factoring integers, producing primes and the rsa cryptosystem€¦ · rsa cryptosystem Đ—i h¯c...
TRANSCRIPT
![Page 1: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/1.jpg)
Factoring integers, Producing primes and theRSA cryptosystem
University of Pedagogy
Ho Chi Minh City
December 12, 2005
![Page 2: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/2.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 1
RSA2048 = 25195908475657893494027183240048398571429282126204
032027777137836043662020707595556264018525880784406918290641249
515082189298559149176184502808489120072844992687392807287776735
971418347270261896375014971824691165077613379859095700097330459
748808428401797429100642458691817195118746121515172654632282216
869987549182422433637259085141865462043576798423387184774447920
739934236584823824281198163815010674810451660377306056201619676
256133844143603833904414952634432190114657544454178424020924616
515723350778707749817125772467962926386356373289912154831438167
899885040445364023527381951378636564391212010397122822120720357
Università Roma Tre
![Page 3: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/3.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 1
RSA2048 = 25195908475657893494027183240048398571429282126204
032027777137836043662020707595556264018525880784406918290641249
515082189298559149176184502808489120072844992687392807287776735
971418347270261896375014971824691165077613379859095700097330459
748808428401797429100642458691817195118746121515172654632282216
869987549182422433637259085141865462043576798423387184774447920
739934236584823824281198163815010674810451660377306056201619676
256133844143603833904414952634432190114657544454178424020924616
515723350778707749817125772467962926386356373289912154831438167
899885040445364023527381951378636564391212010397122822120720357
RSA2048 is a 617 (decimal) digit number
Università Roma Tre
![Page 4: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/4.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 1
RSA2048 = 25195908475657893494027183240048398571429282126204
032027777137836043662020707595556264018525880784406918290641249
515082189298559149176184502808489120072844992687392807287776735
971418347270261896375014971824691165077613379859095700097330459
748808428401797429100642458691817195118746121515172654632282216
869987549182422433637259085141865462043576798423387184774447920
739934236584823824281198163815010674810451660377306056201619676
256133844143603833904414952634432190114657544454178424020924616
515723350778707749817125772467962926386356373289912154831438167
899885040445364023527381951378636564391212010397122822120720357
RSA2048 is a 617 (decimal) digit number
�� ��http://www.rsasecurity.com/rsalabs/node.asp?id=2093
Università Roma Tre
![Page 5: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/5.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 2
RSA2048=p · q, p, q ≈ 10308
Università Roma Tre
![Page 6: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/6.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 2
RSA2048=p · q, p, q ≈ 10308�� ��PROBLEM: Compute p and q
Università Roma Tre
![Page 7: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/7.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 2
RSA2048=p · q, p, q ≈ 10308�� ��PROBLEM: Compute p and q
Price: 200.000 US$ (∼ 15, 894.00 VND)!!
Università Roma Tre
![Page 8: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/8.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 2
RSA2048=p · q, p, q ≈ 10308�� ��PROBLEM: Compute p and q
Price: 200.000 US$ (∼ 15, 894.00 VND)!!
Theorem. If a ∈ N ∃! p1 < p2 < · · · < pk primes
s.t. a = pα11 · · · pαk
k
Università Roma Tre
![Page 9: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/9.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 2
RSA2048=p · q, p, q ≈ 10308�� ��PROBLEM: Compute p and q
Price: 200.000 US$ (∼ 15, 894.00 VND)!!
Theorem. If a ∈ N ∃! p1 < p2 < · · · < pk primes
s.t. a = pα11 · · · pαk
k
Regrettably: RSAlabs believes that factoring in one year requires:
number computers memory
RSA1620 1.6× 1015 120 Tb
RSA1024 342, 000, 000 170 Gb
RSA760 215,000 4Gb.
Università Roma Tre
![Page 10: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/10.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 3�� ��http://www.rsasecurity.com/rsalabs/node.asp?id=2093
Università Roma Tre
![Page 11: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/11.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 3�� ��http://www.rsasecurity.com/rsalabs/node.asp?id=2093
Challenge Number Prize ($US)
RSA576 $10,000
RSA640 $20,000
RSA704 $30,000
RSA768 $50,000
RSA896 $75,000
RSA1024 $100,000
RSA1536 $150,000
RSA2048 $200,000
Università Roma Tre
![Page 12: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/12.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 3�� ��http://www.rsasecurity.com/rsalabs/node.asp?id=2093
Challenge Number Prize ($US) Status
RSA576 $10,000 Factored December 2003
RSA640 $20,000 Not Factored
RSA704 $30,000 Not Factored
RSA768 $50,000 Not Factored
RSA896 $75,000 Not Factored
RSA1024 $100,000 Not Factored
RSA1536 $150,000 Not Factored
RSA2048 $200,000 Not Factored
Università Roma Tre
![Page 13: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/13.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 4�� ��History of the “Art of Factoring”
Università Roma Tre
![Page 14: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/14.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 4�� ��History of the “Art of Factoring”
ó 220 BC Greeks (Eratosthenes of Cyrene )
Università Roma Tre
![Page 15: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/15.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 4�� ��History of the “Art of Factoring”
ó 220 BC Greeks (Eratosthenes of Cyrene )
ó 1730 Euler 225+ 1 = 641 · 6700417
Università Roma Tre
![Page 16: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/16.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 4�� ��History of the “Art of Factoring”
ó 220 BC Greeks (Eratosthenes of Cyrene )
ó 1730 Euler 225+ 1 = 641 · 6700417
ó 1750–1800 Fermat, Gauss (Sieves - Tables)
Università Roma Tre
![Page 17: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/17.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 4�� ��History of the “Art of Factoring”
ó 220 BC Greeks (Eratosthenes of Cyrene )
ó 1730 Euler 225+ 1 = 641 · 6700417
ó 1750–1800 Fermat, Gauss (Sieves - Tables)
ó 1880 Landry & Le Lasseur: 226+ 1 = 274177× 67280421310721
Università Roma Tre
![Page 18: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/18.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 4�� ��History of the “Art of Factoring”
ó 220 BC Greeks (Eratosthenes of Cyrene )
ó 1730 Euler 225+ 1 = 641 · 6700417
ó 1750–1800 Fermat, Gauss (Sieves - Tables)
ó 1880 Landry & Le Lasseur: 226+ 1 = 274177× 67280421310721
ó 1919 Pierre and Eugène Carissan (Factoring Machine)
Università Roma Tre
![Page 19: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/19.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 4�� ��History of the “Art of Factoring”
ó 220 BC Greeks (Eratosthenes of Cyrene )
ó 1730 Euler 225+ 1 = 641 · 6700417
ó 1750–1800 Fermat, Gauss (Sieves - Tables)
ó 1880 Landry & Le Lasseur: 226+ 1 = 274177× 67280421310721
ó 1919 Pierre and Eugène Carissan (Factoring Machine)
ó 1970 Morrison & Brillhart227
+ 1 = 59649589127497217× 5704689200685129054721
Università Roma Tre
![Page 20: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/20.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 4�� ��History of the “Art of Factoring”
ó 220 BC Greeks (Eratosthenes of Cyrene )
ó 1730 Euler 225+ 1 = 641 · 6700417
ó 1750–1800 Fermat, Gauss (Sieves - Tables)
ó 1880 Landry & Le Lasseur: 226+ 1 = 274177× 67280421310721
ó 1919 Pierre and Eugène Carissan (Factoring Machine)
ó 1970 Morrison & Brillhart227
+ 1 = 59649589127497217× 5704689200685129054721
ó 1980, Richard Brent and John Pollard 228+ 1 = 1238926361552897×
93461639715357977769163558199606896584051237541638188580280321
Università Roma Tre
![Page 21: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/21.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 4�� ��History of the “Art of Factoring”
ó 220 BC Greeks (Eratosthenes of Cyrene )
ó 1730 Euler 225+ 1 = 641 · 6700417
ó 1750–1800 Fermat, Gauss (Sieves - Tables)
ó 1880 Landry & Le Lasseur: 226+ 1 = 274177× 67280421310721
ó 1919 Pierre and Eugène Carissan (Factoring Machine)
ó 1970 Morrison & Brillhart227
+ 1 = 59649589127497217× 5704689200685129054721
ó 1980, Richard Brent and John Pollard 228+ 1 = 1238926361552897×
93461639715357977769163558199606896584051237541638188580280321
ó 1982 Quadratic Sieve QS (Pomerance) Number Fields Sieve NFS
Università Roma Tre
![Page 22: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/22.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 4�� ��History of the “Art of Factoring”
ó 220 BC Greeks (Eratosthenes of Cyrene )
ó 1730 Euler 225+ 1 = 641 · 6700417
ó 1750–1800 Fermat, Gauss (Sieves - Tables)
ó 1880 Landry & Le Lasseur: 226+ 1 = 274177× 67280421310721
ó 1919 Pierre and Eugène Carissan (Factoring Machine)
ó 1970 Morrison & Brillhart227
+ 1 = 59649589127497217× 5704689200685129054721
ó 1980, Richard Brent and John Pollard 228+ 1 = 1238926361552897×
93461639715357977769163558199606896584051237541638188580280321
ó 1982 Quadratic Sieve QS (Pomerance) Number Fields Sieve NFS
ó 1987 Elliptic curves factoring ECF (Lenstra)
Università Roma Tre
![Page 23: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/23.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 5�� ��Carissan’s ancient Factoring Machine
Università Roma Tre
![Page 24: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/24.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 5�� ��Carissan’s ancient Factoring Machine
Hình 1: Conservatoire Nationale des Arts et Métiers in Paris
Università Roma Tre
![Page 25: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/25.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 5�� ��Carissan’s ancient Factoring Machine
Hình 1: Conservatoire Nationale des Arts et Métiers in Paris�� ��http://www.math.uwaterloo.ca/ shallit/Papers/carissan.html
Università Roma Tre
![Page 26: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/26.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 6
Hình 2: Lieutenant Eugène Carissan
Università Roma Tre
![Page 27: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/27.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 6
Hình 2: Lieutenant Eugène Carissan
225058681 = 229× 982789 2 minutes
3450315521 = 1409× 2418769 3 minutes
3570537526921 = 841249× 4244329 18 minutes
Università Roma Tre
![Page 28: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/28.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 7�� ��Contemporary Factoring 1/2
Università Roma Tre
![Page 29: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/29.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 7�� ��Contemporary Factoring 1/2
¶ 1994, Quadratic Sieve (QS): (8 months, 600 voluntaries, 20 countries)D.Atkins, M. Graff, A. Lenstra, P. Leyland
RSA129 = 114381625757888867669235779976146612010218296721242362562561842935706
935245733897830597123563958705058989075147599290026879543541 =
= 3490529510847650949147849619903898133417764638493387843990820577×32769132993266709549961988190834461413177642967992942539798288533
Università Roma Tre
![Page 30: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/30.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 7�� ��Contemporary Factoring 1/2
¶ 1994, Quadratic Sieve (QS): (8 months, 600 voluntaries, 20 countries)D.Atkins, M. Graff, A. Lenstra, P. Leyland
RSA129 = 114381625757888867669235779976146612010218296721242362562561842935706
935245733897830597123563958705058989075147599290026879543541 =
= 3490529510847650949147849619903898133417764638493387843990820577×32769132993266709549961988190834461413177642967992942539798288533
· (February 2 1999), Number Fields Sieve (NFS): (160 Sun, 4 months)RSA155 = 109417386415705274218097073220403576120037329454492059909138421314763499842
88934784717997257891267332497625752899781833797076537244027146743531593354333897 =
= 102639592829741105772054196573991675900716567808038066803341933521790711307779×106603488380168454820927220360012878679207958575989291522270608237193062808643
Università Roma Tre
![Page 31: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/31.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 7�� ��Contemporary Factoring 1/2
¶ 1994, Quadratic Sieve (QS): (8 months, 600 voluntaries, 20 countries)D.Atkins, M. Graff, A. Lenstra, P. Leyland
RSA129 = 114381625757888867669235779976146612010218296721242362562561842935706
935245733897830597123563958705058989075147599290026879543541 =
= 3490529510847650949147849619903898133417764638493387843990820577×32769132993266709549961988190834461413177642967992942539798288533
· (February 2 1999), Number Fields Sieve (NFS): (160 Sun, 4 months)RSA155 = 109417386415705274218097073220403576120037329454492059909138421314763499842
88934784717997257891267332497625752899781833797076537244027146743531593354333897 =
= 102639592829741105772054196573991675900716567808038066803341933521790711307779×106603488380168454820927220360012878679207958575989291522270608237193062808643
¸ (December 3, 2003) (NFS): J. Franke et al. (174 decimal digits)RSA576 = 1881988129206079638386972394616504398071635633794173827007633564229888597152346
65485319060606504743045317388011303396716199692321205734031879550656996221305168759307650257059 =
= 398075086424064937397125500550386491199064362342526708406385189575946388957261768583317×472772146107435302536223071973048224632914695302097116459852171130520711256363590397527
Università Roma Tre
![Page 32: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/32.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 7�� ��Contemporary Factoring 1/2
¶ 1994, Quadratic Sieve (QS): (8 months, 600 voluntaries, 20 countries)D.Atkins, M. Graff, A. Lenstra, P. Leyland
RSA129 = 114381625757888867669235779976146612010218296721242362562561842935706
935245733897830597123563958705058989075147599290026879543541 =
= 3490529510847650949147849619903898133417764638493387843990820577×32769132993266709549961988190834461413177642967992942539798288533
· (February 2 1999), Number Fields Sieve (NFS): (160 Sun, 4 months)RSA155 = 109417386415705274218097073220403576120037329454492059909138421314763499842
88934784717997257891267332497625752899781833797076537244027146743531593354333897 =
= 102639592829741105772054196573991675900716567808038066803341933521790711307779×106603488380168454820927220360012878679207958575989291522270608237193062808643
¸ (December 3, 2003) (NFS): J. Franke et al. (174 decimal digits)RSA576 = 1881988129206079638386972394616504398071635633794173827007633564229888597152346
65485319060606504743045317388011303396716199692321205734031879550656996221305168759307650257059 =
= 398075086424064937397125500550386491199064362342526708406385189575946388957261768583317×472772146107435302536223071973048224632914695302097116459852171130520711256363590397527
¹ (May 9,2005) (NFS): F. Bahr, et al (663 binary digits)RSA200 = 279978339112213278708294676387226016210704467869554285375600099293261284001076093456710529553608
56061822351910951365788637105954482006576775098580557613579098734950144178863178946295187237869221823983 =
3532461934402770121272604978198464368671197400197625023649303468776121253679423200058547956528088349×7925869954478333033347085841480059687737975857364219960734330341455767872818152135381409304740185467
Università Roma Tre
![Page 33: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/33.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 8�� ��Contemporary Factoring 2/2
Università Roma Tre
![Page 34: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/34.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 8�� ��Contemporary Factoring 2/2
Elliptic curves factoring (ECM) H. Lenstra (1985) - small factors (50 digits)
Università Roma Tre
![Page 35: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/35.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 8�� ��Contemporary Factoring 2/2
Elliptic curves factoring (ECM) H. Lenstra (1985) - small factors (50 digits)
» (1993) A. Lenstra, H. Lenstra, Jr., M. Manasse, and J. Pollard 229+ 1 =
2424833× 7455602825647884208337395736200454918783366342657× p99
Università Roma Tre
![Page 36: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/36.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 8�� ��Contemporary Factoring 2/2
Elliptic curves factoring (ECM) H. Lenstra (1985) - small factors (50 digits)
» (1993) A. Lenstra, H. Lenstra, Jr., M. Manasse, and J. Pollard 229+ 1 =
2424833× 7455602825647884208337395736200454918783366342657× p99
» (April 6, 2005) (ECM) B. Dodson 3466 + 1 is divisible by709601635082267320966424084955776789770864725643996885415676682297;
Università Roma Tre
![Page 37: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/37.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 8�� ��Contemporary Factoring 2/2
Elliptic curves factoring (ECM) H. Lenstra (1985) - small factors (50 digits)
» (1993) A. Lenstra, H. Lenstra, Jr., M. Manasse, and J. Pollard 229+ 1 =
2424833× 7455602825647884208337395736200454918783366342657× p99
» (April 6, 2005) (ECM) B. Dodson 3466 + 1 is divisible by709601635082267320966424084955776789770864725643996885415676682297;
¼ (Sept. 5, 2005) (ECM) K. Aoki & T. Shimoyama 10311 − 1 is divisible by4344673058714954477761314793437392900672885445361103905548950933
Università Roma Tre
![Page 38: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/38.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 8�� ��Contemporary Factoring 2/2
Elliptic curves factoring (ECM) H. Lenstra (1985) - small factors (50 digits)
» (1993) A. Lenstra, H. Lenstra, Jr., M. Manasse, and J. Pollard 229+ 1 =
2424833× 7455602825647884208337395736200454918783366342657× p99
» (April 6, 2005) (ECM) B. Dodson 3466 + 1 is divisible by709601635082267320966424084955776789770864725643996885415676682297;
¼ (Sept. 5, 2005) (ECM) K. Aoki & T. Shimoyama 10311 − 1 is divisible by4344673058714954477761314793437392900672885445361103905548950933
For updates see Paul Zimmerman’s “Integer Factoring Records”:�� ��http://www.loria.fr/ zimmerma/records/factor.html
Università Roma Tre
![Page 39: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/39.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 8�� ��Contemporary Factoring 2/2
Elliptic curves factoring (ECM) H. Lenstra (1985) - small factors (50 digits)
» (1993) A. Lenstra, H. Lenstra, Jr., M. Manasse, and J. Pollard 229+ 1 =
2424833× 7455602825647884208337395736200454918783366342657× p99
» (April 6, 2005) (ECM) B. Dodson 3466 + 1 is divisible by709601635082267320966424084955776789770864725643996885415676682297;
¼ (Sept. 5, 2005) (ECM) K. Aoki & T. Shimoyama 10311 − 1 is divisible by4344673058714954477761314793437392900672885445361103905548950933
For updates see Paul Zimmerman’s “Integer Factoring Records”:�� ��http://www.loria.fr/ zimmerma/records/factor.html
More infoes about fatroring in�� ��http://www.crypto-world.com/FactorWorld.html
Università Roma Tre
![Page 40: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/40.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 8�� ��Contemporary Factoring 2/2
Elliptic curves factoring (ECM) H. Lenstra (1985) - small factors (50 digits)
» (1993) A. Lenstra, H. Lenstra, Jr., M. Manasse, and J. Pollard 229+ 1 =
2424833× 7455602825647884208337395736200454918783366342657× p99
» (April 6, 2005) (ECM) B. Dodson 3466 + 1 is divisible by709601635082267320966424084955776789770864725643996885415676682297;
¼ (Sept. 5, 2005) (ECM) K. Aoki & T. Shimoyama 10311 − 1 is divisible by4344673058714954477761314793437392900672885445361103905548950933
For updates see Paul Zimmerman’s “Integer Factoring Records”:�� ��http://www.loria.fr/ zimmerma/records/factor.html
More infoes about fatroring in�� ��http://www.crypto-world.com/FactorWorld.html
Update on “factorization of Fermat Numbers”:�� ��http://www.prothsearch.net/fermat.html
Università Roma Tre
![Page 41: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/41.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 9�� ��Last Minute News
Università Roma Tre
![Page 42: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/42.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 9�� ��Last Minute NewsDate: Thu, 10 Nov 2005 22:07:26 -0500
From: Jens Franke <[email protected]>
We have factored RSA640 by GNFS. The factors are
16347336458092538484431338838650908598417836700330
92312181110852389333100104508151212118167511579
and
19008712816648221131268515739354139754718967899685
15493666638539088027103802104498957191261465571
We did lattice sieving for most special q between 28e7 and 77e7 using factor base bounds of
28e7 on the algebraic side and 15e7 on the rational side. The bounds for large primes were
2ˆ 34. This produced 166e7 relations. After removing duplicates 143e7 relations remained. A
filter job produced a matrix with 36e6 rows and columns, having 74e8 non-zero entries. This
was solved by Block-Lanczos.
Sieving has been done on 80 2.2 GHz Opteron CPUs and took 3 months. The matrix step was
performed on a cluster of 80 2.2 GHz Opterons connected via a Gigabit network and took about
1.5 months.
Calendar time for the factorization (without polynomial selection) was 5 months.
More details will be given later.
F. Bahr, M. Boehm, J. Franke, T. Kleinjung
Università Roma Tre
![Page 43: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/43.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 10
RSA
Adi Shamir, Ron L. Rivest, Leonard Adleman (1978)
Università Roma Tre
![Page 44: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/44.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 11�� ��The RSA cryptosystem
Università Roma Tre
![Page 45: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/45.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 11�� ��The RSA cryptosystem
1978 R. L. Rivest, A. Shamir, L. Adleman (Patent expired in 1998)
Università Roma Tre
![Page 46: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/46.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 11�� ��The RSA cryptosystem
1978 R. L. Rivest, A. Shamir, L. Adleman (Patent expired in 1998)
Problem: Alice wants to send the message P to Bob so that Charles cannotread it
Università Roma Tre
![Page 47: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/47.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 11�� ��The RSA cryptosystem
1978 R. L. Rivest, A. Shamir, L. Adleman (Patent expired in 1998)
Problem: Alice wants to send the message P to Bob so that Charles cannotread it
A (Alice) −−−−−−→ B (Bob)
↑C (Charles)
Università Roma Tre
![Page 48: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/48.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 11�� ��The RSA cryptosystem
1978 R. L. Rivest, A. Shamir, L. Adleman (Patent expired in 1998)
Problem: Alice wants to send the message P to Bob so that Charles cannotread it
A (Alice) −−−−−−→ B (Bob)
↑C (Charles)
¶
·
¸
¹
Università Roma Tre
![Page 49: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/49.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 11�� ��The RSA cryptosystem
1978 R. L. Rivest, A. Shamir, L. Adleman (Patent expired in 1998)
Problem: Alice wants to send the message P to Bob so that Charles cannotread it
A (Alice) −−−−−−→ B (Bob)
↑C (Charles)
¶ Key generation Bob has to do it
·
¸
¹
Università Roma Tre
![Page 50: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/50.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 11�� ��The RSA cryptosystem
1978 R. L. Rivest, A. Shamir, L. Adleman (Patent expired in 1998)
Problem: Alice wants to send the message P to Bob so that Charles cannotread it
A (Alice) −−−−−−→ B (Bob)
↑C (Charles)
¶ Key generation Bob has to do it
· Encryption Alice has to do it
¸
¹
Università Roma Tre
![Page 51: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/51.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 11�� ��The RSA cryptosystem
1978 R. L. Rivest, A. Shamir, L. Adleman (Patent expired in 1998)
Problem: Alice wants to send the message P to Bob so that Charles cannotread it
A (Alice) −−−−−−→ B (Bob)
↑C (Charles)
¶ Key generation Bob has to do it
· Encryption Alice has to do it
¸ Decryption Bob has to do it
¹
Università Roma Tre
![Page 52: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/52.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 11�� ��The RSA cryptosystem
1978 R. L. Rivest, A. Shamir, L. Adleman (Patent expired in 1998)
Problem: Alice wants to send the message P to Bob so that Charles cannotread it
A (Alice) −−−−−−→ B (Bob)
↑C (Charles)
¶ Key generation Bob has to do it
· Encryption Alice has to do it
¸ Decryption Bob has to do it
¹ Attack Charles would like to do it
Università Roma Tre
![Page 53: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/53.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 12�� ��Bob: Key generation
Università Roma Tre
![Page 54: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/54.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 12�� ��Bob: Key generation
-
-
-
-
-
Università Roma Tre
![Page 55: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/55.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 12�� ��Bob: Key generation
- He chooses randomly p and q primes (p, q ≈ 10100)
-
-
-
-
Università Roma Tre
![Page 56: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/56.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 12�� ��Bob: Key generation
- He chooses randomly p and q primes (p, q ≈ 10100)
- He computes M = p× q, ϕ(M) = (p− 1)× (q − 1)
-
-
-
Università Roma Tre
![Page 57: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/57.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 12�� ��Bob: Key generation
- He chooses randomly p and q primes (p, q ≈ 10100)
- He computes M = p× q, ϕ(M) = (p− 1)× (q − 1)
- He chooses an integer e s.t.
-
-
Università Roma Tre
![Page 58: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/58.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 12�� ��Bob: Key generation
- He chooses randomly p and q primes (p, q ≈ 10100)
- He computes M = p× q, ϕ(M) = (p− 1)× (q − 1)
- He chooses an integer e s.t.
0 ≤ e ≤ ϕ(M) and gcd(e, ϕ(M)) = 1
-
-
Università Roma Tre
![Page 59: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/59.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 12�� ��Bob: Key generation
- He chooses randomly p and q primes (p, q ≈ 10100)
- He computes M = p× q, ϕ(M) = (p− 1)× (q − 1)
- He chooses an integer e s.t.
0 ≤ e ≤ ϕ(M) and gcd(e, ϕ(M)) = 1
Note. One could take e = 3 and p ≡ q ≡ 2 mod 3
-
-
Università Roma Tre
![Page 60: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/60.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 12�� ��Bob: Key generation
- He chooses randomly p and q primes (p, q ≈ 10100)
- He computes M = p× q, ϕ(M) = (p− 1)× (q − 1)
- He chooses an integer e s.t.
0 ≤ e ≤ ϕ(M) and gcd(e, ϕ(M)) = 1
Note. One could take e = 3 and p ≡ q ≡ 2 mod 3
Experts recommend e = 216 + 1
-
-
Università Roma Tre
![Page 61: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/61.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 12�� ��Bob: Key generation
- He chooses randomly p and q primes (p, q ≈ 10100)
- He computes M = p× q, ϕ(M) = (p− 1)× (q − 1)
- He chooses an integer e s.t.
0 ≤ e ≤ ϕ(M) and gcd(e, ϕ(M)) = 1
Note. One could take e = 3 and p ≡ q ≡ 2 mod 3
Experts recommend e = 216 + 1
- He computes arithmetic inverse d of e modulo ϕ(M)
-
Università Roma Tre
![Page 62: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/62.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 12�� ��Bob: Key generation
- He chooses randomly p and q primes (p, q ≈ 10100)
- He computes M = p× q, ϕ(M) = (p− 1)× (q − 1)
- He chooses an integer e s.t.
0 ≤ e ≤ ϕ(M) and gcd(e, ϕ(M)) = 1
Note. One could take e = 3 and p ≡ q ≡ 2 mod 3
Experts recommend e = 216 + 1
- He computes arithmetic inverse d of e modulo ϕ(M)
(i.e. d ∈ N (unique ≤ ϕ(M)) s.t. e× d ≡ 1 (mod ϕ(M)))
-
Università Roma Tre
![Page 63: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/63.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 12�� ��Bob: Key generation
- He chooses randomly p and q primes (p, q ≈ 10100)
- He computes M = p× q, ϕ(M) = (p− 1)× (q − 1)
- He chooses an integer e s.t.
0 ≤ e ≤ ϕ(M) and gcd(e, ϕ(M)) = 1
Note. One could take e = 3 and p ≡ q ≡ 2 mod 3
Experts recommend e = 216 + 1
- He computes arithmetic inverse d of e modulo ϕ(M)
(i.e. d ∈ N (unique ≤ ϕ(M)) s.t. e× d ≡ 1 (mod ϕ(M)))
- Publishes (M, e) public key and hides secret key d
Università Roma Tre
![Page 64: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/64.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 12�� ��Bob: Key generation
- He chooses randomly p and q primes (p, q ≈ 10100)
- He computes M = p× q, ϕ(M) = (p− 1)× (q − 1)
- He chooses an integer e s.t.
0 ≤ e ≤ ϕ(M) and gcd(e, ϕ(M)) = 1
Note. One could take e = 3 and p ≡ q ≡ 2 mod 3
Experts recommend e = 216 + 1
- He computes arithmetic inverse d of e modulo ϕ(M)
(i.e. d ∈ N (unique ≤ ϕ(M)) s.t. e× d ≡ 1 (mod ϕ(M)))
- Publishes (M, e) public key and hides secret key d
Problem: How does Bob do all this?- We will go came back to it!
Università Roma Tre
![Page 65: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/65.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 13�� ��Alice: Encryption
Università Roma Tre
![Page 66: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/66.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 13�� ��Alice: Encryption
Represent the message P as an element of Z/MZ
Università Roma Tre
![Page 67: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/67.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 13�� ��Alice: Encryption
Represent the message P as an element of Z/MZ
(for example) A ↔ 1 B ↔ 2 C ↔ 3 . . . Z ↔ 26 AA ↔ 27 . . .
Università Roma Tre
![Page 68: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/68.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 13�� ��Alice: Encryption
Represent the message P as an element of Z/MZ
(for example) A ↔ 1 B ↔ 2 C ↔ 3 . . . Z ↔ 26 AA ↔ 27 . . .
SAIGON ↔ 19 · 265+ 26
4+ 9 · 263
+ 7 · 262+ 15 · 26 + 14 = 226366440
Note. Better if texts are not too short. Otherwise one performs some padding
Università Roma Tre
![Page 69: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/69.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 13�� ��Alice: Encryption
Represent the message P as an element of Z/MZ
(for example) A ↔ 1 B ↔ 2 C ↔ 3 . . . Z ↔ 26 AA ↔ 27 . . .
SAIGON ↔ 19 · 265+ 26
4+ 9 · 263
+ 7 · 262+ 15 · 26 + 14 = 226366440
Note. Better if texts are not too short. Otherwise one performs some padding
C = E(P) = Pe (mod M)
Università Roma Tre
![Page 70: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/70.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 13�� ��Alice: Encryption
Represent the message P as an element of Z/MZ
(for example) A ↔ 1 B ↔ 2 C ↔ 3 . . . Z ↔ 26 AA ↔ 27 . . .
SAIGON ↔ 19 · 265+ 26
4+ 9 · 263
+ 7 · 262+ 15 · 26 + 14 = 226366440
Note. Better if texts are not too short. Otherwise one performs some padding
C = E(P) = Pe (mod M)
Example: p = 9049465727, q = 8789181607, M = 79537397720925283289, e = 216 + 1 = 65537,
P = SAIGON:
Università Roma Tre
![Page 71: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/71.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 13�� ��Alice: Encryption
Represent the message P as an element of Z/MZ
(for example) A ↔ 1 B ↔ 2 C ↔ 3 . . . Z ↔ 26 AA ↔ 27 . . .
SAIGON ↔ 19 · 265+ 26
4+ 9 · 263
+ 7 · 262+ 15 · 26 + 14 = 226366440
Note. Better if texts are not too short. Otherwise one performs some padding
C = E(P) = Pe (mod M)
Example: p = 9049465727, q = 8789181607, M = 79537397720925283289, e = 216 + 1 = 65537,
P = SAIGON:
E(SAIGON) = 22636644065537
(mod79537397720925283289)
= 71502481501746956206 = C = ZPOYWXZXDNCGUBA
Università Roma Tre
![Page 72: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/72.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 14�� ��Bob: Decryption
Università Roma Tre
![Page 73: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/73.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 14�� ��Bob: Decryption
P = D(C) = Cd (mod M)
Università Roma Tre
![Page 74: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/74.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 14�� ��Bob: Decryption
P = D(C) = Cd (mod M)
Note. Bob decrypts because he is the only one that knows d.
Università Roma Tre
![Page 75: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/75.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 14�� ��Bob: Decryption
P = D(C) = Cd (mod M)
Note. Bob decrypts because he is the only one that knows d.
Theorem. (Euler) If a,m ∈ N, gcd(a,m) = 1,
aϕ(m) ≡ 1 (mod m).
If n1 ≡ n2 mod ϕ(m) then an1 ≡ an2 mod m.
Università Roma Tre
![Page 76: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/76.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 14�� ��Bob: Decryption
P = D(C) = Cd (mod M)
Note. Bob decrypts because he is the only one that knows d.
Theorem. (Euler) If a,m ∈ N, gcd(a,m) = 1,
aϕ(m) ≡ 1 (mod m).
If n1 ≡ n2 mod ϕ(m) then an1 ≡ an2 mod m.
Therefore (ed ≡ 1 mod ϕ(M))
D(E(P)) = Ped ≡ P mod M
Università Roma Tre
![Page 77: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/77.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 14�� ��Bob: Decryption
P = D(C) = Cd (mod M)
Note. Bob decrypts because he is the only one that knows d.
Theorem. (Euler) If a,m ∈ N, gcd(a,m) = 1,
aϕ(m) ≡ 1 (mod m).
If n1 ≡ n2 mod ϕ(m) then an1 ≡ an2 mod m.
Therefore (ed ≡ 1 mod ϕ(M))
D(E(P)) = Ped ≡ P mod MExample(cont.):d = 65537−1 mod ϕ(9049465727 · 8789181607) = 57173914060643780153
D(ZPOYWXZXDNCGUBA) =
7150248150174695620657173914060643780153(mod79537397720925283289) = SAIGON
Università Roma Tre
![Page 78: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/78.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 15
RSA at work
Università Roma Tre
![Page 79: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/79.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 16�� ��Repeated squaring algorithm
Università Roma Tre
![Page 80: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/80.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 16�� ��Repeated squaring algorithm
Problem: How does one compute ab mod c?
Università Roma Tre
![Page 81: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/81.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 16�� ��Repeated squaring algorithm
Problem: How does one compute ab mod c?7150248150174695620657173914060643780153(mod79537397720925283289)
Università Roma Tre
![Page 82: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/82.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 16�� ��Repeated squaring algorithm
Problem: How does one compute ab mod c?7150248150174695620657173914060643780153(mod79537397720925283289)
-
-
-
Università Roma Tre
![Page 83: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/83.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 16�� ��Repeated squaring algorithm
Problem: How does one compute ab mod c?7150248150174695620657173914060643780153(mod79537397720925283289)
- Compute the binary expansion b =[log2 b]∑
j=0
εj2j
-
-
Università Roma Tre
![Page 84: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/84.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 16�� ��Repeated squaring algorithm
Problem: How does one compute ab mod c?7150248150174695620657173914060643780153(mod79537397720925283289)
- Compute the binary expansion b =[log2 b]∑
j=0
εj2j
57173914060643780153=110001100101110010100010111110101011110011011000100100011000111001
-
-
Università Roma Tre
![Page 85: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/85.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 16�� ��Repeated squaring algorithm
Problem: How does one compute ab mod c?7150248150174695620657173914060643780153(mod79537397720925283289)
- Compute the binary expansion b =[log2 b]∑
j=0
εj2j
57173914060643780153=110001100101110010100010111110101011110011011000100100011000111001
- Compute recursively a2j
mod c, j = 1, . . . , [log2 b]:
-
Università Roma Tre
![Page 86: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/86.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 16�� ��Repeated squaring algorithm
Problem: How does one compute ab mod c?7150248150174695620657173914060643780153(mod79537397720925283289)
- Compute the binary expansion b =[log2 b]∑
j=0
εj2j
57173914060643780153=110001100101110010100010111110101011110011011000100100011000111001
- Compute recursively a2j
mod c, j = 1, . . . , [log2 b]:
a2j
mod c =(a2j−1
mod c)2
mod c
-
Università Roma Tre
![Page 87: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/87.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 16�� ��Repeated squaring algorithm
Problem: How does one compute ab mod c?7150248150174695620657173914060643780153(mod79537397720925283289)
- Compute the binary expansion b =[log2 b]∑
j=0
εj2j
57173914060643780153=110001100101110010100010111110101011110011011000100100011000111001
- Compute recursively a2j
mod c, j = 1, . . . , [log2 b]:
a2j
mod c =(a2j−1
mod c)2
mod c
- Multiply the a2j
mod c with εj = 1
Università Roma Tre
![Page 88: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/88.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 16�� ��Repeated squaring algorithm
Problem: How does one compute ab mod c?7150248150174695620657173914060643780153(mod79537397720925283289)
- Compute the binary expansion b =[log2 b]∑
j=0
εj2j
57173914060643780153=110001100101110010100010111110101011110011011000100100011000111001
- Compute recursively a2j
mod c, j = 1, . . . , [log2 b]:
a2j
mod c =(a2j−1
mod c)2
mod c
- Multiply the a2j
mod c with εj = 1
ab mod c =(∏[log2 b]
j=0,εj=1 a2j
mod c)
mod c
Università Roma Tre
![Page 89: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/89.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 17�� ��#{oper. in Z/cZ to compute ab mod c} ≤ 2 log2 b
Università Roma Tre
![Page 90: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/90.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 17�� ��#{oper. in Z/cZ to compute ab mod c} ≤ 2 log2 b
ZPOYWXZXDNCGUBA is decrypted with 131 operations in
Z/79537397720925283289Z
Università Roma Tre
![Page 91: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/91.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 17�� ��#{oper. in Z/cZ to compute ab mod c} ≤ 2 log2 b
ZPOYWXZXDNCGUBA is decrypted with 131 operations in
Z/79537397720925283289Z
Pseudo code: ec(a, b) = ab mod c
Università Roma Tre
![Page 92: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/92.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 17�� ��#{oper. in Z/cZ to compute ab mod c} ≤ 2 log2 b
ZPOYWXZXDNCGUBA is decrypted with 131 operations in
Z/79537397720925283289Z
Pseudo code: ec(a, b) = ab mod c
ec(a, b) = if b = 1 then a mod c
if 2|b then ec(a, b2 )2 mod c
else a ∗ ec(a, b−12 )2 mod c
Università Roma Tre
![Page 93: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/93.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 17�� ��#{oper. in Z/cZ to compute ab mod c} ≤ 2 log2 b
ZPOYWXZXDNCGUBA is decrypted with 131 operations in
Z/79537397720925283289Z
Pseudo code: ec(a, b) = ab mod c
ec(a, b) = if b = 1 then a mod c
if 2|b then ec(a, b2 )2 mod c
else a ∗ ec(a, b−12 )2 mod c
To encrypt with e = 216 + 1, only 17 operations in Z/MZ are enough
Università Roma Tre
![Page 94: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/94.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 18�� ��Key generation
Università Roma Tre
![Page 95: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/95.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 18�� ��Key generation
Problem. Produce a random prime p ≈ 10100
Probabilistic algorithm (type Las Vegas)
1. Let p = Random(10100)
2. If isprime(p)=1 then Output=p else goto 1
Università Roma Tre
![Page 96: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/96.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 18�� ��Key generation
Problem. Produce a random prime p ≈ 10100
Probabilistic algorithm (type Las Vegas)
1. Let p = Random(10100)
2. If isprime(p)=1 then Output=p else goto 1
subproblems:
Università Roma Tre
![Page 97: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/97.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 18�� ��Key generation
Problem. Produce a random prime p ≈ 10100
Probabilistic algorithm (type Las Vegas)
1. Let p = Random(10100)
2. If isprime(p)=1 then Output=p else goto 1
subproblems:
A. How many iterations are necessary?(i.e. how are primes distributes?)
Università Roma Tre
![Page 98: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/98.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 18�� ��Key generation
Problem. Produce a random prime p ≈ 10100
Probabilistic algorithm (type Las Vegas)
1. Let p = Random(10100)
2. If isprime(p)=1 then Output=p else goto 1
subproblems:
A. How many iterations are necessary?(i.e. how are primes distributes?)
B. How does one check if p is prime?(i.e. how does one compute isprime(p)?) Primality test
Università Roma Tre
![Page 99: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/99.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 18�� ��Key generation
Problem. Produce a random prime p ≈ 10100
Probabilistic algorithm (type Las Vegas)
1. Let p = Random(10100)
2. If isprime(p)=1 then Output=p else goto 1
subproblems:
A. How many iterations are necessary?(i.e. how are primes distributes?)
B. How does one check if p is prime?(i.e. how does one compute isprime(p)?) Primality test
False Metropolitan Legend: Check primality is equivalent to factoring
Università Roma Tre
![Page 100: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/100.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 19�� ��A. Distribution of prime numbers
Università Roma Tre
![Page 101: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/101.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 19�� ��A. Distribution of prime numbers
π(x) = #{p ≤ x t. c. p is prime}
Università Roma Tre
![Page 102: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/102.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 19�� ��A. Distribution of prime numbers
π(x) = #{p ≤ x t. c. p is prime}
Theorem. (Hadamard - de la vallee Pussen - 1897)
π(x) ∼ x
log x
Università Roma Tre
![Page 103: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/103.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 19�� ��A. Distribution of prime numbers
π(x) = #{p ≤ x t. c. p is prime}
Theorem. (Hadamard - de la vallee Pussen - 1897)
π(x) ∼ x
log x
Quantitative version:
Theorem. (Rosser - Schoenfeld) if x ≥ 67x
log x− 1/2< π(x) <
x
log x− 3/2
Università Roma Tre
![Page 104: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/104.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 19�� ��A. Distribution of prime numbers
π(x) = #{p ≤ x t. c. p is prime}
Theorem. (Hadamard - de la vallee Pussen - 1897)
π(x) ∼ x
log x
Quantitative version:
Theorem. (Rosser - Schoenfeld) if x ≥ 67x
log x− 1/2< π(x) <
x
log x− 3/2
Therefore
0.0043523959267 < Prob�(Random(10100) = prime
�< 0.004371422086
Università Roma Tre
![Page 105: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/105.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 20
If Pk is the probability that among k random numbers≤ 10100 there is a primeone, then
Università Roma Tre
![Page 106: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/106.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 20
If Pk is the probability that among k random numbers≤ 10100 there is a primeone, then
Pk = 1−(
1− π(10100)10100
)k
Università Roma Tre
![Page 107: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/107.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 20
If Pk is the probability that among k random numbers≤ 10100 there is a primeone, then
Pk = 1−(
1− π(10100)10100
)k
Therefore0.663942 < P250 < 0.66554440
Università Roma Tre
![Page 108: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/108.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 20
If Pk is the probability that among k random numbers≤ 10100 there is a primeone, then
Pk = 1−(
1− π(10100)10100
)k
Therefore0.663942 < P250 < 0.66554440
To speed up the process: One can consider only odd random numbers notdivisible by 3 nor by 5.
Università Roma Tre
![Page 109: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/109.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 20
If Pk is the probability that among k random numbers≤ 10100 there is a primeone, then
Pk = 1−(
1− π(10100)10100
)k
Therefore0.663942 < P250 < 0.66554440
To speed up the process: One can consider only odd random numbers notdivisible by 3 nor by 5.
LetΨ(x, 30) = # {n ≤ x s.t. gcd(n, 30) = 1}
Università Roma Tre
![Page 110: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/110.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 21
To speed up the process: One can consider only odd random numbers notdivisible by 3 nor by 5.
Università Roma Tre
![Page 111: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/111.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 21
To speed up the process: One can consider only odd random numbers notdivisible by 3 nor by 5.
LetΨ(x, 30) = # {n ≤ x s.t. gcd(n, 30) = 1}
then
Università Roma Tre
![Page 112: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/112.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 21
To speed up the process: One can consider only odd random numbers notdivisible by 3 nor by 5.
LetΨ(x, 30) = # {n ≤ x s.t. gcd(n, 30) = 1}
then
415
x− 4 < Ψ(x, 30) <415
x + 4
Università Roma Tre
![Page 113: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/113.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 21
To speed up the process: One can consider only odd random numbers notdivisible by 3 nor by 5.
LetΨ(x, 30) = # {n ≤ x s.t. gcd(n, 30) = 1}
then
415
x− 4 < Ψ(x, 30) <415
x + 4
Hence, if P ′k is the probability that among k random numbers ≤ 10100
coprime with 30, there is a prime one, then
Università Roma Tre
![Page 114: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/114.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 21
To speed up the process: One can consider only odd random numbers notdivisible by 3 nor by 5.
LetΨ(x, 30) = # {n ≤ x s.t. gcd(n, 30) = 1}
then
415
x− 4 < Ψ(x, 30) <415
x + 4
Hence, if P ′k is the probability that among k random numbers ≤ 10100
coprime with 30, there is a prime one, then
P ′k = 1−
(1− π(10100)
Ψ(10100, 30)
)k
Università Roma Tre
![Page 115: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/115.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 21
To speed up the process: One can consider only odd random numbers notdivisible by 3 nor by 5.
LetΨ(x, 30) = # {n ≤ x s.t. gcd(n, 30) = 1}
then
415
x− 4 < Ψ(x, 30) <415
x + 4
Hence, if P ′k is the probability that among k random numbers ≤ 10100
coprime with 30, there is a prime one, then
P ′k = 1−
(1− π(10100)
Ψ(10100, 30)
)k
and0.98365832 < P ′
250 < 0.98395199
Università Roma Tre
![Page 116: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/116.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 22�� ��B. Primality test
Università Roma Tre
![Page 117: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/117.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 22�� ��B. Primality test
Fermat Little Theorem. If p is prime, p - a ∈ N
ap−1 ≡ 1 mod p
Università Roma Tre
![Page 118: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/118.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 22�� ��B. Primality test
Fermat Little Theorem. If p is prime, p - a ∈ N
ap−1 ≡ 1 mod p
NON-primality test
M ∈ Z, 2M−1 6≡ 1 mod M ==> Mcomposite!
Università Roma Tre
![Page 119: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/119.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 22�� ��B. Primality test
Fermat Little Theorem. If p is prime, p - a ∈ N
ap−1 ≡ 1 mod p
NON-primality test
M ∈ Z, 2M−1 6≡ 1 mod M ==> Mcomposite!
Example: 2RSA2048−1 6≡ 1 mod RSA2048
Therefore RSA2048 is composite!
Università Roma Tre
![Page 120: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/120.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 22�� ��B. Primality test
Fermat Little Theorem. If p is prime, p - a ∈ N
ap−1 ≡ 1 mod p
NON-primality test
M ∈ Z, 2M−1 6≡ 1 mod M ==> Mcomposite!
Example: 2RSA2048−1 6≡ 1 mod RSA2048
Therefore RSA2048 is composite!
Fermat little Theorem does not invert. Infact
Università Roma Tre
![Page 121: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/121.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 22�� ��B. Primality test
Fermat Little Theorem. If p is prime, p - a ∈ N
ap−1 ≡ 1 mod p
NON-primality test
M ∈ Z, 2M−1 6≡ 1 mod M ==> Mcomposite!
Example: 2RSA2048−1 6≡ 1 mod RSA2048
Therefore RSA2048 is composite!
Fermat little Theorem does not invert. Infact
293960 ≡ 1 (mod 93961) but 93961 = 7× 31× 433
Università Roma Tre
![Page 122: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/122.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 23�� ��Strong pseudo primes
Università Roma Tre
![Page 123: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/123.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 23�� ��Strong pseudo primes
From now on m ≡ 3 mod 4 (just to simplify the notation)
Università Roma Tre
![Page 124: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/124.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 23�� ��Strong pseudo primes
From now on m ≡ 3 mod 4 (just to simplify the notation)
Definition. m ∈ N, m ≡ 3 mod 4, composite is said strong pseudo prime(SPSP) in base a if
a(m−1)/2 ≡ ±1 (mod m).
Università Roma Tre
![Page 125: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/125.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 23�� ��Strong pseudo primes
From now on m ≡ 3 mod 4 (just to simplify the notation)
Definition. m ∈ N, m ≡ 3 mod 4, composite is said strong pseudo prime(SPSP) in base a if
a(m−1)/2 ≡ ±1 (mod m).
Note. If p > 2 prime ==> a(p−1)/2 ≡ ±1 (mod p)
Let S = {a ∈ Z/mZ s.t. gcd(m,a) = 1, a(m−1)/2 ≡ ±1 (mod m)}
Università Roma Tre
![Page 126: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/126.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 23�� ��Strong pseudo primes
From now on m ≡ 3 mod 4 (just to simplify the notation)
Definition. m ∈ N, m ≡ 3 mod 4, composite is said strong pseudo prime(SPSP) in base a if
a(m−1)/2 ≡ ±1 (mod m).
Note. If p > 2 prime ==> a(p−1)/2 ≡ ±1 (mod p)
Let S = {a ∈ Z/mZ s.t. gcd(m,a) = 1, a(m−1)/2 ≡ ±1 (mod m)}
À
Á
Â
Ã
Università Roma Tre
![Page 127: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/127.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 23�� ��Strong pseudo primes
From now on m ≡ 3 mod 4 (just to simplify the notation)
Definition. m ∈ N, m ≡ 3 mod 4, composite is said strong pseudo prime(SPSP) in base a if
a(m−1)/2 ≡ ±1 (mod m).
Note. If p > 2 prime ==> a(p−1)/2 ≡ ±1 (mod p)
Let S = {a ∈ Z/mZ s.t. gcd(m,a) = 1, a(m−1)/2 ≡ ±1 (mod m)}
À S ⊆ (Z/mZ)∗ subgroup
Á
Â
Ã
Università Roma Tre
![Page 128: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/128.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 23�� ��Strong pseudo primes
From now on m ≡ 3 mod 4 (just to simplify the notation)
Definition. m ∈ N, m ≡ 3 mod 4, composite is said strong pseudo prime(SPSP) in base a if
a(m−1)/2 ≡ ±1 (mod m).
Note. If p > 2 prime ==> a(p−1)/2 ≡ ±1 (mod p)
Let S = {a ∈ Z/mZ s.t. gcd(m,a) = 1, a(m−1)/2 ≡ ±1 (mod m)}
À S ⊆ (Z/mZ)∗ subgroup
Á If m is composite ==> proper subgroup
Â
Ã
Università Roma Tre
![Page 129: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/129.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 23�� ��Strong pseudo primes
From now on m ≡ 3 mod 4 (just to simplify the notation)
Definition. m ∈ N, m ≡ 3 mod 4, composite is said strong pseudo prime(SPSP) in base a if
a(m−1)/2 ≡ ±1 (mod m).
Note. If p > 2 prime ==> a(p−1)/2 ≡ ±1 (mod p)
Let S = {a ∈ Z/mZ s.t. gcd(m,a) = 1, a(m−1)/2 ≡ ±1 (mod m)}
À S ⊆ (Z/mZ)∗ subgroup
Á If m is composite ==> proper subgroup
 If m is composite ==> #S ≤ ϕ(m)4
Ã
Università Roma Tre
![Page 130: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/130.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 23�� ��Strong pseudo primes
From now on m ≡ 3 mod 4 (just to simplify the notation)
Definition. m ∈ N, m ≡ 3 mod 4, composite is said strong pseudo prime(SPSP) in base a if
a(m−1)/2 ≡ ±1 (mod m).
Note. If p > 2 prime ==> a(p−1)/2 ≡ ±1 (mod p)
Let S = {a ∈ Z/mZ s.t. gcd(m,a) = 1, a(m−1)/2 ≡ ±1 (mod m)}
À S ⊆ (Z/mZ)∗ subgroup
Á If m is composite ==> proper subgroup
 If m is composite ==> #S ≤ ϕ(m)4
à If m is composite ==> Prob(m SPSP in base a) ≤ 0, 25
Università Roma Tre
![Page 131: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/131.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 24�� ��Miller–Rabin primality test
Università Roma Tre
![Page 132: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/132.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 24�� ��Miller–Rabin primality test
Let m ≡ 3 mod 4
Università Roma Tre
![Page 133: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/133.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 24�� ��Miller–Rabin primality test
Let m ≡ 3 mod 4
Miller Rabin algorithm with k iterations
N = (m− 1)/2
for j = 0 to k do a =Random(m)
if aN 6≡ ±1 mod m then OUPUT=(m composite): END
endfor OUTPUT=(m prime)
Università Roma Tre
![Page 134: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/134.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 24�� ��Miller–Rabin primality test
Let m ≡ 3 mod 4
Miller Rabin algorithm with k iterations
N = (m− 1)/2
for j = 0 to k do a =Random(m)
if aN 6≡ ±1 mod m then OUPUT=(m composite): END
endfor OUTPUT=(m prime)
Monte Carlo primality test
Università Roma Tre
![Page 135: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/135.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 24�� ��Miller–Rabin primality test
Let m ≡ 3 mod 4
Miller Rabin algorithm with k iterations
N = (m− 1)/2
for j = 0 to k do a =Random(m)
if aN 6≡ ±1 mod m then OUPUT=(m composite): END
endfor OUTPUT=(m prime)
Monte Carlo primality test
Prob(Miller Rabin says m prime and m is composite) / 14k
Università Roma Tre
![Page 136: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/136.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 24�� ��Miller–Rabin primality test
Let m ≡ 3 mod 4
Miller Rabin algorithm with k iterations
N = (m− 1)/2
for j = 0 to k do a =Random(m)
if aN 6≡ ±1 mod m then OUPUT=(m composite): END
endfor OUTPUT=(m prime)
Monte Carlo primality test
Prob(Miller Rabin says m prime and m is composite) / 14k
In the real world, software uses Miller Rabin with k = 10
Università Roma Tre
![Page 137: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/137.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 25�� ��Deterministic primality tests
Università Roma Tre
![Page 138: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/138.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 25�� ��Deterministic primality tests
Theorem. (Miller, Bach) If m is composite, thenGRH ==> ∃a ≤ 2 log2 m s.t. a(m−1)/2 6≡ ±1 (mod m).
(i.e. m is not SPSP in base a.)
Università Roma Tre
![Page 139: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/139.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 25�� ��Deterministic primality tests
Theorem. (Miller, Bach) If m is composite, thenGRH ==> ∃a ≤ 2 log2 m s.t. a(m−1)/2 6≡ ±1 (mod m).
(i.e. m is not SPSP in base a.)
Consequence: “Miller–Rabin de–randomizes on GRH” (m ≡ 3 mod 4)
Università Roma Tre
![Page 140: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/140.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 25�� ��Deterministic primality tests
Theorem. (Miller, Bach) If m is composite, thenGRH ==> ∃a ≤ 2 log2 m s.t. a(m−1)/2 6≡ ±1 (mod m).
(i.e. m is not SPSP in base a.)
Consequence: “Miller–Rabin de–randomizes on GRH” (m ≡ 3 mod 4)
for a = 2 to 2 log2 m do
if a(m−1)/2 6≡ ±1 mod m then
OUPUT=(m composite): END
endfor OUTPUT=(m prime)
Università Roma Tre
![Page 141: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/141.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 25�� ��Deterministic primality tests
Theorem. (Miller, Bach) If m is composite, thenGRH ==> ∃a ≤ 2 log2 m s.t. a(m−1)/2 6≡ ±1 (mod m).
(i.e. m is not SPSP in base a.)
Consequence: “Miller–Rabin de–randomizes on GRH” (m ≡ 3 mod 4)
for a = 2 to 2 log2 m do
if a(m−1)/2 6≡ ±1 mod m then
OUPUT=(m composite): END
endfor OUTPUT=(m prime)
Deterministic Polynomial time algorithm
Università Roma Tre
![Page 142: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/142.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 25�� ��Deterministic primality tests
Theorem. (Miller, Bach) If m is composite, thenGRH ==> ∃a ≤ 2 log2 m s.t. a(m−1)/2 6≡ ±1 (mod m).
(i.e. m is not SPSP in base a.)
Consequence: “Miller–Rabin de–randomizes on GRH” (m ≡ 3 mod 4)
for a = 2 to 2 log2 m do
if a(m−1)/2 6≡ ±1 mod m then
OUPUT=(m composite): END
endfor OUTPUT=(m prime)
Deterministic Polynomial time algorithm
It runs in O(log5 m) operations in Z/mZ.
Università Roma Tre
![Page 143: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/143.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 26�� ��Certified prime records
Università Roma Tre
![Page 144: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/144.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 26�� ��Certified prime records
Top 10 Largest primes:
Università Roma Tre
![Page 145: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/145.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 26�� ��Certified prime records
Top 10 Largest primes:
1 225964951 − 1 7816230 Nowak 2005 Mersenne 42?
2 224036583 − 1 7235733 Findley 2004 Mersenne 41?
3 220996011 − 1 6320430 Shafer 2003 Mersenne 40?
4 213466917 − 1 4053946 Cameron 2001 Mersenne 39
5 27653× 29167433 + 1 2759677 Gordon 2005
6 28433× 27830457 + 1 2357207 SB7 2004
7 26972593 − 1 2098960 Hajratwala 1999 Mersenne 38
8 5359× 25054502 + 1 1521561 Sundquist 2003
9 4847× 23321063 + 1 999744 Hassler 2005
10 23021377 − 1 909526 Clarkson 1998 Mersenne 37
Università Roma Tre
![Page 146: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/146.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 26�� ��Certified prime records
Top 10 Largest primes:
1 225964951 − 1 7816230 Nowak 2005 Mersenne 42?
2 224036583 − 1 7235733 Findley 2004 Mersenne 41?
3 220996011 − 1 6320430 Shafer 2003 Mersenne 40?
4 213466917 − 1 4053946 Cameron 2001 Mersenne 39
5 27653× 29167433 + 1 2759677 Gordon 2005
6 28433× 27830457 + 1 2357207 SB7 2004
7 26972593 − 1 2098960 Hajratwala 1999 Mersenne 38
8 5359× 25054502 + 1 1521561 Sundquist 2003
9 4847× 23321063 + 1 999744 Hassler 2005
10 23021377 − 1 909526 Clarkson 1998 Mersenne 37
- Mersenne’s Numbers:Mp = 2p − 1
Università Roma Tre
![Page 147: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/147.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 26�� ��Certified prime records
Top 10 Largest primes:
1 225964951 − 1 7816230 Nowak 2005 Mersenne 42?
2 224036583 − 1 7235733 Findley 2004 Mersenne 41?
3 220996011 − 1 6320430 Shafer 2003 Mersenne 40?
4 213466917 − 1 4053946 Cameron 2001 Mersenne 39
5 27653× 29167433 + 1 2759677 Gordon 2005
6 28433× 27830457 + 1 2357207 SB7 2004
7 26972593 − 1 2098960 Hajratwala 1999 Mersenne 38
8 5359× 25054502 + 1 1521561 Sundquist 2003
9 4847× 23321063 + 1 999744 Hassler 2005
10 23021377 − 1 909526 Clarkson 1998 Mersenne 37
- Mersenne’s Numbers:Mp = 2p − 1
- For more see �� ��http://primes.utm.edu/primes/
Università Roma Tre
![Page 148: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/148.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 27�� ��The AKS deterministic primality test
Università Roma Tre
![Page 149: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/149.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 27�� ��The AKS deterministic primality test
Department of Computer Science & Engineering,I.I.T. Kanpur, Agost 8, 2002.
Università Roma Tre
![Page 150: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/150.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 27�� ��The AKS deterministic primality test
Department of Computer Science & Engineering,I.I.T. Kanpur, Agost 8, 2002.
Nitin Saxena, Neeraj Kayal and Manindra Agarwal
Università Roma Tre
![Page 151: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/151.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 27�� ��The AKS deterministic primality test
Department of Computer Science & Engineering,I.I.T. Kanpur, Agost 8, 2002.
Nitin Saxena, Neeraj Kayal and Manindra AgarwalNew deterministic, polynomial–time, primality test.
Università Roma Tre
![Page 152: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/152.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 27�� ��The AKS deterministic primality test
Department of Computer Science & Engineering,I.I.T. Kanpur, Agost 8, 2002.
Nitin Saxena, Neeraj Kayal and Manindra AgarwalNew deterministic, polynomial–time, primality test.
Solves #1 open question in computational number theory
Università Roma Tre
![Page 153: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/153.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 27�� ��The AKS deterministic primality test
Department of Computer Science & Engineering,I.I.T. Kanpur, Agost 8, 2002.
Nitin Saxena, Neeraj Kayal and Manindra AgarwalNew deterministic, polynomial–time, primality test.
Solves #1 open question in computational number theory�� ��http://www.cse.iitk.ac.in/news/primality.html
Università Roma Tre
![Page 154: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/154.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 28�� ��How does the AKS work?
Università Roma Tre
![Page 155: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/155.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 28�� ��How does the AKS work?
Theorem. (AKS) Let n ∈ N. Assume q, r primes, S ⊆ N finite:
• q|r − 1;
• n(r−1)/q mod r 6∈ {0, 1};
• gcd(n, b− b′) = 1, ∀b, b′ ∈ S (distinct);
•(q+#S−1
#S
)≥ n2b
√rc;
• (x + b)n = xn + b in Z/nZ[x]/(xr − 1), ∀b ∈ S;
Then n is a power of a prime Bernstein formulation
Università Roma Tre
![Page 156: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/156.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 28�� ��How does the AKS work?
Theorem. (AKS) Let n ∈ N. Assume q, r primes, S ⊆ N finite:
• q|r − 1;
• n(r−1)/q mod r 6∈ {0, 1};
• gcd(n, b− b′) = 1, ∀b, b′ ∈ S (distinct);
•(q+#S−1
#S
)≥ n2b
√rc;
• (x + b)n = xn + b in Z/nZ[x]/(xr − 1), ∀b ∈ S;
Then n is a power of a prime Bernstein formulation
Fouvry Theorem (1985) ==> ∃r ≈ log6 n, s ≈ log4 n
Università Roma Tre
![Page 157: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/157.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 28�� ��How does the AKS work?
Theorem. (AKS) Let n ∈ N. Assume q, r primes, S ⊆ N finite:
• q|r − 1;
• n(r−1)/q mod r 6∈ {0, 1};
• gcd(n, b− b′) = 1, ∀b, b′ ∈ S (distinct);
•(q+#S−1
#S
)≥ n2b
√rc;
• (x + b)n = xn + b in Z/nZ[x]/(xr − 1), ∀b ∈ S;
Then n is a power of a prime Bernstein formulation
Fouvry Theorem (1985) ==> ∃r ≈ log6 n, s ≈ log4 n
==> AKS runs in O(log17 n)operations in Z/nZ.
Università Roma Tre
![Page 158: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/158.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 28�� ��How does the AKS work?
Theorem. (AKS) Let n ∈ N. Assume q, r primes, S ⊆ N finite:
• q|r − 1;
• n(r−1)/q mod r 6∈ {0, 1};
• gcd(n, b− b′) = 1, ∀b, b′ ∈ S (distinct);
•(q+#S−1
#S
)≥ n2b
√rc;
• (x + b)n = xn + b in Z/nZ[x]/(xr − 1), ∀b ∈ S;
Then n is a power of a prime Bernstein formulation
Fouvry Theorem (1985) ==> ∃r ≈ log6 n, s ≈ log4 n
==> AKS runs in O(log17 n)operations in Z/nZ.
Many simplifications and improvements: Bernstein, Lenstra, Pomerance.....
Università Roma Tre
![Page 159: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/159.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 29�� ��Why is RSA safe?
Università Roma Tre
![Page 160: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/160.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 29�� ��Why is RSA safe?
+
+
+
Università Roma Tre
![Page 161: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/161.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 29�� ��Why is RSA safe?
+ It is clear that if Charles can factor M ,
+
+
Università Roma Tre
![Page 162: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/162.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 29�� ��Why is RSA safe?
+ It is clear that if Charles can factor M ,then he can also compute ϕ(M) and then also d so to decrypt messages
+
+
Università Roma Tre
![Page 163: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/163.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 29�� ��Why is RSA safe?
+ It is clear that if Charles can factor M ,then he can also compute ϕ(M) and then also d so to decrypt messages
+ Computing ϕ(M) is equivalent to completely factor M . In fact
+
Università Roma Tre
![Page 164: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/164.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 29�� ��Why is RSA safe?
+ It is clear that if Charles can factor M ,then he can also compute ϕ(M) and then also d so to decrypt messages
+ Computing ϕ(M) is equivalent to completely factor M . In fact
p, q =M − ϕ(M) + 1±
√(M − ϕ(M) + 1)2 − 4M
2+
Università Roma Tre
![Page 165: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/165.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 29�� ��Why is RSA safe?
+ It is clear that if Charles can factor M ,then he can also compute ϕ(M) and then also d so to decrypt messages
+ Computing ϕ(M) is equivalent to completely factor M . In fact
p, q =M − ϕ(M) + 1±
√(M − ϕ(M) + 1)2 − 4M
2+ RSA Hypothesis. The only way to compute efficiently
Università Roma Tre
![Page 166: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/166.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 29�� ��Why is RSA safe?
+ It is clear that if Charles can factor M ,then he can also compute ϕ(M) and then also d so to decrypt messages
+ Computing ϕ(M) is equivalent to completely factor M . In fact
p, q =M − ϕ(M) + 1±
√(M − ϕ(M) + 1)2 − 4M
2+ RSA Hypothesis. The only way to compute efficiently
x1/e mod M, ∀x ∈ Z/MZ
Università Roma Tre
![Page 167: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/167.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 29�� ��Why is RSA safe?
+ It is clear that if Charles can factor M ,then he can also compute ϕ(M) and then also d so to decrypt messages
+ Computing ϕ(M) is equivalent to completely factor M . In fact
p, q =M − ϕ(M) + 1±
√(M − ϕ(M) + 1)2 − 4M
2+ RSA Hypothesis. The only way to compute efficiently
x1/e mod M, ∀x ∈ Z/MZ
(i.e. decrypt messages) is to factor M
Università Roma Tre
![Page 168: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/168.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 29�� ��Why is RSA safe?
+ It is clear that if Charles can factor M ,then he can also compute ϕ(M) and then also d so to decrypt messages
+ Computing ϕ(M) is equivalent to completely factor M . In fact
p, q =M − ϕ(M) + 1±
√(M − ϕ(M) + 1)2 − 4M
2+ RSA Hypothesis. The only way to compute efficiently
x1/e mod M, ∀x ∈ Z/MZ
(i.e. decrypt messages) is to factor M
In other words
Università Roma Tre
![Page 169: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/169.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 29�� ��Why is RSA safe?
+ It is clear that if Charles can factor M ,then he can also compute ϕ(M) and then also d so to decrypt messages
+ Computing ϕ(M) is equivalent to completely factor M . In fact
p, q =M − ϕ(M) + 1±
√(M − ϕ(M) + 1)2 − 4M
2+ RSA Hypothesis. The only way to compute efficiently
x1/e mod M, ∀x ∈ Z/MZ
(i.e. decrypt messages) is to factor M
In other words
The two problems are polynomially equivalent
Università Roma Tre
![Page 170: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/170.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 30�� ��Two kinds of Cryptography
Università Roma Tre
![Page 171: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/171.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 30�� ��Two kinds of Cryptography
+ Private key (or symmetric)
. Lucifer
. DES
. AES
Università Roma Tre
![Page 172: Factoring integers, Producing primes and the RSA cryptosystem€¦ · RSA cryptosystem Đ—I H¯C SƯ PH—M TP H˙ CHÍ MINH, December 12, 2005 4 ☎ History of the “Art of Factoring”](https://reader033.vdocuments.us/reader033/viewer/2022060517/604a9988501a41482028a8f4/html5/thumbnails/172.jpg)
RSA cryptosystem ĐẠI HỌC SƯ PHẠM TP HỒ CHÍ MINH, December 12, 2005 30�� ��Two kinds of Cryptography
+ Private key (or symmetric)
. Lucifer
. DES
. AES
+ Public key
. RSA
. Diffie–Hellmann
. Knapsack
. NTRU
Università Roma Tre