Square Roots and the Rabin Cryptosystem William J
Total Page:16
File Type:pdf, Size:1020Kb
The Roots of Higher Mathematics Computing Square Roots and the Rabin Cryptosystem William J. Martin, WPI Abstract: We explore thought experiments dealing with the computation of square roots in various number systems. As an application, we introduce an encryption scheme of Rabin. 1 Weird Number Systems A child learns about number systems in a very sensible way: First the counting numbers, then perhaps integers, then fraction, on to real numbers, and then the complex numbers. This seems very reasonable: each contains all the previous ones and enjoys more and more features, allowing more and more flexibility. Before we discuss other systems, let us review the notation for these familiar objects. The natural numbers, or positive integers, are denoted N = f1; 2; 3;:::g. They are closed under addition and multiplication: if we add or multiply two numbers from this set, the answer is guaranteed to be in this set. This is a great context for a discussion of unique factorization: an integer p > 1 is prime if its only divisors are 1 and itself. (Note that one is neither prime nor composite; it has an inverse, so it is called a \unit".) The integers are the first ring a student sees. The set Z = f:::; −3; −2; −1; 0; 1; 2; 3;:::g is closed under both addition and multiplication. It is a commutative ring since ab = ba for any two integers a and b. Every element has an additive inverse: stately precisely, for any integer a, there is a (unique) integer b such that a + b = 0. In algebra, we extend intuitive notation and denote this b by \−a". As a ring, we have a distributive law: a(b + c) = ab + ac and (a + b)c = ac + bc for all integers a, b and c. But only a = 1 and a = −1 have multiplicative inverses; for only these values of a does the equation ax = 1 have an integer solution x. The rational numbers are denoted by Q and their precise definition involves some subtlety to overcome the issue that (−6)=4 = 3=(−2) etc. (The concept of \canonical forms" is useful here: every rational number can be expressed uniquely in lowest terms where the numerator and denominator have no common factor and the denominator is positive.) This is our first example of a field! Both addition and multiplication are commutative: a + b = b + a and ab = ba. We have associativity so we can move parentheses around whenever expressions involve only one operation. We have the distributive laws. But now we have multiplicative inverses: for every rational number a, not equal to zero, there is a (unique) rational number x such that ax = 1. In high school, a student encounters phenomena in physics, chemistry, biology, finance, etc. where continuous variables are required for an accurate model. A \realistic" model. So 1 we feed them the real numbers. This set of objects is denoted by R but few students see the true definition of this set or a precise way to add or multiply real numbers. We usually equate them with non-terminating decimals and accept some finite precision (say 8 digits past the decimal point) so that addition (and multiplication, up to some error) is performed as with rational numbers. (In fact, any calculator or computer system can only represent a finite number of possibilities, so ignoring computer algebra systems, the \real" numbers students compute with a a very small subset of the rational numbers.) Applications in physics and electrical engineering, as well as a rigorous approach to mathematics, demand more: every polynomial of positive degree must have a root. While this property fails for the rational numbers (e.g., take f(x) = x2 − 3) and the real numbers (e.g., take f(x) = x2 + 3), the Fundamental Theorem of Algebra tells us that the complex numbers C = fa + bi j a; b 2 Rg have this \algebraically closed" property, where i is some object that squares to −1. There are other algebraically closed fields, such as the field of algebraic numbers. The collection of objects of the form f(x)=g(x) where f(x) and g(x) are polynomials with complex coefficients forms a field, called the field of rational functions and these have a (unique) algebraic closure. There also p-adic fields for any prime p. So we can find algebraically closed fields where a + a = 0 for all a, or where a + a + a = 0 for all a. This is the sort of field that becomes most useful in communications. In information theory, we concern ourselves with the mathematics of communication. We may be interested in efficient compression, balancing space savings against recoverability. We may be interested in error-correction, balancing \parity-check" overhead against message recovery in the presence of noise. Or we may be interested in encryption, where we aim to ensure that an encoded message is understandable only to its intended recipient. 2 Square Root Computation The cryptosystem we will discuss today is the invention of Michael Rabin of Harvard Uni- versity. Its main beauty lies in its simplicity. To encrypt a message m, you simply interpret m as a number (in a certain ring) and transmit m2. So the encryption function is just E(x) = x2 a function which, at face value, is familiar to every algebra student. Correct decryption involves computing a square root. How hard can that be? 2.1 One-way functions Cryptographers have great interest in \one-way" functions. A function f : X ! Y (i.e., taking inputs from a set X and producing a well-defined output y = f(x) in the set Y for any x in X) is said to be one-way if • given any x in X, it is easy to compute f(x) • given any y in Y , it is hard to find some x in X with f(x) = y, even if promised that one exists 2 (The proper definition is more technical. There must exist a polynomial time algorithm which, given x, computes f(x) while recovering x from only the value f(x) and a description of the function should be NP-hard or similar.) Unfortunately, we do not know any one- way functions! Researchers have many candidates, many suspicions about what sorts of functions should work, but no one has successfully proven the existence or non-existence of such functions. So the basic idea is to encrypt a message by incorporating a one-way function into the encryption process. An eavesdropper who intercepts the message must invert f in order to recover the message. But if f is one-way, this is essentially impossible. But this begs the question: If recovering the message is hard, how can the intended recipient obtain the message? In order to achieve this, we need not just a one-way function but a one-way trapdoor function: a one-way function which becomes efficiently invertible given some extra (secret) information. 2.2 Computing square roots Given all this theory, it's quite surprising that f : x 7! x2 could be a candidate one-way trapdoor function. But we'll see how this works as we develop the ingredients below. First let's recall what happens over the real numbers. Squaring an integer can be done quickly and the same technique is used for real numbers when represented as fixed-precision decimals. Since the advent of calculators, most people have forgotten how to estimate square roots by hand. The grade school method regularly taught until the 1960s is very clever and instills in a student skills that can be generalized to more abstract calculations of the same sort at the university level. In elementary calculus, a student learns Newton's Method (following the tangent line, instead of the curve, to reach the x-axis and then iterating) for finding roots of functions. I was surprised to learn, some years back, that this is essentially how a Texas Instrument calculator finds square roots. When I push the \SQRT" button on a calculator1, the input is first scaled to some number a lying between 1=2 and 2 (this contributes some powers of two to the answer) and then the calculator performs two iterations of Newton's Method on the function f(x) = x2 − a. Let us observe that not all real numbers have square roots. Working inside R, the square root of a negative number does not exist. The number zero is special: it has only one square root while all positive numbers have exactly two square roots. Please keep this classification in mind as we move to stranger number systems below. A communications system cannot realistically work with real numbers. Devices such as cellphones and CD players have very constrained memory and must perform calculations quickly. For these and other reasons, such environments employ modular arithmetic. What we will see next is that, while squaring a number in modular arithmetic can be performed quite efficiently, computing square roots seems to be easy in some moduli and extremely hard in others. (But we still cannot prove this. This remains a research problem for mathe- maticians and computer scientists.) 1At least on some TI calculators. I've seen their machine code, but it may have been updated since then. 3 3 Modular Arithmetic We have all seen modular (or \clock") arithmetic and familiarity with it is simply a matter of practice. Since my job requires me to use it almost daily, I have become quite adept at such calculation (but don't ask me to compute a derivative of a trig function!). I don't expect many readers have been doing these computations regularly, but I will be brief nonetheless.