Groups for PKE: A Quick Primer Discrete Log and DDH Assumptions, Candidate Trapdoor One-Way Permutations 1 Groups, a primer 2 Groups, a primer A set G (for us finite, unless otherwise specified) 2 Groups, a primer A set G (for us finite, unless otherwise specified) A binary operation *: G×G→G 2 Groups, a primer A set G (for us finite, unless otherwise specified) A binary operation *: G×G→G Abuse of notation: G instead of (G,*) 2 Groups, a primer A set G (for us finite, unless otherwise specified) A binary operation *: G×G→G Abuse of notation: G instead of (G,*) Sometimes called addition, sometimes called multiplication (depending on the set/operation) 2 Groups, a primer A set G (for us finite, unless otherwise specified) A binary operation *: G×G→G Abuse of notation: G instead of (G,*) Sometimes called addition, sometimes called multiplication (depending on the set/operation) Properties: 2 Groups, a primer A set G (for us finite, unless otherwise specified) A binary operation *: G×G→G Abuse of notation: G instead of (G,*) Sometimes called addition, sometimes called multiplication (depending on the set/operation) Properties: Associativity, 2 Groups, a primer A set G (for us finite, unless otherwise specified) A binary operation *: G×G→G Abuse of notation: G instead of (G,*) Sometimes called addition, sometimes called multiplication (depending on the set/operation) Properties: Associativity, Existence of identity, 2 Groups, a primer A set G (for us finite, unless otherwise specified) A binary operation *: G×G→G Abuse of notation: G instead of (G,*) Sometimes called addition, sometimes called multiplication (depending on the set/operation) Properties: Associativity, Existence of identity, Invertibility 2 Groups, a primer A set G (for us finite, unless otherwise specified) A binary operation *: G×G→G Abuse of notation: G instead of (G,*) Sometimes called addition, sometimes called multiplication (depending on the set/operation) Properties: Associativity, Existence of identity, Invertibility Also for us (unless specified otherwise) Commutativity 2 Groups, a primer A set G (for us finite, unless otherwise specified) A binary operation *: G×G→G Abuse of notation: G instead of (G,*) Sometimes called addition, sometimes called multiplication (depending on the set/operation) Properties: Associativity, Existence of identity, Invertibility Also for us (unless specified otherwise) Commutativity Examples: Z (integers, with addition operation; infinite group), n ZN (integers modulo N), G (G group; coordinate-wise op) 2 Groups, a primer 3 Groups, a primer Computation with groups 3 Groups, a primer Computation with groups For us, finite, but typically large: i.e., exponential in k 3 Groups, a primer Computation with groups For us, finite, but typically large: i.e., exponential in k Some compact representation of the elements (poly(k) bits) 3 Groups, a primer Computation with groups For us, finite, but typically large: i.e., exponential in k Some compact representation of the elements (poly(k) bits) Efficient algorithms for: 3 Groups, a primer Computation with groups For us, finite, but typically large: i.e., exponential in k Some compact representation of the elements (poly(k) bits) Efficient algorithms for: Checking if an element (in standard rep.) is in the group 3 Groups, a primer Computation with groups For us, finite, but typically large: i.e., exponential in k Some compact representation of the elements (poly(k) bits) Efficient algorithms for: Checking if an element (in standard rep.) is in the group Group operation (on elements in standard rep.) 3 Groups, a primer Computation with groups For us, finite, but typically large: i.e., exponential in k Some compact representation of the elements (poly(k) bits) Efficient algorithms for: Checking if an element (in standard rep.) is in the group Group operation (on elements in standard rep.) Inverting 3 Groups, a primer Computation with groups For us, finite, but typically large: i.e., exponential in k Some compact representation of the elements (poly(k) bits) Efficient algorithms for: Checking if an element (in standard rep.) is in the group Group operation (on elements in standard rep.) Inverting Sampling a random element (almost) uniformly 3 Groups, a primer Computation with groups For us, finite, but typically large: i.e., exponential in k Some compact representation of the elements (poly(k) bits) Efficient algorithms for: Checking if an element (in standard rep.) is in the group Group operation (on elements in standard rep.) Inverting Sampling a random element (almost) uniformly Group itself represented by these algorithms 3 Groups, a primer Computation with groups For us, finite, but typically large: i.e., exponential in k Some compact representation of the elements (poly(k) bits) Efficient algorithms for: Checking if an element (in standard rep.) is in the group Group operation (on elements in standard rep.) Inverting Sampling a random element (almost) uniformly Group itself represented by these algorithms For collection of groups: GroupGen, an algorithm to select a group 3 Groups, a primer 4 Groups, a primer Additive notation: X+Y, identity denoted as 0, X+X denoted by 2X 4 Groups, a primer Additive notation: X+Y, identity denoted as 0, X+X denoted by 2X Multiplicative notation: XY, identity 1, XX denoted as X2 4 Groups, a primer Additive notation: X+Y, identity denoted as 0, X+X denoted by 2X Multiplicative notation: XY, identity 1, XX denoted as X2 Order of a group G: |G| = number of elements in G 4 Groups, a primer Additive notation: X+Y, identity denoted as 0, X+X denoted by 2X Multiplicative notation: XY, identity 1, XX denoted as X2 Order of a group G: |G| = number of elements in G Cyclic group (finite, in multiplicative notation): there is one element g such that G = {g0, g1, g2, ... g|G|-1} 4 Groups, a primer Additive notation: X+Y, identity denoted as 0, X+X denoted by 2X Multiplicative notation: XY, identity 1, XX denoted as X2 Order of a group G: |G| = number of elements in G Cyclic group (finite, in multiplicative notation): there is one element g such that G = {g0, g1, g2, ... g|G|-1} 4 Groups, a primer Additive notation: X+Y, identity denoted as 0, X+X denoted by 2X Multiplicative notation: XY, identity 1, XX denoted as X2 Order of a group G: |G| = number of elements in G Cyclic group (finite, in multiplicative notation): there is one element g such that G = {g0, g1, g2, ... g|G|-1} g0 4 Groups, a primer Additive notation: X+Y, identity denoted as 0, X+X denoted by 2X Multiplicative notation: XY, identity 1, XX denoted as X2 Order of a group G: |G| = number of elements in G Cyclic group (finite, in multiplicative notation): there is one element g such that G = {g0, g1, g2, ... g|G|-1} 0 g g1 4 Groups, a primer Additive notation: X+Y, identity denoted as 0, X+X denoted by 2X Multiplicative notation: XY, identity 1, XX denoted as X2 Order of a group G: |G| = number of elements in G Cyclic group (finite, in multiplicative notation): there is one element g such that G = {g0, g1, g2, ... g|G|-1} 0 g g1 g2 4 Groups, a primer Additive notation: X+Y, identity denoted as 0, X+X denoted by 2X Multiplicative notation: XY, identity 1, XX denoted as X2 Order of a group G: |G| = number of elements in G Cyclic group (finite, in multiplicative notation): there is one element g such that G = {g0, g1, g2, ... g|G|-1} 0 g g1 g2 g3 . 4 Groups, a primer Additive notation: X+Y, identity denoted as 0, X+X denoted by 2X Multiplicative notation: XY, identity 1, XX denoted as X2 Order of a group G: |G| = number of elements in G Cyclic group (finite, in multiplicative notation): there is one element g such that G = {g0, g1, g2, ... g|G|-1} 0 gN-1 g g1 2 gN-2 g .. g3 .. .. 4 Groups, a primer Additive notation: X+Y, identity denoted as 0, X+X denoted by 2X Multiplicative notation: XY, identity 1, XX denoted as X2 Order of a group G: |G| = number of elements in G Cyclic group (finite, in multiplicative notation): there is one element g such that G = {g0, g1, g2, ... g|G|-1} 0 gN-1 g g1 2 gN-2 g e.g. N, with say g=1 (additive group) 3 Z .. g .. .. 4 Groups, a primer Additive notation: X+Y, identity denoted as 0, X+X denoted by 2X Multiplicative notation: XY, identity 1, XX denoted as X2 Order of a group G: |G| = number of elements in G Cyclic group (finite, in multiplicative notation): there is one element g such that G = {g0, g1, g2, ... g|G|-1} 0 gN-1 g g1 2 gN-2 g e.g. ZN, with say g=1 (additive group) . g3 . or any g s.t. gcd(g,N) = 1 . 4 Groups, a primer Additive notation: X+Y, identity denoted as 0, X+X denoted by 2X Multiplicative notation: XY, identity 1, XX denoted as X2 Order of a group G: |G| = number of elements in G Cyclic group (finite, in multiplicative notation): there is one element g such that G = {g0, g1, g2, ... g|G|-1} 0 gN-1 g g1 2 gN-2 g e.g. ZN, with say g=1 (additive group) . g3 . or any g s.t. gcd(g,N) = 1 . Number of generators of ZN =: φ(N) 4 Groups, by examples 0 gN-1 g g1 gN-2 g2 . 3 . g . 5 Groups, by examples 0 gN-1 g g1 gN-2 g2 . 3 . g . * ZN = (generators of ZN, multiplication mod N) 5 Groups, by examples 0 gN-1 g g1 gN-2 g2 .