1. On the Cryptographic Value of the q th Root Problem Cheryl Beaver Peter Gemmell Anna Johnston William Neumann

2. The Big Picture  Mod N q th roots

3. q th Roots Vs Square Roots q th roots  discrete logs Simple one-way function Functions over a group for which discrete logarithms are difficult. No Trapdoor. 2 ond Roots  Factoring Simple one-way function Functions over a ring for which factoring the groups is difficult. Simple Trapdoor q th Roots Square Roots

4. What is a q th Root? Let G be a finite cyclic group,  an element of G and q a prime integer. The q th root of  is  where:

5. How do you take q th roots? s=0,1 s>1 Compute (q  1 mod r) raise  to that integer. Same as for s=1, then find a discrete log of an element of order q (s-1). Let the order of G be q s r, with GCD(r,q)=1. Find the q th root of .

6. When are q th Roots Hard? qGqG A large prime integer A group whose order is divisible by q 2 CLAIM: Finding q th roots in G is equivalent to the discrete logarithm problem! Note: WLOG -- let the order of G=q 2

7. What are the roots? Let the order of G be q 2,  be a generator of G and  =  qx (0  x<q). The q th roots of  are:

8. Discrete Logs ==> q th Roots Given the ability to find discrete logarithms q th roots can be found  is a generator of G.

9. q th Roots ==> Discrete Logs Using a q th root oracle, devise a fast algorithm for computing discrete logarithms. ORACLE

10. Assumptions about Oracle The function f(x) defines the oracle. Oracle assumptions imply assumptions on f. Assume that the oracle behaves similar to the oracle for a group whose order is qr. cf(x)=f(cx) mod (q)

11. Discrete Logarithm Technique Find the discrete log of  base  (  is a generator) 1.Let  =  t, with t=qt 1 +t 0 2.Find t 0 with Oracle: 3.Find t 1 with Oracle:

12. Oracle Discrete Logarithm If the range of the discrete logarithm is known then the Oracle divides the range by half  =  qx, with 0  x<q/2 k. 2.The bounds on x imply that 0  2 k+1 x<2q. 3.In reduced form modulo q, 2 k+1 x  2 k+1 x  bq (mod q) b  {0,1} 4.Compare  raised to 2 k+1 with M(  ) raised to this power.

13. Function Comparison

14. Putting them together 1.If the result of this equation is the identity, b-=0; otherwise b=1; 2.If b=0, 0  x<q/2 k+1 ; 3.If b=1, q/2 k+1  x<q/2 k+1

15. 1.Compute T where  =  qT. 2.Start with 0  x=T)<q/2 0,  =  qx, and set T=0 3.For k=0 to  lg(q) , use the oracle to find out which half of the range x is in. 4.If x is in the upper range (q/2 k+1  x<q/2 k ), then T=T+  q/2 k+1 , 5.The new range for x is 0  x<q/2 k+1. Summary of Discrete Logarithm Technique Find the discrete logarithm of an element  in G.

16. Groups, Subgroups, and Residues |G|=q 2   q  q |G|=qr  q  r   q  r  r  q

17. Public Key Protocols Exponential Knapsack Similar to the Fiat-Shamir signature scheme. ElGamal Style: Similar in some ways to ElGamal, but secret is in the group instead of the exponent.

18. Exponential Knapsack Components Secret Key:{x i }, with i=0,1, …,k  1 Public Key:{y i }, with y i  x i  q Secret 1-time random:r Public 1-time random:t=r q Hash of message|random: U= H(m|t)=  u i 2 i

19. Signature Protocol Signer Verifier S,U,m Verifies if U=U’

20. ElGamal Style Signature Components Secret Key:x Public Key:y, with y  x  q Secret 1-time random:r Public 1-time random:t=r q Hash of message|random:U = H(m|t), 0<U<q

21. Signature Protocol Signer Verifier S,U,m Verifies if U=U’

22. Conclusions In a group whose order is divisible by q 2, the problems of taking discrete logarithms and finding a q th root are equivalent. The q th root problem is a new foundation upon which public key cryptosystems can be built. Discrete logarithm based systems with secrets in the group instead of the exponent.

23. Square Roots Modulo N Equivalent to Factoring 1.Choose random r 2.Take the square root modulo N: r 2  s mod N 3.If the the square root is not r (75% chance), then (r-s)(r+s)=0 mod N 4.With luck GCD(r-s,N) or GCD(r+s,N) will be P and Q (conversely, knowing the factorization enables square roots to be easily found)

24. Why Does this Work? Let the order of G be q s r (s>0) and GCD(r,q)=1; v:v  r -1 mod q  :A generator in G  :an element of G which has a q th root --  =  qx for some integer 0  x<q (s-1) r ;

25. Generalizing for q th roots Let |G|=q s r where s>0 and GCD(r,q)=1. 1.Raise  to the (1+rc)/q, where c=(-r -1 mod q) Þ  x+rcx 2.  rc has order q s. 3.Find x modulo q s-1 by finding the discrete log of  r base  qr. 4. Remove the error term:

26. Square Roots if the Order of G is Known Let  be a generator of G, |G|=2 s r be the order of G, s>0 and r is odd 1.Raise  to the (1+r)/2 ® (  x+rx ) 2.  r has order 2 s. 3.Find x modulo 2 s-1 by finding the discrete log of  r base  2r. 4. Remove the error term: Find the square root of  =  2x