CSE 311 Lecture 14:
Euclidean Algorithm and Modular Equations

Topics

Primes and GCD

A quick review of Lecture 13.

Euclidean algorithm

Computing GCDs with the Euclidean algorithm.

Extended Euclidean algorithm

Bézout’s theorem and the extended Euclidean algorithm.

Modular equations

Solving modular equations with the extended Euclidean algorithm.

Modular exponentiation

A fast algorithm for computing $a^k\ \text{mod}\ m$.

Primes and composites: definitions and theorems

Greatest common divisor (GCD): definition

Greatest common divisor (GCD)

The greatest common divisor of integers $a$ and $b$, written as $\gcd{a}{b}$, is the largest integer $d$ such that $d\vert a$ and $d\vert b$.

We can compute GCDs efficiently using the Euclidean algorithm. Invented in 300 BC!

Euclidean algorithm is based on two useful facts

$\gcd{a}{0}$

If $a$ is a positive integer, then $\gcd{a}{0} = a$.

Proof follows straightforwardly from the definition of GCD and divisibility.

GCD and modulo

If $a$ and $b$ are positive integers, then $\gcd{a}{b} = \gcd{b}{\mod{a}{b}}$.

Euclidean algorithm

Apply $\gcd{a}{b} = \gcd{b}{\mod{a}{b}}$ until you get $\gcd{a}{0} = a$.

// Assumes a >= b >= 0.
public static int gcd(int a, int b) {
  if (b == 0)
    return a;             // GCD(a, 0) = a
  else  
    return gcd(b, a % b); // GCD(a, b) = GCD(b, a mod b)
}

Bézout’s theorem about GCDs

Bézout’s theorem

If $a$ and $b$ are positive integers, then there exist integers $s$ and $t$ such that $\gcd{a}{b} = sa + tb$.

We can extend Euclidean algorithm to find $s$ and $t$ in addition to computing $\gcd{a}{b}$.

Extended Euclidean algorithm

Extended Euclidean algorithm

Extended Euclidean algorithm

Multiplicative inverse $\mod{}{m}$

Suppose $\gcd{a}{m} = 1$.

By Bézout’s theorem, there exist integers $s$ and $t$ such that $sa + tm = 1$.

$\mod{s}{m}$ is the multiplicative inverse of $a$ modulo $m$

$1 = \mod{(sa+tm)}{m} = \mod{sa}{m}$

In other words, $\mod{s}{m}$ is the multiplicative inverse of $\mod{a}{m}$ iff $\congruent{sa}{1}{m}$.

So, we can compute multiplicative inverses with the extended Euclidean algorithm. These inverses let us solve modular equations.

Using multiplicative inverses to solve modular equations

Solve: $\congruent{7x}{1}{26}$

Solving a more general equation

Solve: $\congruent{7y}{3}{26}$

We computed that 15 is the multiplicative inverse of 7 modulo 26:

That is, $\congruent{7 * 15}{1}{26}$.

By the multiplication property of mod, we have

That is, $\congruent{7 * 15 * 3}{1 * 3}{26}$.

So, any $\congruent{y}{15 * 3}{26}$ is a solution.

That is, $y = 19 + 26k$ for any $k\in\Z$ is a solution.

Solving equations modulo a prime number

$\gcd{a}{m}=1$ if $m$ is prime and $0 < a < m$, so we can always solve modular equations for prime $m$.

The modular exponentiation problem: $\mod{a^k}{m}$

How would you compute $\mod{78365^{81453}}{104729}$?

To keep the intermediate results small, we use fast modular exponentiation.

Repeated squaring: $\mod{a^k}{m}$ for $k = 2^i$

If $k = 2^i$, we can compute $\mod{a^k}{m}$ in just $i$ steps.

Note that $\congruent{\mod{a}{m}}{a}{m}$ and $\congruent{\mod{b}{m}}{b}{m}$. So, we have $\mod{ab}{m} = \mod{((\mod{a}{m})(\mod{b}{m}))}{m}$.

Fast exponentiation: $\mod{a^k}{m}$ for all $k$

// Assumes a > 0, k >= 0, m > 0.
public static long fastModExp(long a, long k, long m) {
    if (k == 0) {            // k = 0
        return 1;
    } else if (k % 2 == 0) { // k is even
        long tmp = fastModExp(a, k/2, m);
        return (tmp * tmp) % m;
    } else {                // k is odd
        long tmp = fastModExp(a, k-1, m);
        return (a * tmp) % m;
    }
}

$\mod{78365^{81453}}{104729} = 45235$

Fast exponentiation: how fast is it?

Note that 81453 is 10011111000101101 in binary.

$81453 = 2^{16} + 2^{13} + 2^{12} + 2^{11} + 2^{10} + 2^{9} + 2^{5} + 2^{3} + 2^{2} + 2^{0}$

$a^{81453} = a^{2^{16}} * a^{2^{13}} * a^{2^{12}} * a^{2^{11}} * a^{2^{10}} * a^{2^{9}} * a^{2^{5}} * a^{2^{3}} * a^{2^{2}} * a^{2^{0}}$

Using fast modular exponentiation: RSA encryption

Alice chooses random 512-bit (or 1024-bit) primes $p, q$ and exponent $e$.

Alice computes $m=pq$ and broadcasts $(m, e)$, which is her public key.

She also computes the multiplicative inverse $d$ of $\mod{e}{(p-1)(q-1)}$, which serves as her private key.

To encrypt a message $a$ with Alice’s public key, Bob computes $C = \mod{a^e}{m}$.

This computation uses fast modular exponentiation.

Bob sends the ciphertext $C$ to Alice.

To decrypt $C$, Alice computes $\mod{C^d}{m}$.

This computation also uses fast modular exponentiation.

It works because $\mod{C^d}{m} = a$ for $0 < a < m$ unless $p\vert a$ or $q \vert a$.