\documentclass[11pt]{article}
\input{headers06}

\usepackage{fancyhdr}   
\pagestyle{fancy}      
\lhead{CS 355, SPRING 2025}               
\rhead{Name: Hemanta K. Maji} %%% <-- REPLACE Hemanta K. Maji WITH YOUR NAME HERE

\usepackage[strict]{changepage}  
\newcommand{\nextoddpage}{\checkoddpage\ifoddpage{\ \newpage\ \newpage}\else{\ \newpage}\fi}  


\begin{document}

\title{Homework 6}

\date{}

\maketitle 

\thispagestyle{fancy}  
\pagestyle{fancy} 


\begin{enumerate}

\item {\bfseries RSA Assumption (5+12+5).} Consider RSA encryption scheme with parameters $N=35=5\times 7$.
\begin{enumerate}
    \item Compute $\varphi(N)$ and write down the set $\mathbb{Z}^{*}_N$.
    
      {\bfseries Solution.}   
     
    %\newpage
    \vspace{0.3 \textheight}
    \item Use repeated squaring and complete the rows $X,X^2, X^4$ for all $X\in \mathbb{Z}^{*}_N$ as you have seen in the class (slides), that is, fill in the following table by adding as many columns as needed.

  {\bfseries Solution.}   
   \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE
       \begin{center}
 %      \centering
       \begin{tabular}{|c|c|c|c|c|c|c|c|c|c|c|c|c|}
       \hline
        $X$ & & & & & & & & & & & & \\
       \hline
        $X^2$ &&&&&&&&&&&&\\
       \hline
        $X^4$ &&&&&&&&&&&&\\
        \hline
       \end{tabular}
    \end{center}
      \begin{center}
 %      \centering
       \begin{tabular}{|c|c|c|c|c|c|c|c|c|c|c|c|c|}
       \hline
        & & & & & & & & & & & & \\
       \hline
        &&&&&&&&&&&&\\
       \hline
        &&&&&&&&&&&&\\
        \hline
       \end{tabular}
    \end{center}
    
    \vspace{0.2 \textheight}
   
    \item Find the row $X^7$ and show that $X^7$ is a bijection from $\mathbb{Z}^{*}_N$ to $\mathbb{Z}^{*}_N$.
     
    {\bfseries Solution.}  
        
        \begin{center}
 %      \centering
       \begin{tabular}{|c|c|c|c|c|c|c|c|c|c|c|c|c|}
       \hline
        $X$ & & & & & & & & & & & & \\
       \hline
        $X^2$ &&&&&&&&&&&&\\
       \hline
        $X^4$ &&&&&&&&&&&&\\
        \hline
        $X^7$ &&&&&&&&&&&&\\
        \hline
       \end{tabular}
    \end{center}
      \begin{center}
 %      \centering
       \begin{tabular}{|c|c|c|c|c|c|c|c|c|c|c|c|c|}
       \hline
        & & & & & & & & & & & & \\
       \hline
        &&&&&&&&&&&&\\
       \hline
        &&&&&&&&&&&&\\
        \hline
        &&&&&&&&&&&&\\
        \hline
       \end{tabular}
    \end{center}
    
    
     \newpage
\end{enumerate}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% Question 2 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\item {\bfseries Answer the following questions (7+7+7+7 points):}
\begin{enumerate}
    \item (7 points)
    By hand, compute the three least significant (decimal) digits of $25114997^{9301403}$.  
    Explain your logic.
    
    {\bfseries Solution.} 

    \newpage
    
    \item (7 points)
    Is the following RSA signature scheme valid? (Justify your answer)
        $$(r\Vert m)=21, \sigma=226, N=339, e=23$$
    Here, $m$ denotes the message, $r$ denotes the randomness used to sign $m$, and $\sigma$ denotes the signature. Moreover, $(r\Vert m)$ denotes the concatenation of $r$ and $m$. The signature algorithm $Sign(m)$ returns $(r\Vert m)^d \mod{N}$ where $d$ is the inverse of $e$ modulo $\varphi(N)$. The verification algorithm $Ver(m,\sigma)$ returns ($(r\Vert m)==\sigma^e \mod{N}$). 
    
    {\bfseries Solution.} 
    \newpage
    
    \item (7 points)
    Remember that in RSA encryption and signature schemes, $N=p\times q$ where $p$ and $q$ are two large primes. 
    Show that in the RSA scheme (with public parameters $N$ and $e$), if you know $N$ and $\varphi(N)$, then you can efficiently factorize $N$, i.e., you can recover $p$ and $q$.

    
    
    {\bfseries Solution.}   

    \vfill
    
    \item (7 points)
    Consider an encryption scheme where 
    $Enc(m):=m^e \mod{N}$ where $e$ is a positive integer relatively prime to $\varphi(N)$ and $Dec(c):=c^d \mod{N}$ where $d$ is the inverse of $e$ modulo $\varphi(N)$.
    Show that in this encryption scheme, if you know the encryption of $m_1$ and the encryption of $m_2$, then you can find 
    the encryption of $(m_1\times m_2)^6$.
      
    {\bfseries Solution.}   
    \vfill
    
    \newpage
    
    \item (7 points)
    Suppose $n = 76499 = 227 \cdot 337,$ where $227$ and $337$ are primes.
    Let $e_1 = 6039$ and $e_2 = 9031.$ 
    
    \begin{enumerate}
        \item (2 points) Only one of the two exponents $e_1, e_2$ is a valid RSA encryption key, which one?
        
          {\bfseries Solution.}   
          \vfill
        
        \item (3 points) For the valid encryption key, compute the corresponding decryption key $d.$
        
          {\bfseries Solution.}   
          \vfill
        
        \item (2 points) Decrypt the cipher text $c = 33.$
        
          {\bfseries Solution.}   
          \vfill
          
    \end{enumerate}
    
\end{enumerate}
\newpage






%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% Problem 3  %%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\item {\bfseries Euler Phi Function (30 points)}
\begin{enumerate}
    \item (10 points)
    Let $N = p_1^{e_1} \cdot p_2^{e_2} \dotsi p_t^{e_t}$ represent the unique prime factorization of a natural number $N$, where $p_1<p_2<\dotsi <p_t$ are prime numbers and $e_1,e_2,\dotsc,e_t$ are natural numbers. 
    Let $\bbZ_N^* = \left\{x \colon 0\leq x<N-1, \gcd(x,N)=1 \right\}$ and $\phi(N)=\abs{\bbZ_N^*}$. 
    Using the inclusion exclusion principle, prove that 
      $$\phi(N) = N \cdot \left(1-\frac1{p_1}\right)\cdot\left(1-\frac1{p_1}\right)\dotsi\left(1-\frac1{p_t}\right).$$
      
    {\bfseries Solution.}   
    
    \newpage
      
    \item (5 points)
    For any $x\in \bbZ_N^*$, prove that
      $$ x^{\phi(N)} = 1\mod N.$$
    Hint: Consider the subgroup generated by $x$ and its order. 
    
    {\bfseries Solution.}   
    
    \newpage
    
    \item {\bfseries Replacing $\phi(N)$ with $\frac{\phi(N)}{2}$ in RSA.} (15 points)
    
    In RSA, we pick the exponent $e$ and the decryption key $d$ from the set $\bbZ_{\phi(N)}^*$.
    This problem shall show that we can choose $e,d\in\bbZ_{\phi(N)/2}^*$ instead. 
    
    Let $p, q$ be two distinct odd primes and define $N = pq$. 
    \begin{enumerate}
        \item (2 points) For any $e\in \bbZ_{\phi(N)/2}^*$, prove that $x^e \colon \bbZ_N^* \to \bbZ_N^*$ is a bijection. 

          {\bfseries Solution.}   
          \vfill
        
        \item (7 points)
        Consider any $x \in \mathbb{Z}^*_N.$
            Prove that $x^{\frac{\phi(N)}{2}} = 1 \mod p$ and $x^{\frac{\phi(N)}{2}} = 1 \mod q.$
            
              {\bfseries Solution.}   
              \vfill
              \newpage
        

        \item (3 points)
        Consider any $x \in \mathbb{Z}^*_N.$
            Prove that $x^{\frac{\phi(N)}{2}} = 1 \mod N.$

              {\bfseries Solution.}   
              \vfill

        
        \item (3 points)
        Suppose $e, d$ are integers that $e \cdot d = 1 \mod \frac{\phi(N)}{2}.$
        Show that $(x^{e})^d = x \mod N,$ for any $x\in\bbZ_N^*$.

          {\bfseries Solution.}   
          \vfill
        
    \end{enumerate}
\end{enumerate}
\newpage





%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% Problem 4  %%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\item {\bfseries Understanding hardness of the Discrete Logarithm Problem.} (15 points)
  Suppose $(G,\circ)$ is a group of order $N$ generated by $g\in G$. 
  Suppose there is an algorithm $\cA_{DL}$ that, when given input $X\in G$, it    outputs $x\in\{0,1,\dotsc,N-1\}$ such that $g^x=X$ with probability $p_X$. 
  
  Think of it this way: The algorithm $\cA_{DL}$ solves the discrete logarithm problem; however, for different inputs $X\in G$, its success probability $p_X$ may be different. 
  
  Let $p = \frac{\left(\sum_{X\in G} p_X\right)}{N}$ represent the average success probability of $\cA_{DL}$ solving the discrete logarithm problem when $X$ is chosen uniformly at random from $G$. 
  
  Construct a new algorithm $\cB$ that takes {\em any} $X\in G$ as input and outputs $x\in\{0,1,\dotsc,N-1\}$ (by making one call to the algorithm $\cA_{DL}$) such that $g^x=X$ with probability $p$. 
  This new algorithm that you construct shall solve the discrete logarithm problem for {\em every} $X\in G$ with the same probability $p$. 
  
  ({\footnotesize {\em Remark:} 
      Intuitively, this result shows that solving the discrete logarithm problem for {\em any} $X\in G$ is no harder than solving the discrete logarithm problem for a {\em random} $X\in G$.
}) 

  {\bfseries Solution.}   


\newpage






%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% Problem 5  %%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\item {\bfseries Concatenating a random bit string before a message.} (15 points)

Let $m\in\zo^a$ be an arbitrary message.
Define the set 
    $$ S_m = \left\{ (r \Vert m) \colon r\in\zo^b\right\}. $$
Let $p$ be an odd prime. 
Recall that in the RSA encryption algorithm, we encrypted a message $y$ chosen uniformly at random from this set $S_m.$

Prove the following
    $$ \underset{y\getsr S_m}{\text{Pr}} [p\text{ divides } y] \leq 2^{-b} \cdot \left\lceil 2^b/p\right\rceil.  $$
    
  ({\footnotesize {\em Remark:} 
      This bound is tight as well. 
      There exists $m$ such that equality is achieved in the probability expression above. 
      Intuitively, this result shows that the message $y$ will be relatively prime to $p$ with probability (roughly) $(1 - 1/p)$. 
    }) 

      {\bfseries Solution.}   

\newpage

  


\item {\bfseries Properties of $x^e$ when $e$ is relatively prime to $\phi(N)$} (20 points)

In this problem, we will partially prove a result from the class that was left unproven. 
Suppose $N=pq$, where $p$ and $q$ are distinct prime numbers. 
Let $e$ be a natural number that is relatively prime to $\varphi(N)=(p-1)(q-1)$. 
In the lectures, we claimed (without proof) that the function $x^e \colon \bbZ_N^*\to\bbZ_N^*$ is a bijection. 
The following problem is key to proving this result. 

\begin{boxedalgo}
Let $N = pq$, where $p$ and $q$ are distinct prime numbers. 
Let $e$ be a natural number relatively prime to $(p-1)(q-1)$. 
Consider $x,y\in \bbZ_N^*$. 
If $x^e=y^e\mod N$, then prove that $x=y$. 
\end{boxedalgo}

Hint: You might find the following facts useful. 
    \begin{itemize}
        \item Every $\alpha\in \bbZ_N$ can be uniquely written as $(\alpha_p,\alpha_q)$ such that $\alpha=\alpha_p\mod p$ and $\alpha=\alpha_q\mod q$, using the Chinese Remainder theorem. 
          We will write this observation succinctly as $\alpha = (\alpha_p,\alpha_q)\mod(p,q)$. 
          
        \item For $\alpha,\beta\in \bbZ_N$, and $e\in \bbN$ we have $\alpha^e=\beta\mod N$ if and only if $\alpha_p^e =\beta_p\mod p$ and $\alpha_q^e=\beta_q\mod q$.
          We will write this succinctly as $\alpha^e=(\alpha_p^e,\alpha_q^e)\mod(p,q)$. 
          
        \item From the Extended GCD algorithm, if $u$ and $v$ are relatively prime then, there exists integers $a,b\in\bbZ$ such that $au + bv =1$. 
        
        \item Fermat's little theorem states that $x^{p-1}=1\mod p$ if $x$ is a natural number that is relatively prime to the prime $p$. 
    \end{itemize}

      {\bfseries Solution.}   

\newpage



%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% Problem 7  %%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\item {\bfseries Challenging: Inverting exponentiation function.} (20 points)

 Fix $N = pq$, where $p$ and $q$ are distinct odd primes. 
 Let $e$ be a natural number such that $\gcd(e, \phi(N)) = 1$. 
 Suppose there is an adversary $\cA$ running in time $T$ such that  
        $$\prob{[\cA ([x^e \mod N]) = x]} = 0.01$$
    for $x$ chosen uniformly at random from $\mathbb{Z}^*_N.$ 
Intuitively, this algorithm successfully finds the $e$-th root with probability $0.01$, for a random $x$. 
    
For any $\eps\in(0,1)$, construct an adversary $\cB_\eps$ (which, possibly, makes multiple calls to the adversary $\cA$) such that
        $$\prob{[\cB_\eps ([x^e \mod N]) = x]} = 1 - \epsilon,$$
    for {\em every} $x \in \mathbb{Z}^*_N.$
The algorithm $\cB_\eps$ should have a running time polynomial in $T, \log N,$ and $\log 1/\epsilon$. 

  {\bfseries Solution.}   

\end{enumerate}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% PLEASE LIST COLLABORATORS BELOW  %%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\newpage
{\bfseries Collaborators :}   
% ENTER THEIR NAMES HERE  

\end{document}

