MATH2068_Number Theory and Cryptography_2013 Semester 2_math2068-2011sols

8036Semester22011The University of SydneyFACULTY OF SCIENCEMATH2068and MATH2988Number Theory and CryptographyNovember,2011Lecturer:R.B.HowlettTime allowed:two hoursThe question paper must not be removed from theexamination roomNo notes or books are to be taken into the examination room.Only approved non-programmable calculators are allowed.The MATH2068paper hasfive questions.The MATH2988paper has one extra question(on the back page).The questions are of equal value.Question6is for MATH2988only..../21.(i )Use a Vigen`e re cipher with keyword CAT to encrypt the plaintext messageOCELOT.(ii )Let M =c 1c 2c 3...c be a message which is a sequence of letters from thealphabet {A ,B ,...,Z }.(a)What is a digraph ,and what is the definition of the digraph coinci-dence index of M ?(b)If the sequence M were generated by choosing successive letters in-dependently with all letters having equal probability of being choseneach time,what would be the expected value of the digraph coinci-dence index?(c)If M is ordinary English text,written in upper case letters andstripped of spacing and punctuation,would you expect the digraphcoincidence index to be greater than,less than,or the same as theanswer to Part (ii )(b)?(Give a brief reason.)(iii )A long intercepted message M is reliably known to have been encryptedwith a block transposition cipher.If the (2,7)-decimation of M withperiod 9has coincidence index 0.0047and the (3,5)-decimation of M ofperiod 8has coincidence index 0.0072,what conclusions should you draw?Solution:(i )A B C D E F G H I J K L M N O P Q R S T U V W X Y Z012345678910111213141516171819202122232425plaintext:1424111419key:20192019ciphertext:16223131412Thus encryption produces QCXNOM.(ii )(a)A digraph is a pair of adjacent letters.The digraph coincidenceindex of M is the probability that two randomly chosen digraphsof M coincide.(More exactly,for each x and each y in the al-phabet {A ,B ,...,Z }let n xy be the number of occurrences of xyas a digraph of M :thus n xy is the number of elements of the set{i ∈Z |1≤i ≤ −1and (c i ,c i −1)=(x,y )}.Then the digraph coincidence index of M is x,y (n xy /( −1))2,where the sum is overall 262possible values of (x,y ).)(b)The expected value of the probability that a randomly chosen di-graph equals a given digraph xy is (1/26)2,and so the expectedvalue of the probability that two independently chosen digraphsboth equal xy is (1/26)4.The expectedvalue of the digraph co-incidence index is therefore x,y (1/26)4=(1/26)2,since there are262possible values for (x,y )..../3(c)If M is a piece of ordinary English then the frequency distribution ofthe digraphs of M will be uneven,in the sense that the frequency ofsome digraphs will be much greater than (1/26)2and the frequencyof others will be much less than (1/26)2.The result is that thedigraph coincidence index will be much larger than the (1/26)2of (b)above.(The minimum value of k i =1p 2i subject to the constraint that all p i are nonnegative and k i =1p i =1occurs when all p iequal 1/k .)(iii )You should conclude that the block length for the cipher is 8and thatwhen the ciphertext is split into eight-letter blocks the third and fifthletters of each block were originally adjacent letters of the plaintext.2.(i )An affine cipher is a substitution cipher defined by a rule of the formi →mi +n (mod 26),for some fixed integers m,n ,where the letters A to Z are identified withresidues modulo 26in the usual way (A ↔0,B ↔1,etc.).The pair (m,n )is called the key .(a)If the key is (8,16),encipher the message BEN .(b)A sample of ciphertext known to have been produced by an affinecipher is found to consist of 2000letters altogether,of which thetwo most common are J (271occurrences)and N (199occurrences).Assuming that these represent the most common letters in English,determine the key.(ii )Let n =(d d −1...d 0)8;that is,when the integer n is expressed in base8notation its digits are d ,d −1,...,d 0.(a)Explain what this means,and illustrate your answer by finding the base 10representation of n =(2145)8.(b)Prove that n ≡d 0+d 1+···+d (mod 7).Solution:(i )(a)Numerically BEN is (1,4,13).Now8×1+16=248×4+16=48≡22(mod 26)8×13+16=120≡16(mod 26)and converting (24,22,16)back into letters produces YWQ ..../4(b)Note that numerically J↔9and N↔13.The most common letterof English is E↔4and the second most common is T↔19.So weneed tofind m and n such that4m+n≡9(mod26),(1)19m+n≡13(mod26).(2) Subtracting(1)from(2)gives15m≡4(mod26),whence15m≡30(mod26).By coprime cancellation this gives m≡2(mod26),andsubstituting back into(1)gives n≡1(mod26).So the key is(m,n)=(2,1).(ii)(a)The notation means that n=d 8 +d −18 −1+···+d181+d080.Thus(2145)8=2×83+82+4×8+5,which is1125in base10notation.(b)Since8≡1(mod7)and congruence respects addition and multi-plication,it follows that8k≡1k≡1(mod7)for all nonnegativeintegers k,andn≡d 1 +d −11 −1+···+d11+d0≡d0+d1+···+d (mod7),as required.3.(i)Find the order of4modulo each of the primes11and23,and thenfindthe residue of41112modulo253.(You are given that253=11×23.) (ii)Prove that if n,a and b are integers such that n|ab and gcd(n,a)=1 then n|b.You may use the fact that integers r and s exist satisfyingrn+sa=gcd(n,a).(iii)Show that if p is a prime number and t an integer such that t2≡1 (mod p),then either t≡1(mod p)or t≡−1(mod p).Solution:(i)If p is any odd prime then4(p−1)/2=2p−1≡1(mod p),by Fermat’s Little Theorem,and so ord p(4)must be a divisor of(p−1)/2.Since ord p(4)can only be1if p|(4−1)=3,it follows that ord11(4)=5and ord23(4)=11.Write N for the residue of41112modulo253.Since ord11(4)=5it follows that if n and m are arbitrary nonnegative integers then4n≡4m(mod11)if and only if n≡m(mod5).So N≡41112≡42≡5(mod11),giving N=11k+5for some integer k.Similarly4n≡4m(mod23)ifand only if n≡m(mod11),and since1112≡1(mod11)it follows thatN≡41112≡4(mod23).Hence11k+5≡4(mod23).../5and therefore11k≡−1≡22(mod23)and coprime cancellation yields k≡2(mod23).So k=23h+2for someinteger h,and henceN=11k+5=11(23h+2)+5=253h+27.Since0≤N<253it follows that N=27.(ii)Assume that n,a and b are integers such that n|ab and gcd(n,a)=1.Since gcd(n,a)=1there exist integers r and s such that rn+sa=1,and multiplying through by b gives rnb+sab=b.Since n|ab there existsan integer t such that ab=tn,and so it follows thatb=rnb+sab=rbn+stn=(rb+st)n.Since r,b,s and t are all integers,so is rb+st.Hence n|b,as required.(iii)Assume that p is prime and t an integer with t2≡1(mod p),and suppose that p is not a divisor of t−1.Then gcd(p,t−1)=p,since gcd(p,t−1)is a divisor of t−1.Since the only divisors of p are p and1,and sincegcd(p,t−1)is a divisor of p,it follows that gcd(p,t−1)=1.Now sincep|(t2−1)=(t−1)(t+1)and gcd(p,t−1)=1it follows from Part(ii)above that p|(t+1).So either p|(t−1),which gives t≡1(mod p),orp|(t+1),which gives t≡−1(mod p),as required.4.(i)A user of the RSA cryptosystem has chosen(2329127,331)as the publickey.Given that2063is a factor of2329127,determine the private key.(ii)Suppose that you are user of the Elgamal cryptosystem and that your public key is(p,b,k)=(43,3,41)and your private key is m=6.(a)Check that the necessary relationship between the private key andthe public key is satisfied.(b)You receive the message 2,[1,20,21] .Decrypt it.(iii)Let S={0,1,2,3,4,5,6,7,8,9},and let a1,a2,a3,...be an infinite se-quence of elements of S such that a i+1is determined by a i for every i.(That is,a i+1=f(a i)for some function f from S to S.)Show that thereexists a positive integer k such that a2k=a k.Solution:(i)In the RSA cryptosystem the public key aways has the form(n,e) where n is the product of two distinct primes and e is coprime toφ(n).Moreover,the private key is then(n,d),where d is the inverse of e mod-uloφ(n).Since we are given that n=2329127and2063is a divisor of.../62329127we conclude that2063and2329127/2063=1129are both prime, and soφ(n)=2062×1128=2325936.Applying the extended Euclidean Algorithm tofind the inverse of331modulo2325936yields the following table.23259363313301070261330017026−70271011−We conclude that331×7027−1×2325936=1,and so the inverse of331 moduloφ(n)is7027.So the private key must be(2329127,7027).(ii)(a)The required relationship is that b m computed in residue arithmetic modulo p must equal k.Noting that86is a multiple of43,wefindthat modulo4336=32×34=9×81≡9×−5=−45≡41as required.(b)The scrambling factor is thefirst component of the ciphertext raisedto the power m,computed in residue arithmetic modulo p.So inthis case it is the residue modulo43of26=64.That is,the scram-bling factor is21.Observe that2×21=−1in residue arithmeticmodulo43;so21−1=−2=41(in residue arithmetic modulo43).Hence the deciphered message is[1×21−1,20×21−1,21×21−1]=[41,20×−2,1]=[41,−40,1]=[41,3,1](iii)Since a1,a2,...,a11all lie in the set S,and S has only10distinct el-ements,there must exist integers i and j with1≤i<j≤11anda i=a j.We now use induction on m to show that a i+m=a j+m for allintegers m≥0.When m=0the statement is a i=a j,which we already know to be true,and this starts the induction.Now if a i+m=a j+m for some nonnegative integer m thena i+m+1=f(a i+m)=f(a j+m)=a j+m+1,which shows that if the statement is true for m then it is also true for m+1,completing the induction.Put n=j−i,noting that n>0since j>i.The statement thata i+m=a j+m for all m≥0can be restated as a i+m=a(i+n)+m for all.../7m ≥0,or a h =a h +n for all h ≥i (writing h for i +m ).We proceed toshow that a r =a r +qn for all integers q ≥0and r ≥i ,using inductionon q .The case q =0is obvious and starts the induction.Now supposethat q is a nonnegative integer such that a r =a r +qn for all integers r ≥i .If r ≥i then certainly r +qn ≥i ,since q and n are nonnegative,andsince a h =a h +n for all h ≥i it follows that a r +qn =a r +qn +n =a r +(q +1)nfor all r ≥i .Hence a r =a r +(q +1)n for all r ≥i ,as required to completeour induction.Choose any integer s with s ≥i/n .Then sn ≥i (since n >0),and soa sn =a sn +qn for all q ≥0(putting r =sn in the statement just proved).In particular this holds for q =s ,and so a k =a 2k holds with k =sn .5.(i )Let p be an odd prime and n ≡−1(mod p ).Let q be prime divisor of N = p −1i =0n ip =1+n p +n 2p +···+n (p −1)p .Find ord q (n ),and thenshow that q ≡1(mod p 2).(ii )Let p be an odd prime.(a)Show that if k is a positive integer then p k ≡3(mod 4)if and onlyif p ≡3(mod 4)and k is odd.(b)Let be a positive integer and let s be the sum of the positive divisors of p .Show that s is odd if and only if is even.(c)Again let be a positive integer and s be the sum of the positivedivisors of p .Show that s ≡2(mod 4)if and only if and p ≡1(mod 4)and ≡1(mod 4).(iii )Using Part (ii ),show that if n is an odd perfect number then n =p m 2for some integers p , and m such that p is prime and p ≡ ≡1(mod 4).Solution:(i )Since p −1i =0n ip is a geometric series with common ratio n p ,withp terms and with 1as the first term,the geometric series formula givesN =((n p )p −1)/(n p −1)=(n p 2−1)/(n p −1).Since q is a divisor of N it is a divisor of (n p −1)N =n p 2−1;that is,n p 2≡1(mod q ).So ord q (n )is a divisor of p 2.Suppose,for a contradiction,that ord q (n )is a divisor of p .This impliesthat n p ≡1(mod q ).SoN =p −1i =0(n p )i ≡p −1 i =01i ≡p (mod q ),.../8and since q is a divisor of N it follows that p ≡0(mod q ).Since p and q areboth primes this forces q =p ,and since we are given that n ≡−1(mod p )it follows that n ≡−1(mod q ).And so n p ≡(−1)p ≡−1(mod q ),sincep is odd.This gives our desired contradiction,since n p ≡1(mod q )andcertainly 1≡−1(mod q )(since 2is not divisible by the odd prime q ).We conclude that ord q (n )is a divisor of p 2that is not a divisor of p ,and since p is a prime the only such number is p 2itself.So ord q (n )=p 2.If n were a multiple of q then we would have n p 2≡0(mod q ),contraryto the fact that n p 2≡1(mod q ).So n is not a multiple of q ,and Fermat’sLittle Theorem tells us that n q −1≡1(mod q ).Hence ord q (n )is a divisorof q −1.Thus p 2|(q −1),and so q ≡1(mod p 2).(ii )(a)Since p is odd the remainder when p is divided by 4must be either 1or 3.So either p ≡1(mod 4)or p ≡3≡−1(mod 4).In the formercase,if k is any positive integer then p k ≡1k ≡1≡−1(mod p )(since p is not a divisor of 2).In the latter casep k ≡(−1)k ≡ +1(mod p )if k is even,−1(mod p )if k is odd.Thus,since −1≡3(mod 4),we have shown that if p ≡3(mod 4)and k is odd then p k ≡3(mod 4),and in all other cases p k ≡3(mod 4),as required.(b)The positive divisors of p are the integers p i for i ∈{0,1,2,...,p }.Thus s =1+p +p 2+···+p = i =0p i .Since p is odd,p ≡1(mod 2).So s ≡i =01i (mod 2);that is,s ≡ +1(mod 2).So s is even if and only if is odd,as required.(c)Suppose first that p ≡−1(mod 4).Thens =1+p +p 2+···+p ≡1+(−1)+(−1)2+···+(−1) (mod 4)and if is odd the right hand side is zero,since the total number ofterms is even and every second term cancels the term that precedesit.On the other hand,if is even then the last term on the righthand side is 1,and the preceding terms cancel out in pairs,leaving1as the value of the right hand side.So if p ≡−1(mod 4)then sis congruent mod 4to either 0or 1,but never congruent to 2.On the other hand,if p ≡1(mod 4)then p i ≡1(mod 4)for all i ,and so s = i =0p i ≡ i =01≡ +1(mod 4),giving s ≡2(mod 4)if and only if ≡1(mod 4),as required..../9(iii)Suppose that n is an odd perfect number,and let p1,p2,...,p k be the prime divisors of n.Thusn=p 11p 22···p kkfor some positive integers 1, 2,..., k,and since the sum-of-divisorsσfunction is multiplicative,σ(n)=σ(p 11)σ(p 2)2···σ(p kk).We are given that n is perfect;so by definition n equals the sum of all the proper divisors n.Henceσ(n)=2n.Observe that since n is odd this quantity is divisible by2but not by4.But2n is the product of thepositive integersσ(p ii ),for i from1to k,and it follows that exactly oneof these numbers are even(since if two or more were even their product would be divisible by at least22,and if none were even their product would not be divisible by2).Moreover the one that is even must be congruent to2mod4,since if it were congruent to0mod4then the product would be divisible by4.Renumbering the factors if necessary,we may assume thatσ(p 11)iscongruent to2mod4,andσ(p ii )is odd for all i from2to k.By(ii)(b)it follows that i is even when2≤i≤k,and so we may write i=2h i in these cases.And by(ii)(c)it follows that p1≡1(mod4)and 1≡1 (mod4).Thusn=p 11(p2h22p2h33···p2h kk)=p m2where m=p h22p h33···p h kk and p=p1is a prime congruent to1(mod4)and = 1is a positive integer congruent to1(mod4),as required.6.(MATH2988students only)(i)Let n be a positive integer.Prove thatd|nφ(d)=n.(ii)Let a1>a2>a3>···>a k be the successive remainders generated when the Euclidean Algorithm is used to determine d=gcd(a,b),where(a1,a2)=(a,b)and a k=d.Show that k<2log2(a)+1.(iii)Let n be an integer greater than1.Show that n is not a divisor of2n−1.(Consider ord p(2)for prime divisors of n.)Solution:(i)Consider the n fractions0n ,1n,2n,...,n−1n,and in each case cancelaway the greatest common divisor of the numerator and the denominator, producing a fraction that is in its lowest terms.The resulting fractions.../10all have the form id where i and d are coprime,0≤i<d,and d|n.Foreach given divisor d of n the total number of possible values for i isφ(d), since this is the size of the set{i|0≤i<d and gcd(i,d)=1},and theyall occur since id =idn,where dd =n.So the total number of fractionswe end up with isd|nφ(d),and since we started out with n fractionswe conclude thatd|nφ(d)=n,as required.(ii)According to the rules that define the Euclidean algorithm,the sequence a1,a2,...,a k is generated as follows:if i∈{2,3,...,k−1}then a i+1is the remainder obtained when a i is divided into a i−1.That is,a i+1=a i−1−q i a i(1)where q i is the largest integer less than or equal to a i−1/a i.Let i∈{2,3,...,k−2}be arbitrary;we shall show that a i+2<12a i.This is obviously true if a i+1≤12a i,since a i+2<a i+1.But if a i+1>12a ithen1<a i/a i+1<2,and so the quotient q i+1obtained when a i is divided by a i+1is1.Thus by(1)above,with i replaced by i+1,a i+2=a i−a i+1<a i−12a i=12a i.So in either case we have a i+2<12a i,as claimed.It follows by induction that if is any positive integer with1+2 ≤kthen a1+2 <2− a1.When =1this reduces to a3<12a1,which isa i+2<12a i in the case i=1,and for the inductive step observe that if>1and a1+2( −1)<2−( −1)a1then,by a i+2<12a i in the case i=2 −1,a1+2 <12a2 −1<12(2−( −1)a1)=2− a1,as required to complete the induction.Moreover,a totally analogous induction gives a2+2 <2− a2for each positive integer with2+2 ≤k.If k=1+2 is odd then by the previous paragraph we have thata k<2− a1,and so2 ≤2 a k<a1,whence <log2a1=log2a and k=2 +1<2log2a+2.If k=2 is even then the previous paragraph gives a k<2−( −1)a2<2−( −1)a,and so2( −1)≤2( −1)a k<a,whence −1<log2a and k=2 <2log2a+2.So in either case k=2log2a+2.(iii)Suppose that n>1is a divisor of2n−1.By the Fundamental Theorem of Arithmetic,n has at least one prime divisor.Choose p to be the least.../118036Semester22011Page11 prime divisor of n.Since p|n and n|(2n−1)it follows that p|(2n−1),and so2n≡1(mod p).Hence ord p(2)is a divisor of n.Obviously2isnot a multiple of p(since2n≡0(mod p));so Fermat’s Little Theoremgives2p−1≡1(mod p),and hence ord p(2)≤p−1.So we have shownthat ord p(2)is a divisor of n that is less than the smallest prime divisorof n.So ord p(2)=1,which is absurd since21≡1(mod p).So if n>1then assuming also that n|(2n−1)leads to a contradiction.So n is nota divisor of2n−1.。