Prime Numbers

8.7 Exercises 433
standards insist on such presence.) The interesting research of [Okeya and
Sakurai 2001] is relevant to this design problem. In fact such issues—usually
relating to casting efficient ECC onto chips or smart cards—abound in the
current literature. A simple Internet search on ECC optimizations now brings
up a great many very recent references. Just one place (of many) to get started
on this topic is [Berta and Mann 2002] and references therein.
8.7. Devise a coin-flip protocol based on the idea that if n is the product of
two different odd primes, then quadratic residues modulo n have 4 square roots
of the form ±a, ±b. Further computing these square roots, given the quadratic
residue, is easy when one knows the prime factorization of n and, conversely,
when one has the 4 square roots, the factorization of n is immediate. Note in
this connection the Blum integers of Exercise 2.26, which integers are often
used in coin-flip protocols. References are [Schneier 1996] and [Bressoud and
Wagon 2000, p. 146].
8.8. Explore the possibility of cryptographic defects in Algorithm 8.1.11.
For example, Bob could cheat if he could quickly factor n, so the fairness
of the protocol, as with many others, should be predicated on the presumed
difficulty in factoring the number n that Alice sends. Is there any way for
Alice to cheat by somehow misleading Bob into preferring one of the primes
over the other? If Bob knows or guesses that Alice is choosing the primes
p, q, r at random in a certain range, is there some way for him to improve his
chances? Is there any way for either party to lose on purpose?
8.9. It is stated after Algorithm 8.1.11 that a coin-flip protocol can be
extended to group games such as poker. Choose a specific protocol (from the
text algorithm or such references as in Exercise 8.7), and write out explicitly
a design for “telephone poker,” in which there is, over a party-line phone
connection, a deal of say 5 cards per person, hands eventually claimed, and
so on. It may be intuitively clear that if flipping a coin can be done, so can
this poker game, but the exercise here is to be explicit in the design of a
full-fledged poker game.
8.10. Prove that the verification step of Algorithm 8.1.8 works, and discuss
both the probability of a false signature getting through and the difficulty of
forging.
8.11. Design a random-number generator based on a one-way function. It
turns out that any suitable one-way function can be used to this effect. One
reference is [H˚astad et al. 1999]; another is [Lagarias 1990].
8.12. Implement the Halton-sequence fast qMC Algorithm 8.3.6 for dimension
D = 2, and plot graphically a cloud of some thousands of points in the
unit square. Comment on the qualitative (visual) difference between your plot
and a plot of simple random coordinates.