considering (Z/nZ)* group (that is, a group contains all number less than n and relatively prime to n, * means 0 does not belong to this group. The binary operation is the multiple operation then reduced by modulo n). The order of this group is (n) so if a (Z/nZ)* or (a, n) = 1 we have a(n) = 1 or a(n) 1 (mod n) in another sense. If p is prime then we have proof of Little Fermat Theorem ap-1 1 (mod p) where p does not divide a.

Corollary 6.2 : A group of prime order is cyclic and has no proper non-trivial

subgroups; any non-identity that generates group.

Proof : Suppose that group G has order of p where p is prime then all subgroup of G

should have order of 1 or p. Thus if a is not indentity element then <a> = G (because the order of <a> is p).

{e}.

Page 25/38

Advanced Mathematics for Cryptography Proof : Clearly, H K is subgroup of both H and K then if gcd(|H|, |K|) |H K|

(i) (ii) (F, +) is an abelian group and 0 is denoted as identity of operation +. (F*, *) is an abelian group and 1 is denoted as indentity of operation * (F* = F \ {0}). (iii) (a + b) * c = a*b + b*c (distributive law).

Definition (Vector Space) : Given (V, +) is an abelian group. This group is said

to be a vector space over a field F if an binary operation : FxVV (a, v) av such that (a, b F, v, w V): (i) (ii) (iii) (iv) a(v + w) = av + aw (a + b)v = av + bv (ab)v = a(bv) 1v = v (1 is the multiplicative indentity if F)

Definition :

(i) Given a vector space V over a field F then we say S = (v1, v2,, vn) V are

linearly independent if c1v1 + c2v2 + . + cnvn = 0 implies c1 = c2 = c3

=.=cn = 0. Otherwise, we say that S are linearly dependent. (ii) We define a dimension of V (denoted as dimV) as the largest number of linear independent elements in V. Dimension of a vector space can be finite or infinite. (iii) (v1, v2,, vn) V are a basis of V over F if n elements are linearly independent and dimV = n.

Page 26/38

Definition (Extension Field) : Let consider a field K which also contains a field

F then K is automatically a vector space over F. We denote dimK (over F) as [K:F], it is called extension degree of K over F. The field K is said to be an extension field of the field F. If [K:F] is finite then it is called a finite extension. One common way of obtaining extension field is to adjoin an element to F: we say K = F() if K is the field consisting all rational expressions formed using and elements of F.

f(x) where all coefficients are elements of F is called polynominal ring, denoted as F[X].

as the largest power of x in all terms of f(x), denoted by deg(f).

polynominal if the coefficient of the largest power of x is 1.

divisible by another polynominal g(x) if h(x) such that f(x) = g(x)h(x) where the degree of g(x) and h(x) are less than degree of f(x) and greater than 0. Otherwise, f(x) is said to be irreducible. We also can apply division algorithm theorem of integer and greatest common divisor concept to polynominal.

domain if f(x) F[X] satisfying the following : f(x) = pi(x) where every pi(x) is irreducible.

Page 27/38

over F if f(x) F[X] such that f()=0. If such doesnt exist then is said to be transcendental over F.

Proposition 6.5 There exists only one monic irreducible polynominal f(x) such that

f() = 0 if is algebraic over F ( is called root of f(x)). This monic irreducible polynominal is called minimal polynominal of . Furthermore, if any h(x) F[X] satisfies h() = 0 then f(x)|h(x).

Proof : Assume that f(x) and g(x) which are irreducible polynominal such that f() =

g() = 0. Because f(x) and g(x) are irreducible, they are relatively prime which means u(x), v(x) F[X] such that : f(x)u(x) + g(x)v(x) = 1 Replace x by we have : 0.u(x) + 0.v(x) = 1 It is impossible so such f(x) is unique. 0=1

Proposition 6.6 : If the minimal polynominal, say f(x), of has degree d, then any

element of F() (that is, any rational expression involving powers of and elements of F see definition of extension field) can be expressed as a linear combination of the powers 1, , 2,, d-1. Therefore, those powers of form a basis of F() over F and so the dimension of the extension obtained by adjoining is the same as the degree of the minimal polynominal , [F():F] = deg(f(x)) = d.

of F is called a conjugate of over F. is a map from F() to F() satisfying : (i) (ii) (iii) is bijective. (x + y) = (x) + (y). (preserving addition) (xy) = (x)(y). (preserving mutiplication)

Page 28/38

F() and F() are said to be isomorphism. If F() = F(), then we say that F() and F() are automorphism. A very popular result in this topic is that Q( 2 ) and

are rational numbers.

Definition (Multiple Root): (x-m)r | f(x) (that is, (x-m)r | f(x) and (x-m)r+1 | f(x))

then we say that m is a root of multiplicity r.

Propostion 6.7 If f(x) has a multiple root then gcd(f, f) has a root . Definition (Splitting Field) : A splitting field of f(x) F[X] is the smallest

extension field containing all roots of f. That is, f(x) is splitted into a product of linear polynominals in the splitting fields of f. f(x) = a(x r1)(x r2)(x rn) where ri splitting field of f(x) for any i. The splitting field is unique up to isomorphism, meaning that if any K has same properties, there will be a 1-to-1 corespondence between K and K which preserve addition and multiplication.

times, 1 is the multiplicative indentity of F) then we say characteristic of F p, char(F) = p. In this case F contains a copy of the field Z/pZ which is called its prime field. If 1 + 1 +1 + 1 + never gives result 0 we say that char(F) = 0. For instance char(Z/pZ) = p (p is prime) and char(Q) = 0. Note that characteristic of a field can only be prime.

Propositon 6.8 Every field should contain one and only one prime field. Definition (Algebraic Closure) : Given a field F. If every polynominal f(x)

F[X] has a root in F then F is said to be algebraic closed. The complex field, C, is the one

Page 29/38

of this kind of field. The smallest algebraically closed extension field of F is called the algebraic closure of F. It is denoted as F . The complex numbers are. the algebraic closure of the real numbers.

Page 30/38

Finite Field

Theorem 7.1 : Let F be a finite field

(i) (ii) Characteristic of F cannot be zero. If char(F) = p then the order of F is pn for some integer n, where p is prime. There is also one and only one finite field with such order up to isomorphism, denoted by F p n .

Proof : The order of Fq* is q-1 then ord(a) | (q-1) for any a Fq*.

of order q-1, called primitive element.

Proposition 7.1: Every finite field has a generator. Corollary 7.2: Let <g> = Fq*

(i) (ii) gi is a generator if and only if (i, q-1) = 1 There are (q-1) generators.

Proof : Pending.

Proof : We have :

(a + b) p = C ip a i b n i

i =0 p

Page 31/38

( a + b) p = a p + b p

2 2 2

Apply

3

this

3

fact

3

repeatedly,

we

can

show

that

b.

algebraic over a finite field.

Proof : is one root of f(x) then :

f ( ) = a d d + a d 1 d 1 + ... + a1 + a0 = 0

f ( i ) = a ( i ) d + a d 1 ( i ) d 1 + ... + a 1 i + a 0

f ( i ) = a d ( d ) i + a d 1 ( d 1 ) i + ... + a1 i + a0 f ( i ) = (a d d + a d 1 d 1 + ... + a1 + a 0 ) i = 0

(explaination pending)

Xq X = 0 and Fq is precisely the set of roots of that equation. Conversely, for every prime power q = pn the splitting field over Fp of the polynominal Xq X is the field of q elements.

Proof : First suppose that Fq is a finite field then the order of every element in Fq divides

q-1. Thus, Xq-1 = (Xord(a))k = (1)k = 1 (where a is an element of Fq) Xq X = 0. Conversely, let q = pn is a prime power and F is a splitting field of f(x) = Xq X over field Fp. We have : f(x) = Xq X f(x) = qXq-1 - 1 f(X) = -1 (because q = 0 in Fp)

Therefore f(x) and f(x) have no common root at all and they have no multiple root. This statement means that f(x) has distinct q root. As we define F as splitting field of f(x) over Fp then F must contain at least q elements. We show that the set of q elements is a field with addition and multiplication operation. If a and b are solutions of f(x), aq = a, bq = b then (a + b)q = aq + bq = a + b (Theorem 7.3) and (ab)q = aqbq = ab. That is both sum of a

Page 32/38

d

Fp [ X ] f ( x)

, where p is prime

and f(x) is an irreducible polynominal of degree d such that f() = 0. Fp[X]/f(x) means that all operations in such field will be reduced modulo f(x). We know that if f(x) is minimal polynominal of then all elements if vector space Fp() can be written as a linear combination of 1, , 2, 3,..., d-2, d-1. That is 1, , 2, 3,..., d-2, d-1 forms a basis in Fp() over Fp:

a

i =0 i

d 1

d

i =0

f ( ) = d + a d 1 d 1 + ... + a1 + a 0 = 0

d = (a d 1 d 1 + ... + a1 + a 0 )

[Fp():Fp] = d F p ( ) = { ai i | ai F p }

i =0 d 1

where ai Fp

In order to construct a finite field, take following steps : Take an irreducible polynominal f(x) over Fp.

F p d = F [ X ] / f ( x) Operation : given g(x), h(x) F p d g(x) h(x) = {g(x) + h(x)} mod f(x) g(x)h(x) = {g(x)h(x)} mod f(x) g(x)-1 = g(x)-1 mod f(x)

Page 33/38

F p is called a prime field where p is prime (in cryptographic sense, size of p

should be 1024). F2 n is called binary field. If n is composite, it is called a composite field. Size of n also should be 1024 in respect of cryptography. F p n is called an optimal extension field. Size of p should be the same as size of a word in a given processor and n = 1024/r. Definition of Norms and Traces : Given a prime number and q = pn. Then, trace and norm function are defined as follow : N , Tr : Fq n Fq TrF n |Fq ( ) = ( ) = q

q

n 1 i =0

N F n |Fq ( ) = ( ) = q

q

n 1 i =0

Proposition 7.2 :

(i) (ii) (iii) (iv) (v) (vi) (vii) Tr(+) = Tr() + Tr(). Tr(c) = cTr(). Tr(c) = nc. Tr(q) = Tr(). N() = N()N(). N(c) = cnN(). N(c) = cn.

TrE/K = TrF/KoTrE/F.

Page 34/38

NE/K = NF/KoNE/F.

Bases : basis is a set of n elements in Fq which are linearly independent over Fq.

n

The number of ways to choose a basis of Fq n over Fq is (explaination pending) : (q n 1)(q n q )...(q n q n 1 ) =

q i (q ni 1)

i =0 i =0

n 1

n 1

n ( n 1)

q

n 1 i =0

(q

i =1 n

1)

2

= qn

(i) poly-nominal basis if it has form : {1, , 2,, n-1} (ii) normal basis if it has the form :

{ , q , q ,..., q

w n

, q 1 }

n

Definition of dual basis : Let = { 1 , 2 ,..., n } and = { 1 , 2 ,..., n } are two bases of Fq n / Fq . is dual basis of if : Tr(ij) = ij Where ij is Kronecker delta, ij = 1 if i = j and 0 if i j.

Theorem 7.5 :

(i) For every basis of Fq n / Fq , there is one and only one dual basis of . (ii) The dual basis of a normal basis is a normal basis. (iii)The dual basis of a polynominal basis is not a polynominal basis.

determinant is not zero) where :

Page 35/38

1 q A= 1 ... q n 1 1

2 q 2

...

q 2

n 1

... ...

n q n

Proof : Fisrt, we prove that if is a basis then A is nonsingular. It is the fact that there

always exists dual basis of . Let be the dual basis of and consider following matrix :

1 q B= 1 ... q n 1 1

2 2q

...

2q

n 1

... n 1 ... nq

n nq

1 q T AB = 1 ... q n 1 1

2 q 2

...

q 2

n 1

1q ... 1q 1 2q ... 2q

n n 1

...

nq

Because ij = ij (Kronecker delta). This implies that A can be inverted or A must be nonsingular. Now we prove that when A is nonsingular then is a basis. Let consider following equation :

c

i =1 i

= 0 where ci Fq

q

n c i i = 0 i =1

c

i =1 n q i

q i

=0 = 0 (because ci Fq ciq = ci )

c

i =1 i

q i

Page 36/38

c

i =1 i

qk i

= 0 if

c

i =1 i

= 0 , where ci Fq holds.

1 q AC = 1 ... q n 1 1

2 q 2

...

q n 1 2

c

i =1 i

= 0 implies ci = 0 i

Theorem 7.6 : Let = {1, , 2 ,..., n 1 } be a polynominal basis, f(x) = Irr(, Fq) an

minimal polynominal of over Fq, f(x) = (x - )(n-1xn-1 + n-2xn-2 ++ 0). Then the dual basis of is {1,2,,n), where : i = i/f(x)

Proof : Pending.

Theorem 7.7 :

(i) There is no a self-dual polynominal ( = ) basis of Fq n over Fq for n 2. (ii) Fq n has one self-dual basis over Fq if and only if q is even or both q and n are odd. (iii)If n is odd or if q is even then there is a self dual normal of Fq n /Fq.

irreducible in Fq[X] if and only if t 2 satisfies : (i) each prime factor of t divides e but not divide (q-1)/e. (ii) if 4|t the 4|q-1.

Page 37/38

(i) Trinominal : xn + adxd + a0 (three terms) (ii) Pentanominal : five terms. (iii)All-one polynominal : all coefficients equal to 1.

Suppose that we want to compute A(x)B(x). We write A(x) and B(x) in following form : A(x) = xn/2An + Al B(x) = xn/2Bn + Bl Then, we have : A(x)B(x) = (xn/2An + Al)(xn/2Bn + Bl) A(x)B(x) = xnAnBn + xn/2(AnBl + BnAl) + AlBl

In order to reduce the number of multiplication operations, we simplify AnBl + BnAl in following way : AnBl + AlBl = (Al + An)(Bl + Bn) AlBl - AnBn Repeat this procedure for multiplication operation of AnBn, AnBl, AlBn, AlBl we can get better performance in comparision with conventional method.

(i) (ii) (iii) (iv) (v) (vi) (vii) Addition : Subtraction : Multiplication : Reduction : Division : Inverse : Power :

Page 38/38

- 2014-fall-122-hmwk-solutions-01-04Uploaded byMorvaridYi
- KING ABDULAZIZ UNIVERSITY DEPARTMENT OF MATHEMATICS MSc Entrance Exam Second Semester 1433 Maximim Time: Three HoursUploaded bySergio
- ScienceLunchTalk BeamerUploaded bySree Hari
- 10.1.1.29Uploaded byConstantinos Louca
- The Geometry of Frobenioids IIUploaded byseanbyram
- 082187571X_GeometriesUploaded bypilili01
- Irreducible PolynomialsUploaded byRamaswamy Koodalloor Parasuraman
- Number Series(1)Uploaded byDeepesh Tanwar
- Lecture Notes - state spaceUploaded byTaosif Iqbal
- Chap2Uploaded byeshbli
- GroupUploaded bylunarcausticac
- Polynomial RingsUploaded byWahid Choirul Ana
- Mathematics Ch2 Part IUploaded byThis is my jam
- Principal ideal domainsUploaded byAdi Subbu
- Groups.pdfUploaded byTafara Mhangami
- X Math Ch1 RealNumbers ChapterNotes July(1)Uploaded byRajeev Singh Bais
- Linear MapsUploaded byEdward Devinous
- Lifting the Exponent Lemma - Version 4Uploaded bymario
- 1106.0953v1Uploaded bybalbasaur
- Study of Structural Analysis of Mechanisms - Structural IsomorphismUploaded byInternational Journal of Engineering Inventions (IJEI)
- Prime Numbers and the Riemann HypothesisUploaded byzikibruno
- Number Theory 05-19-13Uploaded byaniket
- Saharon Shelah- Polish Algebras, Shy From FreedomUploaded bySakoMC
- chap2sec4Uploaded bytalhaaftab728
- jemh101Uploaded bytoaniltiwari
- Vasil Penchev. The Kochen - Specker theorem in quantum mechanics: A philosophical commentUploaded byVasil Penchev
- M.O.E.M.S Practice Packet 2009-2010Uploaded byHui Jin
- Holiday Home Work Vi.docxUploaded byGaurav Mehndiratta
- jemh101Uploaded bysaisrinivasbvk
- algoritmsUploaded byAvadhani Sharma

- Algebra Homework Set 7 Hung Tran. 8.3.11 (⇒) Suppose RUploaded bythp343
- Theory and Anlysis of Nonlinear Framed Structures - Y. Bin Yang.pdfUploaded byAllan Gavino
- Markov_chains_cheat_sheet.pdfUploaded byJDTerex
- Problems in Flow NetUploaded byanumned
- Mathematic Sbst 1303Uploaded bySasa Vathi
- A Self-Adaptive Hybrid Genetic Algorithm for Data Mining ApplicationsUploaded byGustavo Liberatti
- OBSERVATION ON THE HYPERBOLAUploaded byUJM Editor
- Geometry ReviewUploaded byRocket Fire
- Discrete MathUploaded bySenura Seneviratne
- Math 17 Exercises 8 w/ ANSWER KEYUploaded byMau Tejada
- Study Unit 2.1 Basic ProbabilityUploaded bybronwyncloete
- Geant4 GPS Users ManualUploaded byRaj
- Aptitude ShortcutsUploaded byKayala Suresh Kumar
- LaplaceTransforms.pdfUploaded byAdam
- ecaade2009Uploaded bylmn_grss
- LINC Vol 16 Section 2 Programming the LINC Jun65Uploaded bypsc098
- Practice Makes Perfect 5 Transformations)Uploaded bydikwanz
- NET Mathematics 100 MCQsUploaded bymuhammad yaseen
- what your brain looks like when it solves a math problem - the new york timesUploaded byapi-162570032
- 013391545X_section4.7_4.8Uploaded byAtef Naz
- Extended kalmanfilter for induction motorUploaded bymakroum
- 73088-ArticleText-292040-1-10-20180228Uploaded bymondes
- Path Integrals by WeikbergUploaded byDevidutta Gahan
- Basis and DimensionUploaded byMuhd Faisal Samsudin
- Topostruct HelpUploaded byGabi Celani
- Lecture 07 - Z-TransformUploaded byImelda Yulistya
- Cambridge International as and a Level Computer Science CoursebookUploaded byPrasanth
- NEW NM QBUploaded byJag Parvesh Dahiya
- AnswersUploaded byAlyssa L
- Solution Matlab Part Assignment 4Uploaded byyeahright2012