Modular Inverses Recall the simple encryption function f (a) = (3a + 9) mod 26 We made the claim that an inverse function is given by: g (a) = (9a – 3) mod 26 Check this: g (f (a ))  g(3a+9) (mod 26)  9(3a+9)-3 (mod 26)  27a+81-3 (mod 26)  27a+78 (mod 26)  a (mod 26). So for a in the range [0,25] we have g (f (a )) = a and so g and f are inverses of each other. L13

g(f (a ))  x·3a (mod 26)  a (mod 26) Modular Inverses How could one have inverted f methodically? Do simpler example: f (a ) = 3a mod 26 Look for constant x and an inverse of the form: g(a ) = xa Then condition g(f (a ))  a (mod 26) gives: g(f (a ))  x·3a (mod 26)  a (mod 26) If we can solve this for a=1, it will work for all other x as well. So plug in a=1 to get: 3x  1 (mod 26) I.e. we wish to find an inverse of 3 modulo 26. L13

Modular Inverses DEF: The inverse of e modulo N is the number d between 1 and N-1 such that de  1 (mod N) if such a number exists. Q: What is the inverse of 3 modulo 26? L13

Modular Inverses A: 9 because 9·3 = 27  1 (mod 26). Q: What is the inverse of 4 modulo 8? To figure out the inverse of the original function f (a) = (3a + 9) mod 26 look for Solution of the form g (a) = (9a + x) mod 26. We want the “9a” term because 9 is the inverse of 3 modulo 26. Now compose f and g to get g ( f(a)) = (9(3a+9) + x) mod 26 = (a+81 + x) mod 26 = (a+ 3 + x) mod 26. Since we want g ( f(a)) = a, it’s now clear that we should let x = -3 and therefore g (a) = (9a - 3) mod 26 as claimed before. L13

Modular Inverses A: Trick Question! No inverse can exist because 4x is always 0 or 4 modulo 8! THM1: e has an inverse modulo N if and only if e and N are relatively prime. This will follow from the following useful fact. THM2: If a and b are positive integers, the gcd of a and b can be expressed as an integer combination of a and b. I.e., there are integers s,t for which gcd(a,b) = sa + tb L13

Modular Inverses Example 5·14 - 3·23 =1 implies: gcd(14,23) = 1 Any number dividing both 14 and 23 must divide 1 The inverse of 14 modulo 23 is 5 5·14 =1+ 3·23 5·14  1 (mod 23) “An” inverse of 23 modulo 14 is -3 -3·23 =1- 5·14 -3·23  1 (mod 14) 11·23  1 (mod 14) “The” inverse is 11 L13

Modular Inverses Proof of THM1 using THM2: If an inverse d exists for e modulo N, we have de  1 (mod N) so that for some k, de = 1 +kN, so 1 = de – kN. This equation implies that any number dividing both e and N must divide 1, so must be 1, so e,N are relatively prime. L13

Modular Inverses On the other hand, suppose that e,N are relatively prime. Using THM2, write 1 = se + tN. Rewrite this as se = 1-tN. Evaluating both sides mod N gives se  1 (mod N) . Therefore s is seemingly the inverse e except that it may be in the wrong range so set d = s mod N.  L13

Extended Euclidean Algorithm A constructive version of THM2 which gives s and t will give explicit inverses. This is what the extended Euclidean algorithm does. The extended Euclidean algorithm works the same as the regular Euclidean algorithm except that we keep track of more details –namely the quotient q = x/y in addition to the remainder r = x mod y. This allows us to backtrack and write the gcd(a,b) as a linear combination of a and b. L13

Extended Euclidean Algorithm Examples gcd(33,77) Therefore s = -2 and t = 1 Step x = qy + r x y gcd = ax+by - 33 77 1 33=0·77+33 11= 77 - 2·(33-0·77) = -2·33 + 1·77 2 77=2·33+11 11 11 = 77 - 2·33 3 33=3·11+0 Solve for r. Plug it in. L13

Extended Euclidean Algorithm Examples inverse of 244 modulo 117 gcd(244,117): Step x = qy + r x y gcd = ax+by - 244 117 1 244=2·117+10 10 1= 3·117-35·(244- 2·117) = -35·244+73·117 2 117=11·10+7 7 1=-2·10+3·(117-11·10) = 3·117-35·10 3 10=7+3 1=7-2·(10-7) = -2·10+3·7 4 7=2·3+1 1=7-2·3 5 3=3·1+0 Solve for r. Plug it in. L13

Extended Euclidean Algorithm Summary: Extended Euclidean algorithm works by keeping track of how remainder r results from dividing x by y. Last such equation gives gcd in terms of last x and y. By repeatedly inserting r into the last equation, one can get the gcd in terms of bigger and bigger values of x,y until at the very top is reached, which gives the gcd in terms of the inputs a,b. L13