Chapter 2 : Multiplicative Cipher · Web viewIn this chapter we will study the Multiplicative...
100
Chapter 2 – Multiplicative Cipher In this chapter we will study the Multiplicative Cipher. Instead of adding a number as we did in the Caesar Cipher, we will now multiply each plain letter by an integer a, our secret encoding key. As some of them fail to produce a unique encryption, we will discover an easy criterion for keys that produce the desired unique encryptions (the “good” keys) and apply it to different alphabet lengths. When doing so we will discover very important mathematical encryption tools such as Euler’s -function, Euler’s and Lagrange’s Theorem and study further examples of groups, rings and fields. 2.1 Encryption using the Multiplication Cipher Instead of encoding by adding a constant number, we multiply each plain letter by our secret key a. Since each plain letter turns into 0 for a=0 and remains unchanged for a=1, we start with a=2. We will multiply MOD 26 as we are using the 26 letters of the English alphabet. We get the following encoding and decoding table. PLAIN LETTER: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z Secret key: a=2 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 0 2 4 6 8 10 12 14 16 18 20 22 24 0 2 4 6 8 10 12 14 16 18 20 22 24 Cipher letter: a c e g i k m o q s u w y a c e g i k m o q s u w y 1
Transcript of Chapter 2 : Multiplicative Cipher · Web viewIn this chapter we will study the Multiplicative...
Chapter 2 – Multiplicative Cipher In this chapter we will study the Multiplicative Cipher. Instead of adding a number as we did in the Caesar Cipher, we will now multiply each plain letter by an integer a, our secret encoding key. As some of them fail to produce a unique encryption, we will discover an easy criterion for keys that produce the desired unique encryptions (the “good” keys) and apply it to different alphabet lengths. When doing so we will discover very important mathematical encryption tools such as Euler’s -function, Euler’s and Lagrange’s Theorem and study further examples of groups, rings and fields.
2.1 Encryption using the Multiplication Cipher Instead of encoding by adding a constant number, we multiply each plain letter by our secret key a. Since each plain letter turns into 0 for a=0 and remains unchanged for a=1, we start with a=2. We will multiply MOD 26 as we are using the 26 letters of the English alphabet. We get the following encoding and decoding table.
PLAIN LETTER: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z Secret key: a=2 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25
0 2 4 6 8 10 12 14 16 18 20 22 24 0 2 4 6 8 10 12 14 16 18 20 22 24
Cipher letter: a c e g i k m o q s u w y a c e g i k m o q s u w y
Notice, that only every other cipher letter appears, and that exactly twice. This is not a useful encryption system since it may yield ambiguous messages. As an example, let’s encode and decode NAT and ANT.
PLAIN LETTER N A T A N TSecret key a=2 13 0 19 0 13 19
0 0 12 0 0 12Cipher letter a a m a a m
You can see the dilemma of this message. Decoding “aam” can either yield NAT or ANT as the plain text. What would you do? Of course, you don’t want to receive any more ambiguous messages. Let’s simply test all possible keys of the multiplication ciphers MOD 26:
1
PLAIN LETTER
a A B C D E F G H I J K L M N O P Q R S T U V W X Y Z0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 01 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 252 0 2 4 6 8 10 12 14 16 18 20 22 24 0 2 4 6 8 10 12 14 16 18 20 22 24
3 0 3 6 9 12 15 18 21 24 1 4 7 10 13 16 19 22 25 2 5 8 11 14 17 20 234 0 4 8 12 16 20 24 2 6 10 14 18 22 0 4 8 12 16 20 24 2 6 10 14 18 22
5 0 5 10 15 20 25 4 9 14 19 24 3 8 13 18 23 2 7 12 17 22 1 6 11 16 216 0 6 12 18 24 4 10 16 22 2 8 14 20 0 6 12 18 24 4 10 16 22 2 8 14 20
7 0 7 14 21 2 9 16 23 4 11 18 25 6 13 20 1 8 15 22 3 10 17 24 5 12 198 0 8 16 24 6 14 22 4 12 20 2 10 18 0 8 16 24 6 14 22 4 12 20 2 10 18
9 0 9 18 1 10 19 2 11 20 3 12 21 4 13 22 5 14 23 6 15 24 7 16 25 8 1710 0 10 20 4 14 24 8 18 2 12 22 6 16 0 10 20 4 14 24 8 18 2 12 22 6 16
11 0 11 22 7 18 3 14 25 10 21 6 17 2 13 24 9 20 5 16 1 12 23 8 19 4 1512 0 12 24 10 22 8 20 6 18 4 16 2 14 0 12 24 10 22 8 20 6 18 4 16 2 1413 0 13 0 13 0 13 0 13 0 13 0 13 0 13 0 13 0 13 0 13 0 13 0 13 0 1314 0 14 2 16 4 18 6 20 8 22 10 24 12 0 14 2 16 4 18 6 20 8 22 10 24 12
15 0 15 4 19 8 23 12 1 16 5 20 9 24 13 2 17 6 21 10 25 14 3 18 7 22 1116 0 16 6 22 12 2 18 8 24 14 4 20 10 0 16 6 22 12 2 18 8 24 14 4 20 10
17 0 17 8 25 16 7 24 15 6 23 14 5 22 13 4 21 12 3 20 11 2 19 10 1 18 918 0 18 10 2 20 12 4 22 14 6 24 16 8 0 18 10 2 20 12 4 22 14 6 24 16 8
19 0 19 12 5 24 17 10 3 22 15 8 1 20 13 6 25 18 11 4 23 16 9 2 21 14 720 0 20 14 8 2 22 16 10 4 24 18 12 6 0 20 14 8 2 22 16 10 4 24 18 12 6
21 0 21 16 11 6 1 22 17 12 7 2 23 18 13 8 3 24 19 14 9 4 25 20 15 10 522 0 22 18 14 10 6 2 24 20 16 12 8 4 0 22 18 14 10 6 2 24 20 16 12 8 4
23 0 23 20 17 14 11 8 5 2 25 22 19 16 13 10 7 4 1 24 21 18 15 12 9 6 324 0 24 22 20 18 16 14 12 10 8 6 4 2 0 24 22 20 18 16 14 12 10 8 6 4 2
25 0 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1
We learned already that the key a=2 (as can be seen in the 3rd row) does not produce a unique encryption. So which ones do? Each row that contains each integer from 0 to 25 exactly once and therefore yields a unique cipher letter will serve. Simply by looking at the table, we find that the following keys (whose rows are bold) produce a unique encryption and therefore call them the good keys: a = 1,3,5,7,9,11,15,17,19,21,23,25
Why those and what do they have in common? They seem to not follow any apparent pattern. Are they the odd numbers between 1 and 25? No, 13 is missing. Or are they possibly the primes between 1 and 25? No, 9,15, 21 and 25 are not prime and the prime 13 is missing. So, let’s understand why the bad keys
a = 2,4,6,8,10,12,13,14,16,18,20,22,24
don’t produce a unique encryption. We have to understand why multiplying by a bad key a MOD 26 yields some integers more than once and others not at all. An extreme example would be when a=0: all plain letters are translated into 0’s which are all a’s so that no decryption is possible.
2
Encoding Key a
If a=1 is used as a key, each cipher letter equals its plain letter which shows that it does produce a unique encryption. However, it yields the original text. This is not very useful.
The bad key a=2 yields an ambiguous message as we saw in the introductory example: each A turns into 0 (=a) since 2*0 = 0 MOD 26 just as each N turns into 0 since 2*13 = 26 = 0 MOD 26. Also, each B and each M turn into 2 (=c) since 2*1 = 2 MOD 26 and 2*14 = 28 = 2 MOD 26. When you study the a=2 row precisely, you will see that the original 26 plain letters are converted into 13 “even” cipher letters (the even cipher letters are those whose numerical equivalent is an even number.) each occurring exactly twice. This is the reason why a=2 yields an ambiguous decryption.
If a=4,6,8,…,24, we encounter the same dilemma as for a=2. We can see in the table that an A will always translate into 0 (=a) since the product of any such key a with 0 (=A) yields 0. N (=13) translates into a for any even key a aswell because even keys N
4*13 = 2*(2*13) = 2*0 = 0 MOD 26,6*13 = 3*(2*13) = 3*0 = 0 MOD 26,8*13 = 4*(2*13) = 4*0 = 0 MOD 26, etc.
Notice in all three equations that because a=2 turns the 13 (=N) into 0 in 2*13 = 0, all the multiples of a=2 translate the N into 0 (=a). That means: Because a=2 is a bad key all the multiples of a must be bad keys aswell.
Consider an alphabet length of M=35: the bad key a=5 (why?) will translate the H (=7) into a (=0), because 5*7 = 35 = 0 MOD 35. Therefore, all the keys that are multiples of 5 such as a=10,15,20,25,30 will also translate the H into 0(=a). Similarly, the multiples of a=7 will translate an F (=5) into an 0 (=a) because 7 does so.
a=13 yields an ambiguous message since each even plain letter is translated into a (=0): a=13 even letters
13*0 = 0 MOD 26, 13*2 = 0 MOD 26, 13*4 = (13*2) * 2 = 0 * 2 = 0 MOD 26, 13*6 = (13*2) * 3 = 0 * 3 = 0 MOD 26, etc.
Each odd plain letter translates into 13 (=n):
a=13 odd letters13*1 = 13 MOD 26, 13*3 = 13*2 + 13*1 = 0 + 13 = 13 MOD 26,13*5 = 13*4 + 13*1 = 0 + 13 = 13 MOD 26,13*7 = 13*6 + 13*1 = 0 + 13 = 13 MOD 26, etc.
Moreover, since a=13 is a bad key its multiples 26, 39, … must also be bad keys. However, we don’t need to consider keys that are greater than 26 since each of them has an equivalent key less than 26 that yields the same encryption: the even multiples of 13
3
(i.e. 26, 52, 78, ...) have its equivalent key in a=0, a very bad key, since 26=52=78=0 MOD 26. The odd multiples of 13 (i.e. 39, 65, 91, …) have its equivalent key in a=13, another bad key, since 39=65=91=13 MOD 26.
Let’s summarize our discoveries. Which keys now yield a unique encryption?A key a does not produce a unique encryption,
if 1) a divides 26 evenly or if 2) a is a multiple of such divisors.
We can combine these two criteria into one easy criterion. Can you? Try it!
CRITERION FOR GOOD KEYS A key a produces a unique encryption, if the greatest common divisor of 26 and a equals 1, which we write as: gcd(26, a)=1
Convince yourself that 26 has a greatest common divisor equal to 1 with each of these good keys a = 1,3,5,7,9,11,15,17,19,21,23,25. Except for 2 and 13, all prime numbers less than 26 are among the keys (why do they have to?). However, there are some additional integers that are not prime (i.e. 9,15,21 and 25). That are those that don’t have a common divisor with 26. Thus, being prime is not quite the reason for a good key, but almost. We, therefore, name the good keys as follows:
Definition of numbers that are relative prime:Two integers are called relative prime if their greatest common divisor equals 1.
Examples are: 4 and 5 are relatively prime because gcd(4,5)=1. So are 2 and 3, 2 and 5, 3 and 10, 26 and 27, 45 and 16. Counter examples are: 45 and 18 are not relative prime since gcd(45,18)=9 and not 1.343 and 14 are not relative prime since gcd(343,14)=7.
From now on we will use a handy Notation for the set of possible and good keys: 1) All the possible keys for an alphabet length of 26 are clearly all the numbers between 1 and 26, denoted as Z26. Simply: Z26 = {0,1,2,3,…, 24,25}. Generally: An alphabet of length M has the keys: ZM = {0,1,2,3,…, M-2,M-1}
2) Now, the good keys are the ones that are relative prime to 26 as listed above and are denoted as Z26*. Simply: Z26* = {1,3,5,7,9,11,15,17,19,21,23,25}. Generally: The good keys are those a’s that are relative prime to M and are denoted as ZM*. (I can not list those here as they depend on the alphabet length M.)
We are now able to summarize how to encrypt a message using the multiplication cipher:
4
To encrypt a plain letter P to the cipher letter C using the Multiplication Cipher, we use the encryption function: f : P C=(a*P) MOD 26. If a is a “good” key, that is if a is relatively prime to 26, then f produces a one-to-one relationship between plain and cipher letters, which therefore permits a unique encryption.
Among the 12 good keys we pick a=5 to encode the virus carrier message as follows:
PLAIN TEXT A N T I S T H E C A R R I E R0 13 19 8 18 19 7 4 2 0 17 17 8 4 17
0 13 17 14 12 17 9 20 10 0 7 7 14 20 7Cipher text a n r o m r j u k a h h o u h
Exercise1: Encrypt the same plain text using the key a=7.
2.2 Decryption of the Multiplication CipherNow that the virus carrier message was encoded in a unique manner how can it be decoded? First of all, you need to know which one of the 12 good keys was used. In some secret manner, the sender and the recipient had to agree on the encoding key a. Say a=5 was chosen. Now, how do you decrypt the above message? To do so, we have to look at the encryption equation C=a*P MOD 26 and solve it for the desired plain text letter P.
In order to solve an equation like 23=5*P for P using the rational numbers, we would divide by 5 or multiply by 1/5 to obtain the real solution P=23/5. However, when using MOD arithmetic and solving 23=5*P MOD 26, we don’t deal with fractions but only integers. Thus, dividing is performed slightly different: instead of dividing by 5 or multiplying by 1/5, we first write 5-1 (instead of 1/5) where 5-1 now equals an integer and multiply both sides by that integer 5-1. We denote 5-1 “the inverse of 5”. Just as 5*1/5 yields 1, 5 * 5-1 shall equal 1 MOD 26.
Definition of an inverse number: A number a-1 that yields 1 when multiplied by a is called the inverse of a. Mathematically: a-1 * a = a * a-1 = 1.
Example1: When using fractions,5-1=1/5 is the inverse number to 5, 3-1=1/3 is the inverse number to 3,
5
3/2 is the inverse number to 2/3.
Now, let’s look at examples for MOD arithmetic: Example2: The inverse of a=3 is a-1 = 2 MOD 5 because a * a-1 = 3*2 = 6 = 1 MOD 5. I found a-1 = 2 by simply testing the integers in Z5*={1,2,3,4}. a=4 is inverse to itself modulo 5 since a * a-1 = 4 * 4 = 16 = 1 MOD 5.
Example3: Doing arithmetic MOD 7, the inverse of a=3 is a-1 = 5 because a * a-1 = 3*5 = 15 = 1 MOD 7. Again, I found the inverse of a=3 by testing the integers in Z7* ={1,2,3,4,5,6} The inverse of a=4 is 2 since a * a-1 = 4 * 2 = 8 = 1 MOD 7.a=6 is inverse to itself MOD 7 since a * a-1 = 6 * 6 = 36 = 1 MOD 7.
Example4: What is the inverse of 3 MOD 11? It is a-1=4 since 3*4 = 12 = 1 MOD 11.
Example5: Try it yourself! What is the inverse of 5 MOD 11? What is the inverse of 7 MOD 11?
Back to the virus carrier message. It was encoded MOD 26. Since we calculate MOD 26, thus dealing with integers from 0 to 25, we now have to find an integer a-1 among those integers that yields 1 MOD 26 when multiplied by 5: a-1 * 5 = 1 MOD 26. Equivalently stated: what product of a-1 and 5 equals 1 more than a multiple of 26 such as 27, 53, 79, 105, etc? Aha, there is 105 = 21*5 so that 21*5 = 1 MOD 26. Equivalently stated, 105 divided by 26 leaves a remainder of 1. Wonderful, that is all we need to solve our encryption function C= a*P MOD 26 for the plain letter P in order to then decode the encrypted message: Multiplying both sides of our encryption equation the equation yields
a-1*C = a-1*(a*P) (1)= (a-1*a)*P (2)= 1*P (3)= P MOD 26 (4)
Remark: Solving this equation required the 4 group properties: the existence of an inverse and the closure in (1), the associative property in (2), the inverse property in (3) and the unit element property in (4). It thus gives a great example that we are only guaranteed to solve this equation for numbers that form a group with respect to multiplication MOD 26. We will check in the Abstract Algebra section at the end of this chapter that the set of good keys MOD 26, Z 26* = {1,3,5,7,9,11,15,17,19,21,23,25}, does form a multiplicative group. We can therefore always find a-1 for a given good key a.
Thus our decoding function P = a-1*C MOD 26 tells us to simply multiply each cipher letter by the inverse of the encoding key a=5, namely by the decoding key a-1=21 MOD 26 and we can eventually decode:
Cipher text a n r o m r j u k a h h o u h0 13 17 14 12 17 9 20 10 0 7 7 14 20 7
6
0 13 19 8 18 19 7 4 2 0 17 17 8 4 17PLAIN TEXT A N T I S T H E C A R R I E R
For example, multiplying the cipher letter r=17 by a-1 = 21 decodes the r to T=19 since 21*17 = 357 = 19 MOD 26. The o =14 decodes to I = 8 since 21*14 = 224 = 8 MOD 26,the m =12 decodes to S=18 since 21*12 = 252 = 18 MOD 26. How does the j decode to the H, and the u decode to the E? Verify this now!
An easier way to determine the decoding key a-1
Decoding a message turns out to be really easy once we know the decoding key a-1. We just had to multiply each cipher letter by a-1. So, we are left with determining the decoding key a-1 knowing the original encoding key a. To decode the above virus carrier message we found the inverse of a=5 through a clever check of the products of a and a-1
that produced one more than multiples of 26. That was trial and error and might take quite a while. We won’t have to do it that way again since there is a much more straightforward method. To find the inverse for each good key a, you just need to look back at the 26 by 26 encryption table.
For instance, to find the inverse of the good key a=5 we have to look at the fifth row which shows that a-1 equals 21 since the only 1 in this row is in the V- or 21-column (5 * 21 = 1 MOD 26). Moreover, you can see that the plain letter V encrypts to the cipher text letter b (=1) when using a=5 as the encoding key. Take a moment now to verify the
Rule for finding the decoding key a-1:1) For a given good key a, find the unique 1 in the a-row,2) From that 1 go all the way up that column,3) The letter’s numerical equivalent that you hit on the very top is the inverse of a.
Example: If we use the encoding key a=3, we find that the decoding key a-1 is 9 as the 1 occurs in the J- or 9-column telling us additionally that the plain letter J (=9) encrypts to the cipher letter b (=1). Finding the decoding keys for each good key a in the same manner, we obtain the following key pairs:
Good Encoding key a
Its decoding key a-1
1 13 95 217 159 311 19
7
15 717 2319 1121 523 1725 25
Three important observations:
1. All decoding keys a-1 in the right column are among the set of all encoding keys a. In fact, the sets of the encoding and decoding keys are identical. Coincidence? No, it is not. Just as the regular multiplication of two integers is commutative (i.e. 3 * 9 = 9 * 3 =27) the MOD- multiplication is commutative (3 * 9 = 9 * 3 = 1 MOD 26). You can observe this order-doesn’t-matter rule in the original 26x26 multiplication table: The diagonal line from the top left to the bottom right forms a reflection line. I.e. 21 is an inverse to 5 MOD 26, therefore 5 is inverse to 21 and the two 1’s are mirrored over the diagonal line. Therefore, the set of all encoding keys must equal the set of all decoding keys.
2. If we extract those rows with the good keys a = 1,3,5,7,9,11,15,17,19,21,23,25 and their corresponding columns, we obtain:
1 3 5 7 9 11 15 17 19 21 23 251 1 3 5 7 9 11 15 17 19 21 23 253 3 9 15 21 1 7 19 25 5 11 17 235 5 15 25 9 19 3 23 7 17 1 11 217 7 21 9 23 11 25 1 15 3 17 5 199 9 1 19 11 3 21 5 23 15 7 25 1711 11 7 3 25 21 17 9 5 1 23 19 1515 15 19 23 1 5 9 17 21 25 3 7 1117 17 25 7 15 23 5 21 3 11 19 1 919 19 5 17 3 15 1 25 11 23 9 21 721 21 11 1 17 7 23 3 19 9 25 15 523 23 17 11 5 25 19 7 1 21 15 9 325 25 23 21 19 17 15 11 9 7 5 3 1
This reduced table shows i.e. that 3 and 9 are inverse to each other because of the commutative property of the MOD-multiplication (exhibited by the diagonal as a line of reflection). Now every row contains exactly one 1 revealing that there exists an inverse for each a which is precisely the reason why those a’s are the good keys. Moreover, multiplying any two good keys yields again a good key. As an attentive reader, we realize that the MOD multiplication of the keys is closed (recall the group properties in the previous chapter). Combining this fact with the fact that each key a possesses a decoding key a-1, the set of the good keys forms a commutative group with the unit element 1. Does that even mean that the good keys form a field? That would additionally require that the good keys form a commutative group with respect
8
to addition. Do they? Try to answer it for yourself. I will answer it at the end of this chapter in the Abstract Algebra section.
3. The only two keys that are inverse to themselves are 1 and 25, which means that the
encoding key equals its decoding key. Let’s check why: 1*1=1 MOD 26 which explains a = a-1 = 1 (Big deal!). Now when a=25, we have: 25*25 = 625. Since 625=24*26+1 which means that 625 leaves a remainder of 1 when divided by 26, we have 625 = 1 MOD 26 and altogether 25 * 25 = 625 = 1 MOD 26. These calculations were correct but almost required a calculator. Here is a non-calculator way to understand why 25 is inverse to itself: Since 25 = -1 MOD 26, it follows 25 * 25 = (-1) * (-1) = 1 MOD 26. This shows that when using an encoding key that is one less than the alphabet length M, namely a = M-1, then the decoding key must also equal M-1, a-1 = M-1. The reason is (M-1) * (M-1) = (-1) * (-1) = 1 MOD M. For example: when using an alphabet length of M = 27 and an encoding key a=26 then its decoding key is a-1 =26. To verify this: 262 = 676 =1 MOD 27.
Here is the C++ Code for the encryption and decryption of the multiplication cipher://Multiplication Cipher using the good key a=5//Author: Nils Hahnfeld, 9/22/99
#include<conio.h>#include<iostream.h>
void main(){ char cl,pl,ans; int a=5, ainverse=21; //as a-1*a=21*5=105=1 MOD 26
clrscr(); do { cout << "Multiplication Cipher: (e)ncode or (d)ecode or (~) to exit:" ; cin >> ans; if (ans=='e') { cout<< "Enter plain text: "<< endl; cin >> pl; while(pl!='~') { if ((pl>='a') && (pl<='z'))
cl='a' + (a*(pl -'a'))%26; else if ((pl>='A') && (pl<='Z'))
cl='A' + (a*(pl -'A'))%26; else cl=pl; cout << cl; cin >> pl;
}
}
9
else if (ans=='d')
{ cout << "Enter cipher text: " << endl; cin >> cl; while(cl!='~') { if ((cl>='a') && (cl<='z'))
pl='a' + (ainverse*(cl -'a'))%26; else if ((cl>='A') && (cl<='Z'))
pl='A' + (ainverse*(cl -'A'))%26; else pl=cl; cout << pl; cin >> cl;
} } } while(ans!='~');}
Programmer’s Remarks:Can you understand the code yourself? Try to understand as much as possible first, then continue reading. 1) This program both encodes and decodes. Say you first want to encode the letter c then you have to enter e when asked. Then the if-condition if (ans=='e') is fulfilled so that we enter the encoding part of the program. You are asked to enter your plain letter in cin >> pl; As long as you don’t enter ‘~’ the while-condition while(pl!='~') is fulfilled and the entered plain letter (=pl) is being encoded.
To do so, I distinguish between upper and lower case letters since they are encoded slightly different. Say, the lower case plain letter c is entered, then the condition if ((pl>='a') && (pl<='z')) is fulfilled and the encryption is being executed by this one seemingly weird command cl='a' + (a*(pl -'a'))%26; Let me explain that to you in detail: First you need to know that each letter is stored as a number: i.e. A=65, B=66, C=67, .., Z=100, a=101, b=102, c=103, …z=125. In fact, any character is stored as a number: i.e. ~=.., $=.. etc. For now, let’s focus on the lower case letters.
The plain letter c is stored as 103, however, I want the c to equal 2 in compliance with our
10
translation a=0, b=1, c=2, etc. which we used in our virus carrier example. Therefore, I need to subtract 101 from the 103 to get the desired 2, similarly, I again would have to subtract 101 from any plain letter b=102 to get the desired 1. In fact, I always have to subtract 101 from each entered lower case plain letter to get its corresponding number. By subtracting a (=101) from the entered plain letter in (pl -'a');. I accomplish this. Subsequently, that difference is multiplied by the good key a=5 which I defined as such in int a=5. You could also define a to be a different good key. If you choose to do so, don’t forget to also redefine the corresponding decoding key in int a=5, ainverse=21; .
Ok, let’s continue with the encoding part. Since we are performing MOD 26 arithmetic, we use the MOD-operator % that guarantees us the product (a*(pl -'a'))%26; to be between 0 and 25. In our example, after subtracting 101 from the plain letter c we get the desired 2 that is now multiplied by a=5 yielding 10. This is just what we wanted except that the answer 10 does not equal the desired cipher letter k on the computer. Therefore, we just have to add a number in order to get k=111. Which number would that be? Right, we have to add 101 to the 10 which we do by adding a=101 in cl='a' + (a*(pl -'a'))%26. Now the cipher letter cl equals k and we can end the lower case encoding.
The encryption of upper case plain letter works similarly except that I have to subtract A=65 (instead of a=101 as above) to obtain our desired plain letter number. Say, we want to encrypt the plain letter C=67. I first subtract 65 =’A’ and then multiply that difference by the good key a=5 yielding 10 again. The MOD 26 calculation leaves the 10 unchanged. Finally, I have to add the usual 65 = A (why?) to obtain the desired cipher letter.
How do we deal with non-letters? Well, I leave all the entered non-letters such as ! or . or ? unchanged so that you can detect the format of the original message easier. If we don’t want to give an eavesdropper any additional information about
11
our secret message, we would firstly either not use such characters at all or we would expand our alphabet length and encode them just like the other plain letters. Secondly, we would translate every upper case plain letter into a lower case cipher letter so that we don’t reveal information about the beginning of a sentence. These are valuable information for an eavesdropper that help cracking the message. I leave the translation from an upper case plain letter to a lower case cipher letter as an easy exercise for you.
2) Lastly, I want to explain the trick how I manage to encode not only a letter but a whole word or sentence if necessary. The statements while(cl!='~') and cout << cl; cin >> pl; are in charge of it. The first time the loop passes the line cout << cl; the translated plain letter pl that was read in as cin >> pl; before the while loop is output as its cipher letter cl. The trick is now that if we enter more than one letter all but the first entered letter are buffered (which means temporarily stored in the computer’s RAM) until read in in cin >> pl; inside the while loop. Since any plain letter fulfills the condition in while(cl!='~') The loop is reentered and the next cipher letter is displayed in cout << cl; We can then end this while loop by entering ~ and then choose to either encode, decode or exit the program. Try it for yourself.
2.3 Cryptoanalysis - Cracking the Multiplication Cipher
12
Just like the Cipher Caesar Cipher, the Multiplication is not secure at all. How could it be broken? Let’s consider two options:
Option 1: Cracking the cipher code using letter frequenciesIf plain letters are replaced by cipher letters the underlying letter frequencies remain unchanged. I.e. if the letter e (the most frequent letter in the English language) occurs 20 times in the plain text its replacement letter will appear 20 times in the cipher text. Therefore, an eavesdropper simply has to count letter frequencies to identify the most frequent cipher letter. Its numerical equivalent reveals the row and therefore the key a as follows:
PLAIN LETTER
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z1 0 1 2 3 42 0 2 4 6 83 0 3 6 9 124 0 4 8 12 165 0 5 10 15 20 25 4 9 14 19 24 3 8 13 18 23 2 7 12 17 22 1 6 11 16 216 0 6 12 18 247 0 7 14 21 28 0 8 16 24 69 0 9 18 1 10
10 0 10 20 4 1411 0 11 22 7 1812 0 12 24 10 2213 0 13 0 13 014 0 14 2 16 415 0 15 4 19 816 0 16 6 22 1217 0 17 8 25 1618 0 18 10 2 2019 0 19 12 5 2420 0 20 14 8 221 0 21 16 11 622 0 22 18 14 1023 0 23 20 17 14 11 8 5 2 25 22 19 16 13 10 7 4 1 24 21 18 15 12 9 6 324 0 24 22 20 1825 0 25 24 23 22
After intercepting the cipher text, an eavesdropper simply finds the most frequent letter of this rather brief message. Longer messages reveal the most the letter e equivalent, however, this is not necessarily so for our message.
13
Keys a
Cipher text a n r o m r j u k a h h o u h0 13 17 14 12 17 9 20 10 0 7 7 14 20 7
He finds the cipher letter h to be most frequent. However, there is no 7 – the numerical equivalent of letter h - in the E column. This means that the cipher E does not equal 7. In fact, the cipher E can only be an even cipher letter as only even numbers appear in the E-column. Thus, among those numbers that occur twice in the cipher code, 14, 17 and 20, we can eliminate the odd 17. The 14 as the possible cipher E then tells him to test the keys a=10 and a=23.
Since a=10 is a bad key he checks the good key a=23. He decodes all the other cipher letters by finding their corresponding number in the 23rd row (see above) and then goes up that column to find the original plain letter. He obtains:
Cipher text a n r o m r j u k a h h o u h0 13 17 14 12 17 9 20 10 0 7 7 14 20 7
0 13 11 6 7 11 23 2 14 0 15 15 19 2 15PLAIN TEXT A N L G H L X C O A P P T C P
That message does not reveal a virus carrier. Certainly, it might be a double encoded message that has to be decoded twice, possibly using two different keys or even two different ciphers. Before considering such encoding techniques, we go ahead and check if the other frequent number, 20, is the cipher E.
Checking the E column, we can see that the possible two keys are the bad one a=18 and the good one a=5. Again, we just have to find the cipher numbers in the 5 th row and then go up that column to the very top to find the corresponding plain letter. This yields the correct plain text: Cipher text a n r o m r j u k a h h o u h
0 13 17 14 12 17 9 20 10 0 7 7 14 20 7
0 13 19 8 18 19 7 4 2 0 17 17 8 4 17PLAIN TEXT A N T I S T H E C A R R I E R
As you can see, detecting the most frequent cipher letter is of enormous help in cryptography. Here, it reduces the number of possible good keys to two. It is not difficult to find the encoded E in English documents as every 8 th letter on average is an E (about 13%), it is therefore by far the most frequent letter. Consequently, the longer a cipher text, the easier the cipher E can be detected. Other frequent letters such as T, A, O and N occurring with about (8%) might be of further help to crack the cipher text.
I will explain the usage of letter frequency as a very important means to crack cipher codes in the next chapter. In case you wonder why the discussion of cracking codes is made public; why is it not kept secret to maintain the security of ciphers? The answer is a
14
simple “No”: Only those encryption systems that withstand all possible attacks are secure and thus useful. Certainly none of the cryptosystems we have considered thus far. Remember that the first 3 ciphers are meant to familiarize you with basic encryption systems. Moreover, we build the mathematical foundation to understand secure encryption systems such as the RSA encryption.
Option 2: Cracking the cipher code using trial and error (“brute force”)Knowing that there are just 12 possible unique encryptions MOD 26, the journalist produces the corresponding 12 rows in the 26 x 26 multiplication table and cracks the code easily.
Cipher text a n r o m r j u k a h h o u ha=1 A N R O M R J U K A H H O U Ha=3 A N X W E X D Y M A L L W Y La=5 A N T I S T H E C A R R I E Ra=7 A N V C Y V F O U A B B C O Ba=9 A N Z Q K Z B I E A V V Q I Va=11 A N L G U L P Q I A D D G Q Da=15 A N P U G P L K S A X X U K Xa=17 A N B K Q B Z S W A F F K S Fa=19 A N F Y C F V M G A Z Z Y M Za=21 A N H S I H T W Y A J J S W Ja=23 A N D E W D X C O A P P E C Pa=25 A N J M O J R G Q A T T M G T
MS Excel as a simple encryption and decryption tool:I created the following table in MS Excel with the CHAR and the MOD function:
Cipher text
a n r o m r j u k a h h o u h
a a-1 0 13 17 14 12 17 9 20 10 0 7 7 14 20 73 9 A N X W E X D Y M A L L W Y L5 21 A N T I S T H E C A R R I E R7 15 A N V C Y V F O U A B B C O B9 3 A N Z Q K Z B I E A V V Q I V
11 19 A N L G U L P Q I A D D G Q D15 7 A N P U G P L K S A X X U K X17 23 A N B K Q B Z S W A F F K S F19 11 A N F Y C F V M G A Z Z Y M Z21 5 A N H S I H T W Y A J J S W J23 17 A N D E W D X C O A P P E C P25 25 A N J M O J R G Q A T T M G T
15
For example, I created the T in the row a=5 using the Excel-formula =CHAR(65+MOD(E$2*$B4,26)) where the cell E$2 contains 17 and the cell $B4 contains 21 as the decoding key a-1. The formula MOD(E$2*$B4,26) computes the number of the plain letter T, namely 19. However, converting 19 to its character does not yield the desired T. The T is stored as 84 which you could see by entering the Excel formula =CODE("T"). Therefore, we first have to add 65 to the 19 in order to translate the 84 eventually into the desired T using =CHAR(65+MOD(E$2*$B4,26)). In fact, all the upper case letters on Excel are 65 numbers higher than those we are using, the lower case letters on Excel are 97 numbers above ours (i.e. =CODE("a") yields 97).
Which cracking method should a code cracker use. They are trade-offs in terms of their efficiency: the gain of not having to determine the most frequent letter in the cipher text for the brute force approach is at the cost of producing all possible cipher codes. Vice versa, the cost of detecting the most frequent cipher letter in the first approach is at the gain of producing only one plain text provided that the most frequent cipher letter turns out to be unique. This is very likely in English texts and virtually certain in the German language where on average every 5th letter is an E.
Even if an eavesdropper decides to produce all 12 possible plain texts, they can be generated with the help of a computer within a few seconds. Therefore, no matter how he decides to crack the cipher text, it won’t take long. Thus, safer encryptions are necessary. In the next chapter, I will show you one principle of increasing the safety of a cipher code. I will couple the Multiplication Cipher with the Caesar Cipher (which produces 26 unique encryptions) to obtain a super encryption that will allow 12*26=312 possible unique encryptions. Are the used 12 unique encryptions a set number? Or can we even increase the mere 12 unique encryptions for the Multiplication Cipher by varying the alphabet length? Let’s investigate this in the following section.
2.4 Varying the Alphabet Length varies the Number of Good KeysUsing an alphabet length of M=27:Say for legibility reasons we add a blank symbol as our 27 th plain letter. It converts to the plain letter number 26 so that we now have to encrypt MOD 27. Does the increase of our alphabet length by 1 increase the number of unique encryptions obtained? Our good-key-criterion declares those integers to be good keys that are relative prime to 27. Which ones are those? 27=3*3*3, so that only the multiples of the only prime divisor 3 such as a=3, 9 and 27 will not yield a unique encryption, all the other integers will: The good keys a are therefore
Z27* = {1,2,4,5,7,8,10,11,13,14,16,17,19,20,22,23,25,26}
allowing 18 different unique encryptions, 6 more than before.
16
Notice that we found the good keys indirectly. We first found the bad keys as the multiples of the prime divisors of the alphabet length M. Consequently, the good keys are the remaining integers less than M. Again a perfect task for a computer, especially when we have to find the prime divisors of bigger integers. (I.e. what are prime divisors of 178247 or of 56272839 ?). Below is the C++ program that performs the task for us, it just finds all the factors of an entered alphabet length M by testing all the integers less than M for possible factors. This “brute force” approach will work fast enough for integers M that have 10 digits or less. For larger integers, however, dividing by every integer less than M slows the program down enormously. Test it yourself.
One of the major goals of current Mathematics research is to design faster factoring algorithms as today’s are fairly slow. In fact, the security of i.e. the commonly used RSA Cipher is based on the relative slowness of such factoring programs. If you are able to invent a fast factoring algorithm, you will not have to worry about a future job.
//Author: Nils Hahnfeld 10/15/99//Factoring program#include <conio.h>#include <iostream.h>#include <math.h>
void main(){ int M, factor ;
clrscr(); do { cout << "Enter the integer that you want to factor or 0 to exit: M="; cin >> M; factor=2; while(factor <= M) { if (M%factor==0) //check all integers less than M as factors
{ cout << factor << endl;
M/=factor; factor=1; } factor++;
} }while(M!=0);}
Programmer’s remarks:Starting with 2, this program checks the integers from 2 to M-1 as potential factors of M in if (M%factor==0). In such case, divide M by that
17
factor: M/=factor; and start checking M/factor for factors less than M/factor...etc. This process repeats until M is reduced to 1 and therefore less than the smallest factor possible, 2.
Can we do even better with M=28 ?
Can we increase the number of unique encryptions by further extending our alphabet? Let’s add a dot to our alphabet to denote the end of a sentence in the original message. Our alphabet length of 28 now yields how many unique encryptions? Try it for yourself!
28 equals 2*2*7 so that all the keys that are multiples of 2 or 7 do not and all non-multiples of 2 or 7 do produce a unique encryption: Z28* = {1, 3, 5, 9, 11, 13, 15, 17, 19, 23, 25, 27} allowing only 12 different unique encryptions. That is weird! A longer alphabet produces less unique encryptions. Why is that?
This weirdness is not really weird. What really matters is not the alphabet length M but rather the number of multiples of the prime factors of M that are less than M: the less multiples of prime factors (as for the alphabet length of 27), the more a’s produce a unique encryption and vice versa. Aha, that realization helps a lot, since that also means that prime M’s produce M-1 unique encryptions. Why is that? Try to explain this, than continue reading!
The reason for that is that a prime number has per definition no prime divisor except for 1 and itself. Therefore, since there are no other prime divisors and thus no multiples, all integers less than M serve as good keys. Let’s check this for an alphabet length of M=29. As 29 is prime, it has no divisors except for 1 and 29 and thus there are no multiples as bad keys. Therefore, each integer less than 29 is a good key MOD 29: Z29* = {1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28}.allowing a total of 28 different unique encryptions. Hey, this shows a great way to produce more unique encryptions which of course makes life harder for an eavesdropper:
Recommendation for more security: Choose the alphabet length M to be a prime number to make cracking the cipher text more difficult.
18
You now understand why cryptographers have an affection for prime numbers. Additionally, you will learn that the RSA Cipher uses prime numbers as well. They are very special primes as they must consist of 100 digits or more. It is not difficult to understand that the length of such numbers requires the usage of computers. Thus, we now go ahead and practice a bit more computer programming.
Determining the bad keys for a given alphabet length M is a perfect task for a computer. The following C++ program firstly determines the factors for an entered alphabet length M and secondly their multiples, the bad keys. Thirdly, listing the good keys would be best done using C++ vectors or even C-style arrays which you might know. If so please go ahead and modify the following program. If you don’t know, exercise your patience, later in this chapter I will present a more elegant program that uses the Euclidean Algorithm to determine the good keys.
This program is an extension of the previous simple factoring program. After finding each factor of M, I just print them out in for (j=1;j<factor2;j++){ cout << setw(2) << j*factor << " ";}
I will explain the data type bool and the command setw() after the C++ code. //Author: Nils Hahnfeld 10-16-99//Program to find the bad keys#include <conio.h>#include <iostream.h>#include <iomanip.h>#include <bool.h>
void main(){ int M, m, j, factor, factor2; bool prime;
clrscr(); cout << "This program finds the 'bad' keys for an entered alphabet length M." << endl; cout << "===========================================================================" << endl; do {
cout << "Enter the alphabet length or 0 to exit: M=";cin >> M;m=M; factor=2; prime=0; //initializationwhile(factor <= m){ if (m%factor==0) {
if (factor!=M){ cout << "Divisor of "<< M << " =" << setw(3) <<factor<< ". "; cout << "'Bad' keys: ";
19
}else { cout << M << " is prime."<< endl; prime=1; break; }
factor2=M/factor; for (j=1;j<factor2;j++){ cout << setw(2) << j*factor << " ";} cout << endl; m/=factor; while(m%factor==0){m/=factor;} //takes out multiples of factor factor=1; } factor++;
} cout << "Thus, the 'good' keys are all the "; if (!prime) cout <<"non-listed "; cout << "integers from 1 to " << M-1 <<"." << endl << endl; }while(M!=0);}
Programmer’s Remarks:1) The logic of this program is the same as in the previous factoring program. However, you can see the usage of the data type boolean (“bool”, named after the British Mathematician George Boole [1815-1864]), which is used if a variable (i.e. prime) can only attain two possible values: either true (=1) or false (=0). In order to be able to use the data type boolean, we have to include the bool.h library in #include <bool.h>1. Since the bool.h library is very short I want to show you its contents:
typedef int bool;const int false = 0;const int true = 1;
In the first line the new data type “bool” is defined of type “int” so that the (two) bool-variables are just regular integers. The next two lines then show us that the variable “false” is defined as “0” and “true” as “1”. The command const is used as a safety feature in C++: both variables are constant and can never be modified in any program.
1 Modern C++ compiler ( i.e. C++ builder5.0 from Borland) don’t require to include the bool.h library anymore. Thus, variables of type boolean can be used just like int, char, double or other variables.
20
2) The setwidth command setw() assigns as many spaces as entered in the parentheses for a numerical output in order to have a well-formatted output. It has to be placed after the cout command as in: cout << setw(2) << j*factor. In order to be able to use the command setw() we have to include the iomanip.h library in #include <iomanip.h>.
2.5 Counting the Number of Good Keys for various Alphabet Lengths M
– An Introduction to the Euler Function.
Now that we have explored the criteria for unique encryptions and the number of good keys for certain alphabet lengths, it is the nature of Mathematics to generalize the observations and to set up an explicit formula for the number of unique encryptions based on the alphabet length M. For that purpose we have to consider 3 different cases of the alphabet length M
1) If M is a prime number: We observed in the previous section that the prime alphabet length M=29 yields u=28 unique encryptions. For the same reason, an alphabet length of M=31 produces u=30 unique encryptions. Since the number of unique encryptions u is a function of the alphabet length M, we may write in function notation: u(M) to denote the number of unique encryptions (which equals the number of good keys) as a function of M. I.e. for M=29 we have u(29)=28. For M=31 we have u(31)=30. Remember that a function, per definition, assigns to each x-value one particular y-value. The x values are the ones that we can choose independently, here the length of the alphabet M. Each y-value is dependent on the choice of x, i.e. the number of unique encryptions u are dependent on the chosen alphabet length M. Since u can be expressed as a formula that involves M, namely u=M-1, we say that u is a function of M and write u(M)=M-1.
In general we have the:
Formula for the number of good keys if M is a primeIf the alphabet length M=p is prime, the number of good keys is u(p) = p-1.
2) If M is a prime power, M=pn:Now let’s look back at M=27 as an example where we only have the one prime factor p=3, such that M=33. How many multiples of 3 will not produce a unique encryption? Those are the 8 integers 3, 6, 9, 12, 15, 18, 21, 24. Since there are 9 threes (or 9 multiples of 3) in 27 and therefore 8 threes when counting only up to 26 yielding the 8 listed bad keys. Therefore, we just need to divide 27 by the only prime divisor 3 and subtract 1 at the end to find the number of bad keys: 8 = 27/3 – 1.
21
This principle of finding the number of bad keys holds true for any alphabet length that is a prime power: There are M/p multiples of p less or equal to M, and therefore M/p - 1 many less than M. And we are only interested in those integers less than M since we are calculating MOD M which involves the integers 0 to M-1. Thus, the number of bad keys can simply be found by dividing the alphabet length M by the only prime divisor p and subtracting 1 from that fraction: M/p - 1. Let’s write down the
Formula for the number of bad keys if M is a prime power
b(M) = number of bad keys = M/p - 1.
Example1: M=9=32 has the only prime divisor 3 and thus b=9/3 – 1 = 2 bad keys which are 3 and 6 as the multiples of 3 that are less than 9.
Example2: M=81=34 has again 3 as the only prime divisor and thus b = 81/3 – 1 = 34/3 –1 = 33 –1 = 26 bad keys. Those are 3, 6, 9, 12, 15, 18, 21, 24, 27, 30, 33, 36, 39, 42, 45, 48, 51, 54, 57, 60, 63, 66, 69, 72, 75 and 78 as the multiples of 3 that are less than 81.
Our ultimate goal is not to develop a formula for the number of bad keys but rather for the number of good keys. However, subtracting the number of bad keys from the number of all possible keys (=M-1) yields the number of good keys. In formula:
u(M) = (M-1) – b(M) using the above formula for the number of bad keys yields = M-1 - (M/p -1) distributing the minus sign to the terms in the parenthesis yields
= M-1 - M/p + 1 canceling out the 1’s yields = M - M/p This turns out to be a handy formula for the number of good keys. However, it can be simplified further using the fact that we are considering here alphabets of length M that are powers of a prime p: M=pn for some positive integer n. Thus, our formula simplifies to: u(M) = pn – pn/p which simplifies further to = pn - pn-1. Therefore,
Formula for the number of good keys if M is a prime power: If M = pn , the number of good keys is u(M) = pn - pn-1.
Example 1: For M=27=33: Inserting 3 for p and 3 for n in pn - pn-1 yields u(27) = 33 - 32
= 27-9 = 18 which is just what we wanted.
Example2: For M=9=32 we have u(9) = 32 - 31 = 9 – 3 = 6 which are the 6 good keys a=1,2,4,5,7,8.
Example3: For M=16=24 we have u(16) = 24 - 23 = 8 which are the 8 good keys a=1,3,5,7,9,11,13,15.
22
Example4: For M= 34 =81, we get u(81) = 34 - 33 = 81 – 27 = 54.
3) If the alphabet length M is a product of two prime numbers p and qThe last case we have to study is when M is a product of two primes. Combining our three formulas for the number of good keys, we will then be able to develop a general formula for the number of good keys for any given alphabet length M.
Let’s start with Example1: M=26=p*q=2*13. We saw that an alphabet length of M=26 produces 12 unique encryptions, since the even numbers as multiples of 2 and the 13 are the 13 bad keys. More precisely: Out of the 25 (= p * q - 1) integers that are smaller than 26, we had 12 (=13-1) multiples of 2 {2,4,6,8,10,12,14,16,18,20,22,24} and the 1 (=2-1) multiple of 13 {13} as bad keys, so that 25-12-1=12 good keys are remaining:
a = 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25Notice that u(26) = 12 = 25-12-1 = (p*q - 1) – (p-1) - (q-1)
Example2: For M=10=5*2, we obtain u(10)=4 good keys which are obtained by crossing out the 4 (=5-1) multiples of 2 and the 1 (=2-1) multiples of 5 as bad keys:
a = 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 Notice that again u = 4 = 9 – 4 –1 = (p*q - 1) – (p-1) – (q-1)
Example3: For M=15=5*3, we obtain u(15)=8 good keys which are obtained by crossing out the 4 (=5-1) multiples of 2 and the 2 (=3-1) multiples of 5:
a = 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14Notice that again u = 8 = 14 – 4 – 2 = (p*q - 1) – (p-1) – (q-1)
The number of good keys can always be computed by u(p*q) = (p*q - 1) - (p-1) -(q-1). This formula can be simplified into the product of two factors. Here is how: u = (p*q - 1) - (p-1) – (q –1) getting rid of the first two parentheses yields = p*q -1 - p + 1 – (q –1) the two 1’s cancel each other out yielding
= p*q – p – (q –1) factoring the p yields= p*(q-1) – (q –1) (q-1) in both terms can be factored yielding = (q-1) * (p –1) which can also be written as = (p-1) * (q –1)
Formula for the number of good keys if M is the product of two primes:The number of good keys is u(M) = u(p*q) = (p-1)*(q-1).
23
Example4: If M=39=3*13=p*q, then the formula yields u(39) = (3-1)*(13-1) = 2*12 = 24. You can verify this as follows: out of the 38 (=p*q-1) integers that are less than 39, we first cross out all the 12 (=13-1) multiples of 3 {3,6,9,12,15,18,21,24,27,30,33,36} and then cross out the 2 (=3-1) multiples of 13 {13,26} resulting in 38 – 12 – 2 = 24 good keys.
Example5: If M=65=5*13=p*q, then the formula yields u(65) = (5-1)*(13-1) = 4*12 = 48. You can verify this as follows: out of the __ integers that are less than 65, we first cross out all the ___ multiples of __ and then cross out the __ multiples of __ resulting in ______ = 48 good keys.
A summary of our explorations for the number of good keys shows:1) u(p) = p - 1, if M is prime M=p. 2) u(pn)= pn - pn-1, if M is a power of a prime M= pn.3) u(p*q) = (p-1)*(q-1), if M is a product of two primes M=p*q.
Credit goes to the Swiss Mathematician Leonard Euler (pronounced “Oiler”, 1707-1783). He investigated these number properties and was the first one to come up with a function, Euler’s -function, also called Euler’s Totient function, that determines the number of integers that are relative prime to a given integer M. It is a function that is in the heart of Cryptography and used i.e. for the RSA encryption. The following table shows the numbers relative prime to M for the first 21 integers.
M 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 (M) 1 2 2 4 2 6 4 8 12 10 4 12 6 8 8 16 6 18 8 12
Similar to our notation, the properties of Euler’s -function that computes the number of integers that are relatively prime to M and wrote similarly to our notation: Euler’s -function: 1) (p) = p-1 for a prime p.2) (pn) = pn - pn-1 for a prime power pn.3) (p*q) = (p-1)*(q-1) for two distinct primes p and q.4) (n*m) = (n) * (m) when n and m are relatively prime. It describes the
multiplicative property of .
We have explored the first three properties already, however, the 4th property is new - but not totally new. I want to show you an example where we used it already. Say M=26=2*13=n*m. Since n and m are two distinct primes, they certainly are relative prime, so that the condition for property 4) is fulfilled. We obtain (2*13) = (2) *(13). From property 1) we know that (2)=1 and (13)=12, and consequently, (2*13) = (2)*(13) = 1*12 = 12 which is exactly property 3). Thus, property 4) yields nothing new if our alphabet length is the product of two primes. However, it turns out to be indispensable when M is not the product of two primes, but say a product of a prime and a prime power.
24
Example1: If M=24=3*8=3*23, then (24) = (3*23) using property 4) yields
= (3)*(23). using properties 1) and 2) yields = (3-1)*(23-22)= 2*4 = 8.
For a check: the eight integers 1,5,7,11,13,17,19,23 are relative prime to 24 and thus the good keys for M=24.
Even products of 3 primes or prime powers like 30 or 60 can now be dealt with due to the 4th property: Example2: If M=30=2*3*5, then (30) = (2*3*5) using property 4) yields = (2)*(3*5) again property 4) yields
= (2)*(3)*(5) now using property 1) yields= 1*2*4= 8.
For a check: the same eight integers 1,5,7,11,13,17,19,23 are relative prime to 30 and are thus the good keys for M=30.
Example3: Now, it is your turn. If M=60=22*3*5, then(60) = (22*3*5) using property __ yields
= (22)*(3*5) using property __ yields= (22)*(3)*(5) using properties __ and __ yields= (22 – 21)*2*4= 2*2*4= 16.
You noticed, that the multiplicative property of Euler’s -function, expressed in property 4), is used to decompose any integer M into its prime factors or prime power factors to then apply the first two properties to each prime or prime power. This eventually enables us to calculate the number of integers that are relative prime to these primes and prime powers. Multiplying such answers yields the number of good keys for any given alphabet length. The given examples show you the calculation process. Notice, that property 3) became useless for the calculation process since factors that are relative prime are separated via property 4). Subsequently, is computed by property 1) if such factors are primes or by property 2) if they are prime powers.
Before we conclude this section with the highlight of creating a sole formula for (M) from these four properties, we will consider 2 examples for each of the 4 properties of Euler’s -function. I will complete the first ones and leave the second ones for you as exercises.
Examples for property 1): 3 and 5 are two primes.
25
(3)=3-1=2 as 1 and 2 are relative prime to 3. (5)=_____ as 1,2,3,4 are relative prime to 5.
Examples for property 2): 8 and 25 are prime powers.(8)= (23)=23 -22 =4 as 1,3,5,7 are relative prime to 8.(25)=____________ as all integers from 1 to 24 except for 5,10,15,20 are relatively prime to 25.
Examples for property 3): 15 and 21 are products of two primes. (15)=(3*5)=(3-1)*(5-1)=2*4=8 as 1,2,4,7,8,11,13,14 are relative prime to 15.(21)=________________________ as 1,2,4,5,8,10,11,13,16,17,19,20 are relative prime to 21.
Examples for property 4): 24 and 28 are products of primes and prime powers.(24) = (23 *3) = (23)*(3) = (23-22)*(3-1) = 4*2 = 8 as 1,5,7,11,13,17,19,23 are relative prime to 24.(28) = _____________________________ as 1,3,5,9,11,13,15,17,19,23,25,27 are relative prime to 28.
Now, let’s come to the highlight of this section: I will show you in a few steps how to compute (M) for any M from one equation instead of combining the four properties? All we need to know are the prime divisors of M, but we don’t even need to know how often a prime number divides M. I.e., for M=27 we just need to know that 3 is a prime divisor of 27 but not how often it divides 27. While deriving the formula for M=60=22*3*5 in the left column I will deduce simultaneously the explicit formula for M=p1
2*p2*p3 with p1 being the first prime factor 2, p2 being the second prime factor 3 and p3 being the third prime factor 5 in the right column.
We know already that:(60) = (22*3*5) = (22-21)*(3-1)*(5-1)
(M) = (p12* p2* p3)
= (p12- p1
1)*( p2-1)*( p3-1).
For the purpose of setting up an explicit formula for (M), we now try to give the three factors (in parentheses) the same format. We factor p1=2 yielding = 2*(2-1)*(3-1)*(5-1) = p1
* (p1- 1)*( p2-1)*( p3-1).
The three factors in the parentheses already have the same desired format, however, the single 2 destroys it. The ultimate trick to yet produce the same format is factoring: from each parentheses we factor the first integer (which is a divisor of M) and obtain: (60) = 22*(1 -1/2) * 3*(1 -1/3) * 5 * (1 -1/5) (M) = p1
2 * (1 -1/ p1) * p2*(1 -1/ p2) * p3 * (1 -1/ p3)
= 22*3*5*(1 -1/2)*(1 -1/3)*(1 -1/5) = p12* p2* p3*(1 -1/ p1)*(1 -1/ p2) * (1 -1/ p3)
= 60*(1 -1/2)*(1 -1/3)*(1 -1/5) = M * (1 -1/ p1) * (1 -1/ p2) * (1 -1/ p3).
26
This is it. Notice in the last row that all we need to know are the prime factors p of M without knowing how often they occur. We then write them in the form (1-1/p), multiply them and that product by M yielding (M). On the right we ended up with the explicit formula for (M) when M consists of one prime power and two primes. It surely acquires this simple form for any number of primes or prime powers. Notice, that all we need to find are the different primes, say p1, p2,..., pn, as our explicit formula for the number of unique encryptions appears to be:
Formula for the number of good keys for any alphabet length M:For an alphabet length M, there are (M) = M * (1- 1/p1) * (1- 1/p2) *…* (1- 1/pn) good keys where each pi is a prime divisor of M.
It is really enjoyable to use this simple formula as we just need to find all prime divisors of M and don’t have to worry about how often they occur. Therefore, a simple prime check program would be sufficient to find the divisors p of M. We then set up the factors of the form (1- 1/p), multiply them and eventually multiply that answer by M.
Example1:Say M=180, then a prime check program yields the prime factors 2,3 and 5, so that (180) = 180 * (1-1/2) * (1-1/3) * (1-1/5)
= 180 * (1/2) * (2/3) * (4/5) = 90 * (2/3) * (4/5) = 60 * (4/5)= 48
Example2:Say M=360, since 360=2*180 the prime factors are again 2,3 and 5, so that (360) = 360 * (1-1/2) * (1-1/3) * (1-1/5)
= 360 * (1/2) * (2/3) * (4/5) = 180 * (2/3) * (4/5) = 120 * (4/5)= 96
Example3 is for you:Say M=90, since 90=____ the prime factors are _______, so that (90) = 90 * (1-1/__) * (1-1/__) * (1-1/__)
= 90 * ____________________= _______________ = _______________= ___
Of course, I could have computed the answers in the above examples right away but I wanted to give you the chance of brushing up on your skills to multiply fractions. A little computer program turns out to be again very valuable as the number of good keys can be
27
easily determined by first finding all prime factors of M to then use the above explicit formula.
//Author: Nils Hahnfeld 10-16-99//Program to determine (M)using M*(1-1/p1)*(1-1/p2)*...
#include <iostream.h>#include <conio.h>
void main(){int factor, M, m;float phi;
clrscr(); cout << "This programs uses M*(1-1/p1)*(1-1/p2)*... to calculate phi(M)."<<endl; cout << "==============================================================="<<endl; do { cout << "Enter M to find the number of 'good keys' or 0 to exit: M=" ; cin >> M; cout << endl << "Prime Factor(s) are : " ; m=M; factor=2; phi= (float) M; //casting: from integer to float data type while(factor <=M)
{if (M%factor==0) { cout << factor << " "; M/=factor; while (M%factor==0) M/=factor; //takes out multiple factors phi*= (1- 1/(float)factor); }factor++;}cout << endl << "phi(" << m <<")="<< phi << endl << endl << endl;
}while(M!=0);}
Programmers remarks:This program is an enhanced version of thr previous one that found the bad keys as factors of M for us. If a factor p is found we now additionally form the term 1- 1/p and multiply it to the other terms in phi*= (1- 1/(float)factor) to eventually obtain phi.Notice in this program that phi and M are declared as 2 different data types, yet the value of the
28
integer (int) variable M can be assigned to the real number (float) variable phi in phi= (float) M; All I needed to do is to write the new data type (here float) in parenthesis right in front of the integer variable M. This process is called type-casting and also works when converting between any other numerical data types. In that case you have to be aware that when you convert from a float or a double to an integer (that is from more a precise to a less precise data type) the decimals are simply cut off: i.e. 3.1415927 becomes the integer 3 and we are losing precision. The other time that we are casting in phi*= (1- 1/(float)factor); we don’t give up any precision (and therefore information) as we convert from the integer typed variable factor to the more precise real number typed variable phi.
2.6 Introduction to Euler’s Theorem – Usage of the Good KeysIn this section, we will discover Euler’s Theorem which is the basis for the RSA encryption that I will introduce in chapter 5. It will be quite easy for you to grasp it since it solely deals with properties of the familiar good keys. Let’s recall first what we know already about them.
2.6.1 Good Keys have different OrdersA brief review: In section 2.2 we observed in the reduced multiplication table MOD26 that each encoding key that produces a unique encryption was called a good key and possesses a unique inverse a-1, the decoding key. You can verify this by finding exactly one 1 in each row that is produced by the multiplication of the encoding keys with its inverse a-1. Recall that an inverse of a is that particular integer a-1 that yields 1 when multiplied by a.
29
Decoding key a-1
* 1 3 5 7 9 11 15 17 19 21 23 251 1 3 5 7 9 11 15 17 19 21 23 253 3 9 15 21 1 7 19 25 5 11 17 235 5 15 25 9 19 3 23 7 17 1 11 217 7 21 9 23 11 25 1 15 3 17 5 199 9 1 19 11 3 21 5 23 15 7 25 17
11 11 7 3 25 21 17 9 5 1 23 19 1515 15 19 23 1 5 9 17 21 25 3 7 1117 17 25 7 15 23 5 21 3 11 19 1 919 19 5 17 3 15 1 25 11 23 9 21 721 21 11 1 17 7 23 3 19 9 25 15 523 23 17 11 5 25 19 7 1 21 15 9 325 25 23 21 19 17 15 11 9 7 5 3 1
Notice also that each good key occurs once in each row as well. Therefore, each row below the top row is just a rearrangement of the integers in the top row, which is also called a permutation. In other words: the integers 1,3,5,7,9,11,15,17,19,21,23,25 appear exactly once in each row.
Moreover, we learned in section 2.2 that the only keys that are inverse to themselves, which means that the encoding key equals the decoding key, are 1 and 25 because 1*1=12=1 MOD 26 and 25*25=252=1 MOD26. Notice that as there are no other 1’s on the diagonal there are no other keys that are inverse to themselves. Therefore, raising any other key except for 1 and 25 to the second power will not yield 1, however, if we raise to powers greater than 2, will we be more successful? Will we be able to raise the good keys to powers that yield 1 MOD 26? Might there even be one 'universal’ exponent that produces 1 for each good key a? We will check this now in detail for the good keys in Z26*, and then briefly for those in Z27* and Z28*.
For our exponent inspection, we need a new vocabulary in order to denote that particular power of a good key that yields the first 1.
Definition of the order of a good key:We raise the good key a to the power of 1, 2, 3, etc.: a1, a2, a3, … We stop when the first power yields 1 (which is guaranteed to happen for each good key and will be proved in the upcoming Euler’s Theorem). That exponent whose power yields the first 1 is called the order of a. or equivalently:
If as=1 for the smallest positive integer s, then “the order of the good key a is s.”
So, let’s find the orders of the good keys MOD 26.
For a=3:
30
Encoding key a
32=9 and 33 = 3 * 32 = 3 * 9 = 27 MOD 26 = 1. Since all calculations are performed MOD 26, we may just write 33=1 and therefore as a chain display: 31 -> 32 -> 33 MOD 26 or even simpler: 3 -> 9 -> 1
Here, the order of the good key a=3 is 3 since 33=1, which equals the length of the chain (why?). Therefore, 36 equals also 1 since 36 = (33)2 = 12 =1. For the same reason: 312=1. Although the exponents 6 and 12 also yield 1, none of them is the order of a=3 as none of them is the smallest exponent that yields 1. 3 is therefore the uniquely defined order of a=3. The fact that 36, 39 and 312 all equal 1 can easily be seen by extending the above chain display as follows:
3 -> 9 -> 1 -> 3 -> 9 -> 1 -> 3 -> 9 -> 1 -> 3 -> 9 -> 1 (31 -> 32 -> 33 -> 34 -> 35 -> 36 -> 37 -> 38 -> 39 -> 310 -> 311 -> 312)
Because of the repetitive or cyclic nature of the powers of 3, the chain can simply be displayed as: 3 -> 9 -> 1
and the period of this chain, namely 3, equals the order of the key a=3.
For a=5: Since 5*5=25 and 5*25=21 and 5*21=1 we get 5*5*5*5=54=1. Therefore, 4 is the order of 5 which again equals the period of the chain:
5 -> 25 -> 21 -> 1
Furthermore, 58=(54)2=12=1. Explain why 512 =1, 516 =1, 520 =1 yourself using the chain display. You can practice your MOD-calculation skills by computing 54=1 in an alternative way: Since 52 = 25 = -1 MOD 26, we obtain 54 = (52)2 = (-1)2 = 1 MOD 26.
Our additional search for an universal exponent that yields 1 for any good key a turns out to be very limited: the good key a=3 has exponents 3,6,9,12,… whereas a=5 has exponents 4,8,12,16,…that yield 1. So, 12 seems to be the only possible candidate for a universal exponent. So, let’s check if 12 works for a=7.
For a=7: Multiplying 7 by 7 gives 72=23, 73=7*23=5, 74=7*5=9, 75=7*9=11, 76=7*11=25, 77=7*25=19, 78=7*19=3, 79=7*3=21, 710=7*21=17, 711=7*17=15 and finally 712=7*15=1. Thus, the order of the good key a=7 is 12. Verify this on the chain display by determining the period of the chain
7 -> 23 -> 5 -> 9 -> 11 -> 25 -> 19 -> 3 -> 21 -> 17 -> 15 -> 1
31
I reached every good key for an alphabet length of 26 when computing all the powers of a=7. Precisely, raising 7 to the power of 1 then to 2, then to 3 … and finally to 12 generates all the 12 good keys, which is the reason why mathematicians call 7 a generator. It is important to specify that 7 is a generator for Z26* because it does not generate all the good keys that are i.e. in Z28* (Explain why not!). I will show you in much more detail the usefulness of generators in the Abstract Algebra section.
As a reminder: the star in Z26* denotes the good keys for an alphabet length of M=26 or M=28, respectively. Without the star, Z26 denotes the set of all positive integers that are less than 26. Written out: Z26* = {1,3,5,….,23,25} are the integers less than 26 that are relative prime to 26. Z26 = {0,1,2,3,….,24,25} are the integers less than 26. Although the keys a=3,5 and 7 have different orders, they all have an universal exponent of 12: when raising these keys to the power of 12 we obtained 1: 312=1, 512=1 and 712=1. Will the to-the-power-of-12-rule hold true for the other good keys and will we, therefore, be able to discover an universal exponent property? Let’s check this for the remaining good keys. For a=9:Since 92=9*9=3 and 9*3=1 so that 93=1. Thus, the order of a=9 is 3 which means that 9 is not a generator of Z26*and you explain why again 912=1 holds true using the chain display:
9 -> 3 -> 1 and the period of 3 equals the order of 9.
For a=11: It is your turn now. Show that the order of a=11 is 12 (which also means that 11 is a generator of Z26*): use your windows-calculator (go to Start, then you find it in Accessories) and compute the powers of 11 MOD 26 to complete the chain and verify that its period is 12:
11 -> 17 -> ……………………………………………………………..-> 1
Moreover, check on your windows-calculator that the to-the-power-of-12 rule also holds true for the remaining good keys by calculating 1512=1, 1712=1, 1912=1, 2112=1, 2312=1, 2512=1. The latter is quite easy to see as we know already that 252=1 and therefore 25 raised to any multiple k of the exponent 2 [(252)k=1] must also yield 1. Here is a table that displays the powers of all good keys a MOD 26:
Exponents1 2 3 4 5 6 7 8 9 10 11 12
1 1 1 1 1 1 1 1 1 1 1 1 1
32
3 3 9 1 3 9 1 3 9 1 3 9 15 5 25 21 1 5 25 21 1 5 25 21 17 7 23 5 9 11 25 19 3 21 17 15 19 9 3 1 9 3 1 9 3 1 9 3 111 11 17 5 3 7 25 15 9 21 23 19 115 15 17 21 3 19 25 11 9 5 23 7 117 17 3 25 9 23 1 17 3 25 9 23 119 19 23 21 9 15 25 7 3 5 17 11 121 21 25 5 1 21 25 5 1 21 25 5 123 23 9 25 3 17 1 23 9 25 3 17 125 25 1 25 1 25 1 25 1 25 1 25 1
The order of each good key a can now easily be traced in this table. I.e. the order of a=21 is 4 since the first 1 occurs as the fourth number in the row of a=21. Notice one very important fact: the order of each good key a is a divisor of 12. The French Mathematician J. Lagrange(1736-1813) was the first to observe this fact and to prove it. However, he didn’t state it particularly for the good keys MOD 26. Mathematically, there is nothing special about the M=26. He uses an algebraic theory, the group theory, to state his theorem in a more general manner. You will have the pleasure to study this theory in the Abstract Algebra section at the end of this chapter.
Now, place your index finger on the first 1 in the a=3 row, the order 3 then tells us the distance to the next 1. Jumps of length 3 bring us to the 1 when the exponent is 12. Realize, that the only reason why we end up at the 1 is because 3 is a divisor of 12. Move your index finger now to the first 1 in the a=5 row: the jumps of length 4 direct us again to 1 for an exponent of 12. Now, my point is that we only end up at 1 for an exponent of 12 for all good keys because their orders are 12 or divisors of 12. Otherwise, we would not hit 1 for an exponent of 12. I.e., say the order of a=7 were 5, then our jumps of length 5 would yield 1 for the exponents 5,10,15, .., however, not for 12. In conclusion: since the order of each good key MOD 26 is a divisor of 12 - guaranteed and proved in Lagrange’s Theorem - the to-the-power-of-12 rule holds true for all the good keys MOD 26. So, we can write our universal-exponent observations as:
a12= a(26)=1 MOD 26 if a is relative prime to 26. A brief remark: This formula holds even true for integers a that are greater than 26. I.e. a=29 is also relative prime to 26 and 2912 =1 MOD 26. However, we don’t need to consider those integers since each of them has an equivalent integer that is less than 26 that is relative prime to 26: i.e. 29=3 MOD 26 and using a=29 as a key produces the same unique encryption as a=3 does.
Is there anything special about an exponent 12? Is it coincidence that the exponent of 12 is just the amount of numbers that are relative prime to 26, namely (26)? If not, can we then generalize our “to-the-power-of-12-rule” to the “to-the-power-of-(M)” rule for any given alphabet length M. Let’s check this for M=27 and M=28 first:
1) For M=27:
33
Good keys a
The Euler function for prime powers yields (27) = (33) = 33 – 32 = 27 - 9 = 18. Instead of creating a whole new multiplication table for Z27*, I simply use my windows-calculator to raise all the good keys (those that are relative prime to 27 such as a=1,2,4,5,7,8,10,…,26) to the power of 18. I compute: 218=1, 418=1, 518=1, 718=1, 818=1, 1018=1,…, 2618=1 MOD 27. Recall that the last equation must be 1 because 26 = -1 and thus (-1)2 = 1 and therefore 2618 = (-1)18 = ((-1)2)9 = 1^9 = 1. Again: a18 = a(27) = 1 MOD 27 for the good keys a in Z27* = {1,2,4,5,7,8,10,11,13,14,16,17,19,20,22,23,25,26}.
2) For M=28: Then (28) = (22*7) = (22) * (7) = (22 – 21) * 6 = 12. And 312=1, 512=1, 912=1, 1112=1, 1312=1,…, 2712=1 MOD 28 is what your calculator computes so that again: a12 = a(28) = 1 MOD 28 for the 12 good keys a in Z28* = {1,3,5,9,11,13,15,17,19,23,25,27}.
2.6.2 Euler’s TheoremHow would you formulate the above to-the-power-of-(M)-rule as a theorem? Try to formulate it for yourself and then continue reading!
I hope you were able to formulate it just as Leonard Euler did. His theorem rose to one of the most famous theorems in Mathematics and became central in Cryptography: Euler’s Theorem:For a given alphabet length M, each integer a that is relative prime to M yields 1 MOD M when raised to
the power of (M): a(M) =1 MOD M.
Of course, we have not proven it. Rather, we verified it for M=26, M=27 and M=28. Checking those examples does not prove anything. A Mathematician would not be satisfied, he might say that our calculations don’t justify a theorem, however, it does seem to be a promising conjecture.
If you pursue a math career at college, you will encounter a lot of proofs. It is not my intention to introduce you to the many mathematical proofs, I rather want you to explore and discover many mathematical properties yourself. Nevertheless, since the proof of Euler’s Theorem is not difficult, I want to demonstrate it to you. Also to give you an idea of how proving a mathematical theorem can be accomplished and thus what to expect in case you happened to find yourself in some college math lecture:
I am first going to prove Euler’s Theorem for an alphabet length of M=5 for you. Customarily, proving it for one particular case is not being done in Mathematics,
34
however, it will give you a better idea of the general proof later. When first checking one particular case of the general proof you will be using concrete numbers that will fill the letters in the general proof with more meaning.
2.6.3 Proof of Euler’s Theorem for an alphabet length M=5So let’s prove Euler’s Theorem for an alphabet length of M=5. Since (5) = 4 we have to prove that a4 =1 MOD 5 for all integers a that are relative prime to 5 which are all the good keys a=1,2,3,4. For that purpose, we set up the multiplication table for Z5:
* 1 2 3 41 1 2 3 42 2 4 1 33 3 1 4 24 4 3 2 1
The first row (in blue) shows us the four good keys 1,2,3,4. In the next 3 rows, you see the rearrangements of the 4 keys. Now, rearranging the numbers in each row leaves their product unchanged - which is the key idea in this and later in the general proof. Specifically, let’s take a look at the first two rows first:
1 st row row of key a=2 1 * 2 * 3 * 4 = 2 * 4 * 1 * 3 can be written as
= (2*1) * (2*2) * (2*3) * (2*4) MOD 5 combining the four 2’s yields= 24 * 1 * 2 * 3 * 4
If we now divide both sides by 1 * 2 * 3 * 4 = 24, we obtain 1 on the left-hand side and 24
on the right-hand side which proves: 24 =1 MOD 5.
We can prove 34 =1 MOD 5 similarly. We now consider the first and the third row:1 st row row of key a=3 1 * 2 * 3 * 4 = 3 * 1 * 4 * 2 can be written as
= (3*1) * (3*2) * (3*3) * (3*4) MOD 5 combining the four 3’s yields= 34 * 1 * 2 * 3 * 4
Again, dividing both sides by 1 * 2 * 3 * 4 yields 1 on the left-hand side and 34 on the right-hand side which proves: 34 =1 MOD 5. The proof of a4 =1 MOD 5 is completed if we show that 44 =1 MOD 5 and realize that 14
=1 MOD 5. This is a great exercise for you, please do both now. I will provide the set up for the good key a=4:
1 st row row of key a=4 1 * 2 * 3 * 4 = _____________________ can be written as
= _____________________ MOD 5 combining the four 3’s yields= 34 * 1 * 2 * 3 * 4
35
In our first generalization step we now reduce the 4 parts of our proof for M=5 to one single more general proof.
1 st row row of key a a1 * a2 * a3 * a4 = (a*a1) * (a*a2) * (a*a3) * (a*a4) MOD M
= a4 * a1* a2 * a3 * a4 Again, the division by a1*a2*a3*a4 on both sides yields a4=1 MOD 5 and we have completed our proof for Euler’s Theorem when M=5. The proof of the generalized Euler’s Theorem will be of the same format except that we will have rather (M) terms instead of the (5) = 4 terms here.
2.6.4 Proof of Euler’s Theorem:If we now use an alphabet length M, then we have (M) good keys which we list as: a1,
a2, a3,…,a(M). The subscripts from 1 to (M) according to Euler’s function tell us which key we are talking about when they are listed in order from smallest (which is always 1) up to largest (which is (M)). In case of M=5 we would have a1=1, a2=2, a3=3 and a(5)
= a4 = 4, in case of M=26 we would have a1=1, a2=3, a3=5,…, a(26)=a12= 25. For the proof, we don’t need to know their actual values. All we really use in the proof is that there are (M) good keys whose products are the same in each row. We saw in the multiplication tables for the good keys when M=5 or M=26 that multiplication by another good key a just causes a rearrangement of the (M) good keys: the row of key a contains the integers a1, a2, a3, …,a(M) in a certain order, however, the products in all rows are the same: 1 st row row of good key a
a1*a2*a3*…*a(M) = (a*a1) * (a*a2) * (a*a3) * … *(a*a(M)) MOD M = a(M) * a1*a2*a3*…*a(M)
Again, dividing both sides by a1 * a2 * a3 *…* a(M) yields 1 on the left-hand side and a(M) on the right-hand side which proves: a(M)=1 MOD M which completes the proof of Euler’s Theorem.
Here is the C++ Code for Euler’s Theorem: with this program you can check the theorem for any entered alphabet length M and any key a. To check if a key a is a good or a bad one (i.e. if a is relative prime to M) you can use one of the earlier C++ programs. Can you also find an a and M such that a(M)=1 MOD M even if a is not a good key?
//Author: Nils Hahnfeld 11-3-99//Euler's Theorem//Warning: Incorrect answers occur for high powers (overflow problem)
36
#include <iostream.h>#include <conio.h>#include <math.h> //required for pow() function
int gcd(int A, int B); //prototype of the gcd functionfloat phi(int m); //prototype of Euler's phi function
void main(){
int M,a,ans,n;
clrscr(); cout << " The Euler Theorem: a^phi(M)=1 MOD M, if gcd(a,M)=1" << endl; cout << " ==================================================" << endl; do { cout << "Enter number M = "; cin >> M; cout << "Enter number a or 0 to exit: a = "; cin >> a; ans=(int)pow(a,phi(M)); if (gcd(a,M)==1) { cout << "a^phi(M) = "<< a <<"^" <<phi(M)<< " = " << ans%M << " MOD " << M << endl;} else { cout << a << "and " << M << " are not relative prime." <<endl;} cout <<endl; } while(a!=0);}
int gcd(int A, int B) // definition of the gcd function{ int R; do { R=A%B; A=B; B=R; } while(R!=0); return A;}
float phi(int m) // definition of Euler's phi function{ int factor=2; float phi=(float)m; while(factor<=m)
{if (m%factor==0) { m/=factor; while(m%factor==0) {m/=factor;} //cancels multiple factors
37
phi*= (1- 1/(float)factor); }factor++;}
return phi;}
Programmer Remarks: 1) Notice on top that we have to include the math library (which consists of the most common mathematical functions) in order to use the power function in ans=(int)pow(a,phi(M));
2) The power function’s return type is double, however, we need the power to be of type integer in order to perform the mod calculation in ans%M. For that reason, I have to convert the types (“type-casting”) again in ans=(int)pow(a,phi(M));
3) Now you are learning how to define your mathematical functions and how to incorporate them into your main program. Although very many mathematical functions are predefined in the math.h library, some are not. Sometimes, we need to define our own such that they can be used just like a library function.
Our first function shall return the greatest common divisor (gcd) of two entered integers (a and M), look at its definition at the bottom of the program. Since the greatest common divisor is an integer, the return data type is int written in front of the function definition: int gcd(int A, int B). The integers a and M must be read in again as integers, called A and B, so that all the computations inside the gcd function are performed on A and B. Their original values are those of a and M and change according to the procedure that determines the gcd of A and B. This procedure is the famous Euclidean Algorithm that I will explain to you in the next chapter. For now, you have to believe that it calculates the answer correctly, just as you have to believe that your calculator computes correctly.
Once the answer is calculated, it is returned to the main program in return A; and used in if
38
(gcd(a,M)==1). That means, gcd(a,M) takes the returned value of A from our gcd function is checked if it equals 1.The second function returns the value of Euler’s -function as a real number (“float”) to the main program in ans=(int)pow(a,phi(M)); and in … <<"^" <<phi(M)<< " = " … such that phi(M) in the main program takes the value of phi in the return function.
4) Finally, you find the “prototypes” (which are copies of the first lines) of the two self-defined functions right in front of the main program:
int gcd(int A, int B); float phi(int m);
They tell the C++ compiler to be patient about the two so far unknown functions when compiling the main program. The compiler will now compile the main program and expects the definition of those two functions following the main program.
2.6.5 Fermat’s Little Theorem: There is a neat exponent-simplification of Euler’s Theorem if the alphabet length M is a prime number. Using the first property of the Euler function: (M)=M-1, if M is prime, then Euler’s Theorem simplifies to the so-called
Fermat’s Little Theorem:If the alphabet length P equals a prime number, each of the P-1 integers a less than P are guaranteed to be relative prime to P (and therefore good keys) so that Euler’s Theorem simplifies to: aP-1=1 MOD P.
As an example check the previous section when P=5. We don’t need to prove Fermat’s Little Theorem anymore as it is a special case of the more general Euler Theorem which we just proved. This theorem is named after Pierre Fermat because he first discovered and prove it. It is called little to distinguish it from Fermat’s Theorem (also called Fermat’s Last Theorem) which states: for all integers x,y,z and n>2: xn + yn ≠ zn.
Note that n must be greater than 2 in Fermat’s Last Theorem as for n=2 we would just state the famous Pythagorean Theorem where i.e. x=3, y=4 and z=5 is one of infinitely many solutions. However, Fermat’s Last Theorem states the opposite, namely that you
39
can not find integers x, y and z that fulfill the equation for an exponent that is any integer greater than 2.
A famous anecdote is this one: Pierre Fermat (1601-1665), also the founder of the theory of probability, claimed that he had found a proof for his theorem. But he never published it. Supposedly, it did not fit on the page’s margin, so that nobody can be sure today if he actually proved it or not. However, the British Mathematician Andrew Wiles became well-known throughout the world in 1995 when he proved Fermat’s Last Theorem on more than 300 pages after spending 6 years in isolation and fulfilling a childhood dream.
2.7 Abstract Algebra (II): Examples of Rings and Fields
The last two sections are for those that like to have a more profound understanding of the encryption systems and the underlying algebraic fundament. Study it thoroughly.
2.7.1 ZM forms a Ring, ZP even forms a FieldWe learned in this chapter that all keys in ZM are good ones if M is prime. I. e. when M=29, we saw that all the non-zero keys in Z29 = {0,1,2,3,…,28} are good keys since each one possesses an inverse, the decoding key in Z29. However, when M=26, some of the non-zero keys in Z26 = {0,1,2,3,…,25} do not possess an inverse in Z26. This difference in inverse characterizes the difference between a field such as Z29 and a ring such as Z26.
To study the differences between fields and rings in more detail, let’s consider two familiar examples of rings. We learned in the previous chapter already that Z4 and Z6 do not form groups with respect to MOD-multiplication since there are keys a that don’t possess a decoding key a-1 or mathematically: not every element in Z4 and Z6 possesses an inverse element. For example, the multiplication table of Z4 shows
* 1 2 31 1 2 32 2 0 23 3 2 1
Only those integers that are relatively prime to M=4, namely 1 and 3, produce a 1 in their row and are therefore called the good keys. The key a=2 does not possess a decoding key a-1 in Z4 since none of the products of a=2 with 1, 2 or 3 yields 1. In fact, it never yields an odd number.
Similarly in Z6:
40
* 1 2 3 4 51 1 2 3 4 52 2 4 0 2 43 3 0 3 0 34 4 2 0 4 25 5 4 3 2 1
We obtain a 1 in the rows for a=1 and a=5 as the only two integers that are relatively prime to 6 (the only good keys in Z6).
We can observe that if the product of two non-zero members yields 0 MOD M (i.e. 2*3 =0 MOD 6 and thus 2 and 3 are called “zero-divisors”) we can never obtain 1 in their rows. It is impossible since multiples of the zero-divisors yield 0 over and over again and the zero-divisors is greater than 1?
Both Z4 and Z6 are examples of rings as they each fulfill the following
Ring properties:The set ZM forms a RING if 1. (ZM, +) forms a commutative group: The integers in ZM fulfill the four
group properties ( I) closed, II) unit element, III) inverse element, IV) associativity) with respect to addition. V) Moreover, the addition is commutative.
2. (ZM, *) is closed: The multiplication of integers in ZM yields an integer in ZM
3. they fulfill the distributive property a*(b+c) = ab+ac and (a+b)*c=ac + ab.
Notice that a Ring entails the two operations + and * whereas a group just uses one (I.e. + or *).
Let’s check the 3 ring properties for Z6 : 1) We saw in the multiplication table of Z6 that the product of any two integers in Z6
yields an answer that is part of Z6 aswell. This shows that the MOD-multiplication of Z6
is closed.
41
2) The addition table of Z6 appears as follows:
+ 0 1 2 3 4 50 0 1 2 3 4 51 1 2 3 4 5 02 2 3 4 5 0 13 3 4 5 0 1 24 3 5 0 1 2 35 3 0 1 2 3 4
I) Here you easily see that the sum of any two integers yields 0,1,2,3,4 or 5 so that the addition is closed. II) The unit element is 0 as adding 0 does not change the sum. III) Each integer has an inverse as we find a 0 in every row. I.e. 1 and 5 as well as 2 and 4 are inverse to each other. IV) The associative property is verified by checking all possible additions such as 1+(2+3) = (1+2)+3. V) The addition is commutative since the addition table is symmetric with respect to the main diagonal. 3) The distributive property is verified by checking all possible combinations such as 1*(2+3) = 1*2+1*3 and (1+2)*3=1*2 + 2*3. Notice that the distributive property checks if we can change the order of adding and multiplying numbers MOD6. Yes, we certainly can.
If in addition to the ring properties the non-zero elements of a set also form a multiplicative group then that set forms a field. That means in particular that each non-zero integer in ZM possesses an inverse that itself is in ZM. I.e. Z5 ={0,1,2,3,4}forms a field since each member in Z5 with the exception of 0 has an inverse in Z5. You can observe this by finding a 1 in each row. For instance, 3 and 2 are inverse MOD 5. The 0 is excluded since it turns any product into 0 and thus does not even have a chance to have an inverse.
* 1 2 3 41 1 2 3 42 2 4 1 33 3 1 4 24 4 3 2 1
Field properties: The set ZM forms a FIELD F if 1. (ZM, +) forms a commutative group: The integers in ZM fulfill the four
group properties (closed, unit element, inverse element, associativity) with respect to addition. Moreover, the addition is commutative.
42
2. (ZM*, *) forms a group: The non-zero integers in ZM fulfill the four group properties (closed, unit element, inverse element, associativity) with respect to multiplication.
3. they fulfill the distributive property a*(b+c) = ab+ac and (a+b)*c=ac + ab.
Notice that every field is also a ring. A field has the additional property that each field element possesses a multiplicative inverse.
Another example for a field is Z7 :* 1 2 3 4 5 61 1 2 3 4 5 62 2 4 6 1 3 53 3 6 2 5 1 44 4 1 5 2 6 35 5 3 1 6 4 26 6 5 4 3 2 1
Remark: Z5 and Z7 are even commutative or abelian groups with respect to multiplication and are therefore called commutative fields.
It is your turn now to show that Z7 forms a field. In order to verify property 1): ”The non-zero elements in Z7 form a multiplicative group” use the above table. To verify property 2) “Z7 forms an additive group” complete the following addition table:
+ 0 1 2 3 4 5 60 1 41 023 6 24 456 6 4
Notice in our examples that ZM forms a field if M is a prime number, and a ring if M is not. Let me show you why this is always true. I.e.: when M=6 the second row of the multiplication table shows the sequence 0,2,4,0,2,4. Since the multiples of 2 yield 0 (i.e. 2*3 = 0 MOD 6 and 2 is called a “zero divisor”) repeatedly and thus never 1, it is impossible for 2 to have a multiplicative inverse. Therefore, Z6 can not be a field:
* 1 2 3 4 51 1 2 3 4 52 2 4 0 2 4
In fact, any set ZM for a non-prime integer M possesses at least 2 divisors of M (why?). Those divisors are therefore zero divisors MOD M, thus, they can not have any multiplicative inverses and make it therefore impossible for ZM to be a field.
43
However, if M is prime, each integer a from 1 to M-1 is relative prime to M and thus is a good key of ZM (observe the permutations in each row for Z5 and Z7). Take a good key different from 1 and multiply it by itself, that product must be another good key a since the multiplication of good keys is closed (since ZM is a multiplicative group). Now continuing to multiply the product must eventually yield 1 which is what Fermat’s little Theorem teaches us. The worst case would be to multiply the good key a M-1 times by itself (in which case a turns out to be a generator of ZM). What matters is that a produces 1 after say k multiplications so that ak=1 MOD M. The inverse of a must then be the member ak -1 since a*ak-1 =1 MOD M. Therefore, every member in must have an inverse in ZM which is needed for a field.
We can now conclude this section with a
Criterion for rings and fields when performing MOD arithmetic:
ZM forms a ring, if M is not a prime number (i.e. Z4 , Z6, Z8, Z9,…) .
ZM forms a field, if M is a prime number (i.e. Z2, Z3, Z5, Z7,…) .In order to distinguish we denote the fields ZP and the rings ZM.
Remark: Notice that Fermat’s Little Theorem aP-1 = 1 MOD P is true for all fields ZP as all keys in ZP are guaranteed to be good keys. Euler’s Theorem a(M)=1 MOD M, however, is only true if we restrict ZM to the good keys which are the ones that are relative prime to M, denoted as ZM*. Does ZM* form a ring or a field? Or neither? I will answer this question in the next section.
What does all that mean? In order to decide right away if a given alphabet length M forms a ring or a field - and to therefore know if all keys are good keys - we just need to check if M is a prime number or not. Again, this sounds like a perfect computer task. It is. Input an integer M and let your program check if it is divisible by an integer that is less than M and greater than 1. If so, M is not prime, otherwise M is prime.
Let me show you my prime check program in C++:
//Prime Checking Program//Author: Nils Hahnfeld, 11/08/99
#include<iostream.h>#include<conio.h>
void main(){ int M,factor=2;
clrscr(); cout << "Enter integer M= "; cin >> M; while (factor<M && M%factor!=0)
{
44
factor++; //increment factor by 1 as long } //as it does not divide M evenly.
if (factor==M) {cout << M << " is prime" << endl;} else {cout << M << " is not prime" << endl;}getch();}
Programmer’s Remarks:
1) The search for divisors of M is straightforward: I simply check all integers between 2 and M-1 as factors of M. Notice that I am using 2 conditions in the while statement: the && represent the logical “and” so that both conditions need to be fulfilled in order to enter the while loop. The logical “or” is represented by ||.
2) If the first condition factor<M is not fulfilled it would not make sense to also check the second as both would have to be fulfilled. Also, C++ is not trained to also check the second condition if the first condition was not fulfilled. This “shortcut” is called short-circuiting and becomes even more useful when several conditions have to be checked in order to enter a loop. Similarly, the short-circuiting concept holds true for the logical or: if the first or the second condition is already fulfilled the following conditions don’t need to be checked anymore as one fulfilled condition suffices.
2.7.2 The Good Keys of ZM form a Multiplicative Group We just learned that for a prime alphabet length P all keys in ZP are good ones and thus form a field. So, what about if M is not prime and we only use the good keys in ZM? Sounds like a good try. As an example, let’s go back to the reduced multiplication table MOD 26 where we limited ourselves to the rows and the columns of the good keys. That are those keys that are relatively prime to 26, denoted as Z26* ={1,3,5,7,9,11,15,17,19,21,23,25}
* 1 3 5 7 9 11 15 17 19 21 23 251 1 3 5 7 9 11 15 17 19 21 23 253 3 9 15 21 1 7 19 25 5 11 17 23
45
5 5 15 25 9 19 3 23 7 17 1 11 217 7 21 9 23 11 25 1 15 3 17 5 199 9 1 19 11 3 21 5 23 15 7 25 17
11 11 7 3 25 21 17 9 5 1 23 19 1515 15 19 23 1 5 9 17 21 25 3 7 1117 17 25 7 15 23 5 21 3 11 19 1 919 19 5 17 3 15 1 25 11 23 9 21 721 21 11 1 17 7 23 3 19 9 25 15 5
23 23 17 11 5 25 19 7 1 21 15 9 325 25 23 21 19 17 15 11 9 7 5 3 1
Notice that each row contains a 1, the unit element, and that therefore each encoding key a possesses a unique decoding key a-1 as the inverse of a. Verifying the associative and the commutative properties we can see that these good keys form a commutative group with respect to multiplication. So far, everything looks promising that Z26* will form a field. Additionally, the keys would have to form a commutative group with respect to addition. So let’s make up the corresponding addition table and check it:
+ 1 3 5 7 9 11 15 17 19 21 23 251 2 4 6 8 10 12 16 18 20 22 24 03 4 6 8 10 12 14 18 20 22 24 0 25 6 8 10 12 14 16 20 22 24 0 2 47 8 10 12 14 16 18 22 24 0 2 4 69 10 12 14 16 18 20 24 0 2 4 6 811 12 14 16 18 20 22 0 2 4 6 8 1015 16 18 20 22 24 0 4 6 8 10 12 1417 18 20 22 24 0 2 6 8 10 12 14 1619 20 22 24 0 2 4 8 10 12 14 16 1821 22 24 0 2 4 6 10 12 14 16 18 2023 24 0 2 4 6 8 12 14 16 18 20 2225 0 2 4 6 8 10 14 16 18 20 22 24
The MOD 26 addition is commutative and associative since the regular integer addition is. However, the addition is not even closed as the calculated sums are not good keys themselves. In particular, the unit element 0 is not in Z26*. Of course, if only one of the group properties is not fulfilled then the good keys of Z26 can not form a group with respect to addition. And even though they do form a commutative group with respect to multiplication as we saw earlier, they can not form a field which would require both and would have been mathematical perfection. And even the second best to perfection, a ring, is not formed by the good keys of Z26 since the addition is not closed (property 2).
We can now enhance the criterion from the previous section of major Abstract Algebra concepts when performing MOD calculation.
Criterion for group, rings and fields when doing MOD-arithmetic:
46
ZM forms a ring, if M is not a prime number (i.e. Z4 , Z6, Z8, Z9,…) .ZP forms a field for a prime number P (i.e. Z2, Z3, Z5, Z7,…).ZM* (consisting only of the good keys in ZM) forms a commutative multiplicative group for any integer M, but not an additive group and therefore neither a ring nor a field.
2.8. Group Theory and Lagrange’s Theorem
In this last section, I will show you that Euler’s Theorem is a result of the more general Theorem of Lagrange which states: “The order of each good key a is a divisor of (M)”. Since Lagrange's Theorem is rooted in the theory of groups and subgroups, I will first introduce you to that theory.
Euler’s Theorem for an alphabet length of M=26 statesa(26) = a12 = 1 MOD 26 for all good keys a.
Why is it a result of Lagrange’s Theorem? To understand it we have to study the order of the good keys:
Exponents1 2 3 4 5 6 7 8 9 10 11 12
1 1 1 1 1 1 1 1 1 1 1 1 13 3 9 1 3 9 1 3 9 1 3 9 15 5 25 21 1 5 25 21 1 5 25 21 17 7 23 5 9 11 25 19 3 21 17 15 19 9 3 1 9 3 1 9 3 1 9 3 111 11 17 5 3 7 25 15 9 21 23 19 115 15 17 21 3 19 25 11 9 5 23 7 117 17 3 25 9 23 1 17 3 25 9 23 119 19 23 21 9 15 25 7 3 5 17 11 121 21 25 5 1 21 25 5 1 21 25 5 123 23 9 25 3 17 1 23 9 25 3 17 125 25 1 25 1 25 1 25 1 25 1 25 1
Table2.8A
The bold 1’s in each row display where jumps of length that equal the order of that key lead you to. Notice that it is necessary that the jump length s must be a divisor of the number of good keys, 12=(26) in order to fulfill Euler’s Theorem. I.e. consider the row for a=3: The arrows show you the jumps of length 3 lead us from 3 to 6 to 9 to 12. Surely, this only works since we started off at the right position: the exponent 0 (that is not displayed in the table, it would be an additional column left to the a=1 column.) yields a0=1 for any a. Otherwise, when starting off from a different position or jumping with a jump length that does not equal the order of a good key (i.e. 5 or 7), we would not arrive at the 1 for the exponent 12.
47
Good keys a
From the table, we can read off the order for each good key: Good key a
is of order
1 13 35 47 129 311 1215 1217 619 1221 423 625 2
When studying this table, it naturally poses some questions: 1. Is every divisor of the number of members in ZM*, here 12, an order of some good key? 2. Why is the occurrence of each order of a good key an even number except for 1 and 2? 3. Why do pairs of encoding and decoding keys (i.e. 17 and 23 or 3 and 9 or 7 and 15) have the same
order?
We will be able to answer the last two questions once we embed this table in a more general theory, the group theory. Looking at the powers of the good keys when M=27 and M=28 will help answering the first question:
For M=27, The good keys a are {1,2,4,5,7,8,10,11,13,14,16,17,19,20,22,23,25,26} and their powers with exponent 18=(27) all equal 1 – just what Euler taught us in his Theorem:
Exponents1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 12 2 4 8 16 5 10 20 13 26 25 23 19 11 22 17 7 14 14 4 16 10 13 25 19 22 7 1 4 16 10 13 25 19 22 7 15 5 25 17 4 20 19 14 16 26 22 2 10 23 7 8 13 11 17 7 22 19 25 13 10 16 4 1 7 22 19 25 13 10 16 4 18 8 10 26 19 17 1 8 10 26 19 17 1 8 10 26 19 17 110 10 19 1 10 19 1 10 19 1 10 19 1 10 19 1 10 19 111 11 13 8 7 23 10 2 22 26 16 14 19 20 4 17 25 5 113 13 7 10 22 16 19 4 25 1 13 7 10 22 16 19 4 25 114 14 7 17 22 11 19 23 25 26 13 20 10 5 16 8 4 2 116 16 13 19 7 4 10 25 22 1 16 13 19 7 4 10 25 22 117 17 19 26 10 8 1 17 19 26 10 8 1 17 19 26 10 8 119 19 10 1 19 10 1 19 10 1 19 10 1 19 10 1 19 10 120 20 22 8 25 14 10 11 4 26 7 5 19 2 13 17 16 23 122 22 25 10 4 7 19 13 16 1 22 25 10 4 7 19 13 16 123 23 16 17 13 2 19 5 7 26 4 11 10 14 25 8 22 20 125 25 4 19 16 22 10 7 13 1 25 4 19 16 22 10 7 13 1
48
Good keys a
26 26 1 26 1 26 1 26 1 26 1 26 1 26 1 26 1 26 1Table2.8B
Good key a
is of order
1 12 184 95 187 98 610 311 1813 915 1816 917 619 320 1822 923 1825 926 2
Notice that, again, the orders 1,2,3,6,9 and 18 are all divisors of 18.
For M=28, the good keys a are {1,3,5,9,11,13,15,17,19,23,25,27} and their powers with exponent 12=(28) are again in accordance with Euler’s Theorem:
Exponents1 2 3 4 5 6 7 8 9 10 11 12
1 1 1 1 1 1 1 1 1 1 1 1 13 3 9 27 25 19 1 3 9 27 25 19 15 5 25 13 9 17 1 5 25 13 9 17 19 9 25 1 9 25 1 9 25 1 9 25 111 11 9 15 25 23 1 11 9 15 25 23 113 13 1 13 1 13 1 13 1 13 1 13 115 15 1 15 1 15 1 15 1 15 1 15 117 17 9 13 25 5 1 17 9 13 25 5 119 19 25 27 9 3 1 19 25 27 9 3 123 23 25 15 9 11 1 23 25 15 9 11 125 25 9 1 25 9 1 25 9 1 25 9 127 27 1 27 1 27 1 27 1 27 1 27 1
Table2.8C
Let’s verify the orders of the good keys for M=28:Good key a
is of order
49
Good keys a
1 13 65 69 311 613 215 217 619 623 625 327 2
Notice that, again, the orders 1,2,3 and 6 are all divisors of 18. However, the answer to question 1 is a clear “No”: 12 as one divisor of the number of good keys, namely 12, does not occur here: There is no big jump of length 12 that brings us to a 1 in the rightmost column. That is what M=26 has and what M=28 does not have and it will make a big difference as you will see in the section on cyclic groups. Additionally, 4 does not occur as another divisors of 12.
2.8.1 SUBGROUPS are Subsets of Groups with Group Properties
For M=26, the powers of the good key a=3 are 3, 9 and 1, the powers of the good key a=5 are 5, 25, 21 and 1. Both sets of integers are examples of subgroups of the group Z26* = {1,3,5,7,9,11,15,17,19,21,23,25}. You can imagine the
Two conditions for a subgroup: 1) the numbers in the subgroup must be part of Z26* and2) they themselves fulfill the 4 group properties.
Let’s verify the 2 subgroup conditions for the subset S3={3,9,1}. 1) is true as 3,9,1 are in Z26*.Let’s check 2):
I. Closure: The multiplication in S3 is closed as all the possible products 3, 9 and 1 are again in S3. Verify this in the multiplication table of S3:
* 3 9 13 9 1 39 1 3 91 3 9 1
II. Associativity: Because the regular multiplication of integers is associative, the multiplication MOD 26 is associative.
50
III. Unit element: The unique unit element is 1 as you can see in the table.
IV. Inverse element: Each element in S3 possesses an inverse element that is in S3. To verify this, for each member of S3 in the left column find the unit element 1 in its row. Then go up that column to find its inverse in S3. In that way, you find that the inverse of 3 is 9 as 3*9 = 1 MOD 26. 9 is the inverse of 3 for the same reason. 1 is inverse to itself and we verified that S3 is a subgroup of Z26*.
Now it is your turn to show in a similar manner that S5 = {5,25,21,1} forms a subgroup of Z26*. Start right now by completing the multiplication table for S5 and then verify condition 1) and the four group properties in 2).
* 5 25 21 15 2525 1 521 11 1
2.8.2 Finite and Infinite (Sub)Groups There are 2 types of (sub)groups: finite and infinite ones. Example1: the set of all positive and negative integers is an infinite group with respect to addition as there is an infinite amount of such integers. All the even integers form an infinite subgroup of the above group as it contains infinitely many even numbers. Checking that they form a subgroup is quite easy, so let’s do it: 1) All even numbers are clearly in the set of all integers.
I) The addition of integers is closed as all possible sums of 2 even integers yields another integer.
II) I. e.: 2 + (4 + 8) = (2 + 4) + 8 or generally: a + (b + c) = (a + b) + c for all even integers show their associative property.
III) The unit element is 0 as addition by 0 does not change the sum (I.e. 2+0=2 or 0+8=8).
IV) The inverse of an even integer c, c-1, is the same integer of opposite sign, -c, so that their sum yields the unit element 0. I. e.: c=6, then c-1=-6, since 6 + (-6) =0
We will, however, deal exclusively with finite groups and subgroups as we are dealing with finite alphabet lengths and therefore with a finite amount of good keys. This requires new vocabulary:
51
Definition:The order of a (sub)group is the number of its members.
Example1: The order of Z26= {0,1,2,3,…,25} is 26, the order of Z26* = {1,3,5,..,25} is (26)=12.
Example2: The order of ZM= {0,1,2,3,…,M-1} is M, the order of ZM* is (M).
Example3: The order of the subgroup S3={3,9,1} is 3, the order of S5={5,25,21,1} is 4.
I want to acquaint you with 1 useful subgroup criterion. It can be used to decide in a quick manner whether a subset of a group G forms a subgroup of G or not. It is a very powerful one as it only checks for the finiteness and closeness of a subset and not for the unit or inverse elements.
1. Subgroup Theorem:If the subset S of the group G is finite and closed then S is a subgroup.
Example1: The finite subset S3={3,9,1} is closed under multiplication as we checked earlier which shows that it is a subgroup of Z26*. It is a subgroup of S23={23,9,25,3,17,1} which itself is a subgroup of Z26*.
Example2 is for you: Is the finite subset S23={23,9,25,3,17,1} closed and thus forms a subgroup? To verify this, fill in the multiplication table below:
* 23 9 25 3 17 123 39 125 173 2517 171 23
Counter example1: Say we add take out the 9 in S3 to get the subset T={1,3}. Although the products 1*3, 3*1 and 1*1 are all in T, 3*3=9 is not in T. Therefore, the 1. Subgroup theorem can not be applied. Of course, T is not a subgroup since it is not closed which is the 1. condition for groups.
Counter example2: Say we add the good key 5 to S3 to get the subset T={3,9,1,5}. The multiplication is not closed as i.e. 3*5=15 is not in T, therefore, the 1. Subgroup theorem can not be applied. In fact, T is not a subgroup since T is not closed, also 5 does not possess an inverse in T.
52
Counter example3: The set of all integers forms a group with respect to addition. The positive integers including 0 form a subset of all integers. The addition is closed and thus the second condition of the criterion is fulfilled, however, the first one is not. The subset is not finite as there is an infinite number of positive integers. In fact, the non-negative integers don’t form a subgroup as no positive integer possesses an inverse.
2.8.3. Cyclic (Sub)GroupsIt is easy to observe in Table2.8A that all the 12 subgroups of Z26* are cyclic, which loosely stated means, that the numbers start repeating after all members are reached. This can be best seen using the chain display of the powers in the following 3 examples. The order of the good key a then tells us the order of the subgroup generated by a. Observe this in the following three examples: a=3: 3 -> 9 -> 1 The order of a=3 is 3 which equals the order of S3,
and a=3 generates S3.
5 -> 25 -> 21 -> 1 The order of a=5 equals the order of S5,a=5: namely 4, and a=5 generates S5.
Although the subgroup S7 is not a proper subset of Z26* (since it equals Z26*) it is a subset of Z26*. Thus, S7, has an order of 12 and 7 is a generator of S7 (since it generates Z26*).
All 3 examples show that each subgroup is generated when the generator, which we now name the good key g, is raised to the power of 1, then 2, then 3, …until we obtain the unit element 1. In that moment, the entire subgroup is generated by that good key g. I.e. we can write a cyclic group with 12 members as
Gg = { g, g2, g3, g4, g5, g6, g7, g8, g9, g10, g11, g12=1}
This leads us now to the official Definition of cyclic (sub)groups: Cyclic (sub)groups are (sub)groups that can be generated by at least one member g.
Example1: The subgroups S3={3,9,1}, S5={5,25,21,1} and S7 (= Z26*) are cyclic since they can be generated by 3, 5 and 7 (or 11, 15, 19) respectively. Example2: {0,1,2,3,…,M-1} is a finite group with respect to addition and can be generated by 1.
53
Example3: The subgroup of all even integers can be generated by 2 or –2 and is thus an example for an infinite cyclic group. Counter example1: Verify in Table2.8C that the group Z28* = {1, 3, 5, 9, 11, 13, 15, 17, 19, 23, 25, 27} is not cyclic since none of the good keys generates Z28*. Certainly, subgroups of Z28* are generated by each of the good keys in Z28*, however, none of them generates the entire group Z28*.
When is a group ZM* cyclic? With other words: How can we choose our alphabet length M so that ZM* turns out to be a cyclic group? We investigate this by trying many, many different alphabet lengths. Let’s imagine we are one of the greatest Mathematicians trying to find some pattern in our list. My foregoing is the following: I underlined the generators in each group. If none are underlined, then the group is not cyclic and I then colored that group gray. I left some blanks for you as an exercise to fill in. Multiplicative Groups ZM* Factors of MZ2*={1} 2Z3*={1,2} 3Z4*={1,3} 4=2*2Z5*={1,2,3,4} 5Z6*={1,5} 6=2*3Z7*={1,2,3,4,5,6} 7Z8*={1,3,5,7} 8=2*2*2Z9*={1,2,4,5,7,8} 9=3*3Z10*={1,3,7,9} 10=2*5Z11*={1,2,3,4,5,6,7,8,9,10} 11Z12*={1,5,7,11} 12=2*2*3Z13*={1,2,3,4,5,6,7,8,9,10,11,12} 13Z14*={1,3,5,9,11,13} 14=2*7Z15*={1,2,4,7,8,11,13,14} 15=3*5Z16*={1,3,5,7,9,11,13,15} 16=2*2*2*2Z17*={1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16}
17
Z18*={1,5,7,11,13,17} 18=2*3*3Z19*={1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18}
19
Z20*={1,3,7,9,11,13,17,19} 20=2*2*5Z21*={1,2,4,5,8,10,11,13,16,17,19,20} 21=3*7Z22*={_____________________} 22=____Z23*={1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22}
23
Z24*={1,5,7,11,13,17,19,23} 24=______Z25*={1,2,3,4,6,7,8,9,11,12,13,14,16,1 25=5*5
54
7,18,19,21,22,23,24}Z26*={___________________________}
26=2*13
Z27*={1,2,4,5,7,8,10,11,13,14,16,17,19,20,22,23,25,26}
27=______
Z28*={1,3,5,9,11,13,15,17,19,23,25,27}
28=2*2*7
Z29*={1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28}
29
Z30*={____________________} 30=2*3*5Z31*={1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30}
31
Z32*={1,3,5,7,9,11,13,15,17,19,21,23,25,27,29,31}
32=______
Z33*={1,2,4,5,7,8,10,13,14,16,17,19,20,23,25,26,28,29,31,32}
33=3*11
Question for you: Which ZM* are not cyclic? Well, that was the easy part: all the gray M ones have no generator and are therefore not cyclic. What don’t these M have that the other M’s have? It must have something to do with the factors of M which is the reason why I created the 2nd column. But what exactly? Before you continue reading try to come up with a good guess.
What do you observe? I observed, that all multiples of 4 except for 4 itself yield non-cyclic group. Thus, all the M that contain an factor 2*2 yield non-cyclic groups. Also, M=21=3*7 and M=3*11 suggest that products of two primes yield non-cyclic groups. Attention: 2*7, 2*11, 2*13 are also products of 2 primes, so I better say that the product of two odd primes yields a non-cyclic group. What about the non-cyclic 30=2*3*5? It also contains a product of two odd primes. So, I better say that If M contains a product of two odd primes or is a multiple of 4 then Z M* is non-cyclic.
And vice versa, which M yield cyclic groups ZM*? How can we express them? Even though expressing the non-cyclic ZM* is easy we still want to express the cyclic ones. So, let’s do it: If M is prime ZM* is cyclic. Also, all the products of the same prime yield a cyclic ZM* such as M=5*5 or M=3*3 and even for M=3*3*3. They are called prime powers. Also, multiplying the prime powers by 2 is allowed such as M=2*3*3. Remember that products of two different odd primes such as M=3*5 or M=3*7 is not allowed. Let’s not forget that M=2 and M=4 yield cyclic groups. That is it, no other products are allowed. It is time to formulate our conjecture:
55
If M equals 2 or 4 or pn or 2*pn for some odd prime, then ZM* is cyclic. In fact, that is it. Surely, to be on the safe side we should continue our list and check for further non-cyclic groups. It wrote a little C++ program that simply checks if ZM* contains a generator or not. I will show it to you now. Remember that this theorem can not just be based on checking and guessing. What if we oversaw a certain case that did not show up in our examples (i.e. If M is a multiple of 1347, ZM* is non-cyclic)?
Time for a few words on mathematical proofs: In Mathematics, we are aiming for guaranteed true results that can never be disproved. Thus, theorems have to be air tight. And we make them air tight by proving them i.e. the way we proved Euler’s Theorem for any alphabet length M. Self-created proofs may make sense to us, but they are only accepted if nobody in the whole Mathematics society can find a mistake or a counterexample. For example, the 300-page-proof of Fermat’s Last Theorem by Andrew Wiles was inspected by about 10 Mathematicians that spent more than half a year to understand Wiles’ reasoning. At the end, nobody could prove him wrong, thus, the proof was accepted or true. This conclusion I leave up to you.
Here is the C++ program that checks if ZM* possesses a generator and is therefore cyclic:#include <iostream.h>#include <conio.h>#include <math.h>
int gcd(int A, int B){ int R; do { R=A%B; A=B; B=R; } while(R!=0); return A;}
void main(){ int M,i,p1,p2,counter,phi=1; long int K; clrscr(); cout << "Enter number M = "; cin >> M; cout << "Relative prime are: 1 "; for(i=2;i<M;i++) {
if (gcd(i,M)==1) { cout << i << " "; phi++; } else if (M%i==0)
56
{ p1=i; if (M%(p1*p1)!=0) p2=M/i; }
} cout << endl; cout << "phi(" << M << ")=" << phi << endl; if (phi==M-1) cout << M << " is prime"<< endl; if (phi==(p1-1)*(p2-1)) cout << M << " = "<< p1 << " * " << p2 << endl; cout << endl; for (i=2;i<M;i++)
{if (gcd(i,M)==1) { K=(i*i)%M; counter=2; while (K!=1)
{K=(K*i)%M;counter++;}
}if (counter==phi) cout << i << " is a generator" << endl;counter=1;}
getch();}
Programmer’s Remarks:How can we find generators? Recall that a generator is a good key whose order equals the group order (M). That means, in particular, that the powers of the good key yield 1 for the exponent (M) and not 1 for any smaller exponent.
Let me now explain to you how I find the generators. The above program is identical to the program used earlier to find the good keys and their number, I just added the bottom part starting at the second for-loop. I first check if the key i is a good keys in if (gcd(i,M)==1). If so, I start raising i to the second power MOD M and set the counter equal to the current exponent 2 in K=(i*i)%M;
counter=2; If the power equals already 1 we fail the while-loop check in while (K!=1) and i can not be a generator if (M)> 2. i is, however, a generator if (M)=2. Since i=1 can never be a generator (except in the subgroup S={1}), I started the for-loop at i=2 in for (i=2;i<M;i++).
57
If, however, the power is different from 1, I just keep raising to higher powers MOD M in while (K!=1)
{K=(K*i)%M;counter++;}
until reaching the first 1. The counter that was increased by 1 each time I entered the loop then tells me the correct exponent of that power. Finally, I just need to check if that exponent equals (M) in if (counter==phi). If so, I found a generator of ZM*, I output it and check the next key. I stop checking when i=M-1.
Three easy yet important facts of cyclic groups:
1)The order of a generator g equals the order of the subgroup that is generated by g. As you can observe in our examples: a generator g generates all the members in a subgroup. The order of a generator is that exponent, s, which makes the power of g equal to 1 for the first time. These generated s elements now form a subgroup whose order therefore is s.
2) Each subgroup S of a cyclic group G must itself be cyclic.To see this consider all the elements of S. They can all be expressed as powers of g. Let k be the least positive power of g that is in S. If not every element is a power of gk then there is some element gm where m is positive and not a multiple of k. Let p be the greatest multiple of k that is less than m. Then m - p is less than k. But this means that gm • g-p = gm-p is in S. This contradicts the choice of k as the smallest positive power of g in the subgroup. Thus all elements of S are generated by gk and S is cyclic.
Example1: Z26*={1, 3, 5, 7, 9, 11, 15, 17, 19, 21, 23, 25} has i.e. the cyclic subgroups S3={3,9,1}, S5={5,25,21,1}.
3) A group G of prime order must be cyclic.This is a result of Lagrange’s Theorem: If G is a group of prime order p then take any non-identity element g and look at the subgroup generated by it. The order of the subgroup must be a divisor of the order of G (Lagrange's Theorem) but since G is of prime p order the only divisors of p are 1 and p itself. Since g isn't the identity the subgroup it generates must have more than one element. Therefore, its order must be p and it must be G itself, thus, G is cyclic. Furthermore since the choice of g was only limited by not being the identity it follows that G can be generated by any of its elements other than the identity element.
58
Examples for multiplicative groups ZM* of prime order are very limited since Euler’s –function teaches us that the orders of ZM* are all even integers except when M=2. 2 is the only even prime number so that only Z4* = {1,3} and Z6* = {1,5} turn out to be the only examples to consider. 3 and 5 are generators in their respective groups which suffices to show that they both are cyclic. We find, however, plenty of examples among the additive groups ZM. If only M is prime p, Zp consists of the p members 0,1,2,…p-1 and is therefore of prime order. Let’s take a look at Z7.
Example1: Z7 has the 7 members 0,1,2,3,4,5 and 6. You can observe the cyclic nature of Z7 as each previous row or column is cycled one shift to the right or down.
+ 0 1 2 3 4 5 60 0 1 2 3 4 5 61 1 2 3 4 5 6 02 2 3 4 5 6 0 13 3 4 5 6 0 1 24 4 5 6 0 1 2 35 5 6 0 1 2 3 46 6 0 1 2 3 4 5
Although Z7* ={1,2,3,4,5,6} is not of prime order. You are right, it is therefore not an example for the third fact of cyclic groups. However, even though the prime condition is not fulfilled it is yet cyclic which you can not see right away in the following multiplication table:
* 1 2 3 4 5 61 1 2 3 4 5 62 2 4 6 1 3 53 3 6 2 5 1 44 4 1 5 2 6 35 5 3 1 6 4 26 6 5 4 3 2 1
The trick is here that we can make the cyclic nature of Z7* visible by rearranging the table as follows:
* 1 5 4 6 2 31 1 5 4 6 2 35 5 4 6 2 3 54 4 6 2 3 1 56 6 2 3 1 5 42 2 3 1 5 4 63 3 1 5 4 6 2
Now we can see: neighboring rows and columns are again cycled forward one space.
2.8.4 How to determine the Order of Cyclic Subgroups Per definition, cyclic groups and their subgroups can be generated by at least one of their members. Vice versa, every group member generates some subgroup. Its order is a
59
divisor of the group order. I want to show you a very easy way to compute the order of a subgroup that was generated by one of its generators g.
Let’s consider the familiar multiplicative group Z26*={1,3,5,7,9,11,15,17,19,21,23,25}. Since it is cyclic it can be generated by at least one member. We learned already that 7, 11, 15 and 19 are generators of Z26*. So let’s pick g=7 to generate S7=Z26*: 7 -> 23 -> 5 -> 9 ->11 -> 25 -> 19 ->3 -> 21 -> 17 -> 15 -> 1
We can rewrite this as: S7 = {7, 23, 5, 9, 11, 25, 19, 3, 21, 17, 15, 1}
= {7, 72, 73, 74, 75, 76, 77, 78, 79, 710, 711, 712=1}
= {g, g2, g3, g4, g5, g6, g7, g8, g9, g10, g11, g12=1}
I.e. 23 equals 72, 5 equals 73 MOD 26. Therefore, we may write 23=g2 and 5=g3 when using the generator g=7. The purpose of writing each good key as a power of the generator g=7 is to determine the order of the subgroup generated by that good key. I.e.: Since 23=g2, the order of 23 and therefore the order of the subgroup generated by 23 must be 6 as 236 = (g2)6 = g12 = 1. And the 6 subgroup members as powers of 23=g2 are S23 = {g2, g4, g6, g8, g10, g12=1} = {23, 9, 25, 3, 17, 1}. Notice that the exponent of the generator 23=g2, namely 2, gives the jump length and the number of jumps that guides us to the desired exponent 12 equals the order of the subgroup S23, namely 6.
The order of the subgroup generated by 5=g3 is 4 since 54 = (g3)4 = g12 = 1. The 4 subgroup members are S5 = {g3, g6, g9, g12=1} = {5, 25, 21, 1} – obtained by 4 jumps each of length 3.
It is your turn now, fill in the blanks: The order of the subgroup generated by 9 is __ since (g4)_ = g12 = 1. The __ subgroup members are: S9 = {g4, , g12=1} = {9, ,1} – obtained by __ jumps each of length __.
The order of the subgroup generated by 25=g6 is 2 since 252 = (g6)2 = g12 = 1. We learned this already: Since 25 = -1 MOD 26 we have 25 = (-1)2 = 1 MOD 26. The members of the subgroup generated by 25 are:S25 = {g6, g12=1} = {25,1} – obtained by 2 jumps each of length 6. Notice that S25 is itself a subgroup of the subgroup S5 = {5, 25, 21, 1}as 25 and 1 are in S5
and themselves fulfill the four group properties.
Subgroup of subgroup of groups, does that ever end? Is there a smallest subgroup of the group Z26*? Of course, S1 ={1} is the smallest subgroup of Z26* since each subgroup must contain the unit element 1. Now, the inverse of 1 is 1 itself since 1*1=1 MOD 26. Furthermore, 1 generates the subgroup S1 ={1} of order 1. Our above method to determine the order of any subgroup must also work here: Since 1=g12 the order of 1
60
must be 1 since (g12)1 = g12 = 1. Finally, there is nothing special about M=26. S1 = {1} is the smallest subgroup for any alphabet length M. Our above method to determine the order of a good key in Z26* worked well because the exponents of the powers of the generator g that I chose i.e. 1,2,3,4,6 and 12 are divisors of 12. It was easy to find their multiples in order to arrive at exponent 12. How do we find the orders of those exponents that are not divisors of 12 such as 5, 7, 8, 9, 10 and 11? With other words: What are the orders of the subgroups generated by g5, g7, g8, g9, g10
and g11?
Let’s find the order of 11=g5 first? Recall that the definition of the order of a group member is that exponent which yields 1 for the first time. If we now add more columns to the tableX we will find 1’s in columns 12, 24, 36, 48, 60, 72, 84, … since g12 = 1, g24 = (g12)2 = 12 = 1 MOD 26 and similarly g36 = g48 = g60 = g72 = g84 = … = 1. Starting off in column 5 with jumps of length 5, we hit the first 1 in column 60 since no other column is a multiple of 5 and 12 at the same time. Therefore, 11=g5 is of order 12 and a generator of S11 = Z26*:
S11 = {11, 112, 113,114,115,116,117,118,119,1110,1111,1112=1}
= {g5, (g5)2, (g5)3, (g5)4, (g5)5, (g5)6, (g5)7, (g5)8, (g5)9, (g5)10, (g5)11, (g5)12=1}
= {g5, g10, g15, g20, g25, g30, g35, g40, g45, g50, g55, g60=1}
= {11, 17 , 5 , 3 , 7 , 25, 15, 9 , 21 , 23, 19 , 1}
– obtained by 12 jumps each of length 5.
The order of the subgroup generated by 19=g7 is 12 since 7 and 12 are relative prime and therefore: (g7)12 = g84 = 1 MOD 26. Again, that does not surprise us since we learned already that 19 = g7 is a generator of Z26*:S19 = {19, 192, 193,194,195,196,197,198,199,1910,1911,1912=1}
= {g7, (g7)2, (g7)3, (g7)4, (g7)5, (g7)6, (g7)7, (g7)8, (g7)9, (g7)10, (g7)11, (g7)12=1}
= {g7, g14, g21, g28, g35, g42, g49, g56, g63, g70, g77, g84=1}
= {19, 23, 21 , 9 , 15 , 25, 7, 3 , 5 , 17, 11 , 1}
– obtained by 12 jumps each of length 7.
Now it is your turn again. The order of the subgroup generated by 15=g __ is __ and 15 thus generates Z26*. Explain why only the powers with exponents 1,5,7,11 turn out to have an order of 12 and are therefore the only generators of Z26*. Answer: Because 12 is relative
prime to 1,5,7,11 and therefore jumps of length 1,5,7 or 11 will yield the first 1 for an exponent that is the least common multiple.
61
Complete the following:S15 = {15, 152, 153,154,155,156,157,158,159,1510,1511,1512=1}
= {g11 ……………………………………………., (g11) __ =1}
= {g11,………………………………………………., g132=1}
= {15, ……………………………………………………….}
The crux is now that the order 12 for g1, g5, g7, g11 is not only true when choosing the generator g=7. It is true for any chosen generator of Z26* such as g=7,11,15 or 19. It is thus independent of the choice of the generator g. I.e. g=11 generates Z26* in just the same way: S11 = {g, g2, g3, g4, g5, g6, g7, g8, g9, g10, g11, g12=1}
= {11, 112, 113,114,115,116,117,118,119,1110,1111,1112=1}
= {11, 17, 5, 3, 7, 25, 15, 9, 21, 23, 19, 1}
Notice here that the members of order 12 are again those whose powers have exponents that are relative prime to 12: g1=11, g5=7, g7=15 and g11=19.
It is your turn again: generate all members of Z26* by raising the generator g=15 to the powers of 1, 2, …, 12 and verify that those with an exponent 1,5,7 and 11 are the ones that have an order 12.
S15 = { g, g2, g3, g4, g5, g6, g7, g8, g9, g10, g11, g12=1}
= {15, 152, 153,154,155,156,157,158,159,1510,1511,1512=1}
= {15, 17,… , 1}
Notice, for any of the four generators we obtain the following good keys as powers of g:g2 and g10 always yield 23 and 17 which are of order 6, g3 and g9 always yield 5 and 12 which are of order 4, g4 and g8 always yield 9 and 3 which are of order 3, g6 = 25 which is of order 2, and of course g12 = 1 which is of order 1.
We are left now with the easy task to determine the orders of the subgroups generated by 3= g8, 21= g9 and 17= g10 using the same generator g=7.
62
For 3= g8: The subgroup generated by 3=g8 is S3 = {3,9,1}= {g8, g16, g24=1} (obtained by 3 jumps each of length 8) and thus has an order of 3.
For 21= g9: The subgroup generated by 21=g9 is S21 = {21,25,5,1}= {g9, g18, g27, g36=1} (obtained by 4 jumps each of length 9) and has thus an order of 4. For 17= g10: The subgroup generated by 17=g10 is S17 = {17, 3, 25, 9, 23, 1} = {g10, g20, g30, g40, g50, g60=1} (obtained by 6 jumps each of length 10) and has thus an order of 6.
Let’s summarize our discoveries in Z26*:
Powers of generators g of Z26*
yield the good keys in Z26*
of order s
g1 , g5 , g7 , g11 7, 11, 15, 19 12g2 , g10 17, 23 6g3 , g9 5,21 4g4, g8 3,9 3
g6 25 2g12 1 1
This table is very important since it contains and displays many significant facts:
1. Fact: This table shows that the orders s are all divisors of the cyclic group of order (26)=12.
2. Fact: This table contains the fact that the choice of the actual generator g of Z26* is irrelevant for the order of a good key (expressed as a power of g) in Z26. After finding a generator g we can tell the order of each good key expressed as a power of g, gk, simply by looking at the exponent k.
3. Fact: The table gives pairs of encoding and decoding keys: Recall that an encoding key is inverse to its decoding keys which simply means that their product equals 1. If the members in Z26* are now listed as powers of the generator, then 2 members are inverse and thus form a pair of encoding and decoding keys if their exponents add up to 12. I.e.: using g=7 as generator of Z26* yields g3 = 5 and g9 = 21 as a pair since g3
* g9 = g12 = 1 MOD 26. Also, g4 = 9 and g8 = 3 forms a pair since g4 * g8 = g12 = 1 MOD 26. The only keys that are inverse to themselves are g12=1 and g6 = 25.
4. Fact: The table shows that pairs of encoding and decoding keys have the same order. I.e.: Using g=11 as a generator of Z26* tells us that g4 = 3 and g8=9 are both of order 3 which we learned already since both generate the same subgroup S = {3,9,1}. Also, g2 = 17 and g10 = 23 are both of order 6 as they both generate the subgroup S = {17, 3, 25, 9, 23, 1}.
63
Notice that all the observations are only valid for cyclic groups, those who can be generated by one member. That particular member g is needed to list such groups as G = {g, g2, g3, … , gn=1}.
I want to end this section with an highlight for cyclic groups that I find shows a lot of the elegance of Mathematics. Let’s find a formula to determine the order of a good key in Z26* - expressed again as a power of a generator g of Z26* - solely by inspecting its exponent? I.e. How can writing 23 as g10 for some generator g help us to find its order 6? Here is how.
We observed that those powers with exponents that are relative prime to 12 such as 1,5,7 and 11 yield order 12. This tells us that the order depends somehow on the greatest common divisor of the exponents and 12. Therefore, let’s find all 12 greatest common divisors by firstly writing out the 12 exponents, by secondly dividing 12 by each possible exponent (that are those between 1 and 12) and by thirdly simplifying the fractions to find their greatest common divisors:
Exponents:12 12 12 12 12 12 12 12 12 12 12 12
12/1 12/2 12/3 12/4 12/5 12/6 12/7 12/8 12/9 12/10 12/11 12/12
12/1 6/1 4/1 3/1 12/5 2/1 12/7 3/2 4/3 6/5 12/11 1/1
The third row is instrumental to us: The four underlined fractions with exponents that are relative prime to 12, i.e. 1,5,7,11, can not be simplified further and the numerator 12 gives their orders. Simplifying the red fractions for the exponents 2 and 10 yield a numerator of 6 which tells us their order. What is the order of the exponents 4 and 8? What does the third row tell you? Reading the table reveals 3 in green. Isn’t that an elegant way of determining the order of a subgroup? With ease we can now come up with a formula for the order of a subgroup generated by gk solely based on the exponent k:
1. Formula to compute the order of each good key gk in Z26*: s = order of the good key gk = 12 / gcd(k,12)
Example1: the order of g8 equals 12 / gcd(8,12) = 12/4 = 3.Example2: the order of g7 equals 12 / gcd(7,12) = 12/1 = 12.Verify this formula for all the other exponents and then continue reading.
Again there is nothing special about M=26. More general, for a given alphabet length M we have (M) many good keys in ZM*. In case they form a cyclic group and thus at least one good key is a generator of ZM* so that each good key can be expressed as a power of g, gk, the order of each good key a= gk can be computed as follows:
64
2. Formula to compute the order of each good key gk in the cyclic group ZM*
s = order of the good key gk = (M) / gcd(k, (M))
Counter example1: For M=28 we have the good keys 1, 3, 5, 9, 11, 13, 15, 17, 19, 23, 25, 27. Since Z28* does not possess a generator g we can not express any good key as gk. Therefore, we can not apply the formula.
2.8.5 How to determine the Number of Good Keys of given Order in a Cyclic Group
Believe it or not, this is not the climax yet. From our simplified fractions in the third row, we can even tell how many good keys in Z26* possess an order of 12, 6, 4, 3, 2 or 1. I.e. we have 4 good keys that have an order of 12 since there are 4 fractions that have a non-simplified numerator 12. That means that there are four integers less than 12 that are relative prime to 12, namely the four underlined denominators 1,5,7 and 11. Thus, Euler’s -function with (12)= ((26))=4 gives the number of good keys with order 12 and we can set up the…
Formula to determine the number of good keys in a cyclic group that are of order s: (s) = the number of integers relative prime to the divisor s of n=(M), gives the number of good keys a that are of order s.
More examples for Z26*: There are two fractions with a simplified numerator 6, 6/1 and 6/5, telling us that there are 2 integers less than 6 that are relative prime to 6, namely the two denominators 1 and 5. Moreover, (6)=2 tells us that there are two good keys of order 6. Similarly, we find that there are (4)=2 of order 4, (3)=2 of order 3, (2)=1 of order 2, and (1)=1 of order 1. Altogether, we have
(1) + (2) + (3) + (4) + (6) + (12)= 1 + 1 + 2 + 2 + 2 + 4 = 12.
And we have just discovered Euler’s identity which holds true for cyclic groups of order n:
65
∑(s) = n denoting the sum of (s) for all divisors s of n.
(s) tells us the correct number of good keys of order s, however, it does not tell us which good keys those are. However, the 2nd row does. I.e. the good keys of order 6 are g2 and g10 again for any generator g which we find by going up from 6/1 and 6/5 to the second row yielding the 2 and the 10 as the denominators of 12/2 and 12/10.
This might look interesting and confusing at the same time to you. Nothing helps better than doing it yourself and rediscovering the steps that I just showed you. So, here are your three assignments:1) Say we choose an alphabet length of M=27 by adding the character “.” to our alphabet length M=26.
Recall the good keys MOD 27. Z27*={1,……….,26}2) Recall the order of each good key a by creating the chain display. Verify the orders in 2) by firstly
picking a generator g of Z27*. Secondly list the members in Z27* as powers of that generator g so that Z27*= {g, g2, g3,…., 1}. Thirdly, calculate the orders of the good keys in Z27 expressed as powers of g using the above 2. Formula to compute the order of each good key in ZM*:
3) Finally, for each divisor d of 18=(27) find out how many good keys possess an order that equals the divisor d by using Euler’s -function. By adding them all up, I want you to verify Euler’s Identity.
Conclusions:
1. The orders of the good keys occur (s) times for any divisor s of (M), the order of the cyclic group, where M is the used alphabet length.
2. Each divisor s must occur at least once in cyclic groups since (s) is greater or equal to 1.
3. We know three particular orders:
a) The number of generators (which equals the number of good keys of order 12) in ZM* is ((M)).
b) Good keys of order 1 occur exactly once since (1)=1. That is the order of the key a=1 which is a good key in ZM* for any M.
c) The order 2 occurs once aswell since (2)=1. That is the order of the key a=M-1 since M - 1 = -1 MOD M and therefore (M-1)2 = (-1) 2 =1 MOD M.. The orders of 1 and 2 are the only one occurring only once since (d) is greater than 1 for divisors d that are greater than 2. (I.e. (3)=2, (4)=2, (5)=4, (6)=2, (7)=6,…) . In fact, (d) is always an even number, the only exceptions are s=1 and s=2. Therefore, all other orders must occur as even numbers.
The ultimate question still remains: why did we only have jump lengths that are divisors of the order of G. I want to show you why i.e. only jump length that are divisors of 12 occur in Z26*. Therefore, we have to understand Lagrange’s Theorem. Its conversion will then finally show us that there must be at least one jump length for any divisor of the order of the cyclic group G.
66
2.8.6 Lagrange’s Theorem and its ConverseWe are now in a position to state and prove the famous Theorem of Lagrange in its general form:
If G is a finite group and S a subgroup of G, then the order of S is a divisor of the order of G.
Example1: Recall: Z26* is of order 12=(26) and the subgroups S1, S3, S5, S7, S9, S11, S15, S17, S19, S21, S23, S25 are of order 1, 3, 4, 12, 3, 12, 12, 6, 12, 4, 6, 2 which are all divisors of 12.
Example2: Z27* is of order 18=(27) and the subgroups have order 1, 2, 3, 6, 9 and 12 which are all divisors of 18. Example3: Z28* is of order 12=(28) and the subgroups have order 1, 2, 3, 6 which are again all divisors of 12.
I want to show you now why Lagrange’s Theorem must hold true for finite, cyclic groups (as in Z26* and Z27*). Although it holds also true for non-cyclic finite groups (i.e. for Z28*), proving this requires a deeper understanding of group theory which is beyond the scope of our course. Therefore, I will show you the easier proof for finite and cyclic groups.
Proof of Lagrange’s Theorem:Let G be a cyclic group of order n. Because G is cyclic the elements in G can be generated by the generator g and listed as: G = {g, g, g, g, …, gn =1}. In our example we used 7 as a generator to generate G = Z26* = {7, 72=23, 73=5, 74=9, …, 712=1}. However, we could have also used 11, 15 or 19 as possible generators. As you can see, a generator is not necessarily unique, but we are guaranteed at least one in a cyclic group which is
sufficient for the proof. Since each subgroup of G must also be cyclic, each possesses a generator. Say it is the kth element in G. We, therefore, define h = gk, with 1 < k < n, to be the generator for any proper subgroup S of G. (A non-proper subgroup is one that equals G and g would serve as such generator.) Then h generates S such that: S = {h , h2, h3, …., hs = 1}
= {gk, (gk)2, (gk)3, ….,(gk)s = 1} = {gk, g2k, g3k, …., gsk = 1}.
In example, S5 can be generated by h = 5 = 73 so that S5 = {73, (73)2, (73)3, (73)4 = 712 = 1} = {73, 76, 79, 712 = 1} = {5, 25, 21, 1}
The generator h generates all the elements in the subgroup S and terminates generating when it reaches the unit element 1. This happens after computing s elements, so that there are s elements in the subgroup S. Or simply: the order of S is s.
67
Because gn = 1 and gsk = 1, it follows that gn = gsk for some integer k. Therefore, n=sk which shows that s is a divisor of n for any subgroup order s and the proof is complete.
Moreover, the Converse of Lagrange’s Theorem holds true for cyclic groups aswell: For any s that divides the order of a cyclic group we can find a cyclic subgroup S that has the order s. Proof: Let G = {g, g, g, g, …, gn =1} and s be a divisor of the group order n such that n=k*s. Then G = {g, g, g, g, …, gks =1} and I choose the generator h=gk to generate the subgroup S = {gk , (gk)2, (gk)3, …., (gk)s = 1} which is of order s and the proof is complete.
Example1: Z26* is of order 12=(26) and 12 has the divisors 1, 2, 3, 4, 6 and 12. For each of these divisors we can now find a subgroups of such order. I.e. S1 is of order 1, S25
is of order 2, S3 is of order 3, S5 is of order 4, S17 is of order 6 and S7 is of order 12. The Converse Theorem does not tell us how many subgroups there are for each divisor s. We will learn this in the next Theorem.
Example2: Z27* is of order 18=(27) and 18 has the divisors 1, 2, 3, 6, 9 and 12. For each of these divisors we can now find a subgroups of such order. I.e. S1 is of order 1, S26
is of order 2, S10 is of order 3, S8 is of order 6, S7 is of order 9 and S2 is of order 18.
Counter example1: Z28* is not cyclic and the Converse Theorem can not be applied. In fact, there are no subgroups of order 4 and 12 as divisors of the group order 12=(28).
I want to conclude this chapter with a pleasing fact: Say our cyclic group ZM* consists of (M) members. Hence, the number of members in each subgroup must be a proper divisor of (M) (Grace a Monsieur Lagrange). Now, if we want to find two or more subgroups of the same order, we will never succeed. There are none! At least not for cyclic groups ZM*, others may. Theorem:If n is the order of a cyclic group, then there exists exactly one subgroup of order s for each distinct divisor s of n.
Proof: While proving the theorem in the left column, I will simultaneously show you a concrete example (for the cyclic group Z26*) in the right column since the abstract proof might confuse you a bit.
Let G be a cyclic group of order n and g be a generator of G.
Z26* is a cyclic group of order 12 and g=7 is a generator of Z26*.
Let S be a subgroup of S of order s. We know from Lagrange’s Theorem that s
S ={1,3,9,17,23,25} is a subgroup of Z26* of order 6 with 6*2 = 12 = order of Z26*
68
must a divisor of n, say s*f=n. ( so that s=6, f=2 and n=12). S can be generated by one of the members in G, say gk, which is of order s.
S can be generated by one of its members, 17=710, which is of order 6 (so that k=10)
In turn this means that s*k equals some multiple of n: s*k=t*n
In turn this means that 6*10 equals some multiple of 12: 6*10=5*12 (so that t=5).
Since s*f=n, we have s*k = t*n = t*(s*F). Dividing both ends by s yields: k = t*F showing us that t is a divisor of k.
Since 6*2=12, we have 6*10 = 5*12 = 5*(6*2). Dividing both ends by 6 yields: 10=5*2 showing us that 5 is a divisor of 10.
Therefore, gk is in the subgroup generated by gF which is of order s (since s*f=n).
Therefore, 710(=17) is in the subgroup generated by 72(=23) which is of order 6 (since 6*2=12).
However, gk generates the subgroup S of order s with which we started off.
However, 710 generates the subgroup S of order 6 with which we started off.
Thus, s elements of the subgroup generated by gk are in the subgroup generated by gF which has also s elements.
Thus, 6 elements of the subgroup generated by 710 are in the subgroup generated by 72 which has also 6 elements.
Therefore, both subgroups must be identical.
Therefore, both subgroups must be identical.
The crux of the proof is that for any subgroup S of order s we can find another subgroup of the same order (since the Euler function solely yields even integers except for the divisors 1 and 2 whose subgroup orders occur only once) and then show that they are identical. Notice that it was essential in the proof that the group G had to be cyclic (i.e. it has to possess a generator).
Example1: Z26* is of order 12 which has the divisors 1,2,3,4,6 and 12. Thus: The subgroup of order 1 is S1 = {1}. The subgroup of order 2 is S25 = {1,25}. The subgroup of order 3 is S3 = S9 = {1,3,9}. The subgroup of order 4 is S5 = S21 = {1,5,21,25}. The subgroup of order 6 is S17 = S23 = {1,3,9,17,23,25}. The subgroup of order 12 is S7 = S11 = S15 = S19 = {1,3,5,7,9,11,15,17,19,21,23,25}.
Example2: Z27* is of order 18 which has the divisors 1,2,3,6,9 and 18. Thus: The subgroup of order 1 is S1 = {1}. The subgroup of order 2 is S26 = {1,26}. The subgroup of order 3 is S10 = S19 = {1,10,19}. The subgroup of order 6 is S8 = S17 = {1,8,10,17,19,26}. The subgroup of order 9 is S4 = S7 = S13 = S16 = S22 = S25 = {1,4,7,10,13,16,19,22,25}. The subgroup of order 18 is S2 = S5 = S11 = S15 = S20 = S23 =
{1,2,4,5,7,8,10,11,13,14,16,17,19,20,22,23,25,26}.
Counter example1: The non-cyclic group Z28* is of order 12 which has the divisors 1,2,3,4,6 and 12. There is 1 subgroup of order 1: S1 = {1}.
69
There are 3 subgroups of order 2: S13 = {1,13}, S15 = {1,15} and S27 = {1,27}. There are 3 subgroups of order 2: S13 = {1,13}, S15 = {1,15} and S27 = {1,27}.There are 2 subgroups of order 3: S9 = S25 = {1,9,25}.There are 6 subgroups of order 6: S3 = S19 ={1,3,9,19,25,27}, S5 = S17 = {1,5,13,17,25,27}, S11 = S23 = {1,9,11,15,23,25}. Since Z28* is not cyclic the Theorem can not be applied. In fact, Z28* has no subgroups of order 4 or 12.
Recall from 2.8.5. that (s) - for any divisor s of the order of a cyclic group G - tells us the number of good keys that are of order s. Now we learn that subgroups generated by keys of the same order must be identical.
70
