Theorem 7.22 lfn .L m, then
1
2
3
4
n+l 2n+ 1 3n+ 1
n+2 2n+2 3n+2
n+3 2n+3 3n+3
n+4 2n+4 3n+4
n 2n 3n 4n
(ml)n+l
(ml)n+2
(ml)n+3
(ml)n+4
mn
with m rows and n columns. The number in the ith row and jth column is equal to (i  1) n + j. Notice that if gcd (n,j) > 1, then gcd (n, (i  1) n + j) > 1, and hence gcd (n . m, (i  1) n + j) > 1. On the other hand, if j .L n then (i  1) n + j .L n for 1 S; i < n. Thus exactly
R = {j, n
+ j, 2n + j, ... , (m 1) n + j}
There are exactly m elements in the set R. If rn+j==sn+j (modm)
then rn == sn (mod m)
so r == s (modm)
CHAPTER 7. THEOREMS OF FERMAT AND EULER
174
since n .L m, so r = s since both are less than m. Hence R is a complete residue system modulo m, so exactly r.p (m) elements of R are relatively prime to m. Thus r.p (mn) = r.p (m) r.p (n). • We can use Theorems 7.207.22 to compute r.p(n) if we know the prime power factorization of n. In particular, if r
n
=
IIp:i i=l
then
r
r.p(n) =
IIp:i (Pi 1
1)
i=l
Example 7.23 Let 1741764024 = 23 . 32 . 7 . 112 . 134 . Then r.p(1741764024) = 22. (2 1)·3·(3 1)·(7 1).11.(111).133 .(13 1)
=417605760 The following theorem of Euler generalizes Fermat's little theorem and leads to an interesting class of public key ciphers.
Theorem 7.24 (Euler's Theorem) If a .L n, then a'P(n) == 1 (mod n). Proof. Let R be the reduced residue system modulo n consisting of all integers r in the range 1 S; r S; n such that r .L n. Assume a .L n. Then aR = {ar IrE R} is also a reduced residue system modulo n. It follows that R = {ar mod n IrE R}. Thus a'P(n) r = ar == r (modn)
II
II
II
rER
rER
rER
Since n .L TIrER r, we can cancel on both sides to get the desired congruence a'P(n) ==1 (modn). •
Example 7.25 We will show directly that 5'P(21) == 1 (mod21). r.p(21) = 12 and the reduced residue system
We have
{1,2,4,5,8, 10, 11, 13, 16, 17, 19,20} modulo 21. Now {5· 1,5·2,5·4,5·5,5·8,5·10,5· 11,5· 13,5·16,5· 17,5·19,5· 20} = {5,10,20,25,40,50,55,65,80,85,95,100} and hence 1 . 2 ·4 . 5 . 8 . 10 . 11 . 13 . 16 . 17· 19· 20 mod 21 = 5 . 10 . 20 . 25 . 40 . 50 . 55 . 65 . 80 . 85 . 95 . 100 mod 21 = 512 . (1 . 2 . 4 . 5 . 8 . 10 . 11 . 13 . 16 . 17· 19 . 20) mod 21 and canceling 1 . 2 . 4 . 5 . 8 . 10· 11 . 13 . 16· 17· 19 . 20 from both sides yields 512 == 1 (mod 21)
w;:
175
tr.6. EULER'S THEOREM
Problems 7.6 .1. Compute
2. Compute
Verify that
5.
Compute
4",(27)
mod 27 = 1. 5",(1001)
mod 1001 = 1.
6. Prove Theorem 7.19. 7. Start with a complete residue system R modulo 10. Note that 7 1 10 and show directly that {7r + 4 IrE R} is also a complete residue system modulo 10. 8. Start with a reduced residue system R modulo 15. Note that 7 1 15 and multiply each element of R by 7 to form a new reduced residue system {7r IrE R}. Show directly that each element of {7r IrE R} is congruent modulo 15 to exactly one element of R. 9. Show that if n is a product of distinct primes anya. 10. Verify the formula in problem 9 for n = 30.
a",(n)+l
=
a
(mod n) for
Chapter 8
Public Key Ciphers The ciphers we have discussed so far require a key for each pair of users. A secure methodsuch as the use of couriers with locked briefcasesis required for the exchange of these keys. Such methods of key exchange can be expensive, unreliable, and time consuming. If there are many pairs of users in a system, each using a different key, the cost becomes prohibitive. In this chapter we describe cryptosystems that allow keys to be exchanged securely in the open.
8.1
The RivestShamirAdleman Cipher System
In the mid to late 1970s, several schemes were proposed that allowed keys to be safely exchanged over public channels such as telephone lines and satellite links. Since any potential adversary can listen in on these channels, such schemes are called public key ciphers. The most widely known public key cipher is the RSA cipher proposed by Ron Rivest, Adi Shamir, and Leonard Adleman. The algorithm is well known, and now it is legal to develop your own version. ®
BEDFORD, Mass., September 6, 2000RSA Security Inc. (NASDAQ: RSAS) today announced it has released the RSA public key encryption algorithm into the public domain, allowing anyone to create products that incorporate their own implementation of the algorithm. This means that RSA Security has waived its rights to enforce the patent for any development activities that include the RSA algorithm occurring after September 6, 2000. RSA Security press release
In a public key system, each participant has a public key which anyone can look up. If you want to send a message to Bob, you use his public key. To decipher a message enciphered with Bob's public key, you have to use a private 177
CHAPTER 8. PUBLIC KEY CIPHERS
178
key that is known only to Bob. The trick is to make it very difficult to compute the private key from the public key. In the RSA scheme, the public key is a pair (e, m) of positive integers. To decipher a message enciphered with the key (e, m), you need to know the private key (d, m). Although theoretically possible, it is very difficult to compute d from
(e,m). The integer m is constructed by finding two large primes p and q and setting m = pq. Here large might mean 50 digits, for low risk applications, to hundreds of digits for national security applications. This is a good example of how probabilistic primes are used. It is still hard to prove that a given 200digit integer is prime, but it is very easy to generate a 200digit probabilistic prime. The integer e is chosen relatively prime to
y = xemodm Deciphering uses the private key (d, m), where d is the inverse of e modulo
s:
To see why this is true, write ed = 1 + k
mod m =
xed
mod m
= xHk
mod m
=xl (x
modm
= x (l)k modm =x
If, miraculously, p divides x, then
mod q =
=
xH(pl)(ql)k
=x
(xql) k(pl)
mod q mod q
= x (1 )k(pl) mod q
== x
(modq)
and
x
== 0 (modp) == xed (modp)
(p  l)(q  1) so
~B;l.THE RIVESTSHAMIRADLEMAN CIPHER SYSTEM
179
i~;BY the Chinese remainder theorem it follows that xedmodm =
X
The case when q divides x is the same, with the roles of p and q interchanged. . Thus for every x in the range 1 ::;; x < m we have
We state this result as a theorem.
Theorem 8.1 Let p and q be distinct primes and m = pq. Let e be an integer . that is relatively prime to cp(m) and let d be its inverse modulo cp(m). If x is any integer such that 1 ::;; x < m, then
Theorem 8.1 is the basis for a scheme, which allows anyone to send encrypted messages to Sarah. The first step is to construct keys.
Step 1: Construct keys Public key (Published in a directory)
Integers m and e
Private key (Known only to Sarah)
Primes p and q with m
= pq
cp(m) = (p1) (q 1) d = e 1 modcp (m) Step 2: Agree on a Protocol Sarah and Kyle, or anyone else who wishes to send messages to Sarah, must agree on a method for converting text into a sequence of positive integers that are less than m. Step 3: Kyle Sends a Message to Sarah 1. Kyle converts a message into a sequence of positive integers that are each less than m.
2. For each integer x, Kyle calculates y = x e mod m and sends y to Sarah.
Step 4: Sarah Decrypts the Message 1. For each y, Sarah calculates x = yd mod m.
2. Sarah converts each x to text, using the same method as Kyle. A method for converting text into integers will be described in a later section. The following example assumes that the plaintext has already been converted into a positive integer.
180
CHAPTER 8. PUBLICKEY CIPHERS
Example 8.2 First, Sarah generates primes p, q, and an exponent e for enciphering. Then she computes m = pq, the Euler phi function
q
= 92734928626327511
m=pq = 264099224369484956639974579586676121 e = 1009
are the numbers generated by Sarah. Suppose that Kyle decides to send the plaintext message
x = 33 333 333 333 333 333 333 333 333 333 333 333 to Sarah. In order to do this, Kyle looks up Sarah's numbers e and m and computes the ciphertext y = xemodm
= 54423731 721403481610392517373097210 and sends it to Sarah, who calculates
x
= yd mod m = 33 333 333 333 333 333333 333 333 333 333 333
and wonders why Kyle would bother sending such a dull message. What makes the RSA cipher secure? Can't you construct d from m and e, in which case anyone could decipher an RSA cipher? Yes, it is possible to deduce d from m and e; but it is not easy to do. To calculate
=
On the other hand, if m and
= pq
1.1.
THE RIVESTSHAMJRADLEMAN CIPHER SYSTEM
~ Implies
181
that
,:
p+q=mcp(m)+l
and (p
+ q)2 = p2 + 2pq + q2 = p2 _ 2pq + q2 + 4pq = (p_q)2 +4m
implies that p  q = V(p
+ q)2 
4m
Thus p + q and p  q are both easily computable. The primes p and q can then be computed by p=
and q
=
(p + q)
+ (p 
q)
2
(p + q)  (p  q)
="':=='
2
Factoring is much harder than testing for primality. The security of the RSA cipher is based on the premise that deciphering can only be accomplished by factoring m. Changing a single bit in x can completely change the value of y = x e mod m. For example, 5555555555555555 1234 mod 2784892789 = 1172 041861 whereas 5555555555455555 1234 mod 2784892789 = 356849431 Public channels such as phone lines are noisy and the likelihood of at least one error is significant. By combining RSA with something like the Hamming (8, 4) code, the probability of errors can be greatly reduced. (More powerful codes will be introduced in the next chapter.) Text is broken up into blocks and each block is enciphered using RSAj then the ciphertext is converted to hex. Hamming (8, 4) is applied to each nibble (see page 124). At the receiving end, Hamming (8, 4) is used to correct single errors and detect double errors. If double errors are detected, then the corresponding block must be retransmitted. The corrected ciphertext is then deciphered using RSA.
Problems 8.1 1. Let p = 5 and q = 7 so that m = 35, and let e = 11. Find d e 1 modcp(m). Then let x = 22 and compute y = x e mod35 and z ydmodm.
= =
CHAPTER 8. PUBLIC KEY CIPHERS
182
2. Show that a2 mod 24 = 1 for each a ..L 24. Conclude that a 1 mod 24 a mod 24 for each a ..L 24. 3. Let p
= 29
and q
= 31
so that m
= 899,
and let e
= 101.
=
Find
d = e 1 mod
= 555
and compute y
= x e mod m
and z
= yd mod m.
4. Assume m = 25972 641171 898723 is a product of two primes p and q and that
e = 997 x = 99 999 999 999 999 6. Assume that y = x e mod m from problem 5 is transmitted over a noisy channel and received as w = y + 10 12 . How similar are y and w? What message is decrypted? How similar are x and the decrypted message? (This explains why most ciphers are wrapped in some type of error correction scheme.) 7. Assume m = 21936520921056942428185744321881874204790829 920 570235226904516467385564406736567597367535979699 930859 170 667289061009 756151158068196185554149 is a product of two primes p and q and that
e = 997 x = 99 999 999 999 999 9. Let m = pq where p and q are distinct primes. Show that if x is chosen at random in the range 1 S; x S; m, then the probability that gcd (x, m) =I 1 is equal to lip + 11q  11m. 10. Verify the formula in problem 9 for m = 6 and m = 15. Show that if x is chosen at random in the range 1 S; x < m, then the probability that gcd(x,m) =11 is less than 11p+ 11q.
';2. ELECTRONIC SIGNATURES
8.2
183
Electronic Signatures
~. The RSA cipher can be used for electronic signatures. More precisely, here is
how to use RSA to guarantee that a given message carne from a given source. As before, the original message is broken into blocks of fixed length and each block is translated into a number x. Suppose Kyle's public key is (ek' mk) and his private key is (d k , mk), that Sarah's public key is (e s , ms) and her private key is (d s , ms), and that mk < ms. Kyle enciphers the plaintext x with his private key (d k , mk) and then with Sarah's public key (e s , ms):
y
= (X dk mod mk)e. mod ms
Sarah reads the ciphertext y and then computes the plaintext x by x = (yd. mod ms)e k mod mk
using her private key (d s , ms) and Kyle's public key (ek' mk). How does Sarah know that the message carne from Kyle? Because only Kyle knows dk and so only he can encipher the plaintext x with it. To see that this procedure works, let z = x dk mod mk. Then
assuming z
< ms. But indeed z = x dk mod mk < mk < ms. Thus
= zek modmk
= (x dk mod mk) ek mod mk = x dkek mod mk
=x A message from Sarah to Kyle goes as follows. Given the plaintext x, Sarah sends the ciphertext y, where
Kyle then deciphers y by using
Each person uses his or her own private key and the other person's public key. Enciphering is done by using the smaller modulus first, then the larger modulus. Deciphering uses the larger modulus first, then the smaller.
CHAPTER 8. PUBLIC KEY CIPHERS
184
What if the larger modulus were applied first, followed by the smaller modulus for enciphering? It is likely that xes mod ms > mk, and hence some information might get lost. If the deciphered text makes sense, it could only have been enciphered by the person who used his or her own private key. There is a possible flaw in this reasoning. If Sean intercepts the message y = (x ek mod mk)d s mod m s , he could strip off Sarah's signature by computing z = yes mod ms and then attach his own signature by calculating Zdh mod mh and forwarding this message to Kyle. It would appear to Kyle that Sean had sent the original message, although Sean would have no idea what he had actually sent. There are several ways to minimize the effects of this problem. One would be for Sarah to include within the message her name and a time stamp. Another possibility is always to encipher by using the private key first, say y = x ds mod ms. If y > mk, then break y into blocks Yi < mk and calculate y? mod mk for each block and send these blocks to Kyle. Finally, each person could publish two keys; one for sending and one for receiving. The moduli for the sendkeys would be smaller, say 1050 < ms < 1051 , with the moduli for the receivekeys larger, say 1051 < mr < 10 52 . That way each person would be sending a message to someone else with a larger moduli, so enciphering would use the formula y = (x ds mod msyr mod m r , where (d s , ms) is the private senderkey and (en m r ) is the public receiverkey.
Problems 8.2 1. Send the plaintext x = 12 from Kyle to Sarah assuming Kyle's private key is (3,15) and Sarah's public key is (5,21).
2. Sean uses the primes Ps = 38490587 and qs 7349. Find Sean's public and private keys.
= 983299 with exponent e s =
3. Brendon uses the primes Pb = 2748401 and qb = 157849763 with exponent eb = 9587. Find Brendon's public and private keys. 4. Brendon wishes to send the message 1234567890 to Sean, using Sean's public key and Brendon's private key. What message should Sean receive? 5. Show how Sean decrypts the message from Problem 4. Use the following table of primes and exponents to answer Problems 69.
P
q e
Brendon 8329 3499 5501
Janet 2333 6469 7853
Kyle 9967 1931 4663
Preston 7451 6689 7907
Sarah 3469 7643 4637
6. Compute private keys for Brendon, Janet, Kyle, Preston, and Sarah.
7. Brendon encrypts the plaintext message 99999999 using his private key and Janet's public key. What is the encrypted message?
11:3.
A SYSTEM FOR EXCHANGING MESSAGES
185
~,
8. Preston receives the encrypted message 34568007 from Kyle, who used his own private key and Preston's public key. Decrypt the message. 9. The plaintext message 2000000 is encrypted by first applying Preston's public key, then Sarah's private key. Show that decryption fails. Explain what went wrong. For problems 1013, use the following table of primes and exponents.
p q e
Brendon 41 381 059 613 23841 287213 387420499
Janet 688223072857 10214358881 177264463
p q e
Preston 862891037453 510 246 412 969 304839373
Sarah 16321363081 11162261477 98329493
Kyle 10 410 338 677 20604499379 96889010447
10. Compute private keys for Brendon, Janet, Kyle, Preston, and Sarah. 11. Brendon encrypts the plaintext message 99999999 using his private key and Janet's public key. What is the encrypted message? 12. Preston receives the encrypted message 182654067428694778930238 from Kyle, who used his own private key and Preston's public key. Decrypt the message. 13. The plaintext message 101010101010101010101 is encrypted by first applying Preston's public key, then Sarah's private key. Show that decryption fails. Explain what went wrong.
8.3
A System for Exchanging Messages
In practice, the primes p and q are chosen so that n = pq has about We will go through an example where n has about 50 digits. Kyle two primes whose product is greater than 1050. He then chooses integer e and tests to make sure that it is relatively prime to cp( n). sends an email message:
200 digits. constructs a positive Kyle then
TO: Brendon, Sean, Sarah FROM: Kyle nk = 126284756413553050978360366248406608817836065776277 ek = 1009
CHAPTER 8. PUBLIC KEY CIPHERS
186
Kyle constructed nk by computing nk
= Pk
qk, where
Pk = 8273488995874738949376607 qk
= 15263784900967433245564811
but he would never tell Sarah (or anyone else) how nk was defined. Then Kyle computes d k by first computing 'Pk = (Pk  l)(qk 1) = 126284756413553050978360342711132711 975663870834860
then setting d k = 1009 l mod 'Pk = 54694190835205830800340406109777002114336086773 869
Sarah also sends an email message that contains her public key.
TO: Brendon, Sean, Kyle FROM: Sarah ns = 7649659803 155869454870134280817974298450529391 711 731 e s = 997 Sarah remembers that her primes are Ps
= 77839584736125364985746393
qs =98274673857627364665373867
and computes 'Ps = (Ps  l)(qs  1) = 7649659803155869454870134104703715704697799740591472
and ds
= 997 1 mod'Ps = 5723817666152736823804533643038086174227240327463629
Rather than restricting messages to strings of the capital letters AZ, we allow a full set of 256 ASCII characters. Example 8.3 Kyle decides to send the message
The #@%&* computer is acting up again!
1.3.
A SYSTEM FOR EXCHANGING MESSAGES
187
Jlo Sarah. He first wntes down the ASCII value of each character and produces ::the vectors
A = (84,104,101,32,35,64,37,38,42,32,99,111, 109,112,117,116,101,114,32,106) B = (115,32,97,99,116,105,110,103,32,119,112, 32,97,103,97,105,110,33,0,0) He then calculates Xl
= 600167620106771636211628585849721838540876507220
X2
= 2912276570798527424777621159210842274734195
using the sums 19 Xl
= Laici i=O 19
i
X2=Lb ic i=O
where c = 256. Kyle tests the moduli to see which of nk or ns is larger. Since nk  ns
= 7649659803155869454870 134 272544485302575790442335124
Kyle concludes that nk < ns. Thus Kyle enciphers by first using his private key (d k , nk), then Sarah's public key (e s , ns). Kyle enciphers the message by calculating Zl
=
xtk mod nk
= 125819736344175718268932263205870616867460585594806 Z2
=
xgk mod nk
= 110431267001056501628738304699976888214174820174836
Yl = zfs mod ns = 6490122138798845932205029063697475651026315779005336
Y2
= z~s mod ns = 5206997138452155799019530511 244204675487260820178238
Kyle then sends Sarah the following email message:
TO: Sarah
FROM: Kyle 6490122138798845932205029063697475651026315779005336 5206997138452155799019530511244204675487260820178238
188
CHAPTER 8. PUBLIC KEY CIPHERS
Sarah then deciphers the message by calculating some inverse operations:
W2
= YId. mo d ns = 125819736344175718268932263205870616867460585594806 = Y2d. mo d ns
W2
= 110431267001056501628738304699976888214174820174836
Xl
= wr k mod nk
WI WI
= 600167620106771636211628585849721838540876507220 X2
= W~k mod nk
= 2912276570798527424777621159210 842 274734195 Sarah now calculates the sequence {ai} of ASCII values by performing the following steps on Xl and X2: aO
= xmod256 = 84
X= x~:O =2344404766042076703951674163475475931800298856 al
= X mod 256 = 104 X 
X
al
= 25(3 = 9157831117351862124811227 20l 076 077858594917
a2
= xmod256 = 101
al9
= X mod 256 = 105
X
= 2912276570798527424777621159210842274734195
a20
= xmod256 = 115
a37
= xmod256 = 33
a38
= 0
a39
=0
Translated back into text, Sarah reads the message,
The #@%&* computer is acting up again!
f8;:3; A SYSTEM FOR EXCHANGING MESSAGES
189
Problems 8.3 1. Convert the plaintext "2'4=16" toa positive integer, using ASCII values and base 256 arithmetic.
2. Convert to plaintext the three numbers 653481561 706256160607300716034424225952184750930 556034090672982451 998688663006597581 940 164228207 199505372 523 In problems 38, use the keys
e d
n
e d
n
Sarah 997 5723817666152736823804533643038086174227240327463629 7649659803 155869454870134280817974298450529391 711 731 Kyle 1009 54694190835205830800340406109777002114336086773869 126284756413553050978360366248406608817836065776277
3. Encrypt the message
Ron Rivest is a professor at MIT from Sarah to Kyle. 4. Kyle received the encrypted message 580735046350033514934592803992352023532099155378947 5291232071 949948925471 032 807 295136508630705523321 750 from Sarah. Read the message. 5. Sarah received the encrypted message 1695609128579432034342230443933539315666505917090109 3526148554529184887055643524345287218828172175185624 2837766027562936344846748331694487638574287462071682 from Kyle. Read the message. 6. Encrypt the message
RSA is used to transfer keys for fast encryption schemes from Sarah to Kyle.
CHAPTER 8. PUBLIC KEY CIPHERS
190
7. Kyle received the encrypted message 1491543853684791090861904364888457101214455628031970 6920136844206351338082229186328578558592587709058521 464188094287035035931921710687540480117216797612537 from Sarah. Read the message. 8. Sarah received the encrypted message 2027208815204265182328141518312028960081474989240004 3151590210 265147454601370266850881158943783670753786 2698042079593028266457969044162648597639273126469652 from Kyle. Read the message.
8.4
Knapsack Ciphers
Modern cryptology is based on the construction of functions that are easy to calculate in one direction, but difficult to compute in the other direction (without special information). Such a function is called a trap door function. In particular, we seek onetoone functions y = f(x) for which y = fl(x) is difficult to determine unless the user has a particular key. In the case of the RSA algorithm, y = x e mod n is easy to compute, but the inverse function is difficult unless a factorization of n is known or d = e l mod ({J(n) is known. In this section we present another class of functions that are easy to calculate, but for which the inverse problem is more difficult. In the sequence 1,2,2 2,2 3 ,24, ... , each term is greater than the sum of the preceding terms because 1 + 2 + 22 + ... + 2k  1 = 2k  1.
Definition 8.4 A sequence al, a2, ... , an of positive integers is superincreasing if each term is greater than the sum of the preceding terms. That is,
for k
= 1,2, ... , n 
1.
In the superincreasing sequence 1,2,22,23 ,24, ... , each term is twice the preceding one. We can relax that condition a little bit and still get a superincreasing sequence.
Theorem 8.5 A sequence aI, a2,"" an is super increasing if ai+1 > 2ai for = 1, ... , n  1.
i
'i8 ~.:c
rI
191
.4. KNAPSACK CIPHERS .
E~
Proof. The theorem holds for n = 2 because a2 > 2a1 > a1 Suppose that the theorem holds for n = k. Then ak+1
> 2ak > ak + L ai = L i
•
ai
i
Example 8.6 The sequence 1, 3, 8, 21, 45, 97, 207, 415, 843, 1691, 3389, 6787, 13581, 27166, 54335, 108671 is a superincreasing sequence because each term is more than twice as large as the preceding term. In the knapsack problem, you are given a set K of positive integers and you want to write a given positive integer as a sum of some of the numbers in K. This is known to be a very difficult problem to solve if K is large. A knapsack cipher works on binary plaintext. We will illustrate with a'small example. Suppose we base our knapsack cipher on a superincreasing sequence a1, a2, a3, ... , a16. Then plaintext is broken up into blocks of length 16. The text "Hi" is converted to ASCII hex code 4869, which is 0100 10000110 1001 in binary. The ciphertext is the sum of the corresponding terms in the sequence
Consider the particular superincreasing sequence 1,3,8,21,45,97,207,415,843,1691,3389,6787,13581,27166,54335,108671 Note that each term is more than twice the preceding term, so the sequence is indeed superincreasing. Then the ciphertext is
Deciphering is easymuch like conversion from decimal to binary. We need to find coefficients Xi in {O, 1} such that 16
LXiai = Y i=l
The key observation is that if k
LXiai
=W
i=l
then Xk = 0 if ak > w, for otherwise the sum would be larger than w, and that Xk = 1 if ai ~ w, because otherwise the sum would be less than ai, as the sequence is superincreasing. SO, X16 = 1, because a16 = 108671 ~ 127380. Subtracting a16 from both sides of the equation gives 15
L i=l
Xiai
=
127380  108671
= 18709
CHAPTER 8. PUBLIC KEY CIPHERS
192
= 0 because al5 = 54335 > 18709. Similarly X14 = 0 because al4 = 27166 > 18709. But Xl3 = 1 because al3 = 13581 ::; 18709. We then subtract al3 from 18709 and continue. We show the interesting steps, when Xk = 1 and we subtract ak from w, in the table: SO Xl5
k 16 13 11 10 5 2 Thus
Xk
ak
108671 13581 3389 1691 45 3
w 127380 18709 5128 1739 48 0
= 1 exactly when k = 2,5,10,11,13,16 and the binary plaintext is XlX2 ••. Xl6
= 0100 1000 0110 1001
which is 4869 in hex, so the plaintext is "Hi". Algorithm 8.1 To solve easy knapsack problem Input: superincreasing sequence al, ... ,an and sum y Output: Binary sequence Xl, ... , Xn Set Xi = 0 for i = 1 ... n For i from n down to 1 If ai < y Then Set Xi = 1 Set y = y  ai End If Next i End
This is an easy algorithm. In fact, it is too easy. Anyone with a general knowledge of superincreasing sequences could do the same thing, and hence deduce the plaintext. One way to disguise the superincreasing sequence is to select a modulus m > 2 . an and a multiplier k such that k 1. m, and define a new sequence bi by
The sequence bl, b2 , .•• , bn is no longer superincreasing, even if it were arranged in order, but if n
y=
LXiai i=l
liSA. KNAPSACK CIPHERS
I
r/then !/
193
set z = kymodm
In this variation, the public key is (b l , b2 , ••• , bn ) and the private key is (m, k). Given the binary plaintext Xl, X2, ... , Xn , the ciphertext is the number n Z
= LXibimodm i=l
To recover the plaintext Xl, X2, ... , Xn if z and (m, k) are known, first compute k l mod m, and then solve y
=
ykk l mod m
=
n L kIXibi i=l
=
n L klxikai i=l
=
n L Xiai i=l
for
Xl, X2, ... , Xn , using the easy method for a superincreasing sequence. The name "knapsack cipher" comes from the problem of guessing the contents of a knapsack without looking inside. All you know is the weight of the filled knapsack and the weights of the various objects that might be inside. The general knapsack problem is provably difficult and therefore looks like an attractive basis for ciphers. A key that is 100 bits long may require 2100 trials to solve a knapsack problem. However, the version we described is not so secure. Knowing that modular arithmetic is used, the multiplier k can be deduced with moderate effort. The search continues for a secure knapsack cipher that is easy for users to encipher and decipher.
Problems 8.4 1. Show that 2,3,6,12,24,48,96,200 is a superincreasing sequence. 2. Write 313 as a sum of (some of) the integers 2,3,6,12,24,48,96,200. 3. Given the sequence 2,3,6,12,24,48,96,200, let m = 453 and k = 61. What is the public key? Encrypt the plaintext 10010110. Use the private key (453,61) to decrypt the message. 4. Write 361675 as a sum of (some of) the numbers 86977,75580,29992,71381,21594,54585,97773,85775, 38985,2390, 103154,62346,94700,45438,79479,60584 using the fact that these numbers were created by starting with a superincreasing sequence and multiplying each number by 98374 and reducing the results modulo 109771. 5. Show that 1,3,5,10,20,40,80, 160,320,640,1280,2560,5120,1 0240,20480, 40960,81920,163840 is a superincreasing sequence.
CHAPTER 8. PUBLIC KEY CIPHERS
194
6. Write 315428 as a sum of (some of) the integers 1,3,5,10,20,40,80,160, 320,640,1280,2560,5120,10 240,20480,40960,81920,163840. 7. Given the sequence 1,3,5,10,20,40,80,160,320,640,1280,2560,5120, 10240,20480,40960,81920,163840, let m = 327819 and k = 997. What is the public key? Encrypt the plaintext 101100101001011010. Calculate the private key and decrypt the message. 8. Write 2410809 as a sum modulo 4272954 of (some of) the numbers 875372 475406 3996844 393606
3553441 254786 1625582 31492
51953 3524975 1198524 1714537
311 718 1384944 1552373 3564472
1498808 2821841 3156699 2959896
using the fact that these numbers were created by starting with a superincreasing sequence and multiplying each number by 2574163 and reducing the results modulo 4272 954.
8.5
Digital Signature Standard
The digital signature algorithm (DSA) allows a digital signature to be used on an electronic document instead of a traditional signature. It is intended to assure that signatures cannot be forged and that anyone can verify a validly signed document.
Digital Signature Algorithm DSA uses the following parameters: 1. A prime p between 2LL::; 1024.
1
and 2L, where L is a multiple of 64 and 512 ::;
2. A prime q between 2159 and 2 160 that divides p  1. 3. An integer 9 > 1 of the form 9
= h(p1)/q modp
The order of 9 modulo pis q. 4. A random integer x in the range
o
y
= gXmodp
Is. 5.
~
i~ &
DIGITAL SIGNATURE STANDARD
195
6. A random integer k in the range
O
Digital Signature Let m be the 160bit output of the secure hash algorithm for the message M (see page 196). The number m will almost certainly be different for different messages. A digital signature for the message M is the pair of integers (r, 8) computed by the formulas
r = (gk modp) modq 1 8 = k (m + xr) modq The point of incorporating m into the digital signature is to assure that this signature applies to the message M and wasn't just copied from some other message.
Verification Knowing p, q, g, the user's public key y, the electronic document M, and the digital signature (r, 8), the signature is verified by calculating
t=
m8
u =
1
r8
1
modq
modq
v = (lyU modp) modq
If v
= r, then the signature is verified. To see this, note that 8
1
modq
= k (m + xr)l modq
implies 8
1
(m + xr) modq = kmodq
so v = (lyUmodp) modq
= (gmslmOdqyrslmOdqmodp)modq = (gms
1
1
modqgxrs modq
= (g(m+rx)sl
modq
modp) modq
= (gkmOdqmodp) modq =r
modp) modq
CHAPTER 8. PUBLIC KEY CIPHERS
196
Example 8.7 We look at an example with smaller numbers. Let q = 101 E.::.! and p = 1248563. Then p  1modq = O. Let g = 2 q modp = 588634. Then gq modp = 1 and hence g has order q modulo p. Let x = 23. Then y = gX modp = 702644. Suppose m = 53 and let k = 42. The digital signature is given by r = (gkmodp) modq = 52 s
= k 1 (m+xr)modq = 61
Now compute
= ms 1 modq = 82 u = rs 1 modq = 29 t
v
= (lyU modp) modq = 52
Secure Hash Algorithm The secure hash algorithm produces a 160bit output called a message digest. A more suggestive name is digital fingerprint. The message digest detects even slight changes in a lengthy document, so it is almost impossible for different readable documents to have the same message digest. 1 The algorithm uses bitwise logical operations, the circular shift operators, and the modular sum
xl\y xVy xEBy x sn (x) x + y mod 232
and or xor complement left circular shift sum
where x and yare 32bit words, and sn shifts x left by n bits, filling in the vacated bits on the right with those that fell off the left. Thus, S4 (XOX1X2 •.. X31)
= (X4X5 ... X31XOX1X2X3)
Problems 8.5 l. Verify that q
= 1091 381 946026415813817094712889364130135 176 179079
is a prime in the range 2159 < q < 2160 . IThis algorithm, called SH1, is described in the Federal Injo'r'Tnation Processing Standard Publication 1801, which is available at http://www.itl.nist.gov/fipspubs/fip1801.htm. A public competition for a new algorithm, to be called SH3, was announced by the National Institute of Standards and Technology with entries due by October 31, 2008.
~
JiSE DIGITAL SIGNATURE STANDARD
197
Y£ ~:.'
2. Verify that p
= 1001233193091254238180294974169661662027929267 5425071086643301413485006681346209714994069015 138048278778614844442236115774458221400826017 032280284335829147
is a prime in range 2511 < p < 2512 . 3. Verify that p  1 mod q = 0, where p and q are given in problems Land 2. 4. Find the smallest positive integer 5. If g 1.
h
that satisfies
h(p1)/q
modp
=I=
1.
= h(p1)/q modp, where h is given in Problem 4, verify that gq modp =
6. Let q be a prime in the range 2159 algorithm for finding a prime p.
< q < 2160 and consider the following
p := 2'352*q + 1 while isprime(p) = false do p := p + 2*q end do Verify that the prime p given by this algorithm satisfies q I p  1. 7. Let n 1 m and define 7r n ,m (x) to be the number of primes of the form p = nk + m that are less than x. The generalized prime number theorem states that lim 7r n ,m (x) = _1_ x>oo
x/lnx
where
Class Project 1. Get an email address for each student in class.
2. Generate two primes p and q such that m = pq > 1050 . 3. Publish your public key (e, m), where e is a three or fourdigit positive integer with e 1
Chapter 9
Finite Fields Finite fields are called Galois fields in honor of the French mathematician Evariste Galois (18111832), the first to study them in full generality. Recently there has been a renewed interest in finite fields because of their applications to coding theory and cryptography.
In all the history of science there is no completer example of the triumph of crass stupidity over untamable genius than is afforded by the all too brief life of Evariste Galois. E. T. Bell
At the age of 20, Galois engaged in a pistol duel at 25 paces. He was shot in the intestines and died a day later. Much of his mathematical legacy can be traced to the ideas that he frantically put on paper the night before the duel.
9.1
The Galois Field G Fp
The simplest example of a Galois field is Zp = {O, 1,2, ... ,p  I} where p is a prime and addition and multiplication are done modulo p. Here is a list of its properties: Theorem 9.1 Let p be a prime. Then for all a, b, and c in Zp we have 1.
a + (b + c) = (a + b)
2.
a + b = b+ a
Commutative law
3.
a+
Additive identity
4.
a+m =
°
+c
= a
°
for some m
Associative law
Negatives
199
CHAPTER 9. FINITE FIELDS
200 5.
a(bc) = (ab)c
Associative law
6.
ab= ba
Commutative law
7.
al = a
Multiplicative identity
8.
a(b + c) = ab + ac
Distributive law
9.
If a =1= 0, then am = 1 for some m
Inverses
The first eight properties follow from the corresponding properties of Z. The existence of inverses comes from the fact that if p does not divide a, then there is an integer b such that ab == 1 (modp). The element m in property 4 is a. We write the element m in property 9 as aI. We can think of G Fp as the set of congruence classes modulo p. The integers that are congruent to a modulo p form the congruence class of a, denoted by raj. Note that
raj = { ... , a3p, a2p, ap, a, a+p, a+2p, a+3p, ... } The sum of the classes raj and [bJ is [a + b], their product is [abJ. That is,
raj
+ [bJ = [a][bJ
[a + bJ
= [abJ
(See Problem 10.) The idea of a field is obtained by abstracting the properties of addition and multiplication in Zp. Definition 9.2 A field is a set F with an addition and a multiplication satisfying
1. a + (b + c) = (a
+ b) + c for
all a, b, c in F (Associative law)
2. a + b = b + a for all a, b in F (Commutative law) 3. There is an element identity)
°
in F such that a +
°=
a for all a in F (Additive
°
4. a + x = for some x (Negatives. We write x = a.) 5. a(bc) 6. ab
= (ab)c for all a, b,
c in F (Associative law)
= ba for all a, b in F (Commutative law)
7. al = a (Multiplicative identity) 8. a(b + c) = ab + ac (Distributive law) 9. If a =1= 0, then ax
= 1 for some x (Inverses. We write x
= aI.)
ftJ.l.
THE GALOIS FIELD GFp
201
If we take F to be Zp with addition and multiplication modulo p, then we see that Zp is a field. This field is also denoted by GFp , and called the Galois field of order p. The rational numbers Q form a field as do the real numbers JR, and the complex numbers C. These three fields are infinite. We are interested here in finite fields. Example 9.3 Here are the addition and multiplication tables for GF7 .
+ 0 1 2 3 4 5 6
0 0 1 2 3 4 5 6
1 1 2 3 4 5 6 0
2 2 3 4 5 6 0 1
3 3 4 5 6 0 1 2
4 4 5 6 0 1 2 3
5 5 6 0 1 2 3 4
6 6 0 1 2 3 4 5
0 1 2 3 4 5 6
0 0 0 0 0 0 0 0
1 0 1 2 3 4 5 6
2 0 2 4 6 1 3 5
3 0 3 6 2 5 1 4
4 0 4
1 5 2 6 3
5 0 5 3 1 6 4 2
6 0 6 5 4 3 2 1
These are called Cayley tables. They are symmetric about the main diagonal because of the commutative laws. Except for the row of zeros in the multiplication table, each nonzero element appears exactly once in each row. This shows that the equations a + x = b and ex = d have unique solutions in G F7 when
ai o.
Example 9.4 We can think of GF5 as the set of congruences classes modulo 5. There are five congruence classes:
[0] = { ... , 10, 5, 0, 5,1O, ... } [1] = { ... , 9, 4, 1,6, 11 ...} [2] = { ... , 8, 3,2,7,12 ...}
= {... , 7, 2, 3, 8,13 ... } [4] = {... , 6, 1,4,9,14 ...} [3]
Note that
[1]
=
[6]
=
[4]
since each is equal to the set of all integers x such that x mod 5 = 1.
Example 9.5 The addition and multiplication tables of G F5 can be written as
202
CHAPTER 9. FINITE FIELDS
+ 1[0] [1] [0] [1] [2] [3] [4]
I [0] I [1] I [2] I [3] I [4]
[2]
[3]
[4]
[1]
[2]
[3]
[4]
[0]
[2]
[3]
[4]
[0]
[1]
[3]
[4]
[5]
[6]
[2]
[4]
[5]
[6]
[7]
[3]
[5]
[6]
[7]
[8]
[4]
Since
I [0] I [0] I [0] I [0] I [0] I [0]
[0] = [5]
[3] = [8]
[1] = [6] = [16]
[4] = [9]
[1]
[2]
[3]
[4]
[0]
[0]
[0]
[0]
[1]
[2]
[3]
[4]
[2]
[4]
[6]
[8]
[3]
[6]
[9]
[12]
[4]
[8]
[12]
[16]
[2] = [7] = [12] these tables can be rewritten as
+ 1[0] [1] [0] [1] [2] [3] [4]
I [0] I [1] I [2] I [3] I [4]
[2]
[3]
[4]
[1]
[2]
[3]
[4]
[0]
[2]
[3]
[4]
[0]
[1]
[3]
[4]
[0]
[1]
[2]
[4]
[0]
[1]
[2]
[3]
[0]
[1]
[2]
[3]
[4]
I [0] I [0] I [0] I [0] I [0] I [0]
[1]
[2]
[3]
[4]
[0]
[0]
[0]
[0]
[1]
[2]
[3]
[4]
[2]
[4]
[1]
[3]
[3]
[1]
[4]
[2]
[4]
[3]
[2]
[1]
Systems of linear equations can be solved over the finite field G Fp by first solving the system over the rational number field Q and then reducing the solution modulo p. Example 9.6 To solve the system
26x + lOy + 23z = 22
18x + 35y + 7z 7x + 15y + 26z
= 17 = 30
over the field G F41, 1. Find the solution
87 x
= 449'
481 Y
= 2245'
486 z
= 449
to the system of equations over the field Q of rational numbers.
~~9.1.
THE GALOIS FIELD GFp
203
2. Evaluate the solution modulo 41 to get
x = 23,
Y = 38,
Z
= 3
3. Substitute the solution back into the system of equations and evaluate modulo 41 to verify that 26 . 23 + 10 . 38 + 23 . 3 mod 41 = 22 18 . 23 + 35 . 38 + 7 . 3 mod 41 = 17 7 . 23 + 15 . 38 + 26 . 3 mod 41
= 30
Let F be a finite field. When necessary, we will denote the 1 of F by IF to distinguish it from the integer 1. We can form the sum IF + IF, which we denote by 2· IF, the sum IF + IF + IF, which we denote by 3· IF, and so on. As F is finite, we will eventually come across positive integers m < n so that m' IF = n . IF, from which it follows that (n  m) . IF = O. The smallest positive integer c such that c· IF = 0 is called the characteristic of the field F. The characteristic c of a field is a prime number. Why is this? Suppose c = abo Then ab·lF = 0, so (a ·IF) (b .IF) = O. It follows that either a·lF = 0 or b· IF = 0 (see Problem 2). But c is the smallest positive integer such that c· IF = 0, so either a = c or b = c. If F is a field of characteristic p, then we can think of GFp as being contained in F under the correspondence a ++ a . 1F. For a =f. 0 in F, consider the sequence a, a 2 , a\ .... As F is finite, there must be positive integers m < n such that am = an. Repeatedly multiplying this equation by the inverse of a, we get 1 = an  m . So some power of any nonzero element of F is equal to 1. The least positive integer k such that a k = 1 is called the order of a.
Problems 9.1 1. Show that if F is a field, then aO = 0 for any a in F. (Look at aO + aO.) 2. Show that if F is a field, and ab = 0, then a = 0 or b = O. (Show that if a =f. 0, then b = 0.) Another way to state this is that if a and bare nonzero, then so is abo
3. Solve the following system of equations over GF5:
3x+7y+6z = 2 4x+5y+3z 2x+4y+5z 4. Construct the Cayley tables for GFl1 .
=2 = 4
204
CHAPTER 9. FINITE FIELDS
5. Solve the system
3x+9y+4z = 8 2x+3y+5z = 2 5x + 4y + 9z = 10 over GFll . 6. Construct the Cayley tables for GFl3 . 7. Construct the Cayley tables for GF17 . 8. Explain how to locate al in the multiplicative Cayley table for GFp . 9. Explain why the set of integers modulo 10 under addition and multiplication is not a field. 10. Explain why the operations on congruence classes modp, [a] + [b] = [a + b] and [a] [b] = lab], are well defined. That is, why does the result not depend on the particular choice of a and b from the congruence class?
+ 7x + 10 = 0 over GFll . Factor the polynomial 3x3 + x 2 + llx + lover the field GF17.
11. Solve the equation x 2 12.
9.2
The Ring GFp[x] of Polynomials
To construct finite fields other than G Fp , we look at polynomials with coefficients in the field GFp . First, consider polynomials with coefficients in an arbitrary field F. Given two polynomials f(x) ao + alX + a2x2 + ... + anx n
g(x)
=
bo + blx + b2x2
+ ... + bmxm
we add them by adding their coefficients. The coefficient of xi in the sum f(x) + g(x) is ai + bi, where we set ai = 0 if i > nand bi = 0 if i > m. Multiplication of polynomials is more complicated. The coefficient dk of xk in the product f(x) . g(x) is given by
dk =
L
aibj
i+j=k that is,
do = aob o d l = aOb l + albo
dm+n l = anlbm dm+n = anbm
+ anbm l
_~92 .. ~
THE RING GFp[x] OF POLYNOMIALS
205
I,~. This is the product you would get if you simply multiplied f (x) and g (x) using the usual laws.
Example 9.7 The product in GF7[X] of the two polynomials 2 + 3x + 5x 2 and 1 + 5x + 3x 2 + 2x 3 is
(2 + 3x + 5x 2 )(1 + 5x + 3x 2 + 2x3 )
= (2·1) + (2 . 5 + 3· l)x + (2 ·3 + 3·5 + 5· 1)x 2
+ (2·2 + 3·3 + 5· 5)x 3 + (3·2 + 5·3)x4 + (5.2)x 5 2 3 5 = 2 + 6x + 5x + 3x + 3x The set F[x] of polynomials satisfies almost all of the properties of a field. However, a polynomial of degree greater than zero does not have an inverse. The more general notion is that of ring. In a ring you can add, subtract, and multiply. In a field, you can also divide.
Definition 9.8 A ring is a set R with an addition and a multiplication satisfying 1. a + (b
+ c) = (a + b) + c for all a,
b, c in R
2. a + b = b + a for all a, b in R 3. there is an element 0 in R such that a + 0 = a for all a in R
4.
for each a in R there is an element a in R such that a + (a) = 0
5. a(bc) = (ab)c for all a, b, c in R 6. a(b + c) = ab + ac for all a, b, c in R
A ring R is a ring with identity if 7. there is an element 1 in R such that 1a
= a1 = a for
all a in R
A ring R is commutative if 8. ab
= ba for
all a, b in R
A commutative ring with identity is a field if 9. for each a in R with a =J 0 there exists an element aI in R such that aa I = 1 The integers are a commutative ring with identity. The 2 x 2 matrices over the integers with the usual matrix addition and multiplication are a noncommutative ring with identity. The even integers are a commutative ring without an identity.
206
CHAPTER 9. FINITE FIELDS
One important ring is Zn = {O, 1,2, ... , n  I} with addition and multiplication modulo n. This ring is a field when n is prime. We will look at Z6 to see what happens when n is composite. The multiplication table
x 0 1 2 3 4 5
1 0 1 2
0 0 0 0 0 0 0
3 4 5
2 0 2 4 0 2 4
3
4 0 4 2 0 4 2
0
3 0 3 0 3
5 0 5 4
3 2 1
is the Cayley table for multiplication modulo 6. None of the integers 2, 3, or 4 has an inverse modulo 6, so Z6 is not a field. Also, equations such as 2x = 1, 2x = 3, 2x = 5 have no solutions. The set F[x) of polynomials with coefficients in a field F is a commutative ring with identity. It behaves in many ways like the ring Z of integers.
Definition 9.9 The degree of a nonzero polynomial
is the largest m such that am polynomial is monic.
=I=
o.
If am
=
1 for this m, we say that the
We write deg(p( x)) for the degree of the polynomial p( x). The polynomial 2x 3 + 3x 2 + 1 has degree 3 in GF3 [x) and degree 2 in GF 2 [x). It is not monic in either ring. The polynomial X4 + 2x 3 + 3x 2 + 1 is monic in any ring.
Theorem 9.10 If F is a field, and p(x) and q(x) are nonzero polynomials in F[x), then p(x)q(x) =I= 0 and deg(p(x)q(x)) = deg(p(x))
+ deg(q(x))
Proof. Write p(x) = aO+alx+, ·+amxm and q(x) = bo+b1x 1+. ·+bnxn with am and bn nonzero. The term of the largest degree in p(x)q(x) is ambnx m+n , which is not zero because F is a field. • The division algorithm for polynomials over a field is just like the division algorithm for integers.
Theorem 9.11 (Division Algorithm) Let F be any field. Given polynomials a (x) and b (x) in F [x) with b (x) =I= 0, there are polynomials q (x) and r (x) in F [x), where either r (x) = 0 or deg (r (x)) < deg (b (x)), such that a (x)
= b (x) q (x) + r (x)
F9:2.
THE ruNG GF,[xj OF POLYNOMIALS
207
iProof. If Q, (x) = 0, then take q (x) = r (x) = O. Otherwise write
:do ~.
a(x) =aO+alx+···+amxm b(x) = bo + b1x + ... + bnxn with am =I 0 and bn =I O. If m consider the polynomial
< n, take q (x) = 0 and r (x) = a (x).
If m :2: n
This is a polynomial of degree m whose last term is amx m which is the same as the Jast term of a (x). If we subtract it from a (x), we get the polynomial
which is either equal to 0 or has degree at most m  1. So, if we let ql (x) am b:;;: 1 x m n then
a (x) = b (x) ql (x)
+h
=
(x)
with h (x) = 0 or deg (h (x)) < deg (a (x)). If deg(h (x)) :2: deg(b(x)), write h(x) = q2(x)b(x) + 12(x) with 12 (x) = 0 or deg(12(x)) < deg(h(x)). Eventually we get
with fk (x)
= 0 or deg(fk(x)) < deg(b(x)). Taking q (x) = ql (x) r(x) = fk(X)
+ q2(X) + ... + qk(X)
we have shown that
a(x) = q(x)b(x) with r (x)
+ r(x)
= 0 or deg(r(x)) < deg(b(x)).
•
The polynomial q (x) is called the quotient and the polynomial r (x) is called the remainder. It's not hard to see that the quotient and remainder are uniquely determined (see Problem 14). Computer algebra systems will compute the remainder, which it is natural to call a (x) mod b (x) as we do for integers. Definition 9.12 Leta(x), b(x), andm(x) be polynomials inQ[xl. Thena(x) and b (x) are congruent modulo m (x) if a (x)  b (x) = m (x) k (x) for some polynomial k (x) in Q [xl. In this case we write
a (x) == b (x) mod m (x) Note that operations can be carried out in GFp [xl by doing the operations in Q [x], then reducing the coefficients modulo p.
208
CHAPTER 9. FINITE FIELDS
Example 9.13 To find the quotient and remainder when x 3 + x by x 2 + X + 1, we begin by doing long division. This produces 3
x x2
+ 1 is divided
+ x + 1 = xI + x + 2 +X +1 x2 + X + 1
which means that
x3
+X+1 =
(x 2 + X + 1) (x  1) + (x
+ 2)
In this case we write
x3
+ X + 1 mod x 2 + x + 1 = x + 2
and say that the polynomials x+2 and x 3 +x+l are congruent modulo x 2+x+l, that is, 2 x 3 + X + 1 == x + 2 (mod x + x + 1) Note that deg (x + 2) < deg (x 2 + x + 1). Example 9.14 To evaluate
3x4
+ 5x + 2mod2x 3 + x 2 + 5
in GFl l [x], first use long division to rewrite the quotient in the form
3x4 + 5x + 2 2x3 + x 2 + 5
,;:;:__ =
~X _
~
2
4
+
+ ~4 x 2 2x 3 + x 2 + 5
23 4
Qx 2
Thus
Reducing the polynomials with rational coefficients modulo 11, we have ~ x  ~ mod 11 = 7x
3 24 
Thus
+2 2 ~x + ~X2 mod 11 = 9x + 3x + 3
3x 4 + 5x + 2 mod 2x3
+ x 2 + 5 = 9x 2 + 3x + 3
in GFl l [xl. As a check, note that
(3x 4 + 5x + 2)  (9x 2 + 3x + 3) mod 11 = 3x4 + 2x + 10 + 2X2 (7x + 2) (2 X3 + x 2 + 5) mod 11 = 3x4 + 2x + 10 + 2X2 and hence 2x 3
modulo 11.
+ x 2 + 5 divides the difference
19:2. t
THE RING GFp[xJ OF POLYNOMIALS
209
M
~:~. Computer algebra systems have builtin functions that produce a polynomial ; of smallest degree that is congruent to a given polynomiaL The division algorithm can be used to compute the greatest common divisor of two polynomials Pl(X) and P2(X), and to write it as a linear combination of Pl(X) and P2(X).
Theorem 9.15 (Extended Euclidean algorithm) Let F be any field. Given polynomials a and b in F [xJ, there are polynomials sand t in F [xJ such that d = sa + tb is the greatest common divisor of a and b.
Proof. If b = 0, take s = 1 and t = O. Otherwise, writing Pl = a and P2 = b we apply the division algorithm repeatedly to get a sequence of polynomials Pl, P2, P3, ... :
+ P3 = P3q2 + P4 = P4Q3 + P5
Pl = P2ql P2 P3
Pk3
< degp2 with degp4 < degp3 with deg P5 < deg P4 with degp3
= Pk2Qk3 + Pkl
Pk2 = Pk1Qk2
+ Pk
with degpkl < degpk2
with degpk
< degpkl
Pkl = PkQkl
We stop when the remainder is zero. Then d = Pk is the greatest common divisor of Pl = a and P2 = b. Moreover, d may be written as a linear combination of a and b by repeated substitution, from bottom to top, in the preceding equations .
•
The procedure is exactly like the extended Euclidean algorithm for the integers (see page 47). See page 141 for examples with rational coefficients. Every nonzero element u in a finite field K of characteristic P satisfies a monic polynomial in GFp [xJ because some power of u is equal to 1. (See page 203.) Of course 0 satisfies the polynomial x.
Definition 9.16 Let K be a finite field containing a field F, and 0 an element of K. The minimal polynomial of 0 over F is the monic polynomial m (x) in F [xJ of smallest degree such that m (0) = O. Let 0 be an element of a finite field K containing a field F. Let F [OJ denote the set of elements f (0) in K where f (x) ranges over F[xJ. It's clear that F [OJ is a ring because F [xJ is a ring. In fact, F [OJ is a field because some power of any nonzero element of K is equal to 1. We will show that the order of F [OJ is Qn where Q is the order of F and n is the degree of the minimal polynomial of over F.
o
CHAPTER 9. FINITE FIELDS
210
If m (x) is the minimal polynomial of 8 over F, and f (x) is any polynomial in F [x], then we can write f (x) = s (x) m (x) +r (x) where r (x) = or degr (x) < degm (x) = n. So f (8) = r (8). In particular, if f (8) = 0, then r (8) = 0, so r (x) = because m (x) is the minimal polynomial of 8 over F and degr (x) < degm (x). That is, m (x) divides any polynomial that has 8 as a root. Different polynomials r (x) of degree less than n give different values of f (8) because if r (8) = r' (0), then r (x)  r' (x) is a polynomial of degree less than n satisfied by 8, so must be zero because m (x) is the minimal polynomial of 8. So the number of elements in F [8J is the same as the number of polynomials in F [xJ of degree less than n. But such a polynomial looks like
°
°
and there are q choices for each of the coefficients ai giving a total of qn polynomials. We can use this result to show that each finite field has order a power of its characteristic, hence has order pn for some prime p and positive integer n. More generally we show
Theorem 9.17 If K is a finite field containing a field F, then the order of K is a power of the order of F. Proof. Let K have order k and F have order q. If K = F we are done. Otherwise choose an element 8 in K but not in F and let me (x) be its minimal polynomial over F. If n = degme, then the field F [8J has order qn. So k is a power of qn by complete induction (see problem 10) on k  q (we have replaced q by qn, thus decreasing k  q), whence k is a power of q. • Given polynomials a (x) and b (x) =I 0, the division algorithm for polynomials yields the quotient q (x) and remainder r (x). The remainder is given by
r (x)
= a (x) mod b (x)
The cyclic redundancycheck codes (CRC codes) are based on polynomial remainders. Given a fixed polynomial g (x) of degree n, called the generator polynomial, the codeword for the plaintext polynomial p (x) is c (x) = xnp (x) + (xnp (x) modg (x)) mod2. The codeword c(x) is transmitted, and received as d (x). If no errors occur in transmission, then (d (x) mod 9 (x)) mod 2 = 0. If (d (x) mod 9 (x)) mod 2 =I 0, then at least one error must have occurred during transmission, and the codeword would need to be retransmitted. In the case of a barcode, the item would be rescanned.
Example 9.18 Given the generator polynomial 9 (x) = X4 + x 3 + 1 and the plaintext polynomial p (x) = x 7 + x 5 + x 2 + 1, the codeword is given by c (x)
=
xnp (x) + (xnp (x) modg (x)) mod 2 x4 (X7 + x 5 + x 2 + 1) + (X4 (x7 + x 5 + x2 + 1) modx 4 6 3 2 9 Xll + x + x + X4 + x + x + X
+ x3 + 1) mod2
~9.2. ~:~'
THE RING GFp[x] OF POLYNOMIALS
211
... If an error xk occurs, then the received message is
Since (d (x) mod 9 (x) ) mod 2
= xk
is not zero, at least one error is detected. If no errors occur, then
and the plaintext polynomial is the quotient
The critical factor in designing a good CRC code is the generator polynomial 9 (x). One of the most popular CRC codes is CRC16, which uses the generator
polynomial 9 (x)
= x 16 + x 15 + x 2 + 1. This code
1. detects all single errors.
2. detects all double errors. 3. detects any odd number of errors. 4. detects any error burst of length at most 16; that is, an error of the form xk + xk+1 + ... + Xk+n  1 where n S; 16.
Problems 9.2 (4x 4 + 6x 2
1. Compute the sum (5x 3
+ 4x 2 + 3) +
2. Compute the sum (10x4
+ 8x 3 + 6x + 7)+ (7X4 + 6x 2 + 8x + 9) in GF11 [xl.
3. Compute the product (5x 3 4. Compute (10x4
+ 3x + 5) in GF7[xl.
+ 4x 2 + 3) (4x 4 + 6x 2 + 3x + 5) in GF7[xl.
+ 8x3 + 6x + 7)
(7X4
+ 6x 2 + 8x + 9) in GF11 [xl.
5. Compute 4x4
+ x 2 + 3x + 1 mod5x 3 + 4x 2 + 3 in GF7[xl.
6. Compute 2x8
+ 6x 3 + 4mod3x 5 + 7x 4 + 2x + 5 in GFl1 [xl.
7. Factor
x5
8. Factor x 6
+ x 3 + 6x 2 + X + 2 in GF7 [xl. + x 5 + x4 + 4x3 + 3x2 + 3x + 3 in GF7 [xl.
9. Use the generator polynomial 9 (x) = x4 + x 3 + 1 to generate the CRC codeword corresponding to the plaintext p (x) = x 11 + x 9 + x 2 .
CHAPTER 9. FINITE FIELDS
212
10. The principle of complete induction: Let P(n) be a statement that depends on the positive integer n. If P(k) is true whenever P (j) is true for all j < k, then P(n) is true for each positive integer n. Let P' (n) = P (1) & P (2) & ... & P (n). Use ordinary induction on the statement P' (n) to prove the principle of complete induction. 11. Show by complete induction that every positive integer is either 1, a prime, or a product of primes. 12. The polynomial
+ x 29 + x 27 + x 25 + X23 + X21 + x 19 + x 17 + x 15 + x14 + X13 7 2 12 lO 9 8 6 5 +X + xl! + x + x + x + x + x + x + x4 + x + x
r (x)
x
31
is received after being encoded by the CRC16 generator polynomial 9 (x) = + x 15 + x 2 + 1. Test to see whether an error has occurred. If no error is detected, find the plaintext polynomial. x 16
13. The polynomial r (x)
=
+ x 29 + x 27 + x 25 + X23 + X21 + x 20 + x 18 + x 17 + x 15 + X14 8 5 13 12 lO 9 7 6 2 +x + X + xl! + x + x + x + x + x + x + X4 + x + x 31 X
is received after being encoded by the CRC16 generator polynomial 9 (x) = x 16 + X15 + x 2 + 1. Test to see whether an error has occurred. If no error is detected, find the plaintext polynomial. 14. Suppose a (x) = q (x) b (x) + r (x) and also a (x) = q' (x) b (x) + r' (x) as in the division algorithm. Show that r (x) = r' (x) and q (x) = q' (x). (Start by subtracting one equation from the other, and use the fact that the degrees of the remainders are small.)
9.3
The Galois Field CF4
As we observed in Section 9.1, there is a finite field GFp with p elements for each prime p. For p = 2, addition and multiplication in GF2 are given by the tables x 0 1 + 0 1 o 0 1 o 0 0 1 0 1 1 1 0 For handling data, fields with 2n elements are convenient because information is often represented as strings of Os and Is. The immediate candidate for a field of size 4 is Z4, but its multiplication table reveals that it is not a field.
x
0
1
2
3
o
0 0 0
0 1 2
0 2 0
0 3 2
0
3
2
1
1 2 3
';9.3. THE GALOIS FIELD GF4
213
Note that 2 x 2 = 0, so 2 has no inverse . . To construct a field with four elements, we consider GF2 [xl modulo the polynomial x 2 + x + 1. Definition 9.19 Let F be a field and p (x) a polynomial in F [xl of degree at least 1. We say that p (x) is reducible if we can write p(x) = a(x)b(x) where deg a( x) :::: 1 and deg b( x) :::: 1. If p (x) is not reducible, it is said to be irreducible. So p (x) is irreducible if whenever p(x) = a(x)b(x), then either deg a (x) = 0 or deg b (x) = O. A polynomial p (x) in F [xl of degree 2 or 3 is reducible exactly when it has a root in F. Indeed, if p (x) is reducible, say p (x) = a (x) b (x) with deg a (x) :::: 1 and degb(x) :::: 1, then, because dega(x) + degb(x) = degp(x) :::; 3, either a (x) or b (x) has degree 1. Thus p (x) has a linear factor, so it has a root in F. On the other hand, suppose that p (x) has a root 0: in F. By the division algorithm, there are polynomials q (x) and r (x) in F [xl such that p (x)
=
(x  0:) q (x)
+ r (x)
where either r (x) = 0 or degr (x) < deg (x  0:) = 1. So r (x) = r is a constant. Since 0: is a root of p (x), 0 = p (0:) = (0:  0:) q (0:) + r = r so p (x) = (x  0:) q (x) is reducible. Consider the polynomial p(x) = x 2 +x+ 1 in GF2 [xl. As p(O) = 02 +0+ 1 = 1 :f. 0 and p(l) = 12 + 1 + 1 = 1 :f. 0, this polynomial has no roots in GF2 , so it is irreducible. For any polynomial f (x) E G F2 [x], the remainder f (x) mod (X2 + X + 1) has degree less than 2. Thus each polynomial in GF2 [xl is congruent modulo x 2 + x + 1 to a polynomial of degree at most Ithat is, any polynomial in GF2 [xl is congruent, modulo x 2 + x + 1, to one of the four polynomials
x,
x
+ 1,
0,
1
The Galois Field G F4 as a Set of Linear Polynomials We use the irreducible polynomial x 2 + x + 1 in GF2 [xl to construct a fourelement field. The basic idea is to introduce a symbol () and require that ()2 + () + 1 = 0; that is, that () be a root of the irreducible polynomial x 2 + x + 1. Because ()2 + () + 1 = 0, we can write ()2 = () + 1 (remember that the coefficients are in GF2 so 1 = 1). Definition 9.20 The Galois field GF2 2 = GF4 consists of the expressions a() + b, where a and b are in G F 2 , with the straightforward definition of addition and multiplication defined by setting ()2 = () + 1. For example,
= 2() + 1 = 1 (() + 1) () = ()2 + () = () + 1 + () = 2() + 1 = 1
(() + 1) + ()
Similar calculations lead to the addition and multiplication tables for G F 4 .
CHAPTER 9. FINITE FIELDS
214 + 0 1 8 8+1
0 0 1 8 8+1
1 1 0 8+1 8
8 8 8+1 0 1
8+1 8+1 8 1 0
0 1 8 8+1
0 0 0 0 0
1 0 1 8 8+1
8 0 8 8+1 1
8+1 0 8+1 1 8
The multiplication table can be constructed by calculating the matrix product
o 1 8 1+8 then setting 82
= 8 + 1 throughout
to get
00 1
8
o o o
(
o
8
1+8
1+8
1
Notice that setting 82 = 8 + 1 amounts to reducing modulo 82 + 8 + 1. We can represent the element a8 + bin GF4 by the binary string ab. So 8 is represented by 10 and 8 + 1 by 11. The addition and multiplication tables become
+ 00 01 10 11
00 00 01 10 11
01 01 00 11 10
10 10 11 00 01
11 11 10 01 00
00 01 10 11
00 00 00 00 00
01 00 01 10 11
10 00 10 11 01
11 00 11 01 10
If, for shorthand, we let 0 = 00, 1 = 01, 2 = 10, and 3 = 11, then the addition and multiplication tables become
+
o
1 2 3
0 0 1 2 3
1 1 0 3 2
2 2 3 0 1
3 3 2 1 0
o
1 2 3 0 0 0 0 10123
o 2
0
2
3
1
30312
;;9.3. THE GALOIS FIELD GF4
215
Notice that these tables do not give addition and multiplication modulo 4. No matter how the elements are relabeled, the diagonal elements of the addition table would all be the same, which is not the case for Z4. All nine of the field properties listed in Section 9.1 are satisfied by the addition and multiplication of these tables. This field is the Galois field GF4 .
The Galois Field G F4 as a Set of Congruence Classes The Galois field G F4 can also be defined in terms of congruence classes.
Definition 9.21 Define a congruence relation on GF2 [x] by f(x)=g(x) if f (x)  9 (x) = k (x) (x
+ X + 1)
2
for some k (x) E GF2 [x]. Let [J (x)] denote the congruence class containing f (x). The Galois field GF4 is the set of congruence classes with addition and multiplication defined by [f (x)]
+ [g (x)]
+ 9 (x)]
= [J (x)
[J (x)] [g (x)] = [f (x) 9 (x)] Every congruence class [f (x)] contains a unique representative of degree at most 1, namely f (x) mod (x 2 + X + 1). The connection with the notation + b is that the element of e of GF4 is the congruence class [x] of the polynomial x.
ae
The Galois Field G F4 as Linear Combinations of a Fixed Root A third way to define the Galois field G F4 is to represent the elements of G F4 by linear polynomials over G F 2 , and reduce modulo x 2 + x + 1 after multiplying two of these linear polynomials. This amounts to replacing the congruence class [J (x)] by the linear polynomial f (x) mod x 2 + x + 1.
Definition 9.22 Let GF4 be the set {O, 1, x, x
+ I}
with addition and multipli
cation defined by
+ 0 1 x x+1
0 0 1 x x+1
0 1 x x+1
0 0 0 0 0
1 1 0 x+1 x
1 0 1 x x+1
x x x+1 0
1
x+1 x+1 x
1 0
x 0 x x+1
x+1 0 x+1
1
x
1
CHAPTER 9. FINITE FIELDS
216
The Galois Field G F4 as Powers of a Fixed Root A fourth way to define the Galois field G F4 is to let () be a root of the irreducible polynomial x 2 + x + 1 and write each of the nonzero elements of G F4 as a power of (): ()
+1
(}2 = () (}3
= () (() + 1) = (}2 + () = () + () + 1 = 1
Definition 9.23 Let () be a root of the polynomial x 2 + x + 1 and define GF4 to be the set {O, 1, (), (}2} with addition and multiplication given by
+
0 0 1
0 1 ()
()
(}2
(}2
1 1 0 (}2 ()
()
(}2
()
()
(}2
()
0 1
0 1
1 0
(}2
()
0 0 0 0 0
1 0 1
()
(}2
0
0 (}2
()
(}2
1
(}2
1
()
()
Problems 9.3 1. Verify the addition and multiplication tables for GF4 by evaluating sums and products of the four expressions 0, 1, (), and () + 1 where (}2 = () + 1.
2. Prove that addition and multiplication are commutative in GF4 . 3. Verify that the associative laws for addition and multiplication hold in
GF4 . 4. Verify that the distributive law holds in GF4 . 5. Let h (x)
= x 2 + X + 1.
Show that if
fdx)
= h
g1 (x)
= g2 (x)
and
(x) (mod h (x)) (modh (x))
then
It (x) + g1 (x) = h and
It (x) g1 (x) = h
(x)
+ g2 (x)
(mod h (x))
(x) g2 (x) (mod h (x))
In other words, show that the addition and multiplication in G F4
[J (x)] + [g (x)] = [f (x) + 9 (x)] [J (x)] . [g (x)] = [f (x) 9 (x)] is well defined.
THE GALOIS FIELDS GFs AND GF16 6. If () E GF4 is a root of x 2 +x+ 1, then {3
217
= ()+ 1 is also a root of x 2 +x+ 1.
7. Use () and {3 in Problem 6 and define a function f : GF4 + GF4 by f (0) = 0, f (1) = 1, f (()) = (3, and f (() + 1) = (3 + 1. Verify that f(s+t) = f(s) + f(t) and f(st) = f(s)f(t) for all s,t E GF4 . (We say that f is the automorphism of G F4 that interchanges the roots of the polynomial x 2 + x + 1.) S. Let F be any field and let Prove the following.
f (x)
and 9 (x) be nonzero polynomials in F
[xl.
(a) If f (x) 9 (x) E F, then f (x) and 9 (x) are both elements of F, that is, they are polynomials of degree o. (b) If f (x) = (x  a) q (x) +r (x) for some q (x), r (x) E F [xl with a E F and r (x) = 0 or deg (r (x)) = 0, then r (x) = f (a) E F, that is,
f (x)
=
(x  a) q (x)
(c) The polynomial x  a divides of f (x).
f (x)
in F
+ f (a) [xl if and only if a is a root
9. For the congruence relation on GF2 [xl given in Definition 9.21 on page 215, prove that f (x) mod (x 2 + X + 1) is the only polynomial of degree at most 1 in the equivalence class [f (x) l. 10. Show that the multiplication table for G F4 is essentially different from the multiplication table for 1£4. That is, show that no relabeling of 1£4 would create a multiplication table for GF4 .
9.4
The Galois Fields CFs and CF16
The elements of a field of size 2n can be represented in a natural way as binary numbers and easily manipulated by computers and networks. We will look at G F2 n for n = 3 and n = 4 in this section, and then develop the theory for G Fpn with p an arbitrary prime in the following section.
The Field G F8 The elements of the field G Fs can be thought of as polynomials of the form ax 2 + bx + c in GF2 [xl. There are two choices for each of the three coefficients, so there are 2 . 2 . 2 = S of these polynomials. Addition is polynomial addition. How do we multiply? To define the multiplication, we need an irreducible cubic polynomial. The polynomials x 3 + x 2 + 1 and x 3 + x + 1 are irreducible over G F2 because neither 0 nor 1 is a root of either polynomial, and any reducible cubic has a linear factor, so has a root in GF2 . We choose the simpler polynomial x 3 + x + 1.
218
CHAPTER 9. FINITE FIELDS
We note in passing that x S +x = x(x+ 1)(x3 +x+ 1)(x 3 +x 2 + 1) in GF2 [x), and the factors on the right are a complete list of all the irreducible polynomials of degrees 1 and 3 over G F 2 . To multiply in GFs , we take the polynomial product and reduce modulo x 3 + x + 1. So we can form the multiplication table by taking the matrix product
1 x x+1 x2 2 x +1 x 2 +x x 2 +x+1
=
(1
x
1 + X x2 x2 + 1 x
+ x2
x2 + X + 1 )
1 x x+1 x2 x 2 +x X x+1 x 2 +x x 2 + 2x + 1 2 3 x x x 3 +x 2 3 3 2 x +x x +x+x 2 + 1 x +1 2 3 2 x 3 + 2X2 + X x +x x +x 2 3 2 3 x +x + 1 x +x +x x + 2x2 + 2x + 1
x2 + 1 x 3 +x 2 3 3 x +x x +x+x2 + 1 X4 x4 +x2 2 X4 +x X4 + 2X2 + 1 X4 +x 3 X4 +x 3 +x 2 +x X4 + x 3 + x 2 x4 + x 3 + 2X2 + X + 1
x2
x3
x 2 +x x 2 +x + 1 2 3 x +x x 3 +x 2 +x 3 3 x + 2X2 + X x + 2X2 + 2x + 1 x4 +x3 x4 + x 3 + x 2 2 3 x4 +x +x +x x4 + x 3 + 2X2 + X + 1 3 2 x4 +2x +x x4 + 2x 3 + 2x2 + X 3 x4 + 2x + 2X2 + X x4 + 2x3 + 3x 2 + 2x + 1 This is a 7 x 7 matrix whose entries are the polynomial products of all pairs of quadratic polynomials with coefficients in {O, I}.
~9A.
rJr.
THE GALOIS FIELDS GFs AND GF16
219
Now reduce each polynomial in the matrix modulo the irreducible polynomial
t x3 + X + 1 to get l+x x2 2 lx X x+x x 2 1x l+x 1 + 2x + x 2 x 2 1 x x2 x x2 2 2 1 x x x +1 2x2 1 2x  x 2 1 x 2 1 x x+x 2 x 2 1 2x1 x+2x 2 x 2 +x + 1 2 2 x+x x +1 x2 + x + 1 2 1 x 1 x x 2 1 2 2X2 1 x x+2x 2 2 2x  x 1 x 2x 1 lx 1 +x2  x x 2 x 2 lx 3x2 x  2  2x x 2  2  2x 1 + 2x2  X x 2 x 1
x x2 x+x 2 lx
Here we have left the coefficients as integers. To get the multiplication table for GFs , we reduce this matrix modulo 2 to get
x2 x+1 2 x x +x x+1 x+1 x2 + 1 x 2 +x+ 1 x2 x 2 +x + 1 x 2 +x 2 2 1 x X x +1 1 x 2 +x x 2 +x + 1 x2 + 1 x 1 x 2 +x+1 x2 + 1 2 2 2 x +x x +x + 1 x +1 1 x2+ 1 x2 + X + 1 2 1 x x 1 X x2 + 1 x+1 x 2 +x+ 1 x 2 +x X x2 x+1 2 2 x x+1 x +x 1
x x2 x 2 +x x+1
The multiplication table of G Fs can be represented in binary form by using the string of coefficients of each polynomial. The addition table is just mod 2 vector addition (see page 104), so we can compute the sums directly. Addition and multiplication by zero have been omitted from these tables because they are trivial: 0 + a = a + 0 = a and Oa = aO = O.
CHAPTER 9. FINITE FIELDS
220 + 00l 010 011 100 101 110 111
001 000 011 010 101 100 111 110
010 011 000 00l 110 111 100 101
011 010 001 000 111 110 101 100
001 010 011 100 101 110
001 001 010 011 100 101 110
011 011 110 101
100 100 011
III
III
III
010 010 100 110 011 001 111 101
110 010 10l 00l
100 001 010
100 101 110
III 000 001 010 011
III
10l 100 111 110 001 000 011 010
110
III
III
110 101 100 011 010 001 000
100 101 010 011 000 001 110 110
10l 101 001 100 010 111 011 110
III 001 101 011 010 100
111 111 101 010 001 110 100 011
We can also write these tables in decimal (or hex) notation.
+ 1 2 3 4 5 6 7
1 0 3 2 5 4 7 6
2 3 0 1 6 7 4 5
3 2 1 0 7 6 5 4
4 5 6 7 0 1 2 3
5 4 7 6 1 0 3 2
6 7 4 5 2 3 0 1
7 6 5 4 3 2 1 0
1 2 3 4 5 6 7
1 1 2 3 4 5 6 7
2 2 4 6 3 1 7 5
3 3 6 5 7 4 1 2
4 4 3 7 6 2 5 1
5 5 1 4 2 7 3 6
6 6 7 1 5 3 2 4
7 7 5 2 1 6 4 3
Suppose that 8 is a root in GFs ofthe polynomial x 3 +x+1. Then 83+8+1 = 0, so that 83 = 8 + 1. Thus
84 = 8 (8 + 1) = 82 + 8 85 = 8 (8 2 + 8) = 83 + 82 = 8 + 1 + 82 86 = 8 (8 + 1 + 8
2
)
2
2
2
= 8 + 8 + 83 = 8 + 8 + 8 + 1 = 8 + 1
8 7 = 8 (8 2 + 1) = 83 + 8 = 8 + 1 + 8 = 1 So each nonzero element of GFs is a power of 8. This leads to a representation for G Fs that makes both multiplication and addition easy.
)('f,
1~'9.4.
THE GALOIS FIELDS GFs AND GF16
Power Notation
Polynomial Notation
a
221
Decimal (Hex) Notation
a
Binary Notation 000
1
001
1
()1
()
010
2
()2
()2
100
4
()3
()+1
011
3
()4
()2 + ()
110
6
()5
()2 + () + 1
111
7
()6
()2
+ 1
101
5
()o
(= ()7)
Table 9.1
GF2 3
a
= GFs
To add, convert field elements to polynomial or binary notation and use polynomial or vector addition modulo 2. To multiply, convert to powers of () and add exponents, with exponents added modulo 7. For example, 3· 5 ()3 . ()6 = ()9 = ()2 = 100 = 4. Notice that 2 is a root of the polynomial q (x)
= x3 + X + 1 because
23 + 2 + 1 = 3 + 2 + 1 = (011) + (010) + (001)
= (000) = a
In fact, each field element is a root of the polynomial x S + x because and «()i)S = «()i)1()i = «()7)i()i = 1i()i = ()i. Also,
x S + x = x(x + 1)(x3 + x 2 + 1)(x 3 +
X
as + a = a
+ 1)
so every field element is a root of exactly one of the factors on the right. Suppose () is a element of GF s such that ()3 + () + 1 = a and u = () + 1, then
u3 + u2 + 1 =
«() +
1)3 +
«() +
1)2 + 1
= ()3 + 4()2 + 5() + 3
= ()3 + () + 1 =0 Thus u = () + 1 is a root of the polynomial x 3 + x 2 + 1. This polynomial is irreducible over GF2 since it is of degree 3 and has no roots in GF2 . Thus it is the minimal polynomial of () + 1. The following table shows the minimal polynomial for each element of the Galois field G Fs.
222
CHAPTER 9. FiNITE FIELDS Power Notation
Polynomial Notation
Binary Notation
Decimal Notation
a
a
000
a
Minimal Polynomial x
2° 21
1
001
1
x+1
0
010
2
x 3 +x+1
22
02
100
4
x 3 +x + 1
23
0+1
all
3
x3
24
02 +0
110
6
x 3 +x+ 1
25
02 +0+1
111
7
101
5
+ x2 + 1 x3 + x2 + 1
02
26
+1
+ x2 + 1
x3
Minimal polynomials of elements in G F8
Table 9.2
The Field G F 16 The field GF2 4 (also written GF16 ) will be especially important to us. To construct this field, we need an irreducible polynomial of degree 4 over GF2 • One way to construct one is to generate all of the polynomials of degrees 1 through 3, then make a list of all polynomials of degree 4 that can be written as products of those polynomials, then pick a polynomial of degree 4 that is not on the list. This is essentially the sieve of Eratosthenes applied to polynomials. Another way is to factor the polynomial x 16  x = x 16 + x (remember that 1 = 1 modulo 2). Factoring X 16 + x modulo 2 in a computer algebra system yields X
16
+X
(x + 1) (x 2
+ X + 1) (x 4 + x 3 + 1) . (x 4 + X + 1) (X4 + x 3 + x 2 + X + 1) =
X
There are three irreducible polynomials of degree 4 in this factorization. We pick x4 + x + 1 because of its simple form. The method we used to construct GF8 also works for GF16 , but the matrices are a bit large to display here. , Before giving a multiplication table for GF16 , we construct a table of equivalent representations for elements in GF16 . Let 0 be a root of X4 + x + 1, so 04 + 0 + 1 = O. Rewrite this as 04 = 0 + 1. Thus 04 can be replaced by 0 + 1. Multiplying both sides of the equation 04 = 0 + 1 by 0 gives 05 = 02 + O. Similar calculations can be used to calculate the second column of Table 9.3. (The rest of this table is left as problem 8.)
'g.4.
223
THE GALOIS FIELDS GFB AND GF16
Power
Polynomial
Binary
Hex
Decimal
a
a
0000
a
a
Minimal Polynomial x
eO
1
0001
1
1
x+l
e1
e e2
0010
2
2
0100
4
4
e3
1000
8
8
e+l e2 + e
0011
3
3
0110
6
6
e 3 + e2
1100
C
12
+ X+ 1 X4 +x + 1 x4 + x 3 + x 2 + X + 1 X4 +x + 1 x2 + X + 1 X4 + x 3 + x 2 + X + 1
e2 e3 e4 e5 e6
Table 9.3
X4
Representations of elements in G F16
The binary representation is the string of coefficients in the polynomial representation. That is, the binary representation of C3e3 + C2e2 + Cl e + Co is ( C3 C2 CI CO)2'
The minimal polynomials of elements of GH6 can be computed using the identities (a + b)2 = a 2 + b2 for a, bE GF16 , and x 2 = x for x E GF2. If u in GF16 is a root of a polynomial with coefficients in GF2 , then u 2 is a root of the same polynomial. To see this, consider a polynomial C3X3 + C2x2 + CIX + Co such that C3u3 + C2U2 + Cl U + Co = O. Then
0= (C3u3+C2U2+CIU+co)2 2 = c~ (U 3)2 + c~ (U 2)2 + cru + c6
= C3 (u 2)3 + C2 (U 2)2 + CIU 2 + Co Thus u 2 is also a root of C3X 3 + C2X 2 + CIX + Co. Repeating this argument on u 2 shows that (u 2 ) 2 = u4 is also a root of this polynomial, and so on. Now let e be a root of the defining polynomial X4 + x + 1 for G F 16 . We have seen that e, e 2, (e 2)2 = e 4, and (e 4)2 = e B are all roots of x4 + x + 1. This means that x  e, x  e 2, x  e4, and x  e B are all factors of X4 + x + 1. And, sure enough, the product of these four polynomials, computed in GF16 [x], is
the minimal polynomial for each of e, e 2, e4, and e B. Similarly, the minimal polynomial for e3 is
CHAPTER 9. FINITE FIELDS
224 The powers of 02
+ 0 are (0 2 + 0)2 = 02 + 0 + 1 (0 2 + 0 + 1) 2 = 02 + 0
so repeated squaring yields two distinct powers. Hence the minimal polynomial of 02 + 0 is
(X+(02+0)) (X+(02+0)2) =x 2 +x+l
In the following examples, we compute the product
in three different ways. Example 9.24 First, we expand the product to get
2 4 2 3 (0 2 + 0 + 1) (0 3 + 0 + 1) = 05 + 20 + 20 + 20 + 0 + 1 Then reduce the product modulo the irreducible polynomial q (0) = 04 to produce
+0+1
Then reduce the coefficients modulo 2 to get the reduced product 1
+ 02 + 20 3 
20 mod 2 = 02 + 1
It follows that in G F16 ,
Example 9.25 On the other hand, we have 015 = 1 = 00 , so multiplication can be computed by adding exponents of 0 modulo 15. Since 02 + 0 + 1 = OlO and 03 + 02 + 1 = 0 13 , it follows that
(0
2
+ 0 + 1) (0 3 + 02 + 1) = 010 013 = 0(10+13) mod 15 =
08 = 02
+1
Example 9.26 Expanding using the distributive law gives
(0
2
+ 0 + 1) (0 3 + 02 + 1)
=
2 3 2 0 (0 + 0 + 1)
+ 0 (0 3 + 02 + 1)
+ (0 3 + 02 + 1) Multiplication by 0 yields
o(0 3 + 02 + 1) =
+ 03 + 0 = (0 + 1) + (0 3 + 0) 4
0
3
= 0
+1
~r ,/9.5.
THE GALOIS FIELD GFpn
225
i:
~:since 04 = 0 + 1 and 0 + 0 = 0; hence 2
0 (0 3
+ 02 + 1) = 0 (0 3 + 1) = 04 + 0 =(0+1)+0=1
Therefore,
(0
2
+ 0 + 1) (0 3 + 02 + 1) = (1) + (0 3 + 1) + (0 3 + 02 + 1) = 02 + 1 = 5
Problems 9.4 1. Find (0 2 + 1) (0 2 + 0) in G Fs by first converting to powers of 0 and then expressing the result as a polynomial in O.
2. Calculate (0 3
+ 02 )(03 + 0 + 1) in GF16
3. Verify the products E· E GF16 ·
by using polynomial arithmetic.
= Band 8· A = F
(written in hex notation) in
4. Solve the system
3u+Dv Eu+5v
=7 =9
(written in hex notation) for elements u and v of GF16 .
5. Find an irreducible polynomial of degree 5 in GF2 [xl. 6. Use your polynomial q(x) from Problem 5 to construct an element of order 31 in GF32 .
7. Factor x 5
+ x + lover GF2 .
8. Complete the representations of elements in GF16 begun in Table 9.3. page 223. 9. Verify that x 3 + x 2 + 1 and of degree 3 in GF2 [xl.
x
3
+ x + 1 are the only irreducible polynomials
10. Verify that X4 + x 3 + 1, X4 + X + 1, and x4 + x 3 + x 2 + X irreducible polynomials of degree 4 in GF 2 [xl.
9.5
The Galois Field
+ 1 are the only
GFpn
We have seen how the ring GF2 [xl can be used to construct a field with 2n elements. It turns out that any finite field has pn elements for some prime p, a fact we will prove later. Moreover, there is essentially only one field with pn elements.
226
CHAPTER 9. FINITE FIELDS In this section we construct a field with pn elements for an arbitrary prime
p. We do this by constructing a field K containing GFp in which the polynomial
xpn  x factors into linear factors pn
xpn  X =
II (x 
Oi)
i=l
where 0 1, ... , Opn are in K. It turns out that the elements 0 1, ... , Opn are all different and form a field with pn elements. This field is called the splitting field of xpn  x over G Fp. We will show how to construct a field of order pm from an irreducible polynomial of degree mover GFp • Later we will show how to construct such an irreducible polynomial. The idea of how to construct a field from a field and an irreducible polynomial is due to Kronecker.
Theorem 9.27 Let F be a field and h (x) an irreducible polynomial of degree
m in F [xl. Define K to be the set of congruence classes of polynomials in F [xl modulo h (x). Let 0 be the congruence class of the polynomial x, so if f (x) E F [x], then the congruence class of f (x) is f (0). Define multiplication in K by setting f (0) g (0) = r (0) where r (x)
= (f (x) g (x)) mod h (x).
This turns the set K into a field. If F is a finite field of order q, then the order of K is qm. Proof. Note that each element of K can be written uniquely as r (0) where r (x) is a polynomial in F [xl of degree less than m. Indeed, if f (0) is an element of K, then r (x) = f (x) mod h (x). Notice also that f (0) = 0 exactly when h (x) divides f (x). We need to show that nonzero elements of K have inverses. Let r (0) be a nonzero element of K where degr (x) < m. As h (x) is irreducible and does not divide r (x), there exist polynomials s (x) and t (x) with coefficients in F so that s(x)r(x) +t(x)h(x)
=1
by the extended Euclidean algorithm for polynomials. h (0) = 0, we have
s (0) r (0)
(See page 209.)
As
= s (0) r (0) + t (0) q (0) = 1
so r (0) has an inverse in K. All of the other field properties follow from the corresponding properties of
F[xl· Finally, if the order of F is q, then there are exactly qm polynomials a m _1X m 1 + am_2Xm2 + ... + a2x2 + a1X + ao of degree less than m in F [x], because there are exactly q choices for each of the m coefficients. So K has order qm. •
r9:5.
THE GALOIS FIELD GFpn
227
I
r
As a corollary, we will show that every nonconstant polynomial over a field ; has a root in some extension field. Corollary 9.28 Let f (x) be a nonconstant polynomial with coefficients in a field F. Then there is a field K containing F that also contains a root of f (x). Proof. If f (x) is not irreducible, then f (x) has a factor II (x) in F [xl such that 1 ::::; degii (x) < degf(x). Either II (x) is irreducible, or II (x) has a factor h (x) such that 1 ::::; deg h (x) < deg II (x). At each step the degree of the polynomial fi (x) gets smaller, so you will eventually find an irreducible factor q (x) of f (x). Use q (x) to construct the field K as congruence classes modulo q (x) of polynomials over F. Let B be the element of K that is the congruence class of the polynomial x. Then f (B) = 0 because q (x) is a factor of f (x) in F [xl. • Theorem 9.29 There is a field K containing GFp so that xpn  x factors into linear factors over K, that is,
with each Bi in K. Moreover, the set of roots B1 , B2 , ... , Bpn of xpn  x is itself a field, called a splitting field of xpn  x. Proof. We can construct K by repeating the construction of the corollary, starting with the polynomial xpn  x over the field GFp. At each stage we will have written the polynomial xpn  x = X (xpnl  1) as a product of linear factors times a polynomial g (x) of degree greater than lover some field F. We apply the corollary to get a field F' containing F in which g (x) has a root B, so we can write 9 (x) = (x  B) h(x) where the degree of h (x) is smaller than the degree of 9 (x). Thus we have written xpn  x as a product of linear factors times h (x), and we then apply the corollary to the polynomial h (x) over the field F '. To see that the set of roots B1 , B2 , •.. ,Bpn of xpn  x is itself a field, note that if B is a root of xpn  x, then Bpn  B = Othat is, Bpn = B.. Thus if Bi , Bj are roots of xpn  x, then
and Also, if B =I 0, then
(Bl)pn = (Bpn) 1 = B 1 So the set of roots of xpn  x is a field. If there are no multiple roots, then this field has exactly pn elements, as desired. To see that there are no multiple roots, let m = pn. As xm  x = X (xml  1) it is clear that 0 is not a multiple
228
CHAPTER 9. FINITE FIELDS
root. Suppose r is a nonzero root of xm  x. Then rm = r so r m 1 = 1. It follows that
The issue is whether r is a root of the second factor on the right. But if we plug r into that polynomial we get (m  1) r m  1 = (m  1) ·lK = lK =1= 0 because m is divisible by p. • As another application of the division algorithm, we show that a polynomial of degree n has at most n distinct roots. The key fact is Theorem 9.30 An element () of a field is a root of a polynomial f (x) if and
only if f (x) is divisible by the polynomial x  (). Proof. Indeed, the division algorithm tells us that we can write
f(x) = q(x)(x()) +r(x) where either r (x) = 0 or degr (x) < deg (x  ()) = 1. So r (x) is a constant r, and f (()) = q (()) (()  ()) + r = r is equal to 0 exactly when f (x) = q (x) (x  ()).
•
Corollary 9.31 Let F be a field and s (x) a polynomial of degree n in F [x].
Then s (x) has at most n distinct roots in F. Proof. Suppose () is a root of s (x). From the above theorem, s (x) = q (x) (x  ()) for some polynomial q (x). If (3 is a root of s (x) different from (), then 0 = s ((3) = q ((3) ((3  ()) and (3  () =1= 0 implies that q ((3) = O. But, by degq (x) = n  1, so by induction on the degree, the polynomial q (x) has at most n  1 distinct roots in F. Thus s (x) has at most n distinct roots: () and at most n.1 more .•
Problems 9.5 1. Find an irreducible polynomial of degree 2 in GF5[X].
2. Find an element of order 24 in GF25 • 3. Show that if an = 1 and a n/ p an element of order n.
=1=
1 for each prime divisor p of n, then a is
4. Assume that q (x) is an irreducible polynomial in F [x] for some field F, and assume that q (x) I r (x) p (x), where r (x), p (x) E F [x] with deg (r (x)) < deg (q (x)). Prove that q (x) I p (x). 5. A polynomial q(x) of degree 2 or 3 is irreducible in F[x] if and only if q(x) has no roots in F. Use this fact to verify that the polynomials x 2 + 1, x 2 + X + 2 and x 2 + 2x + 2 are irreducible in GF3[X].
~.
;9.6. . ;~
THE MULTIPLICATIVE GROUP OF GFpn
229
6. Use the technique from Problem 5 to find an irreducible polynomial of degree 3 in GF3[xl.
7. Find an element of order 26 in GF27 , using the irreducible polynomial from Problem 6. 8. Compute (2X2 + x from Problem 6.
+ 2)(x2 + 2) in GF27 , using the irreducible polynomial
9. Factor X 27  x over GF3 . 10. Do the following. (a) Construct the Cayley tables for GF3 . (b) Find all polynomials of degree 2 that are irreducible in G F3 [xl. (Hint: The only monic irreducible polynomials of degree 1 are x, x + 1 and x + 2, and reducible polynomials of degree 2 must be products of these.) (c) Factor x 9
x modulo 3 into irreducible factors in GF3 [xl.

11. Analyze the Galois field G F 9 • (a) Complete the following table for powers y3, ... , y8 where y Power y y2
Product x+1 (x + 1)( x + 1)
Expand x+1 x 2 + 2x + 1 Powers of y
modx 2 + 1 x+1 2x
= x + 1. mod 3 x+1 2x
(b) Create addition and multiplication tables using the representation of elements from the far right column in the preceding table, and the base 3 shorthand notation ax + b = (ab)3 (e.g., 2x + 0= 20). (c) Convert the tables to decimal (or hex). 12. Prove that x Pffi
9.6

x
I xpn 
x in Q [xl if and only if min.
The Multiplicative Group of GFpn
In Chapter 4, we looked at permutation ciphers. The permutations of the set {O, 1, ... , n  I}, with the product of two permutations being their composition, is called the symmetric group of degree n. (See Problem 2 at the end of this section.) In order to show that there are irreducible polynomials of every degree in GFp [x], we need some facts about a different kind of groupa commutative group. The general definition of a group is
CHAPTER 9. FINITE FIELDS
230
Definition 9.32 A group is a set G with one binary operation, often indicated simply by juxtaposition, such that
1. a(bc)
= (ab)c for all a, b, c in G
2. there is an element 1 in G such that a1
= 1a = a for all a in G
3. for each a in G, there is an element aI in G such that aa 1 = a 1a
= 1.
The group is commutative if
4. ab = ba for all a, b in G The group is cyclic if 5. there is an element g E G such that every element of G can be written as gm for some integer m, positive, negative, or zero. Here the convention is that gm = (gl) m and gO = 1. From the definition of a field (page 200) we see that the nonzero elements of a field F form a commutative group under multiplication. This group is called the multiplicative group of the field F, and is denoted F*. Let a be an element of a finite group G, and consider the list of positive powers of a As G is finite, this list must have duplicates, so there are positive integers j such that a j = a k . Multiplying both sides of this equation by (a 1)j gives
so there is a positive integer t = k  j such that at = 1. The smallest such positive integer is called the order of a, and is denoted 0 (a). Note that the list of positive powers of a repeats after ao(a) = 1, that is, it looks like
a, a2 ,a3 , ... , ao(a)1 "1 a, a2 ,a3 , ... , ao(a)1 " 1 a, a 2 , ... From this it is clear that an = 1 exactly when o(a) divides n. This is a very useful fact. The subset (a) = {a, a 2 , a3 , ... , ao(a)I, I} of G is itself a group (see Problem 4). A subset of G that is also a group is called a subgroup. If G is a finite group, the number of elements of G is called the order of G, denoted 0 (G). Note that o(a) = o ((a)), so the two uses of the word "order" are consistent. Let S be a subgroup of a finite group G. For each element a E G, the set as = {as I s E S} has the same number of elements as S. Moreover, if a, bEG, then as and bS are either disjoint or equal. To see this, suppose that as and bS have an element c in common. Then c = as = bt for some s, t E S. From a = bts 1 we get as ~ bS, and from b = asCI we get bS ~ as, so as = bS.
r'9.6.
i~:Thus
THE MULTIPLICATIVE GROUP OF GFpn
either as n b8 = 0 or a8 ~. of the distinct sets a8. Then
= b8.
231
Let a 1 8, a28, ... , a m 8 be a complete list
because every element a of G is in the set a8, which must be equal to one of the sets in the list. Thus 0 (G) = 0 (8) x m, so 0 (8) divides 0 (G). We have just proved
Theorem 9.33 (Lagrange's Theorem) If 8 is a subgroup of the finite group G, then the order of 8 divides the order of G. In particular, if 8
= (a), then we get
Theorem 9.34 If a is an element of a finite group G, the order of a divides the order of G. Let F be a field of order m = pn. Then the multiplicative group F* of F has m  1 elements, so the order of each element of F* divides m  1. Thus each of the m  1 elements in F* is a root of the polynomial xm  1 from which we can conclude that
xm 
l

1=
n (x  ri)
ml iI
where rl, r2, ... , r ml are all the elements of F*. More generally, if n divides m  1, then xn  1 has exactly n roots in F. Why is that? That's because if n divides m 1, then the polynomial xn 1 divides the polynomial x m  l 1 (see Problem 7) so xn  1 is a product of factors x  ri where i ranges over some subset of {I, 2, ... , m I}. So F* is a finite commutative group, and for each divisor n of the order of F*, there are exactly n solutions in F* to the equation xn = 1. We want to show that such a group is cyclic.
Theorem 9.35 If G is a finite commutative group, and for each divisor n of the order of G, there are exactly n solutions in G to the equation xn = 1, then G is cyclic. Proof. We first show that the theorem is true if the order of G is a prime power, say pk. It suffices to show there is an element in G of order pk. As the order of any element of G divides pk, if an element a in G does not have order pk, then 1 1 apk  = 1. But there are at most pkl solutions to the equation X Pk  = 1, and there are pk elements of G, so some element of G must have order pk. Now suppose that pk divides the order of G. The equation Xpk = 1 has exactly pk solutions in G and these pk solutions clearly form a group H because if we multiply two of them, we get another one. Moreover, for each divisor n of pk there are exactly n solutions in G to the equation xn = 1, and these solutions lie in H. But we proved the theorem for groups of order a power of a prime, so H is cyclic.
232
CHAPTER 9. FINITE FIELDS
Finally, write the order of G as a product of prime powers p7 i for distinct primes Pi. We have just seen that there is an element ai in G of order p7 i for each i. The product of these elements will have order equal to the product of the numbers p7 i which is the order of G. Why is that? It suffices to show that if a is an element of order c and j3 is an element of order d, and c and d are relatively prime, then 0 (aj3) = cd. For that, see Problem 5. • In particular, the multiplicative group of a finite field is cyclic: there is an element w such that every nonzero element in the field can be written in the form wk.
Definition 9.36 A generator of the multiplicative group of GFpn is called a primitive element. A polynomial of degree n over GF (p) is a primitive polynomial if it is the minimum polynomial of a primitive element in GFpn.
You have seen many examples of the following lemma. Lemma 9.37 The minimal polynomial of an element of GFpn is irreducible. Proof. Let 8 E G Fpn, and let me (x) be its minimal polynomialthat is, me (x) is the monic polynomial of smallest degree with coefficients in G Fp such that me (8) = 0. Suppose me (x) = a (x) b (x) for some a (x) ,b (x) E Fp [xl. Then me (8) = a (8) b (8) = implies that either a (8) = or b (8) = 0. If a (8) = 0, 8 (x) must have degree equal to the degree of me (x), since me (x) is the minimal polynomial of 8. Thus b (x) has degree 0, that is, it is a constant. Similarly, if b (8) = then a (x) is a constant. Thus me (x) is irreducible. •
°
°
°
We now show that the minimal polynomial over G Fp of any primitive element of GFpn is an irreducible polynomial of degree n. Theorem 9.38 Let p be a prime and n a positive integer. monic irreducible polynomial in GFp [xl of degree n.
Then there is a
Proof. Let w be a primitive element of GFpn, and let f (x) be its minimal polynomial over GFp • From a previous lemma, we know that f (x) is irreducible. We want to show that f (x) has degree n. Let m = deg f (x). The set of elements g (w), where g (x) ranges over polynomials with coefficients in GFp, forms a field F containing w. As w is a primitive element of GFpn, the field F must be all of GFpn. But the order of F is pm, sb m=n. •
Thus Kronecker's construction will construct GFpn for every prime p and positive integer n. We want to show that any two finite fields of order pn are essentially the same. We do this by showing Theorem 9.39 If f (x) is an irreducible polynomial of degree n over GFp, then f (x) divides xpn  x.
~>9.6.
THE MULTIPLICATIVE GROUP OF GFpn
233
··Proof. By Kronecker's construction, there is a field of order pn that contains . an element 8 such that f (8) = O. As f (x) is irreducible, it is the minimal pn polynomial of 8. As 8  8 = 0, the polynomial f (x) must divide xpn  x. • Now suppose K is any finite field of order pn, and let f (x) be a fixed irreducible polynomial of degree n over GFp . We know that K consists exactly of the roots of xpn  x and that f (x) divides xpn  x. So there is an element 8 of K whose minimal polynomial is f (x). Therefore GFp [8] has order pn, hence is equal to K. But GFp [8] can be thought of as Kronecker's construction from f (x) and GFp . Example 9.40 To construct GF49 , we need an irreducible polynomial of degree 2 in GF7 [x]. We will show that x 2 + 2 has no roots in GF7 and is therefore irreducible. We will also find a primitive root in GF49 . Define 9 (x) = x 2 + 2. Then 9 (0) = 2 9 (1) = 3 9 (2) = 6 9 (3) = 4 g(4)=4 9 (5) = 6 9 (6) = 3
As none of these values is zero, x 2 + 2 is irreducible over G F 7 . To find a primitive root, recall that the order of an element of GF49 must be a divisor of 48. The divisors of 48 are 1,2,3,4,6,8,12,16,24,48 First try the element 8 = [x] which has the property that 82 = 2. Then 84 = 4, and 812 = 43 = 64 = 1, so 8 has order at most 12. Undaunted, we go on and
= 8 + l.
try the element (3
f
= 82 + 28 + 1 = 28  1 = 2(3  3
(32
(8 + 1
(34
((32)2
(38
((34)2 = (3(3  3)2 = 2(32  4(3 + 2 = 2 (2(3  3)  4(3 + 2 = 4
= (2(3 
3)2 = 4(32  5(3 + 2 = 4 (2(3  3)  5(3 + 2 = 3(3  3
(316
((38) 2 = (_4)2
=2
(324
(38(316 = (4)2 =1
So (3 has order 48 in GF49 • That's because neither (316 nor (324 is equal to 1, but every proper divisor of 48 divides either 16 or 24. So (3 is a primitive element. The polynomial x 49 x factors over G F7 into a 28term product of irreducible polynomials: X
49

X
+ 1) (x + 2) (x + 3) (x + 4) (x + 5) (x + 6) 2 · (x + 1) (x 2 + 2) (x + 4) (x 2 + 5x + 3) (x 2 + 5x + 2) 2 2 2 2 · (x + 2x + 3) (x + 6x + 3) (x + 6x + 6) (x + 4x + 1) 2 2 2 2 · (x + 3x + 5) (x + 2x + 2) (x + 3x + 1) (x + X + 6) · (x 2 + X + 4) (x 2 + 4x + 5) (x 2 + X + 3) (x 2 + 3x + 6) 2 2 2 · (x 2 + 2x + 5) (x + 5x + 5) (x + 6x + 4) (x + 4x + 6) =X
(x
2
CHAPTER 9. FINITE FIELDS
234
The order of every nonzero element of G F49 divides 48 and so is a root of x 48 1. So every element of GF49 is a root of one of the irreducible polynomials listed in the above factorization of X 49  x. The irreducible polynomial satisfied by an element 'Y in GF49 is called the minimal polynomial of 'Y. Different irreducible polynomials of degree n result in addition and multiplication tables that look slightly different, but you can always relabel the elements to make the tables look exactly the same.
Problems 9.6 1. Verify that in the field GF13 , there are exactly 'P (d) elements of order d
for each divisor d of 12. 2. Show that the set of permutations of the set Zn together with the product aT obtained by first applying a, then applying T, is a (noncommutative) group. (See page 76.) 3. Let a be an element of a Group G. Show that the set
(a) = {an I n is an integer} is a subgroup of G. 4. Let a be an element of a finite group G. Show that the set 2 3 , ... ,ao(a)l} (a) _{1 ,a,a,a
is a subgroup of G. 5. Let a, b be elements of a finite group G. (a) If an
=
1, show that
(b) If 0 (a) and
0
0
(a)
In.
(b) are relatively prime and ab = ba, show that 0 (ab) =
o(a)o(b). 6. Verify that in the field GF17 , there are exactly 'P (d) elements of order d for each divisor d of 16. 7. Show that if n divides m1, then the polynomial xn 1 divides xml_1. 8. Show that x 20

1 divides x 100

1.
9. Find a primitive element of G F 31 . 10. Find a primitive element of GF27 in terms of a root polynomial x 3  x  1.
e of the irreducible
,', i
9.7. RANDOM NUMBER GENERATORS
9.7
235
Random Number Generators
In this section we will see how the field GFp gives a way to generate random number sequences, or at least sequences that look like random number sequences. To get a feel for a random number sequence, consider the following experiment. An icosahedron (see Figure 9.1) is a Platonic solid with 20 faces, each an equilateral triangle.
Figure 9.1
Icosahedron
Label the faces with the digits 0,1,2, ... , 9 in such a way that opposite faces share the same label. Our intuition tells us that if we roll such an icosahedron 100 times and record the sequence of digits on the top face, then the resulting sequence should be random. The digits 2 6 4 6 5 8 3 7 8 9 1 7 5 6 9 1 9 2 8 8
5 9 0 2 6 1 9 7 4 2 3 4 0 0 5 8 7 5 8 1 8 5 8 4 1 3 9 4 6 6
1 7 5 0 8 0 5 6 4 4
5 3 9 4 0 3 9 3 8 5 2 5 7 0 8 2 4 0 4 2
3 8 6 7 6 1 4 4 1 5 6 0 1 6 8 1 6 0 5 7
were generated in this manner, with the first digit in the upper left corner and going from left to right, one row at a time.
CHAPTER 9. FINITE FIELDS
236 The histogram
Digit 0 1 2 3 4 5 6 7 8 9
Frequency (10) (10) (7) (7) (12) (13) (12) (8) (13) (8)
shows how often each digit appears. We would expect longer sequences to be more evenly balanced. The law of large numbers says that the frequency of each digit should approach 10% (under ideal conditions such as that the icosahedron is perfectly cut and balanced). Furthermore, each twodigit pair (such as a 5 followed by a 7) should appear roughly 1% of the time. We could make similar statements for strings of length three, four, five, and so forth. Here is another method for generating a sequence of 100 digits. Consider the prime p = 101. The matrix
26 55 27 61 63 75 46 74 40 38
70 2 16 12 96 72 71 28 22 67 31 99 85 89 5 29 30 73 79 34
52 9 54 21 25 49 92 47 80 76
39 32 91 41 44 62 69 10 60 57
4 24 43 56 33 97 77 58 45 68
3 18 7 42 50 98 83 94 59 51
78 8 64 48 81 86 82 11 88 66 23 93 37 53 20 15 19 90 13 35
6 36 14 84 100 95 65 87 17 1
is composed of the powers of 26 modulo 101. Since all of the entries are distinct, we know that 26 is a primitive element of G F 1Ol . Each new entry is constructed by multiplying the previous entry by 26 and reducing the result modulo 101.
7. RANDOM NUMBER GENERATORS
237
Reduce these numbers modulo 10 to get the digits 6 5 7 1 3 5 6 4 0 8
0 6 6 1 2 1 5 5 0 9
2 2 2 8 7 9 9 9 3 4
2 9 4 1 5 9 2 7 0 6
9 2 1 1 4 2 9 0 0 7
4 4 3 6 3 7 7 8 5 8
3 8 7 2 0 8 3 4 9 1
8 4 1 2 8 3 7 0 9 3
8 8 6 1 6 3 3 5 0 5
6 6 4 4 0 5 5 7 7 1
It turns out that "random" is a difficult term to define precisely. However, here are two criteria that might be used to describe a random sequence of digits: 1. There is no obvious pattern. 2. Each digit should appear about onetenth of the time. The sequence {6, 0, 2, 2, 9, 4, 3, 8, 8, 6, ...} of 100 digits from the previous example satisfies the first criterion fairly well and satisfies the second exactly. We can also use a seed to change the starting point. Using the seed 53, we multiply 26 by 53 and reduce modulo 101 to get the starting entry 65. Each new entry can then be generated by multiplying the previous entry by 26 and reducing the result modulo 101. This results in the numbers 65 87 17 1 6 36 14 84 100 95
74 40 38 26 55 27 61 63 75 46
5 30 79 70 16 96 71
22 31 85
29 47 73 80 34 76 2 52 12 9 72 54 28 21 67 25 99 49 89 92
10 58 60 45 57 68 39 4 32 24 91 43 41 56 44 33 62 97 69 77
94 59 51 3 18 7 42 50 98 83
20 15 19 90 13 35 78 8 64 48 81 86 82 11 88 66 23 93 37 53
If we try to extend this sequence, the next number is 26 . 53 mod 101 = 65, which is a repeat of the first number in the sequence. The cycle length of this sequence is 100: the sequence repeats after every 100 iterations. This is an example of a pseudorand.om number generator. Good pseudorandom number generators have long cycles. In order to get long cycle lengths, start with the largest ndigit prime p and find a primitive element in GFp • Convenient primes include 9999999967, 99 999999977, and 999999999989.
CHAPTER 9. FINITE FIELDS
238
To show that 84906326 is a primitive element of G F999 999 999 989, we could decide to examine the first 999 999 999 988 powers to see if they are all distinct (as we did previously to show that 26 was a primitive element of G F101 ). However, there is an easier way. Factorization yields 999999999988 = 2211 x 124847 x 182041 To show that 84906326 is primitive, it is enough to show that 84906326999999999 988/p
mod 999 999 999 989 =f=. 1
for each prime p that divides 999999999988 = 2211 x 124847 x 182041. Indeed, we see that 84906326999999999988/2 mod 999 999 999 989 = 999999999988 84906326999999999988/11 mod 999 999 999 989 = 744525462020 84906326999999999988/124847 mod 999 999 999 989 = 498590406481 84906326999999999988/182041 mod 999999999989 = 958213467498 Thus 84906 326 is a primitive element of G F999 999 999 989. A seed can be generated manually or using an internal function such as a clock. Starting with the seed 1973647 and primitive element 84906326, we get the sequence 1973647 . 84906326 mod 999999999989 = 575 115 592 759 575115592759·84906326 mod 999 999 999989 = 7016033906 7016033 906 . 84 906 326 mod 999 999 999 989 = 662 056 442 111 The cycle length is 999999999988. Every integer n in the range 1 ::; n ::; 999 999999988 will appear exactly once before the entire sequence repeats. (The only 12digit integers that do not appear are the eleven integers 999999999989, 999999999990, ... , 999 999 999 999.) Several computer algebra systems use primitive elements modulo a large prime to generate pseudorandom number sequences.
Problems 9.7 1. Let p be the largest threedigit prime. Show that 525 is a primitive element of GFp • Use the seed 789 to generate the first 10 terms of a pseudorandom number sequence. 2. Show that if a is a primitive element in GFp , then so is a k for any integer k such that k .l p  1. 3. In this section, we showed that 84906326 is a primitive element of GFp , where p = 999999999989. What is the average gap between primitive elements? (How hard is it actually to find a primitive element?)
"9.7. RANDOM NUMBER GENERATORS
239
4. A total of n darts are thrown at a rectangular grid with k small rectangles of equal size. (Each dart hits the grid somewhere; each rectangle has an equal chance of being hit.) Calculate the expected number of untouched small rectangles. 5. An unfinished window composed of a 4 x 4 grid of small square pieces of glass was left lying horizontally in the path of a hail storm, where 16 hail stones land inside the grid and break some of the glass squares. What is the expected number of unbroken squares? Use a pseudorandom number generator to simulate this problem with 1000 repetitions. What is the average number of unbroken squares? What was the smallest number of unbroken squares? The largest number of unbroken squares? 6. Six distinct baseball cards are distributed randomly, one per box of cereal. You must have all six. Use a random number generator to write a computer simulation to determine how many boxes you should expect to purchase before your collection is complete. What is the average if you do 10000 simulations? What is the largest number of boxes required? What is the smallest number of boxes required? 7. Write a computer simulation to estimate the volume of a sphere of radius 1. The volume of a cube of edge 2 is 23 = 8. By symmetry, generate points (x, y, z) where each coordinate is between 0 and 1 and test to see if x 2 + y2 + z2 :::; 1. Multiply the ratio of points inside to the total number of points by 8 to approximate the volume of a sphere. Compare your approximation with the exact value 47r /3 ~ 4. 188790205. 8. Write a computer simulation to estimate the volume of a fourdimensional sphere of radius 1. The volume of a fourdimensional cube of edge 2 is 24 = 16. By symmetry, generate points (w,x,y,z) where each coordinate is between 0 and 1 and test to see if w 2 + x 2 + y2 + Z2 :::; 1. Multiply the ratio of points inside to the total number of points by 16 to approximate the volume of a fourdimensional sphere. 9. Write a computer simulation to estimate the expected length of an interval assuming the endpoints are chosen uniformly in the unit interval. 10. Write a computer simulation to estimate the expected area of a rectangle with sides parallel to the coordinate axes inside the unit square. 11. Write a computer simulation to estimate the expected area of a square with sides parallel to the coordinate axes inside the unit square. 12. Write a computer simulation to estimate the expected area of a square (possibly rotated) chosen at random inside the unit square.
Chapter 10
ErrorCorrecting Codes In this chapter we will develop codes that will correct multiple errors. Codes based on polynomial multiplication were developed independently by R. C. Bose and RayChaudhuri (1960) and Hocquenghem (1959). They are known as BCH codes. A ReedSolomon code is a particular type of BCH code that has many applications. The onedimensional bar codes listed in Chapter 5 use a lot of space for the amount of information they contain. A number of twodimensional bar codes have more recently been developed to pack more information into small spaces. Typically, these codes use aggressive errorcorrection algorithms such as Hamming (page 120), BCH (page 242), and ReedSolomon (page 258).1 Datastrip code appeared as Softstrip in early personal computer magazines as a method for downloading simple computer programs.
Figure 10.1
Datastrip code
Data density can range between 20 and 150 bytes per square centimeter, depending on the printing technology used to produce the strips. Parity bits on each line are used for error correction. MaxiCode was developed by United Parcel Service in 1992 in order to provide more information on its packages. lSee http://www.adamsl.com/pub/russadam/stack.html for a description of additional twodimensional bar codes.
241
242
CHAPTER 10. ERRORCORRECTING CODES
Figure 10.2
MaxiCode
A oneinch square symbol can contain approximately 100 ASCII characters. Errorcorrection symbologies are sufficient to recover information on a symbol with damage on 25% of its surface area. PDF 417 (Portable Data File) is a stacked symbology that is in the public domain (see Figure 10.3).2
Figure 10.3
PDF 417
Error correction and detection can be set at various levels. The ReedSolomon errorcorrection algorithm uses the fact that 3 is a primitive root of 1 modulo the prime 929. An important application of PDF 417 is its use as a substitute for stamps on letters and packages (see Figure 10.4).
US POSTAGE
DEVICE 12345678901234
Figure lOA
10.1
PC postage
BCH Codes
In a polynomial code, we identify a word with a polynomial a(x), then multiply by a fixed polynomial g(x) to get the codeword g(x)a(x). The polynomial g(x) is called the generator polynomial. For example, if the word is a binary word (a r , arl, ... , a2, aI, ao), we form the polynomial
a(x) = arx r + ar_lX r 1 + ... + a2x 2 + alX + aO 2See http://www.linux.org/apps/ Appld_2658.html for a free PDF 417 generator.
F'10.1. BCH CODES
243
in GF2[X]. The corresponding codeword polynomial is
a(x)g(x) mod 2 = 2::Cixi Ifdegg(x) = s, then the codeword is the word (Cn,Cn l, ... ,C2,Cl,CO), where n = r + s. A particularly efficient class of polynomial codes are the BCH codes. Here is how to construct a generator polynomial for a BCH code over G Fp that corrects at least t errors. See the reference [23, Theorem 75] for a proof.
e be a primitive elbe the minimal polynomial of ri over G Fp for i =
Theorem 10.1 (Bose Chaudhuri Hocquenghem) Let
ement in G Fpn, let 1,2, ... ,2t, and set
mi (x)
g(x) = lcm [ml (x), m2(x), ... ,m2t(x)]. If degg (x) = k, then for any polynomial a(x) of degree at most pn  k  2, the weight of the codeword a(x)g(x) is at least d = 2t + 1, so at least t errors can
be corrected. Example 10.2 We will use GF16 to construct a code that will correct double errors. Let q(x) = x4 + X + 1, and let a be a root of q(x). Thus a 4 + a + 1 = O. Since
a 3 ,#1
a5 = a
+ a 2 ,#1
a 15 = 1
it follows that 0 (a) = 15 and hence a is a primitive element of GF16 . We have that ml (x) = q(x) = x4 + X + 1. Notice that in GF2 we have (a + b)2 = a2 + 2ab + b2 = a2 + b2. From this it follows that
(al
+ a2 + ... + an )2 = ai + a~ + ... + a~
In particular, 0= 02 = (a 4 + a + 1)2 = (a 4)2 + a 2 + 1 = (a 2)4 + a 2 + 1 'and hence ml(a 2) = 0, which means that m2(x) = ml(x). Similarly, ml(a 4) = o and hence m4(x) = ml(x). In fact, ml(x) = m2(x) = m4(x) = m8(x). To calculate m3(x), we use again the observation that g((3) = 0 implies g((32) = O. It follows that the zeros of m3(x) are a 3, a 6, a 12 , and a 24 = a 9 (because a 15 = 1). Thus, m3(x) = (x  ( 3)(x  ( 6 )(x  ( 9 )(x _ ( 12 )
= X4 + (a 3 + a 6 + a 9 + ( 12 )x 3 + (a 9 + a 12 + 1 + 1 + a 3 + ( 6 )x2
+ (a 3 + a 6 + a 9 + ( 12 )x + 1 = x4 + (a 3 + a 6 + a 9 + ( 12 )x3 + (a 3 + a 6 + a 9 + ( 12 )x 2 + (a 3 + a 6 + a 9 + ( 12 )x + 1
CHAPTER 10. ERRORCORRECTING CODES
244
Calculating, we have
a 3 + a 6 + a 9 + a l2 = a 3 + (a 3 + a 2) + (a 3 + a)
+ (a 3 + a 2 + a + 1)
=1
and hence It follows that
g(x) = lcm (ml(x), m2(x), m3(x), m4(x)) = (x 4 + X + 1)(x4 + x 3 + x 2 + X + 1) mod 2
= x 8 + X7 + x 6 + X4 + 1 Since g(x) has degree 8, it follows that plaintext polynomials can have degree at most 6. In particular, if
then a(x)
= x 6 + x4 + x 3 + 1 and a(x)g(x) =
xl4
+ x l3 + XID + x 9 + x 3 + 1
and hence the codeword is transmitted as
(1,1,0,0,1,1,0,0,0,0,0,1,0,0,1)2 Example 10.3 With a bit more effort we can construct a threeerrorcorrecting code. We proceed as in the previous example, but add in the polynomial m5(x). To compute m5(x), we note that if a 5 is a root of m5(x), then so is alD. Since a 2D = a 5 (why?) we can stop there and write
m5(x) = (x  a 5)(x  aID) 2 5 = x + (a + alO)x + 1
= x 2 +x + 1 The last equality holds because
a 5 + aID mod 2 = (a 2 + a) + (a 2 + a
+ 1) mod 2 = 1
Thus,
g(x) = lcm (ml (x), m2(x), m3(x), m4(x), m5(x), m6(x)) 2 4 3 2 = (x + X + 1)(x4 + x + x + X + 1)(x + X + 1) = x lO
+ x 8 + x 5 + X4 + x 2 + X + 1
y:;.;
10.1. BCH CODES
245
The downside of this example is that the plaintext polynomial must be of degree at most 4, so although triple error correction is possible, the code carries with it a lot of overhead. We are always on the lookout for codes that require only a few extra check bits but that correct a high rate of errors. In order to get an improvement of the information rate, we need to work with larger fields. Example 10.4 We will construct a fourerrorcorrecting code, using the field GF64 . To construct GF64 , we need an irreducible polynomial of degree 6 in GFdx]. The naive guess is q(x) = x 6 + X + 1. If we take a to be a root of q(x), then a has order 63 since
+a +1= a2 +a a 21 mod a 6 + a + 1 = a 5 + a 4 + a 3 + a + 1 a 63 mod a 6 + a + 1 = 1 = x 6 + X + 1 is indeed irreducible since a is a 7 moda 6
and hence q(x) have m1(x) = m2(x) = m4(x) polynomial of a 3 is given by
= ms(x) = m16(x)
primitive. We
= m32(x). The minimal
m3(x) = (x  ( 3)(x _ ( 6)(x _ ( 12 )(x _ ( 24 )(x _ a 4S )(x _ ( 33 ) since a 63 = 1. Note that (m3 (x) mod q (a)) mod 2 = (9206x  123182x 2 + 584160  37032x3 + 3790x4  46x 5) a 5 + (309 296x + 395 780  2628x 3  200 706x 2 + 3716x4  66x 5) a 4
+ (60x 5 + 2220x4 + 41944x3  223 310x2  596 584x + 7800) a 3 + (487004  735 524x  167640x 2 + 82 738x 3  518x4  32x 5) mod 2 6 2 = x + x4 + x + X + 1 Similarly, we compute m5(x), and
(x) as m5(x) = (x  ( 5)(x  a 10 )(x _ a 20 )(x _ a 40 )(x _ ( 17 )(x _ ( 34 ) = x6 + x5 + x2 + X + 1 m7(x) = (x  a7 )(x  a 14 )(x  a2S )(x  a56 )(x _ a49 )(x _ a35 ) =
x 6 +x 3
m7
+1
Then
g(x) = lcm [m1(x), m2(x), m3(x), m4(x), m5(x), m6(x), m7(x), ms(x)] = m1(x)m3(x)m5(x)m7(x) = (x 6 + X + 1)(x6 + X4 + x 2 + X + 1) . (x 6 + x 5 + x 2 + X + 1)(x 6 + x 3 + 1) = x24 + x 23 + x 22 + x 20 + x 19 + x 17 + x 16
+ X I3 + x lO + x 9 + X S + x 6 + x 5 + X4 + x 2 + X + 1
CHAPTER 10. ERRORCORRECTING CODES
246
This is a large polynomial, but the plaintext polynomials can also be large. In this case, allowable plaintext can be of degree 62  24 = 38. In calculating minimal polynomials, we used the fact that
for a and b in G F2 n. A similar equation holds for G Fpn . Theorem 10.5 If a and b are elements of GFpn then
(a + bt = aP + bP Proof. Expanding (a + bt gives
For 1
~
k
~
p  1, the binomial coefficient is p) p! ( k = k!(pk)!
which is an integer multiple of p, so
(~) modp = 0 Thus
• The theorem (a + b)P = aP + bP can be used to prove, by induction on k, that (al + a2 + ... + akt = af + a~ + ... + a~ An interesting consequence of this theorem is that every element of G Fpn is a pth power. To see this, note that if aP = bP, then (a  b)P = aP  bP = 0, so a  b = 0 as GFpn is a field. That is, raising to the pth power is a onetoone map from GFpn to itself. As GFpn is finite, the map must also be onto, that is, every element of GFpn has a unique pth root. Finally we observe that if a is in G Fpn, then a is in G Fp if and only if aP = a. That is, the elements of G Fp are exactly the fixed points of the map taking a to aP. That aP = a for a in GFp is Fermat's little theorem. Conversely, if aP = a, then aP  a = O. But the equation x P  x = 0 has at most p distinct solutions, and we already know that the p elements of GFp satisfy it.
10.1. BCH CODES
247
Example 10.6 The polynomial q (x) = x 3 {O, 1, 2, 3, 4} because
q(O)mod5 = 1 q(3) mod 5 = 1
+ X + 1 is
q(1)mod5 = 3 q(4) mod 5 = 4
irreducible over GF5
q(2)mod5
=
=1
so q (x) has no root in G F5. Let 0 be a root of q (x) in G F53 . The minimal polynomial of 02 is
Note that 0250
= 02 since 053  1 = 0 124 = 1.
If (3 in GFpn is a root of an irreducible polynomial m (x) in GFp [x], then
... + C1X + Co
= xk + Ck_1Xk1 +
0= m(O)P = ((3k
+ ck_1(3k1 + ... + C1(3 + Cor
r
+ q1
r
+ ... + cf ((3y + (coy = (3pk + ck_1(3P(k1) + ... + C1(3P + Co = ((3p)k + Ck1 ((3p)k1 + ... + C1(3P + Co = ((3k
((3k1
since aP = a for a in GFp by Fermat's little theorem. Thus (3P is also a root of m (x). Repeating this argument we see that ((3P)P = (3p2 is also a root of m (x), 3 4 and similarly (3P , (3P , and so on are roots of m (x). As GFpn is finite, there h
i
must be a positive integer h so that (3P = (3P for some i < h. Let h be the h 1 first time that happens. Then (3, (32, ... ,(3p  are all distinct, so, in particular, h h::; k. As raising to the pth power is a onetoone map, we must have (3P = (3. Now consider the polynomial
which has degree k. Raising to the pth power permutes the elements (3, (32, ... , hl (3P , so
That means that every coefficient of 9 (x) is its own pth power, hence lies in GFp. So 9 (x) is in GFp [xl and 9 ((3) = O. Therefore 9 (x) is divisible by m (x). But h ::; k, that is, degg (x) ::; degm (x). Therefore 9 (x) = m (x) so h = k and we can write m (x) as
CHAPTER 10. ERRORCORRECTING CODES
248
Problems 10.1 1. Show that x 3
+ x + 1 is irreducible over GF2 .
+ x + 1 in GFs . Construct the minimal polynomial
2. Let a be a root of x 3 of a 3 .
3. Use the polynomial x 3 + x + 1 to construct a BCH code that corrects a single error. List all of the plaintext and codeword polynomials and observe that the minimum distance between codewords is three.
4. Show that x 2
+ 1 is irreducible over G F 3 .
5. Let a be a root of x 2 a+1.
+ 1 in
GFg • Construct the minimal polynomial of
6. Show that X4 + x 3 + 1 is irreducible over G F2 by showing that if a is a root of x4 + x 3 + 1, then the order of a is 15.
7. Let () be a root of x4 + x 3 + 1 in G F 16 . Construct the minimal polynomial of ()3 + ()2. 8. Show that x 5 + x 3 + X + 1 is irreducible over GF3 by showing that if () is a root of x 5 + x 3 + X + 1, then the smallest field containing () has at least 35 = 243 elements. g. Let () be a root of x 5 + x 3 + X polynomial of ()4 + 2(). 10. Show that x 2

+ 1 in the field GF 3
5.
Construct the minimal
2 is irreducible over GF5 .
11. Let () be a root of x 2  2 in the field G F52 = G F 25 . Construct the minimal polynomial of 3() + 2.
12. From the equation (a the equation (al + a2 13. From the equation (a aP  bP.
+ by = aP + bP in GFpn (see Theorem 10.5), derive + ... + akY = af + a~ + ... + a); by induction on k.
+ b)P = aP+bPin G Fpn, derive the equation (a 
b)P =
14. The code that encodes a word of length 5 by repeating it three times is a (15,5) polynomial code. What is its generator polynomial? 15. The triplerepetition code (see page 102) is not a polynomial code but can be described as encoding the polynomial p (x) by the polynomial (1 + x + x 2) P (x 3). Verify both parts of this statement.
10.2. A BCH DECODER
10.2
249
A BCH Decoder
Consider a terror correcting BCH code. A cumbersome way to decode is to calculate all the codewords c(x) = a(x)g(x) and for each codeword c(x), calculate c(x) + e(x) for all possible error polynomials, where each e(x) has at most t nonzero terms. This produces a large table, and we search until we locate c(x) + e(x) in the table, and convert this to c(x). Polynomial division by g(x) then yields a(x), or we may simply include a(x) in the table. The following example gives an alternative method for correcting a single error. E:x:ample 10.7 Consider the doubleerror correcting BCH code described in Example 10.2. The irreducible polynomial q (x) = X4 + X + 1 with root 0 yields the generator polynomial g(x) = x 8 + x 7 + x 6 + X4 + 1. Suppose that a single error occurs so that the error polynomial is e( x) = xk, and consider
c(x) + xk = X14 + x 13 + X12 + x 10 + x 6 + x4 + x 3 + x 2 + 1 Since c(O) = 0, we can evaluate the polynomial c(x)
+ xk
at 0 to get
Ok = (0 14 + 013 + 012 + OlD + 06 + 04 + 03 + 02 + 1 modq (0)) mod 2 = 03 +0 2 +0 The challenge is to figure out k. But knowing Ok is enough to determine k. In this case,
3 2 11 0 +0 +0 = 0
so k
= 11.
We correct the polynomial c(x) by adding xl! to get
c(x) = X14 + X13 + x 12 + x 11 + x 10 + x 6 + X4 + x 3 + x 2 + 1 Dividing by g(x) = x 8 + x 7 + x 6 + X4 c (x) 9 (x)
+ 1,
we get
= x6 + x3 + x2 + 1
Example 10.8 The case where e (x) = x j that
+ xk
is more challenging. Suppose
r(x) = c(x) +e(x) = X14 + xl! + x 10 + x 5 + X + 1 where e (x)
= x j + xk
for some (unknown) integers j and k. We figure out j and k by computing the polynomial
250
CHAPTER 10. ERRORCORRECTING CODES
where
r(e) = ej +e k
+ e (x) at powers of e yields j k e + e = r (e) 4 14 5 = (e + ell + elO + e + e + 1 mod e + e + 1) mod 2 = 1 +e 2 (e 2)j + (e 2)k = r (e 2) = (e 28 + e22 + e20 + elO + e2+ 1 mod e4+ e+ 1) mod 2
Evaluating r (x) = c (x)
=e (e 3)j + (e 3)k = r (e 3) = (e 42 + e33 + e30 + e15 + e3+ 1 mod e4+ e+ 1) mod 2 3 2 = e +e + e (e 4)j + (e 4)k = r (e 4) = (e 56 + e44 + e40 + e20 + e4+ 1 mod e4+ e+ 1) mod 2 = e2 We rewrite these equations as
ej + ek = 1 + e2 e2j + e2k = e e3j + e3k = e3+ e2+ e e4j + e4k = e2 Notice that
j j 2j 3j (e + ek) eHk + (e + e2k ) (e + ek) = e + e3k j 4j 2j 3j (e + e2k ) eHk + (e + e3k ) (e + ek) = e + e4k This system can be rewritten as a matrix equation
k 2j 2k ej + e2k e3j + e3k ) ( jej+k k ) 2j ( e +e e +e e +e
=
3j 3k (e 4j + e4k ) e +e
and substitution yields
Since form
e4+ e+ 1 =
0 and
e15
= 1, the matrix equation can be rewritten in the
10.2. A BCH DECODER
251
The augmented matrix
( e; elle ell e2
)
can be reduced using elementary row operations:
e ell ( e; ell e2
R 1 ·e 7
)
;
R2·e 1 R2R 1 ;
;
R2·e 1
(~ (~
e108 e
(~
e8 1
) e e )
(~
0 1
ee8
Rle B R2 ;
~)
e8 e3 e e9 3
8
9
)
Thus ej+k
= e9
ej + ek = e8 Setting a
= ej
ek we search the table
and b =
a 1
b
e9 e8 e7 e6 e5
e e2 e3 e4 and observe that e (x) = X4 C (x)
+ x 5.
= X14
ab
e9 e9 e9 e9 e9
a+b
e107 e e212 e e8
Thus
+ Xll + x 10 + X4 + X + 1
and long division yields
X14
+ Xll + x 10 + X + 1 + X4 8
7
6
4
x +x +x +x +1
mod 2
= x6

x
5
+ 2x 3 
2X2
+ X + 1 mod 2
The singleerrorcorrecting BCH code described in Problem 10.3 uses the codeword x 3 + x + 1 and message words a (x) of degree at most 3 over G F 2. In Table 10.1 a polynomial of the form b6X 6 + b5X 5 + b4x 4 + b3X3 + b2x2 + b1x + bo has been converted to the vector b6b5b4b3b2b1bo. A message with a single error
252
CHAPTER 10. ERRORCORRECTING CODES
e (x) = bixi can be corrected by locating the received message in Table 10.la or 1O.1b and recovering a (x) in the first column of that row.
a (x) a(x)g(x) 0000 0000000 0001 0001011 0010 0010101 0011 0011101 0100 0101100 0101 0100111 0110 0111010 0111 0110001 1011000 1000 1001 1010011 1010 1001110 1011 1000101 1100 1110100 1101 1111111 1110 1100010 1111 1101001 Table IO.la
0000001 0000010 0000100 0001000 0001010 0001001 0001111 0000011 0010100 0010111 0010001 0011101 0011100 0011111 0011001 0010101 0101101 0101110 0101000 0100100 0100110 0100101 0100011 0101111 0111011 0111000 0111110 0110010 0110000 0110011 0110101 0111001 1011001 1011010 1011100 1010000 1010010 1010001 1010111 1011011 1001111 1001100 1001010 1000110 1000100 1000111 1000001 1001101 1110101 1110110 1110000 1111100 1111110 1111101 1111011 1110111 1100011 1100000 1100110 1101010 1101000 1101011 1101101 1100001 Using a table for singleerror correction
a (x) a(x)g(x) 0010000 0100000 1000000 0000000 0000 0011011 0101011 0101011 0001011 0001 0000101 0110101 1010101 0010101 0010 0011 0001101 0111101 1011101 0011101 0111100 0001100 1101100 0101100 0100 0110111 0000111 1100111 0100111 0101 0101010 0011010 1111010 0111010 0110 0100001 0010001 1110001 0110001 0111 1011000 1001000 1111000 0011000 1000 1010011 1000011 1110011 0010011 1001 1001110 1011110 1101110 0001110 1010 1000101 1010101 1100101 0000101 1011 1110100 1100100 1010100 0110100 1100 1111111 1101111 1011111 0111111 1101 1100010 1110010 1000010 0100010 1110 1101001 1111 1111001 1001001 0101001 Using a table for singleerror correction Table IO.lb Finding efficient methods for BCH error correction has been an active area of research. The widespread use of BCH codes attests to the success of these efforts. The following is a general decoder for a binary BCH code. If no error occurs,
10.2. A BCH DECODER
253
the plaintext can be recovered by the polynomial division
_c(x) a () x  g (x) If c (x) modg (x) i= 0 then it is necessary to locate the errors. Error correction algorithms are more complicated than the encoding algorithm which is just polynomial multiplication. The following scheme is typical. Let C (x)
= Co + CIX + C2X 2 + ... + Cn_lX n 1
be the encoded text, and suppose
r (x) = ro
+ rlX + r2x2 + ... + rn_lX n 1
is received, so the error pattern is
and u is the number of errors. k Since C (e ) = 0 for k = 1,2,3, ... , 2t, it follows that r (e k ) = e (e k ) for k = 1,2,3, ... ,2t. Define
r (e) = e (e) = eel + ee 2 + ... + Oe" = r (0 2) = e (0 2) = (oe l )2 + (oe 2 )2 + ... + (oe,,)2
81 = 82
The challenge is to locate e1, e2, ... ,eu . Start with the assumption u = t, the maximum number of errors that can be corrected. If the matrix
s= is singular, then subtract 1 from u and repeat with smaller sized S until a nonsingular matrix is found. This can be accomplished just as well while solving the system
Then factor the polynomial u
Yuxu
+ Yu_1Xu1 + ... + YIX + 1 = II (xe e; + 1) i=l
CHAPTER 10. ERRORCORRECTING CODES
254
The errors occur at xel,xe2, ... ,xeu. To recover a (x), first set c(x) e (x), then divide by 9 (x).
= r(x) +
Example 10.9 We give an example of a tripleerrorcorrecting code that uses GF32 and how triple errors can be corrected. We first need an irreducible polynomial of degree 5 in GF2 [x]. In Table 10.2, we conclude that q (x) = x 5 + x 2 + 1 is irreducible by showing that if () is a root of q (x), then the order of () modulo ()5 + ()2 + 1 is 31. ()
()11 = ()2
()2
()12
()3
()13 = ()4
()4
+1 ()6 ()3 + () ()7 ()4 + ()2 ()3 + ()2 + 1 ()8 ()9 ()4 + ()3 + () ()10 = ()4 + 1 ()5
= = = = =
()2
=
+ () + 1
()21
+ ()2 + ()
()3
+ ()2 + 1 ()23 = ()3 + ()2 + () + 1 ()24 = ()4 + ()3 + ()2 + ()
+ ()3 + ()2
+ ()3 + ()2 + 1
()14
=
(j15
= (j4 + ()3 + ()2 + () + 1
()4
+ ()3 + () + 1 ()17 = ()4 + () + 1 (j18 = () + 1 (j19 = ()2 + () (j20 = ()3 + ()2 (j16
=
()25
= ()4 + ()3 + 1
()26 = ()4
()4
+ ()2 + () + 1
()27
= ()3 + () + 1
()28
=
()29
()30 ()31
Table 10.2
= ()4 + ()3
()22 = ()4
()4
+ ()2 + ()
= ()3 + 1 = ()4 + () =1
Powers of ()
We next locate the minimal polynomial for
and reducing m3 (x) modulo m3
()5
(x)
()3
by defining
+ ()2 + 1 to get
=
x 5 + X4
+ x3 + x 2 + 1
The minimal polynomial of ()5 is given by
Reduce the coefficients modulo m5
(x)
()5
=
+ ()2 + 1 to get x 5 + X4
+ x2 + X + 1
Thus the generating polynomial is given by 9
(x) =
[m1 (x), m2 (x), m3 (x), m4 (x), m5 (x) m6 (x)] 2 = (x5 + x 2 + 1) (x5 + X4 + x 3 + x 2 + 1) (x5 + x4 + x + X + 1) = X I5 + xl! + x lO + x 9 + x 8 + x 7 + x 5 + x 3 + x 2 + X + 1 lcm
Plaintext can be a polynomial of degree at most 25

deg (g (x))  2
= 32 
15  2 = 15
10.2. A BOH DEOODER
255
Suppose the plaintext is given by
so that c(x)
= a(x)g(x)
+ X24 + x 23 + x 20 + x 16 + x 15 13 11 8 7 3 + x +x +x +x +x +1 = x 30
Introduce the triple error
so that r(x)=c(x)+e(x)
+ X24 + x 23 + x 20 + x 16 + x 15 7 13 9 8 5 3 + x +x +x +X +x +x +1
r (x) = x 30
To compute the matrix 811
S =
(
821
812 822
813 823
8 14 ) 824
831
832
833
834
we set
and reduce the coefficients modulo 85
Since 84 + 83
+ 82 + 1 to get
r
= 821 it follows that (8 4 + 83 1 = 810. Similarly, 82 + 8 + 1 = 811 1 implies (8 2 + 8 + = 820 and (8 4 ) 1 = 827 . Multiplication of the first row
lr
by 810 , the second row by 820 , and the third row by 827 yields the matrix
Add the first row to each of the second and third rows to get
CHAPTER 10. ERRORCORRECTING CODES
256 4
4
3
2
3
0 +0 0 +0 +0 +1 4 3 2 0 +0 +0 0 +0 4 4 3 3 0 +0 +0 + 1 0 +0 Multiply the second row by (0 2
+ 0) 1 = 0 12
0
3
0
+0+1 4 0 +0
)
to get
Now add appropriate multiples of the second row to the first and third rows to get 4
3
3
1 0 0 +0 +0 0 +0 +1 ) 4 3 2 o 1 0 +0 03 + 0 + 1 ( 4 3 o 0 0 +0 0 + 02 Multiply the third row by (0 4
+ 0) 1
= 0 to get
Add appropriate multiples of the third row to the first and second rows to get
Now look for a factorization (aix
+ 1) (ajx + 1) (akx + 1) = a HHk x 3 + (a Hj + a Hk + a Hk ) x 2 + (a i + a j + a k ) x + 1 = a 25 x 3 + a 6x 2 + a 21 x + 1
This implies aHj+k = a 25
a Hj
+ a Hk + o;j+k = 0;6 o;i + o;j + a k = 0;21
A search locates the solution i
= 5, j = 9,
k
= 11
10.2. A BCH DECODER
257
and hence e (x) = x 5 + x 9 + Xll. This yields
c(x) = r(x) +e(x) = x 30 + X24 + X23
+ x 20 + x I6 + x I5 + x I3 + xll + x 8 + x 7 + x 3 + 1
so the plaintext is
a(x)= c(x) =XI5+Xll+XIO+x3+x+l 9 (x)
Problems 10.2
+ X + 1 is used to construct a BCH code that corrects a single error with plaintext polynomials of the form a (x) = a3x3 + a2x2 + aIX + ao E GF2 [xl. If the message x 5 + X4 + x 3 + 1 is received, what was the plaintext?
1. The polynomial q (x) = x 3
2. The polynomial q (x) = x4 + X + 1 is used to construct a BCH code that corrects a single error with plaintext polynomials a (x) E GF2 [xl. What is the largest possible degree for a (x)? If the polynomial XI2 + x lO + x 8 + x 6 + x 2 + x is received, what was the plaintext? 3. Let
e be a root of x 2 + x + 2 in GF32 and calculate 9 (x) = ml (x) m2 (x).
4. If the generator polynomial defined in problem 3 produced a codeword that was received as 2x7 + 2x4 + 2x3 + x 2 + 2x + 2, what was the plaintext? In problems 57, let
e be a root of q (x) = x 5 + x 2 + 1 in GF32 .
5. Show that q (x) is a primitive polynomial. 6. Construct a doubleerrorcorrecting BCH code that uses the generator polynomial 9 (x) = lcm (ml (x), m2 (x), m3 (x), m4 (x)), where mi (x) is the minimal polynomial of i. What is the largest possible degree for a plaintext polynomial a (x) E GF2 [x]?
e
7. The polynomial r (x)
= x 29 + x 28 + x 27 + x 25 + x24 + X22 + x 20 + x I8 + x 16
+ x + x + X12 + Xll + x lO + x 8 + x 7 + x 5 + X4 + x 3 + 2x + 1 is received using the BCH code from the previous problem. What is the plaintext polynomial? In problems 811, let be a root of q (x) = x 3 + 2x + 1 in GF27 . 15
13
e
8. Show that q (x) is a primitive polynomial. 9. Construct a singleerrorcorrecting BCH code that uses the generator polynomial p (x) = lcm (ml (x) ,m2 (x)), where mi (x) is the minimal polynomial of i .
e
CHAPTER 10. ERRORCORRECTING CODES
258
10. The polynomial r (x) = 2X 25 + 2X24 + 2X22 + 2X 21 + x 19 + 2x 18 + x 17 + x 16 + 2X14 + 2X12 + 2Xll + x 10 + 2x 9 + 2x 8 + 2x7 + 2x5 + 2x3 + x 2 + 2x + 2 is received after being encoded by the BCH code from the previous problem. What was the plaintext? 11. Construct a doubleerrorcorrecting BCH code that uses the generator polynomial 9 (x) = km (ml (x), m2 (x), m3 (x), m4 (x)), where mi (x) is the minimal polynomial of i. What is the largest possible degree for a plaintext polynomial a (x) E GF3 [x]?
e
10.3
ReedSolomon Codes
A ReedSolomon code is a BCH code where the degree of the irreducible polynomial f(x) is 1. Let be a primitive element in GFp • The minimal polynomial of i is mi(x) = x and hence the encoding polynomial is given by
e ei,
e
Let a(x) denote a plaintext polynomial of degree at most p  2t  2. Then the minimum weight of a nonzero codeword a(x)g(x) is at least d = 2t + 1, and hence at least t errors can be corrected.
Example 10.10 Consider the prime p = 929. Then element. To see this, note that p  1 = 928 = 25 29, and
e
3 is a primitive
3928 mod 929 = 1 3928 / 2 mod 929
= 928 3928/29 mod 929 = 347 Consider the polynomial
g(x) = (x3)(x3 2) (x3 3 ) (x3 4) (x3 5 ) (x3 6 ) = x 6 + 766x 5 + 17x4 + 803x 3 + 19x 2 + 285x + 861 over G F929 . The plaintext polynomial can have degree up to p  2t  2
= 929 
6  2 = 921
with coefficients in G F 929 , and up to three errors can be corrected. The message (523,13,794,24,3,563) is represented in GF929 [xl as the polynomial m (x)
= 523x5 + 13x4 + 794x 3 + 24x2 + 3x + 563
10.3. REEDSOLOMON CODES
259
The corresponding codeword is m (x) 9 (x) mod 929
= 523x l l + 232x 10 + 134x 9 + 15x 8
+ 237x 7 + 503x 6 + 894x 5 + 18x4 + 879x 3 + 630x 2 + 463x + 734 Example 10.11 Consider the field GF2 6 = GF64 . To show that the polynomial q (x) = x 6 + X + 1 is irreducible, it is sufficient to show that a root 0 of q (x) has order 63. That a root 0 has order 63 = 32 7 follows from the evaluations
(0 63 mod p (x)) mod 2 = 1 (0 63 / 3 modp (x)) mod 2 = 06
+ 05 + 04 + 03 =I 1
(0 63 / 7 modp (x)) mod 2 = 04
+ 03 =I 1
Consider the generating polynomial 2 3 4 9 (x) = (x  0) (x  0 ) (x  0 ) (x  0 ) = x4 + (0 4 + 03 + 02 + 0) x 3 + (0 4 + 03 + 02 + 1) x 2 + (0 4 + 1) x
+ 05 + 04
Plaintext can be a polynomial in GF2 [xl of degree
p  2t  2
= 64 
4  2 = 58
The ReedSolomon code (58, 62) corrects any two errors.
Problems 10.3 1. Find a primitive element in GF16 .
2. Construct a generating polynomial for a twoerrorcorrecting ReedSolomon code over G F 16 . 3. Find a primitive element in GF17 . 4. Construct a generating polynomial for a twoerrorcorrecting ReedSolomon code over G F 17 . 5. Find a primitive element in GF257 . 6. Construct a generating polynomial for a fiveerrorcorrecting ReedSolomon code over G F 257 . 7. Find a primitive element in GF256 . 8. Construct a generating polynomial for a fiveerrorcorrecting ReedSolomon code over G F 256 .
Chapter 11
Advanced Encryption Standard In 1997 the National Institute of Standards and Technology held a threeyear competition to develop an advanced encryption standard (AES) to protect sensitive information in federal computer systems. Many businesses were expected to use the AES as well.
Once final, this standard will serve as a critical computer security tool supporting the rapid growth of electronic commerce. This is a very significant step toward creating a more secure digital economy. It will allow ecommerce and egovernment to flourish safely, creating new opportunities for all Americans. Norman Y. Mineta, Secretary of Commerce
The effort to develop the AES reflected the dramatic transformation that cryptography had undergone. Before 1950, cryptography was used primarily by governments to protect state and military secrets. Today, millions of Americans use cryptography without knowing it. Automated tellers use it to encrypt personal identification numbers. Internet transactions use it to identify users and to protect personal information like credit card numbers. Many encryption devices used Data Encryption Standard (DES) or Triple DES. Such systems had become universal in the financial services industry. Consequently, the selection of the AES affected millions of consumers and businesses. The National Institute of Standards and Technology (NIST) requested proposals for the AES in 1997. The criteria for selection included 1. Good security. This was the primary quality required of the winning formula.
261
262
CHAPTER 11. ADVANCED ENCRYPTION STANDARD
2. Key sizes. The algorithm must support key sizes of 128, 192, and 256 bits. There are 2128
= 340282366920938463463374607431 768 211456
possible keys for the 128bit key size. 3. Speed. Other algorithms such as RSA have good security but run slowly. 4. Versatility. The algorithm must run efficiently on large computers, desktop computers, and even small devices such as smart cards. All five finalist algorithms were found to have a very high degree of security. Rijndael was selected for its combination of security, performance, efficiency, ease of implementation, and flexibility. Rijndael was approved as the AES standard on December 6, 2001 and became effective on May 26, 2002.1
11.1
Data Encryption Standard
In 1973, the National Bureau of Standards solicited proposals for cryptographic algorithms to be used by federal agencies for sensitive, unclassified information. IBM submitted an algorithm with the code name LUCIFER. In 1977, a modified version of LUCIFER was adopted as the Data Encryption Standard (DES). In addition to use by federal agencies, DES and a variant called Triple DES are used in the financial services industry. The DES algorithm is a block cipher that uses a 56bit key to encode a 64bit data block. The 64 data bits, labeled 1 through 64, are put into an 8 by 8 matrix 58 50 42 34 26 18 10 2 60 52 44 36 28 20 12 4 62 54 46 38 30 22 14 6 64 56 48 40 32 24 16 8 p= 57 49 41 33 25 17 9 1 59 51 43 35 27 19 11 3 61 53 45 37 29 21 13 5 63 55 47 39 31 23 15 7 That is, data bit 58 appears in row 1 column 1 and data bit 7 appears in row 8 column 8. Then they are read off by rows, bit 2 becomes bit 8, bit 60 becomes bit 9, and so on. In the notation introduced on page 76, the incoming data bits are subject to the permutation
1  ( 40
p
2 3 8 48
... ...
64 ) 25
lSee http://csrc.nist.gov/publications/fips/fips197/fips197.pdf for the announcement in the Federal Register.
11.1. DATA ENCRYPTION STANDARD
263
Written as a product of disjoint cycles, P is given by ]0=
(1,40,28,13,55,58)(2,8,32,29,53,50)(3,48,27,45,51,42)
· (4,16,31,61,49,34)(5,56,26)(6,24,30,21,54,18)(7,64,25,37,52,10) · (9,39,60)(11,47,59,41,35,44)(12,15,63,57,33,36)(14,23,62,17,38,20) · (19,46)(22)(43) The inverse permutation has a somewhat more obvious structure 40 39 38 37 36 35 34 33
p 1 =
8 7 6 5 4 3 2 1
48 47 46 45 44 43 42 41
16 56 15 55 14 54 13 53 12 52 11 51 10 50 9 49
24 64 32 23 63 31 22 62 30 21 61 29 20 60 28 19 59 27 18 58 26 17 57 25
Written in the usual notation, it is ]01
1 2 3 4 5 ... = ( 58 50 42 34 26 ... 674 )
This inverse permutation is applied to the output after the real cryptographic work is done. The key consists of 56 bits. These are held in eight 8bit words with the last bit in each word serving as a parity check bit. Referring to these key bits with the numbers 1,2, ... ,64, the bits numbered 8, 16, 24, 32, 40, 48, 56, and 64 are parity check bits. The key is permuted by putting it into a matrix
K=
57 49 41 33 1 58 50 42 10 2 59 51 19 11 3 60 63 55 47 39 7 62 54 46 14 6 61 53 21 13 5 28
25 34 43 52 31 38 45 20
17 26 35 44 23 30 37 12
9 18 27 36 15 22 29 4
with bit 57 in the first column and first row, and bit 4 in the seventh column and eighth row. Notice that the parity check bits do not appear. This matrix is then read off in rows to get the permuted 56bit key. Given a 2nbit word, let L denote the left n bits and R the right n bits. For f any function that takes n bits as input and produces n bits of output, define
F(L,R) = (R,L+f(R))
CHAPTER 11. ADVANCED ENCRYPTION STANDARD
264
where addition is bitwise addition modulo 2. The function F takes a 2nbit word LR to the 2nbit word R (L + I (R)). It is invertible with inverse
G(L,R) = (R+ I(L),L) because
Go F (L, R)
= G (R, L + I (R)) = (L + I (R) + I (R) ,R) = (L,R)
The DES algorithm uses the key matrix K to produce a sequence of functions iI, h, ... , iI6' The sixteen corresponding functions
FdL,R) = (R,L+ldR)) are successively applied to the 64bit data block. This type of algorithm is called a Feistel network. Most of the security of DES resides in the complexity of how the functions Ii are derived from the original 56bit key. Specialpurpose computers built specifically to break DES have made DES nearly obsolete, although triple DES is still in common use.
Problems 11.1 1. Let
Ui
E
{O, I} and define
Given an 8bit word, let L denote the left 4 bits and R the right 4 bits. Define
F(L,R) = (R,L+I(R)) Compute the first four iterations of F applied to the bytes (11111111) and (11101111). 2. One measure of how well an algorithm scrambles data is how far apart two codewords are that begin at a Hamming distance of one apart. How far apart are the codewords generated in problem I? 3. What is the inverse of the function F defined in problem I? 4. Let
Ui
E
{O, I} and define
Given an 8bit word, let L denote the left 4 bits and R the right 4 bits. Define F(L,R) = (R,L+I(R)) Compute the first four iterations of F applied to the bytes (11111111) and (11101111).
11.2. THE GALOIS FIELD GF256
265
5. One measure of how well an algorithm scrambles data is how far apart two codewords are that begin at a Hamming distance of one apart. How far apart are the codewords generated in problem 4? 6. Let
h h
(uo, Ul, U2, U3) (uo, Ul, U2, U3)
=
+ Ul, Uo, Ul + U2, U2 + U3) mod 2 (uo, UOUI + U2, UOUIU2 + U3, UOUIU2U3) mod 2 (uo
and set
FdL, R) = (R, L
+ JdR))
(i=1,2)
Start with the byte (11111111) and first apply F 1 , then apply F 2 . Repeat with the byte (11101111).
11.2
The Galois Field GF256
The polynomial
q (x) = x8 + x4
+ x3 + X + 1
is irreducible over GF2 . To verify this, consider the ring R of equivalence classes of polynomials in GF2 [xl modulo q (x), and let 8 be the equivalence class of x in R. We will show that 8 + 1 has order 255 = 3 x 5 x 17 in R. Indeed
so 8 + 1 and all of its powers are invertible. Moreover,
+ 1) 255 /3 mod 88 + 84 + 83 + 8 + 1 = 87 + 85 + 84 + 83 + 82 + 1 (8 + 1)255/5 mod 88 + 84 + 83 + 8 + 1 = 83 + 82 (8 + 1)255/17 mod 88 + 84 + 83 + 8 + 1 = 1 + 85 + 84 + 82 (8
so 8 + 1 has order exactly 255. There are 255 polynomials of degree less than 8 in 8 that have at least one nonzero coefficient. So each one of them must be a power of 8 + 1, hence invertible. If q (x) were reducible, then we could write q (x) = a (x) b (x) with the degrees of a (x) and b (x) less than 8. Then 0= a (8) b (8) but a (8) and b (8) are invertible. So q (x) is irreducible. It follows that R is G F 256 , and each of its elements written uniquely as a polynomial
in 8 with coefficients in G F 2 . Addition is straightforward and multiplication is followed by reduction modulo q (8). It is convenient to represent the 256 elements of G F 256 by hexadecimal numbers. Thus, the element
266
CHAPTER 11. ADVANCED ENCRYPTION STANDARD
can be represented by the binary string 11010110 which can be thought of as the binary number (11010110)2 or the hexadecimal number D6. Similarly, the element
can be represented by the binary string 00101100 which can be thought of as the binary number (00101100)2 or the hexadecimal number 2C. Multiplication is given by
D6·2C= WF +e 6 +e 4 +e 2 +e) (e 5 +e 3 +e 2 )modq(e))mod2 =e4 +e3 +e = oe 7 + oe6 + oe 5 + 1e4 + 1e3 + oe 2 + 18 + 0 =lA whereas addition is ordinary polynomial addition with coefficients reduced modulo 2, so that
(e 7 + e6 + e4 + e2 + e) + (e 5 + e3 + ( 2 ) mod 2 = e7 + e6 + e5 + e4 + e3 + e = 187 + 186 + 185 + 1e 4 + 1e 3 + oe 2 + 18 + 0
D6 + 2C =
=FA The element a (e) b(e) mod q(e) can be computed using repeated multiplication bye. If the degree of b (e) is less than 7, then multiplication by e is a simple shift. For example,
e
For polynomials of degree 7, multiplication by is a shift of the lowerorder terms followed by addition by e4 + e3 + e + 1. In particular,
e (e 7 + e5 + e3 + e) = e8 + e6 + e4 + e2 4 4 3 6 2 = (e + e + e+ 1) + (e + e + ( ) = e6 + e3 + e2 + e+ 1 since
(e 8 mod e8 + e4 + e3 + e + 1) mod 2 = e4 + e3 + e + 1
e
Multiplication by higher powers of is repeated multiplication bye. Multiplication of one polynomial by another can be broken down into multiplication bye followed by addition of polynomials modulo 2. For example,
(e 5 + e3 + ( 2 ) (e 7 + e6 + 04 + e2 + e)
e5 (0 7 + e6 + e4 + e2 + 0) + 03 (e 7 + e6 + e4 + e2 + e) + e2 (e 7 + e6 + e4 + e2 + e) =
··11.2. THE GALOIS FIELD GF256
267
where
02 (0 7 + 06 + 04 + 02 + 0) = 0·0 (0 7 + 06 + 04 + 0 2 + 0) = 0 ( (0 4 + 03 + 0 + 1) + (0 7 + 05 + 03 + 02 ) ) 4 2 7 5 = 0 (0 + 0 + 0 + 0 + 0 + 1) = (0 4 + 03 + 0 + 1) + 06 + 05 + 03 + 02 + 0 = 0 6 + 0 5 + 0 4 + 02 + 1 4 2 3 7 6 2 6 5 4 0 (0 + 0 + 0 + 0 + 0) = 0 (0 + 0 + 0 + 0 + 1) = 07 + 06 + 05 + 03 + 0 05 (0 7 +06 +04 +0 2 +0) =0.0(07 +06 +0 5 +0 3 +0) 4
+ 03 + 0 + 1) + 07 + 06 + 04 + 02 ) = 0 (0 7 + 06 + 03 + 02 + 0 + 1) = (0 4 + 03 + 0 + 1) + (0 7 + 04 + 03 + 02 + 0) = 07 + 02 + 1
= 0 ( (0
so
(0 5 +0 3 +0 2 ) (0 7 +06 +0 4 +02 +0) = (0 6 +05 +0 4 +0 2 +1) + (0 7 + 06 + 05 + 03 + 0) +(07 +0 2 +1) = 0
4
+ 03 + 0
Multiplication by 0 can be easily translated into computer code acting on 8bit bytes. Thus
0= (00000010) 02 = (00000100) 03 = (00001000) 04 = (00010000) 0 5 = (00100000) 06 = (01000000) 07
=
(10000000)
so multiplication by 0 is a shift or a shift plus addition modulo 2 by the vector
268
CHAPTER 11. ADVANCED ENCRYPTION STANDARD
(00011011). Repeated multiplication by () produces () (()7
+ ()6 + ()4 + ()2 + ()) = (00000010) . (11010110) = (10101100)
()2
+ (00011011)
= (10110111) (()7 + ()6 + ()4 + ()2 + ()) = (00000100) . (11010110) = (00000010)· (10110111)
= (01101110) + (00011011) = (01110101) ()3 (()7
+ ()6 + ()4 + ()2 + ())
= (00001000) . (11010110)
= (00000010)· (01110101) = ()4 (()7
+ ()6 + ()4 + ()2 + ())
(11101010)
= (00010000) . (11010110)
= (00000010) . (11101010) = (11010100) + (00011011) = (11001111) ()5 (()7
+ ()6 + ()4 + ()2 + ())
=
(00100000) . (11010110)
=
(00000010) . (11001111)
= (10011110) + (00011011) = (10000101)
and hence (()5
+ ()3 + ()2)
(()7
+ ()6 + ()4 + ()2 + ())
(10000101) + (11101010) + (01110101) (00011010) Since u 255 particular, (()4
= 1 for every nonzero u in GF 256 , the inverse of u is u 254 . In
+ ()) 1 = (( ()4 + ()) 254 mod ()8 + ()4 + ()3 + () + 1) mod 2 = () 7 + ()5 + ()3 + ()
As a check, note that (( ()4
+ ())
(()7
+ ()5 + ()3 + ()) mod ()8 + ()4 + ()3 + () + 1) mod 2 = 1
Polynomials Over G F 256 Let () be a root of the polynomial x 8 + X4 + x 3 + X + 1. Elements of G F256 can be represented as polynomials in () of degree at most 7. Polynomials in GF256 [xl can be written in the form bnx n + bn _ 1 x n  1 + ... + b1 x + bo where bi E GF256 .
'11.2. THE GALOIS FIELD GF256
269
Example 11.1 To compute the product a (x) . b (x) where
a (x) = (61 5 + 61 3 + 1) X4 + (61 7 + e) x 2 + (61 4 b (x) = (61 6 + (1 5) x 3 + (61 4 + 61 + 1) x + 61 3
+ 1) x
do polynomial multiplication and reduce the coefficients modulo 61 8 + 61 4 61 + 1. Thus, a (x)
+ 61 3 +
. b (x) = (61 7 + 61 6 + 61 5 + 61 4 + 61 3 + 1) X 7 + (61 7 + 61 6 + 61 5 + 61 4 + 61 3 + 61 + 1) x 5 + (61 6 + 61 5 + 61 3 + 1) X4
+ (61 6 + 61 5 + 612 + 1) x 3 + (61 6 + (12) x 2 + (61 7 + (1 3 ) X Problems 11.2 In problems 16, let 61 be a root of x 8 1. Write (61 6 + 61 3
e.
+ e)
(61 7 + 612
+ X4 + x 3 + X + 1 in GF256 .
+ 1)
as a polynomial of degree at most 7 in
2. Verify that the element 61 + 1 has order 255 in GF256 . 3. Find an irreducible polynomial with root 61 + 1. [Hint: Simplify the polynomial
+ 61 4 + 61 3 + 61 + 1.] Find the inverse of 617 + 61 3 + 1 in GF256 .
modulo 61 8 4.
5. Solve the system
(61 5 + e) x + (61 4 + 61 + 1)y = 612 + 1 (61 7 + (1 6) X + (61 3 + (12) Y = 61 6 + 61 3 of two equations and two unknowns for x, y E GF256 . 6. Calculate the product in GF256 [x] of the two polynomials
p(x) = (e 5 +e)x 3 + (e +1)x+ (61 +61+1) q (x) = (61 7 + 61 3 + (12) x 2 + (61 5 + (12) X + (61 3 + (12) 4
7
CHAPTER 11. ADVANCED ENCRYPTION STANDARD
270
7. Find the inverse of the matrix
with entries in the field G F256 . 8. Solve the system
+ (0 2 + 0) y + (0 5 + 04 ) Z 3 5 2 4 (0 + 0) x + (0 + 0 )y + 0 Z 6 5 7 3 (0 + 0 ) X + (0 + 0 + 1) y + (0 + 1) Z (0 + 1) x
=
of three equations and three unknowns for x, y, z E GF256 .
11.3
The Rijndael Block Cipher
This page is dedicated to the fans of the Rijndael Block Cipher, whose selection, in an upset of Karelinean proportions, as the National Institute of Standards and Technology's proposed Advanced Encryption Standard has brought down the Feistel cipher dynasty. It's a classic story of two guys in a garage taking on the establishment and winning. Prom the home page of the Rijndael Fan Club
Belgian mathematicians Joan Daemen and Vincent Rijmen submitted the winning cipher in the Advanced Encryption Standard open competition, held in 2000, to establish a new technique for protecting computerized information. The Rijndael Block Cipher uses keys of 128 bits, 192 bits, or 256 bits. The 128bit version will be described here. The algorithm includes a series of operations on 4 x 4 matrices whose entries are bytes (8 bits). Each such matrix contains 4·4·8 = 128 bits. The 192 and 256bit versions use 4 x 6 and 4 x 8 matrices. The 128bit cipher is based upon the use of 10 rounds: each round consists of a Galois field operation on the bytes (ByteSub), an operation on the rows (ShiftRows), an operation on the columns (MixColumns), and a vector sum with a scrambled key (AddRoundKey). Throughout the remainder of this section, let 0 be a fixed root of the polynomial x 8 + x4 + x 3 + X + 1 in the Galois field G F256 .
ByteSub Each element ofthe 4 x 4 matrix is a byte, which can be considered as an element of the field GF256 . The ByteSub transformation consists of two steps:
11.3. THE RIJNDAEL BLOCK CIPHER
271
1. Replace each nonzero field element u with its inverse u 1 in GF256 . (The zero element is fixed.) This operation is certainly reversible. Call the new field element
b7 e7 + b6 e6 + b5 e5 + b4 e4 + b3 e 3 + b2 e 2 + ble + bo =(~,~,~,~,~,~,~,~)
2. Apply the affine transformation 0 0 0 1 1 1 1 1
1 0 0 0 1 1 1 1
1 1 1 1 0 1 0 0 0 0 1 0 1 1 1 1
0 1 1 0 0 1 0 0 0 1 0 0 1 1 0 1 1 1 1 1 1 1 1 1
1 1 1 0 0 0 1 1
1 1 1 1 0 0 0 1
1 0 0 1 1 0 1 1 1 1 1 1 1 1 1 0 1 1 0 0 1 0 0 0
1 1 1 1 0 0 0 1
bo b1
b2 b3 b4 b5 b6 b7
+
1 1 0 0 0 1 1 0
b'0 b'I b~
b'3
mod2=
b~
b'5 b'6 b~
Notice that 1 0 1 1 1 1 1 1 1 1 0 1 0 0 0 0
0 0 1 1 1 1 1 0
1
mod2=
0 0 1 0 0 1 1 0 0 1 0 0 1 0 0 1
1 0 0 1 0 1 0 0
0 1 0 0 1 0 1 0
0 0 1 0 0 1 0 1
1 0 0 1 0 0 1 0
0 1 0 0 1 0 0 1
1 0 1 0 0 1 0 0
so the inverse affine transformation is given by 0 1 0 1 0 0 1 0
0 1 0 0 1 0 0 1 1 0 0 1 0 0 1 0
0 1 0 0 1 0 1 0
0 0 1 0 0 1 0 1
1 0 0 1 0 0 1 0
0 1 0 0 1 0 0 1
1 0 1 0 0 1 0 0
b'0 b'I b~ b~ b~ b~ b~ b~
+
1 1 0 0 0 1 1 0
=
bo b1 b2 b3 b4 b5 b6 b7
ByteSub replaces each byte of the 4 x 4 matrix with a transformed byte.
CHAPTER 11. ADVANCED ENCRYPTION STANDARD
272
ShiftRows The ShiftRows transformation is given by
Shift Rows (
800 810 820
801 811 821
802 812 822
803) 813 823
830
831
832
833
=
(800 811 822
801 812 823
802 813 820
821
833
830
831
832
803) 810
The first row is fixed, the second row is shifted one cell to the left with wrap around, the third row is shifted two cells to the left with wrap around, and the fourth row is shifted three cells to the left with wrap around. The inverse transformation shifts the rows to the right.
MixColumns MixColumns is the linear transformation
MixColumns
en
821 831
841
~CL
0+1 0 1 1
814
812
813
822
823
824
832
833
834
842
843
844
1
0+1 0 1
01
1
)
) en
812
813
814
821
822
823
824
831
832
833
834
841
842
843
844
)
This is an invertible linear transformation since
CL
0+1 0 1 1
1
0+1 0 1
0+1 0
r
~+I
0 +0+1 03 + 02 + 1 ) 0 +1 03 + 02 + 0 03 +0+1 03 + 02 + 1 03 + 0 2 + 1 03 + 1 03 + 02 + 0 03 +0+1 3 3 2 0 +0+1 0 + 0 + 1 03 + 1 03 + 02 + 0 3
( 0 +0'+0 3
3
1 1
over GF256 •
AddRoundKey AddRoundKey, the final transformation in each of the ten rounds, is a matrix sum
J1.3. THE RIJNDAEL BLOCK CIPHER
AddRoundKey
_
('00
273
801
802
803
810
811
812
813
820
821
822
823
830
831
832
833
('00
801
802
koo
810
811
812
820
821
'03) + ( k20
830
831
822
813 823
k10
832
833
k30
) kOl kl1 k21 k31
k02 k12 k22 k32
k03 k13 ) k23 k33
where a modified key matrix (k ij ) is generated by the key expansion algorithm for each round. Since u + u = 0 in GF256 , it follows that the inverse transformation adds the same matrix.
Rey Expansions The first key matrix is constructed directly from the 128bit key (~,~,~,~,~,~,~,~,~,~,kA,kB,kc,kD,kE,kF)
where each ki is one byte, as follows
COO
k10
k20 k30
kOl kl1 k21 k31
k02 k12 k22 k32
ko k1 k2 k3
k03 k13 k23 k33
)(
k4 k5 k6 k7
k8 kg kA kB
kc kD kE kF
)
Ten additional key matrices are constructed by a series of transformations on the columns. The leftmost column of the each additional key matrix is constructed by the following four steps: 1. Apply a rotation
to the rightmost column of the previous key matrix. This can also be calculated as the matrix product
o
0 1 0
o o
1
0
CHAPTER 11. ADVANCED ENCRYPTION STANDARD
274
2. Apply the ByteSub transformation to each byte. 3. Add
(T) where i is the number of the round. 4. Add the leftmost column of the previous key matrix. This gives the leftmost column of the current key matrix. The remaining columns of the key matrix are constructed, from left to right, by adding the column to the left to the corresponding column from the previous key matrix. If we let denote column j of the ith key matrix, then for j = 2,3,4 we have Kj Kjl i = i + KjiI
Kl
Problems 11.3 Let 0 be a (fixed) root of x 8
+ X4 + x 3 + X + 1 in GF256.
1. Verify that 1 1 1 1 1 0 0 0
0 0 1 0 1 1 1 1 1 1 1 1 0 1 0 0
0 0 0 1 1 1 1 1
2. Verify that (0 4
1 0 0 0 1 1 1 1
1 1 0 0 0 1 1 1
+ 0) 1
1 1 1 0 0 0 1 1
1 1 1 1 0 0 0 1
= 07
1
mod2=
0 1 0 1 0 0 1 0
0 1 0 0 0 1 1 0 0 0 1 0 1 0 1 0 1 0 0 0 1 1 0 0
+ 05 + 03 + 0 in GF256 .
3. Use ByteSub to transform the byte 04
+ o.
4. Use ShiftRows to transform the matrix
0 0 1 0 0 1 0 1
1 0 0 1 0 0 1 0
0 1 1 0 0 1 0 0 1 0 0 1 0 0 1 0
11.3. THE RIJNDAEL BLOCK CIPHER 5. Use MixColumns to transform the matrix
6. Assume that the ith key is given by
Use the key expansion algorithm to generate key i + l. pn 7. For any nonzero element u E GFpn, show that u  1 = l. pn 8. For any nonzero element u E GFpn, show that u 1 = u  2 .
275
Chapter 12
Polynomial Algorithms and Fast Fourier Transforms In this chapter, we look at different representations of polynomials and at methods for converting from one representation to another such as the fast Fourier transform (FFT).
12.1
Lagrange Interpolation Formula
A polynomial with integer coefficients is primitive if the greatest common divisor of its coefficients is 1. So 9x 2  4x + 6 is primitive while lOx 2  4x + 6 is not.
Theorem 12.1 Any nonzero polynomial in Q [xl can be written uniquely as a positive rational number times a primitive polynomial in Z [xl. Proof. Let f (x) be a nonzero polynomial in Q [xl. Choose nonzero d E Z so that 9 (x) = df (x) has integer coefficients. Let c be the greatest common divisor of the coefficients of 9 (x). Clearly 9 (x) Ie is primitive and
f(x)
= ~g(x) = ~ d
d
(g(x)) c
So we can write any nonzero polynomial that way. Why is there only one way? Suppose we could write
f(x) f(x)
rg(x) sh(x)
where rand s are positive rational numbers and 9 (x) and h (x) are primitive polynomials in Z [xl. Then
h(x)
=
r m g(x) = g(x) s n
277
278
CHAPTER 12.
POLYNOMIAL ALGORITHMS AND FFTS
where m and n are relatively prime positive integers. So nh (x) = mg (x)
Because m and n are relatively prime, n must divide each coefficient of g (x) and m must divide every coefficient of h (x). But g (x) and h (x) are primitive, • so m = n = 1. Thus r/s = 1 so r = s. It follows that g (x) = h (x). For example, the polynomial ~x4  tx  6 can be written as 4
24  x  6 = 2( 5x 4  6x  45 ) x 3 5 15
as the product of the positive rational 2/15 and the primitive polynomial 5x 4 6x  45. The positive rational number is called the content of the polynomial. So the content of
~X4 3

~x 5
6
is 2/15. The content of a polynomial is an integer exactly when the polynomial has integer coefficients. Why is that? Also, the content of a polynomial is 1 exactly when the polynomial is a primitive polynomial in Z [xl. We want to show that the content of a product of polynomials is the product of their contents. Since a polynomial is primitive exactly when its content is 1, this says, in particular, that the product of two primitive polynomials is primitive. That result is known as Gauss's lemma.
Lemma 12.2 (Gauss's lemma) The product of two primitive polynomials in Z [xl is primitive. Proof. Let f (x) and g (x) be primitive polynomials in Z [xl. To show that f (x) g (x) is primitive, it suffices to show that if p is any prime, then p does not divide some coefficient of the product J (x) g (x). Note that because J (x) and g (x) are primitive, then p does not divide some coefficient of J (x), and p does not divide some coefficient of g (x). This means that, considering J (x) and g (x) as polynomials over the field of integers modulo p, each of them is nonzero. But the product of two nonzero polynomials over a field is not zero, so f (x) g (x) is not zero considered as a polynomial over the field of integers modulo p. That means that p does not divide some coefficient of J (x) g (x). • With Gauss's lemma and the preceding theorem in hand, it is easy to see that the content of the product of two polynomials is the product of their contents. Let !1 (x) and 12 (x) be two nonzero polynomials in Q [xl· Write Jdx) = rlPI (x) and 12 (x) = r2P2 (x) where rl and r2 are positive rational numbers and PI (x) and P2 (x) are primitive polynomials in Z [xl. Then
12.1. LAGRANGE INTERPOLATION FORMULA
279
and rl r2 is a positive rational number and PI (x) P2 (x) is a primitive polynomial in Z [xl. So rIr2 is the content of !I (x) 12 (x). But rl is the content of !I (x) and r2 is the content of 12 (x). There are only a few possibilities for a rational root of a given polynomial with integer coefficients. Theorem 12.3 (Rational root theorem) If a polynomial with integer coefficients has a rational root p/q, written in lowest terms, then p divides the constant term and q divides the leading coefficient. Proof. If the polynomial we can write
f (x)
has the root p / q, then by the division algorithm
f (x) = (qx  p) 9 (x)
+r
where r is a constant. Plugging in p/q gives 0 = O· 9 (p/q) + r, so r = O. The content of qx  p is 1 so the content of f (x) is the same as the content of 9 (x). Thus the content of 9 (x) is an integer, so 9 (x) has integer coefficients. As f (x) = (qx  p) 9 (x) = qxg (x)  pg (x)
it is clear that q divides the leading coefficient of f (x) and p divides the constant term of f (x). (See also problem 8.) • The formula
k
p(x)
=
xr'
d L II r·  r ' i=O j#i' i
__ 3
3
is called the Lagrange interpolation formula after JosephLouis Lagrange (17361813). It gives the unique polynomial p(x) of degree at most k whose graph passes through the k + 1 points (ri, d i ) in the plane. Of course we must have ri =I rj for i =I j. You can easily see that the polynomial
= II
Ldx)
has degree k with Li (ri)
x  rj r·  r ' j#i' 3
= 1 and Li (rj) = 0 for each j =I i.
So
k
p(x) =
L diLdx) i=O
is a polynomial of degree at most k such that p (ri) = d i for each i. Example 12.4 To use the formula k
p(x) =
xr'
d L II r·  r ' i=O j#i' i
__ 3 3
280
CHAPTER 12.
POLYNOMIAL ALGORITHMS AND FFTS
to construct a polynomial of degree at most 5 that interpolates the data
n
Xn
0 1 2 3 4 5
0 1 2 3 4 5
Yn
2 15 146 743 2514 6657
it is sufficient to define the polynomials Pi (x) = Yi
II #i
x
Xj
Xi 
Xj
for i = 0,1,2,3,4,5. These polynomials are given by
_ (x  1) (x  2) (x  3) (x  4) (x  5) Po (x )  2· (0 _ 1)(0 _ 2) (0  3)(0  4) (0  5) 1 5 1 4 17 3 15 2 137 =60 x +4 x 12 x +4 x 30 x + 2 _ (x  0) (x  2)(x  3)(x  4)(x  5) ( ) PI X  15· (1 _ 0) (1  2) (1  3)(1  4) (1  5) 5 5 35 4 355 3 385 2 = x  x +  x   x + 75x 8
4
8
4
(x  0) (x  1) (x  3) (x  4) (x  5) P2 (X ) = 146· (2 _ 0)(2 _ 1) (2  3)(2  4)(2  5) = _ 73 x5 + 949 x4 _ 4307 x3
+ 7811 x2 _ 730x 6 6 6 (xO)(x 1)(x 2)(x4)(x5) P3 (x) = 743· (3 _ 0) (3  1)(3  2) (3  4)(3  5) 6
743x4 + 36407 x3 _ 9659 x2 + 7430 x 12 2 3 (x  0) (x  1) (x  2) (x  3) (x  5) P4 (x) = 2514· (4 _ 0)(4 _ 1) (4  2)(4  3) (4  5) 419 5 4609 4 17179 3 25559 2 6285 =x +x x +x   x 4 4 4 4 2 (x  0) (x  1) (x  2) (x  3) (x  4) P5 (x) = 6657· (5 _ 0) (5  1) (5  2) (5  3) (5  4) 2219 5 2219 4 15533 3 11 095 2 6657 =x   x +x x +x 40 4 8 4 5 Now form the sum = 743 x5 _
12
Po (x)
+ PI (x) + P2 (x) + P3 (x) + P4 (x) + P5 (x) 25 6
= 2 + 6x  x
2
71 3 25 4 13 5 + x + x +x 12 6 12
12.1. LAGRANGE INTERPOLATION FORMULA
281
Note that the polynomial Po (x) has value Yo at Xo and is zero at Xl, X2, X3, X4, and X5. In fact, each Pi has the property that Pi (Xi) = Yi, and for i =I j, Pi (Xj) = O.
Problems 12.1 1. Find the content, and the corresponding primitive polynomial, of the following polynomials. a. 2X2 
1
c. 3"x +
~x
h.
13
~X3  ~x2 + 10
15 7 d. 14x2  21x + 35
2
2. Use the Lagrange interpolation formula to find an equation of the line through the points (1,2) and (3,5). 3. Use the Lagrange interpolation formula to find an equation of the line through the points (xo, YO) and (Xl, yd. Show that the equation reduces to the twopoint form Y = Yo
YI + Xl
 Yo ( ) X  Xo Xo
for the line through the points (xo, Yo) and
(Xl,
yd.
4. Use the Lagrange interpolation formula to find an equation of the parabola that goes through the three points (0,1), (1, 2), (2,2). 5. Find the polynomial of lowest degree that goes through the points (2,7), (4,10), (7,23), (11,5) by defining a generic polynomial P (x) = a
+ bx + CX2 + dx 3
and solving the system
p(2)
= 7, p(4) = 10, p(7) = 23, p(l1) = 5
for the unknown coefficients a, b, c, d. 6. Find a polynomial over the integers modulo 101 of lowest degree that goes through the points (1,3), (2,51), (4,78), (7,23) by defining a generic polynomial P (x) = a + bx + cx2 + dx 3 solving the system
p(l)
= 3, p(2) = 51, p(4) = 78, p(7) = 23
for the unknown coefficients {a, b, c, d} and reducing the coefficients modulo 101.
282
CHAPTER 12.
POLYNOMIAL ALGORITHMS AND FFTS
7. Find the polynomial oflowest degree that goes through the points (2,5), (1, 10), (0,8), (1, 5), (2,10).
8. Prove the rational root theorem directly by plugging in a root pi q in lowest terms and clearing fractions.
9. Verify that the polynomial k
p(x) =
L d II i
i=O
jf.i
xT.
__ 2 T· T·
2
t
satisfies p (Ti) = di for i = 0,1, ... , k.
12.2
Kronecker's Algorithm
Using Theorem 12.3, we can find all the rational roots of a polynomial with integer coefficients by constructing a finite set of candidates and testing each one. The same idea can be used to find all the factors of such a polynomial. Suppose f(x) = g(x)h(x), with g (x) and h (x) polynomials with integer coefficients. If m is any integer, then f (m) and g( m) are integers and g( m) If (m) because f(m) = g(m)h(m). To find a factor of degree at most k of a given polynomial f (x), if there is one, let TO, TI, ... , Tk be any k + 1 distinct integers, for example, Ti = i. If f(Ti) = 0, then x  Ti is a factor of f(x). Otherwise, let Di be the finite set of divisors of the integer f(Ti). If g (x) is a factor of f (x), then g(Ti) E Di for i=0,1,2, ... ,k. For each i select an integer di E Di and consider the polynomial k
g(x) =
L d II i
i=O
jf.i
XTo
2
__ T· T· t
2
which is the unique polynomial of degree at most k that satisfies gh)
= di for
i = 0, 1, ... ,k. If g( x) has integer coefficients, we test it to see if it divides f (x). Any factor of f (x) of degree at most k will be constructed as such a polynomial g (x) from some sequence do, d l
, ... , dk with di E D i . This idea was named after Leopold Kronecker (18231891). (See Algorithm 12.1.) The algorithm is usually very inefficient because there are so many cases to check.
283
12.2. KRONECKER'S ALGORITHM
Algorithm 12.1
Kronecker's algorithm
Input: A positive integer k and a polynomial f (x) E Z [xl Output: A divisor p(x) of f (x) of degree at most k or the message "fail" For i from 0 to k do Yi
= f(i) = 0 then
If Yi
Return x  i End If End For For di dividing Yi do k
.
'" II ~JJ X
p(x) = ~di i=O

#i
If p (x) E Z [xl and p (x) divides f (x) then Return p(x) End If End For Return "fail" Here is an example of Kronecker's algorithm in action.
Example 12.5 Let f(x) = x 5 + X4 + 1. There are no linear factors because the only possible rational roots are 1 and 1, and f(l) = 3, f(I) = 1. If f(x) factors, then it must be the product of a polynomial of degree 2 with a polynomial of degree 3. So we need only look for a factor of degree 2. Suppose g(x) is a factor of degree 2. Using the integers TO = 0, T1 = 1, and T2 = 1, we see that f(I) = 1, f(O) = 1, and f(l) = 3. It follows that
Do = {I, I} D1 = {1,1} D2 = {1,1,3,3} Thus there are 2 x 2 x 4 = 16 choices for do, d 1 , and d2 , so 16 possible polynomial divisors of degree 2. Each such polynomial divisor must be of the form
_ (x  O)(x  1) d (x + l)(x  1) d (x  O)(x + 1) g(x)do (_1_0)(_I_I) + 1(0+1)(01) + 2(10)(1+1) Selecting do
= 1, d 1 = 1,
and d 2
= 1, we get the
possible factor
(x  0) (x  1) (x + 1) (x  1) (x  0) (x + 1) _ 1 (10)(11) + (0+1)(01) + (10)(1+1)
284
CHAPTER 12.
POLYNOMIAL ALGORITHMS AND FFTS
which is not even a polynomial of degree 2 (but it is a factor!). The choices do = I, d 1 = 1, and d2 = 3 yield
(x  0)( xI) (x + 1)(xI) 3 (x  0)( x + 1) _ x 2 (10)(11) + (0+1)(01) + (10)(1+1) +
1
X
+
and long division shows that indeed
This method works very well for polynomials of small degree. However, the amount of time it takes is an exponential function of the degree, so it is not a practical method for polynomials of large degree. We look at one more example to show the added complexity for higherdegree polynomials.
Example 12.6 Consider the polynomial
If f(x) factors then at least one ofthe factors is of degree at most 4, so we need only look for a factor of degree at most 4. Choose TO = 0, Tl = I, T2 = 2, T3 = I, and T4 = 2. Then
f (0) = 6 f (1) = 169 = 132 f (2) = 4898 = 2 x 31 x 79 f(1)=7
f (2) = 3350 = 2 x 52 x 67 so
Do Dl D2 D3 D4
= {±1, ±2, ±3, ±6}
= {±1,±13,±169} = {±1, ±2, ±31, ±62, ±79, ±158, ±2449, ±4898} = {±1,±7}
= {±1, ±2, ±5, ±10, ±25, ±50, ±67, ±134, ±335, ±670, ±1675, ±3350}
The number of different choices for do, dl, d2 , d3 , d4 is 8·6·16·4·24 After many failures, we will try
do
= 1, d1 = 13, d2 = 79, d3 = 7, d4 = 67
= 73728.
12.3. NEVILLE'S ITERATED INTERPOLATION ALGORITHM
285
and get the polynomial g
(
x) = 1 (x  1) (x  2) (x + 1) (x + 2)
13x (x  2) (x + 1) (x + 2) (1)(2)(1)(2) + 1(12)(1+1)(1+2) + 79x (x  1) (x + 1) (x + 2) + 7 x (x  l)(x  2)(x + 2) 2 (2 1) (2 + 1)(2 + 2) (1) (11)(1 2) (1 + 2)
+67 =
x(x1)(x2)(x+1)
(2) (2  1) (2  2) (2 + 1) 4 3x + 6x 2 + 3x + 1
Long division then shows that indeed f(x) = (3x 4 + 6x 2 + 3x + 1) (x5 + 2x 3 + 4x + 6)
Problems 12.2 1. Factor the polynomial f(x) algorithm.
=
X4
+ x 2 + 1 in Z [xl
by using Kronecker's
2. Factor the polynomial f (x) = 2x 5 + 4x4 + llx 3 + 30x 2 + 25x + 5. 3. Factor the polynomial f(x)
2x5 + 3x4 + 3x3 + 3x 2 + X + 1.
= 2x 6 +
4. Verify that the polynomial f (x) = X4 + x 3 + x 2 + X + 1 is irreducible in Z [xl by showing that f (x) generates GF16 over GF2 . 5. Verify that f (x) = x4
+ 2x + 2 is irreducible.
6. Factor the polynomial f (x)
= 6x 4 +
7x 3 + 9x 2 + 4x + 2.
7. Factor the polynomial f (x) = x 5 + 3x4 + 3x 3 + 3x 2 + 3x + 2. 8. Factor the polynomial f (x) 9. Verify that algorithm.
f (x)
= x5

X
= x6 +
2x 5 + 3x4 + 3x 3 + 3x 2 + 2x + 1.
+ 1 is irreducible in Z [xl
by using Kronecker's
10. Verify that f (x) = x 5  X + 1 is irreducible in Z [xl by showing that f (x) generates GF 243 over GF 3 .
12.3
Neville's Iterated Interpolation Algorithm
Kronecker's algorithm uses the Lagrange interpolation formula for constructing the interpolating polynomials. In this section we look at another algorithm for constructing an interpolating polynomial. This method first constructs interpolating lines through pairs of points, then uses these lines to construct interpolating quadratic polynomials through triples of points, and so forth until eventually the polynomial of degree n is constructed that interpolates all n + 1 points.
286
CHAPTER 12. POLYNOMIAL ALGORITHMS AND FFTS
Theorem 12.7 Let {XO,Xl, ... ,Xnl,Xn } be any n sume p (x) and q (x) are functions such that
p(xd = f(Xi) q (Xi) = f (Xi)
+1
distinct numbers. As
(i=O,l, ... ,nl) (i=l, ... ,nl,n)
and define 9 by 9 () X =
(xxo)q(x)(XXn)P(X) Xn Xo
Then (i=O,l, ... ,n) Proof. Note that 9 (Xo)
=
(xo  xo) q (xo)  (xo  Xn) P (xo) Xn Xo
Xn  Xo q(xn)=f(xn) Xn Xo and for 1 :::; i :::; n  1 we have =
9 (Xi) =
(Xi  xo) q (Xi)  (Xi  Xn) P (Xi) Xn XO (Xi  XO) f (Xi)  (Xi  Xn) f (Xi) Xn XO
•
as claimed.
Neville's iterated interpolation algorithm is based on the preceding theorem.
Algorithm 12.2
Neville's iterated interpolation algorithm
Input: Integers n and {xd~=o and function values q(i,O) = f(Xi) Output: Interpolating Polynomial q (n, n) For i from 1 to n do For j from 1 to i do '") (xXi_j)q(i,jl)(XXi)q(il,jl) Set q (2, J = '"'''''"'''Xi  Xij Next j Next i Return q (n, n)
12.3. NEVILLE'S ITERATED INTERPOLATION ALGORITHM
287
Example 12.8 Set Xo = 1, Xl = 1, X2 = 3, X3 = 5, and X4 = 10, and then initialize q (0, 0) = 76, q (1, 0) = 36, q (2, 0) = 116, q (3, 0) = 20, and q (4, 0) = 45. The interpolating polynomial can then be constructed by typing
q (1, 1) = (x  xo) q (1, 0)  (x  xd q (0, 0)
(xo) (x  (1)) 36  (x  1) 76 = 1 _ (1) =  20x + 56 Xl 
q (2,1)
=
(x 
Xl)
q (2, 0) X2 
(x 
X2)
q (1, 0)
Xl
= (X  1) 116  (x  3) 36
= 40x _ 4
31 q (3, 1) = (x 
X2)
q (3, 0)  (x X3 
X3)
q (2, 0)
X2
(x  3) (20)  (x  5) 116 = 68x+320 53 q (4,1) = (x  X3) q (4,0)  (x  X4) q (3, 0) =
X4 
X3
(x  5) (45)  (x  10) (20) = 10 _ 5 = 5x + 5
to generate the intermediate polynomials of degree 1, and typing
q (2, 2) = (x  xo) q (2, 1)  (x X2 
(x
q (1,1)
+ 1) (40x 
= 15x 2

4)  (x  3) (20x + 56) 3+1 20x + 41
q (3, 2) = (x  xd q (3, 1)  (x X3 

X2)
Xo
(x 1) (68x
X3)
q (2, 1)
Xl
+ 320) 
(x  5) (40x  4)
51 = 27x2 + 148x  85 q (4, 2)
=
(x 
X2)
q (4, 1) X4 
(x  3) (5x
= 9x 2

(x 
+ 5) 
140x + 455
X4)
q (3, 1)
X2
(x  10) (68x 10  3
+ 320)
CHAPTER 12.
288
POLYNOMIAL ALGORITHMS AND FFTS
to generate the polynomials of degree 2, and typing
q (3, 3) = (x  xo) q (3, 2)  (x  X3) q (2, 2) X3  Xo _ (x + 1) (27x2 + 148x  85)  (x  5) (15x 2  20x + 41) 5+1 = 7x 3 + 36x 2  13x + 20 q (4, 3) = (x  Xl) q (4, 2)  (x  X4) q (3, 2) X4  Xl 2 _ (x  1) (9x  140x + 455)  (x  10) (27x2 101 2 3 = 4x  63x + 240x  145
+ 148x 
85)
for the polynomials of degree 3, and finally, for the interpolating polynomial of degree 4,
q(4,4) = (xxo)q(4,3)  (x x4)q(3,3) X4  Xo 3 (x + 1) (4x  63x 2 + 240x  145) 10 + 1 (x  10) (7x 3 + 36x2  13x + 20) 10 + 1 3 = X4  15x + 50x 2  5x + 5 The graph ofthe interpolating polynomial is shown in Figure 12.l.The linear polynomials q (i, 1) interpolate each pair of consecutive points as illustrated in Figure 12.2. The quadratic polynomials q (i, 2) interpolate each of three consecutive points (see Figure 12.3) and the cubic polynomials q (i, 3) interpolate each of four consecutive points (see Figure 12.4). Example 12.9
Figure 12.1 Interpolating polynomial
Figure 12.2 Linear polynomials
12.3. NEVILLE'S ITERATED INTERPOLATION ALGORITHM
Figure 12.3
Quadratic polynomials
Figure 12.4
289
Cubic polynomials
Problems 12.3
i= Xl, show that q(l,l) given in Neville's iterated interpolation algorithm reduces to the usual twopoint form Y = Yo + YI  Yo (X  Xo ) Xl  Xo
1. Given two points (xo,Yo) and (XI,Yl) with Xo
for a line through the two points (xo, Yo) and (Xl, YI). 2. Find an equation of the polynomial of degree 2 that goes through the three points (3, 2), (1,5), and (2,1), using Neville's iterated interpolation algorithm. Plot the parabola p (x), together with the two lines q (1,1) and
q(2,1). 3. Find the polynomial p(x) of smallest degree that satisfies p(2) = 3, p( 1) = 5, p(l) = 1, p(2) = 1, using Neville's iterated interpolation algorithm. Plot the graph of p(x) and the polynomials q (i,j) on one graph and label each of these polynomials. 4. Recall that sinO = 0, sin (~) = cos (~) = ~, and cos (~) = 0. Show that (X  0) cos x  (x  ~) sin x f(x)= 1!:0 2
satisfies f (0) =
°
and f
Of)
= ~ and f (~) = 0.
5. Use Neville's iterated interpolation algorithm to construct a polynomial p (x) of degree 2 in GF7 [xl that interpolates the points (0,2), (1,3), (2,5). 6. Let 0 be a root of x4 + X + 1 in GF I6 . Use Neville's iterated interpolation algorithm to find a polynomial p (x) E GF 16 [xl that interpolates the three points (0,0+1), (1,0 3 +0), (0,0 2 +0+1).
290
12.4
CHAPTER 12. POLYNOMIAL ALGORITHMS AND FFTS
Secure Multiparty Protocols
First Trust Bank trusts its employees but not their judgment. The bank requires that n tellers must sign off on any large transaction. Employee schedules change constantly, so it is difficult to predict which n tellers might be working at any one time. Thus the bank would like any group of n tellers to have the authority to approve a large transaction, but no smaller group should have that authority. Each teller is assigned an integervalued password, and when each of n tellers submits his or her password, a central computer does a calculation based on these passwords. The following scheme allows any group of n tellers to generate a hidden key, but fewer than n tellers, even if they share their passwords, have absolutely no clue about what the hidden key might be. Let be a polynomial of degree n  1 with integer coefficients. The hidden key is the number p (0). The ith teller is given the secret number p (i). Since any collection of n distinct points determines a polynomial of degree n  1, any group of n tellers can collectively compute p (0). However, fewer than n tellers will be unable to determine the value of p (0). Example 12.10 The coefficients of the polynomial p
(x) = 965785106674+ 314427 379054x + 353 796 761 912x 2 + 940 773378 958x 3
were generated by a pseudorandom number generator modulo 999999999989. Ten tellers were given the passwords p (1) mod 999 999 999 989 = 574782626620 p (2) mod 999 999 999 989
= 536013944204
p (3) mod 999 999 999 989 = 494119333240 p (4) mod 999 999 999 989 p (5) mod 999 999 999 989
= 93 739 067 542 = 979513420902
p (6) mod 999 999 999 989 = 796082667156 p (7) mod 999 999 999 989
= 188087080107
p (8) mod 999 999 999 989 = 800166933547 p (9) mod 999999999989 = 276962501312 p (10) mod 999 999 999 989
= 263114057194
and were told to guard these numbers with their lives. The four tellers 2, 5, 6, and 8 submitted their secret numbers and the networked computer produced the calculation p (0) mod 999 999 999 989 = 965785106674
12.4. SECURE MULTIPARTY PROTOCOLS
291
using Neville's iterated interpolation algorithm. The next day, tellers 1, 2, 4, and 8 submitted their secret numbers and the networked computer produced the calculation p (0) mod 999 999 999 989
= 965785106674
Given n equations of the form q (i, 0) = P (Xi), it is not always necessary to determine all of the coefficients of the polynomial p (x). The modified Neville's iterated interpolation algorithm (see Algorithm 12.3) produces the value of p (0) directly. Algorithm 12.3
Modified Neville's iterated interpolation algorithm
Input: Integers n and nonzero {xd ~=o and function values q (i, 0) = P (Xi) 'Output: q (n, n) = p (0) For i from 1 to n do For j from 1 to i do .. ) xiq(i1,j1)Xi_jq(i,j1) S et q (2, J = =':~'....::'===''='Xi  Xij Nextj Next i Return q (n, n)
Example 12.11 We use Algorithm 12.3 to find the yintercept of the polynomial of degree 2 that goes through the three points (1,5), (3,8), and (6,2). First set Xo = 1, Xl = 3, X2 = 6 and q (0, 0) = 5, q (1,0) = 8, q (2, 0) = 2. Then q (1,1) = Xlq (0, 0)  xoq (1, 0) Xl  Xo  x2q(1,0)Xlq(2,0) q (21) , X2  Xl x2q(1,1)xoq(2,1) q(2 2) = , X2  Xo
= 3·5  1 . 8 = ~
3 1 2 _ 6·83·2  4 1 6 3 6.~1.14 7 = =6 1 5
and hence the parabola goes through the point
(0, D.
Problems 12.4 1. Assume p (1) = 2, p (2) = 4, and p (3) = 1. Construct two polynomials
f (x) and g (x) of degree 3 such that f (k) = g (k) = p (k) but f (0) = 0 and g (0) = 5. Plot the graphs of f and g.
for k = 1,2,3,
CHAPTER 12. POLYNOMIAL ALGORITHMS AND FFTS
292
2. Four soldiers are stationed in a missile silo. Any two soldiers can authorize a missile to be fired. Use a polynomial p (x) = ax + b with coefficients chosen at random in the range 0 S; a, b < 999 999 999 989 to assign the four hidden numbers p (1) mod 999 999 999 989, p (2) mod 999 999 999 989,
p (3) mod 999 999 999 989, p (4) mod 999 999 999 989
Show that soldiers 1 and 2 working together generate the same value of p (0) mod 999 999 999 989 as do soldiers 3 and 4. 3. Show that a conspiracy by n  1 tellers can learn nothing about the value p (0). That is, if p (x) is a polynomial of degree n 1 and the n 1 values p (1), P (2), ... , p (n  1) are known, then p (0) could have any possible integer value in the range 0 S; p (0) < 999999999989. 4. Use the modified Neville's iterated interpolation algorithm to find the y intercept of the polynomial p (x) of degree 3 that satisfies p (2) = 8,
p (3) = 4, p (5) = 7, p (9) = 2.
12.5
Discrete Fourier Transforms
The Lagrange interpolation formula and Neville's iterated interpolation algorithm are two ways of constructing a polynomial that takes on prescribed values at certain points. Prescribing n + 1 values determines a unique polynomial of degree at most n. We usually describe a polynomial by listing its coefficients. However, it can be useful to describe a polynomial in other ways. The polynomial p( x) = (x + 1)(x  l)(x  2) is determined by any of the following descriptions: 1. The polynomial whose coefficients are 1, 2, 1, and 2: the polynomial p( x) = x3  2X2  X + 2
2. The monic polynomial of degree 3 whose roots are 1, 1, and 2 3. The polynomial p(x) of degree 3 such that p(O) = 2, p(l) and p(3) = 8 4. The polynomial p(x) of degree 3 such that p(i) p(i 3 ) = 2i + 4, and p(i4) = 0, where i 2 = 1
=
2i
= 0,
+ 4,
p(2)
p(i 2 )
= 0, =
0,
It takes four parameters to determine a polynomial of degree 3. Note that, in the second description, the fourth parameter is the leading coefficient, which is taken to be 1.
12.5. DISCRETE FOURIER TRANSFORMS
293
Polynomial interpolation takes us from a representation of a polynomial in terms of its function values (item 3 in the preceding list) to a representation in terms of its coefficients (item 1). In this section we will present a very fast algorithm for converting between the coefficients (item 1) and the function values at powers of a primitive root of 1. What is a primitive root of I? In the complex numbers, i 2 = 1, so i4 = (1) 2 = 1. We say that i is a fourth root of 1. The complex number i is a primitive fourth root of 1 because in =f. 1 for n = 1,2,3. Instead of the complex number i, we will use a primitive root of 1 in a Galois field GF q . The algorithm for converting from coefficients to function values is called the fast Fourier transform (FFT). The algorithm for converting from function values to coefficients is called fast Fourier interpolation (FFI). For each sequence Xo, Xl,···, Xnl
from GFq , we can form the polynomial f(t)
= Xo
+ Xlt + X2t2 + ... + Xn_lt n  l
We want to compute its values at the nth roots of unity in GFq . If w is a primitive nth root of unity, then the nth roots of unity are 1, W, w2 , .•. , wn  l . The values of f (t) at the nth roots of unity are
f (w) f (w 2 )
f (w n  l )
If we let
=
Yk
+ Xl + X2 + ... + Xnl = Xo + XIW + X2w2 + ... + Xn_lW n  l = Xo + XIW 2 + X2w4 + ... + X n _lW 2 (nl)
(1) =
f
Xo
= Xo + XIW n  l + X2w2(nl) + ... + Xn_lW(nl)(nl)
f(w k ),
then these equations can be written in the matrix form
1 1 1
1
1
1
Xo
W 2 w
w2 w4
wn l w 2 (nl)
Xl
Yl
X2
Y2
1
wn l
w 2 (nl)
w(nl)(nl)
Xn
Yn
Yo
The square matrix is a Vandermonde matrix. The general Vandermonde matrix is an n by n matrix of the form
V
(ao,
aI, a2,···, anI)
=
nl ao nl
1 1 1
al a2
a~
nl a2
1
anl
a;_l
nl a n l
ao
a5 a 21
al
294
CHAPTER 12.
POLYNOMIAL ALGORITHMS AND FFTS
In our case this matrix is
v=
V (w)
=V
2 n l (1,w,w , ... ,w  )
1 1 1 1
1
1
1
w2
w2 w4
wn l w 2(nl)
wn l
w 2(nl)
w(nl)(nl)
W
The matrix equation y = Vx gives the values Yo, Yl, ... , Ynl of the polynomial f at the nth roots of 1 in terms of its coefficients xo, Xl, X2, ... , Xnl. Polynomial interpolation (calculating the coefficients of a polynomial from its values at selected points) amounts to solving the matrix equation y = V x for x. If Vl is the inverse matrix of V, then x = Vly. The Vandermonde matrix has a particularly simple inverse. In fact, let (= w l . Then 1, (, (2, ... , (nl are also nth roots of 1 and are equal to 1, W, w 2 , ... , w n  l in some order. In fact, (i = w n  i . With a moderate amount of calculation (see problem 7) you can see that 1
1
w
(
As ( = w l , it is fairly easy to see that the diagonal entries of the product are all equal to n. That the offdiagonal entries are all 0 is a consequence of the fact that w is a primitive nth root of 1. The offdiagonal entries have the form
1 + 0 + 02 + 03 + ... + Onl where 0 :f:. 1 is an nth root of 1. But
so 0 = 1 + 0 + 02 + 03 + ... + Onl . It follows that (V (w))l = n l V(w l ), so x = n l V(w l )y. Thus interpolation is closely related to polynomial evaluation. In practice, we choose n to be a power of 2, say n = 2m . If w is a primitive
12.5. DISCRETE FOURIER TRANSFORMS
295
nth root of unity, then nl
=
f (w)
"~XiW i i=O
n/2l
=
l:
n/2l
n/21
=
"~
X2iW 2i +W "~ X2i+lW 2i
i=O
X2i (W 2)i +W
i=O
n/2l
i=O
l:
X2i+l (W 2)i
i=O
So f(w) can be computed by calculating two sums, each of which contains only half the original number of terms. We break the original sum into its even and odd terms, then factor w out of the odd terms. In the final algorithm, this process is repeated until each part contains only one term, which is easily evaluated. Notice that w 2 is a primitive (n/2)th root of 1. The resulting algorithm is recursive. Example 12.12 We will use the preceding equations to convert from coefficients to function values at the 8th roots of 1 in GF17 . Notice that w = 2 is a primitive 8th root of 1 because wO = 1, wl = 2, w 2 = 4, w3 = 8, w4 = 16, w5 = 15, w6 = 13, w7 = 9, and w8 = 1 in GF17 . We will evaluate the polynomial f(x) = 1 + x + 2x2 + x 3 + 3x4 + 2x 5 + x 6 + 2x7 at wi, for i = 0,1,2,3,4,5,6,7. By substituting y = x 2 and z = y2 into f(x), we get f (x) = 1 + x + 2x2 + x 3 + 3x4 + 2x 5 + x 6 + 2x7
= 1 + 2y + 3y2 + y3 + x (1 + y + 2y2 + 2y3) = 1 + 3y2 + y (2 + y2) + x (1 + 2y2 + Y (1 + 2y2)) = 1 + 3z + y (2 + z) + x (1 + 2z + Y (1 + 2z)) We evaluate each of the four polynomials 1 + 3z, 2 + z, 1 + 2z, and 1 + 2z at
z = 1 and z = 1 to get 1 + 3z
2+z
1 + 2z
1 + 2z
1+3=4 1 3 =2
2+1=3 21=1
1+2=3 1 2 =1
1+2=3 1 2 =1
At the next layer, the two polynomials 1 + 2y + 3y2 + y3 = 1 + 3z + y (2 + z) and
1 +y+2y2+2y3 = 1 +2z+y (1 + 2z) are evaluated at y = wO = 1 (using z = 1),
Y = w2 = 4 (using z = 1), Y = w4 = 1 (using z = 1), and y = w6 = 4
(using z
= 1) to get WU w2 w4 = w6
1 4 1 4
1 + 3z + y (2 + z) 4 + 1 (3) = 7 2+4(1) = 2 4  1 (3) 1 24(1) = 6
1 + 2z + y (1 + 2z) 3 + 1 (3) 6 1+4(1) 5 3  1 (3) = 14(1) 3
°
296
CHAPTER 12.
POLYNOMIAL ALGORITHMS AND FFTS
Finally, we evaluate the original polynomial f (x) = 1 + x + 2X2 + x 3 + 3x4 + 2x 5 + x 6 + 2x7
= 1 + 3z + Y (2 + z) + x (1 + 2z + Y (1 + 2z)) at x
= wi, for i = 0,1,2,3,4,5,6,7, to get x wO w1 w2 w3 w4 w5 w6 w7
1 2 4 8 1 2 4 8
f (x) 7+6 2 + 2 (12) 1 + 4 (0) 11 + 8 (3) 76 2  2 (12) 1  4 (0) = 11 8 (3)
13 9 1 1 1 12 1 4
The following FFT algorithm uses the fact that wn+k = w k if w is a primitive 2nth root of 1. Algorithm 12.4
FFT algorithm
Input: N a power of two, w a primitive Nth root of one, x= (XO,Xl,X2, ... ,XNd Output: y = (Yo, Yl, Y2,···, YNl) where Yi = Xo + X1W i + X2 (W i )2 + ... + XNl (wi)Nl Function FFT(N,x,w) If N= 1 then Set Yo = Xo else Set n = N/2 Set xeven = (xo, X2, X4,···, X2n2) Set xodd = (Xl,X3,X5,'" ,X2nl) Set yeven = FFT (n, xeven, w 2 ) Set yodd = FFT(n,xodd,w2) Do for k = 0 to n  1 Yk = yevenk +w k yodd k Yn+k = yevenk w k yodd k Loop End If Return y = (Yo, Yl, Y2,···, YNl) The FFT algorithm we gave is recursive so a lot of bookkeeping was done for you. To implement this algorithm without recursion requires some care. We illustrate with n = 8. We start with the polynomial f (t) = Xo + Xlt + X2t 2 + X3t3 + X4t4 + X5t5 + X6 t6 + x7t1
12.5. DISCRETE FOURIER TRANSFORMS
297
and want to compute the function values
f (1) = Xo + Xl + X2 + X3 + X4 + X5 + X6 + X7 f (w) = Xo + XlW + X2w2 + X3w3 + X4w4 + X5w5 + X6w6 + X7w7 f f f f f f
2 (w ) 3 (w ) 4 (w ) 5 (w ) 6 (w ) 7 (w )
+ XlW 2 + X2W4 + X3w6 + X4 + X5w2 + X6w4 + X7 w6 = Xo + XlW 3 + X2w6 + X3w9 + X4w4 + X5w7 + X6W2 + X7W 5 = Xo + XlW 4 + X2 + X3w4 + X4 + X5w4 + X6 + X7W 4 4 5 = Xo + XlW + X2w2 + X3w7 + X4W + X5W + X6w6 + X6 w3 = Xo + XlW 6 + X2W 4 + X3W2 + X4 + X5W6 + X6w4 + X6 w2 7 4 = Xo + XlW + X2w6 + X3W5 + X4W + X5w3 + X6w2 + X6 W =
Xo
The algorithm has two phases: a permuting phase and a combining phase. In the permuting phase, we rearrange (permute) the sequence Xo, Xl, X2, X3, X4, X5, X6, X7 so that it becomes XO,X4,X2,X6,Xl,X5,X3,X7 as shown in Figure 12.5.
Permute Xo
Xo
Xl
X4
X2
X2
X3
X6
X4
Xl
X5
X5
X6
X3
X7
X7
Figure 12.5
Permutation phase
The permuted indexes, 0,4,2,6,1,5,3,7 are obtained from the original indexes, 0,1,2,3,4,5,6,7, by reversing their binary representations: 1 = 0012 becomes 1002 = 4, while 2 = 0102 becomes 010 2 = 2, and so on. For n = 16, we use four bits for the binary representation, so the sequence 0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15 becomes 0,8,4,12,2,10,6,14,1,9,5,13,3,11,1,15
In the combining phase, we work on a sequence Yo, Yl, Y2, Y3, Y4, Y5, Y6, Y7 which is initially equal to Xo, X4, X2, X6, Xl, X5, X3 , X7 and is then repeatedly modified. There are log2 n steps. For n = 8, there are three steps. In step k, the two entries are replaced by
CHAPTER 12.
298
POLYNOMIAL ALGORITHMS AND FFTS
for each i such that i mod 2k < 2kl. Note that wm = 1 if n divides m. The first three steps are
Step 1 Step 2 Step 3
(Yi, Yi+l) (Yi, Yi+2)
7
(Yi, Yi+4)
7
7
+ Yi+l, Yi  Yi+d + w in / 4Yi+2, Yi  Win / 4Yi+2) in 8 in 8 (Yi + w / Yi+4, Yi  w / Yi+4)
(Yi (Yi
for imod2 = 0 for imod4 = 0,1 for imod8 = 0,1,2,3
For n = 8, this is
for imod2 for imod4 for imod8
Step 1 Step 2 Step 3
=0 = 0, 1 = 0,1,2,3
Here is a picture of the three combining steps for n = 8:
Xo X4 X2 X6
Xl X5 X3 X7
:8: :8: :8:
a+b ab
X
a+b ab
Figure 12.6
Combine
Combine
Combine
a+b ab a+b ab
~ ~
a+b a+w 2 b ab aw 2 b a+b 2 a+w b ab aw 2b
\ I \' 'I
a+b a+wb a w 2b ~
I
w3b~ a ab; a wb c a w 2b
,
7 .\ I \
+ +
a w3b
Combination phase
Here are the contents of Yo, YI, Y2, Y3, Y4, Y5, Y6, Y7 after each step:
.

Step 1
Step 2
+ X2 + X4 + X6 + W:lX2  X4  W:lX6 Xo  X2 + X4  X6 Xo  W:lX2  X4 + W:lX6 Xl + X3 + X5 + X7 Xl + W~X3  X5  W:lX7 Xl  X3 + X5  X7 Xl  W2X3  X5 + W2X7
Yo
Xo
YI
X4
Xo +X4 Xo  X4
Y2
X2
X2 +X6
Y3
X6
X2  X6
Y4
Xl
Y5
X5
Xl + X5 Xl  X5
Y6
X3
Y7
X7
X3 +X7 X3  X7
Xo Xo
.. ~
E
r


12.5. DISCRETE FOURIER TRANSFORMS
299
Step 3
+ Xl + X2 + X3 + X4 + X5 + X6 + X7 + Xl W + X2W~ + X3W,j + X4W" + X5Wo + X6Wo + X7W( Xo + XIW~ + X2W" + X3Wo +X4 + X5W~ + X6W4 + X7Wo 7 o Xo + Xl W,j + X2W + X3Wl! + X4W4 + X5W + X6W~ + X7W5 Xo + XIW" + X2 + X3W4 + X4 + X5W4 + X6 + X7W4 O 7 5 Xo + Xl W + X2W~ + X3W + X4W4 + X5W + X6W + X6W
Yo
Xo
YI Y2 Y3 Y4 Y5 Y6 Y7
We repeat the previous example. Example 12.13 Let p = 17 and notice that modulo p. To evaluate the polynomial
at each of the powers W O = I, WI = 2, w2 w6 = 13, w7 = 9 we proceed as follows:
W
=
= 2 is a primitive 8th root of 1
4, w3 = 8, w4
=
16, w5
Permute Xo
Xl X2 X3 X4 X5 X6 X7
=1 =1 =2 =1 =3 =2 =1 =2
1 3 2 1 1 2 1 2
Figure 12.7
Combine
Combine 1 3 2 1 1 2 1 2
X ~
X
X
Figure 12.8
Permutation Phase
4
15 3 1 3 16 3 16
i i
Combination phase
Combine 7 2 1 11
6 12 0 3
13 9 1 1 1 12 1 4
15,
CHAPTER 12.
300
POLYNOMIAL ALGORITHMS AND FFTS
We conclude that
Problems 12.5 1. Describe the polynomial
f (x)
= 3 (x
+ 1) (x 
2) (x  5) in terms of
(a) its coefficients, (b) its values at x
= 0,1,2,3,
(c) its values at x
= i,i 2 ,i 3 ,i4, where i 2 = 1,
(d) its zeros and its leading coefficient. 2. Repeat the preceding problem with
f (x) = x  x 3 .
3. Use the nonrecursive FFT algorithm to compute f (wi) for i = 0,1,2,3,4, 5,6,7 where f (t) = t and w is a primitive 8th root of 1. Verify your answer by direct evaluation. 4. Repeat the preceding problem with
f (t) = e.
5. Use the nonrecursive FFT algorithm to compute f (Wi) for i = 0,1,2,3,4, 5,6,7 in GF17 for w = 2 and f (t) = 3 + 6t + 4t 2 + 5t4 + t 6 + 8t7. Verify your answer by direct evaluation modulo 17. 6. Repeat the preceding problem in GF41 with w = 3. Verify your answer by direct evaluation modulo 41. 7. Let w be a primitive nth root of 1 in a field. For (
(j
1
1
w
wn 1
wn 1
w(nl~(nl)
1
1 (
~
(nl
)C
= w 1 , show that
C~' 1
)
((nl~(nl)
° ...
0n n
=
°
8. Verify the equation in the previous problem directly for w equal to the complex number i.
12.6. FAST FOURIER INTERPOLATION
301
9. Show that 1 1 1
det
ao
al a2
a 02 a2 1
= II (ai
a~
 aj)
i>j
1 anl
a~_l
10. Verify that
det
(~ ~
1 3
!)
= (3  2) (3  1) (2  1)
9
by evaluating both sides. 11. Let 8 be a root of X4
det
+ x + 1 in GF l6 .
Verify that
11 1 8 ( 1 82
by evaluating both sides.
12.6
Fast Fourier Interpolation
The fast Fourier transform is a quick way to transform coefficients into function values. The reverse process, going from function values to coefficients, is called interpolation (see page 294). It is a remarkable fact that interpolation can also be done with the fast Fourier transform. This is so because if y = V (w ) x, then x = nlV (w l ) y Note that if w is a primitive nth root of 1, then so is w l . The fast Fourier interpolation algorithm is simply the FFT with one additional step. Algorithm 12.5 Fast Fourier interpolation Input: N a power of two, w a primitive Nth root of one, y = (Yo, Yl,···, YNl) Output: x = (XO,Xl, ... ,XNl) such that . (.)2 ( o)Nl Yi = Xo + XlW' + X2 w· + ... + XNl w' Function FFI(N,y,w) Return x = N l FFT (N,y,w l )
CHAPTER 12.
302
POLYNOMIAL ALGORITHMS AND FFTS
Example 12.14 Consider the polynomial with given function values
x (t) =
Xo
+ X1t + X2t2 + '" +
XN_1tN1
We use FFI to find the coefficients of the polynomial x (t). We first apply the permutation phase to get Figure 12.9.
Permute 5 13 7 2 3 9
Yo = 5 Y1 = 3 Y2 = 7
Y3 = 0 Y4 = 13 Ys = 9 Y6 = 2 Y7 = 12
o
12 Permutation phase
Figure 12.9 Since w 1 12.10.
=
2 1 mod 17 = 9, we have the combination phase given by Figure
Combine 5 13 7 2 3 9 0 12
X
::8: ~
X
Figure 12.10
Combine
Combine
~ ~
1 9 9 5 12 11 12 5
10 6 9 12 7 8 0 14
Combination phase
Multiplication of the last column by 8 1 mod 17 = 15 yields
15
0 10 9 1 3 2 9 6
mod 17
=
0 14 16 15 11 13 16 5
0 10 9 1 3 2 9 6
12.6. FAST FOURIER INTERPOLATION
303
As a check, we evaluate the polynomial y (t) = 14t + 16t 2
+ 15t3 + llt4 + 13t5 + 16t6 + 5t1
at powers of 2 and note that the results
produce the initial coefficients. Is the FFT really fast? Let's see how long it takes to do a Fourier transformation without it. Let F be a field,
a' polynomial of degree at most N  1 with coefficients in F, and w a primitive Nth root of one in F. We need to evaluate f (wi) for i = 0,1, ... , N  1. The most efficient way to evaluate f (t) at an element a in F is by nesting. We illustrate with N = 8:
You can see that this computation requires seven additions and seven multiplications for a polynomial of degree at most seven. For a polynomial of degree at N  1, it requires N  1 additions and N  1 multiplications, a total of 2N  2 steps. So evaluating f (Wi) for i = 0,1, ... , N  1 in this way requires N (2N  2) = 2N (N  1) steps. How many steps does it take to do these computations with the FFT? Let Cn be the number of steps the FFT algorithm takes for a polynomial of degree at most n 1. Recall that for the FFT, the number n is a power of 2. The basic equation for the recursive algorithm is
Cn = 2Cn /2
n
+ 42
The first 2 is because the FFT algorithm for n calls the FFT algorithm for n/2 twice. The term 4 (n/2) is for the four operations, two multiplications, one addition, and one subtraction, each performed n/2 times after the two calls to the FFT algorithm for n/2. By iterating this equation we get
Cn
2Cn /2
n
+ 42 =
2Cn /2
+ 2n
2(2C /4 + 4~) + 2n = 22C /4 + 4n 22 (2C + 4i) + 4n = 2 c + 6n n
n
n /8
3
n /8
The pattern is now fairly clear. For each i from 1 to 10g2 n we have
CHAPTER 12.
304
POLYNOMIAL ALGORITHMS AND FFTS
In particular, when i = 10g2 n we get
en = But
CI
nCI + 2nlog2 n
= 0 because there are no operations involved in the first step. So
en = 2nlog2n What about the computation of the powers w k in the loop? The most efficient thing to do is to calculate all N /2 of these powers at the beginning, before entering the recursive FFT algorithm. This will require N /2  1 more multiplications in addition to the CN steps of the recursive algorithm, so the total number of steps is N "2  1 + 2N 10g2 N Compare these two numbers when N = 1024. The straightforward Fourier transform takes
2N (N  1) = 2·1024·1023 = 2,095,104 steps, while the fast Fourier transform takes
N "2 
1 + 2N 10g2 N
= 511 +
2 . 1024· 10 = 20,991
steps. Suppose F is a field and w E F is a primitive Nth root of 1. For example, the field GFp has a primitive Nth root of 1 if p  1 is divisible by N. If N is a power of 2, then the FFT and FFI algorithms can be combined to produce a fast multiplication for polynomials f (t) and 9 (t) in F ttl whose product has degree less than N. Here is how you do it. Let f and g be the lists of coefficients of f (t) and 9 (t). First form the Fourier transforms
and FFT (N,g,w) = (g (wO) ,g (WI),
... ,g (W N I))
Then take the componentwise product of these two transformations
Finally, x = FFI (N, y, w) gives the list of coefficients of the product f (t) 9 (t) of the two polynomials. Why is this faster than ordinary multiplication of polynomials? Suppose the degrees of f (t) and 9 (t) are N /2 and N /21. The polynomials have N /2+ 1 and N /2 coefficients, so ordinary multiplication requires N 2 /4+ N /2 multiplications in the field F. We have to sum these N 2 /4 + N/2 products into N sums, so
12.6. FAST FOURIER INTERPOLATION
305
the number of additions required is N 2 /4 + N/2  N = N 2 /4  N/2. Thus the total number of operations is N 2 /2. With fast multiplication of polynomials, we have three Fourier transforms and N multiplications in the field. The number of steps in a fast Fourier transformation is N /2  1 + 2Nlog2 N. For N = 1024, this last number is 20991, so the number of steps for the fast multiplication is 3·20991 + 1024 = 63997, while the number of steps for ordinary multiplication is 10242 /2 = 524288. Example 12.15 We compute the product of the two polynomials f (t) = 1 + 5t + 3t 2 + t 4 and 9 (t) = 3 + 5t + 4t4 in GF17 [xl by using FFT to evaluate each of these polynomials at Wi for i = 0,1,2,3,4,5,6,7, where w = 2; then using pointwise multiplication to get the function values of the product at Wi for i = 0,1,2,3,4,5,6,7; and then using FFI to get the coefficients of the product. , We first apply FFT as in Example 12.13 to get function values of f (t) = 1 + 5t + 3t 2 + t 4 and 9 (t) = 3 + 5t + 4t4, then calculate products to generate the following table:
f (2il 0 1 2 3 4 5 6 7
10 5 2 11 0 2 13 16
9 (2il 12 9 10 5 2 6 4 10
f (2il 9 (2il 1 11 3 4 0 12 1 7
To calculate the coefficients of f (t) 9 (t), we use FFT with w 1 = 2 1 mod 17 = 9 as in Example 12.14 to get the polynomial
Problems 12.6 1. Find a prime of the form p = 25k + 1, and then find an element w in G Fp of order 25. 24 2. Verify that p = 2529 + 1 = 929 is a prime. Calculate a 29 . mod 929 for a 29 24 few values of a until you find one such that a . mod 929 =f. 1. Use that to construct an element of order 32 = 25 in G F929 •
3. Observe that 28 + 1 = 257 is a prime. Find an element w in GF257 of order 28. 4. Find a prime of the form p of order p  1.
= 2n + 1 for n >
8. Find an element win GFp
306
CHAPTER 12.
POLYNOMIAL ALGORITHMS AND FFTS
5. Verify that p = 1 + 230.37.58.73.112 .13.172 ·19·23 is a prime. Find an element of order p 1 in GFp • Use this to find an element of order 230 in GFp • 6. Show that if w is a primitive nth root of 1, then w 1 is also a primitive nth root of 1. 7. Let w be a root of f (x) = x 5 +2x+ 1 in GF 243 . Show that w is a primitive 242nd root of 1. Find w 1 . What is the minimal polynomial of w 1 7 8. With reference to the discussion on page 303, prove by induction on i that the formula en = 2i cn /2i + 2in is correct for i = 1,2, ... ,log2 n. 9. Let f (t) and 9 (t) be polynomials of degrees a and b with coefficients in a field. Show that multiplication of f (t) by 9 (t) requires (a + 1) (b + 1) multiplications of field elements, and ab additions of field elements. 10. How many steps does the fast Fourier transform take for N = 20487 How does this compare to the number of steps for N = 10247
Appendix A
Topics in Algebra and N umber Theory The application of algebra to codes, ciphers, and discrete algorithms relies on several topics in algebra and number theory. These topics are introduced in the text, but we collect some of the basic definitions and properties together here for easy reference.
A.I
Number Theory
Number theory is the study of the integers, ... , 3, 2, 1,0,1,2,3, ... , and how they behave under addition and multiplication. Often we deal with just the nonnegative integers, 0,1,2,3, ... , or with the positive integers, 1,2,3,4, .... We say that an integer n divides an integer m, and write nlm, if there is an integer a such that na = m. We also say that m is a multiple of n or that n is a divisor of m. If a and b are integers that are not both zero, then the greatest common divisor d of a and b is the largest of the common divisors of a and b. We write the greatest common divisor of a and b as d = gcd(a, b). Euclid gave an algorithm to compute the greatest common divisor over 2000 years ago, and this is still used extensively. The Euclidean algorithm takes only a modest number of steps to compute gcd (a, b). An integer p > 1 is a prime if its only positive divisors are 1 and p. The first five primes are 2, 3, 5, 7, and 11. Primes, especially very large primes, play a very important role in cryptography. An integer n > 1 that is not prime is called a composite. The first five composites are 4, 6, 8, 9, and 10. The fundamental theorem of arithmetic says that factorization of positive integers into primes is unique. Of course 2 . 2 . 3 and 2 . 3 . 2 are both ways of writing 12 as a product of primes, but they are not essentially different. The product is unique if we arrange the primes in order of size. Theorem (The Fundamental Theorem of Arithmetic) Every integer greater than 1 is either a prime or can be written uniquely as a product of primes. 307
308
APPENDIX A. TOPICS IN ALGEBRA AND NUMBER THEORY
Modular arithmetic provides many powerful tools. If nand m are integers with m > 0, then we define nmodm = nln/mJ m, where In/mJ is the largest integer that is less than or equal to n / m. Note that n mod m is the remainder when dividing n by m. For each positive integer m, this determines a congruence relation, on the integers. We say a is congruent to b modulo m and write a == b if a mod m = b mod m, or equivalently, if m divides the difference ab. The Chinese remainder theorem is a statement about simultaneous congruences. Theorem (Chinese Remainder Theorem) Let ml, m2, ... , mr be pairwise relatively prime positive integers. Then the system x == ai (mod mi), i = 1,2, ... , r has a unique solution modulo mIm2 ... m r . Codes, ciphers, and discrete algorithms are often based on the computational complexity of "hard" problems, such as the integer factorization problem in number theory. Among the important theorems and techniques in number theory we present in this text are the Euclidean algorithm, Fermat's little theorem, Euler's theorem, the principle of mathematical induction, Wilson's theorem, and the Chinese remainder theorem. The theorems and techniques of number theory are so pervasive in cryptography that if we gave any reasonably complete summary here of pertinent parts of the field, we would essentially be repeating this entire text. For further information about number theory and how it relates to codes, ciphers, and discrete algorithms, see the following items in the index: aI mod m; a == bmod m; Absolute value; Carmichael numbers; Ceiling; Chinese Remainder Theorem; Common divisor; Complete residue system; Composite; Congruence class; Congruence relation; Congruent; Disjoint cycles; Division algorithm for integers; Divisor; Euclidean algorithm; Euler phi function; Euler's theorem; Fermat's last theorem; Fermat's little theorem; Floor; Fundamental theorem of arithmetic; Greatest integer; Induction; Integer; Inverse modulo m; Least common multiple; Least nonnegative residue system; Mathematical induction; Method of exhaustion; Miller's test; Modular arithmetic; Mod function; Modular representation; Nonnegative integer; Pairwise relatively prime; Pascal's triangle; Positive integer; Primality testing; Prime; Principle of mathematical induction; Probabilistic primes; Pseudo prime; Rabin's probabilistic primality test; Reduced residue system; Relatively prime; Residue system; Sieve of Eratosthenes; Systems of linear equations modulo n; Wilson's theorem.
A.2
Groups
A group is a basic algebraic system. The theory of groups is one of the oldest branches of algebra, and has applications in many areas of science as well as in other parts of mathematics. A binary operation on a set is a way of putting two elements of a set together to get a third element of that set; that is, a binary
A.2. GROUPS
309
operation on a set S is a mapping S x S + S. A group is a set with a particular kind of binary operation on it. Here is a formal definition. Definition A group is a nonempty set G with one binary operation, often indicated simply by juxtaposition of elements of G, such that 1. a(bc) = (ab)c for all a, b, c in G.
2. There is an element 1 in G such that al = la = a for all a in G. 3. For each a in G, there is an element a 1 in G such that aa 1
= a 1 a = 1.
The group is commutative if (4.) holds:
4. ab
= ba for all a, bin G.
The group is cyclic if (5.) holds: 5. There is an element 9 E G such that every element a E G can be written as a = gm for some integer m, positive, negative, or zero. Here the convention is that gm = (gl) m and gO = 1. If G is a finite group, the number of elements of G is called the order of the group G. If a is an element of a finite group G, there is a smallest positive integer t such that at = 1. This integer is the order of the group element a. If S is a subset of G for which ab E Sand a 1 E S for every pair of elements a, b E S, then S is a group under the operation of G. Such an S is called a subgroup of G. If a E G has order t, then (a) = {I, a, a 2 , a3 , ..• , at  1 } is a subgroup of G. Note that (a) is a cyclic group. Also note that the order of a and the order of (a) are the same, so the two uses of the word "order" are consistent. Here are two basic facts relating the orders of groups and of their elements and subgroups: Theorem (Lagrange) If S is a subgroup of the finite group G, then the order of S divides the order of G. Applying Lagrange's theorem to the case S = (a) gives the following. Theorem If a is an element of a finite group G, then the order of a divides the order of G. Example Here are several important examples of groups:
• The integers form a group under addition. This is an infinite group. • The integers mod m form a finite group under addition. • The set of permutations of {O, 1,2, ... , n} forms a finite group under the operation of concatenation. For further information about groups and how they relate to codes, ciphers, and discrete algorithms, see the following items in the index: Commutative group; Cyclic group; Group; Group of symmetries; Inverse permutation; Lagrange's theorem; Multiplicative group of a field; Order of a group; Order of a group element; Permutation; Product of permutations; Subgroup; Symmetric group.
310
APPENDIX A. TOPICS IN ALGEBRA AND NUMBER THEORY
A.3
Rings and Polynomials
In a ring you can add, subtract, and multiply. Definition A ring is a set R with an addition and a multiplication satisfying 1. a + (b
+ c)
= (a
+ b) + c for all a, b, c in R
2. a + b = b + a for all a, b in R
3. there is an element 0 in R such that a + 0 = a for all a in R 4. for each a in R there exists a in R such that a + (a) = 0
5. a(bc) = (ab)c for all a, b, c in R 6. a(b + c) = ab + ac for all a, b, c in R
A ring R is a ring with identity if 7. there is an element 1 in R such that 1a
= a1 = a for all a in R
A ring R is commutative if 8. ab = ba for all a, b in R
Example
Here are several important examples of rings:
• The integers are a commutative ring with identity. • The 2 x 2 matrices over the integers with the usual matrix addition and multiplication form a noncommutative ring with identity. • The set of even integers is a commutative ring without an identity. Consider polynomials with coefficients in an arbitrary ring. Given two polynomials
f(x) g(x)
ao + alX + a2x2 + ... + anx n bo + b1x + b2x2 + ... + bmxm
we add them by adding their coefficients. The coefficient of xi in the sum f(x) + g(x) is ai + bi , where we set ai = 0 if i > nand bi = 0 if i > m. The coefficient dk of xk in the product f(x) . g(x) is given by
dk =
L
aibj
i+j=k that is do = aobo, d1 = aOb l + albo, d2 = aOb2 + alb l + aOb2, ... , dm+n 1 = anIbm + anb m l , and dm+n = anbm . This is the product you get if you simply multiply f (x) and g (x) using the usual laws. • The set of polynomials with coefficients in a commutative ring with identity is itself a commutative ring with identity.
AA. FIELDS
311
• Of particular interest is the ring F [xl of polynomials over a field F (see next section). Note that a polynomial of degree greater than zero does not have a multiplicative inverse. For further information about rings and polynomials and how they relate to codes, ciphers, and discrete algorithms, see the following items in the index: Commutative ring; Division algorithm for polynomials; Extended Euclidean algorithm; Generator polynomial. Greatest common divisor of integers; Greatest common divisor of polynomials; Greatest integer; Irreducible polynomial; Kronecker's algorithm; Lagrange interpolation; Minimal polynomial; Neville's iterated interpolation algorithm; Polynomial division; Polynomial division algorithm; Polynomial interpolation; Polynomial remainder; Polynomial ring; Primitive element; Primitive polynomial; Primitive root; Rational root theorem.
A.4
Fields
In a field you can add, subtract, multiply, and divide. Definition A field is a set F with an addition and a multiplication satisfying 1. a + (b
2. 3. 4.
+ c) = (a + b) + c for all a, b, c in F a + b = b + a for all a, b in F There is an element 0 in F such that a + 0 = a for all a in F For each a in F there is an element a in F such that a + (a) = 0
5. a(bc) 6. ab
= (ab)c for
= ba for
all a, b, c in F
all a, b in F
7. There is an element 1 in F such that a1
8. a(b + c)
= ab + ac for
= a for
all a in F
all a, b, c in F, and
g. For each nonzero a in F there is an element aI in F such that aa 1 = 1.
Example
Here are several important examples of fields:
• Take F to be Zp = {O, 1,2, ... ,p  I} with addition and multiplication modulo p, then Zp is a field. This field is also denoted by GFp, and called the Galois field of order p. • The rational numbers Q form a field as do the real numbers JR., and the complex numbers C. These three fields are infinite. The applications to codes, ciphers, and finite algorithms in this text rely primarily on finite fields.
312
APPENDIX A. TOPICS IN ALGEBRA AND NUMBER THEORY
The following idea of how to construct a field from a field and an irreducible polynomial is due to Kronecker . • Let F be a field and h (x) an irreducible polynomial of degree m in F [xl. Define K to be the set of congruence classes of polynomials in F [xl modulo h (x). Let () be the congruence class of the polynomial x, so if f (x) E F [x], then the congruence class of f (x) is f (()). Define multiplication in K by setting f (()) 9 (()) = r (()) where r (x) = (f (x) 9 (x)) mod h (x). This turns the set K into a field. If F is a finite field of order q, then the order of K is qm. For further information about fields and how they relate to codes, ciphers, and discrete algorithms, see the following items in the index: Binary representation of field element; Cayley table; Fast Fourier interpolation; Fast Fourier transform; Field; Galois field; G Fp; G Fpn ; Multiplicative group of a field; Primitive element; Primitive polynomial; Primitive root; Splitting field.
A.5
Linear Algebra and Matrices
A matrix is a rectangular array of numbers or other algebraic expressions that can be added and multiplied. One application of matrices is to keep track of coefficients of linear equations. They are used in many ways in all of the mathematical sciences. The horizontal lines of a matrix are called rows and the vertical lines are called columns. A matrix with m rows and n columns is called an mbyn matrix. If either m = 1 or n = 1, the matrix is also called a vector. The product of an m x k matrix with a k x n matrix
( an
a12
alk
a21
a22
a2k
amI
am2
amk
b 12
b21
b22
bIn b 2n
bkl
bk2
bkn
) en
is the m x n matrix
en C21
C=
C22
Ctn
C2n
)
.
Cm l
where the
C12
Cm 2
Cmn
iph entry of C is given by Cij = 2.:;=1 airbrj.
)
A.5. LINEAR ALGEBRA AND MATRICES
313
The n x n identity matrix is
The inverse of an n x n matrix A is an n x n matrix B such that AB inverse is denoted B = AI. A system of m linear equations in n variables an X l a21 X l
+ a12 X 2 + ... + aln X n + a22 X 2 + ... + a2nXn
= I.
The
h =
b2
can be represented by the matrix equation
or by the augmented matrix a12
aln
a22
a2n
b2 ) b,
am2
a mn
bm
A system of linear equations can be solved by a series of steps (1) add a multiple of one equation to a second equation, (2) interchange two equations, or (3) multiply both sides of an equation by a nonzero constant. Applied to a matrix, this method is called row reduction. The object of row reduction is to end up with a matrix such that the first nonzero entry in each row is 1 (the leading 1) and the leading 1 in each row is to the right of the leading 1 in the previous row, as in the matrix 1 0 0 0
C12
C13
C14
C15
0 0 0
1 0 0
Cl5
C25
1 0
C35
1
d1 d2 d3 d4
0
0
0
0
0
dn
314
APPENDIX A. TOPICS IN ALGEBRA AND NUMBER THEORY
Such a matrix is said to be in row echelon form. To get the solution of the system of linear equations, reinterpret each row of the matrix as an equation and use back substitution. If the last nonzero row is
(0
0
1
Cij
it follows that n
Xjl
= di 
L
CikXk
k=j
where Xj, ... , Xn can be assigned arbitrary values. You get a similar equation for each variable corresponding to a column with a leading 1, which you can evaluate working from the last nonzero row to the first. The variables corresponding to columns without a leading 1 can be assigned arbitrary values. A system of n linear equations in n variables can be solved by using an inverse matrix, if you have one. If
then
provided there is an inverse matrix. The affine transformation given by a matrix A and a vector b is the map taking x to y = Ax + b. When such a transformation is used for encryption, we need to be able to reverse it. This can be done when A is invertible, in which case x = Al (y  b). The determinant function associates with every square matrix A a unique number det A obtained as the sum and difference of certain products of the entries. The determinant of the n x n matrix (aij) is det(aij) =
L
(_1/ 9n (a)
ala(1)a2a(2)'"
ana(n)
a
where a ranges over all the permutations of {I, 2, ... , n} and (_1/ 9n (a) = ±1, depending on whether a permutes an even or odd number of digits. Here are
A.5. LINEAR ALGEBRA AND MATRICES
315
some examples: det (
det
824 741 ( 216
65 979 663
~~
) = ad  be
814) 764 = 96396086 880
One important use of the determinant is that it gives a test for invertibility: a square matrix A is invertible if and only if det A :/= o. For further information about linear algebra and matrices and how they relate to codes, ciphers, and discrete algorithms, see the following items in the index: Boolean matrix, Hilbert matrix, Inverse matrix, Linear combination, Permutation matrix, Row reduction, Vandermonde matrix.
Solutions to Odd Problems Chapter 1
Integers and Computer Algebra
Problems 1.1 1. Let n = ab with a > 1 and b > 1. If a2 right kind. Otherwise a 2 > nand
::;
n, then a is a divisor of the
is a divisor of the right kind. 3. Note that 15 (3)
+ 24 (2) =
3, where 3115 and 3124.
5. A sum of two cubes factors as a3 29
+ 512 = =
(23)3 (23
+ b3 =
(a + b) (a 2

ab + b2 ), so
+ (54)3
+ 54)
((2 3)2 _ (2 3) (54)
+ (54)2)
= (633) (385689)
=
(3 x 211)(3 x 128563) = 3 2 x 211 x 128563
7. Let a, b, c, and d be arbitrary integers. (a) This is false. Indeed 4112 and 6112, but 4·6 = 24 does not divide 12. Even simpler, but maybe too simple: 212 and 212 but 2·2 = 4 does not divide 2. (b) If alb, then b = sa for some integer s. If ale, then c = ta for some integer t. So b + e = sa + ta = (s + t)a, which means that al(b + c). See also part iii of the theorem on properties of divisors. (c) This is false. Take a
= 2, b = 4, and c = 6.
(d) If alb, then b = at for some t, so b2 = a2 t 2 , which means that a 2 1b2 . 317
318
SOLUTIONS TO ODD PROBLEMS (e) This is false. Take a = 2, b = 4, e = 3, and d = 9. Note that 214 and 319, but 5 f 13. (f) Let b = as and d = ct. Then bd = aset = ae . st, which means that aelbd. (g) Let b = as. Then be = ase, which means that albe.
9. No. The number 13 is not divisible by 3. 11. Let P be a prime divisor of PIP2 ... Pk + 1. If P PIP2 ... Pk + 1 = Pin for some integer n. So
=
Pi for some i, then
1 = Pin  PIP2 ... Pk
= Pi (n 
PIP2··· PilPi+l ... Pk)
making Pi a factor of 1. That can't be, so P must be different from each prime Pi. This shows how, given any finite set of primes, you can find another prime not in that set. So there are infinitely many primes.
13.
4=2+2 6=3+3 8=5+3 10=7+3 12 = 7 +5 14 = 11 + 3 16 = 13 + 3 18 = 13 + 5 20 = 13 + 7 22 = 19 + 3
24 = 26 = 28 = 30 = 32 = 34 = 36 = 38 = 40 = 42 =
19 + 5 19 + 7 23 + 5 23+7 29+3 29+5 29+7 31 + 7 37+3 37 + 5
44 = 46 = 48 = 50 = 52 = 54 = 56 = 58 = 60 = 62 =
37 + 7 43+3 43+ 5 43 + 7 47 + 5 47 + 7 53 + 3 53 + 5 53+ 7 59 + 3
64 = 61 + 3 66 = 61 + 5 68 = 61 + 7 70 = 67 + 3 72 = 67 + 5 74=67+7 76 = 73 + 3 78 = 73 + 5 80 = 73 + 7 82 = 79+3
84 = 86 = 88 = 90 = 92 = 94 = 96 = 98 =
79 + 5 79 + 7 83+5 83 + 7 89 + 3 89 + 5 89 + 7 79 + 19
15. Note that each factorization of n! + 1 involves a prime or primes larger than n.
+1= 3! + 1 = 4! + 1 = 5! + 1 =
(a) 2!
3 is prime
(b)
7 prime
(c) (d)
52 composite
112 composite
(e) 6! + 1 = 7 x 103 composite (f) 7!
+ 1 = 71 2
composite
(g) 8! + 1 = 61 x 661 composite (h) 9! + 1 = 19 x 71 x 269 composite
PROBLEMS 1.2
319
17. If three numbers are consecutive odd numbers, they must look like n, n+ 2, n + 4, where n is odd. But if n is odd, then n = 2m + 1, where m is an integer. Thus, the three numbers are 2m + 1, 2m + 3, 2m + 5. If m = 1, we get the triplet 3, 5, 7. Suppose m > 1. If 2m + 1 is not divisible by 3, then dividing 2m + 1 by 3 gives a remainder of 1 or 2. If the remainder is 1, then 2m + 1 = 3k + 1 for some integer k, and 2m + 3 = 3k + 3 which is divisible by 3. If the remainder is 2, then 2m + 1 = 3k + 2, and 2m + 5 = 3k + 6 which is divisible by 3. Thus one of the three numbers is divisible by 3, and all are greater than 3, one of them is composite.
19. If n = 1, then n 2 + 1 = 2, a prime. But if n is an odd number greater than 1, then its square is also odd, and adding 1 gives an even number greater than 2, which is thus composite. So the answer to the first question is, if n is odd, n 2 + 1 is a prime if and only if n = 1. If n is even, then n 2 + 1 can be prime, for example 22 + 1 = 5 is a prime. But n 2 + 1 is not a prime for n = 8 because 82 + 1 = 65 = 5 x 13. 21. Yes. If n is composite, then n
= ab, where a > 1 and b > 1, so
2n 1 = 2ab_l = (2 a 1) (2 ab  a + 2ab  2a
which shows that 2 n also prime.
+ 2ab  3a + ... + 1)

1 is composite. Thus if 2 n
=
1. 592 7 x 10 3 and 12:;  1l'1

1 is prime, then n is
Problems 1.2 1. Note that 13.14  1l'1
=
1. 2645 x 10 3 , so
22/7 is the closer approximation to 1l'. 3. A computer algebra system produces 1l' places 5. Note that (_1)2/4
= 3.141592654 to ten decimal
= \1(1)2 = 1, whereas
(_1)1/2
=R
= i.
7. Let x = 0.33333333333 .... Then lOx = 3.33333333333 ... so subtracting gives 9x = 3.0, which implies x = 3/9 = 1/3. 9. Note that x = 3.489 and 100x 345.5 = 691/2. This gives
= 348.989, 691
so 99x
691
x = 2.99 = 198
As a check, compute 691/198
~
3.489898990.
= 348.989  3.489 =
SOLUTIONS TO ODD PROBLEMS
320 11. Here is one solution:
a
b ~ 0.469387 755 ~ 1
~
2+ ~
O.
130 4i4 783
1 1 0.469387 7551 ~ 2 + O. 130434783 1 1 ~ ~ 2+7+ 1r 2 + 7+0. 66~ 666 644
O. 666666644
1 2+
11
1
~
7 + 1+. 500 000051
2+ 7+ 1+ . 50000& 051
~
1
2+~
23 49
= 
~
Checking,
~~ ~ 0.469387755 1 Problems 1.3 10
1.
I: 2 =
10 2 + 2 + ... + 2
~
= 10 . 2 = 20
j=l 10
3.
10
I: I: (i + 1) (j + 1) = 4356. To see why this is correct, note that i=O j=O
n
5. I:k 3 = ~ (n+ 1)4  ~ (n+ 1)3 + ~ (n+ 1)2_1 k=2 mn+1 times
m
7.
I: 1 =
~
1 + 1 + ... + 1 = m  n + 1
k=n 5
9.
I: (1 + k
3
)
= (1 + 03) + (1 + 13) + (1 + 23) + (1 + 33) + (1 + 43) +
k=O
(1 + 53) = 1 + 2 + 9 + 28 + 65 + 126 = 231 10
11.
II i 2 = 12 . 22 . 32 . 42 . 52 . 62 . 72 . 82 . 92 . 102 = 12 . 22 . 32 . 24 . 52 . 22 . 32 . i=l
72 .2 6 .34 .2 2 .5 2 = 216385472
= 13168189440000
PROBLEMS 1.4
321
5
13.
II (n
2
+ n) = 27 33 52 = 86400
n=l m
15.
L
(ai
+ bi ) = an + bn + a n +1 + bn +1 + ... + am + bm = an + a n +1 + ... +
i=n
am
m
+ bn + bn +1 + ... + bm
L
=
m
ai
+L
i=n
bi
i=n
Problems 1.4 n
1.
L i 2 = ~ (n + 1)3 
~ (n + 1)2 + in + i = in (n + 1) (2n + 1). To verify
i=l
this result by induction on n, first note that with n = 1 we have 1
~ i 2 = 12 = 1 = ~ (1) (1 + 1)(2 (1) + 1) Then assume that k
Li
2
= ~k (k + 1) (2k + 1)
i=l
for some k ;::: 1. Then k+l
L
i 2 = (k
k
+ 1)2 + L i 2
i=l
i=l
= (k
=
1
+ 1)2 + "6k (k + 1)(2k + 1)
1
"6 (k + 1) ((k + 1) + 1) (2 (k + 1) + 1)
so, by the principle of mathematical induction, for all n ;::: 1 we have 1
n
~i2
= "6 n (n+ 1)(2n+
1)
3. A computer algebra system yields n
L k2k = (n + 1) 2 + n
1
2)
+2=

2 x 2n + 1
+2
k=l
which further simplifies to n
L k2k = 2 + n
1
(n
+1
2n +1 (n  1) + 2
k=l
See the disc for the proof by mathematical induction.
SOLUTIONS TO ODD PROBLEMS
322
5. The sum is given by
To verify this by induction, first observe that
Assume that for some n 2: 1,
~ (~)xr = (1 + x)n.
= + xn+1 + ~ ( (~) +
1
=l+xn+1+ n 1
= 1 +x +
=~
Then,
C: 1) )
xr
~(~)xr+ ~(r:1)xr
+~
(~)xr + ~ (~)xr+1
(~)xr +x ~ (~)xr = (1 +xt +x(l +xt
= (1 + x) (1 + xt = (1 + xt+1 ,,1 1 1 7. Dror n = 1,L..k=l 1(1+1) = "2 = n~l holds for some n. Then
n+1
t;
1 1+1·
Assume t hat
"n 1 L..k=l k(k+1)
n 1 k(k+1) = n+1 + (n+1)((n+1)+1) 1
n(n+2) 1 +,.......,,(n+1)(n+2) (n+1)(n+2) n2+2n+1 (n+1)2 n+1 = = (n+1)(n+2) (n+1)(n+2) n+2
=
9. For n = 1, we have 2::;=0 (;) = @ + G) = 1 + 1 = 21. Assume that 2::;=0 (~) = 2n holds for some n. In the next problem you are asked to
PROBLEMS 1.4
323
prove that
if 0 < r :::; n, and we use that here. So n+l
L r=O
(n+ 1)
=
r
n
L
r=l
=
(n+ 1) r+l
(n +o 1) + I: (n) + I: ( +n ) + (n ++ 1) r=O r=O r
=
r
1
1
n
(n~l) + (~(~) _ (~)) +
(~(~)  (~)) + (~:~)
= 1 + (2n  1) + (2n  1) + 1 = 2. 2n = 2n +1 11. For n = 1, we have (a + b)l = a+b = @albo+(Dallbl since 1. Assume that (a + bt = L~=o (~)anrbr. Then
@ = (D =
1 (a + bt+ = (a + b) (a + bt
= (a+b) ~ = a~
(~)anrbr
(~)anrbr + b~ (~)anrbr
(n: 1) an+1rbr r=O
= ... = ~
which shows that the formula also holds with n replaced with n + 1. (See the disc for details of this simplification.) 13. For n = 1 we have
since
G) = G) =
1. Assume that
324
SOLUTIONS TO ODD PROBLEMS Then
(x
+ yt+ 1 = (x + y) (x + yt = (x + y) ~ =x
t (~)xnryr t (~)xnryr +y
r=O
=
(~)xnryr
t
r=O
r=O
(~)xn+lryr +
I: (r:
l)xnr+lyr
r=l
=
(~)xn+lyO + ~ (~)xn+lryr + ~ (r: l)xn r+l yr
=
(~)xn+lyO + ~ [(~) + (r: 1)] xn+1ryr
which shows that the formula also holds with n replaced with n 15. Direct evaluation yields 16! = 20922789888000 14!5!2!
= 20922789888000
Note that 14! x 5! x 2!
= 14! x 24 x 3 x 5 = 14! x 16 x 15 = 16!
17. For n = 1 we have
~ v'5 (1 +2v'5) 1_~ v'5 (1  2v'5) 1= 1 = F1 _1 (1
v'5
+ 2
v'5)O __1 (1 v'5)O = 0 F. v'5 2 ° =
+ 1.
PROBLEMS 1.4
325
Suppose these two equations hold for n = k, so F = k
F _ = kl
(1 + J5) ~ (1 + J5 ~
J5
k _
2
(1 _J5) 1(1J5
~
J5
J5)kl _ _
2
k
2
J5)kl
2
Then
so the two equations hold for n = k
+ 1.
19. Notice that if x = 2, then n
Lk2k k=l
If we define
n
n
nl
k=l
k=l
k=O
= Lkxk = X Lkx k 1 = xL (k + l)xk nl
f (x) = L (k + 1) xk k=O then nl nl xn  1 x n +1  X f(x) dx= ~Xk+l =X ~xk = x   =   ~ ~ xI xI k=O k=O
J
SOLUTIONS TO ODD PROBLEMS
326 and hence
xf(x)=xd~ (xn:~~x) + 1) xn 
(( n =X
1) (x  1)  (Xn+ 1

X)
2
_xn+1
(x  1) + xn+2n  xn+1n + x
(x  1)2 xn+1 (nx  n  1) + x = (x  1)2 Therefore, n
Lk2k = 2f(2) k=l
2n+1 (2n  n  1) + 2 (2  1)2 = 2n+1 (n  1)
Chapter 2
+2
Codes
Problems 2.1 1. Note that
101 1010 1011 1001 0010 ,A..,A..,A..,A.. ,A..
5
A
B
9
2
= (1011010101110010010)2
3. Evaluation produces ((((5·16) + 10) . 16 + 11) . 16 + 9) . 16 + 2
= 371602
The definition, in terms of the decimal representation, produces (5AB92)16
5
X
16 4 + 10
X
163 + 11
X
162 + 9 x 16 + 2
(371602)10 5. Note that (10101011100001110101001101010100)2 A B 8 7 5 354
=
row1O'i11OOo0ill0iCilbo1lOiCilolOo = (AB875354) 16 7. We have (10101011100001110101001101010100)2 = 231 + 229 + 227 + 225 +224+223+218+217 +216+214+212+29+28+26+24+22 = 2877772628
PROBLEMS 2.1
327
9. Conversion yields
= (11000010010001011011101101h
50927341 11. Note that 50927341 mod 16 3182958 mod 16 198934mod16 12433mod16 777 mod 16 48mod16 3mod16
=
=
13 14 6 1 9 0 3
(50927341  13) /16 (3182958  14) /16 (198934  6) /16 (12433 1) /16 (777  9) /16 (48  0) /16
= = = = = =
and hence (50927341)10 = (30916ED)16 13. Multiplication yields
C x
8
8 0
11 2
1 2 A B 0 E 0 0 3
42 1 2 0 9
F B 5 0 0 0 0 0 5
and hence (2B)16 x (CIF)16 = (20935)16
15. Multiplication yields 1
0 x 01 1 0 0
h h 1
0
11 0 0
010 1 1
1 1 0
1 1 11 0 1 1
1 1 1 1
0 0 0
1 1 1
0
0
1
and hence (101101)2
X
(1101)2 = (1001001001)2
Check by converting to decimal: (101101)2
25
(1101)2 45 ·13
3
(1001001001 )2
2
+ 23 + 22 + 2° = 45
+ 22 + 2° =
13
585 29 + 26 + 23
+ 1 = 585
3182958 198934 12433 777 48 3
328
SOLUTIONS TO ODD PROBLEMS
17.
2
B
4 1
I O2 A 1 1
8 F
0
55 5
F
8 7
and hence (01F)16 = (47)16
+
(2B)16
(22)16 (2B)16
19. Long division yields
1
1
0
1
I1
0 1 1
1 1 0 1
1 0 0 1 1
1 0 1 1 0 1
1 1 1
1
o
and hence (101101)2 = (11) (110)2 (1101)2 2 + (1101)2 Checking, (1101)2
X
(11)2
+ (110)2
(101101)2
=
(23 + 22 + 1) (2 + 1) + 6 25 + 23 + 22 + 1 = 45
= 45
Problems 2.2 1. Number theory is the queen of mathematics.
3.
4D 61 74 68 65 6D 61 74 69 63 73 20 69 73 20 74 68 65 20 71 75 65 65 6E 20 6F 66 20 74 68 65 20 73 63 69 65 6E 63 65 73 2E
5. ASCII is pronounced askee. 7. Unicode contains over thirty thousand distinct coded characters.
PROBLEMS 2.4
329
Problems 2.3 1.
~
.!l..
Y LO .. F _ _ .. 
M
. ..£ ••• ...:.
A
 ..  ..... . . _._.. .. ._. . ... .. .T
I
B
_.
N
P
G
R
E
A
S
I
0
R
N
S
E
T
I
N
G
..U M KIN .. N
Help, my floating point numbers are sinking.
_ _
Y ALE COL .z. _ .. L ..  ... I E G E M 0 R ...S E .D E . . L.... . . G H DIN P A ..... T E. _.. ..  ..I N  T  I.. N G MIN AT REP . ..  ..I  ..U _. . o R T R A IT S  .    ..  ...
3.• ~
At Yale College Morse delighted in painting miniature portraits. 5. Using the numbers of units from Problem 4, we have
A 7.3 5 0.37
Letter % Units Exp.# Letter % Units Exp.# Letter % Units Exp.#
J
0.2 13 0.03 S 6.3 5 0.32
B
C 3.0
0.9 9 0.08 K 0.3 9 0.03 T 9.3 3 0.28
D 4.4 7 0.31
11
0.33 L
M
3.5 9 0.32 U 2.7 7 0.19
2.5 7 0.18 V 1.3 9 0.12
E
13.0 1 0.13 N 7.8 5 0.39 W 1.6 9 0.14
F 2.8 9 0.25
G 1.6 9 0.14
0
P
7.4
2.7
11
11
0.81 X 0.5
0.30 Y 1.9 13 0.25
11
0.06
H 3.5 7 0.24 Q 0.3 13 0.04
I
7.4 3 0.22 R 7.7 7 0.54
Z 0.1 11
0.01
By adding together the contributions from each letter, the expected number of time units per letter is 6.06. Notice that the most frequently occurring letter (E) has the shortest code.
7. Suddenly, Samuel had an idea. Maybe electricity could transmit messages.
Problems 2.4 1. At the age of ten he attended a school for blind boys in Paris. A
•
T
• • • •
T
E
H
• •
• • •
• •
•
A
•
•
G
E
• • • • • •
SOLUTIONS TO ODD PROBLEMS
330
o
T
F
H
N
E
E
• • • • • • • • • • • • • • • • • • •A • • E D T E N D T • • • • • • • • • • • • • • • • • • • • • o • • L A H o c s • • • • • • • • • • • • • • •N • • • F R B I L D o • • • • • • • • • • • • • • • • • • • • • •y •I •o N B s • • • • • • • • • • • • • • • • • • •I p R s A • • • • • • • • • • • • • • 3. Braille is used in virtually every language. B
R
A
I
L
L
E
• • • • • • • • • • • • • • • I I u s E D N s • • • • • • • • • • • • • • • • • • • • • • y R T u L L v A I • • • • • • • • • • • • • • • • • • • • E• • • • • • • • • y E R v • • •• • • • •• • • • • • • A • • L N G u G E A • • • • • • • • • • • • • • • • • • • • • •
• •
5. Braille became a talented cellist.
7. Braille was admired as a teacher.
PROBLEMS 2.6
331
Problems 2.5 1. The combinations are 1100, 1010, 1001,0110, 0101, and 0011, so there are six arrangements that can be made by choosing 2 from 4. Note also that this is the value of the binomial coefficient
G)
=6
3. 000111 010101 100011 101100
001011 010110 100101 110001
5. From Problem 4 we see that
001101 011001 100110 110010
001110 01l01O 101001 110100
010011 011100 101010 111000
C30) = 120 and (:) = 126 are reasonable
choices. A single error would be easier to recognize than for a 7bit binary code. With a 7bit binary code, a single error would yield a different ASCII value. With a 4outof9 code, a single error would lead to 3 out of 9 or 5 out of 9, which could immediately be recognized as an error. 7. Use induction. If a set has 1 element x, then the subsets are {x} and the empty set, so there are 21 = 2 subsets. Assume that a set with n elements has a total of 2n subsets. Consider a set with n + 1 elements formed by adding a new element z. There are 2n subsets that do not contain z and there are 2n subsets that do contain z, so there are
subsets of the set with n
+ 1 elements.
The formula
f (7)
=2
m
k=O
simply states that every subset has a certain number k of elements.
Problems 2.6 1. Lining up the slant cuts in a deck of IBM cards assures that all the cards are right side up and facing in the correct direction.
3. Using 12 locations 2 at a time yields 12 single punches for a total of 78. 5. There are
en =
C22) = 66 combinations,
495 patterns with four holes.
plus (~)
=
SOLUTIONS TO ODD PROBLEMS
332
Chapter 3
Euclidean Algorithm
Problems 3.1 1. Find remainders modulo 5:
9374mod5 1874mod5 374mod5 74 mod 5 14mod5 2mod5 so 9374
= (244444)5'
= = = = =
4 4 4 4 4 2
=
(9374  4) /5 (1874  4) /5 (374  4) /5 (74  4) /5 (14  4) /5
=
1874 374 74 14 2
As a check, note that
((((2·5 + 4) . 5 + 4) . 5 + 4) . 5 + 4) . 5 + 4
= 9374.
3. The addition and multiplication tables are given by E9 0 1 2 3
0 0 1 2 3
1 1 2 3 0
2 2 3 0 1
3 3 0 1 2
(>9
0 1 2 3
0 0 0 0 0
1 0 1 2 3
2 0 2 0 2
3 0 3 2 1
We see from the addition table that 2 E9 3 = 1. However, 2 (>9 x solution because 1 does not appear in the row 2 0 2 0 2.
= 1 has no
5. The addition and multiplication tables are given by E9 0 1 2 3 4 5
0 0 1 2 3 4 5
1 1 2 3 4 5
2 2 3 4 5
3 3 4 5
4 4 5
5 5
6 6
6
6
6
6
6
6
6
0
0 1
0 1 2
0 1 2 3
0 1 2 3 4
0 1 2 3 4 5
(>9
0 1 2 3 4 5 6
0 0 0 0 0 0 0 0
1 0 1 2 3 4 5 6
2 0 2 4
3 0 3
6
2 5 1 4
1 3 5
6
4 0 4 1 5 2
5 0 5 3 1
6
4 2
3
6
6
0 6
5 4 3 2 1
If a and b are in the set {O, 1, 2, 3, 4, 5, 6}, then you can always solve the equation a+x = b because b appears in every row. If a = 0, then a (>9 x = b can be solved only if b = O. Otherwise, b appears in the row headed by a and hence a (>9 x = b has a solution.
7. There are many possibilities. For example, given a letter that corresponds to the number x, associate the letter that corresponds to y =
x+ amod26
PROBLEMS 3.2
333
for any fixed integer a strictly between 0 and 26. Another possibility would be to associate the letter that corresponds with x, the letter that corresponds with the number y
= ax mod 26
where a is a particular fixed integer such as 3 or 5. For a choose an odd integer other than 13 between 0 and 26. A third possibility would be to do a combination of these two schemes. Given a letter that corresponds to the number x, associate the letter that corresponds to the number y
= ax + b mod 26
where b =I 0 and a is an odd integer between 0 and 26 other than 13. 9. Add 3 to both sides of the equation 5x + 8 = 4 to get 5x + 11 = 7, which is the same as 5x = 7 in the integers modulo 11. From the multiplication table
x 1 2 3 4 5 6 7 8 9 10
1 1 2 3 4 5 6 7 8 9 10
2 2 4 6 8 10 1 3 5 7 9
3 3 6 9 1 4 7 10 2 5 8
4 4 8 1 5 9 2 6 10 3 7
5 5 10 4 9 3 8 2 7 1 6
6 6 1 7 2 8 3 9 4 10 5
7 7 3 10 6 2 9 5 1 8 4
8 8 5 2 10 7 4 1 9 6 3
9 9 7 5 3 1 10 8 6 4 2
10 10 9 8 7 6 5 4 3 2 1
locate 7 in row 5. The column header is 8 and 5·8 mod 11 = 7. Checking, 5·8+ 8 mod 11 = 4, so x = 8 is indeed a solution. 11. There are only 11 possible choices for x, so just try them. Let x 2 + 9x + 9 mod 11. Then
f (0) = 9 f (4) = 6 f (8) = 2
f (1) = 8 f (5) = 2 f (9) = 6
f (2) = 9 f (6) = 0 f (10) = 1
f (x)
=
f (3) = 1 f (7) = 0
Thus x = 6 or x = 7. Now that the solution is known, it is easy to see that factorization would also work. That is, (x  6) (x  7) mod 11 = x 2 +9x+9.
Problems 3.2 1. The positive divisors of 48 and of 72 are d (48) = {I, 2, 3, 4, 6, 8,12,16,24, 48} d(72)
= {1,2,3,4,6,8,9, 12, 18, 24, 36, 72}
SOLUTIONS TO ODD PROBLEMS
334
The intersection of these two sets is {1, 2, 3, 4, 6, 8,12, 24} and max{l, 2, 3,4,6,8,12,24}= 24. 3. Factoring gives 55440 = 24325 x 7 x 11 and 48000 = 273 x 53, so gcd (55 440, 48 000) = 2min{4,7}3min{I,2}5min{1,3}7min{0,1}11 min{O,I} =2 4315 17°11° =240 5. From the table
n 0 1 2 3
qn
1 3
Tn
29432403 22254869 7177534 722267
n 4 5 6 7
qn
Tn
9 1 15 496
677131 45136 91 0
we see that gcd (29432403,22254869) = 91 7. Let a and a + 5 denote the two integers. If k I a and k I a + 5 then also k I (a + 5)  a = 5 and hence k I 5. Thus gcd (a, a + 5) = 1 or gcd (a, a + 5) = 5. 9. Note that gcd (a, b)
gcd(b,amodb)
gcd (ro, Tl)
= gcd(b,ro) = gcd(To,bmodro)
= gcd (Tl' ro mod Td = gcd (Tl' T2)
and, in general,
11. The remainders, starting with 233 and 144, are 89, 55, 34, 21, 13, 8, 5, 3, 2, 1, 0 so the number of steps is 11 (or maybe it's 10). If we start with F 20 , then the remainders are
F21
and
so the number of steps is 19. You can calculate F 20 and F 21 . They are 6765 and 10946.
Problems 3.3 1. Let a = 43 and b = 56. Then successive applications of the division algorithm give the equations 56 = 1 . 43 + 13 and 43
= 3 . 13 + 4 and 13 = 3 . 4 + 1
PROBLEMS 3.3
335
Solve the first equation for 13, the second for 4, and the third for 1 13
= 56  1 . 43 and 4 = 43  3 . 13 and 1 = 13  3 . 4
Start with the third of these equation's and substitute the expression for 4 from the second equation 1 = 13  3·4 = 13  3· (43  3·13) = 13  3 . 43 + 9 . 13 = 10 . 13  3 . 43 Now substitute the expression for 13 from the first equation into this 1 = 10· 13  3 . 43 = 10· (56  1 ·43)  3 . 43 = 10 . 56  10· 43  3 . 43 = 10· 56  13 . 43 3. 1 = gcd (43,56) = (13) ·43 + 10 . 56. (See disc for details.) 5. The solution is 3=gcd(742789479,9587374758) = 742789479 (1357468553) + 9587374758 (105170955) 7. Consider the array x\y
5 4 3 2 1 0 1 2 3 4 5 6
5 50 46 42 38 34 30 26 22 18 14 10 6
4 44 40 36 32 28 24 20 16 12 8 4 0
3 38 34 30 26 22 18 14 10 6 2 2 6
2 32 28 24 20 16 12 8 4 0 4 8 12
1 26 22 18 14 10 6 2 2 6 10 14 18
0 20 16 12 8 4 0 4 8 12 16 20 24
1 14 10 6 2 2 6 10 14 18 22 26 30
2 8 4 0 4 8 12 16 20 24 28 32 36
3 2 2 6 10 14 18 22 26 30 34 38 42
4 4 8 12 16 20 24 28 32 36 40 44 48
5 10 14 18 22 26 30 34 38 42 46 50 54
6 16 20 24 28 32 36 40 44 48 52 56 60
Note that 2 is the smallest positive integer that appears in the array. By reading the row and column headers, we see that 2 = 5·4 + (3) ·6 = 2·4+ (1) . 6 = (1) ·4+ 1 ·6= (4) ·4+ 3 ·6. Thus d = 2 and (x, y) could be any of the pairs (5, 3), (2, 1), (1,1), or (4,3). 9. Assume albe and a .l b, say 1 = ax + by. Then multiplication by e yields e = aex + bey. Since ala and albe, it follows that al(aex + bey) = e.
SOLUTIONS TO ODD PROBLEMS
336
Problems 3.4 In problems 17, M = {I, 4, 7,10,13,16,19,22,25, ...}. 1. The next six elements after 25 in the set Mare 28,31,34,37,40,43. 3. The first six composites in Mare 16 = 4·4 49 = 7·7
28 = 4·7 52 = 4 ·13
40 = 4 ·10 64=4·4·4
5. Since p and q are ordinary primes, the only factorization of pq in the positive integers is p. q, but p and q are not elements of M so pq must be prime in M. 7. Each of ab, ed, ae, bd, ad, and be is prime in M because each is ofthe form (3m + 2) (3n + 2), where 3m + 2 and 3n + 2 are ordinary primes. 9. It takes the mutual cooperation of a factor of 2 and a factor of 5 to generate a multiple of 10 and thus generate a trailing zero. There are 994 factors of 2 available. The number of factors of 5 is given by LI000/5J
+ LI000/25J + LI000/125J + LlOOO/625J =
200 + 40 + 8 + 1 = 249
and hence there are exactly 249 factors of the form 2·5, each of which contributes 1 zero at the end of 1000!. 11. Let k
n = IIp:i, i=l
k
a
=
IIp{i,
k
b = IIpfi i=l
and
i=l
where Ii ::::; ei and gi ::::; ei for i = 1,2, ... , k. Then lcm (a, b) =
k
k
i=l
i=l
II p,;ax{fi ,9i} I II p:i = n
Problems 3.5 1. Finding a solution to the congruence lOx == 14 (mod 8) is equivalent to finding an integer solution to the equation lOx = 14 + 8y, which is equivalent to finding an integer solution to the equation 5x = 7 + 4y, which is equivalent to finding a solution to the congruence 5x == 7 (mod 4). The integer solutions to lOx = 14 + 8y are given by x = 3 + 4Nl and y = 2 + 5N1 and the integer solutions to 5x = 7 + 4y are given by x = 3 + 4Nl and y = 2 +5N1 . 3. The inverse of 8 modulo 13 is 5 and 3· 5mod13 is 2. So 3/8mod13 = 2. The inverse of 3 modulo 17 is 6, 14·6 mod 17 = 1, so 14/3 mod 17 = 1.
PROBLEMS 4.1
337
5. We have
o1) =
0) 1) = =
1
3
3) 10
(113 34
0) 1
(11 1
1) 3)
(1
10)
(34 11
3
10
= 0 113
so that 34 1 mod 113 = 10. As a check, note that 10· 34 mod 113 = 1. 7. We get 7382784739 1 . 1727372727 mod 2783479827 = 213764595. As a , check, 7382784739·213764595 mod 2783479827 = 1727372727. 9. The multiplication table for the integers modulo 5 using 2, 1,0,1,2 is
x 2 1 0 1 2 Note that (_2)2
2 1 2 0 2 1
1 2 1 0 2 2
0 0 0 0 0 0
1 2 1 0 1 2
2 1 2 0 2 1
= 1 and (22) = 1 in this multiplication table.
11. Multiply the first equation by 37 1 mod 101 = 71 and the second by 17 1 mod 101 = 6 to get 17x + y = 85 and 15x + y = 49. Then subtract the second equation from the first to get 2x = 36 so that x = 2 1 36mod 101 = 18; and from the equation 15x + y = 49 get y = 49  15 ·18 mod 101 = 82. Checking, we see that 23 ·18 + 37 . 82 mod 101 = 14 and 53 . 18 + 17 . 82 mod 101 = 25. 13. If 1 has a square root modulo p, then x 2 + 1 should factor modulo p. Factoring with a computer algebra system produces results like x 2 + 1 mod 2 = (x + 1)2, x 2 + 1 mod3 = x 2 + 1, and x 2 + 1 mod 5 = (x  2) (x + 2).The prime p = 2 is a special case since 1 = 1 and x 2 + 1 has 1 as a double root. Try some primes on your own and you will see that, for the odd primes, it appears that x 2 + 1 factors exactly when p mod 4 = 1. To give you a start, the solution on the disc factors the first 30 primes.
Chapter 4 Problems 4.1 1. KHOOR
Ciphers
338
3.
SOLUTIONS TO ODD PROBLEMS
KTIXEVZOUT VXUJAIZY COZN RKYY ZNGT YODZE LUAX HOZY GXK LXKKRE KDVUXZGHRK
5. Goodbye. 7. Caesar is considered to be one of the first persons to have ever employed encryption for the sake of securing messages. 9. Drive for show; putt for dough. 11.
GHXSG NOOMN NHKFS UEKCE FPJSG WEUYT ADBOS DYFEM HUSFS UVITN RCODP PNENG CAESH YDGFH HSTY
13. y = 15 (3x + 5)
+ 4mod26 = 45x + 79 mod 26 = 19x + 1 mod 26
Problems 4.2 1. The ciphertext was generated using the shift y = x + 6 mod 26, so the inverse is given by the shift x = Y  6 mod 26. The plaintext is
The oldest known encryption device is the scytale. 3. The ciphertext was generated using y = 5x mod 26. Since 5 1 mod 26 = 21 the inverse affine cipher is given by x = 21y mod 26. The plaintext is
The scytale consisted of two round pieces of wood which had exactly the same dimensions. 5. The ciphertext was generated using y = 11x + 4 mod 26, so the inverse is given by x = (y  4)11 1 mod 26. Since 11 1 mod 26 = 19 the inverse is the affine character cipher x = (y  4) 19mod26 = 19y + 2mod26. The plaintext is
Messages were encoded by winding a piece of parchment around the cylinder in a spiral and writing the message along the length of the cylinder. 7. The shift ciphers y = x + 7 mod 26 and y = x + 11 mod 26 were used to encrypt the odd and even letters. Use the inverse shift ciphers y = x + 19 mod 26 and y = x + 15 mod 26 to obtain the plaintext
Thirtyfive code talkers attended the dedication of the Navajo code talker exhibit. The exhibit includes a display of photographs, equipment, and the original code, along with an explanation of how the code worked. Dedication ceremonies included speeches by the then Deputy Secretary of Defense Donald Atwood, U.S. Senator John McCain of Arizona, and Navajo President Peterson Zah. The Navajo veterans and their families traveled to the ceremony from their homes on the Navajo Reservation, which includes parts of Arizona, New Mexico, and Utah.
339
PROBLEMS 4.4
Problems 4.3 I.
CPCRW CEPST OYVOW T
3.
EVIHAA ERSETC
5.
VNLPL HZQBW QJPZL CQXHB BHWJD VTHCP LWQFC HEHCF VNRVR WHINL PHZVP RCZIQ ZHVHQ CRCXC QVZJK ZVHVJ VHQC
7. If a = (0 4 7)(1 6 5 3)(2 9 8) and r = (0)(1 3 5 9 7)(2 8 64), then ar = (0 2 7) (I 4) (3) (5) (6 9) (8) ra = (0 4 9) (I) (2) (3) (5 8) (6 7) 9. Let a be a permutation on {I, 2, ... , n}. If x" = x for all x, then a = (I) (2)··· (n) is a product of disjoint cycles. We say that an integer x is moved by a if x" =1= x. We induct on the number k of integers moved by a permutation a. If k = 0, then x" = x for all x and hence a = (I) (2)··· (n) is a product of disjoint cycles, so the theorem holds. For k > 0, assume that all permutations r that move fewer than k integers can be written as products of disjoint cycles. Let a be an integer moved by a and consider the finite sequence al = a, a2 = a'[, a3 = ag, and so forth. Since ai E {I, 2, ... , n}, there exist integers i < j such that ai = aj. Let m be the least integer such that ai = am with I :::; i < m. If i > I, then ai = ail = am = a~l' contrary to the minimality of m. Consider the permutation (ala2··· am)l a = r. Note that ai = ai for i = I ... m and x" = xt for all other x E {I, 2, ... , n}. Thus r moves fewer than k integers and hence r is a product of disjoint cycles. Thus a = (ala2··· am) r is also a product of disjoint cycles.
Problems 4.4
!) 24) (~ !)
1. IS
>
(8 18)
PY
>
(15
3.
MC DV IG OU
TX IE KT RS
BX ZW WC HN
(~
mod 26 = (2
10)
mod 26 = (20
>
9)
CK
>
UJ
HN FZ IY AN TI OH WN BC PD RT XN SV DH IR MP CV QB RF IY PB VO VR IN YM IN KA RS AH CL YO KS UD OQ DY KM BH HX IC CJ KU
5. The inverse cipher is
x
(H ! H)'mOd26~X ( ~9: 6 I 796 8 6 9 3 I
II 12 16 15 II II 14 19 ) 5 13 17 ~ mod 26 o 24 19 23 II 13 12 15
SOLUTIONS TO ODD PROBLEMS
340
7. Assuming the fictitious Social Security number is 555555555, the affine transformation yields the encryption 5 0 3 8 6 5 9 8 5. See the solution on the disc for details. 9. The plaintext is
If sensitive data falls into the wrong hands, it can lead to fraud or identity theft. See the solution on the disc for details.
Problems 4.5 1. The Playfair square is given by
P
I E
H B D
U F Q
C
R A G 0
S K
N V Y
T
L M W X Z
The plaintext and ciphertext are given by WH
EA
TS
TO
NE
NA
ME
DT
HE
PL
!
!
!
!
!
!
!
!
!
!
HU
AK
YR
RT
UK
GK
PA
QY
UP
MC
AY
FA
IR
CI
PH
ER
AF
TE
RH
IS
!
!
!
!
!
!
!
!
!
KT
OE
RS
IR
HB
AI
EO
QA
or
FR
EI
ND
LY
ON
PL
AY
FA
IR
!
!
!
!
!
!
!
!
!
UE
HY
SZ
VG
MC
KT
OE
RS
or
! RL
3. Use the Playfair square
R D
F U V
H C G Q W
E B IJ P X
0 A K N
Y
S T L M Z
to obtain the message
The primary use of a Wheatstone bridge is the measurement of resistance 5. The Playfair cipher may be improved by seriating its input text. 7. Who? Not me!
PROBLEMS 4.7
341
Problems 4.6 1. LOSCH POTYX YXQBL EEYWT NIWAJ MIOMY IPINP PPKLH B
3. Who is the weakest link? 5. Why Playfair (play fair?) when the other guys are using RSA? 7. Since 1 + 1 mod 2 = 0, it follows that adding the same binary vector twice gives back the original vector. In particular, if
( 1 0
0
=(
1 0
0
1 0
0
1 0
1 0
1 1
)+(
1
1 0
1
1 0
0
1 ) mod2
1
1 0
1
1 0
0
1 ) mod2
o)
then ( 0
1
=(1
1
0 0
0
0 0
0
1
1 0
o )+ ( 1
1 )
Problems 4.7 1. We take x
= 7 ;
'H' and compute
= (x + S1 mod 26)""1 = (7 + 25 mod 26)""1 = 60"1 = 9 z = (y + S2 mod 26)0"2 = (g + 13 mod 26)0"2 = 220"2 = 21 w = (z + S3 mod 26)""3 = (21 + 4 mod 26)""3 = 250"3 = 1 u = (w)P = 1P = 9 y
z
1
1
= (U0"3  S3 mod 26 ) = g0"3  4mod26 = 18  4mod26 = 14 1
Y = (Z0"2
1
= 140"2 13mod26 = 13 13mod26 = 0 X = (yO"l  s3mod26) = 00"1  25 mod 26 = 23  25mod26 = 24  s2mod26)
1
1
and hence the first ciphertext character is 24 the shift constants:
S1 ; S1 S2; S2
7
'Y'. Finally, we update
+ 1 mod 26 = 0 + Imod26 = 14
Continuing in this way, we see that the ciphertext is YQ.
3. Attack now! 6
5. The number is e2 ) e24) ei) "'@Intheexample,thereare(226 )ways 1O! to choose the first pair {A, Z}, then e24) ways to choose the second pair {B, Y}, and so on. But the 1O! ways of listing these 10 pairs all give the same pairings, so we must divide by 1O! to get the number of distinct plugboard settings.
342
7.
SOLUTIONS TO ODD PROBLEMS 1 _ (J'

(1 2 3 4 5 6 7) 1 (1 2 3 4 5 6 7) 6 7 2 5 3 1 4 and r = 2 3 7 1 5 4 6
apr = 9. Let p = (aI, a2, ... ,ak) and set r = (J'1. Then (a[)apr = (aif 2 k 1,and (akr)apr _ (ak )rapr _ a pr _ (a1 )7" . aipr _ (ai+1 )r £or %. _ 1 , , ••• , k If x ~ {aI, a2, ... , ak}, then xrapr = x pr = xr so xr is fixed by the permutation (J'pr. Thus (J'pr = (aI,a2, ... ,ak) is also a kcycle.
Chapter 5
ErrorControl Codes
Problems 5.1 1. The probability of getting 10 out of 10 on a true false exam is (~) 10 4 10\4 ~ 9.7656 x 10 .
=
3. The codewords 000 and 111 are a distance 3 apart. 5. There are 200 places where the error could occur; so the probability of a 99 single error is e~O) (1  0.0001/ (0.0001) = 1. 960 6 x 10 2 . 7. The expected number of errors is the sum of n x (the probability of exactly n errors), which is given by 1000
;
nx
(
1~0)
(1 
0.001)1000n
(O.OOlt = 1.0
The contribution by the nth bit is 1 x (0.001) = 0.001. Since there are 1000 bits, the expected number of bit errors is 1000 x (0.001) = 1.0.
9. If the probability of a letter being changed is 1/10, then you can expect about a tenth of the letters to be changed. For two consecutive sentences, about one fifth of the letters can be expected to be different. The length of the sentence is 65, and 65/5 = 13, so on average the distance between two sentences should be roughly 13. Indeed, the distances between pairs of sentences range from 11 to 14, so an average of 13 is reasonable.
Problems 5.2 2
0
0
1
1.11111111111111111111 (2001) 5=wnwnn
3.
Iii1l
7=nnnww
111111
fTj
I1111I (5773)
'v'
'..'
7=nnnww
3=wwnnn
(Note that the short bars were added to indicate the width of beginning and ending spaces.)
PROBLEMS 5.3
343 9
1
1
2
001
~~~~
5. The 2 of 5 bar code 11111 11111 11111 as (9112001; September 11, 2001)
~~~
11111
11111
11111
11111 decodes
7. The Code 39 bar code COD
E
3
9
iiillliiflnifillfiiIlUn decodes as (Code 39). 9. The Interleaved 2 of 5 bar code 5=wnwnn
l=wwnnn
~
~
1111111
'v' start
I 11111

11111
111111
II
5=wnwnn
6=nwwnn ,,"..
11111
'...'
I"v' 11111 8=wnnwn
end ~
2=nwnnw
decodes as (551862; Cinco de Mayo). (Note that the short bars were added to indicate the width of beginning and ending spaces.) 11. The Code 39 bar code
Ilill
8
112111 11 111 Ilf II Ilfll 11I11 * Iii II 11111 11111 11111 11111 11111 11111 r
f e e
t
decodes as 28 is perfect. (A perfect number is a number that is equal to the sum of its proper divisors. In this case, 1 + 2 + 4 + 7 + 14 = 28.)
Problems 5.3
1. 'v' 'v' 'v' 'v' 'v' 037000
'v' 'v' 'v' 'v' 'v' 'v' 628118
SOLUTIONS TO ODD PROBLEMS
344
10
L iai
mod 11
=0
i=l
Assume that ak and an are interchanged, ak i an, and 1 :::; k < n :::; 9. Set bk = an, bn = ak, and otherwise bi = ai. Then
t,
ib i mod 11 =
(t, t, ibi 
iai) mod 11
= (k (bk  ak) + n (b n  an)) mod 11 = (k (an  ak) + n (ak  an)) mod 11 = (k  n) (an  ak) mod 11
i 0
because 11 divides neither of the factors k  n or an  ak. (Why?) Thus
r II
cannot be a valid ISBN number.
5.
~ II
~ ~ ~ II ~' ~ II ~ ~ II ~ ~ II ~ 0
0
0
3
~ 11~8 ~II~' ~II~' ~ II~B 7. The first digit (0) represents the country and the second part represents the publisher. The last digit is the check sum
o. 1 + 4 . 2 + 7 . 3 + 1 . 4 + 8 . 5 + 9 . 6 + 6 . 7 + 1 . 8 + 4 . 9 mod 11 = 9. Do a web search on a bar code such as code 93. 11. A short element could be added to any of
There are ~ = 60 rearrangements of
51
3121
= 10 rearrangements 0 f
4
PROBLEMS 5.4
345
{H,I,I.I} and 2f~!
= 30 rearrangements of
{11H"} for a total of 60 + 10 + 30
= 100 symbols.
Problems 5.4 In the following problems,
H
1 0 1 1
1 0 0 0
0 1 1 1
0 0 0 0 1 0 0
0 0 0 0 0 1 0
0 0 0 0 0 0 1
U 0 0 1 0 0 0 0
D
0 1 0 0
0 0 1 0
~). p~
0 0 0 1 1 1 1
1 0 1 0 1 0 1
0 1 1 0 0 1 1
, and
1. The codeword is
(1
1 1) H mod 2 = (0
0
1 1 0 0
1 1)
3. The parity is even, so we assume there are either 0 or 2 errors. An error check yields (1
0
1
1 0
1 0) P mod 2 = (0
0 0)
which indicates no errors, so the plaintext is given by (1
0
1 1 0
1 0) D mod 2 = (1
0
1 0)
5. The parity is odd, so we assume a single error occurred. An error check yields (1 0 1 1 0 1 0) P mod 2 = (0 0 0) so we assume the error occurred in the 8th bit. The plaintext is given by (1
0
1 1 0
1 0) D mod 2 = (1
0
1 0)
SOLUTIONS TO ODD PROBLEMS
346
7. The codewords are given by
(a a a
1 ) Hmod2 = ( 1 1
a
1
a a
(a a
1
a ) Hmod2 = ( a
1
a
1
a
1
(a a
1
1 ) Hmod2 = ( 1
a a a a
1
(a
1
a a ) Hmod2 =
a a
(a
1
a
1 ) Hmod2 = (
(a
1
1
a ) Hmod2 =
(a
1
1
1 ) Hmod2 = (
( 1
a a a ) Hmod2 =
( 1
a a
1 ) Hmod2 = (
( 1
a
1
a ) Hmod2 =
( 1
a
1 1 ) Hmod2 = (
( 1
1 ) =
a )= 1 ) =
1
1
a a )=
1
a a
1
a
( 1 1
a a
1
1
a )=
1 1
1 ) =
( 1
a
a a a
( 1
1
a a
1
1
a a a
1 1
a a
1 )=
III II II II III II
I
0)=1
1 )=
( 1
a
1
1
a
1
a
1
1
a a
1
1
a a ) Hmod2 = ( a
1
1
1
1
a a )=
( 1
1
a
1 ) Hmod2 = ( 1
a
1
a
1
a
( 1
1
1
a ) Hmod2 = ( a a
1
a
1
1
a )= 1 ) =
1 ) =
a )=
II III II
I
IIII II
Omitting patterns with 1 or 4 bars, there are 10 remaining two and threebar codes that could be used to encode the digits 09. This bar code symbology would give single error correction.
PROBLEMS 6.1
347
9. An error check yields
(0
0
0
0
1 1) P mod 2 = (0
0
which indicates an error in bit (0
( 0
1 0
0
0
1
0 0 1 0 0 0 0
1 )
1 1) 2 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 1
1 1)
= 3. Thus
mod 2 =
(1 0 1 1 )
11. The parity is even, so we assume there are either 0 or 2 errors. An error check yields (0
1 0
0
1
1) P mod 2 = (0
0
0
0)
so assume there are no errors. Thus the plaintext is (0
1 0
0
1 0
1) D mod 2 = (0
1 0
1)
13. The parity is odd, so we assume a single error occurred. An error check yields (1 1 1 1 1 1 1) P mod 2 = (0 0 0) so a single error must have occurred at bit 8. The plaintext is 1
Chapter 6
1
1
1
1
1
1) D mod 2 = (1
1
1 1)
Chinese Remainder Theorem
Problems 6.1
= 3 and y = 4; that is, 2·3+3·4 mod 11 7 and 3 . 3 + 4 mod 11 = 2. See the disc for details of the solution.
1. Both equations are satisfied by x
3. Use row reduction to get
(!
5 8
1
0
~ )~ ( ~
2
0
1
3
1
4:
and conclude that
(34 85)
1
= (
2 1
5
4: 3
4:
5
4:
)
)
=
SOLUTIONS TO ODD PROBLEMS
348 Reduce modulo 11 to get
( 43 85)
1
2~)
(
mod 11 =
10
Check your answer by showing that
(!
~) (1 0 ~) mod 11 = (~ ~) 2
See the disc for further details. 5. Note that 2
3
1)1
015 ( 372
Reduce each entry modulo 17 to get
(
°32 713 21)1 5 mod 17 = (
12 10 15
12 12
15) 16
8
7
See the disc for further details. 7. The answer is x = 1, Y solution.
= 12, and
z = 3. See the disc for details of the
9. A computer algebra system gives the solution w
121
139
= 2, x = 89,y = 2, z =
18
Reduce modulo 91 to find the solution 1;1 mod 91 = 15, 89 mod 91 = 2, 1~9 mod 91 = 24, and 18 mod 91 = 73. See the disc for further details.
Problems 6.2 1. The solutions to the congruence x := 5 (mod 9) are ... , 5,14,23,32,41, 50,59,68,77,86,94, ... and the solutions of x := 4 (mod 11) are ... , 4,15, 26,37,48,59,70,81,92,103,114, ... and hence the common solutions are 59 + 99k for k E Z.
°: :;
3. There should be a unique solution x such that x < 3 . 4 . 5 = 60. The solutions in the interval x < 60 to three congruences are
°: :;
A= {2,5,8, 11, 14, 17,20,23,26,29,32,35,38,41,44,47,50,53,56 ,59} B = {3, 7, 11, 15, 19, 23, 27, 31, 35, 39,43, 47, 51, 55, 59} (7=
{4,9,14,19,24,29,34,39,44,49,54,59}
Note that An B
n (7 = {59}.
PROBLEMS 6.3
349
5. The Chinese remainder algorithm yields 353. 7. The Chinese remainder algorithm yields 419. 9. The congruence 2x + 3 := 7 (mod 11) is equivalent to 2x := 7  3 := 4 (mod 11), and hence x:= 4.2 1 := 2 (mod 11). The congruence 3x+4:= 5 (mod 13) is equivalent to 3x := 5  4:= 1 (mod 13), and hence x := 3 1 := 9 (mod 13). Thus the original pair of congruences is equivalent to the system x := 2 (mod 11) and x := 9 (mod 13). Thus x must satisfy x = 2 + 11k = 9 + 13r 11k:= 9  2 (mod 13) k = 7.11 1 mod 13 = 3 so x := 2 + 11 ·3 := 35 (mod 143) . Checking, note that 2·35 + 3 mod 11 = 7 and 3 . 35 + 4 mod 13 = 5.
Problems 6.3 1. The product is 37759097376·116389305648 = 4394755125487858779648. See the disc for details of the computation using base b = 1000 arithmetic. 3. The product is 37759097376·116389305648 = 4394755125487858779648. See the disc for details of the computation using the modular basis (997, 999,1000,1001,1003,1007,1009,1013) and the Chinese remainder algorithm. 5. We have 240 ~ 1.099511628 x 10 12. Modulo 1000, we have 240 mod 1000 = 210 X 2 10 X 2 10 X 2 10 mod 1000 = 24 x 24 x 24 x 24 mod 1000 = 776. Modulo 100000, have 240 mod 100000 = 210 X 210 X 210 X 210 mod 100 000 = ... = 27776, and hence the last five digits are 27776. It follows that 240 = 1099 511627776. See the disc for more detail. 7. Because 100! = 29734852471611913717519523429331337241243247253 x 59 x 61 x 67 x 71 x 73 x 79 x 83 x 89 x 97, the modular representation is 100!
= (0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)
Note that the elements of the modular basis are all powers of distinct primes, and are thus pairwise relatively prime.
Problems 6.4 1. Note that 2x 3 + 3x 2 + 3x + 1 = (2x + 1) (x 2 + X + 1) and 2X2 + 5x + 2 = (2x + 1) (x + 2), so gcd (2 x 3 + 3x 2 + 3x + 1, 2X2 + 5x + 2) = 2x + 1.
350
SOLUTIONS TO ODD PROBLEMS
3. Modulo 5 we have 2 3 2x + 3x + 3x + 1 = xI + 6x + 3 2X2 + 5x + 2 2X2 + 5x + 2 2x3 + 3x 2 + 3x + 1 = (x + 4) (2X2 + 5x + 2)
2X2
+x+3
+ 5x + 2 = 2x _ 1 x+3
and modulo 7 we have 2 3 2x + 3x + 3x + 1 = xI + 6x + 3 2X2 + 5x + 2 2X2 + 5x + 2 2x 3 + 3x2 + 3x + 1 = (x + 6) (2x2 + 5x + 2)
+ 6x + 3
2X2 + 5x + 2 1 2 x 6x+3 = "3 +"3 The leading coefficient must be 1 or 2. If the leading coefficient is 1, then modulo 5 we have x + 3 and modulo 7 we have 6 1 (6x + 3) mod 7 = x + 4 and x + 18 does not divide 2x 3 + 3x 2 + 3x + 1. Assume the leading coefficient is 2. Then modulo 5 we have 2 (x + 3) = 2x + 1, and modulo 7 we have 2 (x + 4) = 2x + 1. Note that 2x3+~~:13X+1 = x 2 + X + 1 and 2 2x 2 +5x+2 = X1 + 2' so 2x + 1 is a common divisor . x+ 5. The greatest common divisor is 1 + 2x 2 . As a check, note that
6x 5  7x 3 + 8x 2  5x + 4 2X2 + 1 2 4 3 8x + 6x + 8x + 3x + 2 2x2 + 1
_ 3  3x  5x + 4 _ 4 2  x
+
3
2
x+
See the disc for details of the polynomial division.
7. Scientific Notebook produces gcd (6x 5  7x 3 + 8x 2  5x
+ 4, 8x4 + 6x 3 + 8x 2 + 3x + 2)
= 1 + 2X2
9. Use long division to get
6x 6 + 4x 5 + 9x 4 + 19x 3 + 2X2 + 15x + 5 2 3 3       : : 3    =        = X + X + 1 3x + 2X2 + 5 5 12x + llx 4 + llx 3 + 26x 2 + 5x + 15 _ 4 2  x +x+3 3 3 2 2 5
x + x
+
a common divisor. Note that 2::2~3::l 3 1.2 x  1.8 + 4x ¥x+¥(4x 2 + X + 3) + 13 X +.!.! 2+x+3 implies 2x + 3x + 1 = (1.2 x  1.) 8 8 8 4x2+x+3 32 248 + 848 h· h· d· t th t 2 3 + 3 +1 x  169 an d 11 +.ll 13 (13 11) W 1C mIca es a x x 8 x 8 169 gX+ g and 4x 2 + x + 3 are relatively prime. which shows 3x3 + 2x2
+ 5 is
PROBLEMS 6.5
351
Problems 6.5 1. See the answer to problem 3. See the disc for details of the solution using
elementary row operations and rational arithmetic.
3. Direct calculation with a computer algebra system yields 1 1
2"
1 3' 1 4
1
2"
1 3' 1 4
1
5
1 3' 1 4 1 5 1 6
1
1
4
16
120
240
140
1
5
120
1200
2700
1680
"6
1
240
2700
6480
4200
1
140
1680
4200
2800
'7
5. Note that 1
detH2
= 12 =
1 223
H
__1_ _ _ 1_ 3  2160  24335 1 1 det H4 = 6048000 2833537 1 1 det H5 = 266716800 000 = 21°355573 1 1 det H6 = 186313420339200000 = 21439557511
d
et
7. The row operations
Coo29
31 9
. (100 gIve 29
1 0
31 100 9 29 31 100 1
~) ~ G ~G
31 ) 1 = ( 9 9 29
. 9. Note that mdeed det (127 37
1 100 0 1 100 29
2~) ~ (~ 1~0) ~
31 100 1 2900
G 0
1
1 100 1 100 9 29
~) 31) 100
31 ) 100 . 24) 7
=
1.
Modulo 11, the inverse is
(~ ~), and modulo 13, the inverse is (171 ~~).
The Chinese remainder
theorem yields 127 ( 37
24 ) 7
1 _

(
c ([7, 7] , [11, 13]) c ([4,11] , [11, 13])
7  ( 37
24) 127
c ([2,11] , [11, 13]) ) c ([6,10] , [11, 13])
SOLUTIONS TO ODD PROBLEMS
352 Checking, note that
(~~~ ~4) Chapter 7
(;7
122~) = (~ ~)
Theorems of Fermat and Euler
Problems 7.1 1. Note that (101  1)! mod 101 = 100 == 1 (mod 101), (103  1)! mod 103 = 102 == 1 (mod 103), (105  1)! mod 105 = 0, (107  1)! mod 107 = 106 == 1 (mod 107), and (1091)!mod109 = 108 == 1 (mod 109), so 101, 103, 107, and 109 are primes and 105 is not.
3.
12 mod 11 32 mod 11 52 mod 11 72 mod 11 92 mod 11
= 1
=9 = 3 = 5 = 4
22 mod 11 42 mod 11 62 mod 11 82 mod 11 102 mod 11
= 4
=5 = 3 = 9 = 1
5. Computing x 2 mod 15 for x = 1,2,3, ... , 14 shows that the solutions are 12 mod 15 = 42 mod 15 = 112 mod 15 = 142 mod 15 = 1 7. We know that (p  1)! modp = p  1. Since p  1 1. p, it follows that (p  2)!modp = 1. Since p  2 (modp) == 2, it follows that (p  3)! (p  2) modp 2 (p  3)! modp
2 (p  3)! mod p
1
= 1 = p
1.
9. Rearrange the product as 2·3·4·5·6·7·8·9·10·11 . 12·13·14·15 = (2·9)· (3·6)· (4·13)· (5·7)· (8 ·15)· (10·12)· (11.14) and observe that 2· 9mod17 = 1, 3· 6mod17 = 1,4· 13mod17 = 1, 5· 7mod17 = 1, 8 . 15 mod 17 = 1, 10 . 12 mod 17 = 1, and 11 . 14 mod 17 = 1. Hence 16! mod 17 = 1 . 16 . (2 . 9) . (3 . 6) . (4. 13) . (5 . 7) . (8 . 15) . (10· 12) . (11 . 14) mod 17
= 1·16 ·1·1·1·1·1·1·lmod17 = 16mod17 == 1
(mod17)
Problems 7.2 k
1 1. Using Algorithm 7.1, gets 2
3 4
p
1 1· 11 mod 15 = 11 so 114 mod 15 = 1. 11· 11 mod 15 = 1 1·11mod15 = 11 11· 11 mod 15 = 1
PROBLEMS 7.3
353 k
p
1
3. Using Algorithm 7.1, gets
1
1· 16mod29 = 16 so 16 4 mod29 16· 16 mod 29 = 24 24 . 16mod29 = 7 7· 16 mod 29 = 25
2 3 4
= 25.
5. Using Algorithm 7.2, we get 597 mod 127 = 80. See the disc for details. 7. Using Algorithm 7.2, we get 463 mod 127 = 1. See the disc for details. 9. We get 1272387894339363242 mod 243682743764 = 17298641040. 11. The second variation computes xn and then reduces the result modulo m. For x and n integers, xn is feasible to calculate exactly only if x and n are relatively small integers, say at most 3 or 4 digits each. The first variation makes it easy to calculate xn mod m for numbers x, n, and m that are each perhaps a hundred decimal digits long.
Problems 7.3 1.
x 2 mod 11 + x 2 22 mod 11 = 4 4 2 mod 11 = 5 52 mod 11 = 3
Ln/2J + n 10 LI0/2J = 5 L5/2J = 2 L2/2J = 1
nmod2
p . x mod 11 + P
o
1
1
o 1
1· 4mod11
=4
3· 4 mod 11
=1
and we see that 210 mod 11 = 1. 3. 21000 mod 13
=
(212) 83 24 mod 13
= 183 24 mod 13 = 16 mod 13 = 3
5. 52000 mod 17 = (5 16 ) 125 mod 17 = 1125 mod 17 7. 11 1234 mod 29 9. 5217 mod217
=
(1128)44112mod29
=1
= 144112 mod 29 = 121 mod 29 =
5
= 5 although 217 = 7 x 31
11. To verify this by hand, write 217 as a sum of powers of 2: 217
128 + 64 + 16 + 8 + 1 28 + 27 + 24 + 23 + 1
then compute 5n (mod 217) for n = 1,2,22,2 3, ... ,2 8 using the fact that each number 5 n (mod 217) is the square of the preceding one: 5, 25, 191, 125, 191, 125, 191, 125, 191
354
SOLUTIONS TO ODD PROBLEMS Finally, compute 5217
5128+64+16+8+1 5128564516585 191 . 125· 191 . 125 . 5 (mod 217) 5 (mod217)
Trying to divide 217 by 3,5,7,11, ... results quickly in 217 = 7 x 31 13. Note that 1729 = 7 x 13 x 19 and 1728 = 2633 . Since 7, 13, and 19 are primes, it follows that x 7 mod 7 = x mod 7 and x 13 mod 13 = x mod 13 and x 19 mod19 = xmod19 for every integer x. Suppose x 1 7, x 113, and x 1 19. Then
= (X 6 )288 mod 7 = 1288 mod 7 = 1 x 1728 mod 13 = (x I2 ) 144 mod 13 = 1144 mod 13 = 1 1728 x mod 19 = (X 18 )96 mod 19 = 196 mod 19 = 1 X
1728
mod 7
and hence by the Chinese remainder theorem, x 1728 mod 1729 = 1, which means that x l729 mod 1729 = x mod 1729. Suppose that x mod 7 = 0, x 1 23, and x 1 41. Then X
I729
mod 7
= 0 = xmod 7
= (X I2 ) 144 mod 13 = 1144 mod 13 = 1 l728 x mod 19 = (x I8 )96 mod 19 = 196 mod 19 = 1 x l728
mod 13
and hence x l729 mod 7 = 0 = x mod 7 and x 1729 mod 13 = x mod 13 and x l729 modl9 = xmod19 so that X 1729 mod 1729 = xmod1729 by the Chinese remainder theorem. The remaining cases can be handled in a similar manner. Observe that 1729 = 103 + 93 = 123 + 13 . 15. Let x be an integer and p a prime dividing n. If p divides x, then xn
mod p
= 0 = x mod p
If p does not divide x, then x n 1
=
(x p _ 1 )(nl)/(pl)
==
l(nl)/(pl)
== 1
(modp)
so xn mod p = x mod p. Thus this equation holds for any prime p dividing n. By the Chinese remainder theorem, xn
mod n
= x mod n
PROBLEMS 7.4
355
17. Set m = 1 and do a loop such as
for k from 1 to 100 do; if isprime(6*k+l) = true and isprime(12*k+l) = true and isprime(18*k+l) = true then c[m]:=(6*k+l)*(12*k+l)*(18*k+l); m:=m+l; end if; end for and observe that c (1)
1729
c (2)
294409
=
c (3)
56052361
c (4)
118901521
c (5)
172947529
c (6)
216821881
c (7)
228842209
c (8)
1299963601
c (9)
2301745249
Problems 7.4
l
1. Since V899J
= 29, 899 2
= 4491.2
8~9
= 299~
899 5 
179 i5
81...§..
899 13 
692
= 47...2.. 19
23 =
899
392
8~9 = 128¥
899 = 11
899 _ 5215 17 17
899 19
899 29 
and hence 899
we check
11
13
23
31
= 29 . 31.
3. Note that gcd (2, 899) = 1. Factoring, we have 898 = 2 x 449. The calculations 2449 mod 899 = 698 and 698 2 mod 899 = 845 show that 899 is composite. 5. Since 2P  1 modp = 26747, it follows from Fermat's little theorem that p is composite. Factorization shows that p = 449 x 457.
SOLUTIONS TO ODD PROBLEMS
356
7. We have 187736503  1 = 2 x 93868251. Note that 293868251 mod 187 736 503 = 1 393868251 mod 187 736 503 = 1 593868251 mod 187736503 = 1 793868251 mod 187 736 503 = 1 1193868251 mod 187 736 503 = 1 1393868251 mod 187736503 = 1 1793868251 mod 187 736 503 = 1 1993868251 mod 187 736 503 = 1 2393868251 mod 187 736 503 = 1 2993868251 mod 187 736 503 = 1 and hence 187736503 passes Miller's test with n = 10 trials. x Then I' (x )  lnxx·i Inx1 ~ 1 d h ence lnx' (Inx)2 ~ ~ lnx an 100 I' (10 ) = 4. 324083649 x 10 3, so the average gap between primes is 4.324083~49X10 3 ~ 231. Assuming that on average you start halfway
9 . Let
1 (x ) 
between two primes, and you only check even numbers, you will expect to test about 231/4 ~ 58 numbers. 11. The gaps are 949  268 = 681 1293  1243 = 50 2773  1983 = 790 2911  2809 = 102 3469  2967 = 502
1243 1983 2809 2967 3501 
949 = 294 1293 = 690 2773 = 36 2911 = 56 3469 = 32
so the average gap is 681 + 294 + 50 + 690 + 790 + 36 + 102 + 56 + 502 + 32 = 323~ 10 10 which is somewhat larger than the expected gap given in problem 9.
Problems 7.5 1. Note that gcd (7,100) = 1. We have 73 7 mod 101 = 40 and 7 1 mod 100 = 43 and 40 43 mod 101 = 73, and hence 73 is recovered. 3. For example, let p
= 3391691164919859649719340532627567207 607656859034356995566589707894210757 866827613621 721127496191413
PROBLEMS 7.6
357
be the smallest prime ~ 5150 mod 10100 5. The numbers 2047679804982929369090035623502251 062360672 859 815 645 1503714396228131674104263081904252158592322776941888 958411586724601781693914292292892305522540318192 363442582571176226543020134304037361597914795908 agree at 10 spots (see the bold digits). This is not a surprise because the process does a good job of mixing, and random 100digit numbers would be expected to agree in about 10 spots (onetenth of the time).
Problems 7.6 1. Since 24 = 23 3, the integers {I, 5, 7, 11, 13, 17, 19, 23} are relatively prime
to 24 and cp(24) 3. We have cp(27)
= 8.
= cp(3 3 ) = 33  32 = 18. There are 18 integers
1,2,4,5,7,8,10,11,13,14,16,17,19,20,22,23,25,26 less than or equal to 27 that are relatively prime to 27. 5. Since 1001 = 7 x 11 x 13, we have
cp(1001) = cp(7)cp(11 )cp(13) = 6 ·10 ·12 = 720 Note that
5720 mod 1001 = 1
7. We start with the least nonnegative residue system R and construct
= {O, 1,2,3,4,5,6,7,8, 9}
{7r + 4 1r E R} = {4, 11, 18, 25,32, 39, 46, 53, 60, 67} Note that 4mod10 11 mod 10 18 mod 10 25 mod 10 32 mod 10 and hence each element of {7r exactly one element of R.
4 1 8 5 2
39mod10 46 mod 10 53 mod 10 60 mod 10 67mod 10
+ 41 r E R}
= = = = =
9 6 3 0 7
is congruent modulo 10 to
SOLUTIONS TO ODD PROBLEMS
358
9. Let p be a prime that divides n. If p does not divide a, then aP 1 (modp) so a'P(n) == 1 (modp)
1
_
because p  1 divides
== a (modp)
On the other hand, if p does divide trivially, a'P(n)+l
a,
then
== 0 ==
a
a'P(n)+l
(modp) so,
== a (modp)
Thus a'P(n)+l == a (modp) for each prime dividing n. But this says that each prime that divides n also divides a'P(n)+l  a, so if n is a product of distinct primes, then n must divide a'P(n)+l  a, that is, a'P(n)+l a (modn).
Chapter 8
Public Key Ciphers
Problems 8.1 1. As m = 5· 7, we have
z
=
4.6
=
24. Then d =
x e mod m = 2211 mod 35 = 8 ydmodm = 811 mod 35 = 22
See the disc for details of these computations. 3. As m = 29·31, we have
=
= 840 and d
=
Y = x e mod m = 555 101 mod 899 = 731
z = yd mod m = 731 341 mod 899 = 555 5. Let x = 99999999999999, m = 25972641171898723, e 25972640809676568 and note that y
= 997, and
=
= x e mod m = 4815828410330867
d = e 1 mod
yields yd mod m = 99999999999999. 7. The numbers p and q are found using p+q = m
V
PROBLEMS 8.2
359
Then P = (p+q)!(pq) = 1577721810442045796135801 753173 108424 529493235712363682079169439737077 and q = (p+q);(pq) =13903 921956248276860434553177560567483064851642185956 700 075183 216869937. As a check, pq = 21936520921056942428185744321881874204790829 920570235226904516467385564406736567597367535979 699 930 859 170667289061009756151158068196185554149 9. There are
Problems 8.2 1. We have 123 mod 15 = 3 and 35 mod 21 = 12 and hence Kyle sends the message 12 to Sarah.
3. The product Pbqb is given by nb = 2748401· 157849763 = 433834 446478963 so the public key is (eb, nb) = (9587,433834446478963). Since
5. Since ns = 37847755706513 < nb = 433834446478963, Sean decrypts the message by first applying Brendon's public key, then Sean's private key to get (386686175803129 9587 mod nb) 28526126032457 mod ns = 511239719324328526126032457 mod ns = 1234567890
7. Since nj < nb, the plaintext message is encrypted by first using Janet's public key, then using Brendon's private key to get (99 999 999 7853 mod 15 092 177) 164165 mod 29 143 171 = 6136937164165 mod 29143171 = 24506902 9. Encryption yields (2000000 7907 mod49 839 739)22913165 mod 26 513 567
= 4557462622913165 mod 26 513 567 = 6765427
SOLUTIONS TO ODD PROBLEMS
360 and decryption yields
(67654274637 mod 26 513 567t 679 243 mod 49 839 739 5
= 1906105945679243 mod 49 839 739 = 44781288 Information can be lost when modular arithmetic with a large modulus is followed by modular arithmetic with a smaller modulus. 11. Since nj > nb, the plaintext message is encrypted by first using Brendon's private key, then using Janet's public key to get (99999999260733157830321636619 mod 986577727411807628569)177264463 mod 7029 757456346007993017
= 889504247126301481385177264463 mod 7029 757456346007993017 = 6165005940876305088312 13. Encryption yields 70849375393993065812 and decryption yields 333146 600281 273 156600517. Information can be lost when modular arithmetic with a large modulus is followed by modular arithmetic with a smaller modulus. By first applying Sarah's private key followed by Preston's public key, the encrypted message is 30564624919862526996750 and decryption yields 101010101010 101 010 101. See the disc for details of these computations.
Problems 8.3 1. The ASCII values are given by
and hence the equivalent positive integer is 50 + 94·256 + 52.256 2+ 61· 256 3 + 49.256 4 + 54.2565 = 59585108139570 3. Sarah first translates the plaintext to large integers using the table
R
0
n
82
111 s 115
110 32
0
r
111
114
i
105 s 115
32 a 97 32
R
i
82
105
v 118
e 101
p
r
0
112
114
111
32
77
32 a 97
M
t
116
s 115 f 102 I 73
t
116 e 102
32 s 115
T
84
46
PROBLEMS 8.4
361
and the calculations x = 82 + 111c + 110c2 + 32c3 + 82c4 + 105c5 + 118c6 + 101c7 + 115c8 + 116c9 + 32c10 + 105cll + 115c12 + 32c13 + 97c I4 + 32cI5
+ 112c16 + 114c17 + 111c18 + 102cI9 = 584802410 296 329 453 294 993 117073566607047018835794 Y = 102 + 115c + 115c2 + 111c3 + 114c4 + 32c5 + 97c6 + 116c7
+ 32c8 +
77c9 + 73c lO + 84c ll + 46c I2 = 3670580832286885393984052753254
Since nk < n s , Sarah first uses Kyle's public key, then her private key to encrypt the message as (x ek mod nk)d s mod ns = 6642642701546739554009203
231203625130908152661584571 (ye k mod nk)d mod ns = 5781828020001339664110566 s
141724658323575128107486053 5. The message is Multiplication is easy, but factorization is hard.
See the disc for details. 7. Since nk < n s , Kyle first uses Sarah's public key then his own private key to calculate the numbers (x997 mod ns) dk mod nk, (y997 mod ns) dk mod nk, and (z997 mod ns) dk mod nk. The message is
RSA keys are typically 1024 to 2048 bits long See the disc for details.
Problems 8.4 1. Note that
2=2<3 2+3=5<6 2 + 3 + 6 = 11 < 12 2 + 3 + 6 + 12 = 23 < 24 2 + 3 + 6 + 12 + 24 = 47 < 48 2 + 3 + 6 + 12 + 24 + 48 = 95 < 96 2 + 3 + 6 + 12 + 24 + 48 + 96 = 191 < 200 so the sequence {2, 3, 6,12,24,48,96, 200} is super increasing.
SOLUTIONS TO ODD PROBLEMS
362
3. Since 2 + 3 + 6 + 12 + 24 + 48 + 96 + 200 = 391 < 453, it follows that m = 453 is an appropriate modulus. Also, gcd (453,61) = 1 and hence k = 61 has an inverse modulo 453. The public key is given by
= 122 3·61 mod 453 = 183 6·61 mod 453 = 366 2·61 mod 453
12·61 mod 453 = 279 24·61 mod 453 = 105 48·61 mod 453 = 210 96·61 mod 453 = 420 200 . 61 mod 453 = 422 The encrypted message is given by (122,183,366,279,105,210,420,422). (1,0,0,1,0,1,1,0)
= 1031
To decrypt the message, note first that 61 1 mod 453 = 52 and hence the original superincreasing sequence is given by 122·52 mod 453 = 2
=3 366· 52 mod 453 = 6 279 . 52 mod 453 = 12 183·52 mod 453
105 . 52 mod 453 = 24 210 . 52 mod 453 = 48 420 . 52 mod 453 = 96 422 . 52 mod 453 = 200 and 1031 . 52 mod 453 = 158 We now deduce that 158 = 96 + 62 62 = 48 + 14 14 = 12 + 2 so 158 and the plaintext is (1
= 96 + 48 + 12 + 2
°° ° 1
1 1
°)2'
PROBLEMS 8.5
363
5. Note that 1=1<3 1+3=4<5 4+ 5 = 9 < 10 9 + 10 = 19 < 20 19 + 20 = 39 < 40 39 + 40 = 79 < 80 79 + 80 = 159 < 160 159 + 160 = 319 < 320 319 + 320 = 639 < 640 639 + 640 = 1279 < 1280 1279 + 1280 = 2559 < 2560 2559 + 2560 = 5119 < 5120 5119 + 5120 = 10239 < 10240 10239 + 10240 = 20479 < 20480 20479 + 20480 = 40 959 < 40960 40959 + 40960 = 81919 < 81920 81919 + 81920 = 163839 < 163840 so the sequence 1,3,5,10,20,40,80,160,320,640,1280,2560,5120,10 240, 20480,40960,81920,163840 is superincreasing. 7. The public key is 997, 2991, 4985, 9970,19940,39880,79760,159520,319040, 310261,292703,257587,187355,46891,93782,187564,47 309,94618. The ciphertext is 860321 mod327819 = 204683. The private key is 997 1 mod 327819 = 133495. To decrypt, multiply by 133495 and reduce modulo 327819 to get the superincreasing sequence 1,3,5,10,20,40,80,160,320,640,1280,2560,5120, 10240,20480,40960,81920, 163840 and the sum 133495·860321 mod327819 = 115616. Now 115616 = 81920 + 33696 33696 = 20480 + 13216 13216 = 10 240 + 2976 2976 = 2560 + 416 416 = 320 + 96 96 = 80 + 16 16 = 10 + 6 6=5+1 so the plaintext is 101100101001011010.
SOLUTIONS TO ODD PROBLEMS
364
Problems 8.5 1. Use a computer algebra system to verify that q = 1091381946026415813817
094712889364130135 176 179079 is prime. The evaluations q  2159 = 360631127360964354715252
296531 222620307209907591 160 q 2 = 370 119691 304487104386590 119826918889520756363897 show that 2159 < q < 2160 . 3. Evaluation of p  1 mod q should produce O. 5. The order of 9 must divide the prime q. Since the order of 9 is not 1, it must be exactly q. 7. The generalized prime number theorem implies that 1 x (x) ~ r.p (q) . lnx
7r q ,m
Let f(x) =
lr~x
=
q~l
.
l:x' The derivative is given by 1
f'(x)=q_1'
lnxx l
1
(lnx)2X~qlnx
and hence the average gap between primes in the arithmetic sequence kq+ 1 is roughly qlnx. Since q ~ 2160 and x ~ 2512 and we only check every 2q, and on average we start halfway between such primes, the average number of trips through the loop should be about In 2512 4
Chapter 9
~
354. 8913564/4 ~ 89
Finite Fields
Problems 9.1
+ aO= a (0 + 0). So aO + aO aO to both sides of this equation gives aO = O.
1. From the distributive law, aO
= aO. Adding
PROBLEMS 9.1
365
3. The system
3x+7y+6z = 2 4x+5y+3z = 2 2x+4y+5z = 4 is equivalent to the matrix equation
Calculate the inverse modulo 5 and multiply to get
Thus x = 1, y = 4, z = 1. As a check, note that 3 . 4 + 7 . 4 + 6 . 2 mod 5 = 2 4 . 4 + 5 . 4 + 3 . 2 mod 5 = 2 2 . 4 + 4 . 4 + 5 . 2 mod 5 = 4 5. Solve the system
3x+ 9y+4z = 8 2x+3y+5z = 2 5x + 4y + 9z
= 10
over the rational numbers to get
Reduce modulo 11 to produce
32
7 mod 11 = 3 omod 11 = 0 10 mod11 = 8 7
SOLUTIONS TO ODD PROBLEMS
366 As a check, note that indeed
3 . 3 + 9 . 0 + 4 . 8 mod 11 = 8 2 . 3 + 3 . 0 + 5 . 8 mod 11 = 2 5 . 3 + 4 . 0 + 9 . 8 mod 11 = 10 7.
+
o
o 2
2
3
4
3
4
4
5
4
3
4
4
4
6
6
7
6 7
8
9
10
11
12
13
14
15
16
8
9
10
11
12
13
14
15
16
10
11
12
13
14
15
16
o
o
7
6
7
8
9
10
11
12
13
14
15
16
o
7
8
9
10
11
12
13
14
15
16
8
9
10
11
12
13
14
15
16
o
o
6
7
8
9
10
11
12
13
14
15
16
7
8
9
10
11
12
13
14
15
16
o
o
7
7
9
10
11
12
13
14
15
16
8
8
10
11
12
13
14
15
16
o
10
11
12
13
14
15
16
o
9 10
10
11
12
13
14
15
16
11
11
12
13
14
15
16
o
o
12
12
13
14
15
16
13
13
14
15
16
o
14
14
15
16
o
15
15
16
o
16
16
x 4
6
2
11
12
13
12
13
14
4
5
6
8
9
10
11
12
13
14
15
11
7
5
5
10
15
3
13
6
6
12
7
7
14
13 16
12
12
7
13
13
9
14
14
11
8
15
15
13
11
16
16
15
14
10 14
13
6
14
11
3
8
11
12
13
14
15
10
11
12
13
14
15
16
9
11
13
15
11
14
9
13
7
12
3
10
8
16
5 10
13
15
2
4
10
16
9
16
6
13
3
11
2
10
14
6
15
7
16
11
4
14
7
12
6
15
15
5
12
13
4
4
13
12
12
9 15
9
3
9
4
16
11
6
14
10
6
2
15
11
16
13
10
7
4
16
14
11
10
15 14
5
16
14
9
3
9
14
4
14
3
2
10 16
4
12
16
11 8
12
10
16
7 13
7
4
12
10
12
10
16
11
11
11
11
9
10
10
10
9
12
11
9
9
10
14
15
8
9
12
7
7 7
10
8
6
10
9
7
7
8
16
7
6
8
4
9
7
7
7
7
11
6
6
7
4
4
3
5
4
6
7
5
4
4
5
6
15
4
3
4
4
10
4
4
3
3
4
8
3
4
4
4
8
3 3
4
2
8 13
8
7
11
9
13
8
3
15
10
7
3
16
12
8
4
15
12
9
6
3
6
4
2
12
10 4
PROBLEMS 9.2
367
9. The definition of a field contains the following two properties: al = a and, if a :f. 0, then ax = 1 for some x. The element in the set of integers modulo 10 under addition and multiplication such that al = a for all a in the set is the congruence class of the number 1. The multiplication table for the set of integers modulo 10 is 1
1 1
2 3 4 5 6 7 8 9
2 3 4 5 6 7 8 9
2 2 4 6 8 0 2 4 6 8
3 3 6 9 2 5 8 1 4 7
4 4 8 2 6 0 4 8 2 6
5 6 5 6 0 2 5 8 0 4 5 0 0 6 5 2 0 8 5 4
7 7 4 1 8 5 2 9 6 3
8 9 8 9 6 8 4 7 2 6 0 5 8 4 6 3 4 2 2 1
and you can see that there are several rows that do not contain 1. For example, there is no element in the set for which 2n = 1. If this were a field, every element would have to have a multiplicative inverse. 11. To factor x 2 + 7x + 10 = (x  a) (x  b) over GFll , look for a and b in the Cayley tables for G Fll so that a + b = 7 mod 11 = 4 and ab = 10 mod 11. The solution is x = 6 or x = 9.
Problems 9.2 1. The sum (5x 3
+ 4x2 + 3) + (4X4 + 6x 2 + 3x + 5) mod 7 is equal to 4X4
3. The product (5x 3 6x
7
+ 5x 3 + 3x 2 + 3x + 1
+ 4x 2 + 3) (4x 4 + 6x 2 + 3x + 5) mod 7 is + 2x 6 + 2x 5 + 2X4 + 2x 3 + 3x 2 + 2x + 1
5. The division algorithm in GF7[x] writes 4x4
+ x 2 + 3x + 1 as
+ 3) (5x 3 + 4x 2 + 3) + 3x 2 + 2x + 6 so the answer is 3x 2 + 2x + 6. Factoring the polynomial in Q [x] gives (x  3)2 (x + 3) (3x + x 2  2) which (5x
7.
IS
(x
+ 4)2 (x + 3) (3x + x 2 + 5) mod 7
9. The codeword x 4p(x)
+ (X4p (x) modg (x)) mod 2 is equal to
368
SOLUTIONS TO ODD PROBLEMS
11. Let n be a positive integer. If n is 1 or a prime, then we are done. Otherwise n = ab where a and b are positive integers greater than 1. So a < nand b < n. By the principle of complete induction, we may assume that each of a and b is a prime or a product of primes. So n = ab is a product of primes.
13. Computing (r (x) modg (x)) mod 2 gives
X
15
+ x6 + x3 +
X
+ 1, so at least
one error has occurred. The plaintext must be retransmitted.
Problems 9.3 1. The multiplication table is given by
(
~
) (0
1
()
() + 1) mod 2 =
()+1
(~
o
o
1
() ()2
()
0 ()+1 ()(()+1)
()+1 o ) ()(()+1) (()+1)2
where (()2 mod ()2 + () + 1) mod 2 = () + 1, (() (() + 1) mod ()2 + () + 1) mod 2
= 1, and (( () + 1)2 mod ()2 + () + 1) mod 2 = (), so the multiplication table is given by
o 1 ()
()+1
o o o o o
()+1
1
()
o
o
o
1
()
()+1
()
()+1
1
()+1
1
()
Addition is vector addition modulo 2. In particular, 0+0 (() + 1) + (() + 1) = 0, so the addition table is given by
+ 0 1 ()
()+1
0 0+0 1+0 ()+O ()+1+0
1 0+1 1+1 ()+1 ()+1+1
()
O+() 1+() ()+1 ()+1+()
= 1+1 = ()+() =
()+1 0+()+1 1+()+1 ()+()+1 ()+1+()+1
which reduces to
+ 0 1
0 0 1
()
()
1 1 0 ()+1
()+1
()+1
()
3. Let p (x), q (x), r (x) E Z [xl and set s (x)
() ()
1+() 0 1
()+1 ()+1 ()
1 0
= x 2 + X + 1. Then
PROBLEMS 9.3
369
(p (x) + q (x)) + r (x) mod s (x) = p (x) + (q (x) + r (x)) mod s (x) (p (x) q (x)) r (x) mod s (x) = p (x) (q (x) r (x)) mod s (x)
so
[[P (x) + q (x)] + r (x)] = [p (x) + [q (x) + r (x)]] [p (x) q (x)] [r (x)] = [p (x)] [q (x) r (x)] 5. Suppose
h (x) == 12 (x) (mod h (x)) and Then
12 (x) + p (x) h (x)
h (x)
=
91 (x)
= 92 (x) + q (x) h (x)
for some p (x), q (x) E Z [x]. Thus
h (x) + 91 (x) = 12 (x) + 92 (x) + (p (x) + q (x)) h (x) h (x) 91 (x) = 12 (x) 92 (x) + (12 (x) q (x) + 92 (x) P (x) + p (x) q (x) h (x)) h (x) so
h (x) + 9d x) == 12 (x) + 92 (x) (mod h (x) ) h (x) 9d x) == 12 (x) 92 (x) (mod h (x) ) 7. Note that
f transforms the addition table + 0 1 8 8+1
0 0 1 8 8+1
1 1 0 8+1 8
8 8 1+8 0 1
8+1 8+1 8 1 0
0 0 1 /3 /3+1
1 1 0 /3+1 /3
/3 /3 1+/3 0 1
/3+1 /3+1 /3 1 0
into the addition table + 0 1 /3 /3+1
SOLUTIONS TO ODD PROBLEMS
370
and the multiplication table
x 0
1 8 8+1
0 0 0 0 0
1
8
0
0
0
1 8 8+1
8 8+1 1
8+1 1 8
1
/3
/3+1
0
0
0
1 /3 /3+1
/3 /3+1 1
/3+1 1 /3
8+1
into the multiplication table
x 0
1 /3 /3+1 so
0 0 0 0 0
f (s + t) = f (s) + f (t) and f (st) = f (s) f (t) for all s, t E G F4 .
9. Let r (x)
= f (x) modx 2 + x + 1. Then f (x)  r (x)
= k (x) (x 2
+ X + 1) = o.
for some k (x) E GF2 [x], and deg (r (x)) < 2 or r (x) If s (x) E [f (x)] then
f (x)  s (x)
= h (x) (x
2
+ X + 1)
for some h (x) E GF2 [x]. Suppose that deg (s (x)) < 2 or s (x)
r (x)  s (x) = =
= O. We have
(J (x)  k (x) (x 2 + X + 1)) (h (x)  k (x)) (x 2 + X + 1)
so if (h (x)  k (x))

(J (x)  h (x) (x 2 +
X
+ 1) )
# 0, then
deg (r (x)  s (x)) = deg (h (x)  k (x)) But this is not possible. Thus h (x)k (x)
+2 2
2
= 0, implying that r (x) = s (x).
PROBLEMS 9.4
371
Problems 9.4 1. Note that
(0 2
+ 1) (0 2 + 0) = 06 . 04 = 010 = 07 . 03
=
1 .03
= 0+1
3. Note that E· E = (1110) . (1110)
+ 02 + 0) . (0 3 + 02 + 0) 5 4 3 2 06 + 20 + 30 + 20 + 0 mod 2 4 2 4 (0 6 + 0 + 0 mod 0 + 0 + 1) mod 2 03 + 0 + 1 = (1011) = B
= (0
= = =
3
and 8 . A = (1000) . (1010) =0 3 .(03 +0)
+ 04 mod 04 + 0 + 1) mod 2 = 03 + 02 + 0 + 1 = (1111) = F =
(0
6
5. These polynomials are irreducible over GF2 :
x 5 + X4 x 5 + X4
+ x3 + X + 1 + x3 + x2 + 1 x5 + x3 + 1 x 5 + X4 + x 2 + X + 1 x 5 + x3 + x 2 + X + 1 x5 + x2 + 1 7. Note that in GF2 ,
x 5 + X + 1 mod 2 = (x 3 + x 2 + 1) (x 2 + X + 1) 9. The given polynomials are irreducible because they have no roots in GF2 . That is,
[x 3 + x2 + 1] x=o = 2 3 [x +x + 1Jx=1 = [x 3 + X + 1Jx=o =
1 1 1
[x3+ x +1Jx=1=1
SOLUTIONS TO ODD PROBLEMS
372
modulo 2. Here is a complete list of the remaining polynomials of degree 3 together with an evaluation that shows that each polynomial has a root:
[x 3 L=o = 0 [x 3 + 1]x=1 = 0 [x 3 + x]x=o = 0 [x3+ X2] x=O =0 3 2 [x + x + x L=o = 0 [x 3 + x2 + X + 1L=1 = 0 This exhausts all eight possible polynomials of degree 3.
Problems 9.5 1. The polynomials
x 2 +4x+ 1 x 2 +x+1 x 2 +2 x 2 + 2x + 3
x 2 +x +2 x 2 +3x +4 x 2 +2x+4
x 2 +4x+ 2 x 2 +3x+3 x 2 +3
are all irreducible. 3. Let k be the least positive integer such that a k = 1 and assume that an = 1. Write n = kx + b, where 0 S b < k. Then an = 1 = akx+b = (a k ab = 1 . a b implies a b = 1. Since k is the least positive integer with this property, it follows that b = 0, and hence kin. If k =f n, then k I ~ for some prime divisor p of n. Thus an/ p = (akf = 1.
r
5. The three polynomials are irreducible because
[X2 + 1] 0 mod 3 = 1 [X2 + 1] 1 mod 3 = 2 [x 2 + 1] 2 mod 3 = 2
[x 2 + X + 2] 0 mod 3 = 2 [X2 + 2x + 2] 0 mod 3 = 2 [x 2 + X + 2] 1 mod 3 = 1 [x 2 + 2x + 2] 1 mod 3 = 2 [X2 + X + 2L mod 3 = 2 [x 2 + 2x + 2L mod 3 = 1
shows that none of the polynomials has a root in G F 3 . 7. Let 0 be a root of x 3 + 2X2 + X + 1 in G F27 . The order of 0 divides 26 and hence is 2, 13, or 26. Note that (0 26 mod 03 + 202 + 0 + 1) mod 3 = 1 13
mod 03 + 20 2 + 0 + 1) mod 3 = 2 (0 2 mod 03 + 20 2 + 0 + 1) mod 3 = 02
(0
and hence 0 is an element of order 26.
PROBLEMS 9.5
373
9. Note that x 27  x mod 3
= x (x + 1) (x + 2) (x 3 + 2X2 + X + 1)
+ x 2 + 2) (x 3 + 2x + 1) (x 3 + 2x + 2) (x 3 + 2x2 + 2x + 2) (x 3 + 2X2 + 1) 2 2 3 (x + x + 2x + 1) (x 3 + x + X + 2) (x
3
is the product of all monic irreducible polynomials of degrees 1 and 3 in GF3[X]. 11. Consider the field G Fg.
a. Power y y2 y3 y4 y5 y6 y7 y8
Product x+l (x+l)(x+l) (x + 1) 2x (x + 1)(2x + 1) (x + 1) 2 (x + 1)(2x + 2) (x + 1) X (x+l)(x+2)
h. x 00 01 02 10 11 12 20 21 22 See the
c.
+ 0 1 2 3 4 5 6 7 8
0 0 1 2 3 4 5 6 7 8
1 1 2 0 4 5 3 7 8 6
2 2 0 1 5 3 4 8 6 7
3 3 4 5 6 7 8 0 1 2
00 00 00 00 00 00 00 00 00 00 disc
4 4 5 3 7
8 6 1 2 0
02 00 02 01 20 22 21 10 12 11
11 00 11 22 12 20 01 21 02 10
12 00 12 21 22 01 10 11 20 02 for the addition table.
5 5 3 4 8 6 7 2 0 1
01 00 01 02 10 11 12 20 21 22
modx 2 + 1 x+l 2x 2x  2 1+3x 2x+2 4x xI 1 +3x
Expand x+l x 2 + 2x + 1 2x2 + 2x 2X2 + 3x + 1 2x+2 2X2 + 4x + 2 x 2 +x 2 x +3x+2
6 6 7 8 0 1 2 3 4 5
7 7 8 6 1 2 0 4 5 3
10 00 10 20 02 12 22 01 11 21
8 8 6 7 2 0 1 5 3 4
x 0 1 2 3 4 5 6 7 8
0 0 0 0 0 0 0 0 0 0
20 00 20 10 01 21 11 02 22 12
1 0 1 2 3 4 5 6 7 8
2 0 2 1 6 8 7 3 5 4
21 00 21 12 11 02 20 22 10 01
3 0 3 6 2 5 8 1 4 7
mod 3 x+l 2x 2x+ 1 2 2x+2 X x+2 1
22 00 22 11 21 10 02 12 01 20
4 0 4
8 5 6 1 7 2 3
5 0 5 7 8 1 3 4 6 2
6 0 6 3 1 7 4 2 8 5
7 0 7 5 4 2 6 8 3 1
8 0 8 4 7 3 2 5 1 6
SOLUTIONS TO ODD PROBLEMS
374
Problems 9.6 1. The divisors of 12 are 1,2,3,4,6, and 12. The following table shows that
there are exactly
1 1 2 2 2 4
Elements 1 12 3,9 5,8 4,10 2,6,7,11
3. In any group, anam = a n +m for any integers nand m. In particular, aOa n = aO+ n = an = a n +O = ana o so aO = 1, the identity. The inverse of an is a n because ana n = a n  n = aO = 1. The product of two elements of (a) is in (a) because anam = a n+m E (a). Thus (a) is a subgroup. 5. Let a,b E G. (a) Assume an = 1 and let n = k· o(a) + r, where 0:::; r < o(a). Then 1 = an = ak.o(a)+r = (ao(a))k a r = a r implies r = 0 [since o(a) is the smallest positive integer i such that ai = 1], so that 0 (a) In. (b) Since ab = ba it follows that anbn = (ab t for every integer n. Let o (a) = sand 0 (b) = t. Note that (ab)st = astb st = (as)t W)S = 1 implies 0 (ab) I st. If (abt = 1, then anbn = 1 implies an = b n and hence 1 = (ast = (an)S = (bnt = b ns and hence tins, but s .1 t implies tin. Similarly, sin. Thus st I n. In particular, if n = 0 (ab), then st I 0 ( ab ). Hence st = 0 ( ab ).
7. Suppose m  1 = nt. Then x m  1  1 = xnt  1 is equal to xn  1 times the polynomial xn(tl) + x n (t2) + X n (t2) + ... + xn + 1. 9. The divisors of 30 are 1, 2, 3, 5, 6, 10, 15, and 30. The following table shows that there are exactly
1 1 2 4 8
Elements 1 16 4,13 2,8,9,15 3,5,6,7,10,11,12,14
PROBLEMS 9.7
375
Problems 9.7 1. Since factor (997) = 997 it follows that 997 is the largest threedigit prime. Note that factor (996) = 223 x 83. Since 525 996 / 2 mod 997 = 996 525 996 / 3 mod 997 = 304 525996/83 mod 997 = 701 it follows that 525 is primitive. The first 10 terms of the pseudorandom number sequence are given by 789· 525 mod 997 = 470 470· 525 mod 997 = 491 491 . 525 mod 997 = 549 549 . 525 mod 997 = 92 92 . 525 mod 997 = 444 444 . 525 mod 997 = 799 799 . 525 mod 997
= 735
735 . 525 mod 997 = 36 36 . 525 mod 997 = 954 954 . 525 mod 997 = 356 3. There are
x 10 x 124846 x 182040 = 454539316800
primitive elements in GF999999999989. Thus over 45% of the numbers less than 999999999989 are primitive. Hence the average gap between primitive elements is just over 1. 5. The expected number of unbroken squares (see Problem 4) is 16
c:)
16
~ 5.697186087
7. Use something like
randomize set trials = 1000000 for i from 1 to trials do if rnd~2 + rnd~2 + end for print 8*n/trials end
rnd~2
< 1 then set n = n+l
SOLUTIONS TO ODD PROBLEMS
376
With 1000000 trials, this algorithm produced 4.192168 compared with the exact value 471" /3 ~ 4. 188790205. 9. Use something like randomize set trials = 1000000 for i from 1 to trials do set n abs(rnd  rnd) end for print n/trials end
=
With 1000000 trials, the algorithm produced an approximate length of 0.3335381. The expected length can be represented by the integral
210
1
x (1  x) dx
=
~
where x is the expected length and 2 (1  x) is the probability density function on the unit interval. It can also be represented by the double integral 1
10 10
1
Ix  yl
where x and yare the endpoints and function on the unit square.
dx dy
=
~
f (x, y) = 1 is the probability density
11. Results of an experiment with 1000000 trials repeated 10 times: 0.10005552 0.10080621 0.09980552
0.10020009 0.09980621 0.10004283
0.10016799 0.10029138
0.09977582 0.09948852
The expected area is given by the integral
r x 2 (1 _ x)2 dx = ~10 io 1
3
where x 2 is the area of a square of side x and 3 (1  X)2 is the probability density function. Note that the vertex in the lower left corner of a square must be chosen from a square of edge 1  x.
Chapter 10
ErrorCorrecting Codes
Problems 10.1 1. If x 3 + X + 1 were reducible over G F2, then it would have a root in G F2 = {O, I} because the degree of x 3 + x + 1 is 3. However, 03 + 0 + 1 mod 2 = 1
377
PROBLEMS 10.1
and 13 + 1 + 1 mod 2 = 1, so X3 +x+ 1 has no roots in GF2. Thus x 3+x+ 1 is irreducible over G F2 . 3. If 0 is a root ofx 3+x+l, then ml (x) = m2 (x) = x 3+x+l, so that 9 (x) = x 3 + X + 1. Given a plaintext polynomial a (x) = a3x3 + a2x2 + alX + ao with
ai E
{O, I}, the codeword is given by a (x) 9 (x) mod 2
The following is a list of all polynomials of degree :::; 3 with their corresponding codewords.
x x+l x2 x2 + 1
a (x) 9 (x) mod 2 0 x 3 +x+ 1 X4 +x2 +x x4 + x 3 + x 2 + 1 x5 + x3 + x2 x 5 +x 2 +x + 1
a (x) x3 x3 + 1 x 3 +x x 3 +x + 1 x 3 +x2 x3 + x 2 + 1
x 2 +x x 2 +x + 1
x 5 +X4 +x 3 +x x 5 + X4 + 1
x 3 +x2 +x x 3 +x2 +x + 1
a (x) 0 1
a (x) 9 (x) mod 2 x 6 + x4 + x 3 x 6 +X4 +x+ 1 x 6 +x 3 +x2 +x x6 + x2 + 1 x 6 + x 5 + X4 + x 2 x 6 + x 5 + X4 + x 3 +x 2 +x+ 1 6 x +x 5 +x x6 + x5 + x3 + 1
Observe that the sum of any two distinct codewords is another codeword since
a (x) 9 (x)
+ b (x) 9 (x) mod 2 = (a (x) + b (x)) 9 (x) mod 2
and the degree of a (x) + b (x) :::; 3. Since all nonzero codewords have at least three nonzero terms, it follows that the minimum distance between codewords is 3. 5. If 0 + 1 is a root of an irreducible polynomial m (x), then 3
(0 + 1) mod 3 = 1 + 30 + 302
+ 03 mod 3 = 1 + 03
must also be a root of m (x). Since 0 + 1 must be a root of a polynomial of degree:::; 2, it follows that the minimal polynomial of 0 + 1 must be
(x  (0 + 1)) (x  (0 3 + 1)) mod a2 + 1 = x 2  2x  03X + 1 + 03  Ox + 0 + 04 mod 02 + 1 = x 2  2x + 2 mod 3 =x2 +x+2 As a check, note that
( (0
+ 1)2 + (0 + 1) + 2 mod 02 + 1) mod 3 = 0
so 0 + 1 is indeed a root of x 2
+ x + 2.
SOLUTIONS TO ODD PROBLEMS
378
7. If 03 + 02 is a root of a polynomial over GF2, then so are (0 3 + 02)2,
t
(0 3 + 02) 4, and (0 3 + 02
The minimal polynomial of u
= 03 + 02 is
= 04 + 20 is a root of a polynomial m (x), then so are u 3, u 9, u 27 , and 8I U . The minimal polynomial is
9. If u
((x  u) (x  u 3) (x  u 9) (x  u 27 ) (x = x 5 + 2x4 + 2x3 + 2
U
8I ) mod v) mod 3
where v = 05 + 03 + 0 + 1. 11. The minimal polynomial is
((x  (30 + 2)) (x  (30 + 2)5) mod 02  2) mod5 = x 2 + X + 1 13. Substituting b for b in the equation (a + b)P = aP + bP gives (a  b)P = a P + (I)P bP. If p is odd, then (I)P = 1, so this is just a P  bP. If pis even, then p = 2 so c = c for any c because 2c = O. 15. A polynomial code encodes the polynomialp (x) by the codewordg (x) p (x) This code encodes the polynomial p (x) by the codeword (1 + x + x 2) P (x 3) which does not have the right form. Suppose the plaintext word is
+ aIX + a2x2 + a3x 3 + a4x4. Then p (x 3) + a3x9 + a4x12and (1 + x + x 2) P (x 3) is
so the polynomial p (x) is ao
ao + aIx 3 + a2x6
ao
is
+ aox + aox 2 + aIx3 + aIx4 + aIx 5 + ...
Problems 10.2 1. Since long division produces
x 5 + X4 + x 3 + 1 x 3 +x+l
~~~ =
x2
2x2  X x +x+l
+ X + 1 3
:0
where the remainder 1  2X2  x mod 2 = x + 1 is not zero, we assume a single error. Thus c (x) + xk = x 5 + X4 + x 3 + 1, where c (0) = 0, so evaluation produces
Ok = (0 5 + 04 + 03 + 1 mod 03 + 0 + 1) mod 2 = 1  20 2  0 mod 2 = 0 + 1 = 03
PROBLEMS 10.2 and hence k
379
= 3.
Thus c (x)
= x 5 + X4 + 1 and long division produces
where the remainder 2  2X2 mod 2 = 0 and hence the plaintext is x 2 + 2 X  1 mod 2 = x + X + 1. 3. We have ml
(x) = x 2
m2
(x)
+X +2
= ((x 
B2) (x  B6) mod B2
+ B + 2) mod 3 = x 2 + 1
and hence
9 (x) = (x 2 + X + 2) (x 2 + 1) mod 3 = x4 + 3x2 + x 3 + X + 2 mod 3 = x4 + x 3 5. The order of B must divide 31, so
0
(B)
+ X+ 2
= 1 or 0 (B) = 31.
Since
(B mod B5 + B2 + 1) mod 2 = B =f. 1 it follows that
0
(B) = 31 and hence q (x) is a primitive polynomial.
7. The plaintext is x 19
+ x lO + X + 1.
(See disc for solution details.)
9. Note that ml
(x)
=
(x  0) (x  03 ) (x  09 )
= ((x  B) (x  03 ) (x  09 ) modq (0)) mod3 = x m2
(x)
3
+ 2x + 1
(x  02) (x  06) (x  018 ) = ((xB 2) (x06) (x018)modq(0)) mod 3 = x 3 +x 2 +x+2 =
so
p (x)
= ml
+ 2x + 1) (x 3 + x 2 + X + 2) mod 3 x 6 + x 5 + 2x 3 + 2x + 2
= (x =
(x) m2 (x)
3
Plaintext polynomials in GF3 [xl can be of degree at most 33

6  2 = 19.
SOLUTIONS TO ODD PROBLEMS
380
11. From problem 6, m3
(x) =
m1 m4
m1
(x) = x 3 +2x+ 1 and
m2
(x) = x 3 +x 2 +x+2. Since
(x) (why?), we need only find
(x) = (x  (1 4) (x  (1 12 ) (x  (1 36 ) = (xe 4) (x_e 12 ) (x_elOe 26 ) = ((xe 4) (x_e 12 ) (xelO)modq(e))mod3 3
= x +x
2+ 2
Hence 9
(x) = [m1 (x), m2 (x) ,m3 (x), m4 (x)] = m1 (x) m2 (x) m4 (x) 2 3 2 3 3 = (x + 2x + 1) (x + x + X + 2) (x + x + 2) mod 3 = x 9 + 2x8 + X7 + x 6 + x 5 + 2x4 + 2x3 + 2X2 + X + 1
Plaintext polynomials in GF3 [x] can be of degree at most 33  9  2 = 16.
Problems 10.3 1. Let 61 be a root of x4
+ x + 1.
Note that
(61 3 mod q (e)) mod 2 = 61 3 (61 5 mod q (e) ) mod 2 = 61 + 61 2 (61 15 mod q (e) ) mod 2 = 1 and hence 61 is primitive. 3. Note that 28 mod 17 = 1 and hence 2 has order at most 8. Since 38 mod 17 = 16, it follows that 3 has order 16 because the only prime dividing 17 1 = 16 = 24 is 2.
5. Note that 2128 mod 257 = 1 and hence 2 has order at most 128. Note that 3 128 mod 257 = 256. Since 2 is the only prime dividing 257  1 = 256 = 28 , it follows that 3 is primitive. 7. Let q (x) = x 8 + x4 + x 3+ x 2+ 1 and let 61 be a root in some extension field. We show that q (x) is primitive by showing that 0 (e) = 255 = 3 x 5 x 17. This is established by the following:
61 255 mod q (e) 61 255 / 3 mod q (e) 61 255 / 5 mod q (e) 61255/17 mod q (e)
=
1
+ 61 6 + 61 4 + 61 2 + 61 i= 1 61 3 + 61 i= 1
617
PROBLEMS 11.2
Chapter 11
381
Advanced Encryption Standard
Problems 11.1 1. Let Ui E {O, I} and define f (uo, Ul, U2, U3) = (uo + Ul, Uo, Ul + U2, U2 + U3). Given an 8bit word, let L denote the left 4 bits and R the right 4 bits. Define F(L,R) = (R,L+f(R)) The first iterations of F applied to (11111111) is given by 0 0 0 0 1 0 0 0
0 0 0 0 0 1 0 0
0 0 1 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 1 0 0 0 1 0
0 0 1 0 0 1 0 0 1 0 0 0 1 1 0 1
0 0 0 1 0 0 0 1
1 1 1 1 1 1 1 1
mod2=
1 1 1 1 1 0 1 1
whereas the first iteration applied to (11101111) yields 0 0 0 0 0 0 0 0 1 0 0 1 0 0 0 0
0 0 0 0 0 0 1 0
0 0 0 0 0 0 0 1
1 0 0 0 1 1 0 0
0 1 0 0 1 0 1 0
0 0 1 0 0 0 1 1
0 0 0 1 0 0 0 1
1 1 1 0 1 1 1 1
mod 2 =
1 1 1 1 1 0 1 0
See the disc for the complete solution. 3. The inverse of the function F (L, R) = (R, L
+f
(R)) is
G(L,R) = (R+f(L),L) since
G (F (L, R)) = G (R, L + f (R))
= (L + f
(R)
+ F (R) ,R) = (L, R)
5. The Hamming distance between the two vectors (0, I, I, 0, 0, 1,0,0) and (I, 1,0, 1,0, I, I, 1) is 5.
Problems 11.2 1. The product is
( (0 6 + 03
+ 0)
(0 7
+ 02 + 1) mod 08 + 04 + 03 + 0 + 1) mod 2 =
6
0
+0 + 1
SOLUTIONS TO ODD PROBLEMS
382
3. One solution is
x
+ x4 + x 3 + x 2 + 1. = 07 + 0 + 1 and y = 07 + 06 + 05 + 0 2 + O. 8
5. The answer is x for details of the solution.
See the disc
7. The inverse is AI _ ( 06
7
7
+305 +20 +0 +0 +0 +0 +1 4
0
0 7 0
+ 066 + 045 + 13 +0 +0 +0
)
See the disc for details of the solution.
Problems 11.3 1. Direct evaluation shows the product ofthese two matrices modulo 2 is the identity matrix. See the disc for details.
3. The inverse of 04 ( (0
4
+ 0 is
+ 0) 254 mod 08 + 04 + 03 + 0 + 1) mod 2 =
07
+ 05 + 03 + 0
= (10101010)
Apply the affine transformation 1 1 1 1 1 0 0 0
0 1 1 1 1 1 0 0
0 0 1 1 1 1 1 0
1 1 1 0 0 0 1 1
0 1 1 0 0 1 0 0 0 1 0 0 1 1 0 1 1 1 1 1 1 1 1 1
1 1 1 1 0 0 0 1
0 1 0 1 0 1 0 1
1 1 0 0 0 1 1 0
+
mod 2 =
1 0 0 1 0 0 1 1
Thus the byte (00010010) gets replaced by (11001001). 5. Apply the transformation
(J ~ (]
0+1 0 1 1
1 0+1 0 1
04 0 2 05 +0 +0 5 3 0 +0 +0
on (]
0 02 03 04
02 04 06 08
~) 06 09
8
mod 0
+ 04 + 0 3 + 0 + 1
0 12
0 6 +05 +0+1 0'+0'+0'+1 ) 4 2 4 5 3 6 5 3 0 +0 +0 +0 +0 +0 +0+ 1 0 +0 +0 +0 + 1 4 3 7 6 07 +05 +0 +0 +1 0 +0 +0 5 6 5 3 0 +0 +0 +0 0 +0+1 7
6
7. Let 13 be a primitive element of GFpn. Then u
= 13 k for some k. Thus
PROBLEMS 12.1
383
Chapter 12 Polynomial Algorithms and Fast Fourier 'Transforms Problems 12.1 1. The content and primitive polynomials are
1
1
(a) 2x2  3" x = 3" (6x2  1) 4 6 (b) 15x3  "7X2
1
1
+ 10 =
2
105 (14 x 3  45x2
+ 525)
1
(c) 3"x + 2 = "6 (2x + 3) (d) 14x2 21x+35=7(2x2 3x+5) 3. The interpolating polynomial is
p(x) = Yo
xXo 
= Yo  Yo = Yo
+Yl=Xl Xl  Xo X  Xl X  Xo + Yo + Yl=Xo  Xl Xl  Xo
+ Yl Xl 
5. Let p (x) = a + bx + CX2
+
X  Xo
Xl
Yo (x  XO) Xo
dx 3. The solution to the system of equations
p(2) = 7, p(4) = 10, p(7) = 23, p(ll) = 5 is
__ ~ C {
315' 
d
2021 b __ 7597 a _ 896} 630' 630'  45
7. The polynomial is
p(x) =
41
4
SX 
5 3 165 2 35 12 x  T X + 12 x + 8
See the disc for details of the solution. 9. Substituting rn for
If i
=1=
X
yields
n, then for j = n it follows that ~::::~; = 0, so TI#i ~::::;; =
o.
Thus
SOLUTIONS TO ODiJ PROBLEMS
384
Problems 12.2 1. If the polynomial f(x) = X4 + x 2 + 1 factors, then one of the factors must have degree at most two. Three evaluation points are required to determine a polynomial of degree 2. Evaluate f (x) at 1,0, and 1 to get
f(l) = 3, f(O) = 1, f(l) = 3 The possible function values for a polynomial of degree at most 2 that divides f (x) are given by
Do
= {±1,±3},
Dl = {±1}, D2 = {±1,±3}
Since f (x) :::: 1 for all x, it suffices to choose from among positive values. The choices do = 1, d 1 = 1, d2 = 1 yield the polynomial
(1)
(x  0) (x  1) (1) (x + 1) (x  1) (1) (x + 1) (x  0) (10)(11) + (0+1)(01) + (1+1)(10)
=
1
which is a trivial factor. The choices
do = 3, d1 = 1, d2 = 3 yield the polynomial
(x0)(x1) (x+1)(x1) (x+1)(x0) 2 (3) (10)(11) +(1) (0+1)(01) +(3) (1+1)(10) =2x +1 and this is not a factor of x4 + x 2 necessarily divide 1). The choices
+1
(since the leading term would
do = 3, d1 = 1, d2 = 1 yield the polynomial
3 (x  O)(x 1) 1 (x + 1) (x  1) 1 (x + 1) (x  0) _ 2 () (10)(11)+() (0+1)(01)+() (1+1)(10) x x+1 and the choices
do = 1, d1 = 1, d2 = 3 yield the polynomial 1 (x + 1) (x  1) (x + l)(x  0) _ 2 1 (x  O)(x 1) () (10)(11)+() (0+1)(01)+(3) (1+1)(10) x +x+1 A quick check shows that indeed
PROBLEMS 12.2
385
3. If f (x) = 2x6 + 2x 5 + 3x4 + 3x3 + 3x 2 + X + 1 factors, then it must have a factor of degree at most 3. This requires four evaluation points. In order to minimize the number of guesses, we choose the evaluation points 3, 1,0, and 1 to get
f (3)
= 1159 = 19 x 61
f(1)=3 f (0) = 1 f (1) = 15 = 3 x 5 Note that f (2) = 99 to test. Hence
= 32 11 and f
(2)
= 279 = 32 31 have more divisors
Do = {±1, ±19, ±61, ±1159} Dl = {±1,±3} D2 = {±1} D3 = {±1,±3,±5,±15} The lucky guesses
do
= 19, d1 = 3, d2 = 1, d2 = 3
yield the polynomial
(19)
(x + 1)(x  O)(x  1) (3 + 1)( 3  0) (3  1)
+ ( 1)
(x + 3) (x + 1)(x  1) (0 + 3)(0 + 1)(0  1)
+
and long division produces 2;~11
f (x)
= (2X2
+ (3)
(x + 3)(x  O)(x  1) (1 + 3) (1  0) (1  1)
(3) (x + 3)(x + 1) (x  0) _ 2 1 (1 + 3)(1 + 1)(1 _ 0)  2x +
= X4 + x 3 + x 2 + X + 1, so
+ 1) (x4 + x 3 + x 2 + X + 1)
5. If x4 + 2x + 2 factors in Z [x], then it would also factor in GF3 [x]. Let 8 be a root of x4 + 2x + 2 in some Galois field containing GF3 . The order of 8 is 80 since (880 mod 84
1
mod 84
+ 28 + 2) mod3 = 2
80 5 /
mod 84
+ 28 + 2) mod 3 =
(8 Thus X4
+ 28 + 2) mod3 =
80 (8 / 2
+ 2x + 2 is irreducible in GF3 [x]
3
8
+ 28 + 2
and hence irreducible in Z [x].
7. The only possible rational roots are ±1 and ±2. Since f (2) = 0, it follows that x + 2 is a factor. Knowing that, it is easy to see that X4 + x 3 + x 2 + X + 1 is the other factor, irreducible by problem 4.
386
SOLUTIONS TO ODD PROBLEMS
9. There are no linear factors because the only possible rational roots are ±1, and f(l) = 1 and f(l) = 1. If f(x) factors, then it must have an irreducible factor of degree 2. Assume that 9 (x) = ax 2 + bx + c is such a factor. Since f (1) = 1, f (0) = 1, and f (1) = 1, it follows that g(l) E {1,1}, g(O) E {1,1}, and g(l) E {1,1}. This yields the 8 possible factors 9 (x) = 1 9 (x) = _x 2 + X + 1 9 (x) = x 2  xI
9 (x) = 2X2  1 9 (x) = x 2 + xI 9 (x) = 1
9 (x) = _x 2  X + 1 9 (x) = _2x2 + 1
Trial division by the six polynomials of degree 2 shows that none is a factor, and hence f must be irreducible.
Problems 12.3 1. We have
q(l,l) = (XXO)Y1 (xxdYo Xl  Xo Y1 X  Y1 XO Yox + YOX1 = Yo  Yo + =::....=:..'....::....::.......::....:....=Xl  Xo = Yo + Y1  Yo (x  Xo ) Xl  Xo 3. Note that
q(l,l) = q(2,1)= q
(3 , 1)
(x  (2)) (5)  (x  (1)) (3) 1 (2) = 8x13 (x  (1)) (1)  (x 1) (5) 1(1)
= (x 
q(2,2) =
1)(1)  (x  2)(1) 2(1)
=3x2
=1
(x  (2)) (3x  2)  (x 1) (8x 13) 1(2)
11 2 17 =x +3x3 3 (x  (1)) (1)  (x  2) (3x  2) q(3,2) = 2 (1) 2 = 3x 1 x
_ (x  (  2)) (3x  1  x 2)  (x  2) q (3, 3) 2 _ (2) = ~X2
3
25
7
+ 6 x "6 x
The graphs are as follows:
3

10
3"
(\1 x 2 + 3x  1i)
PROBLEMS 12.4
387
p(2)
= 3,
p(I)
= 5,
p(l)
= 1,
p(2)
=1
5. We have
q(I,I)= q(2,1)= px= ()
(x  0) 3  (x  1) 2 10
=x+2
(x  1) 5  (x  2) 3 21 =2x+l (x  0) (2x + 1)  (x  2) (x
+ 2)
20
4
2
4
=x+x+
2
Problems 12.4 1. Let
f (x) = a+bx+cx 2 +dx3 and 9 (x) = A+Bx+Cx2 +Dx 3 and solve
the systems
f f f f to get
The graphs
(0) = 0
(1) = 2 (2) = 4 (3)
=1
9 (0)
and
=5
9(1) = 2 9 (2) = 4 9 (3) = 1
SOLUTIONS TO ODD PROBLEMS
388
1
may be distinguished by their yintercepts. 3. Let P (1),p (2), ... ,p (n  1) have fixed values and take Po to be randomly chosen. Neville's iterated interpolation algorithm generates a unique polynomial q (x) with values q (0) = Po q(1)=p(l)
q(nl)=p(nl) Thus the possible values of p (0) have not been limited at all.
Problems 12.5 1. Let
f (x) = 3 (x + l)(x  2)(x  5).
(a) Since 30.
f (x)
= 3x 3 18x 2 + 9x + 30, its coefficients are 3, 18,9, and
(b) The function values at x = 0, 1,2,3 are f (0) 279, f (3) = 2299. (c) The values at x f (i4) = 15.
= 1, f (1) = 15, f (2) =
= i,i 2 ,i 3 ,i 4 are f(i) = 1, f
(d) Its leading coefficient is 3. It is zero at x
(i 2 )
= 3, f (is) =
= 1,2, and 5.
1,
PROBLEMS 12.5
389
3. The table is Yo Yl Y2 Y3 Y4 Y5 Y6 Y7
Step 1 0 0 0 0 1 1 0 0
0 0 0 0 1 0 0 0
Step 2 0 0 0 0 1 1 1 1
Step 3 1 W
w"2 w::S 1
w w:'!' _w::S
= w4 , w = w5 , w 2 = w6 ,
This is correct because 1
and _w 3
= w7 .
5. We have
Permute Xo Xl
X2 X3 X4 X5 X6 X7
=3 =6 =4 =0 =5 =0 =1 =8
3 5 4 1 6 0 0 8
Permutation phase and
Combine 3 5 4 1 6 0 0 8
X X X X
Combine 8 15 5 3 6 6 8 9
! !
Combine 13
10
10
9
3
12
3
1
14
16
8
11
15
11
4
5
Combination phase See the disc for details of the arithmetic. As a check, direct calculation shows that
f(l) = 10 f (2) = 9 f (24) = 16 f (2 5 ) = 11
390
SOLUTIONS TO ODD PROBLEMS
7. The ijentry of the product is
k=O
k=O
nl =
2: (wilj+1wjlCjl)
k
k=O
nl =
2:
(wij)k
k=O
because
C= w l .
If i
= j,
this is
nl
2:
nl (wO)k
=
k=O
2:
1k
= n.
k=O
From wn = 1 we get
If i t j, then w' J t 1 because w is a primitive nth root of 1. But w i  j is a root of the polynomial 1 xn = (1 x) (1 + x + x 2 + ... + x n l ), so wi  j is a root of 1 + x + x 2 + ... + xnl. Thus when i j,
t
nl
2:
(wij)k =
0
k=O
9. Recall that if two rows in a matrix are equal, then the determinant of the matrix is zero. Our idea is to show that the polynomial
f (x)
= det
1 1 1
ao al a2
a5 ai a~
nl ao nl al nl a2
1
x
x2
x n l
is equal to the polynomial
Then
f (anI)
= 9 (and, which is the desired result.
Suppose two of ao, al,"" a n 2 are equal. Then clearly 9 is the zero polynomial. But f is also the zero polynomial because two of the rows in the defining determinant are equal. So we may assume that ao, al,···, a n 2
PROBLEMS 12.6
391
are all different. Both f and 9 are of degree n  1. The leading coefficient of f is equal to the determinant of the matrix obtained by removing the last row and column from the matrix whose determinant is f. By induc(ai  aj), which is the leading tion, this determinant is equal to n1>i>j coefficient of g. Clearly 9 (aj) = 0 for j = 0,1, ... , n  2, and f (aj) = 0 for j = 0,1, ... , n  2 because f (aj) is the determinant of a matrix with two equal rows. So f and 9 have the same leading coefficient and the same zeros. Thus they are equal.
II
11. The lefthand side is equal to
which is 05

20 4
+ 20 2 
O. The righthand side is equal to (0 3 5
0
5
0



20 2
+ 0)
20
4
3
+0

20
4
+ 20
2
(0 2

3
0 
1)
+ 20 2

0
0
Notice that the equation holds for any 0 whatsoever, and for any field. But we knew that.
Problems 12.6 1. To find such a prime, look at the numbers 25 k + 1 for k = 1,2,3, ... and hope you find a prime quickly. To go from k to k + 1 you simply add 32 to the number you had before. So, starting with k = 1, which gives 33 (not a prime), successively adding 32 gives 65 (not a prime), then 97, bingo! Thus 97 = 25 3 + 1 is a prime. That was easy. The next part is a little trickier. As 96 = 32·3, we get (a 3 ) 32 mod 97 = 1 so we can look for cubes b such that b16 mod 97 =I 1. Computing, 8 16 mod 97 = 1, 27 16 mod 97 = 1, 125 16 mod 97 = 96 Bingo! So 125 == 28 (mod 97) is an element of order 32. 3. Note that 3128 mod 257 order 256.
=
256 and 3256 mod 257
5. Use a computer algebra system to verify that p
=
1 implies that 3 has
= 1 + 230 .3 7 .58 .73 . 112 .
SOLUTIONS TO ODD PROBLEMS
392 13 . 172 . 19 . 23 is a prime. Let q
= p  1 and observe that
29 q / 2 modp = 62504431582015232409600000000 29 q / 3 modp = 39510 906 027 632123 741196 378 894 29 q / 5 mod p = 20739905493567049891 681480849 29 q / 7 modp = 46525541236811572 209 996 095 299 29 q / ll modp 29 q / 13 modp
= 25821169224421318975300997529 = 9966500034696371632146125001 q 17 29 / modp = 27534573559640223122138911 033 29 q / 19 modp = 2797174485912474274185207652 29 q / 23 modp = 57885642771173560912474071472
and hence 29 is a primitive element of GFp • Let
n
= q/2 30 = 58211 788145839453125
Then 29 n mod p
= 58 183 380 006 354 634 332 026 032 462
is an element of order 230 . To verify this, note that 58 183380006354634332026032462 58 183 380006354634332026032462
230 229
mod p = 1 mod p
= 1
7. To show that the order of w is 242 = 2 x 11 2, it is sufficient to evaluate 242 mod w 5
+ 2w + 1 + 2w + 1 w 242 / 11 mod w 5 + 2w + 1 W
1
=
242 / 2 mod w 5 W
We have w 1 = w 241 modw 5 + 2w + 1 = 2w 4 + 1. As a check, note that w (2w 4 + 1) modw 5 + 2w + 1 = 1. The minimal polynomial of w 1 is (x  (2w 4 + 1)) (x  (2w (X 
4
(2w 4 + 1)
+ 1)3)
(x  (2w 4 + 1)9) (x  (2w
81) mod w
5

w
4
+ 1)27).
+ 1 = x 5 + 2x4 + 1
9. The polynomial f has a + 1 coefficients and the polynomial g has b + 1 coefficients. Each of the coefficients of f must be multiplied by each of the coefficients of g, for a total of (a + 1) (b + 1) multiplications. Now we have to add these (a + 1) (b + 1) products to form a + b + 1 sums (deg f g + 1). To add up m numbers and get n sums, you need m  n additions. For example, to add up 7 numbers to get 1 sum, you need 6
PROBLEMS 12.6
393
additions. To add up 8 numbers to get 2 sums you need 6 additions: for example, 1+2+3 and 4+5+6+7+8. So to add up (a+1)(b+1) numbers to get a + b + 1 sums, you need (a + 1) (b + 1)  (a + b + 1) = ab additions.
Bibliography [1] Adamek, JifL Foundations of Coding, John Wiley & Sons, Inc., 1991 [2] Akritas, Alkiviadis G. Elements of Computer Algebra with Applications, Wiley Interscience, New York, 1989 [3] Albert, A. A. Fundamental Concepts of Higher Algebra, University of Chicago Press, Chicago, 1956 [4] Ax, J. "The elementary theory of finite fields," Annals of Math. 88 (239271),1968 [5] Barr, Thomas H. Invitation to Cryptology, Prentice Hall, Upper Saddle River, NJ, 2002 [6] Berlekamp, E. R. Algebraic Coding Theory, McGrawHill, New York, 1968 [7] Beutelspacher, A. Cryptology, The Mathematical Association of America, Washington, DC, 1994 [8] Blahut, R. E. Theory and Practice of Error Control Codes, AddisonWesley, Reading, MA, 1983 [9] Bose, R. C. "On the application of the properties of Galois fields to the construction of hyperGraecoLatin squares," Sankhya 3 (323328), 1938 [10] Ellis, Graham. Rings and Fields, Oxford, 1992 [11] Galois, E. "Sur la TMorie des Nombres," Bull. Sci. Math. de M. Ferussac 13 (428435), 1830 [12] Garrett, Paul. Making, Breaking Codes: An Introduction to Cryptology, Prentice Hall, Upper Saddle River, NJ, 2001 [13] Garrett, Paul. The Mathematics of Coding Theory, Prentice Hall, Upper Saddle River, NJ, 2004 [14] Hamming, R. W. Coding and Information Theory, Prentice Hall, Englewood Cliffs, NJ, 1986 395
396
BIBLIOGRAPHY
[15J Harmon, C. K. and R. Adams. Reading Between the Lines, Helmers Publishing, Peterborough, NH, 1989 [16J Heisler, J. "A characterization of finite fields," Amer. Math Monthly 74 (1211), 1967 [17J Herstein, I. N. Topics in Algebra, 2nd ed., Xerox College Publ., Lexington, MA 1975 [18J Jacobson, N. Lectures in Abstract Algebra, D. Van Nostrand, Princeton, NJ,1964 [19J Lewand, Robert E. Cryptological Mathematics, The Mathematical Association of America, 2000 [20J Lidl, R. and H. Niederreiter. Introduction to Finite Fields and Their Applications, Cambridge University Press, Cambridge, 1986 [21J Mao, Wenbo. Modern Cryptography, Prentice Hall PTR, Upper Saddle River, NJ, 2004 [22] Ore, O. "Contributions to the theory of finite fields," Trans. Amer. Math. Soc. 36 (243274), 1934 [23] Pless, V. Introduction to the Theory of Error Correcting Codes, Wiley, New York, 1989 [24] Rhee, M. Y. Cryptography and Secure Communications, McGrawHill, Singapore, 1994 [25] Rosen, K. H. Elementary Number Theory and Its Applications, AddisonWesley, Reading, MA, 1984 (26) Schneier, B. Applied Cryptography, Wiley, New York, 1994 (27) Trappe, Wade and Lawrence C. Washington. Introduction to Cryptography with Coding Theory, Prentice Hall, Upper Saddle River, NJ 2002
Notation Absolute value:
x ~f x 2: 0 x If x < 0 (a + b) mod m
Ix I = yX2 = { a EB b =
Addition modulo m: Base 2 logarithm:
10g2
Base 2 representation:
(bnb n 1 ... b2b1 boh = L~o bi 2i
Base b representation:
(ananl ... a2alao)b = L~=o aibi
n) (k
Binomial coefficient:
x 1\ y Bitwise complement: Bitwise or: x Vy Bitwise xor: x EB y Bitwise and:
Ceiling function:
x
rx 1 CRA (a, m,r)
Chinese remainder function: Congruence class modulo p:
[aJ = {... , a  3p, a  2p, a  p, a, a + p, a + 2p, a + 3p, ... } Congruent modulo m: a == b (modm) Congruent modulo m (x): a (x) Cyclic subgroup generated by a: Degree of polynomial p (x): Divides: n Im Euler phi function:
== b (x) (mod m (x))
(a) deg p (x)
cp(n)
n! Field of complex numbers: Factorial:
C
Floor function: lx J Galois field of order p: Galois field of order pn: Greatest common divisor of integers: Hamming distance:
d( u, v)
397
gcd(a, b)
398
NOTATION Integers:
Z = { ... , 3, 2, 1,0,1,2,3, ...} a ..L b
Integers a and b are relatively prime: Integers modulo n:
Zn = {O, 1,2, ... ,n  I} a 1 modm
Inverse modulo m:
lcm(a, b)
Least common multiple of integers:
lcm(a (x), b (x))
Least common multiple or polynomials: Logarithm base 2
log2
(~~
Matrix inverse modulo m:
)
1
mod m
Minimal polynomial of a field element a:
=n
Mod function: nmodm Multiplication modulo m:
LnjmJ m a ® b = abmodm
Multiplicative group of G Fpn: N
Order of group G:
0
(G Fpn ) * nextprime (m)
Next prime larger than m: Nonnegative integers:
ma (x)
= {O, 1,2,3, ... }
(G)
Permutation as images:
(T
Permutation as disjoint cycles: Permutation (T acting on x:
=
1 234 5 6 7 8 ( 5 8 2 6 9 4 1 3 (T = (1597) (283) (46) xO"
r (x) = a (x) mod m (x) Polynomials over the field F: F[x] Polynomials over the Galois field of order p: GFp[x] Polynomial remainder:
Polynomials with integer coefficients: IP' = {I, 2, 3, 4, ... }
Positive integers: Product: fI an Rational numbers: Real numbers:
Q IR.
Secure hash algorithm: Shift left: Shift right:
x << n x»n
SHA(M)
Z [xl
~)
Algorithms Algorithm 1.1
Binomial Coefficient Algorithm
11
Algorithm 2.1
Binary representations
16
Algorithm 3.1
Base b representation
40
Algorithm 3.2
Euclidean algorithm
45
Algorithm 3.3
Euclidean algorithm (recursive)
46
Algorithm 3.4
Extended Euclidean algorithm
49
Algorithm 3.5
Extended Euclidean algorithm (matrix version)
50
Algorithm 3.6
Inverse modulo m
58
Algorithm 3.7
Inverse modulo m
59
Algorithm 4.1
Enigma code
97
Algorithm 5.1
Hamming (8,4) decoding
125
Algorithm 6.1
Chinese remainder algorithm
134
Algorithm 7.1
Crude method
155
Algorithm 7.2
Power method
156
Algorithm 7.3
Sieve of Eratosthenes
163
Algorithm 7.4
Miller's test
166
Algorithm 8.1
To solve easy knapsack problem
192
Algorithm 12.1
Kronecker's algorithm
283
Algorithm 12.2
Neville's iterated interpolation algorithm
286
Algorithm 12.3
Modified Neville's iterated interpolation algorithm
291
Algorithm 12.4
FFT algorithm
296
Algorithm 12.5
Fast Fourier interpolation
301
399
Figures Figure 1.1
Falling dominos
Figure 2.1
Twooutoffive paper tape
32
Figure 2.2
Column sums for twooutoffive paper tape
32
Figure 2.3
Binary sort
34
Figure 2.4
80column card
35
Figure 2.5
Hollerith code for letters
35
Figure 2.6
Hollerith code for symbols
36
Figure 4.1
Enigma machine
96
Figure 5.1
Communications channel
101
Figure 5.2
Triplerepetition code
102
Figure 5.3
Majority rule decoding
103
Figure 5.4
Interleaved two out of five
109
Figure 5.5
UPCA
112
Figure 5.6
UPCA
113
Figure 5.7
Codabar
115
Figure 5.8
Code 128
117
Figure 5.9
Minimum distance
121
Figure 7.1
Primes
Figure 9.1
Icosahedron
235
Figure 10.1
Datastrip code
241
Figure 10.2
MaxiCode
242
Figure 10.3
PDF 417
242
Figure 10.4
PC postage
242
Figure 12.1
Interpolating polynomial
288
9
< 10 000
164
401
FIGURES
402 Figure 12.2
Linear polynomials
288
Figure 12.3
Quadratic polynomials
289
Figure 12.4
Cubic polynomials
289
Figure 12.5
Permutation phase
297
Figure 12.6
Combination phase
298
Figure 12.7
Permutation phase
299
Figure 12.8
Combination phase
299
Figure 12.9
Permutation phase
302
Figure 12.10
Combination phase
302
Tables Table 2.1
Binary code
16
Table 2.2
Hexadecimal numbers
17
Table 2.3a
Binary addition and multiplication
18
Table 2.3b
Hexadecimal multiplication
20
Table 2.4
ASCII code
22
Table 2.5
Morse code
25
Table 2.6
Braille code for AZ
28
Table 2.7
Braille code for digits 09
28
Table 2.8
Braille code for punctuation
28
Table 3.1
Addition and multiplication modulo 5
41
Table 3.2
Extended Euclidean algorithm
50
Table 3.3
Calculating the inverse of 13 modulo 29
59
Table 4.1
Caesar cipher
62
Table 4.2
Letters are numbers
62
Table 4.3
Caesar cipher arithmetic
63
Table 4.4
Caesar encrypting
63
Table 4.5
Ambiguous encryption
65
Table 4.6
Polyalphabetic encryption
66
Table 4.7
Letter count from selected text
69
Table 4.8
Frequencies for shifted ciphertext
70
Table 4.9
Simple shift fails
72
Table 4.10
Substitution cipher
Table 4.11
Permutation cipher
80
Table 4.12
Letter pair (digraph) frequencies
84
(T
403
75
TABLES
404 Table 4.13
Playfair encryption
Table 5.1
Binary symmetric channel
103
Table 5.2
Twooutoffive bar code
107
Table 5.3
Code 39
108
Table 5.4
Interleaved two out of five
109
Table 5.5
U.S. Postal Code
110
Table 5.6
UPCA
112
Table 5.7
Codabar
115
Table 5.8
Width 6 patterns
116
Table 5.9
U.K. Royal Mail
117
Table 5.10
Array decoding
122
Table 7.1
Powers modulo m
156
Table 7.2
Calculation of 5100 mod 101
Table 7.3
Primes less than 100
164
Table 7.4
Euler phi function
171
Table 7.5
Integers relatively prime to 72
173
Table 9.1
GF23
Table 9.2
Minimal polynomials of elements in G Fs
222
Table 9.3
Representations of elements in G F16
223
89
=1
= GFs
160
221
Table 10.la Using a table for singleerror correction
252
Table 1O.lb
Using a table for singleerror correction
252
Table 10.2
Powers of e
254
Index a 1 modm,57 a == b (mod m), 55 Absolute value, 43 Absolutely least residue, 47 AddRoundKey, 272 Adleman, Leonard, 177 Advanced encryption standard, 261 Affine cipher, 65 Affine transformation, 271, 314 Algorithms, 399 Alphabet, 64 Arithmetic exact, 5 floating point, 4 Array decoding, 121 ASCII Code, 22 Associative law, 199 ATM machines, 5
Big 0, 46 Binary code, 107 representation of field element, 221 symmetric channel, 103 word, 104, 112 Binomial coefficient, 10 Bit, 15 Bletchley Park, 95 Block cipher, 82 Books, 114 Boolean matrix, 78 Bose, R. C., 241 Braille code, 27 Braille, Louis, 27 Byte, 124, 270 ByteSub, 270
Back substitution, 47 Bar code Codabar, 114 Code 128, 115 Code 39,107 datastrip, 241 interleaved 2 of 5, 109 MaxiCode, 241 PDF 417, 242 postal code, 109 royal mail, 117 threeoutofnine, 107 two dimensional, 241 twooutoffive, 106 UPCA,112 Base 10 representation, 137 BCH codes, 242 BCH decoder, 249
Caesar cipher, 62 Carmichael number, 161 Carmichael, R. D., 161 Cayley table, 201 Ceiling function, 16 Check sum, 110 Chinese remainder algorithm, 134 Chinese remainder theorem, 127, 132 Cipher, 61 affine, 65 block, 82 Caesar, 62 definition, 61 DES, 261 exponential, 168 knapsack, 190 permutation, 79 Playfair, 88 405
INDEX
406 polyalphabetic, 64, 66 public key, 177 Rijndael, 262 RSA,177 shift, 64, 65 substitution, 75 unbreakable, 92 Vigenere, 64 Ciphertext, 61, 178 Closed form, 10 Codabar, 114 Code ASCII, 22 BCH,242 binary, 15 Braille, 27 Codabar, 114 Code 128, 115 CRC, 210 definition, 15 error control, 113, 114 error correcting, 102 error detecting, 102 Hamming (7, 4), 120 Hamming (8, 4), 125 hexadecimal, 17 interleaved twooutoffive, 109 ISBN, 114 linear, 105 Morse, 24 perfect, 122 ReedSolomon, 258 ternary, 25 threeoutofnine, 107 triple repetition, 102 twooutoffive, 32, 106 U. S. Postal, 109 universal product, 112 UPCA, 112 Codeword, 102, 120, 242 Common divisor, 42 Communications channel, 101 Commutative group, 229 law, 199 ring, 205
Complete induction, 212 Complete residue system, 56 Complex numbers, 201, 293 Composite, 2 Congruence class, 200 modulo a polynomial, 207 relation, 55 Congruent, 55 Content, 278 Control characters, 22 CRC code, 210 Credit card transactions, 5 Cryptanalysis, 68 Cryptography, 61 Cycles definition, 76 disjoint, 76 inverse, 77 length, 237 Cyclic group, 230 Cyclic redundancycheck codes, 210 Daemen, Joan, 270 Data encryption standard, 261 Datastrip bar code, 241 Degree, 206 DES, 261 Determinant, 314 Digital fingerprint, 196 signature, 194 Disjoint cycles, 76 Distance between codewords, 104 Distributive law, 199 Divisibility, 2 Division algorithm for integers, 40 for polynomials, 141, 206, 209 Divisor, 2 Double error detecting, 125 DSA, 194 Electronic document, 194 eavesdropping, 68
INDEX
signatures, 183 Elements of a bar code, 107 Ellipsis, 10 Enigma machine, 95 Errorcontrol codes, 101 Errorcorrecting code, 102 Errordetecting code, 32, 102 Espionage, 68 Euclid's lemma, 51 Euclidean algorithm for integers, 45 for polynomials, 141, 209 Euler
407 Figures, 401 Floatingpoint number, 4 Floor function, 16 Fundamental theorem of arithmetic, 53 Galois field, 199 Galois, Evariste, 199 gcd (a (x), b (x)), 141 Generator polynomial, 242 GFp, 201 GF256 , 265 GFp [xl, 204 GFpn, 225 Greatest common divisor of integers, 43 of polynomials, 141 Greatest integer, 16 Group cyclic, 230 definition, 230 of symmetries, 229 Hamming (7, 4) code, 120 (7, 4) decoding, 122 (8, 4) code, 125 (8, 4) decoding, 125 distance, 104 Hamming, Richard, 104 HardyRamanujan number, 162 Hash algorithm, 196 Hexadecimal code, 17 Hilbert matrix, 148 Hilbert, David, 148 Hocquenghem, 241 Hollerith punched cards, 34 HTML, 23 Hypertext markup language, 23 Icosahedron, 235 Index symbol, 6 Induction complete, 212 principle, 8 Industrial espionage, 68 Information theory, 101
INDEX
408 Integer representations, 137 Integers, 1 Interleaved two of five, 109 International standard book number, 114 Interpolation Fast Fourier, 293 Lagrange formula, 279 Neville algorithm, 286 polynomial, 294 Inverse affine transformation, 271 cycle, 77 modulo m, 57 permutation, 77 Inverse matrix, 294, 314 Irreducible polynomial, 213 ISBN,114 Key, 93 expansion, 273 private, 178 public, 177 Knapsack cipher, 191 Kronecker algorithm, 282 construction, 226 Lagrange interpolation formula, 279 theorem, 231 Lagrange, JosephLouis, 279 Large exponents, 157 Law of large numbers, 236 Least common multiple, 54 Least nonnegative residue system, 56 Lenstra, Hendrik, 72 Linear code, 105 Linear combination, 49 Loop invariant, 45 LUCIFER,262 Majority rule, 102 Mantissa, 4 Mathematical induction, 8 Matrices
Boolean, 78 determinant, 314 operations, 312 row reduction, 313 Vandermonde, 293 MaxiCode bar code, 241 Maximum likelihood decoding, 121 Message bits, 120 digest, 196 words, 120 Method of exhaustion, 43, 132 Miller's test, 166 Minimal polynomial, 209, 221 Minimum distance, 105 MixColumns, 272 Mod function fractions, 57 integers, 39 Modular arithmetic, 39 basis, 137 representation, 137 Monic polynomial, 206 Morse code, 24 Morse, Samuel F. B., 24 Multiplicative group of a field, 230 National Institute of Standards and Technology, 261 Neville iterated interpolation algorithm, 286 Nibble, 124 NIST,261 Noisy channel, 102 Nonnegative integer, 1 Notation, 397 Number complex, 293 floatingpoint, 4 integer, 1 random, 237 Number theory, 1, 153 Numerical analysis, 4 Onedimensional bar code, 106
INDEX Onetime pad, 93 Order of a group, 230 of a group element, 230 Pairwise relatively prime, 133 Paper tape, 32 Parity check bit, 105, 120 code 39, 107 matrix, 105 Pascal's triangle, 11 PC postage, 242 PDF 417 bar code, 242 Perfect code, 122 Permutation cipher, 79 definition, 76 matrix, 78 Personal identification numbers, 261 phi function 'P (n), 171 Plaintext, 61, 82, 178, 242 Platonic solid, 235 Playfair cipher, 88 Polyalphabetic cipher, 66 Polynomial code, 242 division, 141 division algorithm, 206 interpolation, 294 primitive over a finite field, 232 primitive over the integers, 277 remainder, 207 ring, 206 Positive integer, 1 Postal code, 109 Power method, 156 Powers modulo n, 155 Primality, 2 Primality test Miller's test, 166 Rabin, 167 Prime, 2 probabilistic, 166, 167 Prime Number Theorem, 168 Primitive element, 232
409 Primitive polynomial over a finite field, 232 over the integers, 277 Primitive root, 293 Principle of mathematical induction, 8, 49, 212 Private key, 178 Probabilistic prime, 167 Product notation, 7 of permutations, 77 of powers of prime integers, 137 of prime integers, 52 Protocol, 179 Pseudo prime, 165 Pseudorandom number generator, 237 Public key, 177 Public key ciphers, 177 Q,201 Quotient, 207
IR, 201 Rabin's probabilistic primality test, 167 Random, 237 Rational numbers, 201 Rational root theorem, 279 RayChaudhuri, 241 Real numbers, 201 Recursion, 45 Reduced residue system, 171 ReedSolomon code, 258 Reflector, 95 Relative frequency, 68 Relatively prime, 51 pairwise, 133 Remainder, 207 Residue system complete, 56 reduced, 171 standard, 56 Rijmen, Vincent, 270 Rijndael block cipher, 270 Ring, 204 Rivest, Ron, 177 Rotor, 95
410 Roundoff error, 4 Row reduction, 128 Royal mail code, 117 RSA cipher, 177 Secure hash algorithm, 196 Secure multiparty protocols, 290 Shamir, Adi, 177 Shannon, Claude, 101 Shift, 267 Shift cipher, 64 Shift variable, 96 Shift Rows, 272 Sieve of Eratosthenes, 163, 164 Signature verification, 194 Softstrip bar code, 241 Splitting field, 226 Square roots of one, 153 State, 96 Subgroup, 230 Substitution cipher, 75 Sum of binary words, 104 Summation notation, 6 Sun Tsu SuanChing, 127 Superincreasing sequence, 190 Symbols, 397 Symmetric, 201 Symmetric group, 229 Systems of linear equations mod n, 127 Table decoder, 252 Tables, 403 Ternary code, 25 Threeoutofnine bar code, 107 Totient function, 171 Transmission error, 101 Trap door function, 190 Triangle inequality, 121 Triplerepetition code, 102 Truncation error, 4 Turing, Alan, 95 Twodimensional bar code, 241 Twooutoffive code, 32 U. K. royal mail code, 117 U. S. postal code, 109
INDEX Unbreakable ciphers, 92 Universal product code, 112 UPCA,112 Vandermonde matrix, 293 Vector, 312 Vector sum, 104 Verification, 195 Verify signature, 194 Vigenere cipher, 64 Weight, 104 Wiles, Andrew, 159 Wilson's theorem, 154 Wilson, Sir John, 153 World War II, 95
xnmodm, 155 Z,l Zp, 201 Z [xl, 141 ZIP code, 109