For RSA, how do i calculate the secret exponent?
Given p and q the two primes, and phi=(p-1)(q-1), and the public exponent (0x10001), how do i get the secret exponent 'd' ?
I've read that i have to do: d = e-1 mod phi using modular inversion and the euclidean equation but i cannot understand how the above formula maps to either the a-1 ≡ x mod m formula on the modular inversion wiki page, or how it maps to the euclidean GCD equation.
Can someone help please, cheers
You can use the extended Euclidean algorithm to solve for d in the congruence
de = 1 mod phi(m)
For RSA encryption, e is the encryption key, d is the decryption key, and encryption
and decryption are both performed by exponentiation mod m. If you encrypt a message a
with key e, and then decrypt it using key d, you calculate (ae)d = ade mod m. But
since de = 1 mod phi(m), Euler's totient theorem tells us that ade is congruent
to a1 mod m -- in other words, you get back the original a.
There are no known efficient ways to obtain the decryption key d knowing only the
encryption key e and the modulus m, without knowing the factorization m = pq, so
RSA encryption is believed to be secure.
Related
Totient(N) is a product of (P-1)(Q-1) and (P-1),(Q-1) will not be prime after taken 1 from them and multiple factors can be obtained? Is it true? Or can we find P and Q if we have totient of N?
Since only even prime is 2, rest of primes are odd. Therefore $p-1$ is an even number that can at least has 2 as a divisor.
For the second part of your questions; What you do is playing with the equations;
φ(n)=(p−1)(q−1)=pq−p−q+1=(n+1)−(p+q)
(n+1)−φ(n)=p+q
(n+1)−φ(n)−p=q
and n=pq to obtain this quadratic formula.
p2−(n+1−φ(n))p+n=0
For more details and an example see; Why is it important that phi(n) is kept a secret, in RSA?
So i know that to encrypt a message in RSA we use cipher = m^e % n where m is the plain text transformed to an integer of size {0,..,n -1} and n is the modulus.
Let's say that the size of n is 8192bit and e = 65537 and m (as an integer) = n - 4.
So the question is wouldn't be (2^(8192-4))^65537 impossible to calculate ?
Not impossible at all - the exponentiation is performed modulo n, which means that the result will always be less than n. This not only limits the output size, but makes the calculation easier as intermediate stages can be reduced modulo n to keep the numbers involved "small". The Wikipedia page on modular exponentiation provides more detail on how the calculation can be performed.
I'm trying to sign a message with a Bitcoin private key to get a refund from InstaWallet.
Any hints on how to do this from a terminal on OS X?
( page 22, 23 from An Introduction to Bitcoin, Elliptic Curves and the
Mathematics of ECDSA )
4.6 ECDSA
A brief outline of how digital signatures work was given in 2.4.2.
Bitcoin uses the mathematics of elliptic curves as the underlying
basis for its digital signature. Recall elliptic curves are defined by
T = (p, a, b, G, n, h), with Bitcoin using parameters prescribed by
sep256k1. We also have the private and public key pair (Kpriv, Kpub
where Kpub = Kpriv × G, as explained in 4.5. If Alice (A) and Bob (B)
wanted to send a message (or transaction) to each other, this is how
they would create and verify a digital signature.
4.6.1 Signature Generation [7]
To sign a message m Alice would do the following.
Select a random integer k, 1 ≤ k ≤ n − 1.
Compute kG = (x1, y1) and convert x1 to an integer x1.
Compute r = x1 (mod n). If r = 0 then go to step 1.
Compute k^−1 (mod n). Where k^−1 is the multiplicative inverse and satisfies k−1
[ ... ]
Either follow the link and continue on, to steps five, six, and seven via page 23; or via a python answer here via Jorky10:
How to sign and verify signature with ecdsa in python
I know this may seem like a math question but i just saw this in a contest and I really want to know how to solve it.
We have
a (mod c)
and
b (mod c)
and we're looking for the value of the quotient
(a/b) (mod c)
Any ideas?
In the ring of integers modulo C, these equations are equivalent:
A / B (mod C)
A * (1/B) (mod C)
A * B-1(mod C).
Thus you need to find B-1, the multiplicative inverse of B modulo C. You can find it using e.g. extended Euclidian algorithm.
Note that not every number has a multiplicative inverse for the given modulus.
Specifically, B-1 exists if and only if gcd(B, C) = 1 (i.e. B and C are coprime).
See also
Wikipedia/Modular multiplicative inverse
Wikipedia/Extended Euclidian algorithm
Modular multiplicative inverse: Example
Suppose we want to find the multiplicative inverse of 3 modulo 11.
That is, we want to find
x = 3-1(mod 11)
x = 1/3 (mod 11)
3x = 1 (mod 11)
Using extended Euclidian algorithm, you will find that:
x = 4 (mod 11)
Thus, the modular multiplicative inverse of 3 modulo 11 is 4. In other words:
A / 3 == A * 4 (mod 11)
Naive algorithm: brute force search
One way to solve this:
3x = 1 (mod 11)
Is to simply try x for all values 0..11, and see if the equation holds true. For small modulus, this algorithm may be acceptable, but extended Euclidian algorithm is much better asymptotically.
There are potentially many answers. When all you have is k = B mod C, then B could be any k+CN for all integer N.
This means B could potentially be very large. So large, in fact, to make A/B approach zero.
However, that's just one way to respond.
I think it can be written as(But not sure)
(a/b)%c = ((a)%(b*c))/b
I'm working on coding the Pohlig-Hellman Algorithm but I am having problem understand the steps in the algorithm based on the definition of the algorithm.
Going by the Wiki of the algorithm:
I know the first part 1) is to calculate the prime factor of p-1 - which is fine.
However, I am not sure what I need to do in steps 2) where you calculate the co-efficents:
Let x2 = c0 + c1(2).
125(180/2) = 12590 1 mod (181) so c0 = 0.
125(180/4) = 12545 1 mod (181) so c1 = 0.
Thus, x2 = 0 + 0 = 0.
and 3) put the coefficents together and solve in the chinese remainder theorem.
Can someone help with explaining this in plain english (i) - or pseudocode. I want to code the solution myself obviously but I cannot make any more progress unless i understand the algorithm.
Note: I have done a lot of searching for this and I read S. Pohlig and M. Hellman (1978). "An Improved Algorithm for Computing Logarithms over GF(p) and its Cryptographic Significance but its still not really making sense to me.
Thanks in advance
Update:
how come q(125) stays constant in this example.
Where as in this example is appears like he is calculating a new q each time.
To be more specific I don't understand how the following is computed:
Now divide 7531 by a^c0 to get
7531(a^-2) = 6735 mod p.
Let's start with the main idea behind Pohlig-Hellman. Assume that we are given y, g and p and that we want to find x, such that
y == gx (mod p).
(I'm using == to denote an equivalence relation). To simplify things, I'm also assuming that the order of g is p-1, i.e. the smallest positive k with 1==gk (mod p) is k=p-1.
An inefficient method to find x, would be to simply try all values in the range 1 .. p-1.
Somewhat better is the "Baby-step giant-step" method that requires O(p0.5) arithmetic operations. Both methods are quite slow for large p. Pohlig-Hellman is a significant improvement when p-1 has many factors. I.e. assume that
p-1 = n r
Then what Pohlig and Hellman propose is to solve the equation
yn == (gn)z
(mod p).
If we take logarithms to the basis g on both sides, this is the same as
n logg(y) == logg(yn) == nz (mod p-1).
n can be divided out, giving
logg(y) == z (mod r).
Hence x == z (mod r).
This is an improvement, since we only have to search a range 0 .. r-1 for a solution of z. And again "Baby-step giant-step" can be used to improve the search for z. Obviously, doing this once is not a complete solution yet. I.e. one has to repeat the algorithm above for every prime factor r of p-1 and then to use the Chinese remainder theorem to find x from the partial solutions. This works nicely if p-1 is square free.
If p-1 is divisible by a prime power then a similiar idea can be used. For example let's assume that p-1 = m qk.
In the first step, we compute z such that x == z (mod q) as shown above. Next we want to extend this to a solution x == z' (mod q2). E.g. if p-1 = m q2 then this means that we have to find z' such that
ym == (gm)z' (mod p).
Since we already know that z' == z (mod q), z' must be in the set {z, z+q, z+2q, ..., z+(q-1)q }. Again we could either do an exhaustive search for z' or improve the search with "baby-step giant-step". This step is repeated for every exponent of q, this is from knowing x mod qi we iteratively derive x mod qi+1.
I'm coding it up myself right now (JAVA). I'm using Pollard-Rho to find the small prime factors of p-1. Then using Pohlig-Hellman to solve a DSA private key. y = g^x. I am having the same problem..
UPDATE: "To be more specific I don't understand how the following is computed: Now divide 7531 by a^c0 to get 7531(a^-2) = 6735 mod p."
if you find the modInverse of a^c0 it will make sense
Regards