Number theory is the study of the properties and construction of numbers, particularly integers. Prime numbers are of particular interest to number theorists and consequently cryptographers as they are considered the "building blocks" of numbers and produce many interesting results which are useful ...

learn more… | top users | synonyms

3
votes
1answer
188 views

Is this attack for RSA possible?

$N=p·q$ ($p$ and $q$ are prime numbers), $m_1, ..., m_x$ are the messages, $e$ and $d$ are RSA encryption and decryption exponents, respectively. I am given $e, m_1, m_1^e, m_1^d, ..., m_x, m_x^e, ...
3
votes
2answers
204 views

Background for modular arithmetic function

I'm investigating this function: $a := ((b\cdot c) \bmod k) - (b \cdot c)/k$ where $/$ indicates integer division. Two things I've noticed: It's equivalent to multiplying a·b, and then ...
3
votes
0answers
68 views

Can we break ECDLP with this machine?

Let $P$ and $Q$ are two points of NIST elliptic curve $E$ (defined over $F_{2^m}$ with prime $m$) and $k$ is a private key such that $k.P=Q$. Also we have a machine that is able to leak some ...
2
votes
1answer
722 views

ABC Conjecture's Impact on RSA Encryption

A recent proof of the ABC Conjecture has been released by one Shinichi Mochizuki. Now, I'm not well versed in mathematics but it would appear that this proof implies that finding prime factors could ...
2
votes
1answer
259 views

How did they factor RSA-704?

I don't understand the 'Wiedemann algorithm' works. Can someone explain the factoring of RSA-704 in an easy way?
2
votes
2answers
214 views

Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?

As in the title, given $g$, $g^{ab}$ are big elements in a prime group $Z_p$ and $b$ in prime group $Z_r$ ($p > r$, $g$ is one generator of $Z_p$). $a$ is unknown and also in $Z_r$, is finding ...
2
votes
2answers
84 views

Is it hard to recover $p$ from $k \phi(p)$?

Given $k\phi(p)$, is it hard to recover $p$? Here, $p$ is a large prime, $\phi(\cdot)$ is Euler's totient function and $k$ is an unknown integer. Or what's the complexity to recover $p$ from $k ...
2
votes
1answer
100 views

How difficult is it to check if a group element is in a sub group?

I am just curious. We have a group $G$ and its subgroup $H$ with a generator element $h \in H$. How difficult is it to check for $x \in G$ that $x \in \langle h \rangle$? Is there a better way than ...
2
votes
1answer
2k views

How can I use eulers totient and the chinese remainder theorem for modular exponentiation?

I'm trying to implement modular exponentiation in Java using Lagrange and the Chinese remainder theorem. The example we've been given is: Let $N = 55 = 5 · 11$ and suppose we want to compute ...
2
votes
1answer
1k views

ECC - Point Addition/Point Multiplication

So I have a very beginner-esque knowledge of ECDSA and I'm trying to write something in python to take a private key and output the public key (Basically from what I understand just trying to do the ...
2
votes
2answers
284 views

Need 32-bit mixing function that has perfect avalanche between octets

for my hobby tinkering project, I need a mixing function that takes 32-bit input and has 32-bit output (and will, most likely, run in a 32-bit C environment) and the following property (independent of ...
2
votes
1answer
241 views

Zero-knowledge proof that a group element is a quadratic residue?

In a paper it says: "To convince a verifier that a group element is a quadratic residue, the prover executes the following proof with the verifier": $PK \left\{ (\alpha) : y = \pm g^\alpha \right\}$ ...
2
votes
1answer
154 views

Efficiently computing the neutral element in a ring isomorphic to Z/NZ?

Edited to clarify question So my question is whether anyone knows of an efficient way to compute the neutral element (I'm gonna call it 1, but the operation doesn't have to be multiplication) in an ...
2
votes
1answer
69 views

Comprehension question on a signature protocol based on the RSA assumption

We have the following two-party protocol between Alice and Bob. Alice sends messages $m_1, m_2, \ldots \in_R \mathbb{Z}_n^*$ to Bob and Bob signs these values by calculating $v_1, v_2, \ldots \in_R ...
2
votes
1answer
57 views

Why can we ignore $y$ when using the extended Euclidean algorithm to calculate an RSA decryption exponent?

I have a follow-up question about the extended Euclidean algorithm, as applied to RSA key generation, described in this answer. Let us say we have $p=5$, $q=11$ and $e=17$, so that $N=55$ and ...
2
votes
1answer
57 views

In a additive group is it hard to calculate $bg$ given $ag, g, abg$

The ECDH problem defined that given $g,ag,bg$ it is difficult to calculate $abg$. But it is also difficult to calculate $bg$ given $ag,g,abg$. where $g$ is generator and a,b are elements of group.
2
votes
2answers
61 views

Find plaintext of RSA by solving extended euclidean algorith for two encrptions with two different exponents for same plaintext

This is my homework question (but I am not asking the answer to it): Suppose two users Alice and Bob have the same RSA modulus n and suppose that their encryption exponents eA and eB are ...
2
votes
1answer
164 views

Discrete log analog of ECM factoring algorithm?

Anecdotally, most factoring algorithms have a corresponding variant algorithm that can be used to attack the discrete log problem using similar ideas. Is there an analog of the elliptic curve (ECM) ...
2
votes
0answers
39 views

Is it possible to generate backdoored DH parameters?

I know it has been already asked and answered whether it's possible to generate weak DH parameters. But "recentely" we experienced the Logjam attack, which makes use of the pre-computation ...
1
vote
2answers
610 views

Is there an algorithm for factoring N, which is just as simple as this one, but faster?

I found a simple algorithm for factoring semiprime numbers, you can read about it in Factoring Semiprimes and Possible Implications for RSA. It basically works like this: You reverse the digits in ...
1
vote
3answers
228 views

Which area of Maths should I pursue?

I would like to know which area of Mathematics would be most beneficial to cryptography. Surely Algebraic Number Theory and maybe to a lesser extend, Elliptic Curves, are closely linked to ...
1
vote
1answer
216 views

What does modular inversion mean?

I'm trying to implement an e-voting algorithm, which is described at the paper "Internet Voting Protocol Based on Improved Implicit Security" by Abhishek Parakh & Subhash Kak. At the Example 1 ...
1
vote
2answers
193 views

Key Refresh in Diffie-Hellman

Assume the case, that two participants have agreed on a key $K=g^{ab} \mod p$ via Diffie Hellman. I have the need to change the key every now and then. The first idea I had was to simply initiate a ...
1
vote
2answers
136 views

Is computing roots moduli a composite $N$ a hard problem without knowing the factorization of $N$?

Suppose that we are given $\mathbb{Z}_{N}$ and an element $x^u \in \mathbb{Z}_{N}$ with $u \in (0,l]$ where $l$ is the bit-size of $N$. Is it difficult to recover $x$ by knowing $u$ without knowing ...
1
vote
1answer
111 views

Question about Fermat's little theorem

Why is $g^e \mod p = g^{e \mod (p-1)} \mod p$ if p is prime. I don't get it. It follows from Fermat's little theorem.
1
vote
1answer
101 views

How “hard” it is to take an e'th root mod p?

I know it's hard to find the $e$th root of a number mod $n=p_1*p_2$, and if it would be possible we could break RSA. But how hard it is to take an $e$th root mod $p$ where $p$ is a prime and ...
1
vote
1answer
146 views

Modular exponentiation with Chinese Remainder Theorem

I'm learning modular exponentiation with Chinese remainder theorem. I found a great answer from below How can I use eulers totient and the chinese remainder theorem for modular exponentiation? But I ...
1
vote
1answer
216 views

How to solve the reverse of an equation that uses MOD?

I've been tasked with reverse engineering an unknown crypto function. The function uses the following constants: $a=380951$: I noticed that this is a prime number $b=3182$: I noted that this is a ...
1
vote
1answer
285 views

How costly is to find millions of large prime numbers for RSA?

Consider I need to assign a large distinct prime number to each element in a large set. This must be deterministic so the function always gives me the same prime to the same value. What is the most ...
1
vote
1answer
197 views

Equal length of primes in paillier cryptosystem

In the key generation step of paillier cryptosystem , In order to satisfy $\gcd(pq,(p-1)(q-1))=1$ , we can take equal length primes. Instead of taking(length as parameter to generate $p,q$) equal ...
1
vote
1answer
389 views

What does $(\mathbb{Z}_n^*)^2$ mean?

In a paper they write once, $(\mathbb{Z}_n^*)^2$. Is this the group of quadratic residues or is it something else? Here the theorem: Under the strong RSA assumption, given a modulus $n$, along with ...
1
vote
1answer
385 views

What are some different cryptography methods?

Some of the most effective cryptography methods and algorithms are based of factoring large prime numbers (e.g. RSA). I'm curious whether there are some other cryptography methods. Somethings that is ...
1
vote
1answer
471 views

Montgomery Exponentiation - selecting input value R for a given BigInteger

I have Montgomery exponentiation working, but it's working quite slow. I suspect there are two reasons for this - I implemented it bit size instead of word size (I didn't realize at the time that ...
1
vote
2answers
64 views

How to compute two EC point multiplication?

I would like to know how to compute multiplication of two valid EC points over a curve E with generator G. i.e. Given only P and Q points then how to compute R = P * Q where $P = p G$, $Q = q G$ and ...
1
vote
1answer
141 views

Non-commutitive and nonassociative algebraic structures in cryptography

Are there any cryptographic algorithms or primitives that have been developed and studied that make use of non-commutative or non-associative algebraic structures such as quaternion integers or ...
1
vote
1answer
694 views

Algorithm for proving Carmichael numbers

I have an application for determining if a number is a prime or not, currently I'm getting a random number, then doing the Fermat primality testing to find out if the number is probably prime (so this ...
1
vote
0answers
41 views

What constitutes a “description of B” for probabilistic encryption as defined in Cryptology 6.3.4?

On page 21 of the Rivest's Cryptology chapter, he defines a trapdoor predicate as a boolean function for which it is easy to choose an x such that ...
1
vote
0answers
110 views

$\phi$ function in Dual_EC_DRBG

I am trying to understand the operation of the Dual_EC_DRBG. I'm reading the formal specification (SP 800-90) and can't seem to find a definition of the $\phi$ function used throughout the definition ...
0
votes
1answer
46 views

Algorithm for factoring a number $n$ of a specific form given $n$ and $\varphi(n)$

Given the natural number $n$, which is in the form $p^2 \cdot q^2$ with $p$,$q$ prime numbers. Also $\varphi(n)$ is given. Describe a fast algorithm (polynomial time) that calculates $p$ and $q$. ...
0
votes
1answer
38 views

Confusion regarding computing Multiplicative Inverse Modulo P?

May be a silly doubt, please rectify my confusion regarding below problem: For concreteness assume $g=2, p=11, a=6$ and $x=9$ $$A = g^a \bmod p = 2^6 \bmod 11 = 9$$ $$X = g^x \bmod p = 2^9 \bmod 11 ...
0
votes
1answer
63 views

Applications of GF(p) polynomials

A Galois field of the type $GF(p)$, where $p$ is prime, is normally expressed as the ring of integers modulo $p$. If my understanding is correct, it is also possible to represent its elements as a ...
0
votes
1answer
101 views

Prime Numbers in Discrete Log

I am implementing a security protocol based on discrete log. I came across the equation $p = kq + 1$. Understand that based on number theories that both $p$ and $q$ should be large enough to be ...
0
votes
1answer
108 views

Quadratic Residues in identification setting

Suppose Alice has two primes $p$ and $q$ such that $p\equiv q \equiv 3 \pmod 4$. $n=p\cdot q$ is part of her certificate to identify her. A party say Bob, sends her a random quadratic residue ${}\bmod ...
0
votes
1answer
98 views

Existence of a map $\phi:\mathbb{Z}_{N^2}^* \mapsto \mathbb{F} $

Is there a map between the group of $\mathbb{Z}_{N^2}^*$ where $N$ is a composite number , a product of two equal size secure prime numbers $p$ and $q$ and a finite field $\mathbb{F}$, such that for ...
0
votes
1answer
142 views

What are alternatives to number theory based crypto? [closed]

Quantum crypto,lattice based crypto, Neurocryptography and cellular automata based cryptography are alternatives to number theory based crypto. I need to know what are the other hard problems like ...
0
votes
1answer
197 views

RSA, finding p,q [duplicate]

If the public key $(e,n)$ and the private key $(d,n)$ are known, what is the easiest way to find the primes $p$ and $q$? When $n$ and $\phi(n)$ are given this is easy to solve. But I can't manage it ...
-1
votes
1answer
43 views

Computing the cardinality of the co-domain of specific modular exponentiations

Consider the following function: $f: \mathbb{Z}_n \rightarrow Y,~x \mapsto x^e \bmod n$, where $n = p \cdot q$ is an RSA modulus and $gcd(\varphi(n),e) \neq 1$ (different as required for a public ...
-1
votes
1answer
176 views

subgroup of quadratic residue

if a number is said to be a subgroup of a quadratic residue of Z∗p, can I affirm that it is a generator of a cyclic group ? ie, say i am looking for a number which is an element of order q in Z*p, ...
-1
votes
1answer
85 views

What does $\mathbb Z_p^*$ contain?

I have a prime $p = 7$ and was tasked to select a random value in $\mathbb Z_p^*$ in my signature scheme. What does the full range of $\mathbb Z_p^*$ contain in this case? Is it $\{0...7\}$ or ...
-2
votes
1answer
124 views

What parts of number theory does the RSA algorithm use?

It is said that the RSA algorithm uses number theory. What parts of number theory does it use? I know it uses modular arithmetic and Euler's totient theorem and function. Is that all?