dissertacao.pdf

There is a lot of efficient ways to compute the Resultant of two polynomials.
One property of the resultant which will be useful for an attack in Chapter 3 is
that its application allows for the elimination of one variable from a system of
two polynomial equations[45].
To calculate (a, b) we can use the Extended Euclidean Algorithm, which
runs in time linear in the size of a and b and outputs also integers x, y such that
xa + yb = (a, b). We present it now:
Algorithm 2. (Extended Euclidean Algorithm): Given two integers a > b,
in step k = 0 we set r−2 = a, r−1 = b, x0 = y0 = 0, x1 = y1 = 1 and
compute r0 : r−2 = q1 ∗ r−1 + r0, where q1 = ⌊ r−2
⌋. In step k = i, we
compute ri : ri−2 = qi ∗ ri−1 + ri, where qi = ⌊ ri−2
⌋. Then we compute
r−1
ri−1
xi = xi−2 − qi−1xi−1 and yi = yi−2 − qi−1yi−1 if qi−1 is defined.
The algorithm stops at step k = l if rl = 0 and outputs (a, b) = rl−1 and
also xl−2 and yl−2 which satisfy xl−2a + yl−2b = (a, b).
Some properties of Euler’s Totient function, φ(N), and Carmichael’s
Lambda Function, λ(N), are particularly relevant for RSA analysis:
Theorem 2. If p, q are two different prime integers and N = pq we have:
1. φ(p) = p − 1
2. φ(N) = φ(pq) = φ(p)φ(q) = (p − 1)(q − 1)
3. λ(N) = lcm(p − 1, q − 1) = (p−1)(q−1)
(p−1,q−1)
= φ(N)
(p−1,q−1)
We are now in position to present Euler’s Theorem.
Theorem 3. (Euler’s Theorem): If a and N are co-prime positive integers
then:
a φ(N) ∼ = 1 (mod N) (15)
Proof. Let m1, m2, ..., m φ(N) be the positive integers co-prime to and less than
N. These numbers are all distinct modulo N and a is co-prime to N, so each
of the integers am1, am2, ..., am φ(N) is congruent to one of m1, m2, ..., m φ(N).
Because congruences preserve multiplicity, we have:
am1am2...am φ(N) ∼ = m1m2...m φ(N) (mod N) ⇔ (16)
m1m2...m φ(N)a φ(N) ∼ = m1m2...m φ(N) (mod N) (17)
Diving both sides by m1m2...m φ(N) we get the equality.
11