RSA Background Theory and Algorithms

Scot Anderson, Ph.D.

March 8, 2009
1 Introductions
This lecture gives an introduction to the theory used in the RSA algorithm. We assume a knowlege of prime
number concepts and factoring in general, however we do not assume a background in abstract algebra.
2 Background Theory
Notation 1 The following notation will be helpful if you have not seen it before:
x Q means that the element x is a member of the set Q. There are a number of standard sets:
Z Integers
Z
p
Integers mod an integer p (not necessarily prime)
Q Rationals
R Reals
N Natural numbers also sometimes listed as Z
+
C Complex Numbers
We start with a consideration of inverses to numbers in the rational number systems. Since grade school
most of us have been able to tell you the multiplicative inverse of a x Q. We can write x =
a
b
, where
a; b ,= 0 and posit that x
1
=
b
a
. Proving this for any number x is one of the simplest proofs we present.
Theorem 2 Let x Q where x ,= 0. Then the multiplicative inverse is of x is given by x
1
=
1
x
.
Proof. Let a; b Z, and a; b ,= 0, then we can write x =
a
b
for some a; b. Now
1
x
=
b
a
is dened and we have.
x x
1
=
a
b

b
a
(1)
= 1 (2)
Hence we have the multiplicative inverse of x =
1
x
for rational numbers.
The above will work easily for real numbers as well, but what if we want to work with a limited set of
numbers such as the the set of integers. We can see quickly that multiplicative inverses do not exist for all
integers. Given 2, nd a multiplicative inverse in the integers. You might guess
1
2
, but
1
2
= Z so you cant
use it. It should be clear without further discussion that only 1 and 1 have multiplicative inverses in Z
and that they are 1 and 1 respectively.
Suppose we restrict the set of numbers to
Z
p
= 0; 1; :::; p 1 (3)
by redening addition and multiplication to be modulus p. That is consider a number system that has
elements 0; :::; p 1 and denes as
a
p
b = (a b) modp (4)
1
and addition as
a +
p
b = (a + b) modp: (5)
Normally we dont use the subscripts to dene + and . It is understood that addition and subtraction in
Z
p
is modp.
But what about inverses for addition and multiplication.
Example 3 First consider the additive inverse of 5 Z
7
. We want
5 + x = 0
If we try a couple of numbers from Z
7
, we can nd the answer:
(5 + 1) mod7 = 6
(5 + 2) mod7 = 0
From this we can easily theorize the following.
Theorem 4 For any a Z
p
the additive inverse of a is given by b = p a:
Proof. Let a Z
p
and b = p a. Since 0 _ a < p, we have that p a > 0 and p a _ p. If p a = p we
will explicitely perform the subtraction modulus p and we obtain a value b Z
p
.
(a + b) modp = (a + p a) modp
= p modp
= 0
Hence we have that b is the additive inverse a for any a Z
p
.
(Ok, take a breath! Maybe that was a little more involved than you thought it would be but it is still
quite simple.)
What about multiplicative inverses? Well, these are not quite so simple. Consider the following theorem:
Theorem 5 For some p Z
+
and some a Z
p
, a
1
does not exist.
Proof. Let p = 6 and a = 2.
(2 0) mod6 = 0
(2 1) mod6 = 2
(2 2) mod6 = 4
(2 3) mod6 = 0
(2 4) mod6 = 2
(2 5) mod6 = 4
Here we have exausted all possiblilites for inverses of 2 in Z
6
and \x Z
6
we have that (x 2) mod6 ,= 1.
Thus we have that in some Z
p
there exists elements that do not have multiplicative inverses.
That is surely a blow to doing certain types of arithmatic in just any Z
p
but certainly there is some
constraint that we can put on p that will guarantee inverses in Z
p
. Here we need Fermats Little Theorm.
First lets consider a little notation.
Notation 6 If two numbers b and c have the property that their dierence b c is integrally divisible by a
number m (i.e. (b c)=m is an integer), then b and c are said to be "congruent modulo m. " The number
m is called the modulus, and the statement "b is congruent to c (modulo m)" is written mathematically as
b = c (modm)
2
or equivalenty as
b c = m t
for some t Z. Here b is called the base, c is called the residue and m is called the modulus. If we require
that c Z
m
, we can also say that
b modm = c
As a counter example where c = Z
m
consider
10 = 4 (mod3)
gives
10 4 = 3t
for some integer t. Clearly t = 2 works
10 4 = 3(2)
6 = 6
However 10 mod3 = 1 and 1 ,= 4. So be careful with your intuition.
Theorem 7 (Fermats Little Theorem) If p is prime and a is a positive integer not divisible by p, then
a
p1
= 1(modp) (6)
Proof. Consider the set of possitive integers less than p: W = 1; 2; :::; p 1. Multiply each element by a,
modulo p, to get the set
X = a modp; 2a modp; :::; (p 1) a modp (7)
None of the elements of X is equal to zero because p does not divide a. Further no two elements of X are
equal. To see this fact we will do a proof by contradiction (remember set theory or discreet math/structures?).
Assume that two elements are equal.
ja modp = ka modp (8)
or equivalently
ja = ka (modp) (9)
Because a is relatively prime to p we can eliminate it from (9). This gives the contradition since j modp = j
and k modp = k we have that j = k. Hence no two of the p 1 elements of X are equal and therefore X is
identical to our rst set W in some order. Multiplying both sets and taking the result mod p yields
a 2a ::: (p 1) a = [1 2 ::: (p 1)] (modp)
a
p1
(p 1)! = (p 1)! (modp) (10)
Since (p 1)! is relatively prime to p we can eliminate it giving the result
a
p1
= 1 (modp) (11)
An alternative form to Theorem 7 states: If p is prime and a is a positive integer, then
a
p
= a (modp) (12)
This result looks suspiciously like something that we might use for encryption/decryption. After all if
you set x < p and take a
x
, all I need to know is y = p=x and take the result (a
x
)
p=x
= a
p
(modp) = a. But
taking a closer look, this doent seem very secure. If you know x, (you must know p) then you can know y
and vice versa. To overcome this problem we need to understand Eulers Totient function and then Eulers
Theorem.
3
Denition 8 Eulers Totient function (n) returns the number of positive integers less than n and relatively
prime to n. By convention, (1) = 1.
Example 9 Determine (37). Since 37 is prime (and we count the number 1) there are 36 positive numbers
less than 37 that are relatively prime to 37.
Now consider (35). The numbers relatively prime are
1; 2; 3; 4; 6; 8; 9; 11; 12; 13; 16; 17; 18; 19; 22; 23; 24; 26; 27; 29; 31; 32; 33; 34
There are 24 numbers in the list so (35) = 24.
It should be clear by now that for a prime number p
(p) = p 1 (13)
Now suppose that we have two prime numbers p and q such that p ,= q. Then we can show that for
n = pq
(n) = (p) (q) (14)
= (p 1) (q 1) (15)
Consider the set
1; :::; pq 1
. The integers in this set not relatively prime to n are the set
p; 2p; :::; (q 1) p ' q; 2q; :::; (p 1) q (16)
Hence we have
(n) = (pq 1) [(q 1) + (p 1)]
= pq (p + q) + 1
= (p 1) (q 1)
= (p) (q)
Now we are ready to use this fact.
Theorem 10 (Eulers Theorem) For every a and n that are relatively prime:
a
(n)
= 1 (modn) (17)
Proof. Equation (17) is true if n is prime, because in that case (n) = (n 1) and Theorem 7 holds.
However, it also holds for any integer n. Consider the set of integers
R =

x
1
; x
2
; :::; x
(n)

(18)
That is, each element x
i
of R is a unique positive integer less than n with gcd (x
i
; n) = 1. Now multiply
each element by a, modulo n:
S =

(ax
1
modn) ; :::;

ax
(n)
modn

(19)
The set S is a permutation of R, by the following line of reasoning:
1. Because a is relatively prime to n and x
i
is relatively prime to n, a x
i
must also be relatively prime to
n. Thus, all member of S are integers that are less than n and relatively prime to n.
2. There are no duplicates in S. (similar to Theorem 7)
4
Therefore
(n)
Y
i=1
(ax
i
modn) =
(n)
Y
i=1
x
i
(n)
Y
i=1
(ax
i
) =
(n)
Y
i=1
x
i
(modn)
a
(n)

(n)
Y
i=1
(x
i
) =
(n)
Y
i=1
x
i
(modn)
a
(n)
= 1 (modn) (20)
However, if a and n are relatively prime then a
k
and n are relatively prime and we have

a
k

(n)
= 1 (modn) (21)
Alternatively we can state the result as
a
(n)+1
= a (modn) (22)
where a does not have to be relatively prime to n.
Notice that this is looks very similar to Theorem 7! As we will see, it also provides us with what we need
to build the RSA algorithm.
3 The RSA Algorithm
First we have a Plaintext block M < n; that is the block size b must satisfy b _ log
2
n. In practice, the block
size b is i bits, where 2
i
< n _ 2
i+1
. The cipher block C is given by
C = M
e
modn (23)
and decryption by
M = C
d
modn = (M
e
)
d
= M
ed
modn (24)
Both the sender and receiver must know n. The sender knows the value of e, and only the receiver knows
the value of d.
PU
key
= e; n (25)
PR
key
= d; n (26)
For this algorithm to be satisfactory for PKI we must meet the following requirements:
1. It is possible to nd values of e; d; n such that M
ed
modn = M for all M < n.
2. It is relatively easy to calculate M
e
modn and C
d
modn for all values of M < n.
3. It is infeasible to determine d given e and n.
Requirement (2) can be easily satised using ordinary arithmetic modulo n. (3) relies on the diculty
in factoring large primes as we will see. That leaves Relationship (1).
We need to nd a relationship of the form
M
ed
(modn) = M or M
ed
= M (modn) (27)
5
If
ed 1 = k (n) (28)
== ed = k(n) + 1 (29)
== ed = 1 (mod(n)) (30)
Then By Theorem 10 (see Equation 21)
M
ed1
= 1 (modn) (31)
is known to hold. The alternate form of Theorem 10 gives.
M
ed
= M (modn)
From Equation 30 we must have that e and d are inverses of each other modulo (n). That is,
ed = 1 mod(n) (32)
d = e
1
mod(n) (33)
This gives the method of calculating d or e. Also note that, according to the rules of modular arithmetic,
this is true only if d (and therefore e) is relatively prime to (n). Equivalently, gcd ((n) ; d) = 1. We can
check the gcd and nd the inverse using Euclids Extended algorithm.
Table 1 gives the values needed for the RSA scheme. Notice that (n) is never divulged in the public
or private keys. Generating a public key from the private (or vice versa) requires knowledge of (n). No
problem you say, Ill just factor n. But here is the rub: factoring large primes is dicult and thus requirement
(3) from above is met.
p; q, two prime numbers (private, chosen)
n = pq (public, calculated)
e, with gcd ((n) ; e) = 1; 1 < e < (n) (public, calculated)
d = e
1
(mod(n)) (private, calculated)
Table 1: RSA Values
This leads to the key generation algorithm given in Table 2.
Key Generation
Select p; q p; q both prime p ,= q
Calculate n = p q
Calculate (n) = (p 1) (q 1)
Select integer e gcd ((n) ; e) = 1; 1 < e < (n)
Calculate d d = e
1
mod((n))
Return Public Key PU
key
= e; n
Return Private Key PR
key
= d; n
Table 2: Key Generation Algorithm
Example 11 (Simple RSA) 1. Let p = 17 and q = 11.
2. Then n = 187
3. and (n) = 160.
4. Select e such that gcd (e; (n)) = 1 (relatively prime) and e < (n). Let e = 7.
5. Determine d = 23 using Euclids extended algorithm.
6
6. Return the public and private keys PU
key
= 7; 187 ; and PR
key
= 23; 187.
Suppose we have M = 88. Encrypting this with PU
key
and exploiting the properties of modular arithmetic
gives:
88
7
=

88
4
mod187

88
2
mod187

88
1
mod187

88
1
mod187 = 88
88
2
mod187 = 77
88
4
mod187 = 77
2
mod187 = 132
88
7
mod187 = 132 77 88 mod187 = 11
So C = 88
7
mod187 = 11.
4 Homework
1. Using the example above, decrypt C = 11.
2. Program the RSA algorithm in jave to generate key pairs and encrypt/decrypt 32-bit blocks of data.
7