Universit`adegli Studi di Trento DIPARTIMENTO DI MATEMATICA Corso di Dottorato di Ricerca in Matematica XXXI CICLO A thesis submitted for the degree of Doctor of Philosophy An investigation on Integer Factorization applied to Public Key Cryptography Supervisor: Ph.D. Candidate: Prof. Massimiliano Sala Giordano Santilli “I was just guessing at numbers and figures, pulling your puzzles apart...” (The Scientist - Coldplay) To all the people that told me their secrets and asked me their questions. Contents Introduction VII 1 Preliminaries 1 1.1 Historical Overview . .1 1.1.1 RSA . .2 1.1.2 A quick review on Factorization Methods . .2 1.1.3 Factorization Records . .5 1.2 Preliminaries on Elementary Number Theory . .6 1.2.1 Basics on Floor and Ceiling . .6 1.2.2 Definitions and basic properties . .6 1.2.3 Integer solutions of a General Quadratic Diophantine Equation having as discriminant a square . 11 1.3 Algebraic Number Theory Background . 13 1.3.1 Number Fields and Ring of Integers . 13 1.3.2 Norm of an element . 15 1.3.3 Ideals in the Ring of Integers . 16 1.4 Groebner Bases Theory . 20 1.4.1 Multivariate polynomials . 20 1.4.2 Monomial Orderings . 22 1.4.3 Groebner Bases . 24 1.4.4 Elimination Theory . 27 2 An elementary approach to factorization 29 2.1 Successive moduli . 29 2.2 A formula for successive moduli . 36 2.3 Successive moduli in factorization . 39 2.4 Interpolation . 42 2.4.1 Successive Remainders and Interpolation . 42 III CONTENTS 2.4.2 A conjecture on interpolating polynomials . 44 3 The General Number Field Sieve 47 3.1 Choice of the polynomial . 48 3.1.1 Producing a difference of squares . 49 3.2 The Rational Factor Base . 50 3.2.1 The Rational Sieve . 51 3.3 The Algebraic Factor Base . 52 3.3.1 The Algebraic Sieve . 55 3.4 General Ring of Integers . 56 3.4.1 The Quadratic Characters Base . 59 3.5 Linear Algebra . 61 3.6 Finding The Square Roots . 63 3.7 Complexity of GNFS . 63 3.7.1 Some analytic considerations . 63 3.7.2 Heuristic Complexity . 65 3.8 Further Developments in GNFS for the Polynomial Choice . 66 3.8.1 Homogeneous polynomials . 66 3.8.2 GNFS with multiple polynomials . 68 3.8.3 How to choose polynomials . 69 3.9 Other sieving methods . 73 3.9.1 Lattice Sieving . 73 3.9.2 Line Sieving . 76 4 A first attempt to a bivariate GNFS 77 4.1 A bivariate version for GNFS . 77 4.2 The Algebraic Factor Base . 79 4.2.1 The identification of first-degree prime ideals . 79 4.2.2 Divisibility of principal ideals . 84 4.3 The Quadratic Characters Base . 89 4.4 Further works and Limits of this approach . 90 5 Finding GNFS relations using Groebner bases 93 5.1 The generation of the system . 93 5.1.1 Inequalities on the parameters . 95 5.2 The Algorithm for finding Perfect Squares in the Number Field 97 5.2.1 An example of the Algorithm . 102 5.3 Related Systems . 113 5.4 Conclusion and future works . 115 IV CONTENTS Appendices 117 A MAGMA Code for the Bivariate Version of GNFS 119 B MAGMA Code for the System using Groebner Bases 127 Bibliography 141 V Introduction Public-key or asymmetric cryptography allows two or more users to com- municate in a secure way on an insecure channel, using two different keys: a public key, which has the function to encrypt the messages, and a pri- vate key, employed in the decryption of the ciphertexts. Because of the importance of these keys in the protocol, their generation is a sensible is- sue and it is often based on an underlying mathematical problem, which is considered hard to solve by the scientific community. Among the difficult number-theoretic problems, the Integer Factorization Problem (IFP) is one of the most famous: given a composite integer number, recovering its factors is commonly believed to be hard (worst-case complexity). Many asymmet- ric algorithms such as RSA ([RSA78]), Rabin’s cryptosystem ([Rab79]) or Goldwasser-Micali cryptosystem ([GM84]) found their mathematical secu- rity on IFP. Due to its rather simple formulation, IFP has been extensively examined ever since: many factorization methods have been developed to solve this problem, such as Dixon’s algorithm ([Dix81]) or the quadratic sieve ([Pom82]), but, at the moment, the most efficient one is the General Number Field Sieve (GNFS), which is fully described in [LLMP93a]. The aim of this thesis is to discuss some number-theoretic techniques to investigate IFP from new points of view. The thesis will be organized as follows: • in Chapter 1 we will present the factorization problem and discuss its involvement in Public-key Cryptography. We will also recall some of the most famous factorization methods, give a description of the state of the art and survey the actual records on integer factorization. Furthermore, the number-theoretic techniques we will employ belong to three main fields: firstly we will examine relevant properties of the floor function and the ceiling function, then we will recall some important VII INTRODUCTION results in Algebraic Number Theory about ring of integers and their ideals, while Groebner bases will be the main topic of the last part. • Starting from the results recalled in the first chapter, in Chapter 2 we will describe an original work on integer factorization based on some elementary properties of the remainders of a fixed positive integer N modulo successive numbers. We will show that it is possible to define a formula that computes all the remainders of N starting with just three initial consecutive remainders. Later, we will also prove that this formula does not change even as considering the second-degree inter- polating polynomial between the starting remainders. This interesting regularity was originally noticed and analysed by Dr. Matteo Piva. We will exihibit an equivalence between the integer factorization prob- lem and the solution of the aforementioned formula and we will finally explore the future developments of this approach, explaining with an example how we would like to generalize this approach. • The main theme of Chapter 3 is the General Number Field Sieve al- gorithm, depicted in great details. We will report the classical for- mulation of GNFS, including the Rational Factor Base, the Algebraic Factor Base and the Quadratic Characters Base, which permit to get a non-trivial factor of a semiprime N. Additionally, the complexity of the algorithm will be stated and analysed, employing some functions borrowed from Analytic Number Theory. By the end of the chapter, the successive improvements on GNFS will be inspected, especially the different strategies developed in the polynomial selection and in the sieving step. • The last two chapters will again contain some original material. In Chapter 4 we will examine a way to generalize GNFS to bivariate polynomials, based on a joint work with Dr. Daniele Taufer. The structure we will handle in this chapter is the following: we will con- sider two simple quadratic extensions of the rational numbers that do not have any intersection between them, except for the rational num- bers themselves, and a larger extension of degree 4 that contains both. We will prove that the first-degree prime ideals in the smaller exten- sions may be used to generate the same kind of ideals in the larger one and, adding some additional hypotheses, we will show that also the converse is true. Moreover, a potential scheme of an application to GNFS is theorized and we will explain at the end of the chapter why VIII INTRODUCTION this approach will not completely work for our situation in its present formulation. Finally, Chapter 5 addresses the issue of finding some elements for GNFS that lead to a successful factorization of N, through the solu- tion of some multivariate systems, solved using Groebner bases. We will provide this way an algorithm for integer factorization, also with a very detailed example. In Appendix A and Appendix B we will report MAGMA programs used to test some of our algorithms. IX Chapter 1 Preliminaries Notation. We will denote with N the set of natural numbers N = f0; 1; 2;:::g + and with N all the positive integers. 1.1 Historical Overview One of the most ancient and famous theorems about prime numbers is the Fundamental Theorem of Arithmetic, which was first described in Euclid’s Elements in Book IX, [Hea56]. + Theorem 1.1. Every positive integer N 2 N such that N > 1 can be represented in a unique way as a product of prime powers: e1 e2 ek N = p1 · p2 ··· pk ; + where k 2 N , p1 < p2 < : : : < pk are prime numbers and e1; e2; : : : ; ek 2 N. A natural problem arising from this theorem is, given a positive integer num- + ber N 2 N , to find its prime factorization. From a computational point of view, while there are several ways to decide (in polynomial-time) whether an integer is a prime, it is still unknown if there exist a non-quantum polynomial-time algorithm that finds its prime factors. This issue is called Integer Factorization Problem (IFP). The clarification “non-quantum” is needed, since in 1994 Schor ([Sho94]) presented an algo- 1 CHAPTER 1. PRELIMINARIES rithm for quantum computers that finds all prime factors of a given integer in polynomial-time. Since a classical polynomial-time algorithm that solves IFP might never be found, it is considered to be a hard problem. Due to this hardness, IFP guarantees the security of many public-key cryptography algorithms, starting from RSA.