52
60×88 1/16

Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

  • Upload
    natalia

  • View
    219

  • Download
    0

Embed Size (px)

DESCRIPTION

Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii

Citation preview

Page 1: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

�� � � � �� �� � � � �� � � � � � � � �� � ��� �� � � � � �� �� � � � �� � � � �� �! � � � � � � � " �� � � � � ! � �� � �

#$ %& '( )* +, $ -. /* �10 2 0 �3 & - %*� +4 '3 & +5 - 3 )* +, $ -. /* " 0 6 %7 $8 /7

�9 , $ . +8 :5 . 7 / � /5 - /7 5 - /; / � + '. * $' +< * +* ( 7 ' /; /= $ . += $ . 3 & +5 - /; / / >* $ 9 /7 $ '3?� 3@ + '9 3? �A BCD E EF /. G H0 C E 0 GC C C ; 0� /, < 3 5 $ ' / 7 < +& $ . :D D 0D D 0 GC C G ; 0 � /* = $ .

60×88 1/160 � +& $ . : / I 5 +. '$? 02 %= $ ; $ / I5 +. '$? BD 0 � +& 0 8 0 JLK F 0 � 3 * $ M GC C C N -9 0 O $ -$ 9 B

� � # � �D D PC C G K � /5 -7 $ K 2 /8 :Q / ) "8 $ 5 : +7 5 -3 ) < +* 0 KD D 0� . < +& $ . $ ' / 7 � ! R �S �* / 3 9 7 /, 5 . 7 + ' ' /T 3 9 , $ . +8 :5 -3 ) - /= > 3 '$ . " � # � � �U 0D HC CD C K ; 0 �V > +* @ ( � /5 - /7 5 - / ) / >8 0 K � -.? >* :5 - 3 ) < * T . K HC EL0 � +8 0 F F HWT GD T X J 0

Y[Z \ Z ]_^ ` ^ ab cd ef

gih jk l lm no p l qsr h t lu hv j lr

o wx n p l tr o r y j p lm t n x po q l l

z|{}~ ��� { �|� � �� {� � �� { ��� � ��� � � { ��� � ��� � �� � � � �~� { �} { { ����� { �� � �� � { ��� � � � � � � � { � ��� � {� � { � ��� {} � � � {� � ��� � � � � � � �~ � � �� {� { } {� { ��� � �� � � ~ ��� � { ���{ �~ � � � � �� � � } { � } �� � � �� � {� � �� � { �} � � � � �� � � ��� {} � � � {� � ��

 ¡¢   £¤¥ ¥ ¤

Page 2: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

2 2 � E G 0 XD 7 J� H J� +@ + '9 + '. (� � V 7 3 ' � 0 A 0 K < * /* + -. /* � /5 - /7 5 - /; / ; /5 %, $ * 5 . 7 + ' ' /; / 3 'T5 . 3 . %. $ * $ , 3 /. + 4 '3 - 3 K N8 + -. * / '3 -3 3 $ 7 . /= $ . 3 - 3 � . + 4 '3 & + T5 - /; / % '3 7 +* 5 3 . +. $ � K < * +, 5 +, $ . +8 : %& + > ' /T= + /, 3 & +5 - / ) - /= 3 5 T5 3 3 < / 7 / < * /5 $ = - /= < :V . +* ' / ) > +9 /< $ 5 ' /5 . 3 K -$ ', 3 , $ . . +4 '0'$ % -K < * / I +5 5 /* 0O? 9 3 ' " 0 �0 K < * / I +5 5 /* � /5 - /7 5 - /; / ; /5 %, $ * 5 . 7 + ' ' /; / 3 '5 . 3 T. % . $ * $ , 3 / N8 + -. * / '3 -3 3 $ 7 . /= $ . 3 -3 � . + 4 '3 & +5 - /; / % '3 7 +* T5 3 . +. $ � K -$ ', 3 , $ . I 3 9 0 T= $ . 0 '$ % -0� /5 : �10 2 0 K 9 $ 7 +, %V �3 ) -$ I +, * / ) 3 ' I /* = $@ 3 / ' ' / ) > +9 / < $ 5 T' /5 . 3 � /5 - /7 5 - /; / ; /5 %, $ * 5 . 7 + ' ' /; / 3 '5 . 3 . %. $ N8 + -. * / '3 -33 = $ . += $ . 3 -3 � . + 4 '3 & +5 - /; / % '3 7 +* 5 3 . +. $ � K -$ ', 3 , $ . . +4 '0'$ % -0

���� � � � � ��� � ���� ��� �� � � �� � � �! �" �# �$ � � � %& � � � " � '� � � �" �& �� � � �)( * ( +   ¡¢   £ � ¤¥ ¥ ¤( * , ¥ � -(

. /0 12 3 4� ¥ 2 5 3¥ � ¥ 3 5� /5 / > 3 + < * +, 5 . $ 78 ? +. 5 / > / ) -* $ . - / + 7 7 +, + '3 + 7 / >8 $ 5 . : 5 /7 * + T= + ' ' / ) 7 ( & 3 58 3 . +8 : ' / ) . + /* 3 3 & 3 5 +8 3 + + < * 3 8 / M + '3 ) - -* 3 < . /; * $ TI 3 & +5 - 3 = 9 $ , $ & $ = 0�* +, '$ 9 '$ & + ' / , 8 ? 5 . %, + '. /7 7 %9 /7 K / > %& $ V �3 4 5? < / 3 ' I /* = $ T@ 3 / ' ' / ) > +9 / < $ 5 ' /5 . 3 K 3 7 5 + 4 M +8 $ V �3 4 < /8 %& 3 . : < +* 7 / '$ & $8 : ' / +< * +, 5 . $ 78 + '3 + / < * +, = +. +0

2 2 � E G 0 XD 7 J

6 78 9: ; <=> : ? ;> @> ; ?

-© A( B( �� �� CD � �E � ¤¥ ¥ ¤

-©  ¡¢   £ � ¤¥ ¥ ¤

FHG I JK I LM N L

6O� PRQ �� �S TUV W� V TX S� Y � X Z � T � [ V \�� S Q ] @

^ ,( _ ' � `$ " '� � CE � �� ` � ��E � � $ % �a E �$ " � ( ( ( ( ( ( ( ( ( ( ( �

^ ¤( _ % �a E �$ " b � � � �! �" �# �$ � �c � �� �� �� `$ �� %d � # � $ %� � e

^f ( _ % �a E �$ " b � %& � � � " � g '� % �h � ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( , ¤

^ �( _ % �a E �$ " b � �� �� �� ` '� � % b �� ' d # �" � ' ( ( ( ( ( ( ( ( ( ( , �

^2 ( i$ � � % b j � '� E � � �h C % bE � ` � � � �! �" � � � ( ( ( ( ( ( ( ( ( ( ,�

^� ( B d # � $ %�E �k $ E �& �# %�E � � ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( , 4

^ 5( lR� $ � �� " E �� � �� � m �� j � '� E � � n C � b� ( ( ( ( ( ( ( ( ( ( ( ( ( ¤ ,

6 6O� o U � �� X p X �V � Z T� U q @

^ e( ¢ � � �� � d 'E d � h � � m � � �c $ ' � `$ " '� ( ( ( ( ( ( ( ( ( ( ( ( ( ¤�

^ 4( r '� h �� " �# E d � ' d # �" d ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( f ,

^ , ¥ ( s� � �� � �� md D � '� � �� $ � ��h � %�E � � � � �$ " d c # � $ � % ( ( f e

6 6 6O� �� Y � X Z � T � � S Ut V � X p = q

^ , ,( u � � ' � �� � � � �$ " �" d ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( � ¤

, ,( ,( v� D � " � w �� " �$ ���E � ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( � ¤

, ,( ¤( r � � " � � � ` B � % b$ �E � ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( � ¤

, ,( f ( s� $ " E � �$ E � '� � % � `" � � �� d n � � � ( ( ( ( ( ( ( � f

, ,( �( _ ' � `$ " '� # � $ � % r� � � `� %� ( ( ( ( ( ( ( ( ( ( ( ( ( � 2

, ,( 2 ( s� $ " _ � % � '�k * x" �� $ $ �E � ( ( ( ( ( ( ( ( ( ( ( ( ( ( � 5

, ,( � ( s� $ " v� m �E � *   � % %� �� ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( � 4

, ,( 5( u � % � E � � � % bE d `" � $ " �� $ � � jE � '� E �k � � �$ " �" d ( 2 ,

^ , ¤( u �$ " � ��E � � m � % b D �c � � �$ " d c # � $ � % ( ( ( ( ( ( ( ( ( ( ( 2 4

, ¤( ,( r � � " � � � ` �y � � ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( 2 4

, ¤( ¤( s� � �� � u �� % � E &" �E � ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( � ,

, ¤( f ( s� � �� � lR� � � " � � ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( � f

, ¤( �(  �" �h  � C � � �� ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( � �

, ¤( 2 (  �" �h   �c � %�$ � C ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( � 5

, ¤( � ( (n + 1) z �" �h d ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( � e

, ¤( 5( � � $ %�   � �$ �E E � ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( � 4

^ ,f ( A %& � � � " d �� � " � � � j� �� � �� %d c # � $ � % ( ( ( ( ( ( ( ( ( � 4

,f ( ,(  �" �h u � % %� �h � ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( 5 ¤

,f ( ¤( A %& � � � " u � % %� �h � * x" �� $ $ �E � ( ( ( ( ( ( ( ( ( ( 5�

,f ( f ( n� � " � � � j� ��k n � � � ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( 52

,f ( �( A %& � � � " lR� � $ �E � ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( 5 5

Page 3: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� �� � �� �� �� �

,f ( 2 ( A %& � � � " � � %c � �" � *   � � � � $ �E � ( ( ( ( ( ( ( ( ( e¥

,f ( � (  �" �h � '� h �� " � # E �& � � � D � " � ( ( ( ( ( ( ( ( ( ( ( ( e ¤

,f ( 5( (p− 1) z �" �h �� � " � � � j� �� � u � % %� �h � ( ( ( ( ( ( ( e2

6 � �� \XV t � S Y Z � T �S � T TX � S 7� � ?

^ , �( B d m � � �� �� �" � � '$ � $ " � d � / � ( ( ( ( ( ( ( ( ( ( ( ( ( e 5

, �( ,( B j� � �$ 'k j b � a h C �� �� �" �� � $ � $ " � d � / � ( e e

, �( ¤( �$ % � ' �k E � ' d m � �# � $ � % p � q ( ( ( ( ( ( ( ( ( ( ( ( 4 ,

, �( f ( B d m � � �� �� � " � � ' e � d ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( 4 5

�V �� X S� < <

�� X �� S X � S �> >

��� L� N � I � K N L

B �$ E � ' C� E � & � � � % �a �E d %�� � � � � # � " � ' D � �$ k ' " �# �E � � , 4 4 � *¤¥ ¥ ¥ & &( ' iE $ " � " C" � � � � �" �& �� � � � $ 'k j � � � E � � � � " � � � E � � �" �� �� r � � by " � �E � k m� j � �� $ E �$ " b� ( ¡ � % b �" � `� E � & � * � � � '� $ " � $ ' � j �a z

E � m � %� � � � %E d � h �� � j� " � % b$ " '� � E � # � % bE d � �� j C % b" � " d ' � m %� $ " �

$ � ' � � �E E � ` ' d # � $ % � " � % bE � `" � � � � � # � $ � % � � � � � � % �a �E � `� � � � � z

" �& �� � �# � $ � � j� h � # � (£" ' d D �h D �c E � � C$ $ � � k j d � � � E � & � �" � � � � � # � $ � % � � � � � � % � z

a �E �k � � � � �" �& �� � � � h � E E d `� C �$ �" % �# � �" � � �� � " E �$ " b � � � � z

$ " �" � � j % �a �E � k ( u � � ' d m � �� � " � � � � %� � '" � �$ " �� � %$ k � $ c �h � " b

� j �E � � % bE d c " �� m � '� E � `� E � # � % bE � ` � �h & �" � '� � # � " � " � %k � � � �

� �� ' � % � � $ � �" ' �" $ " ' Cy �� `h ' C � C �$ � " �c E �# �$ � �& � ' C j� ( u � �" � C

'� E � & CE � ' �D % � �" �h d �h � y �� � E � � % C# D � � � j$ C ��$ " ' Cy � �c 'E � z

$ " �k �� � ' �� k � ��E �� $ % �a E �$ " � � " �� m Cy � � � � � � ' %�# �E �k � �E k " � `

$ � ' � � �E E � ` � %& � m �� �# � $ � � ` & � � �" � � �)(l %k h � % bE � `D � & � m � %� � h � " � % bE �& � � jE � � � %�E � k $ � � �h � " �

�a E � ��� � �E h � '� " b� E � & � � 4 � � � , ¥ � � � ,f � � � ,2 �(rE � & � $ � �" '� " $ " ' C� " � � �& �� � h � $ �� � % �E d � s� � � �" � � � z# � $ % � ' d �

� " �h d ' � � � �" �& �� � � �� & �$ Ch � �$ " '�E E �& � � m �� j � '� " � % bE �& � $ " � E z

h � �" � � �$ �� �� � % bE �$ " � ¥ 52 ¤¥ ¥ *� r � � by " � �E � k m� j � �� $ E �$ " b� (A '" � � m %� & �h � ��E r � C& % � ' C i( A( � _ � � � ' C i( A( j� � ��h �$ " � ' z

%�E E d � � " � � � � %d � � " � � a � u �# � C � C A( ( � �k j �E C B( u( j� E �& � z

# � $ %�E E d � j� �# � E �k (

Page 4: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

��� F � L M � J � I � �M � �� N J� N �� L� N L � � N� �� L� J � N

���� ��� � ���� � � ���� �� � � � !� � �" �# � � ��

� � � � $V � �X � TUV W� V TX S Ut V � X S � A %& � � � " �� D �E �k ' d # � $ % � z

" � % bE � ` j� h � # � � ��h $ " � ' %k �" $ � m � `E �� Cy h � " � � � E � � � '� E E Cy � � � �� z

h C � C� ' d � � %E k � Cy E � h E � m � � � 'c �h E d c h � E E d c ( B� � # �$ " '� � ��E � �

$ % �a E �$ " � � % & � � � " � � md # E � ' d m � �� �" $ k ' �� k �� m �" d � %& � � � " � (u � � �� jE d c E � m � �� c h � E E d c � %& � � � " �a �" � �" b �� j % �# E �� ' �� k

�� m �" d ( u � �" � C� � �h $ % �a E �$ " b y � %& � � � " � � �E � � �" $ k � � $ � � % b z

E �� ' �� k �� m �" d h %k '$ �c E � m � � � 'h � E E d c � jE �� �" � � �& � � � � $ � z

� � '� E E �& � E �a �$ " '� ( B$ y h CE � a � ' � � # �$ " '� E �a �$ " '� � $ c �h E d c

h � E E d c h %k � % & � � � " � m Ch �" ' d $ " C �� " b E �a �$ " ' �# � $ � % � � �" � � d �

'E �� �" � � � ` � � j � �� �E E � `$ � $ " � � $ # � $ %�E � k %# � �� '$ � & �h ' � �# E � ` &

� � y " h % �E C j� � � $ � E � � �� ' �$ c �h k � Cy E �� �" � � �& �# � $ %� n( u � �" � C�$ % �a E �$ " b � %& � � � " � � ��E � '� � " $ k E �� �" � � � ` � CE � �� � `

f(n)(u �h $ % �a E �$ " by $ � � ` ' d # � $ % � " � % bE � ` j� h � # � � md # E � � �E � � � " z

$ k �E � � % bE � k $ % �a E �$ " b � %& � � � " � � �� D � y �� & �h � E E Cy j� h � # C(u �$ � � % b� C � �� � " �# � $ � � E � ' � j �a E � � � � $ � " b E �a � $ " ' � '$ �c � %& � z

� � " � ' � �� D � y �� c � �E � �� " E Cy j� h � # C� " �h � E E d ` � �h c �h � � j ' � %k �"

� � % C# � " b" � % b� � '� �c E � � � ��E � � $ % �a E �$ " � j� h � # �)( n CE � �� k $ % �a z

E �$ " � � � a h �& �� %& � � � " � m Ch �" k ' %k " b$ k ' � �c E � ` � ��E � � `$ % �a E �$ " �

�� $ $ � " � � '� � � ` j� h � # �)( �� m � %� � � � ���� " � 'E d ` � %& � � � " � " � � � z

% C# � �" $ k m � %� � " �# E � k '� �c E k k � ��E � � $ % �a E �$ " � j� h � # �)(  d m Ch � � � % C# � " b � ��E � � $ % �a E �$ " � � %& � � � " � ' ' ' � h � f(n) == O(g(n)) � " ( �( � � ��h � %k " b � CE � �� � $ " �# E �$ " by h �� �E $ " � E " E �& �$ � z

E �a � " � %k � � ��E � m � � & � k � � � �" � � %d � # %�E � � ' ' d �� a �E � � h %k

� CE � � � � g(n)( B$ 'k j � $ �" � Ch � mE � ' ' �$ " � $ %�h Cy �� � � m � jE � # �E � �( Ch � � $ � � % b j � '� " b j� � � $ b f(n) ≺ g(n) � � $ % � f(n) = O(g(n)) � " �

� $ " b E � `h � " $ k � �E $ " � E " � c > 0 " � � � k � # " �E � # �E � k $ E �� �" � � �& � n' d � � %E k �" $ k E � �� ' �E $ " ' � f(n) 6 cg(n)( g$ % � �h E � ' �� �E E � ' d � � %E k z

y " $ k E � �� ' �E $ " '� f(n) ≺ g(n) � g(n) ≺ f(n)� " � m Ch � � $ � � % b j � '� " b

j� � � $ b f(n)≈ g(n)(

� � q � 'V (� U) * pZ T U �� ]� Ch � $ # � " � " b � # " �# � $ %� � ��h $ " � ' %�E d

'h ' � �# E � ` $ � $ " � � $ # � $ %�E �k � � � �h $ % �a E �$ " by � � � �! � " �# � $ � � `

� �� �� �� � m Ch � � �E � � " b# � $ % � m � " � ' d c � �� �� � � ` � E � � mc �h � d c h %k

� � � � � % � j� �� �)(

+,.- / � � 0 /1 � �2 3 �45 � 0 �5 � �4 � / � �6 � � /1 � 7

l� E E d ` � �h c �h Ch � m�E � �$ %�h Cy � � $ � � m �� a �E �k ( B � z �� � ' d c �'� � � b y " � �� c h � E E d � � � �h $ " � ' %k y " $ k � � m �� m� " d '� y " $ k 'h ' � � # z

E � ' �h � � � h � C& � � � ��h $ " � ' %�E � k ' �$ E � 'E � � $ � � % b j Cy " $ k " � % b� �

� � � ' ' �h � h � E E d c � ' d ' �h � �� j C % b" � " � '( B � z '" � � d c � �� �� ' �h # � $ %� N�" �h E �& � �$ E � '� E �k $ � $ " � d $ # � $ %�E �k � h � C& � C �$ C �� $ " ' %k �" $ k

m!d $ " � � � " �� m C� " ' d � � %E �E �k O(log N)� � � �! � " �# � $ � � c � �� �� �� ` %h � z

%�E � � $ �$ " � " � � � C E �a �E � � � % � $ % �a �E � � # � $ � % & � &h � log N *h % �E �

j� � � $ � # � $ %� N

% �$ E � '� E � � % �& � � � �! � E � C� � j d '� � � " � � � � � �E �

E � ' % � k �" E � ' � h � ��E � � $ % �a E �$ " � &( A" � � � � � �� ��c �h � h � C& � C

�$ E � '� E � y k ' %k �" $ k ��h � � ` � �� �� �� � ` � " � j� " �� " � � E � � � ' d � � % z

E �E � � �a E � � � �E � m ��# b( ¢ � � �E � � � m � " � '� k � ��E � � h �$ " � " �# E �c � � � z

D � �" �� a � � " �� � % bE Cy $ % �a E �$ " b � �� �� �� ` � � �$ � � % b� C� � � � � �� ' � z

% � � � ��E � � $ % �a E �$ " � h %k h � C& �c �$ E � '� E � `$ � $ " � $ # � $ %�E �k � � � z

' �h k " % � D b� �" % �# �k '� �E $ " � E " E � E �a � " � %� � CE � �� � � ��E � �

$ % �a E �$ " �(

� � 8 � PRQ �� � Y � �Q T UV W� V T X � u � � � ��E � � $ % �a E �$ " � ' d # � $ z

% � " � % bE d c j� h � # � m!d # E � � � � �E k y " � " �h d ��h C� � � � � $ '�h �E � k �

h � C& � j� h � # � $ � j '�$ " E d � � ��E � � � $ % �a E �$ " �)( w" � � " �h d �$ E � z

'� E d E � � �$ " � ��E � � E �� �" � � �& � � % & � � � " � �� D �E �k h � E E � ` j� h � # � �� �" � � d ` j� � %y # � �" $ k ' �� j m � �E � � j� h � # � E � � �h j� h � # � �E b D � ` �� j z

� �E �$ " � � h %k � � D �E �k � �" � � d c �a � " � $ � � % b j � '� " b$ k � � � h � E E d ` �" � � � h � C& � � � j '� $ " E d � � %& � � � " d ( u � � �" � h %k � CE � �� `$ % �a E �$ " �

� � % C# � " $ k E � �� ' �E $ " '� ' �h �

f(n) 6 cf

(

n

a

)

+ bg(n) + dn,

&h � a � b� c � d *E �� �" � � d � � � % �a � " � % bE d � � �E $ " � E " d ( Ch � � ��h � � %� & � " b � # " � � CE � �� � $ % �a E �$ " � f(n) � m %� h � y " h ' C z

k $ ' � `$ " '� � +

%:9 &

f(n) > n ;

%< &

kf(n) 6 f(kn)� k > 1(l %k � � % C# �E �k � ��E �� � CE � �� `$ % �a E �$ " � '� a E d h '� %� d (

��� S � � =� � � �~ � � � � � f(n) � g(n)~ � { � � � � � { �� � � � � { �� � �� � %:9 &� %< & � } � � � �� {� { �> � � {� � � � � � � � a > 1� b > 0 � d > 0 �> } { �� � �� � �� � � � � �� � � � {

f(n) 6 f

(

n

a

)

+ b · g(n) + d · n,

� { f(n) = O(g(n)) ?

Page 5: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� �- �5 � �4 � / � �6 � � / 1 � � � � 2 �� 1 � �� / 4 � � �� � � �5 � 0

l �� � j� " � % b$ " ' �( s� � � � � '$ � % C$ ' � `$ " '� %< &

a · f(

n

a

)

6 f

(

a · na

)

= f(n),

" �

f(n) 61

af(n) + b · g(n) + d · n.£" $ y h � � � % C# � � � # " �

f(n) 6b + d

1− 1/a· g(n) = O(g(n)). �

��� S q � =� � � } � � � �� {� { �> � � {� � � � � � � � a > 0 � c > 0 � d > 0�~ � � � �� f(n)~ � { � � � � � { �� �� ~ � � { � �� f(1) = d � f(n) = c · f(na ) + d · n} � � n > 1 � � { {� � � � � �� � � � +

f(n) =

O(n), a > c,

O(n log n), a = c,

O(nloga c), a < c.

l �� � j� " � % b$ " ' � � � � ' �h � " � % b� �h %k $ % C# � k n=at( iR � �

f(n) = d · n ·t−1∑

i=0

(

c

a

)i

+ d · ct = d · n ·t

i=0

(

c

a

)i

,

" � � � � � n = at( £" $ y h � � � % C# � � +

f(n) 6d · n

1− c/a= O(n), �$ % � a > c,

f(n) = d · n · t = d · n · log n, � $ % � a = c, �

f(n) = d · n · (c/a)t+1 − 1

c/a− 16

c · d · na

· ct

at· 1

c/a− 1= O(ct) = O(nloga c),

� $ % � a < c( �

���� �" �# � � � � � � �� !� � ! � � �� ! �� �

� � !" � � �" �

q � � � � UV W�� � * pZ X S� � � u �� a h � '$ � & � j� �" � � # " �$ " � E h � �" z

E d � D � � % bE d � � %& � � � " d $ % �a �E �k � ' d # � " � E �k # � $ � %$ " � % m � � � ��# � ' �h E � � � � y " � ��E � C$ % �a E �$ " � O(log N)� &h � N * m � % b D � � � jh ' Cc

# � $ � %( w" � �E � � % bE � k ' � j �a E � k � ��E � � $ % �a E �$ " � %E � � � E � �

+� - / � �6 � � /1 � � � � 2 �� 1 � �� / 4 � � �� � � �5 � 0 �

# " � d �� $ $ � " � � '� � � ��E � � $ % �a E �$ " � $ " �# E �$ " b y h �� �E $ " � E " z

E �& � E �a � " � %k & � � � � �" � CE �" $ d $ %� j� E � � " b$ k � �" � � j� �� � `

' d � � %E �E �k �" � c � �� �� �� `(

q � q � � � V W�� � (� U �� � � l %k C E �a �E �k � h � %�E �k h ' Cc # � $ � % N� M � %& � � � " d C E �a �E �k $ " � % m � � � � h � %�E �k C& % � h � y " � ��E � C

O(log N log M)( u � �" � Ch %k � CE � �� ` � ��E � � $ % �a E �$ " � C E �a �E �k

� h � %�E �k h ' Cc n z �� j �k h E d c # � $ � % ' d � � %E k �" $ k E � �� '�E $ " ' �

n 6 f(n) 6 O(n2).

_E � # � %� h �� � a � �# " �$ % �a E �$ " � � �� �� �� ` C E �a �E �k �h � %�E �k $

�$ " � " � � � ' � j '�h �E �k '� '� h �� " � E � c �a h �E �k � m �� " E �& �� h � E E � C

# � $ % C$ � ' �� h � y " $ " �# E �$ " by h �� �E $ " � E " E �& � E �a � " � %k ( u �h � m z

�� " E d � h � E E � C# � $ % C N � j� � � $ � E E � C ' ' �h � � �$ %�h � '� " � % bE �$ " �

� j nh ' � �# E d c jE � � � ' � jh �$ b � �E � � � " $ k � �� ' � % bE � k h � � m b � � � y z

�� k nh ' � �# E d c jE � � � ' � �$ %� j� �k " � ` � � � % C# �E E � k � j# � $ %� 1/N�" m �� $ d '� E � � m � %� � %� h D �c �� j �k h � '(u C$ " b M(n) *$ % �a E �$ " b � �� �� � � � C E �a �E �k h ' Cc n z �� j �k h E d c

# � $ � % � D(n) *$ % �a E �$ " b � �� �� �� � h � %�E �k $ �$ " � " � � 2n z �� j �k h E �& �

# � $ %� E � n z �� j �k h E �� # � $ % � � S(n) *$ % �a E �$ " b � �� �� �� � ' � j ' �h �E �k '

� '� h �� " n z �� j �k h E �& �# � $ %� � R(n) *$ % �a E �$ " b � �� �� � � � � m �� ��E �k

n z �� j �k h E �& �# � $ %� (��V � � S � �} � � �} { � { � �� � � � �� { �~ � � � � � M(n)� D(n) � S(n) � R(n)~ � { � � � � � { �� � � ~ � � { � �� � %� & � % < & � � } �� � � � � � � {~ � � � � � �� � � � +

M(n)≈D(n)≈ S(n)≈R(n).

l �� � j� " � % b$ " ' �( B$ � � h � %� � M(n)≺S(n)� " � � � � � '$ � % C

" �a h � $ " '�

AB =1

2((A + B)2 −A2 −B2)

$ � �� ' �h % � '� � ��E � � M(n) 6 3S(n) + 4n( l� %�E � y E � ¤$ � �" '�" $ " ' C�"

� �� �� ��k $ h ' � & � (AE � % �& �# E � � S(n)≺R(n) � " � � � � � '$ � % C �� '�E $ " '�

N2 =1

1

N− 1

N + 1

−N

� � % C# � � � ��E � C S(n)63R(n)+2n( �h � $ b$ %�h C�" $ h � %� " b$ %�h Cy �� �

'� a E �� j� �# � E � �( l� E E �� �� ' �E $ " ' � ' d � � %E k � " $ k h %k " �# E d c jE � z

# �E � `h � `$ " ' � " � % bE d c # � $ � % � � CE � $ # � $ %� ' � h � 1/Nk ' %k y " $ k �c

Page 6: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

,� �- �5 � �4 � / � �6 � � / 1 � � � � 2 �� 1 � �� / 4 � � �� � � �5 � 0

� � � m % � a �E E d � jE � # �E � k �)( u � �" � Ch %k � $ � �� ' %�E � k ' � j �a E d c

�D � m �� ' %� h D �c �� j �k h � c ' � %& � � � " � E � � mc �h � � � ��h C$ �" �� " b

$ �� �� � % bE d � � � � ��h C � d � c C" �# E �E �k ( B� %y # �E � � " � � �c � � � ��h C � '

�� % � E � ' % �k �" E � � ��E � C$ % �a E �$ " � % � �h � � mE � � $ ( ' � ¤ � &(l %k h �� � j� " � % b$ " '� � ��E � � R(n) ≺M(n) ' �$ � � % b j C� $ k � " � �� �� z

�E E d �" �h � ¢ by " �E � h %k ' d # � $ %�E �k jE � # �E �k � m �� " E �& �( £E j� z

� %y # � �" $ k ' ' d # � $ %�E � � � �$ %�h � '� " � % bE �$ " � � " � �� � � `

x(0), x(1), . . .. . . , x(i), . . . � � � � � C %�

x(i + 1) = 2x(i)−Nx(i)2.

l� E E � k � �$ %�h � '� " � % bE �$ " bh � `$ " ' � " � % bE � $ c �h � " $ k � 1/N � " � �

� � � �$ % � x(i) = 1N (1− δ)� " �

x(i + 1) = 2x(i)−Nx(i)2 =2

N(1− δ)− 1

N(1− δ)2 =

1

N(1− δ2).

u � �" � C � � � ' d m � �� E � # � % bE �& � jE � # �E �k x(0)" � � � # " � δ < 12

%� �" �

%� &� �$ h � %� " b � �h ' C $ " � � D � jE � # � �� �� j �k h � # � $ %� N

& � d

� � % C# � � � �$ %�h � '� " � % bE �$ " b � '� �" � � � `� � a h d ` �� j# � $ % � � �� ' � % b z

E � ' d # � $ %�E E d c jE � � � ' � �$ %� j� �k " � ` Ch '� � '� �" $ k ( %� & �h � �k �" � C

d �a � � � �$ " � j� �E � " bE C %k � " � jE � � � � � �" � � d E � % b jk h � ' � z

�k " b � � � h � E E � ` � " � �� � � � � � � � �$ " �k E E � Ch '� � '� k # � $ % � � �� ' � % bE �

� �h $ # � " � E E d c jE � � � ' � # � �� j log n D � & � ' � � % C# � E C a E �� � � % �# � $ " ' �

jE � � � '(£" $ y h � ' d " �� � �" � ��E � �

R(n) 6 R

(

n

2

)

+ 2M(n) + 2n.

B$ � % C %� d , � � � % C# � � R(n)≺M(n)(i j �� � �# � � E � �� ' �E $ " ' M(n)≺S(n)≺R(n)≺M(n)" � �� � b ' d " �� � �"

�� ' � '� %�E " E �$ " b �" �c " � �c � CE � �� `(l �� � a � � # " � R(n) ≺ D(n)( i j �� ' �E $ " '� AB = A 1

B

$ %�h C�" � # " �

D(n) ≺ M(n) + R(n) ≺ R(n)( ¢ � � �E � � � ' $ � % C �# � ' �h E � ` � ��E � �

R(n)≺D(n) � � � % C# � � " �� m C� Cy �� ' � '� %�E " E �$ " b( �v� $ $ �" � � " � �� � b ' � � � �$ � m � ��E � � $ % �a E �$ " � � �� �� � � � C E � z

a �E �k (£ ��E � C� �E b D Cy O(n2) � E � � m � %� � � � �$ " � �a E � � � % C# � " b � � � � z

�E k k ��� C �$ � 'E d ` � %& � � � " � �$ E � '� E E d `E � �� j m � �E � � # � $ � %E � h '�

$ %� & � � d c ( £# �E b Ch � mE � k '� �$ �k �" �& � � %& � � � " � md %� � ��h % �a � z

E � ' �� m �" � c r� �� � C m!d � £ �! � E � % , 4� ¤ &( gR& � $ C" b j� � %y # � � " $ k '

+� - / � �6 � � /1 � � � � 2 �� 1 � �� / 4 � � �� � � �5 � 0 , ,

��� C �$ � 'E � � � '" � ��E � � $ %�h Cy �� & � D � & � ( u C$ " b A � B *h '� n z �� j z

�k h E d c # � $ %� ( v� j � m b � �c E � h '� $ %� & � � d c %h %k � � �$ " �" d $ # � " � � �# " � n = 2k)

A = 2kA1 + A0, B = 2kB1 + B0.

s �&h �

AB = (2kA1 + A0)(2kB1 + B0) = 22kA1B1 + 2k(A0B1 + A1B0) + A0B0 =

= (22k + 2k)A1B1 + 2k(A0B1 + A1B0 −A0B0 −A1B1) + (2k + 1)A0B0 =

= (22k + 2k)A1B1 + 2k(A0 −A1)(B1 −B0) + (2k + 1)A0B0.

s� � � � m �� j � � h %k ' d # � $ %�E �k � � � � j '�h �E � k h ' Cc n z �� j �k h E d c

# � $ � %E C a E � ' d � � %E � " b" � � C E �a �E �k n/2 z �� j �k h E d c # � $ � % � E �� � z

" � � �� � � % �# � $ " ' � $ % �a �E � ` � ' d # � " � E � ` � �� � �E �$ � '( u � �" � Ch %k

$ % �a E �$ " � h � E E �& � � %& � � � " � C E �a �E �k $ � �� ' �h % � '� � ��E � �

f(n) = 3f

(

n

2

)

+ cn, c > 0,

�" � Ch � � � � %� � ¤ � � � % C# � � M(n) ≺ f(n) = O(nlog2 3) � &h � log2 3 == 1,585 . . .�� �" � � # " � �" �" � %& � � � " �E � # � �a E � �E " � � � �� " � � � '� " b� � �

$ � �$ � m ' d # � $ %�E �k '" �# � � x=2k jE � # �E �k E �& �# %�E � � �� 'E �& � � � � � j z

' �h �E � y h ' Cc E �& �# %�E � ' U(x)=xA1 +A0

� V (x)=xB1 +B0( B m � %� �

� m �� $ % C# � � � � �h � mE d ` ��� C �$ � 'E d ` � % & � � � " � �$ E � '� E E d `E � �� j zm � �E � � # � $ � %E � r$ %� & � � d c � $ ' �h �E � � j� h � # � C E �a �E �k # � $ � %�

j� h � # � C E �a �E �k � ' d # � $ %�E �k jE � # �E � ` E �& �# %�E � ' �h � � " � ��E � C

M(n) = O(n1+logr+1 2)( �� �" � � # " � jh �$ b logr+1 2→ 0 � � � r→∞(¢ � � m � %� � � � ���� " � 'E d ' E � $ " �k �� � ' �� k k ' %k � " $ k � %& � � � "

x�E c � & � * x" �� $ $ �E � % , 4 5¥ & � h � y � � ` � ��E � C M(n) = O(n log n ×× log log n)

% � �h � � mE � � $ ( � ¤ � &( u � � � �� j m � �E �k # � $ � %E � $ %� & � � d �

�E � $ � � % b j C�" " �c E � � C md $ " � �& � � �� � m �� j � '� E �k n C � b � � �h C % bE Cy

� � � �! �" � � C� � �" � � d � m Ch C" �� $ $ �" ��E d E � a �(

q � 8 � �V � * � (�� � * TX � \�� ) � B j� � %y # �E � � � � � '�h � � ��E � C$ % �a z

E �$ " � � �� �� �� � ' � j '�h �E �k ' $ " � ��E b( l %k ' d # � $ %�E �k $ " � ��E � Na

E � " C �� % bE �� # � $ % � a � ��h $ " � ' %k �" $ k ' ' �h �

a =

k−1∑

i=0

ai2i = (. . . (ak−12 + ak−2)2 + . . . + a1)2 + a0.

Page 7: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

, � �- �5 � �4 � / � �6 � � / 1 � � � � 2 �� 1 � �� / 4 � � �� � � �5 � 0

s� �� � b ' � j '�h �E � � 'h � E E Cy $ " � ��E b �a E �$ ' �$ " � � � �$ %�h � '� " � % bE � z

C ' d � � %E �E � y � �� �� �� `h ' Cc " � � � ' + C E �a �E � y E � N � ' � j ' �h �E � y

'� '� h �� " ( £" $ y h � � � % C# � � " $ k $ %�h Cy �� k � ��E � � $ % �a E �$ " �

O(M(log N) log a) = O(M(n)k).

� �� �" �# � � � � � �" � � � � �� �" � �

8 � � � P� pZ � p ] S Ut V � X � * � U (S � Ch � � m � jE � # � " bE � � m � % b D � `

� m �� `h � % � " � % b# � $ � % A � B# � � � j (A, B)( ¢ � � � E � � # " � � %& � � � "

g '� % �h � j� � %y # � �" $ k ' � �$ %�h � '� " � % bE � ' d � � %E �E � � � �� �� �� � h � z

%�E �k $ �$ " � " � � h � � � % C# �E �k E C %� ' �& � �$ " � " � � ( u C$ " b A>B>0( £ m � z

jE � # � A=r−1 � B=r0

� ri−2=diri−1+ri

� � � i=1, . . . , k � rk−1=dk+1rk(s �&h � (A, B) = rk

� h � � � % C# �E �k �$ " � " � � rk+1 = 0E � � mc �h � � ' d � � % z

E � " b k+

,h � %�E � �(£ ��E � # � $ % �h � %�E � ` � ' d � � %E k � �� ' � %& � � � " � g '� % �h � ( l %k

�" �& � �� $ $ �" � � � �$ %�h � '� " � % bE �$ " b # � $ � % n � m �E � # # � f0, f1, . . .. . . , fk, . . . , &h � f0 = 0 � f1 = 1� fk = fk−1 + fk−2 � k > 2(��� S � �� � k>1� } � � � � � � � � { � � � � � � � � � � { fk >Rk−2 � � �� R= 1+

√5

2

?l �� � j� " � % b$ " ' �( u � � �E � � E h C� �� y � � n( u � � k=2 C" ' � � z

a h �E � � �# � ' � h E �(l� %� � � � $ � � % b j Ck � � �h � � % �a �E � � �E h C� �� � � � � �

fk+1 = fk + fk−1 > Rk−2 + Rk−3 = Rk−3(R + 1) = Rk−3R2 = Rk−1,

" � � � � � Rk ' %k �" $ k � � % �a � " � % bE d � � �E � C �� 'E �E � k x2 = x + 1( ���V � � S % �� � � , e� � &( z �� �� ��{� { � � � ~ �� �� � {� { � � � � � N >0 � � � � {�� � �� � � � � � � { � � � �� = �� � � �� � �� � � � { � �� � �� � � � � { �� �� � { { � �� � {�� � � � � �� � � � � � A � B � 0 < B < A 6 N � � } � � � {� � { ��� � 1 + blogR Nc ?l �� � j� " � % b$ " ' �( l �� � a � �# " � fi6rk+1−i

� � � i=1, . . . , k+2(u � � i = 1 '� �E �( l %k i + 1� '$ � % C � � �h � � % �a �E �k � E h C� �� � � � � � rk−i = dk−i+2rk−i+1 + rk−i+2 > rk−i+1 + rk−i+2 > fi + fi−1 = fi+1.

u � �" � C� A > r−1 > fk+2 > Rk � �" � Ch � � � % C# � � " $ k � $ � � � k � ��E � �

# � $ %� h � %�E � `

k + 1 6 1 + blogR Nc( �¢ � � �$ � �h $ " '�E E � � j �" � `" � � �� d �a E � � � % C# � " b � ��E � C$ % �a z

E �$ " � � %& � � � " � g '� % �h � h %k E � c �a h �E � k E � � m � % b D � & � � m �� & �h � % � z

" � %k h ' Cc n z �� j �k h E d c # � $ � %

O(M(n)(k + 1)) = O(M(n) log n) 6 O(n2 log n).

+� - / � �6 � � /1 � � �� � � � 1 � � � � 4 �� � , �

B �$ " � $ " � � �" C � ��E � C �a E � C" �# E � " b � �$ % � j� �" � " b � # " �

$ % �a E �$ " b � �� �� � � � h � %�E �k C& % � # � $ %� AE � # � $ % � B � 0<B <A � E �

$ � � h � %� � � � " ' � h O(log A(log A − log B + 1))( £" $ y h � � � m � jE � # � k

# � �� j ni

h % �E C j� � � $ � �$ " � " � � ri � i = −1, 0, 1, . . . , k � � � % C# � � m � %� �

" �# E Cy � ��E � C$ % �a E �$ " � � %& � � � " � g '� % �h �k

i=0

O(ni(ni−1 − ni + 1)) 6

k∑

i=0

O(n0(ni−1 − ni + 1)) =

= O

(

n0

k∑

i=0

(ni−1 − ni + 1)

)

=

= O(n0(n−1 − nk + k + 1)) =

= O(n0n−1) = O(log A · log B) = O(n2).

8 � q � � t � S Ut V � X p� £ ��E � � $ % �a E �$ " � � %& � � � " � g '� % �h � E �

k ' %k �" $ k � �" � � % bE � `h %k j� h � # � E � c �a h �E �k E � � m � % b D � & � � m �� & �

h � % � " � %k (iR � � " $ k E �a �$ " ' � �� j % �# E d c �h � � � � � �� ` � %& � � � " � g '� % �h � (  �a E � � E � � � � � � � C �E b D � " b # � $ % � D � & � ' � %& � � � " � � �h � � � � � z

� Ck � %& � � � " $ �� % b y C �E b D �E �k � m$ � %y " E d c jE � # �E � ` �$ " � " � � '( A

� �E E � � m Ch � j� �E k " b �$ " � " �� ri

E � ri−ri−1 � �$ % � ri>ri−1

2

( u � � " � � �

� $ � �� ' %�E � � � � % C# � �" $ k � �$ %�h � '� " � % bE �$ " b# � $ � % � Ch � ' %� " ' � �k y �� k

C$ % � ' � y |ri|< ri−1

2

( s � � # " � � � � �" � E �� �" � � d � � j# � $ � % m Ch C" �" � � z

�� " � % bE d � �E � ' % �k � " E � ' �h � m � �c h � % � " � %� `( B �� j C % b" � " � � � % C# � z

� " $ k � ��E � � # � $ %� h � %�E � `

k+161+blog2 Nc � � � � # � R=1,618 . . .<2(£h E � � � � h � E E d ` � �h c �h E � C % C# D � � " � m � Cy � ��E � C$ % �a E �$ " � �h � z� � � � � � '� E E �& � � %& � � � " � g '� % �h � O(M(log N) logN) = O(M(n)n)�&h � n = log N *h % �E � j� � � $ � # � $ � % A � B(_ C �� $ " ' Cy " � %& � � � " d � '� �" � � d c ' � � m �� E � ' d � � %E k �" $ k � �� z

�� ��k h � %�E �k ( ¢ � � � � � � � ' � %& � � � " � � /� � %��� �� � �� �� �� � 9 �� � �

-� � �� � ���� � �� � & � �� �� � �k h � %�E � k $ �$ " � " � � j� �E �E � E � %� ' d `

$ h ' � & h � % � " � %k $ � �$ %�h Cy � � ' d # � " � E � � � jh � % � �& � � " � � � ` � # " �

� � % C# �E E � k � �$ %�h � '� " � % bE �$ " bE � � � a h � D � & � Ch � ' %�" ' � �k � " C$ % � z

' � y � j � ��h d h C �� & � � %& � � � " � ( Bh � E E � � %& � � � " � ' d � � %E k �" $ k

O(n) D � & � ' � � � a h d ` � j � �" � � d c � � �" $ % �a E �$ " b O(n)� � � �" � C

� m �� k � ��E � � $ % �a E �$ " � � � � " ' �h O(n2)(�� �" � � E � � �E � � � # " � � � � " $ k � % & � � � " E � c �a h �E �k E � � m � % b z

D � & � � m �� & �h � % � " � %k $ � ��E � � `$ % �a E �$ " � O(M(log N) log log N) == O(M(n) log n)� �h E � � � � � & � � � � $ � E � � h �$ " � " �# E � $ % �a E � � jh �$ b

� � � '�h �E �E � m Ch �" %$ ( � ¤ � &(

Page 8: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

, � �- �5 � �4 � / � �6 � � / 1 � � � � 2 �� 1 � �� / 4 � � �� � � �5 � 0

8 � 8 � � S T� � �� � p ] S Ut V � X � * � U (S � v� $ $ �" � � " � �� � b �� $ D � z

��E E d ` � %& � � � " g '� % �h � � � � j ' � %k y � � `E � �k h C$ E � � m � % b D � � m z

� � h � % � " � %� # � $ � % A � BE � c �h � " bE � " C �� % bE d � # � $ %� x � y � Ch � z

' %�" ' � �k y � � � �� ' �E $ " ' C Ax + By = (A, B)( £" � md # E �& � � %& � � � " �

g '� % �h � �E �" % �# � �" $ k " � �# " �E � �k h C$ � �$ %�h � '� " � % bE �$ " by �$ " � " z

� � ' ri

' d # � $ %k y " $ k � �� h ' � '$ � � �& � " � % bE d � � �$ %�h � '� " � % bE �$ " � xi� yi

+

r−1 = A � r0 = B ;

x−1 = 1 � y−1 = 0 � x0 = 0� y0 = 1 ;

��� � i = 0 � � � �

ri > 0

� � � � �

di = bri−2/ri−1c ;

ri = ri−2 − diri−1

;

xi = xi−2 − dixi−1

;

yi = yi−2 − diyi−1

;

i = i + 1 ;

� �

�E � # �E �k xk

� yk � � � � � �" � � d c rk = (A, B) � � m Ch C" � $ � � d � '

$ � % C$ %�h Cy �� & � C" '� � a h �E �k +

��� S � �� � �� �� i� −1 < i 6 k � �> } { �� � �� � � �� � �� � � � {

xiA + yiB = ri.

l �� � j� " � % b$ " ' �( u � � �E � �E h C� � � y � � i( u � � i = −1, 0�� '�E $ " ' � �# � ' �h E �( g$ % � �� ' �E $ " '� h �� � j� E d h %k '$ �c jE � # �E � ` �E z

h �� $ � ' �E b D � c i � " �h %k i � � � % b j Ck $ b �E h C� " � 'E d � ��h � � % �a �E � � �� � % C# � �

xiA + yiB = (xi−2 − diyi−1)A + (yi−2 − diyi−1)B =

= (xi−2A + yi−2B)− di(xi−1A + yi−1B) = ri. �

�� &� � ' �h �" b � # " � $ % �a E �$ " bh � E E �& � � %& � � � " � �" % �# � �" $ k �"

$ % �a E �$ " � � md # E �& � � %& � � � " � g '� % �h � E � m � %� � � # � E � � �E $ " � E " z

E d `$ � E �a � " � % b � � $ �$ " � ' %k �" O(M(log N) log N) = O(M(n)n)� &h �

n = log N *h % �E � j� � � $ � # � $ � % A � B(

� �� �" �# � � � � � �� ! �� � � � �" � � ! � � � !� ��

Ch � �" �a h �$ " ' %k " b � %� �E " d � � % b �� ' d # �" � 'ZN

$ # � $ %� � '

�E " � � '� %� 0 6 A < N( u C$ " b n = dlog2 Ne(

+ �- / � �6 � � /1 � �� � � �5 � 0 � 4 � � �5 � � � �� 1 � � , �

= � � � � U V W�� � * pZ X S� � � u � � $ % �a �E � � # � $ � % ' �E " � � '� %�

0 6 A, B < N$ C � A + B �a � " ' d `" � j� & �� E � �d � E " � � '� %� � � � �" � z

C �a �" � �E � h � m � " b$ k � �� �h E � ' d # � " � E � � A + B −N( AE � % �& � # E � �� � � ' d # � " � E � � �a �" � �" �� m � '� " b$ k � �� �h E �$ % �a �E � � A − B + N(u � �" � C� $ % �a E �$ " b �" �c � �� �� �� ` �� 'E � O(n)(= � q � � � V W�� � � l %k E � c �a h �E �k ' d # � " � � $ � �" '�" $ " ' Cy �� & � � � � z

� j '�h �E � y h ' Cc ' d # �" � ' � E � h � ' d � � %E � " b �h E � C E �a �E � � n z �� j �k h z

E d c # � $ � % � �h E �h � %�E � � 2n z �� j �k h E �& �# � $ %� E � n z �� j �k h E ��( u � z

�" � C� $ % �a E �$ " bh � E E � ` � �� �� �� � �� 'E � O(M(n))(B � E �& �c $ % C# � k c � �$ � m�E E � � � � � � �� �� " E � ` �� � % � j� �� � � %& � � � " z

� ' � Ch � mE � �" � � j� " b$ k �" � �� �� �� ` C E �a �E � k � h � %�E �k � j� �E � " b

�c � �� �� �� k � $ % �a �E �k ( £h �E � j" � � �c � % & � � � " � ' � � ��h % �a �E E d `

u( �(   �E " & � � � � ' , 4 e2 &( � $ �$ " � � " '$ %�h Cy �� ( u C$ " b N *E �# �" z

E �� # � $ % � � " �� m C� " $ k C E �a � " b ' d # �" d A =n−1∑

i=0

2iai

� B( v� $ $ �" � �

� %& � � � " R � ¥ ;

��� � i = 0 � � � �

i < n

� � � � �� �

ai = 1

� � � � R = R + B ;

� �

R *E �# �" E � � � � � R = R + N ;

R = R/2 ;

� �

� �

R > N

� � � � R = R−N(

_ C" bh � E E �& � � %& � � � " � '" � � # " � '$ � % C �� '�E $ " '�

A =

n−1∑

i=0

2iai = (. . . (2an−1 + an−2)2 + . . . a1)2 + a0

C E �a �E � � # � $ %� BE � # � $ % � A$ ' �h � " $ k � ' d # � $ %�E � y ' d �� a �E �k

AB = a0B + 2(a1B + . . . 2(an−2B + 2an−1B) . . .).£E � ' d � � %E k � " $ k j� n D � & � ' � E � � � a h � � j� �" � � d c �$ C �� $ " ' %k �" $ k

� � � m� ' %�E � � � " �� C �� C jE � # �E � y R jE � # �E �k aiB � i = 0, . . . , n − 1�$ � �$ %�h Cy � � h � %�E � � E � ¤( %� & �h � �k �" � Ch � %�E � y � � % C# �E z

E d � jE � # �E �k '$ � &h � E � c �h k " $ k ' � E " � � '� %� 0 < R < N( B �� j C % b" � " �

�� m �" d h � E E �& � � %& � � � " � � � % C# � � " $ k # � $ % � 2−nAB mod N( s� �� � b

h %k � � % C# �E �k # � $ %� AB mod NE � � mc �h � � � � � �E � " b � �� �h �E �� j

Page 9: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

, � �- �5 � �4 � / � �6 � � / 1 � � � � 2 �� 1 � �� / 4 � � �� � � �5 � 0

h � E E d ` � %& � � � " � # � $ %� 22n mod N � 2−nAB mod N( u �$ � � % b� C

# � $ % � 22n mod N ' d # � $ %k � " $ k $ � � � � b y $ h ' � & � ' � ' d # � " � E � ` $ �

$ % �a E �$ " by O(n2)h ' � �# E d c � �� �� �� ` % � & � �a E � ' d # � $ % � " b j� �� z

E � � � c �� E � " b � � % C# �E E �� jE � # �E � � & � � � %& � � � " " � � a � ' d � � %E k �" $ k

j� O(n2) � �� �� �� ` � " � � m �� k " � Ch �� � �$ " b ' d # � $ %�E �k � � � � j '�h �E �k

� ��E � '� � " $ k ' � % �# �E � `

O(n2)h ' � �# E d c � �� �� � � `(

= � 8 � P� � S ��� � � l %k j� h � E E �& �# � $ %� A � 06A<N �E � c �h � $ � � � z

� by �� $ D � ��E E �& �� %& � � � " � g '� % �h � # � $ %� x � y � Ch � ' %�" ' � �k y � � �

�� '�E $ " ' C xA+yN =(A, N)( g$ % � (A, N)>1� " � AE � � � �" � m �� " E �& �(g$ % � a � (A, N) = 1 � " � '� � # �$ " '� � m �� " E �& � �a E � ' jk " b x mod N(s� � � � m �� j � � � m �� ��E � � ' � � % b �� ' d # �" � ' �a E � ' d � � %E � " b j�

O(M(n)n)

m � " � ' d c � �� �� � � `(

= � = � � U �� � � s� � � � � A/B = A 1B

� " �h � %�E � � ' � � % b �� ' d # �" � '

' d � � %E k �" $ k " � � a � $ �$ % �a E �$ " by O(M(n)n)(

���� � � � �" � � �� �� ! � �� " �� � � � �� !� �

: � � � u � � ' d # � $ %�E �k c $ �� %d � # � $ %� � # � $ " � � � � �E k �" $ k $ %� z

h Cy �� ` � � � � ( g$ % � � j ' �$ " E � � # " � � $ c �h E d � # � $ %� � �� j C % b" � " d ' d z

# � $ %�E � ` �& �� E �# �E d E �� �" � � d # � $ % � M

% � � � �" � h � � C$ � � y " $ k

E � �� ' �E $ " '� h ' Cc ' �h � ' 0 6 N < M � % � −M/2 < N < M/2

& � " � ' d # � $ z

%�E �k �a E � � � � � j ' �h � " b '� � % b �� ' d # �" � '

ZM � �" �a h �$ " ' %k k # � $ %�

� j C� � j� E E d c �E " � � '� % � ' � $ � �" ' �" $ " ' Cy � � � ' d # � " d ( _� �# � $ % � M �a E � ' d m � �� " b �� j % �# E d � $ � �$ � m� � � � � �# � � & � ' d m � � ' � E �& �

� � ��h � %k � " $ % �a E �$ " b ' d # � $ %�E � `(¢ � � m � %� � � � ���� " � 'E d " � � � ` �� ��c �h k ' %k �" $ k '$ % C# � � � � �&h �

# � $ % � M � ��h $ " � ' � � ' ' �h � � � � � j ' �h �E �k E � m � % b D �c ' j� � E � � � � z

$ " d c # � $ � % M =m1m2 . . . mk � � �$ � � % b� C ' �" � $ % C# � � �a E � ' �$ � � % b z

j � '� " b$ k � j � � � � � j � � � %� �

ZM∼= Zm1

+ Zm2+ . . . + Zmk

.

u � � �" � $ � �" ' �" $ " ' � � � � a h � C# � $ % C u � j �E " � � '� %� 06u<M$ � z

�" '� " $ " ' C� " E � m � � (u1, u2, . . . , uk)� &h � ui=u mod mi � i=1, . . . , k( % �h �$ b

� h � %� � j� � � $ b u mod m � ' �" % �# � � �" j� � � $ � � �� ' � `# � $ " � $ �� 'E �E �k

u (mod m)� � m � jE � # � �" E � � �E b D � `E � �" � � �� " � % bE d ` �$ " � " �� �" h � z

%�E �k # � $ %� uE � # � $ % � m( & Bh � E E � $ % C# � � ' �$ " � ' d # � $ %�E � `$

� $ c �h E d � # � $ %� � �a E �$ E � # � %� �� � � `" � � �c �$ " � " � � � � � � � j z

' �h � " b '$ � ' d # � $ %�E � k '� � % b �� c

Zmi

� i = 1, . . . , k � � j� " � � � � % C# � '

�� j C % b" � " � ' d � � %E � " b � m �� " E d ` �� � �c �h � ' �$ $ " � E � ' � " b � � �$ " � " � �

� $ � � �� # � $ % �(

+ �- � /� � � � � � � � �� � � � 3 � � � � 0 � � � 2 �� 1 � 4 � , 7

: � q � l %k ' d # � $ %�E �k E � m � �� (u1, u2, . . . , uk) � �# � $ % C uE C a E � ' d z

� � %E � " b kh � %�E � `# � $ %� uE � # � $ %� mi � i=1, . . . , k( g$ % � '$ � # � $ %� mij� � � $ d '� y " $ k $ � � � � b y bh ' � �# E d c jE � � � ' � " �# � $ % � u j� � � $ d '� � " z

$ k $ � � � � by kbh ' � �# E d c jE � � � '( _ % �a E �$ " bh � %�E �k kb z m � " � ' �& �

# � $ %� E � b z m � " � ' �� �� 'E � O(kM(b)) � � � �" � C$ % �a E �$ " b �� ��c �h � � �� z

E � '� � " $ k ' � % �# �E � `

O(k2M(b))(w" C � ��E � C �a E � C % C# D � " b � � $ % � � � � �E � " b" �c E � � C� �� jh � %k `

� ' %� $ " ' C `� � �� j m � " b � � � �� $ $ ' d # � $ %�E � `E � h '� �" � �� ( u C$ " bh %k

� � �$ " �" d ' d � � %E k �" $ k �� '�E $ " ' � k = 2t( ¢ � �� � ' � �" � �� � �$ %�h � '� z

" � % bE �E � c �h k " $ k � � � � j ' �h �E �k # � $ � %

m1m2, m3m4, . . . , mk−1mk,

m1m2m3m4, . . . , mk−3mk−2mk−1mk,

( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( (

m1m2 . . .mk/4, . . . , m3k/4+1 . . . mk,

m1m2 . . .mk/2, mk/2+1 . . . mk.

¢ � '" � � � �" � �� ' d � � %E k y " $ k h � %�E � k

u11 = u mod (m1m2 . . .mk/2), u12 = u mod (mk/2+1 . . . mk/2),

u21 = u11 mod (m1m2 . . . mk/4), . . . , u24 = u12 mod (m3k/4+1 . . .mk/2),

( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( (

ut−1,1 = ut−2,1 mod (m1m2), ut−1,2 = ut−2,1 mod (m3m4), . . .

. . . , ut−1,k/2 = ut−2,k/4 mod (mk−1mk),

u1 = ut−1,1 mod m1, u2 = ut−1,1 mod m2, . . . , uk = ut−1,k/2 mod mk.

�� &� � ' �h � " b � # " �h %k ' d � � %E �E � k �� � ' �& � �" � �� " �� m C�" $ k

2t−1M(b) + 2t−2M(2b) + . . . + 2M(2t−1b) = O(tM(kb))

h ' � �# E d c � �� �� �� `( ¢ � '" � � � �" � �� " �� m C� " $ k ' d � � %E � " b

2M(2t−1b) + 22M(2t−2b) + . . . + 2t−1M(b) = O(tM(kb))

h ' � �# E d c � �� �� �� `(s� � � � m �� j � � � m �� k � ��E � � $ % �a E �$ " � � � � " ' �h O(M(kb) log k)h ' � �# E d c � �� �� �� `(

Page 10: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

, � �- �5 � �4 � / � �6 � � / 1 � � � � 2 �� 1 � �� / 4 � � �� � � �5 � 0

l %k ' d � � %E �E �k � m �� " E �& � �� ��c �h � �" E � m � �� # � $ � % (u1, u2, . . . , uk)� # � $ % C u � � � �E k � " $ k � � " � `$ � � k " � � � � � � m �$ " � " � � c (��V � � S � �~ � � � M = m1m2 . . . mk � � �� � � � � � mi

} {} � �� { �� � � �� {} � {� � > � �

ci = m1 . . .mi−1mi+1 . . . mk = M/mi,

di = c−1i mod mi,

i = 1, . . . , k ? �{� �� � � ��� � � � � � � � �> � � � �� �� � �

u≡ ui (mod mi), i = 1, . . . , k,

�~ ��� � �~ �� � { �� {� � � �� { } { � { �~ �� M � � � � { ��� � � � } { � { � �~ � �

u =k

i=1

cidiui mod M.

l �� � j� " � % b$ " ' � %� &� � ' d " �� � �" � j$ %�h Cy � �c $ ' � `$ " ' ' d zm �� E E d c # � $ � % +

cidi ≡ 0 (mod mj)

� � � j 6= i,

cidi ≡ 1 (mod mi), i, j = 1, . . . , k. �

l %k ' d # � $ %�E �k jE � # �E �k u � �h � E E � ` � � � C %� " �� m C�" $ k

k∑

i=1

(O((k − 1)M(b)) + TXEA(b)) + M(kb) =

= O((k2M(b) + kTXEA(b) + M(kb))) =

= O(k2M(b) + kTXEA(b))

h ' � �# E d c � �� �� �� ` � &h � # � �� j TXEA(b) � m � jE � # �E � $ % �a E �$ " bE � c � z

a h �E �k � m �� " E �& � � %� �E " � '� � % b ��

Zmi

� log mi=b �$ � � � � by �� $ D � z

��E E �& � � %& � � � " � g '� % �h � ( s � Ch �� � �$ " b �a E � C �E b D � " b � �$ % �

� E � % �& �# E � � � �h d h C �� C$ % C# � y ' �$ � � % b j � '� " b$ k " �c E � � � `� �� jh � z

%k ` � ' %� $ " ' C `� � � � � �E k k � � a h d ` �� j � E � % �& h � E E � ` � � � C %d � � �

k = 2( B �" � $ % C# � � � � % C# � �" $ k � ��E � � O(M(kb) log k + kTXEA(b))(_ C �� $ " ' C�" � h � C& � k � � � C %� h %k ' d # � $ %�E �k # � $ %� u�

u = q1 + q2m1 + q3m1m2 + . . . + qkm1 . . .mk−1,

+ �- � � �� / �� �� � / � � �� � � �� � � �� , �

&h � # � $ %� q1, q2, . . . , qk

' d # � $ %k y " $ k ' � � � �� $ $ � ' d � � %E �E �k $ %�h Cy z

�� & � � % & � � � " � +

c = 1 � u = u1 mod m1

;

��� � i = 1

� � k − 1

� � � � �

c = c ·mi

;

d = c−1 mod mi+1

;

q = d(ui+1 − u) mod mi+1

;u = u + qc ;

� �

�� � � � � %u &(

l �� � j� " � % b$ " ' �� � � ��� " E �$ " � h � E E �& �� %& � � � " � E � c �a h �E �k # � $ z

%� u � � � ' �h � " $ k $ � � � � by �E h C� �� � � � ��h %� & � �" $ k ' d � � %E � " b '

� � # � $ " ' � C � �� a E �E � k (� �" k " � Ch �� � �$ " b ' d # � $ %�E �k � � �" � ` � � � C %� " � � � k a � � � � �

� h %k � $ c �h E � ` � � � C % d � � � � ' �h �E E � ` ' " � � � � � � � $ �$ " � ' %k �"

O(k2M(b) + kTXEA(b))h ' � �# E d c � �� �� �� ` � h � E E � k � � � C %� ' � E � z

& �c $ % C# � k c �� � j d '� �" $ k m � %� � Ch � mE � `( w" � ' d j '� E �" � �# " � � � � �� $ $

' �$ $ " � E � ' %�E �k �� D �E �k $ � $ " � d

u≡ ui (mod mi), i = 1, . . . , k,�$ C �� $ " ' %k �" $ k ' E � ` � �$ %�h � '� " � % bE � + $ E � # � %� h %k �� � ' d c h ' Cc

$ �� 'E �E � ` � j� " � h %k �� � ' d c " � �c � � " � � h � %� � h � � � % C# �E � k � m �� z

& � � � D �E �k ( g$ % � � $ � $ " � � h � m� ' � " b � �� �h E � $ �� 'E �E � � � " �c �h

' d # � $ %�E � `E � � j �E � " $ k � � E � h � m Ch �" ' d � � %E � " b '$ � & � �h �E h � � � % z

E � " � % bE d ` D � &( B" � a � ' �� k '$ % C# � � � $ c �h E � ` � � � C % d h � m� ' %�E � �

� �� �h E �& �$ �� 'E �E �k � � %E �$ " b y �E k � " $ c � C ' d # � $ %�E � `(

���� � � � �" !� � � � � � � �" !� �  � a h C ' d # � $ %�E � k � ' � � % b �� E �& �# %�E � 'E � h � � � � j ' � % bE d

� � % b � � R � '� � % b �� �� %d c # � $ � % � j� � � $ � E E d c '� � � � ` z % � m �$ � $ " � �

$ # � $ %�E �k � E �& � � m �� & �( £E � ' d � � %E k y " $ k � � � �c �a � � � � C %� �� �" % �# � � j� � %y # � �" $ k % � D b '" � � # " �h %k # � $ � %E � � mc �h � � C# � " d z

'� " b jE � � � �� � �E �$ � �" %� h D �c �� j �k h � '� $ " � � D � � '" � ' � � k � � �

'$ % C# � � E �& �# %�E � 'E � � � � � c �� ��E �$ � ' � � � � �� �� � �k c $ � � � � � � �� z

�E " � � E �& �# %�E � 'E � ' � jE � � � �" * � � $ c �h E d � '� % �# �E d � jE � # �E �k

%� a � " '� � % b �� R( u � �" � C ' d # � $ %�E �k $ E �& �# %�E � � '# � z" �h � a �

� � � �� � # � ' d # � $ %�E �k $ �� %d � # � $ %� �)(

Page 11: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� � �- �5 � �4 � / � �6 � � / 1 � � � � 2 �� 1 � �� / 4 � � �� � � �5 � 0

_ % �a E �$ " b � �� �� �� ` $ E �& �# %�E � � � m!d # E � � ��E � '� y " � � % � z

# � $ " ' � � � � �! �" � # �$ � �c � �� �� � � `� � % b �� R � ' d � � %E k � d c E � h � & �

� � � � � � �� �E " � �)( g$ % � � j '� $ " E � m � " � '� k $ % �a E �$ " b � �� �� �� ` ' � � z

%� � " � �a E � " � � a � � ��E � " b �� j C % b" � � Cy � Cy m � " � ' Cy $ % �a E �$ " b

� �� �� �� ` $ E �& �# %�E � �)( �" � m!d �" % �# � " b � � � �! � " �# � $ � Cy $ % �a z

E �$ " b �" m � " � ' � ` ' � ��E � � c d m Ch � � $ � � % b j � '� " b$ � ' � %d OA( )� OB( )(� pZ T U �� � �� SZ �� ] � V t V Z U �� V * � u C$ " b R * � � � � j ' � % bE �� � � % b z

� �( v� $ $ �" � � c � � �D � � j '�$ " E d ` � %& � � � " v C � � � E � * � � �E � �� h %k

' d # � $ %�E �k jE � # �E �k E �& �# %�E �

f(x) = anxn + an−1xn−1 + . . . + a1x + a0

E � h � � % b � � R '" �# � � x=b( £E �$ E � '� E E � $ %�h Cy �� � ��h $ " � ' %�E � �

E �& �# %�E �

f(x) = ((anx + an−1)x + . . . + a1)x + a0

� j� � %y # � �" $ k ' � �$ %�h � '� " � % bE � ' d # � $ %�E � � jE � # �E � `

p0, p1, . . . , pn� � � � � C %�

p0 = an,

pi = pi−1b + an−i,

i=1, . . . , n( u �$ %�h E � � # � $ % � pn

� m Ch �" � $ � � d jE � # �E � � E �& �# %� z

E � ( A � � �! �" �# �$ � � k $ % �a E �$ " b � %& � � � " � � �# � ' � h E � � �� 'E � OA(n)( � " � ' Cy $ % �a E �$ " b '$ % C# � � � � �&h � '� � # � $ " ' � � � % b �� R �� $ $ � " � � z

'� �" $ k � � % b � � �� %d c # � $ � % � �a E � � ��E � " b ' d �� a �E � � OB(nml) � &h �

# � �� j m � m � jE � # �E � � $ � C � jh ' Cc # � $ � % +# � $ %� h ' � � # E d c jE � � � '

' j� � � $ � E � � m � % b D � & �� � � � � � �� �E " � � # � $ %� b � � # � $ % � l = (n + 2)m� m � jE � # � �" # � $ % �h ' � �# E d c jE � � � ' ' j� � � $ � E � � m � % b D � & � � j# � $ � % pi �i = 1, . . . , k( s� � � � m �� j � � � � % C# � � " $ k � ��E � � OB(n2m2)(A % & � � � " v C � � � E � * � � �E � �� � � j ' � %k � " � � % C# � " bE � " � % b� � jE � z

# �E � � f(b) = pn( r� � � �� � j d '� � " $ %�h Cy �� k " � � �� � � ' � % � # �E d

p0, p1, . . . , pn−1

k ' %k y " $ k ' " �# E �$ " � � � � � � � � � �E " � � E �& �# %�E � �k ' %k y �� & �$ k �$ " � " � � �" h � %�E �k E �& �# %�E � f(x)E � (x− b)(��V � � S � �} �� � � � � � � { � � � � � � � � {

f(x) = (x− b)

(n−1∑

i=0

pn−i−1xi

)

+ f(b).

+ 7- � / 4 � � 1 � � � � � � �� � � � � � � �� � 2 3 � � � � ,

l �� � j� " � % b$ " ' �( iR � �

(x− b)

(n−1∑

i=0

pn−i−1xi

)

+ f(b) =

=

(n−1∑

i=0

pn−i−1xi+1

)

−(n−1

i=0

pn−i−1bxi

)

+ f(b) =

=

( n∑

i=1

pn−ixi

)

−(n−1

i=0

pn−i−1bxi

)

+ f(b) =

=

n∑

i=1

(pn−i − pn−i−1b)xi − pn−1b + f(b) =

=

n∑

i=1

aixi − pn−1b + (pn−1b + a0) =

=

n∑

i=0

aixi = f(x).

s� � � � � h �� � j� E � ( �

��� � � � !� � � ! � ! � � � � �� �� ! � � � !

?� � � u C$ " b R *� � C" � " � 'E �� � � % b � �$ �h � E � �� `( s �&h � � %� �E " ω� � % b �� RE � j d '� �" $ k } � � � � � � �� > �� { �� � �� � � } � � � n �� � ��� � �� > �� $ % � ' d � � %E k y " $ k $ ' � `$ " '� +

,( ω 6= 1 ;¤( ωn = 1 ;

f ( n−1∑

j=0

ωij = 0 � 1 6 i < n(

g$ % � � � � � � " �& � � � %� �E " nk ' %k � " $ k � m �� " � d � %� �E " � � � % b z

�� R � " � �a E � � � � �h � % � " b ��� �� � � � � { � } � � { ��� �� { �� � � � �~ �� � � � �

�" � m �� a �E � � � � �" � � �� � � a h � C ' �� " � � C a = (a0, a1, . . . , an−1)� ai ∈ R �

0 6 i 6 n− 1$ " � ' � " '$ � �" ' �" $ " ' � � ' �� " � � F (a) = b = (b0, b1, . . . , bn−1) �&h �

bi =

n−1∑

j=0

aiωij , 0 6 i 6 n− 1.

Page 12: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� � �- �5 � �4 � / � �6 � � / 1 � � � � 2 �� 1 � �� / 4 � � �� � � �5 � 0

� ���� � � { � ��� �� � �� � { � } � � { ����� { �� � � � �~ �� � � � ��h � %k �" $ k � � �

F−1(b) = c� &h � � � � �h �E � " d ' �� " � �� c �� 'E d

ci =1

n

n−1∑

j=0

biω−ij , 0 6 i 6 n− 1.

s � � # " � � �k �� � � m �� " E �� h � $ � �� " E d � � �� � m �� j � '� E �k n C � b � ' j� z

� E � � m �� " E d %" ( �( F−1(F (a)) = a� F (F−1(b)) = b

& � %� &� �$ %�h C�" � j

� � ��h � %�E �k � � � � " � 'E �& �� � �E k (�� �" � � # " � �$ % � '�� " � � C a � �$ " � ' � " b '$ � �" ' �" $ " ' � � E �& �# %�E

f(x) =n−1∑

i=0

aixi � " � � �k �� h � $ � ��" E �� � �� � m �� j � '� E � � n C � b � $ � �" '� " z

$ " ' C�" ' d # � $ %�E � y jE � # �E � ` E �& �# %�E � '" �# � � c ωi � 0 6 i 6 n − 1�� � m �� " E �� * �E " � � � � %k �� � E �& �# %�E � � � � & � jE � # �E � k ' �" �c " �# z

� � c ( s � � # " �h � E E d � " �# � � � m �� j Cy " �� � % �# � $ � Cy C % b" � � % � � � " � ' z

E Cy � �h & � C � � C ' R � � � j ' � %k �" � �$ " � � � " b md $ " � d ` � % & � � � " ' d # � $ z

%�E �k jE � # �E � k � � � � �k �& � � " � � � � m �� " E �& �h � $ � �� " E �& � � � � � m �� j � z

'� E �k n C � b�(

?� q � u � � ' �h � � % & � � � " ' d # � $ %�E �k � �� � m �� j � '� E � k F (a)

%� %& � z

� � " h %k ' d # � $ %�E � k F−1(b)$ " � � � " $ k � E � % �& �# E � & � E � j d '� � d ` � � �� { � � � � { � �> � � � {� { } � � { ��� �� { �� � �� �~ �� �( l %k � � �$ " �" d � � %� & � � �# " � n = 2k( ¢ � � � E � � # " � jE � # �E � � E �& �# %�E � f(x) '" �# � � x = ωi

$ � ' �� h � �" $ �$ " � " � � �" h � %�E �k E �& �# %�E � f(x)E � E �& �# %�E x−ωi �

06 i6n−1( u � � �" � E �& �# %�E d x−ωi � 06 i6n−1 � � �� �E � ' j� � E �

� � �$ " d � �c � � � � j '�h �E � � �� 'E � xn − 1( u � �" � C �a E � � � � �E � " b

� �h c �h � � �" � � d ` �� $ $ � " � � '� %$ k ' �( 2 ( ¤ � � � E � c �a h �E � � jE � # �E � `

�$ " � " � � ' �" h � %�E �k � %� �E " � E � ' j� � E � � � �$ " d � �h C % �)(�� �" � � # " � ωn/2 =−1 � � � �" � C

xn − 1 =(

xn/2 − 1)(

xn/2 − ωn/2)

.

l� %� �

xn/2 − 1 =(

xn/4 − 1)(

xn/4 − ωn/2)

,

xn/2 − ωn/2 =(

xn/4 − ωn/4)(

xn/4 − ω3n/4)

.

u � �h � % a � � �" �" � � � �� $ $ h � � � % C# �E �k % �E � `E d c $ � E �a � " � z

%� `

x − ωi( s� � � � m �� j � � E � c �a h �E � � �$ " � " � � ' �" h � %�E � k E � z

& �# %�E � f(x)E � x−ωi � 06 i6n−1� �a E � � � � ' �$ " � $ � $ � � % b j � '� E � �

+ 7- � / 4 � � 1 � � � � � � �� � � � � � � �� � 2 3 � � � � �

" �c E � � �� �� jh � %k ` � ' %� $ " ' C `� � C" � h � %�E � k f(x)$ E � # � %� E � E � z

& �# %�E d xn/2 − 1 � xn/2 − ωn/2 � j� " � � � a h d ` � jh ' Cc � � % C# �E E d c

�$ " � " � � 'h '� �� j� h � % � E � E �& �# %�E d ' �h � xn/4−ωjn/4 � � " � � h � %� �(��� S � �~ � � �

f(x) =

n−1∑

i=0

aixi

� c ∈ R ? �{� �� {� � � � {� {� �� � � � �� f(x)� � (xn/2 − c) � � � ��

r(x) =

n2−1

i=0

(ai + cai+ n2)xi.

l �� � j� " � % b$ " ' � ' d " �� � �" � j �� '�E $ " '�

f(x) = (xn/2 − c)

n2−1

i=0

ai+ n2xi + r(x). �

i j �" � ` %� d ' d " �� � � " � # " �h %k ' d # � $ %�E �k '�� " � �� � � � � � � z

�� �E " � ' �$ " � " � � E � h � �� jh � % � " b ' �� " � �� � � � � � �� �E " � ' E �& �# %�E �

f(x) � � � � %� � j� " � C E �a � " bE � c� � � � � � �� �E " d '" � � � ` � � % � ' � z

E d � $ % �a � " b �c $ � � � � � � �� �E " � � �� � ' � ` � � % � ' � E d ' �� " � �� ( w" �

" � � m C�" ' d � � %E �E �k E � m � %� � n � � � �! �" �# �$ � �c � �� �� �� `� � % b �� R(B �� j C % b" � " � � � % C# � � �# " �h %k ' d � � %E �E �k '$ � & �� %& � � � " � E � h �

' d � � %E � " bE � m � %� �

n + 2n

2+ 4

n

4+ . . . + 2k n

2k= kn

� � � �! �" �# �$ � �c � �� �� �� `� � % b �� R � " ( �( $ % �a E �$ " b � %& � � � " � md $ " z

� �& � � �� � m �� j � '� E �k n C � b� �� 'E � O(n log n)(?� 8 � %� & �h � �k � %& � � � " C md $ " � �& � � �� � m �� j � '� E �k n C � b� h � $ z

� � �" E �� � �� � m �� j � '� E � � n C � b� k ' %k � " $ k �# �E b Ch � mE d �E $ " � C �E z

" � � � � � � � '�h �E � � ' d # � $ %�E � `$ E �& �# %�E � �)( s� � � E � � � � � � � $� & � � � � � b y �a E � ' d # � $ %k " b � � � � j '�h �E � � E �& �# %�E � '$ �$ % �a z

E �$ " b y O(n log n)

% ' d � � %E � '$ E � # � %� � �� � m �� j � '� E � � n C � b� � � � % C z

# � ' jE � # �E �k E �& �# %�E � ' '" �# � � c � j� " � �� � � E �a � ' � � % C# �E E d �

jE � # �E �k � � E � � �E � � � '� �E C" b$ k � � � � � � � �� �E " � E �& �# %�E � $ � � z

� � by � m �� " E �& � � �� � m �� j � '� E �k n C � b� &( £h E � � � � �E � � m %� h � � " " �

E �h �$ " � " � � �# " �h %k $ C ��$ " ' � '� E � k � �� � m �� j � '� E � k n C � b � E � h � � % b z

� � R" �� m C�" $ k ' d � � %E �E � � h ' Cc C$ % � ' � ` +$ C ��$ " ' � '� E � k � � � � " � ' z

E �& �� � �E k $ " � ��E � n � � m �� " � �$ " � # � $ %� n '� � % b �� R � � �" � C$ % � ' �k

Page 13: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� � �- �5 � �4 � / � �6 � � / 1 � � � � 2 �� 1 � �� / 4 � � �� � � �5 � 0

' d � � %E k y " $ k h � %�� �E � '$ � &h � ( r � � � " �& � � � � � $ %�h C� " � j � %& � � � " z

� m!d $ " � �& � � � � � m �� j � '� E �k n C � b � � a � %� " � % bE � �# " � md # � $ % � n m!d % �

E �� �" � � � `$ " � ��E b y # � $ %� 2(u � � ' �h � �h �E � �h c �h � � � j ' � %k y �� ` � � ���� " � 'E � � � � �E k " b

m!d $ " � �� � �� � m �� j � '� E � � n C � b � '� � % b �� �� %d c # � $ � %( g$ % � � j '� $ " E � �# " �� � � � � � �� �E " d E �& �# %�E � ' �& �� E �# �E d E �� �" � � d # � $ % � M � " �

' d # � $ %�E �k �a E � � � � � j ' �h � " b '� � % b �� ' d # � " � '

ZM � �" �a h �$ " ' %k k

# � $ %� � j C� � j� E E d c � E " � � '� % � ' � $ � �" '� " $ " ' Cy �� � ' d # �" d ( u �$ � � % b z

� C � � � �" � # � $ % � M �a E � ' d m � �� " b �� j % �# E d � $ � �$ � m� � � " � d

m Ch � � $ � � " b" � � � � # � $ %� M �h %k � �" � � d c # � $ % � n=2k � � � � � � " �& � �'� � # � $ " ' � � � � � " � 'E �& � � %� �E " � ω �a E � ' d m �� " b" � � a � E �� �" � z

� Cy $ " � ��E b# � $ %� 2( w" � � � j ' � %k �" �# �E b � � ���� " � 'E � �� � % � j � '� " b

m!d $ " � �� � � � � m �� j � '� E � � n C � b � E � w B   � &h � � $ � � % b j C�" $ k h ' � �# E ��

� � �h $ " � ' %�E � � # � $ � %(��V � � S � =� � � n = 2k � ω = 2q 6= 1� � { } � � M =ωn/2 + 1 � � � � �� � n� � �� � � � � { ���� � � �> � � � � � �� � { �� { �� � �

ZM � � � � � ��� � ω �} � � � � �� � �� > �� { �� � � �� � ��� � �� > � � � } � � � n ?¢ � � �" �� m Cy " $ k h '� %� d (��� S � � �� { � �~ � � � � �� { �� { �� � � � � ��� � �� � � � �� �� � {� { � � � �� �� � � a � n = 2k �> } { �� � �� � � �� � �� � � � {

n−1∑

i=0

ai =k−1∏

j=0

(1 + a2j

).

l �� � j� " � % b$ " ' �( u � � �E � � E h C� �� y � � k( u � � k = 1 �� z

' �E $ " ' � �# � ' �h E �( g$ % � �E � ' � �E � � � � k − 1 � " � � � � k � � % C# � �

n−1∑

i=0

ai = (1 + a)

n2−1

i=0

a2i.

u � � ��h � � % �a �E � y �E h C� �� � � � % C# � �

n2−1

i=0

a2i =

k−2∏

j=0

(1 + (a2)2j

) =

k−1∏

j=1

(1 + a2j

),

# " � � " � � m � '� % �$ bh �� � j� " b(��� S q � �� � M = ωn/2 + 1 � 0 6= ω ∈ R � � �� �� �� 1 6 i < n � �� � �

n−1∑

j=0

ωij ≡ 0 (mod M).

+ 7- � / 4 � � 1 � � � � � � �� � � � � � � �� � 2 3 � � � � �

l �� � j� " � % b$ " ' �( _ �& %� $ E � %� � ,h �$ " � " �# E � � �� � j� " b �# " � � � � '$ �c 1 6 i < nE � `h �" $ k j" � � �� � # " �1 + ωi2j ≡ 0 (mod M).

g$ % � i = 2st� &h � tE �# �" E � � " � � � %� & � � j = k − 1− s( s �&h �

1 + ωi2j

= 1 + ω2k−1t = 1 + (ωn/2)t ≡ 1 + (−1)t ≡ 0 (mod M),

" � � � � � tE �# � " E �(B � �E � $ k � h �� � j� " � % b$ " ' C" � � � � d ( w %� �E " n � m �� " � � " � � � � �

# � $ %� n=2k � M=ωn/2+1=2qn/2+1 ' j� � E � � � �$ " d ( w %� �E " ω=2q 6=1 �� � �# � ωn/2=−1+M≡−1 (mod M)( £" $ y h � ωn≡1 (mod M)( ¢ � � �E � � �%� � ¤ & � �� E " � � C�" ' d � � %E �E � � " ��" b � & � C$ % � ' �k �E � � mc �h � �& �h %k

� � � � " � 'E �$ " � � � �E k � j �h �E � �d ( s� � �� � h �� � j� E � ( �

Page 14: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� ��� � I L� L M � � � L �� N N N � L I

���� � !� ! ��� � ! � � � � � � ��� � � �

� � � �¢ � � � E � � # " � � % & � � � " g '� % �h � h %k E � c �a h �E �k E � � m � % b z

D � & � � m �� & �h � % � " � %k # � $ � % A � B � A > B � j� � %y # � �" $ k ' � �$ %�h � z

'� " � % bE � ' d � � %E �E � � � �� �� �� � h � %�E �k $ �$ " � " � � � � � �E � " � % bE �

� � �$ %�h � '� " � % bE �$ " � # � $ � % A = r−1, B = r0, r1, r2, . . . , rk

h � � � % C# � z

E � k E C %� ' �& � �$ " � " � � rk+1 = 0� &h � ri−2 = diri−1 + ri

� � � i = 1, . . . , k� rk−1 = dk+1rk( s �&h � (A, B) = rk( v� $ $ �" � � " � �� � b � � % C# � y � Cy z

$ k 'h � E E � � %& � � � " � � �$ %�h � '� " � % bE �$ " b d1, d2, . . . , dk+1( ¢ �" � Ch E �

' �h �" b � # " � �" � # � $ %� Ch � ' %�" ' � �k y " �� ' �E $ " ' C

A

B= d1 +

1

d2 +1

d3 +1

. . . +1

dk+1l %k � �� " � �$ " � m Ch � � m � jE � # � " b � �� ' Cy # � $ " b �" �& � ' d �� a �E �k

# � �� j [d1, d2, . . . , dk+1]

� E � j d '� " bE � � �� � d 'E � ` % � % � �� �E � ` &h � � m by (¢ � � �� � d 'E d � h � � m � � �k ' � % � $ b ' � " � � " � � � � �� ' �� . '( x � � � z

� �� �� $ � � �$ " �� E �E � � �E � � � % C# � % � � �$ %� �� m �" �( �y `& �E $ � % �� . . '( & �� �" � � d ` � � � �E k % � c h %k � �h m � �� j C m# � " d c � � %� $ � $ j� h � E E d �� �� z

h � " �# E d �" E �D �E � � ( s� � � �k E � � �� � d 'E d c h � � m� ` m!d %� $ � $ " � � " � z

# � $ � � �� j �� m �" � E � �( w ` %� � � � � j� " � �( �� & �� E a � (£" � " � � � �$ " � `D � � $ ' � `$ " '� " � � �c h � � m� `(l %k %y m �& � n � %y md c E � " C �� % bE d c d1, d2, . . . , dn

$ � �� '�h % � ' d

�� '�E $ " '�

[d1, d2, . . . , dn] = d1 +1

[d2, . . . , dn];

[d1, d2, . . . , dn] =

[

d1, d2, . . . , dn−2, dn−1 +1

dn

]

;

� � � k = 1, . . . , n− 1

[d1, d2, . . . , dn] =

[

d1, . . . , dk +1

[dk+1, . . . , dn]

]

.

+ �- �� � � � � � � � � � � �� � � � � / � � 0 / 1 � � � 7

��V � � S % � � CE h � �E " � % bE � $ � �" '�" $ " ' � � &( z �� �� � { � } {� � � � {��� � � �� � {� � � � � � ~ � � �� � > � � � � � � a1, a2, . . . , an, . . . � � � � � � � ��

[a1, a2, . . . , an] =Pn

Qn, n = 1, 2, . . .

�> } { �� � � � � � � � { � � � { �� � { � � { � � �~ � � � �� {� �� �> } { �� � � � � ��� � � � �� > � � � � � � � � ��

(

a1 11 0

) (

a2 11 0

)

. . .

(

an 11 0

)

=

(

Pn Pn−1

Qn Qn−1

)

, n = 2, 3, . . .

l �� � j� " � % b$ " ' �( l %k Ch � m$ " '� � � %� & � � P0 = 1� Q0 = 0(l �� � j� " � % b$ " ' � � � � ' �h � � E h C� �� � ` � � n( u � � n = 1 C" ' � � a h �E � �

�# � ' �h E �( g$ % � h %k n−1 �E � ' d � � %E �E � � " � � � � � �h � � % �a �E � y �E h C� z

�� � h %k E � � �� � d 'E � `h � � m � [a2, . . . , an] = Xn−1

Yn−1

h � % a E � ' d � � %E k " b$ k

�� '�E $ " ' �

(

a2 11 0

)

. . .

(

an 11 0

)

=

(

Xn−1 Xn−2

Yn−1 Yn−2

)

.

_h � C& � `$ " � � �E d � �" � h � � m � $ 'k j� E d $ � �" E �D �E � �

Pn

Qn= [a1, a2, . . . , an] = a1 +

1

[a2, . . . , an]= a1 +

Yn−1

Xn−1=

a1Xn−1 + Yn−1

Xn−1,

# " � � � %E �$ " b y $ � �" ' �" $ " ' C�" � " � �# E � C �� ' �E $ " ' C

(

Pn Pn−1

Qn Qn−1

)

=

(

a1 11 0

)

·(

Xn−1 Xn−2

Yn−1 Yn−2

)

.

s� � � � � h �� � j� E � ( �l � � m � [a1, a2, . . . , an] = Pn

Qn

� n = 1, 2, . . .E � j d '� y " $ k } { �� { �� � � � �� � { �� � �( B� � # �$ " '� $ %�h $ " ' �k � j �" � `" � � �� d d � � % C# � � � �� � " � z

# � $ � � '$ � �$ E � 'E d � $ ' � `$ " '� � �h c �h k � �c h � � m� `(

,( PnQn−1 − Pn−1Qn = (−1)n � n = 1, 2, . . .¤( �� � � � Pn

� Qn

�� � � �� { } � {� � > } � � �� �� n = 1, 2, . . .

f ( Pn

Qn− Pn−1

Qn−1= (−1)n

QnQn−1

� n = 1, 2, . . .

�( Pn

Qn= a1 +

n∑

k=1

(−1)k

QkQk−1

� n = 1, 2, . . .

2 ( �|{� � � � { �� � � �� � {� � � Pn

� Qn

~ � { � � � � � { �� � � � �� ~ � � � � � � > �� { {� � { ��� � � � Pn=anPn−1+Pn−2 � Qn=anQn−1+Qn−2

} � � n=2, 3, . . .

� ( Qn = anQn−1 + Qn−2 > Qn−1 + Qn−2 > 2Qn−2 > 2n−2

2 � n = 2, 3, . . .

Page 15: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� � � �- � �� �� �1 � 1 � � � � � �� / � �

� � q � v� $ $ �" � � " � �� � b ' � � � �$ � � ��h $ " � ' %�E � � h � `$ " ' � " � % bE d c

# � $ � % E � � �� � d 'E d � h � � mk �)( u C$ " b α *E �� �" � � �� � � % �a � " � % b z

E �� h � `$ " ' � " � % bE �� # � $ % �( B d h � % � 'E � �� % Cy � h � � mE Cy # � $ " � +

α = bαc + {α}( u � %� & � � a1 = bαc � � � $ % � {α} = 0� " � j� � � E # � '� z

� � � �$ % � {α} 6= 0 � " � � � % C# � � �� '�E $ " ' � α = a1 + 1α1

( u � '" � �k k

�" �" � � � ��$ $ h %k # � $ %� α1 � � " ( h ( � � % C# � ' �� j C % b" � " � � �$ %�h � '� z

" � % bE �$ " b a1, a2, . . . , an, . . . ,h %k � �" � � � ` � � � � � a h � n ' d � � %E k �" $ k

�� '�E $ " ' � α=[a1, a2, . . . , an, αn] � n=1, 2, . . .

� � $ %� an(αn)E � j d '� y " $ k� � } { �� > � � %} { �� > � � & � � � � � > � �(B � j �a E d h '� $ % C# � k + % � m � � � � ��$ $ j� � �E # � " $ k E � E �� �" � � �

D � & � n � ' d � � %E �E � �� '�E $ " ' � α = [a1, a2, . . . , an] � % � m � � � � '$ �c n' d � � %E k y " $ k E � �� '�E $ " '� α 6= [a1, a2, . . . , an]( B $ % C# � � m�$ � �E �# E � `

� �$ %�h � '� " � % bE �$ " � a1, a2, . . . , an, . . . � � ��h � % � jE � # �E � � m�$ � �E �# E � `

E � � �� � d 'E � `h � � m � [a1, a2, . . . , an, . . .]� � � � ��h � %

limn→∞

Pn

Qn= lim

n→∞

(

a1 +

n∑

k=1

(−1)k

QkQk−1

)

,

� �" � � d ` '$ � &h � $ C ��$ " ' C� " ' $ � % C $ c �h � �$ " � jE � � �# � ��h Cy �� & �$ k

�k h � $ m� $ � �E �# E � C md '� y � � � # %�E � �)(v� $ $ �" � � � � � $ 'k j� E d � a h C$ � m � `# � $ % � α � � �h c �h k � � � h � � m �

[a1, a2, . . . , an] = Pn

Qn

� n = 1, 2, . . .h %k � � % C# � ' D � `$ k ' �� j C % b" � " � � � � z

�E �E � k h � E E � ` � � � ��h C � d %� �E �# E � ` � � % � m� $ � �E �# E � ` & � �$ %�h � '� z

" � % bE �$ " � a1, a2, . . . , an, . . .��� S � =� � � � � �� � � n + 1 � � � � { α � � � { �} � �� � � � {� � � � �� � � �} { �� { �� �� � � � { �� � � { �> } { �� � �� � � { �� { �� � �~ � � � � � � �� � � � +

Pn

Qn< α <

Pn+1

Qn+1

� � � Pn+1

Qn+1< α <

Pn

Qn.

l �� � j� " � % b$ " ' �( v� $ $ �" � � h � `$ " ' � " � % bE Cy � CE � � � yf(x) = [a1, a2, . . . , an−1, x]( £# � ' �h E � � # " �

f(an) =Pn

Qn,

f

(

an +1

αn

)

= α,

f

(

an +1

an+1

)

=Pn+1

Qn+1.

+ �- �� � � � � � � � � � � �� � � � � / � � 0 / 1 � � � �

B $ � % C � � � ' �h �E E d c ' d D � $ ' � `$ " ' � �h c �h k ��c h � � m� `h %k � CE � z

�� � f(x)h � % a E � ' d � � %E k " b$ k �� '�E $ " ' �

f(x) =xPn−1 + Pn−2

xQn−1 + Qn−2.

_ %�h � '� " � % bE � � f(x) * & � �� � m � %� � � � � �" � Ck ' %k � " $ k $ " � �& � �E �" �E z

E � ` � CE � �� � `( �# � " d '� k E � �� ' �E $ " '� an < an + 1αn

< an + 1an+1

� � � % C z

# � � � # " � ' j� ' � $ � �$ " � �" " �& � � �E �" �E E � ' � j �� $ " � � " � % � C md '� �"

� CE � � �k f(x)� ' d � � %E k � " $ k �h E � � j" �� m C� d c E � �� ' �E $ " '( �� � h � z

� � j� E � ( �¢ � $ � � h � %� E � " � Ch E � ' �h � " b � # " �h � % a E d ' d � � %E k " b$ k E � �� z

' �E $ " '�

P1

Q1<

P3

Q3< . . . 6 α 6 . . . <

P4

Q4<

P2

Q2.

�E � # �E � � � �E �# E � ` E � � �� � d 'E � ` h � � m� ` $ �� %d � E � � � %E d �

# � $ " E d � � �# � ' �h E � �k ' %k �" $ k �� �� �E � % bE d # � $ % � ( ¢ � � m � � �" �$ � �� z

' �h % � '���V � � S � � ��� � {� � �� � > � � � � � � { �� {� � � �� { } � � �� � � � �� � � � � � � � ���� {� � �� > � � � } � � �> �� > � � � { �� �� � � �> � � � � } { �� > � � � � � � � > � � ?l �� � j� " � % b$ " ' �( g$ % � α �� �� �E � % bE �� # � $ % � � " �$ �& %� $ E �

� %& � � � " C g '� % �h � C� � j� E E d ` ' d D � � � � �� $ $ � �$ " � ��E �k E � � �� � d ' z

E � `h � � m � j� � �E # � " $ k � � � E � c �a h �E � � E � � m � % b D � & � � m �� & �h � % � " � %k (u � � �" � jE � # �E � � E � � �� � d 'E � `h � � m � m Ch � " $ � ' �� h � " b$ h � E E d # � $ z

% � ( ¢ � � m � � �" � %y m� k � �E �# E � k E � � �� � d 'E � k h � � m b$ �� %d � E � � � % z

E d � # � $ " E d � k ' %k �" $ k �� �� �E � % bE d # � $ % � ( u � �" � CE � � mc �h � �

h �� � j� " b" � % b� � �h E � jE � # E �$ " b" � � �& � � ��h $ " � ' %�E �k (u ��h � � % �a � � # " � � � �" $ k h '� �� j % �# E d c � � �h $ " � ' %�E �k �� � � z

�E � % bE �& �# � $ %� α = [a1, a2, . . . , an] = [b1, b2, . . . , bm]( u C$ " b ak 6= bk

*

�� � ' �� �" % �# � � 'h � E E d c � �$ %�h � '� " � % bE �$ " k c ( s �&h � � � � E �� �" � � d c

0 6 ε < 1 � 0 6 δ < 1h � % a E � ' d � � %E k " b$ k �� '�E $ " ' �

α =(ak + ε)Pk−1 + Pk−2

(ak + ε)Qk−1 + Qk−2=

(bk + δ)Pk−1 + Pk−2

(bk + δ)Qk−1 + Qk−2.

£" $ y h � � �� $ $ C a h � k � E � % �& �# E � %� � � '$ � % C �E �" �E E �$ " � & � �� � m � z

%d � � % C# � � � # " � ak + ε = bk + δ � � � �" � ' � ��# � �( s� � �� � h �� � j� E � ( ���V � � S q � �� � �� � {� � �� � > � �� �� � � � � � �� � > � � � � � � { �� {� � � �� {} � � �� � � � �� � � � � � � � �� ���� {� � �� > � � � } � � �> �� > � � � { �� � � � � �> �� � � � } { �� > � � � � � � � > � � ? �� { � { � {� �� � � � � � � � � �� � � { � ��� � {� � �� { �

Page 16: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� � � �- � �� �� �1 � 1 � � � � � �� / � �

� � } � � �> �� { � � � { �� � � � �> � � � � } { �� > � � � � � � � > � � � � �� �� � � � � �� �� � {� � �� � { � � � � � { ?l �� � j� " � % b$ " ' �( g$ % � α � � �� �� �E � % bE �� # � $ % � � " � � � � $ � E z

E d ` ' d D � � � � �� $ $ � �$ " � ��E �k E � � �� � d 'E � `h � � m � E � � �&h � E � j� � �E z

# � " $ k � " � � � � � jE � # �E � � � �E �# E � `E � � �� � d 'E � `h � � m � k ' %k � " $ k �� z

�� �E � % bE d # � $ % � ( u � � �" � jE � # �E � � E � � �� � d 'E � `h � � m � '$ � % C

%� d m Ch �" � � ��h � %k " b$ k � ��h � % �

limn→∞

Pn

Qn= lim

n→∞

(

a1 +

n∑

k=1

(−1)k

QkQk−1

)

,

� �" � � d ` � � %� � h � % a �E $ � ' �� h � " b$ # � $ % � α(£h E � jE � # E �$ " b � ��h $ " � ' %�E �k � � � � j ' � % bE �& � h � `$ " ' � " � % bE �& �

# � $ %� ' ' �h � E � � �� � d 'E � `h � � m � h �� � j d '� �" $ k � E � % �& �# E � � ��h d z

h C �� `" � � �� �(£$ " � �" $ k j� � " � " b � # " � jE � # �E � � %y m � ` m�$ � �E �# E � `E � � � � � d 'E � `

h � � m � $ �� %d � E � � � %E d � # � $ " E d � k ' %k � " $ k h � `$ " ' � " � % bE d # � $ z

% � � � '$ � % C �h E � jE � # E �$ " � � � �h $ " � ' %�E �k # � $ %� ' ' �h � E � � � � � d 'E � `

h � � m � � E � �a �" �� �� �E � % bE d # � $ % � ( s� � �� � h �� � j� E � ( �

� � 8 � B j� � %y # �E � � �" �" � m� jh �� � j� " � % b$ " '� � �� h '� j� �# � " � % b z

E d c $ ' � `$ " '� E � � �� � d 'E d c h � � m� `( B � z �� � ' d c � � �$ %�h � '� " � % bE �$ " �

E � � � %E d c # � $ " E d c � � � % C# � � d � � � � �� j % �a �E � � h � `$ " ' � " � % bE d c # � z

$ � % � �& C" �� $ $ � " � � '� " b$ k � � � �� �� �E � % bE d � � � � m % � a �E � k �" �c # � z

$ � %( u � � �" � �� � j d '� � " $ k �# " �E � � �� � d 'E d � h � � m � h � y " ' � � ��h � %�E z

E � $ d $ %� E � � % C# D � � �� � � �E � % bE d � � � � m % � a �E �k ( B � z '" � � d c � m�$ z

� �E �# E d � �� � � �h �# � $ � � � E � � �� � d 'E d � h � � m � � " � % b� � �E � � ��h $ " � ' z

%k y " E �a � $ " ' �# � $ � % � k ' %k y � �c $ k � '� h �� " �# E d � � � �� �� �E � % b z

E �$ " k � � " ( �( h � `$ " ' � " � % bE d � �� D �E �k � � '� h �� " E d c C �� 'E �E � `$

�� %d � � � � � � � �� �E " � � % �� & �� E a &(£" � " � �E " � �� $ E Cy $ 'k j b E � � � � � d 'E d c h � � m� ` $ � � %�E h � � z

E d � $ " � %k �)( r� � � j '� $ " E � � � � �h � % a � " � % bE �$ " b & �h � $ �$ " � ' %k �"365,24220 . . .$ C" �� ( w" � C# � $ % C$ � �" ' �" $ " ' C�" �� � � �h �# �$ � � k h � � m b

[365, 4, 7, 1, 3, . . .]� �� � ' d � � �h c �h k �� � h � � m � � �" � � � ` �� 'E d $ � �" ' �" z

$ " '�E E �

365, 3651

4, 365

7

29, 365

8

33.

u � � m % � a �E � � 365 14

* �" �" � � E � j d '� � d ` � % � � E $ � � `� � %�E h � � b �' '�h �E E d ` ' � 5 &( h �E ( �( � % � � ¡ � j� � � � &h � � � a h d `# � " '� �" d `

& �h * ' � $ �� �$ E d `( ¢ � ' d ` � � � & � � � � E $ � � `� � %�E h � � bh � � " � � � m % � a � z

E � � 365 97400

� # " �E � E �& � m � % b D � � # � 365 833

( w" �" $ " � % b �" % �# � �" $ k

+ �- 4 � � � �1 � � � �� � � �� 1 � � ,

" � � # " �� � a h d `$ �" d ` & �h *E � ' � $ �� �$ E d ` � � � � � " �c � # � $ % �$ �" �E

� �" � � d c h � % � " $ k E � 4

%" ( �( 400 %�" � � y " 97 � � E � 100 % � D E �c $ C" �� &(� �" k �" $ " � '� E � � � % � � E $ � �& �� � %�E h � �k md % � j� �# �E � � �� ' �� '( ��� � � � � md %� � � � '�h �E � " � % b� � '� �E �� � . � '( ¢ � � m � %� � a � " �# E d `

� � %�E h � � b ' '� % ' u� �$ � � ' , ¥ 5 4 &( �� �$ �h $ � � ` � $ " � �E � � � " � � z

" � � £ � � A % bc � `k �)( £E ' '� % �� � % � j 33 %� " � '� �" � � � $ � b �� j

' � $ �� �$ E d $ # � " � %$ k # �" '� �" d ` � � ' �$ b � ` �� j * �k " d `( w" �� � � �� j

� � � m % � a �E � � 365 833

� " � � � � � � � � " $ k 8 % � D E �c $ C" �� ' 33 & �h � (

���� �� � � �� �� � ! � � � !� �

< � � � u C$ " b p *E �# �" E �� � � �$ " �� # � $ % �( ¡ � % �� # � $ % � aE � j d '� �" $ k� �� � �� � � �� > � �> � � � { �} { � { �~ �� p� � $ % � $ �� 'E �E � � x2 ≡ a (mod p)� � �" �� D �E � �(i j � � ��h � %�E �k $ %�h C� " � # " � $ ' � `$ " ' � �� % �& �# � $ %� a

md " b � % �

E � md " b � '� h �� " �# E d ' d # �" � � � �h C %y p � � ��h � %k �" $ k " � % b� �

$ ' � `$ " '� � �$ " � " � � a mod p �" h � %�E �k # � $ %� aE � # � $ % � p � � � � �" � C

' �$ " �# � $ � % a �a E � �� $ $ � " � � '� " b � %� �E " d � � % b �� ' d # �" � '

Zp(£" � " � � � �$ " � `D � � $ ' � `$ " '� � '� h �� " � # E d c ' d # �" � '(,( �� � ��� � � � � � {1, 2, . . . , p − 1} � { �� { } { � { � � � � � � �� � � � � � �� � �� �� � �� > � � �> � �� � � � � � {� � � � � � �� � � � � � � �� �� ?l %k h �� � j� " � % b$ " '� �� $ $ �" � � �" � m �� a �E � � ϕ : x 7→ x2 C % b" � z

� % � � � " � 'E � ` & � C � �d � � % b ��

Zp

' $ � mk ( £# � ' �h E � � �E �k ' %k �" $ k & � z

� � � � � j � $ k h � � Kerϕ = {−1, 1}� � � �# � � m �� j � ϕ(Zp)

m Ch �"

E �a �$ " ' �E �E C %� ' d c � '� h �� " �# E d c ' d # �" � '(¤( =� � �

Z∗p = {1, θ, θ2, . . . , θp−2}� � �� θ �} � � � � � � �� > � � � � � �� � } { ���

Zp � � { � � � �� � � a = θj �~ �� � � �� � �� � � �� > � �> � �� { � � � { � �� { �� � { �� { �� �~ � � � �� {� �� j � �� � { ?l �� � j� " � % b$ " ' � �# � ' �h E � � " � � � � � '$ �� 'E �E � � 2y ≡ j (mod p− 1) �h C % b p− 1k ' %k �" $ k # � " E d # � $ % � (

< � q � � *V U ��� WS� (� S � u � � � j C# �E � � $ ' � `$ " '� '� h �� " �# E d c ' d z

# � " � ' � md # E � ' d h � %k y " h ' � � � � m %� d ( B � z �� � ' d c � � � � �a E � C jE � " b

k ' %k �" $ k % � h � E E �� # � $ % �� '� h �� " �# E d ' d # � " � % j� h � # � �� $ � � jE � z

'� E �k & � � � ' � z '" � � d c � � � � E � `" � �� D �E � � h � E E �& �$ �� 'E �E �k % j� h � z

# � � � � $ � � �� D �E � ` &(   d � �� � a � � # " � �" '� " E � �� � ' d ` ' � � � �$ h � " b

E � $ % �a E �( l %k �" �& �E � h � � � �$ " � ' d # � $ % � " b$ � �" '� " $ " ' Cy � � `$ � ' � %

�� a � E h �� �# " �k ' %k � " $ k � %& � � � " �# �$ � � E �$ % �a E � ` j� h � # � `( B" � a �

' �� k � j� h � # � � � � $ � � �� D �E � `k ' %k �" $ k � %& � � � " �# � $ � � $ % �a E � ` j� z

h � # � ` � h %k E � c �a h �E � k �� D �E � `" � � m C�" $ k � �$ " � ��E � � $ �� �� � % bE d c

� %& � � � " � '(

Page 17: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� � � �- � �� �� �1 � 1 � � � � � �� / � �

�� � � { � �� �� � � � � � ' ' �h �E E d ` � ' , 5 4 e &( � � � ��h � %k � " $ k $ %�h Cy z

� � � m �� j � +

(

a

p

)

=

0, a≡ 0 (mod p),

1, ∃x, x2 ≡ a (mod p), a mod p 6= 0,

−1, 6 ∃x, x2 ≡ a (mod p), a mod p 6= 0.

u � � ' �h � �$ E � 'E d � $ ' � `$ " '� $ � ' � %� �� a � E h �� (

,( =� � � a1 ≡ a (mod p)� � { (a1

p )≡ (ap ) ?¤ %� � � " � � � ` w ` %� �� &( (a

p )≡ ap−1

2 (mod p)(l �� � j� " � % b$ " ' �( u � � a ≡ 0 (mod p) �� '�E $ " ' � �# � ' �h E �(g$ % � a � � � " E �E C %� ' � ` ' d # �" � " � $ �& %� $ E � � % � ` " � � � � � n � � �

ap−1≡1 (mod p) � �" � Ch � ap−1

2 ≡±1 (mod p)( u � � �" � � � $ % � a=θj � &h �

θ * � � � � " � 'E d ` � %� �E " � � % b ��

Zp � " �

ap−1

2 ≡ 1 (mod p)⇐⇒ jp− 1

2≡ 0 (mod p− 1).

u �$ %�h E � � �� 'E �$ � % bE �" � C� # " � j# �" E � � ak ' %k � " $ k � '� h �� " � # E d

' d # �" � � " ( �( (ap )=1( AE � % �& �# E � �� $ $ � " � � '� �" $ k $ % C# � `

(ap )=−1( �

f ( (abp ) = (a

p )( bp )(w" � � $ %�h Cy �� � h '� $ ' � `$ " '� k ' %k y " $ k �# � ' �h E d � $ %�h $ " ' �k �

$ ' � `$ " '� ¤(�( =� � � (a, p) = 1 � � { (a2b

p ) = ( bp ) ?

2 ( ( 1p ) = 1 � (−1

p ) = (−1)p−1

2 (

l %k h � % bE � ` D � & �E � � �" � � m C�" $ k $ %�h Cy �� k %� � (��� S � z �� �� �> � � � � �� � > � � � � � � s � t �> } { �� � � � � � � � � �� � � � � +

%� &

s−12 + t−1

2 ≡ st−12 (mod 2) �% m &

s2 ≡ 1 (mod 8) �

% ' & s2−18 + t2−1

8 ≡ (st)2−18 (mod 2) ?l �� � j� " � % b$ " ' � �� � ' �& �$ �� 'E �E � k ' d " �� � � " � j �� '�E $ " '�

1

2(st− s− t + 1) =

1

2(s− 1)(t− 1),

&h � ' � �� ' � `# � $ " � $ " � � " # �" E �� # � $ % �( l %k h �� � j� " � % b$ " '� '" � � �& �

$ �� 'E �E � k E � h � j� �" � " b �# " �# � $ % � (s− 1)(s + 1) '$ � &h � h � % � " $ k E � 8(

+ �- 4 � � � �1 � � � �� � � �� 1 � � �

¢ � � �E � � � " ��" b � $ �� 'E �E � � ' d " �� � � " � j �� '�E $ " '�1

8(s2t2 − s2 − t2 + 1) =

1

8(s2 − 1)(t2 − 1),

' � �� ' � `# � $ " � � �" � � �& �" � � a � $ " � � " # � " E �� # � $ % �( �

� ( ( 2p ) = (−1)

p2−1

8 (l �� � j� " � % b$ " ' �( s� � � � � � %� �E " d {1,−1} %� a � " ' %y zm � �� $ D � ��E � � � � %k

Zp � " � �a E � �� $ $ � " � � '� " bh � E E �� �� ' �E $ " ' �

' � � %� GF (p2)( B $ � % C � CE � " � % m & %� d $ � �� ' �h % � ' � $ �� 'E �E � �

p2≡1 (mod 8)� � � � �" � C 'h � E E � � � %� '$ � &h � $ �h � � a � " $ k � %� �E " ω� � �k h � � e (E � � � � � � � E � h � ' jk " b � � � � " � 'E d ` � %� �E " � � � y � � `

� � �k h �� (p2 − 1) � � ' � j '�$ " � � & � '$ " � ��E b (p2−1)8

)( v� $ $ �" � � � CE � z

�� y

f(x) =

{

(−1)x2

−1

8 , x≡ 1 (mod 2),

0, x≡ 0 (mod 2).

s� � � � � # � $ % � ek ' %k � " $ k �� � � �h � �" � ` � CE � �� � � " � �a E � �� $ z

$ � " � � '� " b � � � � � � CE � �� y � j� h � E E Cy E � � %� �E " � c � � % b �� ' d # � z

" � 'Z8( u � � �" � '$ � % C � CE � " � % ' & %� d h %k E �# � " E d c s � t ' d � � % z

E k � " $ k �� '�E $ " ' � f(st) = f(s)f(t)(£ � ��h � % � ' � % � # �E C G ∈GF (p2) �� '�E $ " ' �

G =

7∑

j=0

f(j)ωj .

u �� � a � � # " � G 6= 0( iR � �

G = ω − ω3 − ω5 + ω7 = 2(ω − ω3),

" � � � � � ω4=−1( £" $ y h � G2=4(ω2−2ω4+ω6)=8 6=0 � � � $ %�h � '� " � % bE � �� G 6= 0 ' � � %� GF (p2)(u �h $ # � " � � " � �� � bh ' C k $ � �$ � m� � '� % �# �E C Gp( _ �h E � `$ " � z

� �E d

Gp = (Gp−1

2 )2G = 8p−1

2 G =

(

8

p

)

G =

(

2

p

)

G.

_h � C& � `$ " � � �E d �

Gp =

( 7∑

j=0

f(j)ωj

)p

=

7∑

j=0

f(j)ωpj ,

Page 18: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� � � �- � �� �� �1 � 1 � � � � � �� / � �

" � � � � � pE �# �" E �( i$ � � % b j Ck $ ' � `$ " '� � CE � �� � f(x) � � % C# � �

Gp =7

j=0

f(p)f(pj)ωpj = f(p)7

j=0

f(pj)ωpj = f(p)G.

s� �� � b � � � � �� 'E � '� k � m� ' d �� a �E �k � $ �� �� �� k E � G � � � % C# � �

" � � m C� �� �� '�E $ " ' �( �" � � " �� m � '� % �$ bh �� � j� " b( �< � 8 � � * S (� S X Z � p ] � S �V � * � S � V TX �S T T S � l �� � a � � �� �h E � j� z

�# � " � % bE �� $ ' � `$ " ' �$ � ' � %� �� a � E h �� � E � j d '� � �� � '� h �� " �# E d

j� � �E � ' j� � E �$ " �)( w � � � �# �$ � � �E md % �" � � d " ' , 5 ef &( �( w ` z

%� � � ( u� � ' �� � � %E �� h �� � j� " � % b$ " ' � m!d % �h � E � ' , 5 4� &( , 4 z %� " E �

r( �� C$ $ � ( B$ � & � �E � ��h % �a � %$ � b �� j % �# E d c h �� � j� " � % b$ " '� '� h z

�� " �# E �& � j� � �E � ' j� � E �$ " �)(��V � � S � z �� �� �> � } � {� � > � � � � � � � > � � � � � � p � q � } �� � � � � � � {� � � � � � � � {

(

p

q

)

= (−1)p−1

2

q−1

2

(

q

p

)

.

l �� � j� " � % b$ " ' �( u �$ " C �� � � � %E �$ " by � E � % �& � # E �h �� � z

j� " � % b$ " ' C � �$ %�h E � & � $ ' � `$ " '� ( u� �� `h � � " � � � C �� $ D � ��E � y

GF (pm) � � %k

Zp � ' � �" � � � $ �h � � a � " $ k � %� �E " ω � � �k h � � q

%E � z

� � � � � � �a E � � � % �a � " b m = q − 1 � " � � � � � ' d � � %E k �" $ k $ �� 'E �E � �

pq−1 ≡ 1 (mod q)

&( v� $ $ �" � � ' � % � # �E C

G =

q−1∑

j=0

(

j

q

)

ωj .

_E � # � %� h �� � a � � # " � G 6= 0( iR � �

G =

(q−1∑

j=0

(

j

q

)

ωj

)(q−1∑

k=0

(−k

q

)

ω−k

)

=

(−1

q

) q−1∑

j=0

q−1∑

k=0

(

j

q

)(

k

q

)

ωj−k.

s� � � � � ( 0q ) = 0 � " � �a E � � j �E � " bE � a E � ` � ��h � % C � m� �c $ C (£h E � ' � � �E E � j� �E k k ' � '" � � � `$ C � �E h �� $ kE � jk � � � % C# � �

G =

(−1

q

) q−1∑

k=1

q−1∑

j=1

(

j

q

)(

jk

q

)

ωj(1−k) =

(−1

q

) q−1∑

k=1

(

k

q

) q−1∑

j=1

ωj(1−k).

s� �� � b '� �E � '" � � � `$ C � � E h �� $ j = 0 � h � m� ' � '� �� � ' � `$ C �

' d �� a �E � �

q−1∑

k=1

(

k

q

)

= (+1)q − 1

2+ (−1)

q − 1

2= 0.

+ �- 4 � � � �1 � � � �� � � �� 1 � � �

¢ � � �E � � � C# � " d '� k � # " �

q−1∑

j=0

ωja =

{

0, a 6= 0,

q, a = 0,

� � % C# � �

G2 =

(−1

q

) q−1∑

k=1

(

k

q

) q−1∑

j=0

ωj(1−k) =

(−1

q

)(

1

q

)

q = (−1)q−1

2 q.

£" $ y h � G2 6= 0 � � � $ %�h � '� " � % bE � � � G 6= 0 ' � � %� GF (pm)(u �h $ # � " � � " � �� � bh ' C k $ � �$ � m� � '� % �# �E C Gp( _ �h E � `$ " � � � z

E d

Gp =(

(−1)q−1

2 q)

p−1

2 G=(−1)p−1

2

q−1

2 qp−1

2 G≡ (−1)p−1

2

q−1

2

(

q

p

)

G (mod p).

_h � C& � `$ " � � �E d �

Gp =

(q−1∑

j=0

(

j

q

)

ωj

)p

=

q−1∑

j=0

(

j

q

)

ωpj ,

" � � � � � pE �# �" E �( i$ � � % b j Ck $ ' � `$ " '� $ � ' � %� �� a � E h �� � � % C# � �

Gp =

q−1∑

j=0

(

p

q

)(

pj

q

)

ωpj =

(

p

q

) q−1∑

j=0

(

pj

q

)

ωpj =

(

p

q

)

G.

s� �� � b � � � � �� 'E � '� k � m� ' d �� a �E �k � $ �� �� �� k E � G � � � % C# � � " �� zm C� �� �� '�E $ " ' �( s� � � � � h �� � j� E � (

< � = � l �� � j� E E d � $ ' � `$ " '� $ � ' � %� �� a � E h �� � � j ' � %k y " ' d # � $ z

%k " bh %k %y m �& � � � �$ " �& �E �# �" E �& � p � %y m �& � �� % �& � a jE � # �E � � (ap )$ � � � � b y $ %�h Cy �� & � � % & � � � " � +

, & � $ % � # � $ % � a �" � � �� " � % bE � � " � ' d h � %k � $ � E �a � " � % b (−1p

) ;¤ & j� �E k � # � $ % � aE � �$ " � " �� a mod p �" h � %�E �k # � $ %� aE � p ;

f & �� $ � %� h d '� � # � $ % � a ' � � � � j '�h �E � � � � �$ " d c $ � E �a � " � %� `

a = pa1

1 pa2

2 . . . pak

k

� �� � �c �h � � �� j % �a �E � y ' � � � � j ' �h �E � �

4)

(

a

p

)

=

(

p1

p

)a1(

p2

p

)a2

. . .

(

pk

p

)ak

;

Page 19: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� � � �- � �� �� �1 � 1 � � � � � �� / � �

2 & � $ % � p1 = 2 � a1

E �# � " E � � ' d # � $ %k � ( 2p ) ;

� &h %k � � a h �& �E �# �" E �& �$ � E �a � " � %k pi

$ E �# � " E d jE � # �E � �

$ " � ��E � ai

� � � �E k � � '� h �� " �# E d ` j� � �E ' j� � E �$ " � ;

5 & � $ % � E � � mc �h � � � ' � j ' �� �� � $ k � �( ,(¢ � � � � � � �

(

126

53

)

=

(

20

53

)

=

(

2

53

)2(5

53

)

= (−1)26·2(

53

5

)

=

(−2

5

)

=

= (−1)2(−1)3 =−1.

< �: � � *V U � �V � � i j % �a �E E d ` ' d D � �" �h ' d # � $ %�E �k $ � ' � %�

�� a � E h �� k ' %k � " $ k E � Ch � mE d '$ 'k j � $ " � � # " � � � � � & � ' d � � %E �E � �

� � �c �h � " $ k � � � m� & � " b� $ % �a E � ` � �� �� �� � �� � " � � � j� �� � E � " C �� % b z

E d c # � $ � %( �" � md � j m� ' � " b$ k �" E � � mc �h � �$ " � �� � " � � � j � '� " b# � $ z

%� �� $ $ �" � � � m � m ��E � � $ � ' � %� �� a � E h �� � E � j d '� � �� $ � ' � % �

�� � m �)(u C$ " b nE �# �" E � � � � � " $ %�h Cy �� � �� j % �a �E � � E � � � �$ " d � $ � z

E �a � " � % � n=pa1

1 pa2

2 . . . pak

k

( s �&h � h %k %y m �& � �� % �& �# � $ %� a� � � � { �

�� { �� � � ��h � %k � " $ k �� '�E $ " ' �

(

a

n

)

=

(

a

p1

)a1(

a

p 3

)a2

. . .

(

a

pk

)ak

.

Bh � E E � $ % C# � � �� '�E $ " ' � ( an ) = 1 ' � '$ � E � � mk j� " � % bE � � jE � # � � " �# " �# � $ % � ak ' %k �" $ k � '� h �� " � # E d ' d # �" � � � �h C %y n( ¢ � � � � � � �

(

2

15

)

=

(

2

3

)(

2

5

)

= (−1)(−1) = 1,

�h E � � �# � $ % � 2 � �# � ' �h E � �E � k ' %k � " $ k � '� h �� " �# E d ' d # �" � � � � z

h C %y 15( u � �" � C� $ � ' � % C �� � m � E � h � �" E �$ � " b$ k � � � � � � � � % bE � `

� CE � � � � �" h ' Cc � � & C �E " � '( �� �# � " � % bE �� $ ' � `$ " ' � �" �& �$ � ' � %�

j� � %y # � � " $ k '" � � # " � �E Ch � ' %�" ' � �k � " � �� � " �# � $ � � '$ � " � a �

$ ' � `$ " '� � # " � � $ � ' � % �� a � E h �� (

,( =� � � a1 ≡ a (mod n) � � { (a1

n )≡ ( an ) ?¤( (ab

n ) = ( an )( b

n )(

f ( =� � � (a, n) = 1� � { (a2bn ) = ( b

n ) ?

�( ( 1n ) = 1, (−1

n ) = (−1)n−1

2 (

2 ( ( 2n ) = (−1)

n2−1

8 (

+ �- 4 � � � �1 � � � �� � � �� 1 � � 7

l �� � j� " � % b$ " ' � �" �c $ ' � `$ " ' � � � ' �h � " $ k $ � � � � by �( %� & � % ' &

%� d � j �( 4( ¤( ic � ��h %� & � �" $ k ' d � � %E � " b$ � �$ " �k " � % bE � '� � # � z

$ " '� C � �� a E �E �k (l �� � a � % � D b � m � m ��E � � � '� h �� " �# E �& � j� � �E � ' j� � E �$ " �)(��V � � S � z �� �� �> � � � � � � � > � � � � � � m � n� } � � � � � � � � { �� � �� � � � {

(

m

n

)

= (−1)m−1

2

q−1

2

(

n

m

)

.

l �� � j� " � % b$ " ' �( l �$ " � " �# E �$ # � " � " b � # " � (m, n)=1� ' � � � z

" � 'E � $ % C# � � � m� # � $ " � �� ' �E $ " '� �� 'E d E C %y ( u ��h � � % �a � � # " �

# � $ %� m � n � � y " $ %�h Cy � � � �� j % �a �E �k E � � � �$ " d � $ � E �a � " � % �

m = qb11 qb2

2 . . . qbss , n = pa1

1 pa2

2 . . . pak

k .

s �&h � � � � � ��h � %�E � y � $ ' � `$ " '� $ � ' � %� �� � m � � � % C# � �

(

m

n

)

=k

j=1

s∏

i=1

(

qi

pj

)ajbi

,

(

n

m

)

=s

i=1

k∏

j=1

(

pj

qi

)ajbi

.

_ �& %� $ E �� '� h �� " �# E � C j� � �E C ' j� � E �$ " � � � � '$ �c i � j � � �

(

qi

pj

)

= (−1)pj−1

2

qi−1

2

(

pj

qi

)

.£$ " � �" $ k j� � " � " b � # " � '$ � % C �( %� & %� d $ � �� '�h % � ' � �� '�E $ " ' �

s∏

i=1

k∏

j=1

(−1)ajpj−1

2bi

qi−1

2 = (−1)n−1

2

m−1

2 .

s� � � � � h �� � j� E � ( �< � @ � l �� � j� E E d � $ ' � `$ " '� $ � ' � %� �� � m � � � j ' � %k y " h %k %y m �& �

� � �$ " �& �E �# � " E �& � p � %y m �& � �� % �& � a � E � � � � m� & � k � �� � " � � � j� �� �

# � $ %� � ' d # � $ %k " b jE � # �E � � $ � ' � %� �� a � E h �� (ap )$ � � � � by $ %�h C z

y �� & � � %& � � � " � (

u � %� & � � n = p(, & � $ % � # � $ % � a �" � � �� " � % bE � � " � ' d h � %k � $ � E �a � " � % b (−1n ) ;¤ & j� �E k � # � $ % � aE � a mod n * �$ " � " �� �" h � %�E �k # � $ %� aE � n ;

f & �$ % � a# �" E � � � ��h $ " � ' %k � � & � ' ' � h � � � � � j '�h �E �k a = 2ta1 �&h � (a1, 2) = 1� � � �$ % � tE �# �" E � � " � ' d # � $ %k � ( 2n ) ;

Page 20: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� � � �- � �� �� �1 � 1 � � � � � �� / � �

� & � � � �E k � � (a1

n )� '� h �� " �# E d ` j� � �E ' j� � E �$ " �

(

a1

n

)

= (−1)n−1

2

a1−1

2

(

n

a1

)

;

2 & � $ % � E � � mc �h � � � ' � j ' �� �� � $ k � �( ,(¢ � � � � � � �

(

136

53

)

=

(

30

53

)

=

(

2

53

)(

15

53

)

= (−1)532−1

8 (−1)26·7(

53

15

)

=

=−(

8

15

)

=−(

2

15

)

=−(−1)28 =−1.

�� �� � ! � ! � � ! � �� !� � � �� � ! � !" !� � � �� � � � !"

�> � � � B � � � �$ � �� $ � ��h � %�E � � � � �$ " d c # � $ � % '$ � &h � ' d j d '� % m � % b z

D � ` �E " � ��$ ( B �� jE � ` � �$ " � E � '� � �E � $ $ %�h � '� %$ k E �& � � � " � � z

" � � � �)(v� $ $ �" � � ' � � � �$ � � � '�h �E � � � CE � � � � π(x)� �� 'E � `# � $ % C � � � z

$ " d c # � $ � % p ' �E " � � '� %� 1 < p 6 x( g �� # � " d �E � h �� " � %� " E � ` �� C$ $

' , 5 4 , &( � � E � % � j � � Ck �" C � CE � �� y � � � � % d c x� j� �" � % � # " � % C# D �

'$ � & � � � � � � m % � a � �" � CE � ��k xln x

( B , e¥ e &( �� a � E h � � ��h % �a � % � � � z

C % C� � �" � �� k $ h �$ " � " �# E � m � % b D � `" �# E �$ " by h � �" # � $ % � � � �$ " d c

# � $ � % * xln x−1,08366

( £E � � � ' � � � % � � � C % Ch %k 104 < x < 106( B , e2 ¥ &(u( �( �� m!d D � ' � �� � j� % �# " � � � � C %� �� a � E h �� E � ' � �E � � � $ � � � � by

h �$ " � " �# E �$ % �a E � `" �c E � � � � � % C# � %$ %�h Cy �� � � ��E � �

0,921x

ln x< π(x) < 1,106

x

ln x.

Bh � % bE � `D � � md % � � � % C# �E d jE � # �E � k � �E $ " � E " � m � %� � m % � j� � �

� 1( B , e 4� &( Ah � � � � B� % %� z u C$ $ �E E � j� ' � $ � �h �� � j� % � � $ � �" � z

" � # �$ � � ` j� � �E π(x) ∼ xln x

$ � � � � b y " � � � � � � CE � �� `� � � %�� $ E �& �

�� �� �E E �& �( s �# E � � �E � � �� � j� % � � # " � � CE � ��k

x∫

2

dt

ln t∼ x

ln x

h � �" m � %� � " �# E �� � � � m % � a �E � � h %k π(x)� # � xlnx

( l �� � j� " � % b$ " ' �

� $ � �" �" �# �$ � �& � j� � �E � � %� �E " � �E d � �" �h � � md % � � � % C# �E �

" � % b� � ' , 4� 4 &( _ � % m� � & � (

+ ,� - 1 � � � � � � �� � �� � � � � �

�> � q � l �� � a � $ %�h Cy � Cy " � � �� C�k ' %k y � Cy $ k C � � � ��E E d '� z

� � � E " � � � j C % b" � " � u( �( �� md D � '� (��V � � S � �~ �� � � �~ � � � � � } {� � {� � � > � c1� c2 � � �� � � �� { 0 <

< c1 < 1 � c2 > 1 � � �� �� �� x > 2 �> } { �� � � � � � � � �� � �� � � ��

c1x

ln x< π(x) < c2

x

ln x.

l %k h �� � j� " � % b$ " '� h � E E d c E � �� '�E $ " ' Ch � mE � � � ��E � '� " b � CE � z

�� y

θ(x) =∑

p6x

ln p,

E � j d '� � Cy � CE � �� � ` �� md D � '� (��� S � � �� � �� �� x > 2 �> } { �� � � � � � � � � � � �� � � � {

θ(x) < (4 ln 2)x.

l �� � j� " � % b$ " ' �( B$ � % C �# � ' �h E �& �E � �� ' �E $ " '�

22n >

(

2nn

)

>

p<2n∏

n<p

p

� � % C# � �

2n ln 2 > θ(2n)− θ(n).£" $ y h �

θ(2m) 6 2 ln 2(1 + 2 + . . . + 2m−1) < (2 ln 2)2m,

� h %k x = 2m %� � '� �E � ( u � � 2m−1 < x < 2m � � �

θ(x) 6 θ(2m) < (2 ln 2)2m = (4 ln 2)2m−1 < (4 ln 2)x. �

��� S q � �~ �� � � �~ � � � � � � � � � � c > 0� �� { � � �� { � �� �� �� x > 2�> } { �� � �� � � � � � � � � � � � � { θ(x) > cx ?l �� � j� " � % b$ " ' �( B '�h � � m � jE � # �E � k

tp(n) = max{k > 0: pk6 n},

op(n) = max{k > 0: pk |n}.

_E � # � %� j� � " � � # " � tp(n) = blogp nc( B" � � Cy '� % �# �E C � �h $ # � " � �

� � � � � C %�

op(n!) =

tp(n)∑

j=1

n

pj

.

Page 21: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

�� � �- � �� �� �1 � 1 � � � � � �� / � �

u � �" � C � � � '$ �c p < 2n � � �

op

((

2nn

))

= op

(

(2n)!

(n!)2

)

=

tp(2n)∑

j=1

2n

pj

− 2

tp(n)∑

j=1

n

pj

=

=

tp(2n)∑

j=1

(⌊

2n

pj

− 2

n

pj

⌋)

6 tp(2n).

B � �$ %�h E � E � �� ' �E $ " '� � $ � � % b j � '� E � �# � ' �h E � k � ��E � � 0 6 b2xc −− 2bxc6 1( £" $ y h �

2n <n + 1

1

n + 2

2. . .

2n

n=

(

2nn

)

=∏

p<2n

pop

((

2nn

))

6∏

p<2n

ptp(2n).

_ %�h � '� " � % bE � �

n ln 2 <∑

p<2n

tp(2n) ln p =∑

p<2n

blogp 2nc ln p = Σ1 + Σ2,

Σ1 6∑

p6√

2n

ln 2n

ln pln p 6

√2n ln 2n,

Σ2 =

p<2n∑

p>√

2n

ln 2n

ln p

ln p 6

p<2n∑

p>√

2n

1 ln p 6 θ(2n).

£" $ y h � ' d " �� � �" E � �� ' �E $ " ' �

θ(2n) > n ln 2−√

2n ln 2n > cn,

&h � c>0 *E �� �" � �� k � �E $ " � E " � ( ¢ � � �E � � � � � � 2n<x62n+1 � � % C# � � θ(x) > θ(2n) > cn > c

x− 1

2> c1x, c1 > 0. �

l �� � j� " � % b$ " ' � " � � � � d ( B � �c E k k � � � E � � ( iR � �

θ(x) >

p<x∑

p>√

x

ln p > ln√

x(π(x) − π(√

x)) > ln√

x(π(x) −√

x).

_ %�h � '� " � % bE � � $ C# �" � %� d , � � % C# � � π(x) 6

2θ(x)

ln x+√

x < 8 ln 2x

ln x+√

x < c2x

ln x

� � � E �� �" � � � `� �E $ " � E " � c2 > 1(

+ ,� - 1 � � � � � � �� � �� � � � �,

¢ � a E k k � � � E � � ( i jE � �� ' �E $ " '�

θ(x) =∑

p6x

ln p 6 π(x) ln x

$ � � � � b y %� d ¤ � � % C# � �

π(x) >θ(x)

ln x> c

x

ln x.

s� � � � � h �� � j� E � ( ��> � 8 � B� � # �$ " '� $ %�h $ " ' � k � jh �� � j� E E � ` ' d D � " � � �� d � � % C# � z

y " $ k � ��E � � ' � % � # �E d n z& � � � �$ " �& �# � $ %� (� U � ( T X * � � � �~ � � � pn

� n� � } � {� � { � � � � � { ? �{� �� � � � �~ � � � � � �� � � � {� � � � � � > 0 < c3 < c4 � �� { } � � �� �� � {� � � � { �� { ��{ �� � �� ��> } { �� � � � � � � � �� � �� � � ��

c3n ln n < pn < c4n ln n.

l �� � j� " � % b$ " ' �( u � � x=pn

� � � C % � � � '� � " � � �� d � � � � m z

�� " � �" ' � hc1

pn

ln pn< n < c2

pn

ln pn.

B � �c E k k � � � E � � ( � �& � � � �! � � Ck %� ' �� E � �� '�E $ " ' � � � % C# � z

ln pn + ln c1 − ln ln pn < ln n,

� " � � � � � � � � h �$ " � " �# E � m � % b D �c n$ � �� ' �h % � '� � ��E � �

1

2ln pn < ln pn + ln c1 − ln ln pn,

" �

pn <1

c1n ln pn <

2

c1n ln n = c4n lnn.¢ � a E k k � � � E � � ( s� � � � � pn > n� � � �

pn >1

c2n ln pn >

1

c2n ln n = c3n lnn. �

� U � ( T X * � q � �~ � � � pn

� n� � } � {� � { � � � � � { ? �{� �� } � � � �� {� { �> �� {� � � � � � � � 0 < c5 < c6

� } �� � � � � � �> � � � � � �� � � ��

c5 ln n < pn+1 − pn < c6 ln n. �

Page 22: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� � ��� � � N �� L� N L � � N L J IG �� N� � �

�� � � � �� ! � � � � � � �� �

� � � � � � � � � XV o� S XV T Y �� S

u �h �" � E � j '� E � � � �E � � y " $ %�h Cy �� ` �" �h � �$ " � ��E �k '$ �c

� � �$ " d c # � $ � % � E � � �� ' �$ c �h k � �c E �� �" � � �& � j� h � E E �& �# � $ %� N( � z

�� # � $ % � ¤ � ' d m �� $ d '� � '$ � # � $ %� � �� " E d � ¤( i j �$ " � ' D � c $ k # � $ � %

�$ " � ' %k � E � � �E b D � � % 'h � E E � $ % C# � � �" �# � $ % � f & � ' d m �� $ d '� z

� '$ � # � $ %� � �� " E d � f � � " � � h � %� �( g$ % � �� � ' �� �$ " � ' D � � $ k # � $ % �

� � � ' d D � � " b√

Nc � " � �� m �" C � ��� �� �� � � � �$ � � % b� C '$ � �" � m �� E E d �

� �$ " � ' D � � $ k # � $ %� k ' %k y " $ k � � �$ " d �)( u � � �" � E � �h E � � � �$ " ��

# � $ % � ' j� h � E E � � E " � � '� %� E � m Ch �" C � C ��E �(l� E E d ` �" �h � � j ' � %k � " $ " � � � " b E �a �$ " ' � � � �$ " d c # � $ � % �E � �E

E � Ch � m�E h %k � � � '� �� � � � �$ " �" d j� h � E E �& �# � $ %� ( s� E � �E � � � � h �k

�� D � " � � � � � m � m ��E �k 'E � $ " �k �� � ' �� k # � $ " � � $ � � % b j Cy " $ k h %k� � � �$ � � '� E �k � E �a �$ " '# � $ � % � � m %� h � y � �c " � � % � �E d C$ % � ' � z

� ( � %� � " �& � � �� j �� m� " d '� y " $ k $ �� �� � % bE d � � � � � � � � ��$ $ � � d � E �

� �" � � d c � �� �� �� �� � � �$ � � '� E �k � ' d � � %E k y " $ k �# �E b � � ���� " � 'E �(

� � � q � �� X �� ] � U) TV � S

B , 5 5¥ &( w( B� � �E & � � C m % � � � '� %$ %�h Cy � Cy " � � �� C� � � � � � $ d '� z

� Cy l( B � % b$ �E C(��V � � S � z �� �� � {� { n� � � �~ � � � �~ � � { � �� �� � � �� � �� � � > +

%� &

n �} � {� � { � ;

% m &

(n− 1)!≡−1 (mod n) ?l �� � j� " � % b$ " ' �( B$ % C# � � n=2 C" '� � a h �E � � �# � ' �h E �( g$ z

% � n=p>2 * � � �$ " �� � " �� � a h d ` � %� �E " a � � %k � �" % �# E d ` �" 1 � −1� � �" � m �� " E d `

a−1 � � � �# � a 6= a−1( u � �" � C

(n− 1)!≡ (−1)∏

a6=1,−1

aa−1 ≡−1 (mod n).

g$ % � n = ab *$ �$ " � 'E �� � 1 < a < n� " � a | (n− 1)! � � $ %�h � '� " � % b z

E � � (n− 1)!k ' %k �" $ k E � � m �� " � d � %� �E " � � � % b ��

Zn( u � �" � C

(n− 1)! 6≡ −1 (mod n)( s� � � � � h �� � j� E � ( �

+, ,.- � � � � � � 4 � � � � /1 �1 � ��

l� E E d `� � � " � � � ` � E �&h � m!d '� �" Ch � m�E 'h �� � j� " � % b$ " '� c �E � � � � z

�E k " b � & �h %k � � � ' � �� � � � �$ " �" d E � ' � j �a E � ' ' �h C m � % b D � `" � C z

h �� � �$ " �)(

� � � 8 � �� T X � S V T� V * � S UV ] X �V � � p � �� S � %� k " � � �� � n � � � C" '� � a h � �" � # " � � $ % � n � � �$ " �� � " � ' d � � % z

E k � " $ k C$ % � ' � � +} � � �� �� a ∈ {2, 3, . . . , n− 1} � �� � � �� � � { � �� �� � � � �

an−1 ≡ 1 (mod n).

% , &

£ m �� " E �� C" '� � a h �E � � E � ' � �E �(i j �" � `" � � � � d $ %�h C�" �# " � � $ % � $ �� 'E �E � � % , &E � ' d � � %E �E �c �" k

m!d h %k �h E �& �# � $ %� a ' �E " � � '� %� {1, 2, . . . , n− 1}� " � n *$ �$ " � 'E ��(u � �" � C �a E � � ��h % �a � " b$ %�h Cy � � ` � � � {� � � {� � � > �� �� � } � {�� � {� > +, & ' d m � �� � $ % C# � `E �� # � $ % � � j �E " � � '� %� {1, 2, . . . , n− 1} � � � � z

' � �k � $ � � � � by � % & � � � " � g '� % �h � C$ % � ' � � (a, n) = 1 ;¤ & � $ % � �E �E � ' d � � %E k �" $ k � " � �" ' �" � n *$ �$ " � 'E ��� ;

f & � � � ' � �k � ' d � � %E � �$ " b$ �� 'E �E �k % , & ;

� & � $ % � $ �� 'E �E � � E � ' d � � %E �E � � " � �" ' �" � n *$ �$ " � 'E ��� ;

2 & �$ % � $ �� 'E �E � � ' d � � %E �E � � " � �" '�" E � � j ' �$ " �E � E � �a E � � � z

'" � � � " b" �$ " � �� �� j(

g$ % � ' d � � %E k � " $ k $ �� 'E �E � � % , & � " � & � ' � �k " � # " � # � $ % � n k ' z

%k � " $ k } � � � � {} � {� � > � } { {� � { �� � � � a( �� �" � � # " � $ C ��$ " ' C�"

m�$ � �E �# E � E �& � �� �# � $ � % (a, n) � &h � n *$ �$ " � 'E �� � �$ � 'h � � � �$ " ��

� � �$ E � '� E � y a( ¢ � � � � � � � � � � (a, n) = (2, 341) � � % C# � � 2340 ==(210)34≡1 (mod n) �c �" k 431=11·31( u � � ' �h � E � � �E b D � � � � � � � d

�E � � % bE d c �$ � 'h � � � �$ " d c # � $ � %h %k �$ E � '� E � `

a = 2, 3, 5, 7(

a n

2 341 = 11 · 313 91 = 7 · 135 217 = 7 · 317 25 = 5 · 5

l %k %y m �& � a > 1 � � �" $ k m�$ � �E �# E � E �& � �$ � 'h � � � �$ " d c # � $ � %

� � �$ E � '� E � y a( ¢ � � � � � � � �� � � } � � � (2, n)~ � { � � �� � { �� � � � � � �� � � � � �� { � } � � � (2,2n−1)� �� � � � �~ ~ � { � � �� � { �� � � % v( _" � `� � '� % bh � , 4 � 5 &(

Page 23: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� � � � �- � � � 2 �� 1 � �� / 4 � � � �� � � � 1 � �

l� `$ " ' � " � % bE � � 2n − 2 = 2(2n−1 − 1) = 2tn � � � E �� �" � � � t( u � �" � C

22n−2 − 1 = 22tn − 1 = (2n − 1)(2(2t−1)n + . . . + 1)≡ 0 (mod n).

¢ � �$ % � # � $ % � n$ �$ " � 'E �� � " � � 2n − 1" � � a � $ �$ " � 'E ��( s� � � � m �� z

j � � � � �" $ k m� $ � �E �# E � E �& � �$ � 'h � � � �$ " d c # � $ � % � � �$ E � '� E � y 2(u � � a>2 �a E � ' �$ � � % b j � '� " b$ k $ %�h Cy �� C" ' � � a h �E � � � � �" � � ��

� � �h %� & � � " $ k h �� � j� " b '� � # �$ " '� C � �� a E �E �k � � �� �� ��{� { � � � � � � {� {} � {� � {� { � � � � � p � �� � {� { a� �� {� { � �� { (a2 − 1, p) = 1� � � � � { a2p−1a2−1�~ �� � } � � � � {} � {� � > �} { {� � { �� � � � a ?B" � a � ' �� k �$ � 'h � � � �$ " d c # � $ � % �" E �$ � " � % bE � � % �( ¢ � � � � � � �� j '� $ " E � �# " �$ C ��$ " ' C� " '$ � & � 21853 �$ � 'h � � � �$ " d c # � $ � % � � �$ E � '� z

E � y 2$ ��h � 1091987405 � � �$ " d c # � $ � % �E b D � c � # � 25000000000(u � � ' �h � $ ' � `$ " '� �$ � 'h � � � �$ " d c # � $ � %(

� X * �� W (�� � � � �~ � � � n� � � � � � { � � {� � � �� { � ? �{� ��

%� &

n} � � � � {} � {� � { � } { {� � { �� � � � a �� { � � � { �� � { �� { �� �~ � � � �� {� �� (a, n) = 1 � } { �� � {� � � � �� � � � a �

Zn

�� � � � � � � � { n− 1 ;

% m & �� � � n } � � � � {} � {� � { � } { {� � { �� � �� � a � b ∈ Z∗n

� � { n } � � � � {�} � {� � { � } { {� � { �� � � � � ab � ab−1 ;

% ' & �� { � �� � � { Fn={a ∈ Zn : an−1 ≡ 1 (mod n)} { ��� �� ~ �� } { �� �~ } �} ~ �~ �� � � } � �� � � � �� { �� �~ } } >

Z∗n

;

% & & � � � � n � � � � �� � � � � } � � � � {} � {� � > � } { {� � { �� � �� a� {� � �>{ �� {� { � � � � � a � � { |Fn|6 12 |Z∗

n| ?l �� � j� " � % b$ " ' � �# � ' �h E �( �i j � CE � " � % & & � '# � $ " E �$ " � � $ %�h C�" � # " � �$ % � h %k # � $ %� n � � �" $ k

c �" k md �h E � �$ E � '� E � � a� � �� �" � � � C �E �E � k ' %k � " $ k �$ � 'h � � � � z

$ " d � " � � � � " $ k � �� �� `E � ` � �� (n−1)/2# � $ � % � � �� �" � � d h � E E ��

# � $ % �" � � a � E � k ' %k � " $ k �$ � 'h � � � �$ " d (£$ � md `$ % C# � ` $ �$ " � ' %k y " $ �$ " � 'E d � # � $ %� � h %k � �" � � d c C$ % � z

' � � % , & ' d � � %E k �" $ k � � � '$ �c �$ E � '� E �k c ( £E � E � j d '� y " $ k } � � � � {�} � {� � > � � # � $ %� � � � % � � � � � � � � �� � �� �� � � (s� � � � m �� j � � � � � � � � �E �E � � � � � $ � E E �& � ' d D � " � $ " � �a � " ' � j z

E � � E C" b" � � $ � " C� �� � +

*# � $ % � n � � �$ " �� � " � $ " '$ � &h � & � ' � � � " � E � � j '�$ " E �� ;

*# � $ % � n$ �$ " � 'E �� � E � k ' %k �" $ k # � $ % � r� � � `� %� ;" �&h � $ '� z

� �k " E �$ " by C$ ��c � E � �E b D � 1/2" � $ " h � � " �" ' �" � n *$ �$ " � 'E ��� ;

*# � $ % � n$ �$ " � 'E �� � k ' %k � " $ k # � $ % � r� � � `� %� � " �&h � " �$ " '$ � z

&h � h � �" �" ' �" � E � � j '� $ " E �� (

+, ,.- � � � � � � 4 � � � � /1 �1 � � �

¢ � % �# � � " ��" b� `$ � " C� �� � k ' %k �" $ k �# �E bE � Ch � mE d $ ' � `$ " ' �

h � E E �& �" �$ " � ( l %k � �� � " � � � E C a E d " � � � � " � $ " d � '� �" � � d c " �� " bk

$ � " C� ��k E � ' � jE � � � � " ( l %k � �$ " � ��E �k " � � �c " � $ " � ' � j C# � $ E � # � %�

$ ' � `$ " '� # � $ � % r� � � `� %� (

� � � = � � *V ] TX * S Z T� U � S� S ] � U S¢ � � �" �� m C�" $ k $ %�h Cy �� k

��� S % �� C$ $ � , e¥ , &( z �� �� � {� { � � � � � � {� { } � {� � {� { p � �� ��{� {

m>1 �~ �� � � } � �� � � � �� � � � �~ } } � � { �� � �Zpm

� � �� � � � � � �� � � � �� � { � ?l �� � j� " � % b$ " ' �( iR � �

|Z∗pm |= ϕ(Zpm) = pm−1(p− 1).

l %k %y m �& � � %� �E " � a � � ��h � % � � & � � � �k h �� � � �h C %y pk � � � �

ordk(a) = min{t > 1: at ≡ 1 (mod pk)}.

�� �" � � # " � � CE � ��k ordk( ) � � �" � md # E d � $ ' � `$ " '� � � �k h � � (B# � $ " E �$ " � � �$ % � � � �k h � � h ' Cc � %� �E " � ' ' j� � E � � � �$ " d � " � � � �k z

h �� � � � � j '�h �E � k �� '�E � � � � j ' �h �E � y �c � � �k h � � '( r � � � " �& � � � � �

1 6 k < m ' d � � %E k � " $ k �� ' �E $ " ' � ordk(a) | ordk+1(a)� " � � � � � �" � m �� z

a �E � � a 7→ a mod pkk ' %k � " $ k & � � � � � � j � � � % b ��

Zpm

'� � % b � �

Zpk � � � � �k h �� � m �� j� h � % � " � � �k h �� � � � � m �� j� (u � � k = 1� � % b � �

Zp

k ' %k � " $ k � � %� � � � �" � C '

Zpm

E � `h �" $ k � %� z

�E " g0 � � � y � � ` � � �h C %y p � � �k h �� p− 1(u �� � a � � # " � �h �E � j � %� �E " � ' g0

� % � g = (p + 1)g0

� � �" � � z

�k h �� p(p − 1) � � �h C %y p2( g$ % � � %� �E " g0

E � " � � � ` � " � �E � � �"

� � �k h �� p− 1 � � �h C %y p2( u �$ � � % b� C � %� �E " g � ��h $ " � ' � ' ' �h �

� � � � j '�h �E �k � %� �E " � p + 1, � � y �� & � � � �k h �� p

(p + 1)p =

(

1 + pp +

(

p

2

)

p2 + . . .

)

≡ 1 (mod p2),

� � %� �E " � g0

� � �k h � � p − 1 � � �h C %y p2 � " � � & � � � �k h �� h � % a �E

�� 'E k " b$ k � � � � j '�h �E � y p(p− 1)(s� �� � b � E h C� �� � ` � � mh �� � a � � # " � � $ % � C � %� �E " � g � � �k h ��

ord2(g)=p(p−1)� " � ordm(g)=pm−1(p−1) � � � %y m � m>2( u � � m=2�" � '� �E �( u ��h � � % �a � � # " �h %k m − 1 �" � ' � �E � � " ( �( ordm−1(g) == pm−2(p− 1)( s �&h �

g(p−1)pm−2 ≡ 1 (mod pm−1) � g(p−1)pm−3 6≡ 1 (mod pm−1).

Page 24: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� � � � �- � � � 2 �� 1 � �� / 4 � � � �� � � � 1 � �

l %k � � �$ " �" d j� � � $ � � � % �a � h=g(p−1)pm−3( s �&h � h � E E d � $ �� 'E �E �k

� � � C" ' �h

hp ≡ 1 (mod pm−1) � h 6≡ 1 (mod pm−1).

_ %�h � '� " � % bE � �

h≡ (1 + kpm−2) (mod pm−1), (k, p) = 1,

�" � Ch �

hp ≡ (1 + kpm−2)p ≡(

1 + pkpm−2 +

(

p

2

)

k2p2(m−2) + . . .

)

≡ 1 + kpm−1 6≡ 1 (mod pm).

_h � C& � `$ " � � �E d � hp2

= (1 + kpm−1)p ≡ 1 (mod pm)( s� � � � m �� j � �

pm−2(p− 1) = ordm−1(g) 6= ordm(g),

E � ordm(g) | pm−1(p− 1)( £" $ y h � $ %�h C� " � # " � ordm(g) = pm−1(p− 1)(�� � h �� � j� E � ( �l �� � a � " � '� � # �$ " '� C � �� a E �E � k $ %�h Cy � Cy " � � �� C �$ C �� $ " ' � z

'� E � � � � � � " � 'E �& � � %� �E " � '� � % b �� ' d # �" � '(��V � � S % �� C$ $ � , e¥ , &( �~ �� � � } � �� � � � �� � � � �~ } } � � { �� � �

Zn

� ���� � � � � � �� � � � � �� { � �� { � � � { �� � { �� { �� �~ � � � �� {� �� n � { �� { ��� � � � � 2 � 4 � pm � � � � 2pm � � �� m > 1� p �� � � � � � { � } � {� � { � ?

��V � � S % r� � � `� % � , 4 , ¤ &( �~ � � � n� � � �� � { � � {� � � �� { � ? �{� ��

%� & � � � � p2 |n � p > 1� � { n� � � � �� �� � � � � � � { � �� � �� �� � � ;

% m & �� � � n = p1p2 . . . pk � pi 6= pj � � { n � � � � � { �� � �� �� � � � � { �� � { �� � { � � { � � �~ � � � � � {� �� } � � �� �� i �> } { �� �� { ~ � � { � � �(pi − 1) | (n − 1) ;% ' & � � � � n = p1p2 . . . pk � pi 6= pj

� � � � � { �� � �� �� � � � � { k > 3 ?

l �� � j� " � % b$ " ' �( %� & u C$ " b n=ptm� t>2� (m, 2)=1( u C$ " bh %k

� %� �E " � a ' d � � %E �E � C$ % � ' � � ord2(a)= p(p− 1)( s �&h � # � $ % � nE � k ' z

%k � " $ k �$ � 'h � � � �$ " d � � �$ E � '� E � y a � " � � � � � �$ % � an−1≡1 (mod n)�" � � an−1 ≡ 1 (mod p2)( £" $ y h � h � % a E � md " b p(p − 1) | (n − 1) � # " �

� � �" � ' � ��# � " C$ % � ' � y p |n(% m & l �$ " � " �# E �$ " b( u C$ " b n = p1p2 . . . pk � pi 6= pj � � � � � '$ �c

i ' d � � %E �E � C$ % � ' � � (pi − 1) | (n− 1)� � % � n−1=(pi − 1)mi( s �&h � h %k

%y m �& � �$ E � '� E �k a � � % C# � � � # " � � � � '$ �c i ' d � � %E �E �$ �� 'E �E � �

+, ,.- � � � � � � 4 � � � � /1 �1 � � 7

an−1 ≡ (api−1)mi ≡ 1 (mod pi) � � � �� � " � `$ � � ` " � � �� � � m �$ " � " � � c

an−1 ≡ 1 (mod n)(¢ � � mc �h � �$ " b( u � � � � a h � i=1, . . . , kE � `h �" $ k � %� �E " ai" � � � ` �# " � ord1(ai)=pi−1( s �&h � � j C$ % � ' �k an−1i ≡1 (mod n)$ %�h C�" �# " � (pi − 1) | (n − 1)(% ' & g$ % � k=2� � n=pq � p<q � " � n−1=p(q−1+1)−1≡p−1 (mod q−1)(w" � � � �" � ' � ��# � " C$ % � ' � y (q − 1) | (n − 1) � " � � � � � 0<p− 1<q− 1( �� � $ %� r� � � `� %� k ' %k y " $ k h �$ " � " �# E � ��h � � � ( s� � � � � �" $ k

'$ � & � 2163# � $ � % r� � � `� %� E � � �� ' �$ c �h k ��c 25 000 000 000( l �

, ¥ ¥ ¥ ¥ ¥ # � $ %� � r� � � `� %� k ' %k y " $ k " � % b� �$ %�h Cy � � � 16# � $ � %

561� 1105� 1729 � 2465� 2821� 6601 � 8911 � 10585 � 15841 � 29341� 41041�

46657 � 52633 � 62745� 63973 � 75361( u � � ' � �� � " �& � � k ' %k �" $ k % � j� h � E z

E �� # � $ % �# � $ % � r� � � `� %� � $ �& %� $ E �h �� � j� E E � `" � � �� � " �� m C�"

E � c �a h �E �k �� j % �a �E �k # � $ %� E � � � �$ " d � $ � E �a � " � % � � " ( �( �� � z

" � � � j� �� � # � $ %� ( u �$ � � % b� C j� h � # � �� � " � � � j� �� � # � $ � % k ' %k �" $ k

m � %� � $ % �a E � ` � # � j� h � # � � � � '� �� � � � �$ " �" d � " � � ��h '� � � " � % bE � k

�" m �� � � '� � # � $ � % r� � � `� %� E � � � �h $ " � ' %k � " $ k ' � j �a E � `( u � �" � z

C ' � � � '�h �E E � ' d D � " �$ " � � � �$ " d � # � $ %� � # � $ %� r� � � `� %�

� � %E �$ " b y E � �� j % �# � d (

� � �: � �� T X �V UV * � �� � X� S T T�� S

��V � � S � z �� �� � {� { � � � �� � {� { n� � � �~ � � � �~ � � { � �� �� � � �� � � � � �� > +%� &

n �} � {� � { � ;

% m & � �� �� � {� { a ∈ Z∗n

�> } { �� � �� � � � � � �� �� � �

an−1

2 ≡(

a

n

)

(mod n).

% ¤ &

l �� � j� " � % b$ " ' �( g$ % � n � � �$ " �� � " �h � E E �� $ �� 'E �E � � �# � z

' �h E � ' d � � %E �E � ' $ � % C $ ' � `$ " ' $ � ' � %� �� a � E h �� ( u C$ " b " � �� � b

' d � � %E �E � C$ % � ' � � % m & � E � nE � � � �$ " ��( s �&h �

an−1 =(

an−1

2

)2

≡(

a

n

)2

= 1 (mod n).

u � �" � C nk ' %k �" $ k # � $ % � r� � � `� %� � � � �$ ' � `$ " ' C % m & C" '� � a h � z

E � k ¤ �E �h � % a E � � � " b ' �h n=p1p2 . . . pk � pi 6=pj( B d m� �� � %� �E " b �E � k ' %k y �� `$ k � '� h �� " �# E d ' d # �" � � � �h C %y p1( u �� � " � `$ � � `

Page 25: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� � � � �- � � � 2 �� 1 � �� / 4 � � � �� � � � 1 � �

" � � �� � � m �$ " � " � � c E � `h � " $ k � %� �E " a� Ch � ' %�" ' � �k y � � ` C$ % � ' �k

a≡ b (mod p1),

a≡ 1 (mod p2),

( ( ( ( ( ( ( ( ( ( ( ( ( ( (

a≡ 1 (mod pk).

l %k �" �& � � %� �E " � h � % a E � ' d � � %E k " b$ k �� '�E $ " ' �

(

a

n

)

=

(

a

p1

)(

a

p2

)

. . .

(

a

pk

)

=

(

a

p1

)

=

(

b

p1

)

=−1.

u � C$ % � ' � y h %k h � E E �& � � %� �E " � h � % a E � ' d � � %E k " b$ k $ �� 'E � z

E � � % ¤ & � �" � Ch � an−1

2 ≡( an )≡−1 (mod p2)( B � $ " � $ " � � $ �& %� $ E � ' d m � � C

� %� �E " � ah � % a E � m!d " b a≡ 1 (mod p2)( u � �" � ' � ��# � �( �� � $ %� n� Ch � ' %� " ' � �k y �� � $ �� 'E �E � y % ¤ & � � � a∈Z∗n

� E � j d '� y " $ k

� � � � � { �> � � } � � � � {} � {� � > � � } { {� � { �� � � � a( Bh � E E � $ % C# � � '$ � % C

h �� � j� E E � ` ' d D � " � � �� d � � % C# � � � # " � � E � % �& � # � $ � % r� � � `� %� �� �" � � d � md % � md $ �$ " � 'E d � � � ` %� � � ' d � �$ � 'h � � � �$ " d � h %k '$ �c

� %� �E " � ' a � jh �$ bE �" ( l� E E d ` � � j C % b" � " m!d %E � j� ' � $ � � � � % C# �E

l( �� � � � ' , 4 5� &( � v( _ � % � '� � � B( x" �� $ $ �E � ' , 4 5 5 &(v( _ � % � ' � ` � B( x" �� $ $ �E � � �h % �a � % � $ %�h Cy � � ` '� � �k " E �$ " E d `

" � $ " h %k � � � '� �� � � � �$ " �" d # � $ � % +

, & ' d m � �� � $ % C# � `E �� # � $ % � a � j �E " � � '� %� {1, 2, . . . , n − 1} �

� � � '� �k � $ � � � � by � %& � � � " � g '� % �h � C$ % � ' � � (a, n) = 1 ;¤ & � $ % � �E �E � ' d � � %E k �" $ k � " � �" ' �" � n *$ �$ " � 'E ��� ;

f & � � � ' � �k � ' d � � %E � �$ " b$ �� 'E �E �k % ¤ & ;

� & � $ % � $ �� 'E �E � � E � ' d � � %E �E � � " � �" ' �" � n *$ �$ " � 'E ��� ;

2 & � $ % � $ �� 'E �E � � ' d � � %E �E � � " � �" '�" E � � j ' �$ " �E % � " � $ " �a E �

� � '" � � � " b � �� �� j &(

_ % �a E �$ " bh � E E �& �" �$ " � � � � � � " � $ " � E � �$ E � '� � % � `" � � �� d

n � � � � � ��E � '� � " $ k ' � % �# �E � `

O(log3 n)(l� E E d `" �$ " � � %E �$ " by � E � % �& �# �E " � $ " CE � �$ E � '� � % � `" � � �� z

d n � � � � �h E � � � � �E � m %� h � �" � � D � y � � � � � � C �� $ " ' � * � � � � & �

� $ � � % b j � '� E � � ' � jE � � � �" " � % b� �h '� $ � " C� �� � +

*# � $ % � n � � �$ " �� � " � $ " '$ � &h � & � ' � � � " � E � � j '�$ " E �� ;

*# � $ % � n$ �$ " � 'E �� � " �$ " $ '� � �k " E �$ " b y C$ ��c � E � �E b D � 1/2h � �" �" ' �" � n$ �$ " � 'E ��� (

+, ,.- � � � � � � 4 � � � � /1 �1 � � �

u �$ %� � � '" � ��E �k " �$ " � k �� j '� � �k " E �$ " bE � �" m �� � � '� � $ �$ " � 'E � z

& �# � $ %� E � � �� ' �$ c �h � " 1/2k(l �� � j� " � % b$ " ' � � ��E � � ' � � �k " E �$ " � C$ ��c � ' d " �� � � " � j$ %�h Cy �� z

& � �# � ' �h E �& � C" '� � a h �E �k � � E � % �& �# E �& � C" ' � � a h �E � y 1(

� X * �� W (�� � q � �~ � � � n� � � � � � { � � {� � � �� { � ? �{� ��

%� & �� � � n � � � � � { � { } � � � � {} � {� � { � } { {� � { �� � � � a ∈ Z∗n

� � { {� {} � � � � {} � {� � { � } { {� � { �� � � � a ;

% m & �� � � n � � � � � { � { } � � � � {} � {� � { � } { {� � { �� � �� � a, b ∈ Z∗n

� � { n

� � � � � { � { } � � � � {} � {� � { � } { {� � { �� � � � � ab � ab−1 ;

% ' & �� { � � � � � {En =

{

a ∈ Z∗n : a

n−1

2 ≡(

a

n

)

(mod n)

}

� � �� � � � � } { �� �~ } } { �� �~ } } > Fn = {a ∈ Zn : an−1 ≡ 1 (mod n)} ;% & & � � � � n � � � � �� � � � � � � � � � { � { } � � � � {} � {� � > � } { {� � { �� � �� a� {� � �> { �� {� { � � � � � a� � {

|En|61

2|Z∗

n|. �u � � ' �h � m� jh �� � j� " � % b$ " '� � �� �h �E �� j C % b" � " (��V � � S � =� � � � � �� � { ��{ � ��� � � � � � } {� �� � �� �� � � � � { �~ �� � � �~ �� � � {� � � � � � � C>0� �� � � � �� { � � � � n� � �� �� � � � � � � � { � { } � � � � {} � { �� � > � � �� �� �� {� � { �� � � �

a �� � � � � � �� � � 1<a<C log2 n � � { n �} � {�� � { �( �

� � � @ � �� T X � S � � S � '� U U �� S

u C$ " b n *E �# �" E �� � n−1=2st � t *E �# �" E ��( g$ % � # � $ % � nk ' %k �" $ k

� � �$ " d � " � � � � '$ �c a > 2 ' d � � %E k � " $ k $ �� 'E �E � � an−1 ≡ 1 (mod n)(u � �" � C� �� $ $ � " � � '� k � %� �E " d at, a2t, . . . , a2s−1t �a E � j� � " � " b �# " � % � m �$ ��h � E �c E � `h � " $ k �� 'E d ` −1 (mod n)� % � m � at≡1 (mod n)(¢ � �" � j� �# � E � � �$ E � '� E $ %�h Cy � � ` '� � �k " E �$ " E d `" � $ " � � � z

$ " �" d +, & ' d m � �� � $ % C# � `E �� # � $ % � a � j �E " � � '� %� {1, 2, . . . , n − 1} �

� � � '� �k � $ � � � � by � %& � � � " � g '� % �h � C$ % � ' � � (a, n) = 1 ;¤ & � $ % � �E �E � ' d � � %E k �" $ k � " � �" ' �" � n *$ �$ " � 'E ��� ;

f & ' d # � $ %k � at (mod n) ;� & � $ % � at ≡±1 (mod n) � " � �� ��c �h � � �( , ;

Page 26: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

�� � � �- � � � 2 �� 1 � �� / 4 � � � �� � � � 1 � �

2 & ' d # � $ %k � (at)2, (at)4, . . . (at)2s−1

(mod n)h �" �c � � � � � �� � E �

� �k ' � " $ k −1 ;

� & �$ % � E � �h E � � j �" �c # � $ � %E � �� 'E � −1�" � �" ' �" � n *$ �$ " � 'E ��� ;

5 & �$ % � d h �$ " � & % � −1� " � �" ' �" E � � j ' �$ " �E % � " �$ " �a E � � � '" � z

� � " b � �� �� j &(A � � �! �" � # �$ � � k $ % �a E �$ " b h � E E �& � " � $ " � � �# � ' � h E � � $ �$ " � ' %k z

� " O(sn)(¢ � j � ' � # � $ % � n� � �� � { } � � � � {} � {� � > �} { {� � { �� � � � a� �$ % � ' d z

� � %E k � " $ k C$ % � ' � � +

at ≡ 1 (mod n) � % � ∃ r, 0 6 r < s, a2rt ≡−1 (mod n).

%f &

u �� � a � � E � � � � � � � � �# � C# � $ % � r� � � `� %� 561 = 3 · 11 · 17E �

k ' %k �" $ k $ � % bE � �$ � 'h � � � �$ " d � � �$ E � '� E � y 2( iR � � 561−1=16·35(u �� � " � `$ � � `" � � �� � � m �$ " � " � � c # � $ % � ¤ � ��h $ " � ' %k �" $ k �$ " � " � � �

(2, 2, 2) � � � �" � C � & �$ " � ��E � � � y " $ %�h Cy �� ` ' �h +

mod 3 mod 11 mod 17 mod 561

235 −1 −1 8 263(235)2 1 1 13 166

(235)4 1 1 −1 67

(235)8 1 1 1 1

(235)16 1 1 1 1

s� � � � � # � $ % � −1 � ��h $ " � ' %k �" $ k $ ' � � � �$ " � " � � � ' ' � h �

(−1,−1,−1)� " � ' � �� ' � `� � % �E � � # � $ % � −1 �a � " � �k ' � " b$ k " � % b� �

'$ % C# � � � � �&h � � � �" $ k $ " � �� � � $ �$ " �k �� k � j �h E �c −1( u �$ � � % b� C

# � $ %� ' � � % �E � � c '�h C" $ � mk E � j� ' � $ � � � $ % C# � `E � � " � �E " C � " � ' z

E � � �E k " E � � � �# � C '� � �k " E �$ " b � �k ' %�E �k �" �& �$ � md " � k ' $ % C# � �

$ �$ " � 'E �& � n m Ch � " � %� (lRa (   � % %� � ' , 4 52 &( h �� � j� % �# " �� � � � ' �" �h � _ � % � '�k * x" �� $ z

$ �E � $ � % bE � �$ � 'h � � � �$ " d c # � $ � % � � %y m � C �$ E � '� E � y � � �h � mE d c

# � $ %� r� � � `� %� � E � $ C ��$ " ' C� " � � � � �h % �a � % h � " � � �E � � � '� E z

E d ` '� � � � E " � � � '�h �E E �& � ' d D � " �$ " � � � �&h � � � � ' � �k y " $ k '$ � # � $ %�

a E � � �� ' �$ c �h k �� � cn0.133( £E h �� � j� % � # " � h � E E d ` " �$ " h � %� �"

O(n1/7) D � & � ' � � �� ' � % bE � � � ��h � %k � " � k ' %k �" $ k % � # � $ % � n$ �$ " � ' z

E d � % � � � �$ " d ( B , 4 e , &( �( wh %� � E � n( � � `" �E �h � � � � � � � '� % �

� %& � � � "   � % %� �� � C % C# D � % � � ��E � C � � � �! �" � # �$ � � ` $ % �a E �$ " �

h � O(n1/10.89)(

+, ,.- � � � � � � 4 � � � � /1 �1 � �,

 ( v� m �E ' , 4 e¥ &( � ��h % �a � %h � E E d ` '� � �k " E �$ " E d ` '� � � � E " " � z

$ " � � h �� � j� % � # " �h � %k # � $ � % a ∈ Z∗n

� h %k � �" � � d c # � $ % � nk ' %k �" $ k

�$ � 'h � � � �$ " d � �h � E E � C �$ E � '� E � y �E � �E b D � f � �( u � �" � C � �$ %�

� � '" � ��E �k h � E E �& �" �$ " � k �� j ' � � �k " E �$ " bE � �" m �� � � '� � $ �$ " � 'E �& �

# � $ %� E � � �� ' �$ c �h � " 1/4k( £ ��E � � 3/4 � � � z ' �h � � C� E � C % C# D � � � �" � � � � � �E � � � � � � �h %k # � $ %� 652969351=271 ·811 ·2971h � %k # � $ � % a �h %k � �" � � d c h � E E �� # � $ % �k ' %k � " $ k $ � % bE � �$ � 'h � � � �$ " d � $ �$ " � ' z

%k � " 0.7513� � h %k # � $ %� 2000436751=487 · 1531 ·2683 �$ � �" ' �" $ " '�E E � �$ �$ " � ' %k � " 0.7507(¢ � � �E b D � � $ � % bE � �$ � 'h � � � �$ " d � # � $ %� � k ' %k y " $ k $ %� z

h Cy �� � +

a n¤2047 = 23 · 89f

121 = 11 · 112

781 = 11 · 715

25 = 5 · 5

� �" k " � � �c # � $ � % � % � � h %k � � a h �& � # � $ %� a > 1 $ C ��$ " ' C z

� " m�$ � �E �# E � E �& � $ � % bE � �$ � 'h � � � �$ " d c # � $ � % � � �$ E � '� E � y a(£h E � � � � � m ��h �E k k " � $ " d h %k E � $ � � % b� �c jE � # �E � ` m� j � �a E �

� � % C# � " b �� %d ` �k h �E " � ��$ E d c " � $ " � ' � � � j ' � %k y ��c � � � ' � �k " b

� � �$ " �" C � %�E b� �c � � �$ " d c # � $ � % + �$ % � n < 1 373 653$ � % bE � �$ � ' z

h � � � �$ " �� � � �$ E � '� E �k 2 � 3� " � n * � � �$ " �� ; �$ % � n < 25 326 001$ � % bE � �$ � 'h � � � �$ " �� � � �$ E � '� E �k 2 � 3 � 5 � " � n * � � �$ " �� � �$ % �

n < 25 000 000 000$ � % bE � �$ � 'h � � � �$ " �� � � �$ E � '� E �k 2 � 3 � 5 � 7�" � % � m � n = 3 215 031 751 � % � m � n * � � �$ " �� ; % u � � �� E � � _ � % � � � h a �B �&$ " � � � , 4 e¥ & � $ % � n < 2 152 302 898 747 $ � % bE � �$ � 'h � � � �$ " �� � �

�$ E � '� E �k 2 � 3� 5� 7 � 11� " � n * � � �$ " �� ; �$ % � n < 3 474 749 660 383$ � % bE � �$ � 'h � � � �$ " �� � � �$ E � '� E �k 2 � 3� 5� 7 � 11 � 13 � " � n * � � �$ " �� ;

� $ % � n < 341 550 071 728321$ � % bE � �$ � 'h � � � �$ " �� � � �$ E � '� E �k 2 � 3�

5 � 7 � 11� 13 � 17 � " � n * � � �$ " �� % lRa � D � � � , 4 4f & ; � " ( �(B j� � %y # �E � � � � � ' �h � m� jh �� � j� " � % b$ " '� �� j C % b" � "   � % %� �� (��V � � S � =� � � � � �� � { � { � �� � � � � � � } {� �� � �� �� � � � n� � �� � � � �� � �� � { } � � � � {} � {� � > �} { {� � { �� � � � a

� �� �� �� � � � � � a �� � � � � � �� � �

1 < a < 2 log2 n � � { n �} � {� � { � ? �

� � � ?� $V U � V S U) � p ] X � T X � S T \V �� S * S� � \� V TXV X p

u � � ' �h � � � % �E � � � % bE d ` � %& � � � " �� $ � � jE � '� E �k � � �$ " �" d �� �k ' � ' D � `$ k ' � ' & C$ " � ¤¥ ¥ ¤ &( � � j % �a �E E d ` ' � ��h '� � � " � % bE �

Page 27: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

�� � � �- � � � 2 �� 1 � �� / 4 � � � �� � � � 1 � �

'� � � � E " � $ " � " b � ��� � � ���� � �� � � � �� �� � � � � �� � �� � �� � �

� �� � �( � � .� � /

� � � � � % � � �� + � ��� � � ( - �� ( � � � �( 9 -( � � � �� � � �� � � �9 � � �� ( � � � &(A % & � � � " �$ E � '� E E � $ %�h Cy �� � � � " � � � � � � �$ " �" d (��V � � S � �~ � � � � � � � � a � n �� � � �� { } � {� � > ? �{� �� n �} � {� � { ��� { � � � { �� � { �� { �� �~ � � � �� {� �� �> } { �� �� { � �� �� � � � �

(x− a)n ≡ (xn − a) (mod n).

% , &

l �� � j� " � % b$ " ' �( u � � 0<i<n� � � � � � �� �E " � � � xi ' ' d �� z

a �E � � ((x− a)n − (xn − a)) �� '�E (−1)i(

ni

)

an−i( u �" � C� �$ % � n * � � � z

$ " �� � " � '$ � � � � � � � �� �E " d $ �� 'E � d $ E C %� (u C$ " b n $ �$ " � 'E �� � q * � � �$ " � `h � % � " � % b # � $ %� n, " � � � ` � # " �

n = qkt � (q, t) = 1( s �&h � qtE � h � % � " (

nq

) � ' j� � E � � � �$ " �$ an−q � �$ %�h � '� " � % bE � � � � � � � � �� �E " � � � xqE � $ �� 'E � $ E C %� � # " � � h �� � z

j d '� � " " � � � � C( �u � � E � � �$ ��h $ " '�E E � ` � � � ' � �� � �" �& � �� '�E $ " '� " �� m C�" $ k ' d # � $ z

% � " b jE � # �E �k '$ �c n − 2� � � � � � � � �E " � '( u � �" � C ' � � � '�h �E E �

E � a � � %& � � � " � ' �$ " �$ �� 'E �E �k % , & �� $ $ � " � � '� y " $ k $ �� 'E �E �k % � �

h ' C �h C %k & ' �h �

(x− a)n ≡ (xn − a) (mod xr − 1, mod n),

% ¤ &

&h � jE � # �E �k a � r �� �� m � �� y " $ k $ �� � � � % bE d � m �� j � +$ E � # � %� � ��" z

$ k � � �h c �h k �� �� jE � # �E � � r � � j� " � h %k E � & � � � � ' � �k �" $ k $ �� 'E � z

E � � % ¤ &h %k '$ �c � � %d c � jE � # �E � `

a(u � � ' �h � $ � � %& � � � " (

Bc �h + �� % �� n > 1(,( � � %# � $ % � n � � � " ' �h ab � b > 1

& � � �� � �� $ �$ " � 'E ��� ;¤( r = 2 ;

f ( � � � � %

r < n

&

�( � � � � �

2 ( � � %¢ £ l

(n, r) 6= 1

& � � �� � �� $ �$ " � 'E ��� ;

� ( � � %

r � � �$ " �� &

5( ' d # � $ % � " b q *E � � m � % b D � ` � � �$ " � `h � % � " � % b r−1 ;

e( � � %

q > 4√

r log n

& � (

nr−1

q 6≡ 1 (mod r))

4( � ��� � ;

, ¥ ( r← r + 1 ;

, ,( � �

, ¤( � � %

r = n

& � � �� � �� � � �$ " ��� ;

+, ,.- � � � � � � 4 � � � � /1 �1 � ��

,f ( ��� � a � , � � 2√

r log n, �( � � %

(x − a)n 6≡ (xn − a) (mod xr − 1, mod n)&

,2 ( � � �� � �� $ �$ " � 'E ��� ;

,� ( � � �� � �� � � �$ " ��� (

S �Z S� � � x� & , ¤� %& � � � " � 'E �$ �E '$ 'k j � $ " � �# " � � � � � % d c

jE � # �E �k c n �� � ' d ` �� � % % � � � � & �a � " E � E � `" � � $ � � �& �# � $ %� r(l� `$ " ' � " � % bE � � � jE � �� '�E $ " '

r − 1

2> q > 4

√r log n

� � % C# � � r−8√

r log n−1>0( s� � � � � � � % �a � " � % bE d `� � � �E b C �� 'E � z

E � k x2−(8 logn)x−1=0 � � � " ' �h x=4 log n+√

16 log2 n + 1>8 log n � " �

r>64 log2 n( u � � �" � �� � % �a �" j� � � E # � '� " b$ k jE � # �E � � r=n" � % b z

� � � � � � � �$ " d c n � � � �" � C � �$ %�h Cy � � � D � & � �� � j d '� y " $ k E �E C a z

E d � ( u � �� E � % � j � � C� � % & � � � " ( _E � # � %� � �� � a � � # " �h %k j� ' � � D � z

E � k �� � ' �& � �� � %� % � � � � &h �$ " � " �# E � ' d � � %E � " b O((log n)6) D � & � '(£" $ y h � m Ch � " $ %�h � '� " b � # " � ' � '" � � � �� � %� % ��� � &E � h � ' d � � %E � " b

2√

r log n=O((log n)4) D � & � ' � � � � �" � C� %& � � � " m Ch �" �� m �" � " b � � % � z

E � � � % bE �� # � $ % � D � & � ' � � � a h d ` � j� �" � � d c � � �" � � % �E � � � % bE Cy

$ % �a E �$ " b(B �$ � � % b j C� $ k � CE h � �E " � % bE d �� j C % b" � " � g( n � C ' � � � j � E � z

% � " �# � $ � � `" � � � � � # � $ � % %$ ( � ¤ � � � �f ¤ � & � � �" � � d ` � � � '�h � m� jh �� � z

j� " � % b$ " '� (��� S � �~ � � � P (n) �� � � � { �� � � � �� � � � � �� � � � � � n � π1(x) � � � � � {} � {� � > � � � � � � p� p 6 x �~ � { � � �� � { �� � � �� ~ � � { � � � P (p − 1) > x2/3 ?�{� �� � � � �~ � � � � {� � � � � � � c > 0 � � � � ~ �� �� � { � n0

� �� � � � �� { � ���� �� n > n0

� } � � � � � � � �� � � �� � � {� � � � �

π1(x) > cx

log x.

��V � � S � � �~ �� � � �~ � � } { � { � � � � �� � > �� {� � � � � � > a1

� a2

�� � � ~ �� �� � { � n0

� �� � � � �� { � �� �� �� n > n0

� � � � � � �� � � [a1(log n)6,a2(log n)6]� � � �� � � � } � {� � { � � � � � { r� �� { � � �� { r−1 � �� �� } � {� � { ��� � � � � �� q > 4

√r log n � q | or(n) ?l �� � j� " � % b$ " ' �( £ ��E � # � $ % � N � � �$ " d c # � $ � % ' � E " � � z

'� %� [a1(log n)6, a2(log n)6] � Ch � ' %� " ' � �k y ��c C$ % � ' � y

P (r − 1) > (a2(log n)6)2/3 > r2/3

% m Ch � E � j d '� " b " � � � � # � $ %� $ �� �� � % bE d � &( _ �& %� $ E � " � � �� �

Page 28: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� � � � �- � � � 2 �� 1 � �� / 4 � � � �� � � � 1 � �

�� md D � '� � � � E �� �" � � d c � �E $ " � E " � c 0 < c1 < 1 < c2

' d � � %E k y " $ k

E � �� ' �E $ " '�

c1x

ln x< π(x) < c2

x

ln x.

u � �" � C$ C# �" � %� d � � % C# � � � # " � � � � '$ �c nE � # �E � k $ E �� �" � z

� �& � n0

' d � � %E k � " $ k �� � �# � � E � �� ' �E $ " '

N > π1(a2(log n)6)− π(a1(log n)6) >

>ca2(log n)6

log(a2(log n)6)− c2a1(log n)6

log(a1(log n)6)>

>ca2(log n)6

7 log log n− c2a1(log n)6

6 log log n>

>(log n)6

log log n

(

ca2

7− c2a1

6

)

= c3(log n)6

log log n,

&h � � �E $ " � E " d a1

� a2

' d m �� E d " � � � # " � log a1 > 0� log a2 < log log n� c3 > 0� # " � '$ � &h � �a E �$ h � %� " b � � � h �$ " � " �# E � m � % b D � c n(u � %� & � � x = a2(log n)6( s �&h � � � � � j '�h �E � �

Π = (n− 1)(n2 − 1) · . . . · (nx2/3 − 1)

� � �" E � m � %� � x2/3 log n � � �$ " d c h � % � " � %� `( _h � C& � `$ " � � �E d �

x2/3 log n <c3(log n)6

log log n< N,

� � � �" � Ch � % a E �$ C ��$ " ' � '� " b$ �� �� � % bE �� � � �$ " �� # � $ % � r � E � k ' z

%k y �� �$ k h � % � " � %� # � $ %� Π(w" � * � $ � � �� � � �$ " �� # � $ % � � " � � � � � h %k E � & �E � `h � " $ k � � �$ " � `

h � % � " � % b q = P (r − 1) > r2/3 > 4√

r log n� Ch � ' %�" ' � �k y � � ` C$ % � ' � yq | or(n)( l� `$ " ' � " � % bE � �

r − 1

q6

r − 1

r2/3< r1/3 < x1/3,

� � � ' d m � � C# � $ %� Πh � % a E � md " b

nr−1

q 6≡ 1 (mod r).

_h � C& � `$ " � � �E d � '$ � &h � nr−1≡1 (mod r) � � jE � # � " � or(n)E � h � % � " r−1q� or(n) | (r − 1)( s� � �� � h �� � j� E � ( �

+, ,.- � � � � � � 4 � � � � /1 �1 � � �

��V � � S q � � � � { � � � �� � � �} � {� � � ��� ~ � � � { �� {� � � O((log n)12×× pol(log log n)) � � ��

pol(x) �� �� {� { �> � �� {� { � � �� ?l �� � j� " � % b$ " ' �( Ch � h %k � �� " � �$ " � � $ � � % b j � '� " b � m � z

jE � # �E � � O∼(f(n))h %k � ��E � � O(f(n)pol (log log n))(u � % �E � � � % bE �$ " b �� � ' �& � D � & � � %& � � � " � ' d " �� � �" � j" �& � � # " �

� $ % � # � $ % � n � � �" ' �h ab � b > 1 � " � b 6 blog2 nc( u � �" � C � � � ' � �� C

�a E � ' d � � %E � " b � C" � � �$ %�h � '� " � % bE d c � � �d " �� � j ' %�# �E �k � � � z

E k p z `$ " � ��E � h %k '$ �c � � �$ " d c # � $ � % p 6 blog2 nc( l %k E � c �a h �E � k

� � �E k �a E � � E � � � � � � � � � � �E � " b � %& � � � " � �$ %�h � '� " � % bE �& � ' d z

# � $ %�E �k jE � � � ' 'h ' � �# E � ` j� � � $ � # � $ %� x � E � # �E � k $ �$ " � � D � & �(A � �E E � � �$ % � x * �� D �E � � C �� 'E �E � k xp = n �

x =

k∑

i=0

xi2i,

" � xk = 1� �$ % � (2k)p 6 n < (2k+1)p � xk−1 = 1� �$ % � (2k + 2k−1)p 6 n�� " ( h ( _ % �a E �$ " b ' d � � %E �E �k �" �& � D � & � � � � � $ � � % b j � '� E � � � %& � � � " z

� C E �a �E �k x�E c � & � * x" �� $ $ �E � � � �$ %�h � '� " � % bE �& � ' � j '�h �E � k

'� '� h �� " �a E � � ��E � " b '� % �# �E � `

O((log n)4 log log n)=O∼((log n)4)(u �" � � �� � , ' �� � ' � �� � %� % � � � � & ' d � � %E k � " $ k O((log n)6) D � z

& � '( _ C# � " � �� j � �� # � $ %� rh %k ' d � � %E �E �k D � & � '� � 5 �" �h �

� � %E �& � �� �� m � �� '$ �c h � % � " � %� ` � �" �� m C� " $ k E � m � %� �

O(√

r pol(log log n)) = O∼((log n)3)

� �� �� �� `( x� & e � %& � � � " � � � � " $ % �a E �$ " b O(pol(log log n)) � � � z

$ � � % b� C '$ � ' d # � $ %�E � k �a E � � � � ' �h � " b � � �h C %y r( u � �" � z

C $ % �a E �$ " b ' d � � %E �E �k �� � ' �& � �� � %� � ��E � '� �" $ k '� % �# � E � `

O∼((log n)9)(B � '" � � � � � � %� % ��� � & ' d � � %E k �" $ k 2√

r log n = O((log n)4) D � & � '(B d # � $ %�E � � %� ' � `# � $ " � ' �� '�E $ " '� % ¤ & �a E � � � � ' �h � " b$ � � � �E � z

E � � �" �h � � � '" � �E �& � ' � j '�h �E �k '� '� h �� " � � %& � � � " � md $ " � �& �

� � � � m �� j � '� E �k n C � b � h %k C E �a �E �k E �& �# %�E � '$ " � ��E � r( u � �" � z

C$ % �a E �$ " b � � � '� �� � �� '�E $ " '� % ¤ &$ �$ " � ' %k � "

O(r(log n)2pol(log log n)) = O∼((log n)5),

� ' d � � %E �E � k '$ � & � '" � � �& � �� � %� * O∼((log n)12)( s� � �� � h �� � z

j� E � ( �l �� � a � " � �� � b � # " � � % & � � � " ' d � � %E k �" $ ' �y j� h � # C(��V � � S 8 � � � � { � � � � �� � � � �� ~ �� � � � � n �} � {� � { �� � � { � �� { �� � { �� { �� �~ � � � �� {� �� n �} � {� � { � ?

Page 29: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� � � � �- � � � 2 �� 1 � �� / 4 � � � �� � � � 1 � �

l �� � j� " � % b$ " ' �( g$ % � n � � �$ " �� � " � ' �� � ' � �� � %� % � � � � &

h %k '$ �c r

m Ch �" (n, r) = 1 � � �� j C % b" � " � n *$ �$ " � 'E ��� E � ' � j �a �E (B � '" � � � �� � %� % ��� � &$ �� 'E �E � � % ¤ &" � � a � '$ � &h � ' d � � %E �E � � � � �" � C

� %& � � � " �a �" j� � �E # � " b$ k " � % b� �$ �� j C % b" � " � � n * � � �$ " ��� (u C$ " b n$ �$ " � 'E ��( u � �h � � % �a � � # " � � %& � � � " h � � " �� j C % b" � "� n * � � �$ " ��� (g$ % � ' �� � ' � � � � %� % � � � � &E � m Ch �" E � `h �E � � $ � � �� � � �$ " �� # � $ z

% � r � " � �� � % j� � �E # � " $ k �� j C % b" � " � r =n( B$ � % C D � & � 2 � %& � � � " �

�" � �a �" m!d " b" � % b� � � � � � � �$ " d c n(v� $ $ �" � � $ % C# � ` � � �&h � ' �� � ' � �� � %� m Ch � " E � `h �E � � � �$ " ��

# � $ % � r" � � �� �# " � r−1 � � �" � � �$ " � `h � % � " � % b q>4√

r log n � q |or(n)(u C$ " b n � � �" '� � # �$ " '� � � �$ " d c h � % � " � %� `# � $ %� pi � 1 6 i 6 k( u � z

$ � � % b� C ' �" � $ % C# � � or(n)h � % a E �h � % � " b¢ £ r

(or(p1), . . . , or(pk)) �" �E � `h �" $ k � � �$ " � `h � % � " � % b p# � $ %� n�h %k � �" � � �& � q |or(p)( s� � � � �

� � � � �h � � % �a �E � y �� j C % b" � " � �� m �" d � % & � � � " � k ' %k �" $ k � n * � � � z

$ " ��� � " � ' � '" � � � � � � %� % ��� � &h %k '$ �c 1 6 a 6 2√

r log n ' d � � %E �E �

$ �� 'E �E � � % ¤ & � � $ %�h � '� " � % bE � � � $ �� 'E �E � �

(x− a)n ≡ (xn − a) (mod xr − 1, mod p).

%f &

w" �$ �� 'E �E � � �� $ $ � " � � '� �" $ k C a � E � h � � %� Fp = GF (p)( u C$ " b

h(x) | (xr − 1) *E � � � � ' �h � d ` E �& �# %�E h(x) 6= x − 1( s �&h � $ �� 'E � z

E � � %f & �a E � j� �E � " b$ �� 'E �E � �

(x− a)n ≡ (xn − a) (mod h(x), mod p),

% � &

� �" � � �� E � $ � � h � %� � jE � # � � " �� ' �E $ " ' � � %� �E " � ' ' � � %�

Fp(x)/(h(x))( s� $ � d j� h � # � $ '� %� $ b � � j C# �E � y $ ' � `$ " ' � %� z

�E " � '� �E �# E �& � � � %k (£$ " � % �$ b � �� � j� " b �# " �$ �� 'E �E � � % � &h %k '$ �c 16a62√

r log n � z

a �" ' d � � %E k " b$ k " � % b� � '$ % C# � � � � �&h � n = pk � � � E �� �" � � � k > 1(u �$ � � % b� C# � $ %� " � � �& � ' �h � C a � md % � �" m �� � � '� E d E � �� � ' � D � z

& C � %& � � � " � � " � � � % C# �E E �� � � �" � ' � ��# � � j� '� � D � " h �� � j� " � % b$ " ' �

" � � �� d (£$ " � ' D Cy $ k # � $ " bh �� � j� " � % b$ " '� �� j � m b� E � E � $ � � % b� � �" � � � '(

,( u C$ " b d = or(p)� � k *$ " � ��E b E �& �# %�E � h(x)( u �� � a � �# " � k = d(_ �& %� $ E � ' d m � � C E �& �# %�E � h(x) '$ � � & �� � �E � h � % a E d � �" b

� � �k h �� r

%" � � � � � � c � � �k h �� h � % � " r � r * � � �$ " �� &( g$ % � deg h(x)=k �" � ' � � %� Fp(x)/(h(x)) '$ � � %� �E " d k ' %k y " $ k � � �E k � C �� 'E �E �k

Xpk −X = 0, � jE � # � " r | (pk − 1)( £" $ y h � pk ≡ 1 (mod r) � d |k(

+, ,.- � � � � � � 4 � � � � /1 �1 � � 7

_h � C& � `$ " � � �E d � " � � � � � r |pd − 1� " �

xpd − x≡ 0 (mod h(x), mod p)

� h %k � � a h �& � � %� �E " � g(x) � � %k Fp(x)/(h(x)) ' d � � %E �E �$ �� 'E �E � �

g(x)pd ≡ g(

xpd)

≡ g(x) (mod h(x), mod p).

�E � # � " '$ � � %� �E " d � � %k k ' %k y " $ k �� D �E �k � C �� 'E �E �k Xpd −−X = 0� � k 6 d(¤( u C$ " b l = 2

√r log n( u �� � a � � # " � � %� �E " d (x − a) � 1 6 a 6 l �� � � �a h � y " ' � � %� Fp(x)/(h(x)) = GF (pd) � � � % �# �$ � Cy � �h & � C � � C G� � �k h � � |G|> n2

√r(v� $ $ �" � � ' & � C � �� G � �h E �a �$ " ' � S � $ �$ " �k �� � � %� �E " � ' � j� z

h � '� � d c E �& �# %�E � � ' �h �

16a6l

(x − a)ua ,

C� �" � � d c∑

16a6l

ua 6 d− 1.u �� � a � � # " � '$ � " � � � � E �& �# %�E d j� h � y " �� j % �# E d � � %� �E z

" d � � %k ( g$ % � m!d $ C ��$ " ' � '� % � � %� �E " d 1 6 a, a′ 6 l " � � � � � # " �

a≡a′ (mod p)� " � md % � md p<l( u � �" � C '$ � % C ' d m � �� # � $ %� r

%� � � �� z

j C % b" � " � �� m �" d �� � ' �& � �� � %� � %& � � � " � & � � � � r>q>4√

r log n>l �� jE � # � " p < r( ¢ � �" � � � �" � ' � ��# � " " � C� # " � '$ � h � % � " � % � # � $ %� n �E b D � � r

md % � �" $ �k E d E � 2 D � & � � %& � � � " � (_ %�h � '� " � % bE � � '$ � " � � � � E �& �# %�E d � � y " �� jE d � � � �E � ' Fp � ��c $ " � ��E bE � � � � ' �$ c �h � " d−1( u � �" � C � $ � �" ' �" $ " ' Cy " �� j % �# E d �

� %� �E " d � � %k Fp(x)/(h(x))(� � $ % � � %� �E " � ' ' S �� 'E �# � $ % C �� j m � �E � `# � $ %� d − 1E � l + 1$ %� & � � d c � �" � Ch �

|G|> |S|=(

l + d− 1

l

)

=(l + d− 1)(l + d− 2) . . . d

l!>

(

d

l

)l

> 2l = n2√

r,

� �$ � � % b� C d = or(p) > q > 4√

r log n = 2l(f ( u C$ " b g(x) * � m �� j Cy � � ` � %� �E " & � C � �d G( u C$ " b

Ig(x) = {m : g(x)m ≡ g(xm) (mod xr − 1, mod p)}.

Page 30: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� � � � �- � � � 2 �� 1 � �� / 4 � � � �� � � � 1 � �

u �� � a � �# " � E �a � $ " ' � Ig(x)

j� � E C" � �" E �$ � " � % bE � C E �a �E �k (u C$ " b m1, m2 ∈ Ig(x)( iR � �

g(x)m1m2 ≡ (g(x)m1 )m2 ≡ g(xm1)m2 (mod xr − 1, mod p).

_h � C& � `$ " � � �E d �

g(xm1)m2 ≡ g(xm1m2) (mod xm1r − 1, mod p),

�" � Ch �

g(xm1)m2 ≡ g(xm1m2) (mod xr − 1, mod p).

�( £ m � jE � # � # � �� j og

� � �k h �� � %� �E " � g(x) ' � � %� Fp(x)/(h(x)) �

og = |G|( l �� � a � � # " � �$ % � m1, m2 ∈ Ig(x)

� m1 ≡ m2 (mod r)� " �

m1 ≡m2 (mod og)(u C$ " b m2 = m1 + kr � k > 0( s �&h � ' � � %� Fp(x)/(h(x))$ � �� ' �h % � ' d

�� '�E $ " '�

g(x)m1g(x)kr = g(x)m2 = g(xm2) = g(xm1+kr) = g(xm1) = g(x)m1 .

s� � � � � g(x) 6= 0� " � � � % C# � � g(x)kr = 1 � �" � Ch � og | kr � m1 ≡ m2

(mod og)(�� '� � D � h �� � j� " � % b$ " ' �" � � �� d (u C$ " b E = {nipj : 0 6 i, j 6 b√rc}( B $ � % C �( f

E ⊆ Ig(x)( s� � � � �

|E|=(1+b√rc)2>r � " � ' EE � `h C" $ k h '� � %� �E " � ni1pj1 � ni2pj2" � � � � �# " � (i1, j1) 6= (i2, j2)

� ni1pj1 ≡ ni2pj2 (mod r)( B $ � % C � ��h d h C �� & �

� CE � " � � � % C# � � ni1pj1 ≡ ni2pj2 (mod og)( £" $ y h �

ni1−i2 ≡ pj2−j1 (mod og).

B �$ " � $ " � � n|i1−i2| � p|j2−j1|<n√

r � � og>n2√

r( u � �" � C ni1−i2 =pj2−j1 �# " � ' � j �a E �" � % b� � '$ % C# � � � � �&h � n = pk � � � E �� �" � � � k > 1(s� � �� � h �� � j� E � ( ��� �" � � # " � c �" k � � � '�h �E E d ` ' d D � � %& � � � " � � �� � j d '� �"

� � % �E � � � % bE �$ " b j� h � # � � � � ' � �� � � � �$ " �" d # � $ � % � �� � % bE � k $ % �a z

E �$ " bh � E E �& �� %& � � � " � E � $ " � % b� � ' d $ �� � �# " � �E � ��h $ " � ' %k �" � �� �

" � % b� �" � � �� " �# � $ � �� jE � # �E � �( w" �$ 'k j� E � � $ �h E � `$ " � � �E d � $ " � �# " � � $ � �" �" �# � $ � � k � ��E � � %� d ,E � # �E � �" � � ���� " � 'E � �� m �" � " b

" � % b� �h %k h �$ " � " �# E � m � % b D � c jE � # �E � `

n( u � �" � C �� � ' d ` � � � %

� %& � � � " � E � `h �" � $ � � �� # � $ % � r" � � a � " � % b� �h %k h �$ " � " �# E � m � % b z

D �c jE � # �E � `

n � � h %k � %�E b� �c � � �$ " d c # � $ � %h � $ " �" '� " r = n�# " � �� � " �# � $ � � m Ch �" � jE � # � " b � � � '� �� C � � �$ " �" d � � %E d �� �� m � z

� � '$ �c h � % � " � %� `( _h � C& � `$ " � � �E d � � j ' �$ " E d `E � � � % �E � � � % bE d `

+ , � - � � /1 � � � �� � � � � �� � � � � � / 1 � � �� / � � � �

h � " � � �E � � � '� E E d ` � %& � � � " � � ��h % �a �E E d ` Ah %� � E � � u � � �� E z

�� � v C % � % � ¤f � & � � C % C# D �E E d ` r � �E � � ��E $ " � � ` % � ¤ 4 � & � � � �"

" � Ch �� � �$ " b O(log nlog log log n)� # " � � � � '$ �c � �� � " � # �$ � � jE � # � d c

jE � # �E �k c nh � �" � � � � %� Cy � ��E � C� % C# D Cy � # � Ch � E E �& � � � % � z

E � � � % bE �& � � %& � � � " � (¢ � � �� � " � � � ' � E �& �c $ % C# � k c Ch � mE � � � $ � � % b j � '� " b m � %� � � � z���� " � 'E d � �� E h � � j � � � '� E E d � � %& � � � " d � E � � �h � m � � �� $ $ �" ��E z

E d c ' d D � " � $ " � ' _ � % � '�k * x" �� $ $ �E � � v� m �E � *   � % %� �� � � � j ' � %k z

y �� � h �� � j d '� " b � � �$ " �" C# � $ %� (

�� � � � � � � � !� ! � �" � � � � � � � � � !"

v� $ $ �" � � " � �� � b" � � � � $ � �$ � md � � � ' � �� � # � $ � %E � � � �$ " �" C� '

� � � � � � �E �E � � � �" � � d c �a E � C" '� � a h � " b � # " � � � � '� �k � d � # � $ %�

h � `$ " ' � " � % bE �k ' %k y " $ k � � �$ " d �)( B �" % � # � � �" " �$ " � ' � ��h d h C �� z

& � �� jh � %� � � �" � � d � � $ � � % b j � '� % � E � � mc �h � d � C$ % � ' �k � � �$ " �" d �

h � '� % � �" '� " d " � �� � n *E � � � �$ " ��� � % � m �� E � jE � y� � % � � '� � �k " z

E �$ " b" �& � �# " � n *E � � � �$ " �� �E � ' d D � j� h � E E �& �$ � � % b C& �h E � � % �& �

jE � # �E �k � �h � E E d � " �$ " d �$ E � '� E d E � � � � �E �E � � h �$ " � " �# E d c C$ % � z

' � ` � � �$ " �" d ( u � �" � C �E � �& C" h � '� " b� � � �" '� " d " � �� � n *E �

� � �$ " ��� �� E � jE � y� � " � � �� n * � � �$ " ��� ( w" �$ ' � `$ " ' � � � � �E k �" $ k

h %k � �$ " � ��E �k � � �$ " d c # � $ � %( £ m �� k $ c � � 'h � E E � $ % C# � � " � � � '� +

' d m � �� �" $ k E �� �" � �� k � �$ %�h � '� " � % bE �$ " b# � $ � %$ �� �� � % bE �& � ' �h � �$ ��h � � �" � � d c " �� m C�" $ k E � `" � � � �$ " �� # � $ % � � j� " � � # � $ %� � j �" � `

� �$ %�h � '� " � % bE �$ " � � � � �E k �" $ k " � $ " h � " �c � � � � � �� � �E E � h � $ "

C" ' � �h � " � % bE d ` �" ' �" ( g$ % � �" �" �" '� " � n *E � � � �$ " ��� � " � ' d m � �� z

� " $ k $ %�h Cy �� � # � $ % �( g$ % � � � % C# �E �" '� " � n * � � �$ " ��� � " � � $ � � ��

� � �$ " �� # � $ % � � �$ " � ��E �(v� $ $ �" � � h �$ " � " �# E d � C$ % � ' �k � � �$ " �" d # � $ � % �� �" � � d � � m!d # E �

� � � �E k y " ' � %& � � � " � c � �$ " � ��E �k h �� � j C� � � � �$ " d c # � $ � %(

� q � � � �� X �� ] ��� �S

_ %�h Cy �� k c � � �D � � j '� $ " E � k " � � �� � � ' �� � ' d � h �� � j� E E � k �y z

� � ' , e 5� &( � � �� ' �� �� �" � % Cy " � � � � C n � � � '� � � " � � � ` � � �$ " �" d

# � $ %� n� h �$ " � " �# E �� C$ % � ' � � � �" � � �& � �a � " md " b � � ���� " � 'E � � $ z

� � % b j � '� E �h %k h �� � j� " � % b$ " '� � � �$ " �" d �" �& �# � $ %� (��V � � S % �y � � &( �� � ~ � � �� � { � � � � � { n� � �� � � � � } � {� � > � �� { �� � { �� � { �� { �� �~ � � � �� {� �� �> } { �� � �� � � ~ � � { � � �

% , & ∃a ∈ Z∗n, (an−1 ≡ 1 (mod n)) ∧

(

∀ q | (n− 1), an−1

q 6≡ 1 (mod n))(

Page 31: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

�� � � �- � � � 2 �� 1 � �� / 4 � � � �� � � � 1 � �

l �� � j� " � % b$ " ' �( g$ % � n � � �$ " �� � " � ' � � %�

Zn

� $ " b � � � z

� " � 'E d ` � %� �E " � � �" � � d ` � m Ch �" � $ � � d ( ¢ � � m � � �" � � C$ " bh %k

� %� �E " � a ' d � � %E k �" $ k C$ % � ' � � % , &( g$ % � ord(a)=m � " � m |(n−1) � � � � z

# � C$ % � ' � � % , & & � �� E " � � C� " �# " � m=n−1( _ %�h � '� " � % bE � � ϕ(n)=n−1� n * � � �$ " ��( s� � � � � h �� � j� E � ( � S �Z S� � % _ � % � � � h a &( �� � { � � � % , & � �� � � { �� � { � � �� � { �� {� � �� �� � � � � � �� � { � �� � � � �~ � � �� � �~ � ~ � � { � � � +

% ¤ & ∃a ∈ Zn, ord(a) = n− 1 ;

%f &

∀ q | (n− 1), ∃a ∈ Z∗n, (an−1 ≡ 1 (mod n)) ∧

(

an−1

q 6≡ 1 (mod n))(l� `$ " ' � " � % bE � � " � � # " � (1)⇔ (2) � (1)⇒ (3) � �# � ' �h E �(l �� � a � � # " � (3)⇒ (2)( u C$ " b n− 1 = qk1

1 . . . qkss(

u � C$ % � ' � y h %k

� � a h �& � iE � `h �" $ k ai

" � � �� � # " � ord(ai) | (n − 1) � E � ord(ai)

E � h � % � "

# � $ % � n−1qi

( _ %�h � '� " � % bE � � qki

i |ord(ai)( �E � # � " � E � `h C" $ k � %� �E " d bi

" � � � � � # " � ord(bi) = qki

i

( s� �� � b � %� �E " a = b1 . . . bs

m Ch � " � $ � � d �" � � � � � � � �k h � � � %� �E " � ' bi

' j� � E � � � �$ " d �

ord(b1 . . . bs) = qk1

1 . . . qkss = n− 1. �

s� � �� � �y � � � � j ' � %k �" h �� � j d '� " b � � �$ " �" C# � $ %� n '$ % C# � � �� �&h � � j '� $ " E � �� j % �a �E � � E � � � �$ " d � $ � E �a � " � % � # � $ %� n−1( l %k

�" �& � �a E � � $ � � % b j � '� " bh �" � � �E � � � '� E E d `� %& � � � " � �$ E � '� E E d `

E � �� �� m � �� '$ �c ' � j �a E d c jE � # �E � `

a ∈ Z∗n

� % � m � ' �$ � � % b j � '� " b$ k

$ %�h Cy �� '� � �k " E �$ " E d �" �h � +

, & ' d m � �� � $ % C# � `E �# � $ %� a1, . . . , as ∈ Z∗n

� � � � '� �k � h %k E �c

C$ % � ' � � % , & ;¤ & �$ % � C$ % � ' � � % , & ' d � � %E �E �c �" k m!d h %k �h E �& � � j �" �c # � $ � % �" � n * � � �$ " �� � �$ % � E �" � " � �" '� " E � � j '�$ " �E (AE � % �& �# E d ` � " �h �a E � � �$ " � � � " b � � $ � � % b j Ck C$ % � ' � � %f &(u � � � % %y $ " � � � C� �" �" �" �h � � � �E � " � % bE � � # � $ %� n � � � (�� � � � � � �� � �� E � j d '� y " $ k # � $ %� ' �h � Fk = 22k

+ 1 � k = 1, 2, . . .

% u � z

� � a � " � � # " �# � $ % � ' �h � 2m + 1 �a �" md " b � � �$ " d '" � � " � % b� �

'" � $ % C# � � � � �&h � m = 2k( &

n � � � ' d $ � � j d '� % � ��h � � % �a �E � � � # " � '$ � # � $ %� " � � �& � ' � z

h � * � � �$ " d �( u � � n = 0, 1, 2, 3, 4 �" �h � `$ " ' � " � % bE �" � � ( ¢ � � � � n = 5�� � � � �� � j� % w ` %� � ' , 5f ¤ &( � $ � �� '�h % � ' � �� j % �a �E � �F5 = 225

+ 1 = 4294967297 = 641 · 6700417.

B , e 5 e &( i '� E   �c � � ' � # u� � ' CD �E � �� � j� % � # " � # � $ %� F12� F23

" � � a � E � k ' %k y " $ k � � �$ " d �)( % �� �" � � # " �# � $ % � F23

� � z

+ , � - � � /1 � � � �� � � � � �� � � � � � / 1 � � �� / � � �,

� " 2525223 �� � � d ( u � � ' �$ � � � � j '�h �E � � " � � �& �# � $ %� � �E � h � m � %� $ b

m!d $ " � �� � h % �E � ` '2 � � % � � E � & � � m �� � ' , ¥ ¥ ¥ $ " �� E � �( &

��V � � S % u� � �E � , e 5 5 &( �� � � � Fk = 22k

+ 1 } � � k > 1� � �� � � � �} � {� � > � � �� { � � � { �� � { �� { �� �~ � � � �� {� �� �> } { �� � �� � � ~ � � { � � �

3(Fk−1)/2 ≡−1 (mod Fk).

l �� � j� " � % b$ " ' �( s� � � � � �h �E $ " ' �E E d � � �$ " d h � % � " � z

%� # � $ %� Fk−1k ' %k � " $ k 2� " �h �$ " � " �# E � � � � '� � � " b C$ % � ' � � " � � � � d

�y � � � � � q=2( u �� � a � �# " � '� � # �$ " '� # � $ %� a �a E � ' jk " b# � $ % � 3�" ( �( h �$ " � " �# E � � � � ' � � � " b C$ % � ' � � 3(Fk−1)/2 6≡ 1 (mod Fn)( i$ � � % b j Ck

� � � C % C w ` %� �� h %k ' d # � $ %�E � k jE � # �E � `� '� h �� " �# E d c ' d # � " � ' �

� '� h �� " �# E d ` j� � �E ' j� � E �$ " � �� C$ $ � � � % C# � � � # " � � � � � � �$ " �

Fk

h � % a E � m!d " b3(Fk−1)/2 ≡

(

3

Fk

)

≡ (−1)(Fk−1)/2

(

Fk

3

)

≡(

Fk

3

)

(mod Fn).

s� �� � b j� �" � � # " � Fk 6≡ 1 (mod 3)� � � � �" � C C$ % � ' � � Fk 6≡ 0(mod 3) �� 'E �$ � % bE � �� '�E $ " ' C Fk ≡ 2≡−1 (mod 3)( s� � � � � h �� � j� z

E � ( �s� � �� � �y � � � �$ % C a � %� �" � �� 'E � `" �# � � `h %k � �$ " � ��E �k �� % � `

& � C � �d " �$ " � ' � � � j ' � %k y ��c � � � ' � �k " b � � �$ " �" C# � $ � %(  E �& � � � j

E � c � � % C# � % � E � j '� E � � (n−1) z �" �h � ' � " � � � � � � ��h � � %� & � y " jE � E � �

� � %E � ` � % � # � $ " �# E � ` �� � " � � � j� � � � # � $ %� n− 1

%$ ( E � a � &( g �� �h z

E � � m � m ��E � � " � � �� d �y � � �$ E � '� E �E � �� $ $ �" ��E � � h � C& � c & � C � �

' �$ " � C % b" � � % � � � " � 'E � ` & � C � �d

Z∗n

( n� � " �# �$ � � � h �� � j� " � % b$ " ' �

� � �$ " �" d # � $ %� n '" � � �� � �y � � �$ E � '� E �E � � j C# �E � � $ ' � `$ " ' & � C � z

�d

Z∗n

+ � $ % � � � � � z % � m � � m �� j � Ch � �" $ k C$ " � E � ' � " b � # " � � � � � �k h ��

�� '�E n− 1� " �# � $ % � n * � � �$ " ��( l� E E � k �h �k %� a � " ' �$ E � '� " � � �c

� " �h � ' � � � � �" �h � % % � �" �# �$ � �c � � � ' d c � � " �h # � $ % � ' �& � � � %k (

� q � q � ��V � � S $V � U � t XV � S

B , 4 , � &( �( u �� % �E &" �E � m!d %� h �� � j� E � $ %�h Cy �� k " � � �� � (��V � � S % u �� % �E &" �E &( �~ � � � n = qkR + 1 > 1� � �� q �} � {� � { � �� � � � �� � �� �� � �� � � � � � � � R ? =� � � �~ ��� � �~ �� � � � { � a� �� { � � �� {

an−1≡1 (mod n) � (a(n−1)/q−1, n)=1 � � {� � � �> �} � {� � { � �� � � � � �� p� � � � � n � �� � � � � �

p = qkr + 1} � � � �� {� { � { � r ?l �� � j� " � % b$ " ' �( u C$ " b p * � � �$ " � `h � % � " � % b# � $ %� n( s �& z

h � � j C$ % � ' �k " � � �� d ' d " �� � � " � # " � an−1 ≡ 1 (mod p) � a(n−1)/q 6≡6≡1 (mod p)( £" $ y h � � � % C# � � �# " � � � �k h �� m � %� �E " � a � � �h C %y p

Page 32: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

�� � � �- � � � 2 �� 1 � �� / 4 � � � �� � � � 1 � �

Ch � ' %� " ' � �k � " C$ % � ' �k + m | (n − 1) � mE � h � % � " (n − 1)/q( u � �" � z

C qk |m( B $ � % C � % � `" � � � � d n � � � m | (p − 1)( _ %�h � '� " � % bE � �

p− 1 = qkr( s� � �� � h �� � j� E � (u � � �E k k h � E E Cy " � � �� Ch %k '$ �c h � % � " � %� `

q# � $ %� n − 1� � � z

% C# � � $ %�h Cy �� `" � � �� C� � �" � �� k k ' %k �" $ k � m � m ��E � � " � � �� d

�y � � E � $ % C# � `

R >

,(��V � � S � �~ � � � n = FR + 1 > 1� � �� 0 < R < F ? =� � � � �� �� ��{ �� { } � {� � {� { �� � � � � �� q � � � � � F �~ �� � � �~ � � � � � { � a � �� { � � �� {

an−1 ≡ 1 (mod n) � (a(n−1)/q − 1, n) = 1� � { � � � � { n �} � {� � { � ?l �� � j� " � % b$ " ' �( u C$ " b n *$ �$ " � 'E �� � p *E � " � � ' � � % bE d `

� � �$ " � `h � % � " � % b# � $ %� n( �� � " � � # " � '$ � &h � �a E � ' d m �� " bh � % � z

" � % b" � � � # " � p 6√

n( s �&h � � j C$ % � ' �k " � � �� d ' d " �� � �" � # " �h %k

'$ �c � � �$ " d c h � % � " � %� `

q # � $ %� F $ C ��$ " ' C� " �� % �� a " � � �� � # " �

an−1 ≡ 1 (mod p) � a(n−1)/q 6≡ 1 (mod p)( v� $ $ C a h � k � E � % �& �# E � j� z

�# � E � y � " � � �� � �y � � � � � % C# � � � # " �h � % a �E E � `" � $ b � %� �E " �� � y � � ` � � �k h �� �� 'E d `

F � � �h C %y p( B$ � % C � % � `" � � � � d n � � z

� F 6 p− 1( _ %�h � '� " � % bE � � $ � �� '�h % � '� �� � �# � � E � �� ' �E $ " '

p2> (F + 1)2 > R(F + 1) > RF + 1 > n.¢ � p 6

√n� � � �" � ' � � �# � �( �l� E E � k " � � � � � � �� � j d '� �" � # " � �$ % � Ch � % �$ b# � $ " � # E � �� � " � z

� � j � '� " b# � $ % � n− 1 � � � �# � �� � " � � � j � '� E E � k # � $ " b Ch � ' %� " ' � �k �"

C$ % � ' � y F >√

n � " � n * � � �$ " ��(u �� a h � � # � �� � �c �h � " b� h � % bE � `D � C� � � � '�h � h '� � %� $ $ �# � z

$ � �c # � $ " E d c $ % C# � k h � E E � `" � � � � d (��V � � S % u � �" � , e 5 e &( �~ � � � n=2kR+1 � � �� R<2k ? =� � � �~ ��� � ��~ �� � � � � { a� � �� � {� { � {� { �> } { �� � �� � � ~ � � { � � �

a(n−1)/2 6≡ 1 (mod n),

� { n �} � {� � { � ? ���V � � S % u � �" � , e 5 e &( �~ � � � n = 2kR + 1 � � �� R < 2k � 3 < 2k + 1� 3� � �� � � � R ? �{� �� n �} � {� � { � �� { � � � { �� � { �� { � � �~ � � � �� {� �� �> } { �� � �� � � ~ � � { � � �

3(n−1)/2 ≡−1 (mod n).

l �� � j� " � % b$ " ' �( B$ � % C" � � �� d u �� % � E &" �E � h �$ " � " �# E �

� � � '� � � " b C$ % � ' � � a(n−1)/q 6≡ 1 (mod n) � � � a = 3 � q = 2( s� � � � �

� � C$ % � ' � y n = 2kR + 1 6≡ 1 (mod 3)� " � C$ % � ' � � 3(n−1)/2 6= 1 (mod n)

+ , � - � � /1 � � � �� � � � � �� � � � � � / 1 � � �� / � � ��

�� 'E �$ � % bE � ' d � � %E �E � y �� ' �E $ " '�

3(n−1)/2 ≡(

3

2kR + 1

)

≡ (−1)(n−1)/2

(

2

3

)

≡−1 (mod Fn). �

� q � 8 � ��V � � S � X �V

�� �" � � # " � � $ % � ' " � � �� � u �� % �E &" �E � j� �E � " b �� ' �E $ " ' �

(a(n−1)/q − 1, n) = 1E � m � %� � $ %� m �� C$ % � ' � � a(n−1)/q 6≡ 1 (mod n)� " �

�a E � � � % C# � " b$ %�h Cy � � ` �� j C % b" � " (��� S � �~ � � � n = qkR + 1 > 1� � �� q �} � {� � { � � � � � � �� � �� � � ��� � � � � � � � R ? =� � � �~ ��� � �~ �� � � � { � a� �� { � � �� { an−1≡1 (mod n)� a(n−1)/q 6≡ 1 (mod n) � � { � � � �� � � � } � {� � { � �� � � � � �� p � � � � � n� � �� p = qkr + 1} � � � �� {� { � { � r ?l �� � j� " � % b$ " ' �( u C$ " b n = pm1

1 . . . pmk

k

( s �&h � � j C$ % � ' � k

" � � �� d ' $ � % C � � " � `$ � � ` " � � � � d � m �$ " � " � � c ' d " �� � � " � # " � $ C z

��$ " ' C� " " � � �� i� # " � an−1 ≡ 1 (mod pmi

i ) � a(n−1)/q 6≡ 1 (mod pmi

i )(£" $ y h � � � % C# � � � # " � � � �k h �� t � %� �E " � a � � �h C %y pmi

i

Ch � ' %� " z

' � �k �" C$ % � ' � k + t | (n − 1) � tE � h � % � " (n − 1)/q( u � �" � C qk | t(B$ � % C %� d �� C$ $ � � �� � % �# E �$ " � C % b" � � % � � � " � 'E � ` & � C � �d � � % b z

��

Z∗p

mii

� � % C# � � t |pmi−1i (pi − 1)( �� �" � � # " �# � $ %� pi

� q ' j� � E �

� � �$ " d � � � � h � % � " � % � $ �$ �h E �c # � $ � %( u � �" � C qk | (pi − 1)( _ %�h � '� z

" � % bE � � pi − 1 = qkr( �� �" k �" �" �� j C % b" � " $ %� m� � � # � " � � �� � u �� % �E &" �E � � h � E E d `

� �h c �h � � � � � �� � j� %¢ ( lR� � � " � � ' , 4 e e &( � " � � a � �a � " md " b � � z���� " � 'E � � $ � � % b j � '� E h %k h �� � j� " � % b$ " '� � � �$ " �" d # � $ � %(��V � � S % lR� � � " � � &( �~ � � � n=qR+1>1 � � �� q �} � {� � { � � R � � �� �� { � � R < 4(q + 1) ? =� � � �~ ��� � �~ �� � � � { � a � �� { � � �� { an−1 ≡≡ 1 (mod n) � a(n−1)/q 6= 1 (mod n) � � { n �} � {� � { � ?l �� � j� " � % b$ " ' �( u C$ " b n *E � � � �$ " �� � n = pm1

1 . . . pmk

k

(s �&h � � � %� � � � % C# � � � # " �$ C �� $ " ' C�" " � � �� i � # " � q | (pi − 1)(£ m � jE � # � n = piQ( s �&h � n ≡ piQ (mod q) � &h � n ≡ 1 (mod q) �

pi ≡ 1 (mod q)( £" $ y h � Q ≡ 1 (mod q)( _ %�h � '� " � % bE � � Q = qt + 1 >

> 2q + 1 � &h � tE � �a �" m!d " b �� 'E � 0� �E � # � n � � �$ " �� � � % � 1� " � � � � �

QE �# �" E ��( AE � % �& � # E � � pi = qs + 1 > 2q + 1( s� � � � m �� j � �

n = piQ > (1 + 2q)2 = q · 4(q + 1) + 1 > qR + 1.

u � �" � ' � ��# � �( s� � � � � h �� � j� E � ( ��� �" � � # " � ' C$ % � ' � � " � � �� d # � $ %� n � R �& C" md " bE � ' j� z

� E � � � �$ " d (

Page 33: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� � � � �- � � � 2 �� 1 � �� / 4 � � � �� � � � 1 � �

w" � " � � � � � %� a � " ' �$ E � '� � %& � � � " � & �E � �� �� � � � �$ " d c # � $ � %

' �" �# �$ " '�E E � $ " � E h � �" � E � �� � � � ' Cy � �h � � $ b � £ _ s v f �( , ¥ z 4�(BE � '� � # �$ " '� a ' d m � �� y " $ k E � �# �E b ' d $ �� � � $ " � ��E � # � $ %� 2 �� RE � c �h � " $ k �� �� m � � � ( % �� � " � �# " �$ , � y %k ¤¥ ¥ ¤ &( �" �" $ " � E h � �"

m!d % j� �E �E E � E � ' d ` � £ _ s v f �( , ¥ z ¤¥ ¥ ,( &

� q � = � '� XV ( ' S � �� S

B , 4 42 &( �(  � C �� � � � C m % � � � '� % m!d $ " � d ` � %& � � � " & �E � �� �� � h � z

� � j C� � � � �$ " d c # � $ � % � m % � j� �c � $ % C# � `E d ( B � & � �$ E � ' � %� a � "

C$ � %�E � � " � � �� d u �� % � E &" �E � E � $ % C# � ` � � �&h � �� � " � � � j � '� E E � k

# � $ " b F# � $ %� n− 1 Ch � ' %� " ' � �k � " E � �� '�E $ " ' C F > 3√

n( r � � � " �& � �� C Ch � % �$ b � ��E � " b '� � �k " E �$ " b C$ ��c � � � � $ % C# � `E � � � � $ � � # � $ z

%� a ' C$ % � ' � � " � � �� d u �� % �E &" �E � (_ %�h Cy �� k %� � k ' %k � " $ k $ �� � � � % bE d # � $ " E d $ % C# � � " � � �� z

d u �� % �E &" �E � (��� S � � �~ � � � n = 2FR + 1 > 1 ? =� � � �~ �� � � �~ � � � � � { � a� � �� { � � �� { � �� �� � {� { } � {� � {� { �� � � � � �� q � � � � � F �> } { �� � � > ~ � � { �� � � an−1 ≡ 1 (mod n) � (a(n−1)/q − 1, n) = 1 � � { � � � �> � } � {� � { ��� � � � � �� p � � � � � n � �� �� � � �

p = mF + 1 } � � � �� {� { � { �� � � { � m ?=� � � �� � { �� � {� { � F >√

n� � � � F � � � � � { � � R < F � � { n �} � {� � { � ?l �� � j� " � % b$ " ' �( u C$ " b n *$ �$ " � 'E �� � p *E �" � � ' � � % b z

E d ` � � �$ " � `h � % � " � % b# � $ %� n( s �&h � � j C$ % � ' �k " � � � � d ' d " �� � �" �# " � an−1 ≡ 1 (mod p) � a(n−1)/q 6≡ 1 (mod p)( v� $ $ C a h � k � E � % �& �# E �

j� �# � E � y � " � � �� � �y � � � � � % C# � � � # " �h � % a �E E � `" � $ b � %� �E " �� � y � � ` � � �k h �� �� 'E d `

F � � �h C %y p( B$ � % C � % � `" � � � � d n � � z

� F | (p− 1)(l %k h �� � j� " � % b$ " '� '" � � �& � C" '� � a h �E �k � � ��h � � % �a � �# " � p<n(s �&h � p6√

n( g$ % � F >√

n � " � p=mF +1>√

n( g$ % � FE �# �" E � � R<F �" � p > 2F + 1 �

p2 > (2F + 1)2 > (2R + 1)(2F + 1) > 2RF + 1 = n.

u � �" � ' � ��# � �( �_ %�h Cy �� k %� � h �� � j� E � r( r � C '� � � � lRa ( r C � $ � C �" � � �

' , 4 4 ¤ &(��� S q � �~ � � � n� F � R � a~ � { � � �� � { �� � � ~ � � { � � � � � � �> , ?

�} � � �� � � � � � � � � x>0 � 06y<F �� � �� � � � { � 2R=xF +y ? =� � � F > 3√

n� � � � � { y2 − 4x� � � � �� { � ~ �� � � � � � �� �� � � } { �� > �� �� � � � � { �� � {

n �} � {� � { � ?l �� � j� " � % b$ " ' �( _ �& %� $ E � %� � ,h %k � � a h �& � � � �$ " �& �

h � % � " � %k p# � $ %� n ' d � � %E k �" $ k E � �� '�E $ " ' � p > F + 1( u � C$ % � z

+ , � - � � /1 � � � �� � � � � �� � � � � � / 1 � � �� / � � � �

' � y n6F 3( u � �" � C� �$ % � # � $ % � n *$ �$ " � 'E �� � " � �E �E � �a �" � � " b

m � %� h ' Cc � � �$ " d c h � % � " � %� `( u C$ " b

n = 2RF + 1 = (m1F + 1)(m2F + 1) � m1 > m2.

s �&h �

2R = m1m2F + m1 + m2.

iR � � m1m2 < F � �E � # � n > F 3(g$ % � m1 + m2 > F � " � F > m1m2 > m1(F − m2) > F − 1( £" $ y z

h � m1 = F − 1 � m2 = 1� �h E � � � 'h � E E � $ % C# � � n = F 3 + 1( u � �" � z

C m1 + m2 < F(_ %�h � '� " � % bE � � m1m2 =x � m1 +m2 =y( u �" � � �� � B � �" � m1 � m2k ' %k y " $ k � � �E k � � '� h �� " E �& � C �� 'E �E �k m2 − ym + x = 0 � � �" � � ��

� � �" �� D �E �k ' �� %d c # � $ %� c ' " � � " � % b� � ' " � $ % C# � � � �$ % �

y2 − 4xk ' %k � " $ k � � %E d � '� h �� " � � % � E C %� ( �� � h �� � j� E � ( ��� �" � � # " � C m�h � " b$ k � # " � j� h � E E �� # � $ % � E � k ' %k �" $ k � � % z

E d � '� h �� " � � �a E � ' d # � $ % � '$ � ' � % �� a � E h �� h %k E �$ � � % b� � c

� %�E b� �c � � �$ " d c �h C %� `( g$ % � � � � E �� �" � � � �h C %� # � $ % �E �

m Ch �" k ' %k " b$ k � '� h �� " �# E d ' d # �" � � " � �E �E � m Ch �" � � � %E d

� '� h �� " � (u C$ " b ϕ(x) * � CE � �� k w ` %� �� (��� S 8 � �~ � � � p �} � {� � { � � d | (p−1) ? � � {� � � � � � � � � �� T � � � � {

� � � � �� � { � x ∈ Z∗p

� } { �� � {� � {� { �> � �� � � � � � � � d ? �{� �� � } �� � � � � � ��{� � � � �

T >ϕ(d)

d(p− 1),

} � � � � � �� � �� � � � { �> } { �� � � � � � �� { � � � { �� � { �� { �� �~ � � � �� {� ��

(d, (p− 1)/d) = 1.

l �� � j� " � % b$ " ' �( i$ � � % b j Ck $ ' � `$ " '� � CE � �� � w ` %� �� � � z

% C# � �

T =∑

d | d∗ | (p−1)

ϕ(d∗) =∑

k | (p−1)/d

ϕ(kd) >

>∑

k | (p−1)/d

ϕ(k)ϕ(d) = ϕ(d)∑

k | (p−1)/d

ϕ(k) = ϕ(d)p− 1

d,

� � �# � �� ' �E $ " ' � ' d � � %E �E � ' " � � " � % b� � ' " � $ % C# � � � � �& z

h � (d, (p− 1)/d) = 1( �

Page 34: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� � � � �- � � � 2 �� 1 � �� / 4 � � � �� � � � 1 � �

��V � � S � �~ � � � n = 2FR + 1 �} � {� � { � � F = qk1

1 . . . qkss � F > R� (2R, F ) = 1� � �� q1, . . . , qs

� � �� � � �� > � } � {� � > � � � � � � ? �{� �� � � � {�� � � {� � � � {� { � �� { � �~ � � �� { �> �� � � � { � {� � { �� � � � a ∈ Z∗n

� � � � � � ,�~ �� � � {� �� > �� � � } � {� � {� ~ � � � � � n� �� �� � ϕ(F )/F ?l �� � j� " � % b$ " ' �( s� � � � � n � � �$ " �� � " �$ �� 'E �E � � an−1 ≡≡ 1 (mod n) ' d � � %E k � " $ k � � � '$ �c a ∈ Z

∗n

( u � � (2R, F ) = 1 C$ % � z

' � � a(n−1)/qj ≡ 1 (mod n) � � � '$ �c j �� 'E �$ � % bE �" � C� # " � � � �k h ��

� %� �E " � ah � % � " $ k E � F( u � � �E k k %� C f � � � d = F � � % C# � �

E C a E �� �� '�E $ " ' �( �� U � ( T X * � � �~ � � { � �� � � � { � � �> } � � � {� � � � { �� { � { �� � � � q1, . . .. . . , qs

�� � � �� � � � � � �� � � {� � � � � � � � {� � � {� � �~ � } �� � } { �~ � � � � � � �� � � � � ~

1−r

j=1

1

qj.

s� � � � � F = qk1

1 . . . qkss � " � � $ � � � k � ��E � � ' d " �� � � " � jE � �� ' �E $ " '�

ϕ(F )

F=

s∑

j=1

(

1− 1

qj

)

> 1−s

j=1

1

qj,

&h � '$ % C# � � F = q1 � s = 1 ' d � � %E k � " $ k �� '�E $ " ' �( ��(  � C � � � � ��h % �a � %$ %�h Cy � � ` � �� C �$ � 'E d ` � %& � � � " � �$ " � � z

�E �k m � % b D �c � � �$ " d c # � $ � % % ' �� � ' d � �h �k �" �h � � j % �a �E � �

' , 4 4 , &( &( BE � E � � � a h � D � & � � %& � � � " � m� � C" $ k C a � � �$ " � ��E z

E d � E � � ��h d h C �� �" � �� � � �$ " d � # � $ %� q1, . . . , qs

� h %k $ % C# � `E �& �

E � m � �� � �� � j� " � %� `

k1, . . . , ks

' d # � $ %k �" $ k # � $ % � F =qk1

1 . . . qkss

( �� " �

$ % C# � `E � � �h m � �� y " $ k # � $ %� x � y � R=R(x, y)<F" � � �# " � md (2F, R)=1� # � $ % � n = 2FR + 1 � � � E �� �" � � � a Ch � ' %�" ' � �k % � C$ % � ' � y %�

, � % � ¤( u � ' � � �E � h � E E d ` � %& � � � " �� � j d '� �" $ k �# �E b � � ���� z

" � 'E d � " � � � � � � $ % � n � � �$ " �� � " � ' $ � % Ch �� � j� E E � ` " � � �� d �

� � $ %�h $ " ' �k # � $ % � aE � c �h � " $ k �# �E b m!d $ " � �( g$ % � a � # � $ % � n$ � z

$ " � 'E �� � " � '� � �k " E �$ " b ' d � � %E �E �k �� '�E $ " '� an−1 ≡ 1 (mod n)h %k

E � $ � � % b� �c m� j a � %� � �$ % � " � % b� � nE � k ' %k �" $ k # � $ % � r� � � `� %� �" ( �( k ' %k �" $ k # � $ % � �# �E b$ �� � � � % bE �& � ' �h � ( u � � �" � � � � % C# �E E d �

' � � j C % b" � " � �� m �" d � %& � � � " � � � �$ " d � # � $ %� m Ch C" � �" b � �� � " �# � z

$ � � �� 'E � � �E �� �� $ � ��h � %�E � �( �(  � C � � � md % �� � " �# � $ � � �� � ' d �� " � � ��h % �a � % � � m �$ E � '� % � $ � � % b j � '� E � � $ % C# � `E �& � � � � $ � � ' �$ " �

$ h �$ " � " �# E d � C$ % � ' �k � � � �$ " �" d � # " � � � j ' � % � % �$ " � � � " bh �� � j C z

� � � � �$ " d � # � $ %� (

+ , � - � � /1 � � � �� � � � � �� � � � � � / 1 � � �� / � � � 7

� q �: � '� XV ( ' [ S U � T �

B , 4 4 � &( u(   �c � %�$ � C � ��h % �a � % � �� m � %� � md $ " � d ` � %& � � � "

& �E � �� �� � h �� � j C� � � � �$ " d c # � $ � %( u � E �E � y   �c � %� $ � C ' �" � z

h �  � C � � �� � �" � �k ' � � ���� " � 'E �$ " � � � � � $ c �h � " � j z j� C$ % �a E �E E �& �

�c � E � j � h %k � �$ " � ��E � k � � �$ " d c # � $ � % $ � � �# " �� �� 'E � � �E d

�� $ � � �h � %�E � � ( £E � � �h % �a � %� %& � � � " � � � $ � � # � $ � % '� � � �! � " �# � z

$ � � ` � � �& �� $ $ � � �h %k '$ �c # � $ � % n � j� �" � � � ` � j '� $ " E � �� � " � � � j� ��k

E �� �" � � � `# � $ " � # � $ %� n− 1( w" � � � j ' � % � % � � C � $ � � % b j � '� " b ��� C � z

$ � 'E Cy � � � ��h C � C( r � � � " �& � � �E � �" � � j � � � '� % � � � ��h C � C �" m �� z

� � '� � $ �$ " � 'E d c # � $ � % � � $ � � % b j Ck �� D � " � w �� " � ���E � � " �$ " � � �$ " �" d

v� m �E � *   � % %� �� (u ��h % �a �E E d ` � � %& � � � " & �E � �� �� � h �� � j C� � � � �$ " d c m z �� j z

�k h E d c # � $ � % $ �$ " � � " ' $ %�h Cy �� ( u C$ " b B > 0 * �� % �� # � $ % �

� s, c > 0 *h � `$ " ' � " � % bE d � � �E $ " � E " d (x� & ,( g$ % � m < B � " � � % & � � � " ' � j ' �� �� � " $ % C# � `E �� � � �$ " ��

# � $ % �$ mh ' � �# E d � �� j �k h � � % � � � �a h �E E �� $ � � � � by

� � � mE d c h � %�E � ` &(x� & ¤( _" � � � $ � � � � b y � �� C �$ � � �� % �� # � $ % � F � j �E " � � '� z

%� 2εm < F < 2cεm � �� � " � � � j� �� k � �" � � �& � � � %E �$ " b y � j z

' �$ " E � � &h � ε �a E � � � % �a � " b 1/2 � % � 1/3 ' j� ' � $ � �$ " �

�" � � � �E k � �& �h �$ " � " �# E �& � C$ % � ' �k � � �$ " �" d � $ ( %� z

d , � % � ¤ ' �" �h �  � C � � �� (x� & f ( B d m � �� � $ % C# � `E �� # � $ % � t ∈ (2m−2/F, 2m−1/F − sm)(x� & �( i �� � � �$ " �� # � $ % � ' � � � �! �" � # �$ � � ` � � �& ��$ $ � �

P = {n = n0 + ia : n0 = ta + 1, a = 2F, 0 6 i 6 s}.

s� $ " � � �$ " �" d � � � � �E k � d `E � D � & � � � ' d � � %E k �" $ k '" � � �" � �� (w" � � ,( u � � mE d � h � %�E �k E � � � �$ " d � # � $ %� � E � � �� ' �$ c �h k �� � A �&h � A * j� h � E E � k ' � �c E k k & �� E � �� (w" � � ¤( u � � '� �� � � � �$ " �" d $ � � � � b y " �$ " � v� m �E � *   � % %� �� (w" � � f ( l �� � j� " � % b$ " ' � � � �$ " �" d $ � � � � by %� , � % � ¤ %$ ( � z

" �h  � C �� �� &(B d m � �� k � �h c �h k �� � m �� j � �� �� �" � d B � s � c �a E � � �" � z

� j � � � '� " bh � E E d ` � % & � � � " ( u � � �" � � �" � � � � $ 'k j� E E d � $ C$ % �a z

E �E � � � � � ��h C � d h �� � j� " � % b$ " '� � � �$ " �" d h %k $ % C# � k � � �&h � � � � z

' � �k � �� # � $ % �k ' %k �" $ k � � �$ " d % ' d � � %E k � " $ k ��h � � ' � %& � � � " � & �' � E �& � � � ��E $ � � Cy " $ k C$ � � ��E E � ` �" m �� � � '� � `$ �$ " � 'E d c # � $ � %% ' d � � %E k �" $ k # � $ " � ' � %& � � � " � &(

Page 35: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� � � � �- � � � 2 �� 1 � �� / 4 � � � �� � � � 1 � �

� q � @ � (n + 1) � � XV ( p

v� $ $ �" ��E E d � ' d D � � " �h d �" E �$ k " $ k � " � � E � j d '� � d

(n−1) z � " �h � � � �" � � d � � � � �E � d '$ % C# � � � � �&h � � j '� $ " E � � � %E � k

� % � # � $ " �# E � k �� � " � � � j� � �k # � $ %� (n − 1)( g �� �h �E �E " � ��$ E d `

� %� $ $ � " �h � '$ �$ " � ' %k y " (n + 1) z �" �h d � '� �" � � d c � � �h � � %� & � �" $ k

� j '� $ " E � ` �� � " � � � j� ��k # � $ %� (n + 1)(u C$ " b p � q *" � � � � �� %d � # � $ %� �# " � p2−4qE � k ' %k �" $ k � '� h �� " �# z

E d ' d # �" � � � �h C %y n( s �&h � � '� h �� " E �� C �� 'E �E � � x2−px+q=0� � �" �� j % �# E d � � � �E � � �h � E � j� �" � � d c �� '�E r = (p +√

p2 − 4q)/2(iE h C� �� � ` %� &� � � �� � j� " b � # " �$ " � ��E � �" �& �# � $ %� � � y " $ �� � � � % b z

E d ` ' �h (��� S � � �� � } �� � � � � � � r � � �� � � � �

rk=(Vk+Uk

p2 − 4q)/2 � � ��} {� � � � { �� � � �� � {� � � {Uk} � {Vk} {} � � �� �� � � � � � �� ~ � � � � � � > � � � { {� �� { ��� �� � �

U0 = 0, U1 = 1, Uk+2 = pUk+1 − qUk,

V 0 = 2, V 1 = p, V k+2 = pVk+1 − qVk , k > 0.l� E E d � � �$ %�h � '� " � % bE �$ " � E � j d '� y " $ k � �$ %�h � '� " � % bE �$ " k �

�y � � � � $ $ � �� � � � '� E E d � $ # � $ %� � p � q � � � � y " E �& �$ ' � `$ " ' �� � j ' � %k y ��c ' d # � $ %k " b �c � E � % �& �# E � � " �h C � � '" � �E �& � ' � j '�h � z

E � k '� '� h �� " � � � ' � j '�h �E � � '$ " � ��E b � E � � � � � � �

U2k = UkVk, V 2k = V 2k − 2qk, k > 0.% u � � p = 1 � q =−1 � �$ %�h � '� " � % bE �$ " b {Uk}$ � ' �� h � � " $ � �$ %�h � z

'� " � % bE �$ " b y n � m �E � # # �)( & _ %�h Cy �� k %� � � & �� �" � � % b � � E � % �& �# z

E Cy � % � `" � � �� � n � � � (��� S q � �~ � � � � � � � � p� q � r {} � � �� � � � > �> �� � 2r = a ++ b

p2 − 4q (mod n)

� �� � �� {� { �> � � � � � � a � b { ��� � �� { � { � � �� � { �� � � ? =� � � n} � {� � { � � � { 2rn = a− b√

p2 − 4q (mod n) ? �B" � � �E � c � �$ %�h � '� " � % bE �$ " � {Uk} �" � %� � � � �" ' �h

��� S 8 � =� � � n} � {� � { � � � { Un+1 ≡ 0 (mod n) ? ���V � � S � �~ � � � n>1 �� � � �� � { � � � � � { ? =� � � � �� �� � {� { } � {� � {� {�� � � � � �� r � � � � � n+1�~ �� � � �~ � � � �� � � } � {� � > � � � � � � p � q � �� {p2 − 4q� � � � �� �� � � � �� � �� � � �� > � �> � � � { �} { � { �~ �� n� � � �� � � ��� {

Un+1 ≡ 0 (mod n), U(n+1)/r 6≡ 0 (mod n),� { n �} � {� � { � ? �l� E E � k " � � �� � � & �� �" � � % b � '" �# E �$ " � � E � % �& �# E Cy � � % � " � � �� z

d �y � � (n− 1) z � " �h � c ( AE � % �& �# E � �a E � � $ � � % b j � '� " b � '" � � Cy

� �$ %�h � '� " � % bE �$ " b {Vk}( s� � a � � � E � % �& �# E � (n − 1) z �" �h � � �a z

+ , � - � �� � � � 1 � � 2 �4 1 � � � � �5 � � 5 � � � � �� / � � � �

E � � $ � � % b j � '� " b# � $ " �# E �� �� j % �a �E � � n+1E � E �a � " � % � ( �� �" � �# " � � � y " $ k " � $ " d � �$ E � '� E E d � E � �� j % �a �E � � # � $ � % n2+1� n2±n−1(

� q � ?� �� TU S '��� T�� � S¢ � � m � %� � � j '� $ " E d # � $ " E d $ % C# � � �" �& � � �h c �h � k ' %k �" $ k $ %� z

h Cy �� `� � � " � � � ` � � �$ " �" d h %k # � $ � %  � �$ �E E � ( � � $ %� �  � �$ �E E �

E � j d '� y " $ k # � $ %� ' �h � Mn = 2n − 1� &h � n * � � �$ " ��( �� &� � ' �h �" b �# " �# � $ % � Mn

�a � " md " b � � �$ " d " � % b� � �$ % � n * � � �$ " ��(��V � � S % �y � � * �� � � &( �~ � � � n � � � �� � { � � � � � { � � } {� � � � { �� �� � �� � {� � � {Lm} {} � � �� � �� � � �� ~ � � �� � � > � { �� �� { �

L0 = 4, Lm+1 = L2m − 2, 0 6 m < n.

�� � � { Mn

} � {� � { � � {� �� � � { �� � { � {� �� �� {� �� Ln−2≡ 0 (mod n) ? �r � � " � � � ` m!d % �� � ' �E � # � % bE � �" � � d " �y � � '� �E �� , e 4¥ zc & &( � �h � E E Cy � �� " � Cy � � � C � � � � m �� % �� � % � , 4f ¥ &( ' �� m �" � c �� � �� (�� &� � ' �h �" b � # " �# � $ " E d `$ % C# � `

(n + 1) z �" �h � � � � q = 2 � k = 2m �

Lm = V2k/2k(B " � m % � �� , � � � ' �h �E $ � � $ �� '$ �c � j ' �$ " E d c 'E � $ " �k �� � ' �� k

� � �$ " d c # � $ � % p � h %k � �" � � d c # � $ % � Mp

k ' %k �" $ k � � �$ " d % '$ ' �y

�# � ��h b# � $ % � Pp=Mp(Mp − 1)k ' %k �" $ k $ � '� � D �E E d &( B � � � �$ � " � % b z

E d � jE � � � '" � m % � �� � jE � # � y " � # " � � �� � � � � '� ��E d E � '$ � # � $ %� � �

� � �" � CE � � j '� $ " E � �k ' %k y " $ k % � �E � � �h �k h �h C �� � � � �$ " d � # � $ z

%� �   � �$ �E E � (u �$ %�h E � � �k " b � � �$ " d c # � $ � % md % � E � `h �E d ' �� � � c � � �& �� d

D � � �� � � $ D " � mE �& � � � � $ � � � � � & � E � j � '� E E �& �$ , 4 42 &( '$ �" � iE " � � z

E � " * � .� � / % � �� � � � 9 � . � �� � �� � � � � �� � �� � � � �� /� 9 � - � & * �( � � % � z

E � �E � � � $ � ' D � m!d $ " � Cy � � �& �� Ch %k �� �$ �E � % bE �& �� � � b y " � ��

� �� j �$ " � ' D � � � E � $ ' �� � � < z$ � � ' � ��( £E � � & � E � j � '� %" � � a � �� $ z

� � �h � %�E E Cy m� j Ch � E E d c � '� �" � � � ` �" �� a � %$ k c �h � � � $ � � ( B , 4 4 5 &(� � �� E � � � � � � � � � 9 � . � -( � �$ E � '� E E � ` _( r C � � '$ � � � m!d %� � � & � E � j � '� E �

$ � $ " � � � �h h � � a � � �� $ � ��h � %�E E d c ' d # � $ %�E � ` � � � �� 1� � � � �" � �� k '

E � $ " �k �� � ' �� k � � � �h �E � � C�" �� m �" CE �$ � � % b� � c $ �" �E " d $ k # � � z

� b y " � � � '( % B � �$ %�h E � $ " � % m �� " � m % � �d , '$ � � m� � c C� � j� E �# � $ % �

� � � by " � � � ' � � � �E � � ' D �c C# � $ " � � ' � � � $ � �( &

�� �� �" � � � � � � �� � � �� � !" � � � !"

�� h � # � �� � " � � � j� �� � �� % �& �# � $ %� n j� � %y # � � " $ k 'E � c �a h �E � �

�� j % �a �E � k � & � ' � � � � j ' �h �E � � � � �$ " d c $ � E �a � " � %� `( s � � ' � � % b z

E d ` � %& � � � " � # � $ " �E � j d '� � d ` � %& � � � " � � } � { �� > � �� � �� � �� �

Page 36: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

7� � � �- � � � 2 �� 1 � �� / 4 � � � �� � � � 1 � �

�$ >8 3@ $ D 0 �9 7 +5 . '( + & 3 58 $ � +* 5 + ' '$

p

�� ���

Mp

�� ���

Pp

�� � � � � �� � � � ��

, � , ,

− − −� � , �

− − −� � � �

− − −� 7 � �

− − −� , � � � , � � � � �� ��- −� , 7 � ,� , � � � �� � � ���

−7 , � � , � , � � � � � �

−� � , ,� , � , 7 7� �� � �

−� �, , � � 7 , � �� � � � !" � �

−,� � � � 7 � � , �, , #$ % &' (

−, , ,� 7 � � � � , �, � � � �

−, � , � 7 � � 7 7 , � 7 � )* +� (

−, � �� , , � 7 � , � , � �� ,$ -� . ($ . / 0 1 �, � �� 7 , �� � � � , � �� ) & 23 &' 4 ,$ -� . ($ . / 0 1 �, � , � 7 � � � � 7 7� , � �� � � � / 0 1 �, � � � � � � � � , � � 7 , � �� � � � / 0 1 �, 7 � � �, � � 7 , � 7� , � �� � � � / 0 1 �, � � � , 7 � � � , �� 7 , � � 7 ,� & ( & � 56 /7, � �� �� , � �, � � �, , � �, 8* ' %� �9 4 / & � :'� �; & � 5< 7� ��

� � � �� � , � � � � � �� , � �, � � � � 5< 7� ��

� , � � � � � �, 7 � �� � , � �� =� � �� & ( � ) � 1 � �

� � � � �, � � �� � � � � , � �� � � � � ) � 1 � �

� � , , � , � � � 7 � � 7 �, , � �� � � � � ) � 1 � �

� � , � �� 7 �� � � , � � � � , � 7, >* + ? &' 3 � . � 5< � ��

� � � , 7� , � �� � , � � � � , � 7 � @ $ � � 4 @� + ? & � �A � , 7 �

� � � � � � � � � � 7 , � � 7� , � 7 � @ $ � � �A � , 7 �

� 7 � � � � 7 , � � � � � � 7 �� , � 7 � @ & � ($ . 4 / �$ %� . ( ?� � , 1BDC ,

� � � �� �� � � � �� �, �� � , � �� / �$ %� . ( ?� � , 1B

� � , ,� �� � � � � � � � � �� � , � � � � $ �E * � � � 4 0 & � ( 2 / = �

� � , � � � � � � � 7 �, 7 � �� � , � �� / �$ %� . ( ?� � , 1B

� , � , �� �, � �� �� , � � ,� � , � � � � � � � , 1B

� � 7 � � �� � � � 7 �� � � � � � �� , � �� / �$ %� . ( ?� 4 =�; & � , 1B

� � � � � �� � � � � 7, � �, 7 �� � , � � � � � � � , 1B

� � , � � 7 7 � 7 � 7 � �� � 7 � 7� �� , � � � � � � � , 1BDC > � �

� � , � � �� � � �� � �� , � �, � �� , � � � 1 ' 3 & .; � * �GF 0$ � � 3 � .F& �- � �- H = �< # / I

# & . �� * 3 ��

� � � � 7 �� � , � � � �� � , 7 �, � � � , � � 7 /J & . + &F 0$ � � 3 � .F& �- � �- H = �< # / I

# & . �� * 3 ,� �

H� � � � I

� 7 � � � , � 7 7 �� � �� � , �, �� �� , � � � � �� ' ? ($ .F 0$ � � 3 � .F7 * ' $ % ( ?� & �- � �-H = �< # /F # '� 3 & @ & � I

# & . �� * 3 � � �

H �� � � I

K K � � 7� � �� � � � � � �� �, � 7 �, � , � � � 8�� ' � � %� ��F 0$ � � 3 � .F7 * ' $ % ( ?� & �- � �-H = �< # /F # '� 3 & @ & � I

# & . �� * 3 � �C � ��

H� , �� � I

K K , � � � � �, 7 �� �� � � � �,� 7 � �� � � � , �� 3 &' $ .F 0$ � � 3 � .F7 * ' $ % ( ?� & �- � �-H = �< # /F # '� 3 & @ & � I

1< A �� �

H� � �� � � I

+ , � - � �� � � � 1 � � 2 �4 1 � � � � �5 � � 5 � � � � �� / � � 7,

j� � %y # � � " $ k ' � �$ %�h � '� " � % bE � h � %�E � � # � $ %� nE � '$ � ' � j �a E d �

� � �$ " d � # � $ %� � E � � � � ' �$ c �h k � � � √n( u � � ' d � � %E �E � � h � E E �& � � %& � z

� � " � ' � jE � � � �" h ' � " � Ch E �$ " �)( _ �h E � `$ " � � �E d �h %k m � % b D � c # � $ � %

n# � $ % � � �� �� �� `h � %�E � k � � �" � � d � E � � mc �h � � ' d � � %E � " b � �a �"

�� � j� " b$ k E � $ " � % b� � m � % b D � �# " � � & � � � �$ " �E � ' � j �a E � ' d � � %E � " b(_h � C& � `$ " � � �E d � E � � mc �h � � j� �� E � � $ " � � � " b$ � � $ �� '$ �c � � �$ " d c

# � $ � % � E � � �� ' �$ c �h k �� c √n� # " � C a � $ � � � �$ � m� k ' %k �" $ k " � Ch E � `

j� h � # � `( B" � � � `" � Ch E �$ " � �a E � %� &� � � j m� a � " b � �$ % � �$ C �� $ " ' %k " b

h � %�E �k # � $ %� nE � E � � � �$ " d � � � E � '$ � �� %d � # � $ %� k � E � � �� ' �$ c � z

h k � � � √n( w" � � j m� ' � " �" E � � mc �h � �$ " � $ " � � � " b � $ c �h E d `$ � � $ ��

� � �$ " d c # � $ � % � � � �# � $ % �a E �$ " b " � � �& � � %& � � � " � C ' � % �# � " $ k E �

m � %� � � # � ' O(log n) �� j(_ % �a E �$ " bE � c �a h �E �k �� � ' �& �E � " � � ' � � % bE �& �h � % � " � %k # � $ %� nh %k h � E E �& � � %& � � � " � � ��E � '� �" $ k ' � % � # �E � `

O(π(√

n) log2 n) = O(√

n log n)

h %k h � %�E �k E � � � �$ " d � # � $ %� � �

O(√

n log2 n)

h %k h � %�E �k E � � �h �k h �h C � � � �� % d � # � $ %� (�� �" � �# " � � � � � E � % � j � � %& � � � " � ' �� � " � � � j� �� � # � $ " � �& �� E � z

# � '� y " $ k �� $ $ �" ��E � � " � % b� � �� � ' �& � D � & � *E � c �a h �E � k �� � ' �& �

E � " � � ' � � % bE �& �h � % � " � %k ( �� &� � ' �h � " b � # " �h %k E � c �a h �E �k � � %E � `

�� � " � � � j� �� � # � $ %� nE � � mc �h � � ��� C �$ � 'E � � � '" � � � " b ' d � � %E �E � �

h � E E �& � D � & � E � m � %� � log2 n �� j(� �" k � � � �E �E � � � % & � � � " � � � � � mE d c h � %�E � `� ' � � %E � � m � � �

h %k m � % b D � c n � �� � " �# � $ � � E � ' � j �a E � � �E '$ � �� 'E �E � c �h � " D � z

� �� �� � � � �E �E � � '$ ' �� � $ �� �� ��E E � � '� � � � E " � � � �&h � � � � mE d �

h � %�E �k �$ C �� $ " ' %k y " $ k " � % b� �E � '$ � � � �$ " d � # � $ %� �E � � �� ' �$ c �h k z

� � � E �� �" � � � `� �E $ " � E " d C(

� �� E � �� C

� � $ % � � � �$ " d c π(C)256 54

1000 16810000 1229

100000 95921000000 78498

10000000 664579100000000 5761455

Page 37: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

7� � � �- � � � 2 �� 1 � �� / 4 � � � �� � � � 1 � �

B" � � � ' �h � � % & � � � " � � � � mE d c h � %�E � `� 'c �h � " $ �$ " � 'E � `# � z

$ " by � �� � " �# �$ � � ' � '$ � $ � ' � � �E E d � �" �h d �� � " � � � j� � � �)(u � � $ " C �� k � �� � " � � � j� �� � # � $ %� n � $ %�h C� " $ E � # � %� C m�h � " b$ k �# " � �E �E � � � �$ " ��( w" � �a E �$ h � %� " b$ � � � � b y �h E �& � � j � � � $ � E z

E d c ' d D � " � $ " � ' � � �$ " �" d ( ic " � Ch �� � �$ " b �� � � � �� ' � % � � jE � # � " � % b z

E � �E b D � � # � C � % & � � � " � ' �� � " � � � j� �� �)( u � �" � Ch � %� � # � $ % � nm Ch �" j� '�h � �$ # � " � " b$ k $ �$ " � 'E d (

� 8 � � � '� XV ( $V U U S� (S¢ � � m � %� � � � � C %k �E d ' � � �k " E �$ " E d � % & � � � " � �� � " � � � j� �� �

k ' %k �" $ k " � � E � j d '� � d `� ρ z � " �h � � � � �h % �a �E E d ` lRa ( u � % %� �h �

' , 4 52 &(A % & � � � " ,

x� & ,( B d m � �� � E �& �# %�E f(x) ∈ Z[x] � # � $ % � ω(x� & ¤( _ % C# � `E � ' d m � �� � x0 ∈ Zn

� � ' d # � $ %k k jE � # �E � k xi == f(xi−1) mod n � i = 1, . . . , m� � � � ' � �k � " �$ " D � & � f (

x� & f ( l %k p0+2k′rs � � %� & � � j=2h−1 � h %k � � a h �& � 2h6k<2h+1

' d # � $ %k � d=(xj−xk, n)( g$ % � 1<d<n � " �E �" � � ' � � % bE d `

h � % � " � % b# � $ %� nE � `h �E ( g$ % � d=1 � % � d=n � " � �� � �c �h �

� $ %�h Cy �� C jE � # �E � y h(�" � md � ��E � " b$ � �h E � � ' �� k �� m �" d h � E E �& �� %& � � � " � � �� $ $ �" z

� � $ E � # � %� m � %� � � � �$ " � `h %k � E � % � j� � E � �E � � � � ���� " � 'E d ` � % z

& � � � " � �" % �# � y �� `$ k �" � % & � � � " � ," � � # " �E � D � & � f ' d # � $ %k � " z

$ k ¢ £ l

(xj−xk, n)h %k '$ �c # � $ � % �� �# � $ � % j, k � 06j<k6m( ¢ � j � '�

� & � A %& � � � " ¤(B �$ � � % b j C� $ k � j '�$ " E d � �� �� h �� $ � h E � ` � �a h �E �k � (��V � � S � �~ � � � λ > 0 ? z �� � �~ � � �� { � �> � { �� � �� n � � � �� � � { �{ ��� � �� l + 1� � �� l =√

2λn� � � � {� � � {� � � � {� { � �� { �� � � � � �� � � >� �> ��{ �� � �~ �~ � } {} � �� { ��� � � �� > � � � � {} ~ � � � � � � � � �~ � �~ � {� �� � ~� � � �� ~ +

pnl < e−λ.

l �� � j� " � % b$ " ' �( iR � �

pnl =n(n− 1) . . . (n− l)

nl+1=

l∏

i=1

(

1− i

n

)

.

u� ��c �h k � % �& � � � �! � � C# � " d '� k �# " � log(1−x)<−x � � � 0<x<1 �

+ , � - � �� � � � 1 � � 2 �4 1 � � � � �5 � � 5 � � � � �� / � � 7�

� � % C# � �

log pnl <

l∑

i=1

(

− i

n

)

=− l(l + 1)

2n<− l2

2n=−λ.

s� � � � � h �� � j� E � ( �BE � D � $ % C# � � m Ch � �� $ $ � " � � '� " b � �$ %�h � '� " � % bE �$ " b x0, x1, . . .. . . , xm � xi = f(xi−1)� j = 1, . . . , m� � � � $ % C# � `E Cy ' d m � �� C( l %k

$ % C# � `E �& � �" � m �� a �E �k f : Zn→ Zn

�" � � � �� 'h � E �( � �" k E �& �# %�E

f(x) ∈ Z[x] � � �E �# E � � E � % b jk �� $ $ � " � � '� " b � � � $ % C# � `E �� �" � m �� z

a �E � � � " � E � �E � � � � �� � " �# �$ � � � � � j C % b" � " d & � ' � �k " �c � � �D �

$ � �" '�" $ " ' � � � � � '�h �E E d c E � a � � ��E �� " � Ch �� � �$ " � $ " � � � � �" � z

� d � � � % C# � y " $ k 'h � `$ " ' � " � % bE �$ " �)(u C$ " b p *E � " � � ' � � % bE d ` h � % � " � % b # � $ %� n( s �&h � C$ % � ' � �

p | (xj − xk, n) �� 'E �$ � % bE � C$ % � ' � y p | (xj − xk) � � % � xj ≡ xk (mod p)(u � �" � C� � � � �E k k h �� � j� E E Cy ' d D � " � � �� Ch %k ' d m � �� � � � m �� j � z

'� E E � ` � �$ %�h � '� " � % bE �$ " by x′0, . . . , x

′l

� &h � x′i = xi mod p� � � % C# � � �

# " � � � � l =√

2λn '� � �k " E �$ " b$ C �� $ " ' � '� E �k �� � d i, k � 0 6 i < k 6 l" � � � ` � # " � p | (xj − xk , n) � m Ch � " E � �E b D � � # � 1− e−λ(s� � � � � p <√

n � " � '� � �k " E �$ " b �h E � ' �� �E E �& � ' d � � %E �E �k �� z

' �E $ " '� xj ≡ xk (mod n)

m Ch � " � %� � � �a E �$ # � " � " b � # " � xj 6≡ xk

(mod n) � � h � E E � k �� �� � � j ' � %k �" �� � " � � � j � '� " b# � $ % � n(s� � � � m �� j � � h %k E � c �a h �E �k h � E E � ` �� � d $ E � h � a E �$ " by

1− e−λE � � mc �h � � ' d # � $ % � " b l + 1 jE � � � ' � �$ %�h � '� " � % bE �$ " � {xi} �&h � l =√

2λp( £" $ y h � $ ��h E k k $ % �a E �$ " b � %& � � � " � ¤ � ��E � '� �" $ k

' � % �# �E � `

O(l2 log3 n) = O(λ√

n log3 n)(u� � � `h � " � �� � b� �� $ $ �" ��E � y � %& � � � " � ,( �� �" � � # " � � � z

$ � � % b� C f(x) * E �& �# %�E E � h

Z� " �h %k %y m �& �h � % � " � %k p# � $ %� n �

%y m � ` �� � d 0 6 j < k$ C$ % � ' � � xj ≡ xk (mod p)

m Ch C" ' d � � %E k " b$ k

� $ �� 'E �E �k xj+1 ≡ xk+1 (mod p) � xj+2 ≡ xk+2 (mod p) � " ( h (u C$ " b � %& � � � " C ¤ h %k E � c �a h �E �k �� � d (j, k) $ C$ % � ' � �

(xj − xk , n) 6= 1 E � � mc �h � � � �$ %�h � '� " � % bE �$ " b h % �E d l + 1( u � z

� � a � � # " � ' �" � $ % C# � � � %& � � � " , � � j ' � %k �" E � `" � �� � C (j′, k′)$C$ % � ' � � (xj′ −xk′ , n) 6=1� &h � j′ = j + s � k′ =k + s � � � E �� �" � � � s � &h �%

j, k) * �� �� �E � `h �E E � k � % & � � � " � ¤ � " � � � k �# " � k′<4k( u C$ " b# � $ % �

k � � �" '$ ' �� `h ' � �# E � ` j� � � $ � 1 + h

m � " � " ( �( 2h 6 k < 2h+1( s �&h �

� � � j′ = 2h+1 − 1# � $ % � k′ = k + (j′ − j)

m Ch �" E � c �h � " b$ k ' �E " � � '� %�

2h+1 6 k′ < 2h+2 � � �$ � � % b� C

k′ = k + (j′ − j) < 2h+1 + 2h+1 − 1− j < 2h+2,

� � �# � " � � � � � 2h 6 k � " � k′ < 4k(

Page 38: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

7 � � � �- � � � 2 �� 1 � �� / 4 � � � �� � � � 1 � �

s� � � � m �� j � � � $ % � '" � � � C � %& � � � " C � �" �� m C� " $ k � �$ %�h � '� z

" � % bE �$ " bh % �E d l + 1� " � �� � ' � C � % & � � � " CE � � mc �h � � � �$ %�h � '� z

" � % bE �$ " b h % �E d 4l + 1( u � � �" � $ % �a E �$ " b �� � ' �& � � %& � � � " �

� ��E � '� � " $ k C a � ' � % �# �E � `

O(√

λ 4√

n log3 n) � # " � & � �� jh � % C# D � �# � O(λ√

n log3 n)( s� $ � d h �� � j� E �

��V � � S � �~ � � � n �� {� � � �� { � � � � � { ? �~ ��� � �~ �� � {� � � � � � � C� �� � � � �� { � �� �� ��{� { } { � { � � � � �� � {� { � � � � � λ � � � {� � � {� � � � { �> �� �� � � {� � {� �� � { �� { �� �� { ρ� �� � { � �{ � � � � �� � � � � � �� � � �� � � � � �� �� � {� { �� � � � � �� n� � � � � �� C√

λ 4√

n log3 n � � � } � � � {� � { ��� � � � � � � � �� > e−λ ?� 8 � q � � Ut V � X $V U U S� (S � ��X� S T T�� S

A % & � � � " u � % %� �h � * x" �� $ $ �E � k ' %k � " $ k h �" � � �E � � � '� E E d

� %& � � � " � h %k E � c �a h �E �k �E � � % bE �& � � � �$ " �& �h � % � " � %k � � � z

� " � ��E � C$ % �a E �$ " � O( 4√

n log4 n)( £E �$ E � '� E E � $ %�h Cy �� `" � � �� �(��V � � S � �~ � � � z ∈ N� y = z2 ? �{� �� � �� �� ��{� { t ∈ N

� � � �� �� � � � � } � {� � { � �� � � � � �� � � � � � (t, y!) � { � � � �> � � � � � �� � � �

O(z log2 z log2 t)

� � { � �� > � {} � � �� � � ?l �� � j� " � % b$ " ' �( _ & � C � � � � C� $ � E �a � " � % � ' ' d �� a �E � �

y! = (1 · 2 · . . . · z)[(z + 1) · . . . · (2z + 1)] . . . [((z − 1)z + 1) · . . . · z2] =

=

z∏

j−1

(jz)!

((j − 1)z)!= f(1)f(2) . . . f(z),

&h � f(j) = ((j − 1)z + 1) . . . ((j − 1)z + z) � j = 1, . . . , z( u � �" � Ch %k

E � c �a h �E �k E � � �E b D � & � � � �$ " �& �h � % � " � %k # � $ %� (t, y!) �a E � ' �$ z

� � % b j � '� " b$ k $ %�h Cy �� $ � �$ � m � +

x� & ,( B d # � $ %k � jE � # �E �k f(1), . . . , f(z)(x� & ¤( B d # � $ %k � (t, f(j))� j = 1, 2, . . . , zh � � � % C# �E �k �� � ' �& �

E �" � � ' � � % bE �& �h � % � " � %k (

x� & f ( u �$ %�h � '� " � % bE � �$ C ��$ " ' %k � � � � mE d � h � %�E �k (t, f(j))E � # � $ %� (j − 1)z + 1, . . . , (j − 1)z + z( u� � ' �� # � $ % � � j �" � z

& � �E " � � '� %� � h � %k �� � E � �� % � (t, f(j)) � �# � ' �h E � � � m Ch � "

� E � � % bE d � � �$ " d h � % � " � %� # � $ %� (t, y!)(£ ��E � " � �� � b$ % �a E �$ " b ' d � � %E �E �k � � a h �& � D � & � ( l %k ' d � � % z

E �E �k �� � ' �& � D � & � E � `h � � � � � � � �� �E " d E �& �# %�E �f(x) = ((x − 1)z + 1) . . . ((x − 1)z + z).

B �$ � � % b j C� $ k � %& � � � " � m!d $ " � �& � h � $ � � �" E �& � � �� � m �� j � '� E �k

+ , � - � �� � � � 1 � � 2 �4 1 � � � � �5 � � 5 � � � � �� / � � 7 �

n C � b� � � �$ %�h � '� " � % bE �E � `h � z/2 � � � � j '�h �E � ` E �& �# %�E � ' �� � z

' � ` $ " � ��E � � j� " � z/4 � � � � j ' �h �E � ` E �& �# %�E � ' '" � � � ` $ " � ��E � �� " ( h ( B � " �& � � � % C# � �" $ k

log z∑

i−1

z

2i2i log 2i

6 z log2 z

� � � �! �" �# �$ � �c � �� �� �� `( u � � � & � ' d � � %E �E � � E � � mc �h � � ' d � � % z

E k " b � �� �� �� � $ % �a �E �k � C E �a �E �k �� %d c # � $ � %( �� � " � � # " �

E � h �$ " � " �# E � jE � " b jE � # �E �k f(j) mod t( B � � # � $ " ' � � �� �� � � `

jh �$ b ' d $ " C �� y " C E �a �E � � � h � %�E � � $ �$ " � " � � � � � y �� � $ % �a z

E �$ " b O(log2 t)( u � �" � C $ % �a E �$ " b E � c �a h �E �k � � � � � � �� �E " � '

E �& �# %�E � �� 'E � O(z log2 z log2 t)( B d # � $ %�E � � jE � # �E � `" � �� � b ' d z

� � %E k � " $ k � �" � ` a � $ c � � � " � % b� � '� � # �$ " '� % �E � `E d c $ � E �a � " � %� `

' d $ " C �� y " E �& �# %�E d (x−1), . . . , (x−z)( u � �" � C$ % �a E �$ " b �� � ' �& �

�" � �� �� 'E � O(z log2 z log2 t)(¢ � '" � � � D � & � h %k � � a h �& � j �h � E �� j ' d � � %E k �" $ k � %& � � � "

E � c �a h �E �k ¢ £ l �� %d c # � $ � %( l ' � � # E � k $ % �a E �$ " b � %& � � � " � E � z

c �a h �E �k ¢ £ lh ' Cc log t z �� j �k h E d c # � $ � % �� 'E � O(log2 t)( u � �" � C

$ % �a E �$ " b '" � � �& � �" � �� �� 'E � O(z log2 t)(¢ � " ��" b � �" � �� ' d � � %E k � " $ k E � m � %� � z � �� �� �� ` h � %�E �k

log t z �� j �k h E �& �# � $ %� E � 2 log z z �� j �k h E �� # � $ % �( u � �" � C$ % �a E �$ " b

�" �& � �" � �� �� 'E � O(z log t log z)( s� � �� � h �� � j� E � ( �l %k �� � " � � � j� �� � # � $ %� n$ %�h C�" � � % �a � " b z = b 4√

nc+1� y = z2 �

t = n� �" � Ch � ' d " �� � �" � # " �$ % �a E �$ " bE � c �a h �E �k E � � �E b D � & � � � � z

$ " �& �h � % � " � %k # � $ %� nh � E E d � % & � � � " � �� 'E � O( 4√

n log4 n)h ' � z

�# E d c � �� �� � � `( g$ % � � � % �a � " b z < b 4√

nc + 1� " � � %& � � � " m Ch � "

� $ � � " b" � % b� � � %�E b� � � � � �$ " d � h � % � " � % � # � $ %� n(�� �" � � # " �$ � ' �� �E E d � � " �h d �� � " � � � j� �� � E � � �� � " � � � # � z

$ " � ' d � � %E k y " $ k ' f �" � �� (w" � � ,( u � � mE d � h � %�E �k E � 1÷ 2" d $ k # � �� � ' d c � � �$ " d c # � $ � %(w" � � ¤( ¢ � c �a h �E � � � %�E b� �c � � �$ " d c h � % � " � %� ` � " �h � u � % z

%� �h � � % � �" �h � u � % %� �h � * x" �� $ $ �E � % '� �" � � � # � $ % � z � �h m � z

�� �" $ k � j$ � � m �� a �E � ` � �" � � j� �� � � m �� `" � Ch �� � �$ " � � %& � � � " � &(w" � � f ( l %k E � c �a h �E �k m � % b D �c � � �$ " d c h � % � " � %� ` � � � �E k �" $ k

�h � E � j$ C m �� $ � �E �E �� � % bE d c � %& � � � " � '(

� 8 � 8 � � S � XV � � S Q � � �� S

B �$ b � � % �h �" ' � �E � ` �h � � ` � � � � �$ " � ��E � � � %& � � � " � ' �� � " � � � z

j� �� � k ' %k �" $ k � � � $ � �� % d c # � $ � % x � y � h %k � �" � � d c ' d � � %E k �" $ k

Page 39: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

7 � � � �- � � � 2 �� 1 � �� / 4 � � � �� � � � 1 � �

$ � �" E �D �E � � x2≡y2 (mod n)( g$ % � � � � �" � x 6≡±y (mod n)� " �# � $ %�

(x + y, n) � (x− y, n)$ C" bE � " � � ' � � % bE d � h � % � " � % � # � $ %� n(u � z ' �h � � C� �� � ' d ' �" � E � � �� ' %�E � � k ' %k � " $ k �" �h �� � z

" � � � j� �� � � � � � �E �E E d ` u( n � � � ( £E �$ E � '� E E � " � � �� � w ` %� �� �

� � �h $ " � ' %�E � � # � $ %� ' ' �h � �� jE �$ " � h ' Cc � '� h �� " � '(��V � � S � =� � � n>1 �� � � �� � { � � { �~ ��� � �~ �� �� � � �� { { �� {� � � � �� { � � { {� � �� � � � � � � � � �~ � �� � { � �� �� � � � � �� { � � � � � � n = a · b �

a > b > 0 � } � � �� � � � � �� �� � � � � � �� � �� � {� � �� �� � � � � { � n = x2 − y2 �

x > y > 0 ? �� { � { {� � �� � � � � � � �� �� � � �

x =a + b

2, y =

a− b

2,

a = x + y, b = x− y.

l �� � j� " � % b$ " ' � �# � ' �h E �( � � " �h n � � � j� � %y # � �" $ k '" � � # " � � � � � % d c jE � # �E � k c �� �� z

� " �� y ' � � �h $ " � ' %�E � � n=x2−y2 �a E �E � `" � �� � C (x, y)� �� � � m � �� k

'� � # �$ " '� � � E h �h � " � 'E � jE � # �E � � x# � $ %� b√nc + 1, b√nc + 2, . . . �

� � � '� �k k h %k � � a h �& � � jE �c �� '�E $ " '�

(b√

nc+ i)2 − n = y2.

l %k �" m �� � � '� � % �a E d c jE � # �E � `

x �a E � ' �$ � � % b j � '� " b$ k " � �# " � �$ % � # � $ % �E � k ' %k � " $ k � '� h �� " � � " � �E �$ m � % b D � ` ' � � �k " E �$ " by

E � m Ch � " � � '� h �� " �# E d ' d # �" � h %k �h E �& � � jE � m � % b D �c � � �$ " d c

# � $ � % p( u �$ %�h E � � $ ' � `$ " ' � %� &� � � � � '� �k � " $ k � C" � ' d # � $ %�E �k $ � z

�" '� " $ " ' Cy �� & �$ � ' � %� �� a � E h �� (Bc �h + n *E �# � " E �� # � $ % � � p1, . . . , pk

*E � m � % b D � � � � �$ " d � # � $ %� (x� & ¥ ( u � � '� � � " b pi |n� i = 1, . . . , k( g$ % � h � � " �h � % � " � % bE � `h �E (x� & ,( l %k � � a h �& � x �" b√nc + 1h � b√nc + n0

' d # � $ % � " b '� z

% �# ��E d

t = x2 − n, ti = t mod pi, i = 1, . . . , k.

x� & ¤( g$ % � c �" k m!d h %k �h E �& � i = 1, . . . , k ' d � � %E �E � �h E � � j

C$ % � ' � ` +

* ti = 0 � p2i

E � h � % � " t ; � % �

* ti 6= 0 � ( ti

pi) =−1�" � �� �� `" � � $ %�h Cy �� C xE � D � & � ,( B � � �" � 'E � $ % C# � �

�� �� `" � � D � & C f (x� & f ( u � � '� � � " b �k ' %k � " $ k % � t=x2−n � � %E d � '� h �� " � ( g$ % �

x2−n=y2 � " � ' d h � " b �" '� " +� n *$ �$ " � 'E �� � n=a·b� a=x+y �

+ , � - � �� � � � 1 � � 2 �4 1 � � � � �5 � � 5 � � � � �� / � � 7 7

b = x− y� ( g$ % � t = x2−n *E � � � %E d `� '� h �� " � " � �� �� `" �

� $ %�h Cy �� C xE � D � & � ,(

u �$ C" � � h � E E d ` � %& � � � " � � �h � mE � � " �h C� � � � mE d c h � %�E � `� �k ' %k �" $ k �� jE � ' �h E �$ " b y � " �h � �� � � m � �� '$ �c ' � j �a E d c h � % � " � z

%� `( _ % �a E �$ " b �" �& � � %& � � � " � � ��E � '� � " $ k ' � % �# �E � `

O(n0 log2 n)(u� �� � " � n0

� � ��h � %k � " $ k � �� � " �# �$ � � � j� �E � �� " E d c ' d # � $ % � " � % b z

E d c ' � j �a E �$ " � `( �� m � % b D � jE � # �E � � n0 � " � m � % b D � � # � $ % � ' � j z

�a E d c h � % � " � %� ` m Ch �" � � � '� ��E �( £h E � � � � ' �" % � # � � �" � " �h �� � � � mE d c h � %�E � `� � $ � � � � by � �" � � �& �E � c �h � " $ k E � � �E b D � `h � z

% � " � % b � h � E E d ` �" �h � � j ' � %k �" E � c �h � " bE � � m � % b D � `h � % � " � % b# � $ z

%� n� E � � �� ' �$ c �h k �� ` √n(�� �" � � # " � ' �$ " � √n �a E � m �� " b √kn � � � � %d c jE � # �E � z

k c k( B � E �& �c $ % C# � k c �� ��c �h � C �� 'E �E �k (b√

knc+ i)2−kn=x2 �

k = 3, 5, . . . � � j ' � %k �" E � `" � � $ � � �� jE � # �E � � x � C" � m � %� � � � � �" z

� �& � �� �� m � �� jE � # �E � `

i� # � � � � k = 1( u � � �" � � '$ % C# � � C$ ��c �

" � � �� � ��h $ " � ' %�E � � " � � a � � � j ' � %k �" �� � " � � � j � '� " b# � $ % � n � " � � � � �

# � $ %�

(b√

knc+ i + x), (b√

knc+ i− x)

%� a � " ' �E " � � '� %� (0, n) � Ch � ' %�" ' � �k y " �� '�E $ " ' C

(b√

knc+ i + x)(b√

knc+ i− x) = kn.� 8 � = � � Ut V � X � TV � S

B � E �& � c $ � ' �� �E E d c � %& � � � " � c �� � " � � � j� �� � h %k E � c �a h � z

E � k h � % � " � %� ` � $ � � % b j C�" $ k � h �k �� a � E h �� % , 5 4 e &( & � j� � %y # � y �� k $ k

' � � � $ � � �� � d �� %d c # � $ � % x � y � Ch � ' %�" ' � �k y � �c C$ % � ' �k

x2 ≡ y2 (mod n), x 6≡ ±y (mod n).

w" �" � �h c �h k ' %k �" $ k � m � m ��E � � �" �h � n � � � � '� �" � � � " �� zm C�" $ k ' d � � %E �E � � $ " � �& �& � �� '�E $ " '� (l %k � � � $ � � " � � �c # � $ � % ' �$ � � % b j C� $ k � �E k " � � �� � " � �E � ` m� j d (¢ � j � ' � �� � " � �E � ` m� j � `E �� �" � � �� E �a � $ " ' � B={p1, p2, . . . , ph}E � m � % b D �c � � �$ " d c # � $ � %( £ m!d # E � '� � # �$ " '� p1, p2, . . . , ph

m� � C" � � � z

$ " d � # � $ %� � E � � �� ' �$ c �h k �� � E �� �" � � � ` & �� E � �d M � h = π(M)( Ch � & � ' � � � " b � # " � �� % �� # � $ % � b ∈ N

k ' %k � " $ k B z# � $ % � � �$ % �

# � $ % � b2 mod n �� j %� & � � " $ k ' � � � � j ' �h �E � � � � �$ " d c # � $ � % � j �� � " � � z

E � ` m� j d +

b2 mod n =∏

p∈B

pαp(b).

Page 40: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

7 � � � �- � � � 2 �� 1 � �� / 4 � � � �� � � � 1 � �

_ � � �$ " � ' � � � a h � C B z# � $ % C '�� " � � � �� � j� " � %� ` � j �" �& � �� j % � z

a �E �k

~α(b) = (αp1(b), . . . , αph

(b)),

� " � � a � h ' � �# E d ` '�� " � � � � � % C# �E E d ` � j ' �� " � �� ~α(b) � � � '�h �E � �

'$ �c � & �� � � �h �E � " � � �h C %y ¤ �

~ε(b) = (αp1(b) mod 2, . . . , αph

(b) mod 2).

g$ % � " � �� � b� � � � z % � m �$ � �$ � m � � �h � m �� " b" � � �� E �a �$ " ' � �� j z

% � # E d c B z# � $ � % b1, . . . , bm � � � � � �" � � � ' d � � %E k � " $ k % �E � `E �� $ � �" z

E �D �E � �

~ε(b1)⊕ . . .⊕ ~ε(bm) =~0,

" �h %k � � � � j '�h �E �k x = b1 . . . bm

' d � � %E k �" $ k $ � �" E �D �E � �

x2 ≡ y2 (mod n),

&h � # � $ % � y � � ��h � %k � " $ k � � ' �� " � �� � �� � j� " � %� ` �� '�E $ " ' �

y =∏

p∈B

p12(~αp(b1)+...+~αp(bm)).

� � � { � � � � z�� � {� � j� � %y # � �" $ k '$ %�h Cy �� (x� & ,( B d m �� " b$ % C# � `E �� b � 1 < b < n � � ' d # � $ % � " b b2 mod m(x� & ¤( u � � mE d � h � %�E �k � � � �d " � " b$ k �� j % �a � " b b2 mod mE �

� � �$ " d � E �a � " � % � � j �� � " � �E � ` m� j d (x� & f ( g$ % � bk ' %k � " $ k B z# � $ % � � " ( �(

b2 mod n =∏

p∈B

pαp(b),

" � j� � � E � " b ~α(b) � ~ε(b)( u � '" � �k " b � � � ��h C � C & �E � �� �� �

# � $ � % bh �" �c � � � � � �� � E � m Ch �" E � `h �E � m=h+1 B z# � $ � %b1, . . . , bm(x� & �( ¢ � `" � %E � � � � � � � �� D � k $ � � � � by � %& � � � " � � �$ %�h � '� z

" � % bE �& � � $ � %y # �E � k E � � j ' �$ " E d c �� C$ $ � �h E � � �h E Cy $ � z

$ " � C % �E � `E d c C �� 'E �E � `

x1~ε(b1)⊕ . . .⊕xm~ε(bm)=~0 �" E � z

$ � " � % bE �E � � j ' �$ " E d c (x1, . . . , xm)

&$ � �" E �D �E � � % � E � `E � `

j� ' � $ � �$ " �

~ε(bi1)⊕ . . .⊕ ~ε(bit) =~0, 1 < t 6 m.

u � % �a � " b

x = bi1 . . . bit , y =∏

p∈B

p12(~αp(bi1 )+...+~αp(bit )).

+ , � - � �� � � � 1 � � 2 �4 1 � � � � �5 � � 5 � � � � �� / � � 7 �

x� & 2 ( u � � '� � � " b x ≡ ±y (mod n)( g$ % � �" � " � � � " � � � '" � � � " b

� � � ��h C � C & �E � �� �� �)( g$ % � E �" � " �E � `h �E �E �" � � ' � � % bE ��

�� j % �a �E � �

n = u · v, u = (x + y, n), v = (x− y, n).¢ � " � Ch �� � �$ " b � %& � � � " � lR� � $ �E � $ C �� $ " ' �E E � ' % �k �" ' d m � �

�� � " � �E � ` m� j d ( g$ % � # � $ % � h ' d m �� E �" � � � # " � M ≈√

n2

� " � � �# " �

� � a h �� # � $ % � b m Ch � " B z# � $ % � � E � � � % C# � � d � � � � �" � $ �� 'E �E �k

x2≡ y2 (mod n)

m Ch C" " � � ' � � % bE d �)( r � � � " �& � � E � h � m Ch � " �� D � " b

$ � $ " � d �" �# �E b m � % b D �& �# � $ %� E � � j '� $ " E d c ( g$ % � h * � % � � " �

B z# � $ %� m Ch C" � �k ' %k " b$ k �# �E b � �h � �(�� �" � � # " � �$ % � # � $ % � n *$ �$ " � 'E �� � " � C �� 'E �E � � x2 ≡ a2

(mod n) � � � " � � � �� `E � ` � �� � �� D �E �k %h �� � a � " � �" � ' � � z

# � $ " ' � C � �� a E �E �k &( u � �" � C '� � �k " E �$ " b � �k ' %�E �k �� � d (x, y)$ x ≡ ±y (mod n)E � � �� ' �$ c �h � " 1/2( _ %�h � '� " � % bE � � � � '" � �k k � � � z

��h C � C E � m � �� h %k � � % C# �E � k E C a E � ` �� � d k �� j d � � % C# � �# " � E � h � a E �$ " b h � E E �& � �" �h � E � c �a h �E �k h � % � " � %k E � �E b D � �# � 1− 2−k(£ m � jE � # � # � �� j Ψ(n, M)# � $ % � �� %d c # � $ � % a ' �E " � � '� %� 1 << a 6 n� �� $ � %� h d '� y �� c $ k ' � � � � j '�h �E � � � � �$ " d c # � $ � % � j E �a � z

$ " '� B = {p : p 6 M}(i j �� j C % b" � " � '¢ ( l� z �� `E � % , 4� � & � g( r � � � � %h � � v( w �h �D �

� r( u � � �� E �� % , 4 ef & ' d " �� � � " $ %�h Cy �� k

��V � � S % l� z �� `E � r � � � � %h � w �h �D � u � � �� E � &( z �� �� �> � ε >> 0 � x > 10� u 6 (log x)1−ε } � � u→∞ �� �� { �� �� { } { x �> } { �� � � � � �� { {� � { ��� � �

Ψ(

x, x1/u)

= x · u−u(1+o(1)).£" $ y h � � � � u = log xlog y

� � % C# � �

Ψ(x, y) = x · u−u(1+o(1)).

u � �" � C ' � � # �$ " '� � � � m % � a �E E �& � jE � # �E �k '� � �k " E �$ " � � � % C z

# �E �k # � $ %� � �� $ � %� h d '� y �� & �$ k ' � � � � j ' �h �E � � � � �$ " d c # � $ � % � j

E �a �$ " '� B = {p : p 6 M} � � � � $ % C# � `E � ' d m � �� # � $ � % ' �E " � � '� %�

[2, n] �a E � � $ � � % b j � '� " b ' � % �# �E C

Ψ(n, M)

n= u−u,

&h � u= ln nln M

( w" C a � '� % �# �E C �a E � � � �E k " b '� � # �$ " '� � � � m % � a �E z

E �& � jE � # �E �k '� � �k " E �$ " � � �k ' %�E �k B z# � $ %� E � D � & � , � %& � � � " � (

Page 41: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

�� � � �- � � � 2 �� 1 � �� / 4 � � � �� � � � 1 � �

B$ � & �E � h �E � m �� " b h + 1 �� j % �# E d c B z# � $ � % � � � �# � � � � � c � � � z

' � �� � E � D � & � ¤E � h � ' d � � %E � " b hh � %�E � `( s� � � � m �� j � � $ � �h E y y

' �� �E E Cy � � � �! � " �# � $ � Cy $ % �a E �$ " b � %& � � � " � lR� � $ �E � �a E �

� ��E � " b ' d �� a �E � �

T = OA(uu · h2 + h3),

&h � OA(h3) *$ % �a E �$ " b �� D �E �k $ � $ " � d � j h+1 % � E � `E d c C �� 'E �E � `

�" hE � � j '�$ " E d c ( BE � D � $ % C# � � h = π(M) = Mln M

(B d m� �� '� � # � $ " ' � M '� % �# �E C M = L(n)1/2 � &h � # � �� j L(n) � m � z

jE � # �E � exp(√

ln n · ln ln n)( s �&h � � � � � E �" � Ch E � � � � ' � � � " b �

uu = L(n)1/2,

M = π(M) = L(n)1/2.£" $ y h � $ %�h C�" � # " � " � Ch �� � �$ " b � %& � � � " � lR� � $ �E � � ��E � '� �" $ k

$ %�h Cy �� � m �� j � +

T = OA(L(n)2 + L(n)3/2) = O(L(n)2).

A % & � � � " lR� � $ �E � �a � " md " b C$ � ' � � D �E $ " ' � '� E � �E � $ � � % b� �

E � � �� ' %�E �k +

* �a E � j� �E � " b � � � ��h C � C & �E � �� �� � B z# � $ � %" � � � # " � md '� � � z

k " E �$ " b � c � � � �a h �E � k md %� m � % b D � ` ;

* �a E � � �" � � j � � � '� " b ' d m � � �� � " � �E � ` m� j d $ " � � # " � md

C �E b D � " b# � $ % �E � � j '�$ " E d c '$ � $ " � � C �� 'E �E � ` ;

* �a E � C$ � '� � D �E $ " ' � '� " b � � � ��h C � C �" $ � '� � � % �c �c � # � $ � % b �E � k ' %k y � �c $ k B z# � $ %� � ;

* �a E � � $ � � % b j � '� " b md $ " � d ` � %& � � � " �� D �E �k $ � $ " � d % � z

E � `E d c C �� 'E �E � ` %E � � � � � � � � %& � � � " B �h � � E � h %k �� j �� a �E E d c

� " � � � & � � " ( h (

u �h � mE d � C % C# D �E � k E � � � j ' � %k y " � j �E � " b � m �� ` ' �h � ��E � �

$ % �a E �$ " � O(L(n)c) � E �h � y " ' � j �a E �$ " b C �E b D � " b� �E $ " � E " C c�c > 1(

� 8 �: � � Ut V � X �� U[ S� X S � 'V � � TV � S

_ C" b � %& � � � " � � � %c � �" � *   � � � � $ �E � � � � C m % � � � '� E E �& � � � '

, 4 52 &( � j� � %y # � �" $ k 'h ' Cc � j �E �E �k c ' � %& � � � " � lR� � $ �E � +

� & $ % C# � `E d � # � $ %� b ' d m � �� y " $ k $ � � � � b y � " �h � E � � �� � d ' z

E d c h � � m� ` � � ��h % �a �E E �& � �� & �� E a � � � � j ' � %k y �� & � & �E � � � � � '� " b

+ , � - � �� � � � 1 � � 2 �4 1 � � � � �5 � � 5 � � � � �� / � � �,

" � � � � b� # " �# � $ % � b2 mod nk ' %k �" $ k � %d � � � � �" � C '� � �k " E �$ " b

� & � �� j % �a �E �k m � %� � ' d $ �� � ;

m & � j �� � " � �E � ` m� j d B � $ � %y # � y " $ k " � # � $ %� p� h %k � �" � � d c

(

n

p

)

=−1.

v� $ $ �" � � � & � m � %� � � �h � � mE �(��V � � S � �~ � � � x > 1 ��� �� � � � � � �� � { � � � � � { � � {

Pk

Qk

}

�} {� � � � {��� � � �� � {� � � � � { } { �� { �� � �� � � { �� �� k = 1, 2, . . .

�{� �� } � � �� �� k > 1�> } { �� � �� � � � � � � � � � � � � {|P 2

k − x2Q2k|< 2x.

l �� � j� " � % b$ " ' �( B$ � % C$ ' � `$ " ' � �h c �h k ��c h � � m� ` � � �

|P 2k − x2Q2

k|=Q2k ·

x− Pk

Qk

·∣

x +Pk

Qk

<Q2k ·

1

QkQk+1·(

2x +1

QkQk+1

)

.£" $ y h �|P 2

k − x2Q2k| − 2x < 2x ·

(

−1 +Qk

Qk+1+

1

2xQ2k+1

)

<

< 2x ·(

−1 +Qk + 1

Qk+1

)

< 2x ·(

−1 +Qk+1

Qk+1

)

= 0.� U � ( T X * � � �~ � � � n �� � � � �� � � � � � �� � �� � { � � Pk

Qk

�} { �� { �� �� �� � { �� � �� � � � � � √n ? �{� �� � � � � �� �� � > � } { � �� { �� � � { � � � � � � � � ��> � � � P 2k mod n � � � � � P 2

k − nQ2k

� � � } � � � {� � { ��� � 2√

n ?l �� � j� " � % b$ " ' �( u � � x =√

n

P 2k ≡ (P 2

k − nQ2k) (mod n),

� � �# � ' $ � % C " � � �� d |P 2k − nQ2

k| < 2√

n( u � �" � C �E � � % bE d `

� � � m$ � %y " E � ` ' � % � # �E � ' d # �" # � $ %� P 2k

� � �h C %y n $ � ' �� h � �"

$ P 2k − nQ2

k

� # " � � " � � m � '� % �$ bh �� � j� " b(l� E E �� $ %�h $ " ' � � � �� � j d '� �" � # " � � $ % � '� � # �$ " '� $ % C# � `E d c # � z

$ � % bE � , �" � �� � % & � � � " � lR� � $ �E � m �� " b# � $ %� Pk � " � �E � � % bE d `

� � � m$ � %y " E � ` '� % �# � E � ' d # �" # � $ %� P 2k mod n� �� 'E d `

P 2k −nQ2

k

� E �

m Ch �" � �� ' d D � " b jE � # �E � k ¤√n( u � �" � C '� � �k " E �$ " b � & � �� j % �a � z

E � k ' � � � � j '�h �E � � # � $ � % � j m� j d B

m Ch �" m � %� � ' d $ �� � ` � # � � � �

$ % C# � `E � ' d m � ��(u �� � a � " � �� � b �# " �" � � � ` ' d m � �# � $ � % b � � j ' � %k �" � $ � %y # � " b � j

�� � " � �E � ` m� j d '$ � # � $ %� p � C� �" � � d c (np )=−1( u �� � a � �# " � ' �� j z

% �a �E � � # � $ %� P 2k − nQ2

k

E � � � �$ " d � $ � E �a � " � % � m Ch C" '$ " ��# � " b$ k

Page 42: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

�� � � �- � � � 2 �� 1 � �� / 4 � � � �� � � � 1 � �

" � % b� �" � # � $ %� p� h %k � �" � � d c nk ' %k �" $ k � '� h �� " �# E d ' d # � " �

� � �h C %y p(u C$ " b p | (P 2k − nQ2

k)( s� � � � � (Pk , Qk) = 1 � " � (p, Qk) = 1( £" $ y z

h � ' d " �� � �" � # " � � %� �E " Qk

� m �� " � � � �h C %y p( u � �" � Ch � % a E �

' d � � %E k " b$ k C$ % � ' � �

(

PkQ−1k

)2 ≡ n (mod p),

E � �" � � � jE � # � �" � # " � (np ) = 1(s� � � � C % C# D �E �k � � j ' � %k y " h � m � " b$ k � m �� ` � ��E � � $ % �a E �$ " �

� %& � � � " � O(L(n)c) � � � c =√

2(

� 8 � @ � '� XV ( � * S (� S X Z � V t V � � � � X S

B , 4 e , &( r( u � � �� E � � ��h % �a � %h %k � � � �a h �E � k B z# � $ � % � $ z

� � % b j � '� " b � �h c �h � � m � m �� y � � ` �" �h n � � � (v� $ $ �" � � � CE � �� y

f(x) = (x + b√

nc)2 − n,

k ' %k y � Cy $ k � '� h �� " E d " ��c # %�E � $ �� %d � � � � � � � � � �E " � �)(u � � � � a h � �� % � x ∈ Z

� � % C# � � " $ k E � " � � ' � � % bE �� $ �� 'E �E � �

(x + b√

nc)2 ≡ f(x) (mod n),

� � �# � jE � # �E � � f(x) � � � � %d c xE � '� % � � � +

f(x) 6 x2 + 2x√

n,

� � � �" � C (x + b√nc)2 6= f(x)( u � �" � C� � $ % � � � � ' �$ " �$ % C# � `E d c

# � $ � % b ' � %& � � � " � �� $ $ � " � � '� " b jE � # �E �k b = f(x) � � � $ % C# � `E d c

x � j� � %y # �E E d c 'E �� �" � � � �E " � � '� %� −M 6 x 6 M � " � ' � � �k " E �$ " b

� � � �a h �E �k B z# � $ � % ' � j �� $ " � � " (u � � �" � �a E � � ��h '� � � " � % bE � �$ C ��$ " ' � " b � � �$ � � '� E � � " �c x� j �" �& � �E " � � '� %� � � �" � � d � �& C" h � '� " b �� j % �a �E � � f(x)E � E � z

a � " � % � � j �� � " � �E � ` m� j d B( l %k �" �& �h %k � � a h �& � p ∈B � � �" � � ��

�a �" ' d $ " C �� " b '� � # �$ " '� $ � E �a � " � %k ' �� j % �a �E � �

f(x) = (x + b√

nc)2 − n =∏

p∈B

pαp(x),

�� D � � � '� h �� " E �� C �� 'E �E � �

(x + b√

nc)2 − n≡ 0 (mod p)

' � � % b ��

Zp( g$ % � r(p)1 , r

(p)2

* �� D �E �k �" �& � C �� 'E �E � k � " �h � % a E �

' d � � %E k " b$ k �� '�E $ " ' � x = r(p)i + jp � i = 1, 2 � j ∈ Z(

+ , � - � �� � � � 1 � � 2 �4 1 � � � � �5 � � 5 � � � � �� / � � ��

u � �h � %� ' � � �h '� � � " � % bE � h � E E Cy �� m �" C � � E � c �a h �E � y � � � z

E � `

r(p)1 , r

(p)2

h %k � � a h �& � p ∈ B � �a E �" � �� � b �$ " � ' � " b ' �E " � � '� z

%� [−M, M ]" � % b� �" � # � $ %� x�h %k � �" � � d c $ �� 'E �E � � x≡r(p)i (mod p)' d � � %E k �" $ k h %k h �$ " � " �# E � m � % b D �& �� � % � # �$ " '� # � $ � % p∈B( �E � E � �

h %k � � a h �& � x$ � � $ � � " �c p∈B �h %k � �" � � d c ' d � � %E k y " $ k �" � $ �� 'E � z

E � k � � � �a �" " � � a � m!d $ " �� � �$ C ��$ " ' � " b �� � " � � � j� � � y # � $ %� f(x)�� $ % � �E � $ C ��$ " ' C�" (lRa ( l � ' � $ � u(   �E " & � � � � � m � m � � % � h � E E d ` � �h c �h ( £E � � ��h z

% �a � % � � $ � � % b j � '� " b E �& �# %�Efab(x) = ax2 + 2bx + c,

&h � � � � � � � �� �E " d a, b, ck ' %k y " $ k �� %d � # � $ %� � � Ch � ' %� " ' � �k y "

C$ % � ' � y

b2 − ac = n, 0 6 b < a;

u � � " � � � ' d m � �� � � � � � � �� �E " � ' ' d � � %E k � " $ k �� '�E $ " ' �

afab(x) = (ax + b)2 − n,

�" � Ch � � � % C# � � $ �� 'E �E � �

(ax + b)2 ≡ afab(x) (mod n),

� � �# �

(ax + b)2 6= afab(x).

r � � � � � �� �E " d a, b, c ' d m � �� y " $ k � � $ c �h k � j$ %�h Cy � �c $ � � m �� z

a �E � `( n CE � � �k fab(x) � � � E � � � " � � $ � � % bE d � jE � # �E � � '� �E �� c

�" �� j� � [−M, M ]

fab(−M)≈ 1

a(a2M2 − n).

  � E � � % bE �� jE � # �E � � �E � � � � E � � � " '" �# � � x =−b/a � −1 < x < 0 �

fab

(

− b

a

)

=−n

a.

Page 43: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� � � � �- � � � 2 �� 1 � �� / 4 � � � �� � � � 1 � �

Ch � ' d m � �� " b a, b, c" � � � # " � md � � $ � � % bE �� � �E � � % bE ��

jE � # �E �k � CE � � � � fab(x)E � �" �� j� � [−M, M ]

md % � �� 'E d � � � m$ � z

%y " E � ` ' � % � # �E � � � � �" � ' � � � % �a E d � � jE � � C +

f(x)

x

−M

M

−b/a

v � $ ( ,(

u � �" � C � � %� & � � +

a≈√

2n

M.

� � $ % � bE � c �h � � � � �� D �E � � $ �� 'E �E �k

b2 ≡ n (mod a), 0 6 b < a.¢ � � �E � � � # � $ % � c ' d m � �� � � j C$ % � ' �k

b2 − ac = n.�� �" � � # " � C$ % � ' � � $ C ��$ " ' � '� E �k �� D �E � k '" � � �& �$ �� 'E �E �k

�a E � � �� � m �� j � '� " b$ %�h Cy � � � m �� j � +h %k '$ �c � � �$ " d c h � % � " � z

%� `

q | a ' d � � %E k �" $ k (nq ) = 1( �E � # �E � � �� � " � � � j� �� � # � $ %� aE � � m z

c �h � �" � � a � � �" � C� # " � �E � C# � $ " ' C� " '� � # � $ " ' � $ � E �a � " � %k '

� $ � � � $ �� 'E �E � � ( u � �" � C� � md # E � � '� � # � $ " ' � # � $ %� a ' d m � �� y "

% � m � � � %E d `� '� h �� " � % � m �# � $ % � � �� � " � � � j C� �� ' � � � � j '�h �E � � � � � z

$ " d c # � $ � % � j �� � " � �E � ` m� j d (u � � h � E E � ' d m � �� �� �� � " � � ' jE � # �E � k E �& �# %�E � fab(x)E � �E z

" � � '� %� [−M, M ] Ch � ' %�" ' � �k y " E � �� '�E $ " ' C

|fab(x)|6 1√2

M√

n,

# " � ' 2√2 �� j % C# D � � # � C � $ c �h E �& � � %& � � � " � u � � �� E �� � '� �" � z

� � � � � M �√n

|fab(x)|6 2 + 2x√

n≈ 2x√

n 6 2M√

n.

+ , � - � �� � � � 1 � � 2 �4 1 � � � � �5 � � 5 � � � � �� / � � � �

u � �" � C " � � � � � � % � E � d m � %� � � ��h � �# " � " � % bE d h %k � � � $ � �

B z# � $ � %( � " �h u � � �� E �� E � j d '� �" $ k � " �h � � '� h �� " � # E �& � �� D �" � � % �

� � z �" �h � � � �" �h l � ' � $ � *   �E " & � � � � * �� � � z �" �h � % �� � � �� � �

� � � � � � �� 9 � � 9 � � 9 � � � � � � �� 9 � � 9 � � - ��� � � 9 � �� � � � � � &(

� 8 � ?� (p − 1) � � XV ( Y S � XV � � S Q $V U U S� (S

u ��h � � % �a � � # " � n *E �# �" E �� $ �$ " � 'E �� # � $ % � � E � � � y �� �

E � m � % b D �c � � �$ " d c h � % � " � %� `( £ m � jE � # � # � � � j pE � � �E b D � ` � � � z

$ " � `h � % � " � % b# � $ %� n( ¢ � D � j� h � # � j� � %y # � �" $ k ' � & �E � c �a h �E � �)(u ��h � � % �a � � # " � # � $ % � (p− 1) �� j %� & � � " $ k ' � � � � j '�h �E � �

E � m � % b D �c � � �$ " d c h � % � " � %� `( B d m� �� # � $ % � k � � �" � � �� k ' %k �" $ k

�� �� � " � � �" �h � ( l %k C$ �� D E � ` �� m �" d � %& � � � " � E C a E � � # " � md

' d � � %E k % �$ b C$ % � ' � �(p− 1) |M(k),

&h � M(k)=

¢ £ r(1, 2, . . . , k)

% ' �$ " � M(k) �a E � � $ � � % b j � '� " b k! � % � m �

� � � � j '�h �E � � pα1

1 . . . pα2

2

�� � ' d c k � � �$ " d c # � $ � % 'E �� �" � � d c $ " � �� z

E k c α1>. . .>αk � � �" � � d � ' d m � �� y " $ k � j � ' � � $ " �# �$ � �c $ � � m �� a �E � ` &(B$ � % C � % � `" � � �� d n � � � ' d � � %E k �" $ k $ �� 'E �E � �

2M(k) ≡ 1 (mod p).g$ % � � � � �" �

2M(k) 6≡ 1 (mod n),

" �

p | (2M(k) − 1, n),

&h � 1<p� (2M(k) − 1, n)<n( s� � � � m �� j � � d=(2M(k) − 1, n) *k ' %k �" $ k

$ � m$ " '�E E d h � % � " � %� # � $ %� n� � �� " E d p(¢ � �" � ` � h � � �$ E � '� E $ %�h Cy �� ` � " �h E � c �a h �E �k $ � m$ " ' �E E �& �

h � % � " � %k # � $ %� n( s� � � � � # � $ % � kE � � j '� $ " E � � " � 'E � � $ � � % b j � '� E

� �$ %�h � '� " � % bE d ` �� �� m � � � %d c jE � # �E � `h �E �� �" � � �& � � � � $ � � � z

'� E E �& � jE � # �E �k (u C$ " b k * �� % �� # � $ % � � E � � � � � � k < 106 � � c *E � m � % b D �� �� % ��

$ C$ % � ' � � (c, n) = 1� E � � � � � � � c = 2(x� & ,( l %k � � a h �& � i �" 1h � k ' d # � $ %k �" $ k mi = cM(i) mod n �

� � � ' � �k �" $ k " �$ " D � & � ¤(

x� & ¤( B d # � $ % � " b d=(mi − 1, n)( g$ % � 1<d<n � " �E � `h �E E �" � � z

' � � % bE d `h � % � " � % b# � $ %� n( B � � �" � 'E � $ % C# � � � � %� & � �

i = i + 1(

Page 44: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� � � � �- � � � 2 �� 1 � �� / 4 � � � �� � � � 1 � �

  �a E � �h � � � �� � � '� " b � %& � � � " � � $ � � % b j Ck �h E � ' �� �E E �E �$ z

� � % b� � �� j % �# E d c �$ E � '� E � `

c(s� � � � � (c, n) = 1� " � (c, p) = 1( u � �" � C� � � " � % b� � (p− 1) |M(i)�" � mi ≡ 1 (mod p) � " ( �( p | (mi − 1) � � E � D � & � ¤ m Ch �" E � `h �E E �" � � ' � z

� % bE d `h � % � " � % b n(u� �� �" � kh � % a �E ' d m � �� " b$ k E � �# �E b m � % b D � � �E � # � �a �"

m!d " b ' d � � %E �E � C$ % � ' � � mi ≡ 1 (mod n) � h � % � " � % bE � m Ch �" E � `h �E (u � � ' d � � %E �E � � � %& � � � " � ' � j '�h �E � � ' $ " � ��E b cM(i) E � h �

�$ C �� $ " ' %k " b ' � � % b ��

Zn

� " �h � � � '" � �E �& � ' � j '�h �E �k ' � '� h z

�� " ( s� � � � � log M(i) 6 i log i� " � h %k ' d # � $ %�E � k (mi − 1) mod n" � � m C�" $ k O(i log i) � � � �! �" �# �$ � �c � �� �� �� ` � � % b ��

Zn( u � �" � C

� m �� k $ % �a E �$ " b � %& � � � " � �a �" m!d " b & � C m � � ��E �E � ' � % �# � z

E � `

O(k2 log k log3 n)(

� ��� � � N� � �G � J � N L � � J� � N �� L� J � � �

r � � �" �& �� � �# �$ � � k $ � $ " � � � / �k ' %k � " $ k � %� $ $ �# �$ � � � � � � z

� � � � � �" �& �� � � # �$ � � `$ � $ " � d $ �" � � d " d � � %y # � �)( £E � m!d %�

� � �h % �a �E � ' �� m �" � �2 ¥ � � 'E � $ " �k �� � ' �� k � � % C# � %� �# �E b D � � � z

� �� �� $ � � �$ " �� E �E � �( ¢ �$ �" �k E � E �& �# � $ %�E E d � � � � " � # �$ � � � �� zm �" d � � � j C# �E � y � � $ ' � `$ " ' � '� �" � � d c C� � j� E d E � m � � d �� �� � " � � ' �� � � ' �h k � � � � �$ %� m %�E � y $ c � d � � � � � �� ' � % bE � � $ � � % b j � '� E � � �E �

$ # � " � � " $ k m� j � �� $ E � `(¢ � � � E � � m �� ` � %& � � � " �� m �" d $ � $ " � d � / �( r� a h d ` � m � z

E �E " ' d �� m� " d '� � " $ ' �y �� � C �" � � d " d c � $ �� �� " E d c � %y # � `( l %k

�" �& � �E & �E � � � � C� " h '� m � % b D � c � � �$ " d c # � $ %� p � q � ' d # � $ %k z

� " � � � � j ' �h �E � � n = pq( �� " � " �� m C�" $ k ' jk " b $ % C# � `E �� # � $ % � e�' j� � E � � � �$ " �� $ ϕ(n) = (p − 1)(q − 1)� � E � `" � # � $ % � d � j C$ % � z

' �k ed ≡ 1 (mod ϕ(n))( u� �� (n, e) � m �k ' %k �" $ k �" � � d " d � %y # � �

� � � �� �" $ k ' �" � � d " d `� � " � % �&( £$ " � % bE d � # � $ %� (p, q, ϕ(n), d) � m �� z

j Cy " $ �� �� " E d `� %y # ( �� � " � � # " �# � $ %� (p, q, ϕ(n)) 'h � % bE � `D �

E � E C a E d � �& C" m!d " b CE �# " �a �E d ( l %k �� $ D � � � � '� E �k h �$ " � " �# E �

jE � " b �� � C (n, d)(g$ % � � m �E �E " Ac �# � " � �$ %� " b$ � � m ��E � � t � m �E �E " C B � " � �E ' d zm � �� � " � j �" � � d " �& � � � " � % �& � �� � C (n, e) � m �E �E " � B � ' d # � $ %k � "

D � � � � '� E E �� $ � � m ��E � � +

s≡ te (mod n).

A m �E �E " B � � � % C# � 'h � E E �� $ � � m ��E � � � ' d # � $ %k �" +

t≡ sd (mod n)

�� �� � � � � � � � !� �� � � � ! � � ��

u � � � j C# �E � � � � � �" �& �� � � # �$ � � `$ � $ " � d � / � �$ E � 'E d ' � � � � z

$ � k ' %k �" $ k ' d m � � �� �� �" � � ' p � q � e � d� � � � � �" � � d c j� h � # � �� D � z

E � k $ �� 'E �E � k

te ≡ s (mod n)

�" E �$ � " � % bE � t � % � m �E � c �a h �E � k %y m �& � � j �� �� �" � � '$ �� �� " E �& �

� %y # � (p, q, ϕ(n), d)k ' %k � " $ k $ % �a E � `(

Page 45: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� � �� - 4 � � � 1 �� � �2 � �� / 4 � � / � /1 � � � , / 1

� = � � � � � S V T * � �) � W ( \S� S � X� S T T X � p 7 �

u �� � a � � # " � �$ % � � � � " $ k ' � j �a E �$ " bE � `" � %y m �� � j# � $ � %

(p, q, ϕ(n), d)� " � �a E �E � `" � $ � $ �� � �" E d `� %y # � �$ C ��$ " ' � " b �� $ z

D � � � � '� E � �( l� `$ " ' � " � % bE � � �$ % � d �a � �� � " � � � j � '� " b# � $ % � n� E � `" � � & �h � % � " � % � p � q � " � d jE � � ϕ(n) = (p − 1)(q − 1)� � �� z

�� �" � d %� &� �E � c �h � " $ k � j$ �� 'E �E �k ed≡ 1 (mod ϕ(n))$ � � � � by

�� $ D � ��E E �& � � %& � � � " � g '� % �h � (g$ % � d �a � E � c �h � " b# � $ % � ϕ(n)� " �# � $ %� p � q %� &� �E � c � z

h k " $ k � � � � � C %� +

p + q = n− ϕ(n) + 1,

p− q =√

(p + q)2 − 4n.¢ � � �E � � � �$ % � � � �" $ k � %& � � � " E � c �a h �E �k �� $ � �E �E " d d � " � � � � �

� �� � j d '� � " $ %�h Cy �� k " � � �� � � � � � " $ k � � ���� " � 'E d ` '� � �k " E �$ " z

E d ` � %& � � � " �� � " � � � j� �� � (��V � � S � �~ � � � n = pq � � �� p � q �} � {� � > � ? =� � � �~ ��� � �~ ��� � � { � � � �� � � { � �� � � � � � � � � d} { {� � �> � { �~ � �� �~ (n, e) � � { �~ �� �� � �~ �� � � � {� � � {� � � > �� � � { � � � � ��� � { � �� �� � � � � � � � n� � � � {� � �� {� � � � ~ � } �� � � { �� �� 1/2 ?l �� � j� " � % b$ " ' �( s� � � � � ed≡ 1 (mod ϕ(n))� " � � � � E �� �" � z

� � kh � % a E � ' d � � %E k " b$ k �� ' �E $ " ' �

ed− 1 = kϕ(n),

%� '� k # � $ " b� �" � � �& � � j '�$ " E � ( u C$ " b ed−1=2sr � &h � r *E �# �" E � � s>1(u �" � � �� � w ` %� �� h %k � � a h �& � � %� �E " �

Z∗n

h � % a E � ' d � � %E k " b$ k

$ �� 'E �E � � +

a2sr ≡ 1 (mod n).

v� $ $ �" � � " � �� � b '� � �k " E �$ " E d ` � %& � � � " � � E � % �& �# E d `" � $ " C

� � �$ " �" d   � % %� �� * v� m � E � (

x� & ,( B d m � �� � $ % C# � `E � k# � $ � % a1, . . . , ak ∈ Z∗n

� h %k � � a h �& �

� jE �c � � � '� �k � " �$ " E � D � & � ¤(

x� & ¤( l %k h � E E �& � a ' d # � $ %k � ar(g$ % � ar ≡ 1 (mod n)� " �" �$ " � � �D � % C$ �� D E �(g$ % � ar 6≡ 1 (mod n)� " � ' d # � $ %k � � �$ %�h � '� " � % bE �$ " b

(ar)2, (ar)22

, . . . , (ar)2s−1

� � � � '� �k � � '$ " � �# � �" $ k % � 'E � ` −1 (mod n)( g$ % � h � �" �" �$ " � � �D � % C$ �� D E �( g$ % � E � " � " � ' �� j C % b" � " � m Ch �"

+ , �- � �� � � � � � � �� 1 � � � / � /1 � � � , / 1 � �

E � `h �E �" � � �� s′ � # " �

b = a2s′−1r 6≡ ±1 (mod n), b2 = a2s′r ≡ 1 (mod n).

x� & f ( l %k E � `h �E E �& �E � D � & � ¤# � $ %� b ' d # � $ %k � (b − 1, n)� (b + 1, n)( £E � � m Ch C" � $ � � d � # � $ %� � p � q(g$ % � h %k '$ �c # � $ � % a1, . . . , ak

" �$ " E � D � & � ¤ � � �D � % C$ �� D E � � " �

�� j % �a �E � � E � E � `h �E �(u �� � a � # " � h � E E d ` � %& � � � " $ '� � �k " E �$ " b y C$ ��c � E � � z

E � � 1− 2−k � � j ' � %k �" E � `" � �� � " � � � j� �� y # � $ %� n(u C$ " b

Z∗n = An ∪ Bn � &h �

An ={

a ∈ Z∗n : ∃s′ 6 s, a2s′−1r 6≡ ±1 (mod n), a2s′r ≡ 1 (mod n)

}

,

Bn = Z∗n\An.

s� � � � � � %� �E " d a ∈ An

� � j ' � %k y " E � `" � �� � " � � � j� �� y n � " �h %k

h �� � j� " � % b$ " '� " � � � � d E � h �h �� � j� " b � # " � |Bn|< |ϕ(n)|2

(u ��h $ " � ' � E �a �$ " ' � Bn

' ' �h �

Bn = B0n ∪

s⋃

s′=1

Bs′

n ,

&h �B0

n = {a ∈ Zn : ar ≡ 1 (mod n)},

Bs′

n ={

a ∈ Zn : a2s′−1r ≡−1 (mod n), a2s′r ≡ 1 (mod n)}

,

u C$ " b p−1=2im � q−1=2jl � &h � m, l *E �# � " E d � i6j( _E � # � %� j� �" � �# " � E �a �$ " ' � Bs′

n

E � � C$ " �" � % b� � � � � s′ 6 i� l� `$ " ' � " � % bE � �

ϕ(n) = 2im2jl,

� � �# � 2im2j l | (ed − 1) = 2sr( �E � # � " � ml | r( u � �" � C C$ % � ' � �

a2s′−1r ≡−1 (mod n),

� � $ %�h � '� " � % bE � � �

a2s′−1r ≡−1 (mod p)

�a �" ' d � � %E k " b$ k " � % b� � � � $ % � s′ − 1 < i � " ( �( s′ 6 i(i" � � �

|Bn|= |B0n|+

i∑

s′=1

|Bs′

n |.

Page 46: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

�� �� - 4 � � � 1 �� � �2 � �� / 4 � � / � /1 � � � , / 1

�# � " d '� k � j � � � � � j

Zn∼= Zp + Zq � � � % C# � �

|B0n|= |B0

p | · |B0q |= (r, p− 1)(r, q − 1) = ml,

" � � � � � � � �k h �� � �h & � C � �d

{a ∈ Zp : ar ≡ 1 (mod p)}

& � C � �d

Zp

�� ' �E %

r, p− 1) = m(v� $ $ C a h � k � E � % �& �# E � � � � % C# � �

|Bs′

n |= |Bs′

p ||Bs′

q |= ((2s′

r, p− 1)− (2s′−1r, p− 1))((2s′

r, q − 1)−− (2s′−1r, q − 1)) = (2s′

m− 2s′−1m)(2s′

l − 2s′−1l) = 22(s′−1)ml.£" $ y h �

|Bn|= ml +

i−1∑

k=0

22kml = ml

(

1 +4i − 1

3

)

=

= ml4i + 2

36 ml

2i+j + 2

3< ml

2i+j

2=

ϕ(n)

2.

s� � � � � h �� � j� E � ( �B j� � %y # �E � � j� �" � � # " �� � a h d ` � � % b j � '� " � % bh � % a �E E � j� z

' � $ � �$ �� ��" E d � m �� j � & �E � � � � � '� " b$ ' � � $ � m$ " ' �E E d � # � $ %� p �

q( ic �" k � � � ��$ $ & �E � �� �� � � � �$ " d c # � $ � % p � qh �$ " � " �# E �" � Ch � z

� � � ` � E � % b jk h � %� " b# � $ % � n = pq � m � � c �" k md h %k h ' Cc �� jE d c

� � % b j � '� " � %� `$ � $ " � d � / �(��V � � S � =� � � � � {� � � � A � � } { ��� ~ �� � � � � � � � � � p � q � �� { �� � {� � � � B � � { {� � { �� � {�~ � ��� ��� � { � �� �� � � � � �� � � �� � �� � > �

�� � } {� �� � > � �~ � � �~ � � � } { � { �� � ��� � � � � � � � { �� � � {� { � � � { � � � �� ?l �� � j� " � % b$ " ' �( u �� � a � � � � � � � % b j � '� " � % b B �a �" E � ` z

" � $ �� �� " E Cy �� $ � �E �E " C dA

� m �E �E " � A( u �$ ' � � �� $ � �E �E " � eB� dB

�E �a �" ' d # � $ % � " b '� % �# �E C eBdB − 1 = kϕ(n)� &h � k � ϕ(n) *

E � � j ' �$ " E d � � C jE � # �E �k (£ m � jE � # � # � �� j t �E � � % bE d `h � % � " � % b# � $ %� eBdB − 1" � � � ` �# " �# � $ % � (eBdB − 1)/t ' j� � E � � � �$ " �$ eA(u �� � a � # " �$ C �� $ " ' C� " h �" � � �E � � � '� E E d `� %& � � � " � & � ' d # � $ z

%�E �k (x� & ,( u � %� & � � q0 = eBdB − 1� h0 = (g0, eA)� t = h0(x� & ¤( l %k '$ �c i �" ,h �" �c � � � � � �� � hi > 1� � � %� & � �

gi = gi−1gi−1/hi−1, hi = (gi, eA), t = thi.

+ , �- � �� � � � � � � �� 1 � � � / � /1 � � � , / 1 �,

u � % C# �E E �� ' �� j C % b" � " � ' d � � %E �E � k D � & � ¤# � $ % � t � �# � ' �h E � � �

m Ch �" � $ � � d (�� &� � ' �h � " b � # " �# � $ % � t = h0h1 . . . hi � m Ch �" Ch � ' %� " ' � �k " b C$ % � z

' � y

(

eBdB − 1

t, eA

)

= 1,

� � �# � � %& � � � " ' d � � %E � " E � m � %� � 2 logn D � & � ' � " � � � � � � $ % � hi >2 �" �

i 6 log2(eBdB − 1) 6 2 log2 n.

B �$ � � % b j C� $ k " � �� � b �� $ D � ��E E d � %& � � � " g '� % �h � h %k E � c � z

a h �E �k # � $ � % a � b � j C$ % � ' �k

aeBdB − 1

t+ beA = 1.

l� %� � � � �� � a � � # " � b ≡ dA (mod n) * � $ � � �� # � $ % �( s� � � � �

t = h0h1 × . . .× hi � &h � hi | eA � � (eA, ϕ(n)) = 1 � " � (t, ϕ(n)) = 1( £" $ y h �

ϕ(n)∣

eBdB − 1

t.

s� � � � � h �� � j� E � ( �B j� � %y # �E � � $ h � %� � � �� �h E � j� �# � E � � � �" E �$ k �� �$ k � h � E E � C

$ % C# � y ( u ��h � � % �a � �# " � d � � �$ �" �� % � $ � � $ �� �" � � d " d c � %y # � `

'$ �c � m �E �E " � ' � E � D % � �� � C� %y # � `$ C$ % � ' � � (eA, eB) = 1( s �&h �

h %k # � $ � % x, y" � � �c � # " � xeA + yeB = 1 � m Ch �" '� �E � � � �$ " �� $ � �" z

E �D �E � � � � � j ' � %k y �� � �$ C ��$ " ' � " b m�$ � %y # � ' �� # " �E � � $ � � m ��E �k t �j� D � � � � '� E E �& �E � �" � c � %y # � c ( A � �E E � � �$ % � s1 ≡ teA (mod n)�

s2 ≡ teB (mod n)� " � sx1sy

2 ≡ t (mod n)(

� = � q � � TUV * �� S * p�RV � Z T� U

p

q

u �$ � � % b� C C$ �� D E �� �� D �E � � j� h � # � �� � " � � � j� �� � # � $ %� n � � j z

' � %k � " � � %E �$ " by h � D � � � � '� " b$ c � C � / � � � � � �h � % � " b$ �� �� " E d `

� %y # � " � ' d m � � � � �$ " d c # � $ � % p � q ' � E �& � � � � �h � %k �" $ " � `� �$ " b

D � � � � '� E � k (u� � �# � $ % � E �� �" � � d � " �� m � '� E �k E � ' d m � � p � q � E � ' d � � %E �E � �

� �" � � d c �a �" � � � ' �h � " b� $ E � a �E � y $ " � `� �$ " � D � � � � '� E �k (B � z �� � ' d c � # � $ %� E � h � % a E d $ �h � � a � " b$ k ' $ � � $ � � c � j '� $ " E d c

m � % b D �c � � �$ " d c # � $ � %( u � �" � C �E � E � h � % a E d k ' %k " b$ k # � $ %� �

$ �� �� � % bE �& � ' �h � %E � � � � � � � # � $ %� �  � �$ �E E � � % � n � � � & � E �

h � % a E d � �" b j� � �E � � �E �$ " � `(

Page 47: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

�� �� - 4 � � � 1 �� � �2 � �� / 4 � � / � /1 � � � , / 1

B � z '" � � d c � �E � E � h � % a E d md " b m % � j� � � � " � � � � � �E � # � �a E �

' �$ � � % b j � '� " b$ k � " �h � �� � " � � � j� �� � n � � � � �� D � " b C �� 'E �E � �

(

p + q

2

)2

− n =

(

p− q

2

)2

.

B z" ��" b �c � �& � � E Cy � � % b � & �� y " �� j % �a �E �k E � � � �$ " d � E �a � z

" � % � # � $ � % p−1 � q−1( �� � " � �# " � '$ � % C � j � � � � � j �

Zn∼=Zp +Zqh %k � � �k h � � ' � %� �E " � ' a = a1 + a2

�" �& �� � % b �� ' d � � %E k �" $ k $ � �" z

E �D �E � �

ordn(a) =

¢ £ r

(ordp(a1), ordq(a2)).

u � �" � Ch %k E � c �a h �E �k �� $ � �E �E " d dh �$ " � " �# E � �� D � " b$ �� ' z

E �E � �

ed≡ 1 (mod (p− 1, q − 1))

' �$ " �$ �� 'E �E �k

ed≡ 1 (mod ϕ(n)).

s� � � � � # � $ %� p− 1 � q − 1 � m� # �" E d � " � '$ � &h �

¢ £ r

(p− 1, q − 1)∣

ϕ(n)

2.

_ %�h � '� " � % bE � � ' $ c � � � / � '$ � &h � �$ " b �� ' � '� %�E " E d � � � �� $ z

D � � � � '� E � y �� $ � �E �E " d � E � � � � � � � d � d +

¢ £ r

(p − 1, q − 1)(u � � �" � �� ' � '� %�E " E d c � � D �E � ` m Ch �" " � m � % b D � � # � m � % b z

D �¢ £ l

(p− 1, q − 1)(B % C# D � $ % C# � � (p−1, q−1)=2 � p=2t+1 � q=2s+1� &h � s� t *E �# � " z

E d � # � $ %� $ C$ % � ' � � (s, t) = 1(�" � md � $ � %y # � " b ' � j �a E �$ " b � � � �E �E �k (p−1) z � (p+1) z �" � z

h � ' �� � " � � � j� �� � E � # � $ %� p � qE � � %� h d '� �" �& �� E �# �E � � � $ �$ " �k �� �

'" � � # " � m!d # � $ %� p− 1 � p + 1� q − 1 � q + 1E � �� j %� & � % � $ b ' � � � � j ' � z

h �E � � � %�E b� �c � � �$ " d c $ � E �a � " � %� ` � $ �h � � a � % � m!d '� � # �$ " '�

$ � E �a � " � %k c �" k md �h E � m � % b D �� � � �$ " �� # � $ % �( ¢ � � m � %� � $ � % bE ��

" � � m � '� E � � � $ � � � C % � � � '� E E �� v � '� $ " � ' , 4 5 e &( � j� � %y # � �" $ k '" � �# " � md # � $ %�

p1 =p− 1

2, p2 =

p + 1

2, q1 =

q − 1

2, q2 =

q + 1

2m!d % � � � �$ " d � � � � �# � # � $ %� p1−1 � q1−1" � � a � E � h � % a E d �� j %� z

& � " b$ k ' � � � � j '�h �E � � � %�E b� � c � � �$ " d c # � $ � % � � h � % a E d $ �h � � a � " b

'� � # �$ " '� �h E �& � � jh � % � " � %� ` m � % b D �� � � �$ " �� # � $ % �(

+ , �- � �� � � � � � � �� 1 � � � / � /1 � � � , / 1 ��

P \� � (� U �� � � �� {� � { � � � � � { p� �� > �� �� � � � � �� � { } � {� � > �� �� � ��> } { �� � � � � � ~ � � { � � � +

p≡ 1 (mod r),

p≡ s− 1 (mod s),

r ≡ 1 (mod t),� �� p � r � s� t ���{ �� � � � } � {� � > � � � � � � ?�# � " d '� k �# " �# � $ %� p � q � r � th � % a E d md " bE �# � " E d � � � � % C# � �

� � � E �� �" � � d c j � k � l ' d � � %E �E d �� '�E $ " '� +

p = 2jr + 1,

p = 2ks− 1,

r = 2lt + 1.

lRa ( � � �h �E � ��h % �a � % ' , 4 e� &( � %& � � � " & �E � �� �� � " � � �c # � $ � %(

x� & ,( _" � � � � � �$ " d � $ % C# � `E d � # � $ %� s � t( l %k � �$ " � ��E �k

� � a h �& � � jE � c � $ � � % b j C� $ %�h Cy �� ` � " �h ( n � � $ � � C z

� $ % C# � `E �� # � $ % � x� � � y �� � E C a E �� # � $ % � jE � � � ' �� $ � � � � by � � � mE d c h � %�E � ` �$ " � ' %k � ' �E " � � '� %�

[x, x + log x]" � % b� � " � # � $ %� � � �" � � d � E � � � y " � %�E b z

� �c h � % � " � %� `( u � � '� �k � �$ " � ' D � � $ k # � $ %� E � � � �$ " �" C

�h E � � j" �$ " � ' � � �$ " �" d (

x� & ¤( _" � � � � � �$ " �� # � $ % � r ' �h � 2lt+1 �� �� m � � � # � $ � % l ' �E z

" � � '� %� [1, log t]� � $ � � % b j Ck � E � % �& �# E � D � & C , � � �$ � � '� E � �

$ � � � � by � � � mE d c h � %�E � `E � � %�E b� � � � � �$ " d � # � $ %�

� � � � �E k k j� " � � �$ " � ' D � $ k # � $ %� " �$ " d � � �$ " �" d (

x� & f ( B d # � $ %k � # � $ % � u(r, s)=(sr−1−rs−1) mod rs � � � %� & � �

p0 =

{

u(r, s), u(r, s) = 2g + 1,

u(r, s) + rs, u(r, s) = 2g, g ∈ Z.

u� �� m � � � # � $ � % k �$ C ��$ " ' %k � � � � ' � �� C # � $ � % ' �h �

p0 + 2krsh � " �c � � � � � �� � E � $ �� m �" � � " �h � E � j " � $ " � '

� � �$ " �" d (

B �$ E � '� h � E E �& � � %& � � � " � %� a � " $ %�h Cy �� k

��V � � S % � � �h �E &( =� � � r � s �� � � �� � > � } � {� � > � � � � � � � � { � � � � { p~ � { � � � � � { �� �� ~ � � { � �� �

p≡ 1 (mod r),

p≡ s− 1 (mod s)

Page 48: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� � �� - 4 � � � 1 �� � �2 � �� / 4 � � / � /1 � � � , / 1

�� { � � � { �� � { �� { �� �~ � � � �� {� �� {� { � � � � � � � �

p= p0 +2krs� � ��

p0 =

{

u(r, s), u(r, s) = 2g + 1,

u(r, s) + rs, u(r, s) = 2g, g ∈ Z,

u(r, s) = (sr−1 + rs−1) mod rs.

l �� � j� " � % b$ " ' �( B$ � % C � % � `" � � �� d n � � � � � �

sr−1 ≡ 1 (mod r),

rs−1 ≡ 1 (mod s).£" $ y h � � C# � " d '� k � # " � sr−1 ≡ 0 (mod s)� rs−1 ≡ 0 (mod r) � � � % C# � �

{

u(r, s)≡ 1 (mod r),

u(r, s)≡−1 (mod s).

u � �" � C# � $ %� ' �h � p = p0 + 2krsk ' %k y " $ k � $ � � d �)(u �� � a � � # " �h � C& �c # � $ � % � Ch � ' %�" ' � �k y ��c h � E E � C C$ % � ' � y

E � " ( g$ % � p′ *" � � �� # � $ % � � " � p− p′ ≡ 0 (mod r) � p− p′ ≡ 0 (mod s)(£" $ y h � p≡ p′ (mod rs)( �E � # � " p′≡ u(r, s) (mod rs) � � # � $ % � p′ � � �"

' �h p0 + 2k′rs( s� � �� � h �� � j� E � ( �g �� �h E � ` ' � j �a E � `$ %� m �$ " by ' d m � �� # � $ � % p � q '$ � $ " � � � / �

�a �" m!d " bE � % �# � � m � % b D �& �# � $ %� � %� �E " � ' ω∈Z∗n

� � � �h $ " � ' %k y z

� �c �" � � d " d � $ � � m ��E �k � � � y � �c � %d ` � � �k h �� ordn(ω)( B �" �

$ % C# � � h %k E � c �a h �E �k E � � j ' �$ " E �& �$ � � m ��E �k ω �a E � � j �E � " b

� " �h � " � �� �� � � � � ��$ $ � j� D � � � � '� E �k

s = ωe, (ωe)e = ωe2

, (ωe2

)e = ωe3

, . . . , ωe4

, . . .

h �" �c � � � � � �� � E � ' d � � %E � " $ k C$ % � ' � �

eu ≡ 1 (mod ordn(ω)),

� � $ %�h � '� " � % bE � �

(

seu)−1= ωeu

= ω (mod n).  �E � � % bE �� # � $ % � D � & � ' h � � � % C# �E � k ω �� 'E � ordordn(ω)(e)(�E � # � " h %k m� j � �� $ E �$ " � D � � � � '� E �k E � � mc �h � � � �" � � m � '� " b �# " � md

h %k � �# " � '$ �c x ∈ Z∗n

� e ∈ Z∗ϕ(n)

'� % �# �E � ordordn(ω)(e)

md %� h �$ " � z

" �# E � m � % b D � `(

+ , �- � �� � � � � � � �� 1 � � � / � /1 � � � , / 1 � �

u � � ' �h � h �$ " � " �# E �� C$ % � ' � � � h �� � j� E E �� ' , 4 42 &(  � C � � � � & � z

�� E " � � Cy �� � $ " � `� �$ " b$ � $ " � d � / � �" E �$ � " � % bE � �" �h � ' � � $ � � % b z

j Cy ��c � " � �� �� y � � � �� $ $ � j� D � � � � '� E � k (��� S � �~ � � � h=pq � p−1=2RpFp � q−1=2RqFq � � ��� � � {� � � �� � { �� �� � { � �� � � � � � � � Fp

� Fq

� � � �� � � �Fp =

r∏

i=1

p′iαi , Fq =

s∏

i=1

q′iβi .

�{� �� � { �� f {� � �> � > � � { { � ��� � �x ∈ Z

∗n

� � �� � {� { �> � ordn(x) >

>

¢ £ r

(Fp, Fq) �~ � { � � �� � { �� � � � � � � � �� � � �~

f >ϕ(Fp)

Fp· ϕ(Fq)

Fq> 1−

r∑

i=1

1

pi−

s∑

i=1

1

qi.

l �� � j� " � % b$ " ' �( B �$ � � % b j C� $ k � ��E � � ` �h �� � j� E E � ` ' %� z

� f � j , ¤( � +∣

∣{x ∈ Z∗p : Fp |ordp(x)}

∣ > (p− 1)ϕ(Fp)

Fp,

∣{x ∈ Z∗q : Fq |ordq(x)}

∣ > (q − 1)ϕ(Fq)

Fq.

s� � � � � � j C$ % � ' � `

Fp | ordn(x) � Fq | ordn(x)E � � �$ ��h $ " ' �E E �$ %�h C� " �# " �¢ £ r

(Fp, Fq) |ordn(x) � � � % C# � �

∣{x ∈ Z∗n : [Fp, Fq ] |ordn(x)}

∣ > (p− 1)(q − 1)ϕ(Fp)

Fp

ϕ(Fq)

Fq,

# " � � h �� � j d '� � " %� C(��V � � S � �~ � � � n = pq �� ~ � � { � �� � � � �> ? �~ � � � � �� � �

p′i − 1 = 2a′ib

′i, i = 1, . . . , r,

q′j − 1 = 2a′′j b′′j , j = 1, . . . , s,

� ��� � � {� � � �� � { � � �� � { � �� � � � � � � � b′i

� b′′j

� � � �� � � �

b′i =

2i∏

j=1

pαij

ij , i = 1, . . . , r, b′′i =

2i∏

j=1

qβij

ij , j = 1, . . . , s.

Page 49: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� � �� - 4 � � � 1 �� � �2 � �� / 4 � � / � /1 � � � , / 1

�{� �� � �� �� � {� { t� �� � � �� { } � {� � {� { � (p− 1)(q − 1) �~ � { � � �� � { �� �� �� � {~ � � { � � � � +

tp′

−1

pij 6≡ 1 (mod p′i), i = 1, . . . , r, j = 1, . . . , ri,

tq′−1

qij 6≡ 1 (mod q′i), i = 1, . . . , s, j = 1, . . . , si,� { �� � { { � ��� � �

x ∈ Z∗n

� � �� � {� { �> � ordordn(x)(t)

� � � � � � � � � � � ��~ ¢ £ l

(b′1, . . . , b′r, b

′′1 , . . . , b′′s ) � � � } � � �> �� � � r

i=1

1p′

i+

s∑

i=1

1q′

i

?

l �� � j� " � % b$ " ' �( AE � % �& � # E �" � � �� � u �� % �E &" �E � �a E �

� �� � j� " b � # " � b′i |ordp′

i(t)� h %k i = 1, . . . , r( _ %�h � '� " � % bE � b′i |ordp

′αii

(t)�

� " � � a � b′i |ordFp(t) � � � i = 1, . . . , r( s� � � � m �� j � �

¢ £ r

(b′1, . . . , b′r) |ordFp(t),

AE � % �& �# E � � � % C# � � ¢ £ r

(b′′1 , . . . , b′′s ) |ordFq (t),£" $ y h �

¢ £ r

(b′1, . . . , b′r, b

′′1 , . . . , b′′s ) |ord � ��

(Fq ,Fp)(t).

_ �& %� $ E � %� � � h � %k x ∈ Z∗n

� h %k � �" � � d c ' d � � %E k �" $ k C$ % � z

' � �¢ £ r

(Fp, Fq) |ordn(x) � $ �$ " � ' %k �" E � �E � �

1−r

i=1

1

p′i+

s∑

i=1

1

q′i.

u �$ � � % b� Ch %k " � � �c x ∈ Z∗n

h � % a E � md " b

ord � ��

(Fp,Fq)(t) |ordordn(x)(t),

� � % C# � � " � � m C� ��( s� � �� � h �� � j� E � ( �l� E E � k " � � � � � � �� � j d '� �" �# " � C$ % � ' � � v � '� $ " � �" � �# " � md h %k

m � % b D �& � � � �$ " �& �h � % � " � %k p1

%

q1

&# � $ %� p

%

q

&# � $ % � p1 − 1

%

q1 − 1

&

" � � a � � � % � m � % b D � ` � � �$ " � `h � % � " � % bE � k ' %k �" $ k E � � mc �h � d

h %k j� �� " d �" �" �h � $ � $ � � % b j � '� E � � � " � �� �� � � � � ��$ $ � j� D � � z

� � '� E �k (

+ , �- � �� � � � � � � �� 1 � � � / � /1 � � � , / 1 � 7

l %k & �E � �� �� � � � �$ " d c # � $ � % p � q � h � y ��c h �$ " � " �# E Cy $ " � ` z

� �$ " b �" E �$ � " � % bE � �" �& � � " �h � � �a E � � $ � � % b j � '� " b �" �h  � C z

�� �� � �$ " � ��E �k � � �$ " d c # � $ � %( £E E �$ � " ��� C �$ � 'E d `c � �� � " � � �

h %k & �E � �� � � � p � q � $ � � % b j Cy " $ k $ & �E � � � � � '� E E d � E � �� � ' � C � � 'E �

��� C �$ � � �� E � � # � $ %� p′i

� q′i � � �" � � d � ' $ ' �y �# � � �h b $ " � �k " $ k � �

$ & �E � � � � � '� E E d �� E � � E � '" � � � C � � 'E � ��� C �$ � � # � $ %� p′′ij

� q′′ij(_ �& %� $ E �" � � �� � h %k � m� $ ��# �E � k ' d $ �� � `$ " � `� �$ " � �" E �$ � " � % bE �

� " �h � � " � � � � � '� E � k � � � ��$ $ � j� D � � � � '� E �k h �$ " � " �# E � ' jk " b � � z

�� �E � ' j� � E � � � �$ " d � # � $ %� p′′ij� q′′ij � � '� � # � $ " ' � �� $ � �E �E " d D � � z

� � '� E �k e = t ' jk " b" �# � $ % � x � � �" � � �� � $ � � % b j � '� % �$ bh %k h �� � j� z

" � % b$ " '� � � �$ " �" d # � $ � %$ � � � � by " � � �� d u �� % �E &" �E � pij

� qijE � '" � � � C � � 'E � ��� C �$ � � (u � �" � C C$ % � ' �k " � � �� d E �$ % �a E � � m� $ ��# � '� y " $ k E � m � % b D � `

�h � � � � � �� � ` � � � ��h C � d & �E � �� �� � � � �$ " d c # � $ � % � E � " �� m Cy "

m � % b D �c j� " �� " E � & � �� E " � � � '� E � � �c ' d � � %E �E �k (

� = � 8 � � p� V � \S� S � X� V *

e

d

v� $ $ �" � � " � �� � b ' � � � �$ � ' d m � �� �� $ � �E �E " D � � � � '� E �k � �� $ z

D � � � � '� E � k ( s� � � � � jE � # �E �k e � d � � ��h � %k y " ' � � k j� D � � � � z

'� E �k � �� $ D � � � � '� E �k � " � �a E �E � j '� " b �k h $ � " C� �� ` � '� �" � � d c

a � %� " � % bE � � � " b � % �� jE � # �E � � e � d( ¢ � � � � � � � � � � � $ � � % b j � '� E � �

$ � $ " � d � / � � � � j� �� " � � %�� " � �E E d c � %� " � a � `$ � � � �E �E � � � �� z

h � " E d c � � �" �# �� �$ " �$ " '�E E d k ' %k � " $ k " �� m � '� E � � � $ � � % b j � '� E �k

E � m � % b D �c jE � # �E � ` �� $ � �E �E " d d C ' %� h � % b �� � � �" �# � � � m � % b D �& �

jE � # �E �k �� $ � �E �E " d e C ��E " �� % bE �& �� � � by " � �� (£h E � � � � ' d m � � � % d c �� �� � " � � ' e � % � d � ��h $ " � ' %k �" $ k E � m� j z

� �� $ E d � � �k h C$ � � m �� a �E � `( g$ % � � %d k ' %k �" $ k $ �� ��" E d ` �� z

�� �" � d � " � �a E � � � � �E � " b � " �h �� � � m � �� � %d c jE � # �E � `h �

� � % C# �E �k � $ � � �& �# � $ %� d(g$ % � � %d k ' %k �" $ k �� �� �" � e� " �h �$ " � " �# E � m � % b D �� # � $ % �

�" � � d " d c $ � � m ��E � ` � Ch � ' %�" ' � �k y � �c E � �� ' �E $ " ' C t< e√

n

m Ch C" j� z

D � � � � ' d '� " b$ k � � �$ " d ' � j '�h �E � � '$ " � ��E b te = s '� � % b ��

Z � �

� � �" � C �c �a E �E � `" � � C" � � j ' %�# �E �k � � �E k $ " � ��E � e(l � C& � k � E � % �& �# E � k $ � " C� �� k �a � " $ % �a � " b$ k � � �&h � CE � $ � � % b z

� � c � m �E �E " � ' � $ � � % b j C�" $ k �h �E � � � '� k �� $ � �E �E " � e( u ��h � � % �a � �# " � k� m �E �E " � ' � � $ � � % b j Cy ��c �h �E � � � ' Cy �� $ � �E �E " C e6k � �" � �� ' z

%k y " $ � � m ��E �k s1≡te1 (mod n1), . . . , sk≡tek (mod nk)� �a E �$ # � " � " b �# " � � �� � " �# �$ � � '$ � &h � ' d � � %E k � " $ k C$ % � ' � � (ni, nj)=1

% ' � � �" � 'E �

$ % C# � � $ " � E �" � j ' �$ " E � ` �� � " � � � j� ��k # � $ � % ni, nj)( u �� � " � `$ � � `

Page 50: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� � �� - 4 � � � 1 �� � �2 � �� / 4 � � / � /1 � � � , / 1

" � � �� � � m �$ " � " � � c $ C �� $ " ' Cy " # � $ %� t � s" � � � � # " � t≡ ti (mod ni) �

s≡ si (mod ni)� i = 1, . . . , k( s� � � � � # � $ %� s1, . . . , sk

� j '� $ " E d � " �# � $ z

% � 0 6 s < n1 · . . . · nk

�a E � ' d # � $ % � " b( u � �" � C ' $ % C# � � � � �&h �

E � m � � t1, . . . , tk " � � � ' � � ' d � � %E �E �E � �� '�E $ " ' � te < n1 · . . . · nk � " �

# � $ % � t �a E � � � % C# � " b � C" � � j ' %�# �E �k � � �E k $ " � ��E � e� � � �E � C

' �$ $ " � E � ' � " b � $ c �h E d � " �� $ " d t1, . . . , tk( l� E E � k $ � " C� ��k E � � m � %� �

�# � ' �h E � ' $ % C# � � � � �&h � '$ � � m �E �E " � �" � �� ' %�E � �h E � � " � a �

�� �� C %k �E �� $ � � m ��E � � t � t< e√

n1 · . . . · nk( Bh � E E � $ % C# � � $ �� j C � � z

% C# � � C �� 'E �E � � te=s '� � % b �� �� %d c # � $ � % � � �" � � �� � � D � �" $ k � C" �

� j ' %�# �E �k � � �E k $ " � ��E � e(

� �� � LM � J� N N

u � � E � � � $ � E � � �� jh � %� , � $ � � % b j � '� % � $ b� E � & � � ¤ � � � 4 � � �f � � � � , �( � %� � � �h � � mE Cy �E � � � � � � y � � � ��E � � $ % �a E �$ " � � � � �! � " �# � $ � �c

� �� �� �� ` � � %& � � � " � ' g '� % �h � � h � $ � ��" E � C � �� � m �� j � '� E � y n C � b�

� h �( � %& � � � " � �a E � � � �# � " � " b � E � � � � � � � ' � E � & � c � 4 � � � ,f � �$ �h � � a � ��c " � � a � m � % b D �� # � $ % � C � �� a E �E � ` � j� h � # � � % � ' � , � �(v� jh � % ¤E � � � $ � E E � �$ E � '� � E � & � , ¥ � � � ,� �( i$ " � � �# � $ � � � $ '�h �E �k

' jk " d � j� E � & �f � � � , e �(v� jh � % f �$ E � '� E E � � E � & � c � , ¥ � � �f � �(  E �& �h � � � %E � " � % bE d c $ ' �h � z

E � ` �a E � � � % C# � " b ' � 4 �( _ ' � `$ " '� # � $ � % r� � � `� %� � � C m % � � � '� E d

' �f � �( s�$ " _ � % � '�k * x" �� $ $ �E � * '$ " � " b� �2 f � $ h � � � %E �E � � �2 � �(s�$ "   � % %� �� * v� m � E � � � C m % � � � '� E $ E � # � %� ' h � " � � � E � � � '� E E �

'� � � � E " � ' �� , � � � j� " � ' ' � � �k " E �$ " E � ' �� m �" � �� 4 �( s�$ " d � � �$ " �" d

h %k � %�E b� � c � � �$ " d c # � $ � % � � � ' �h �E d � �� C �$ C %�� � � ` r( r� % z

h ' � %� % ( �( 9 � �� � � �( � � � �9 � � �� � � � � � � �( � �� � � � �� �� � � �� � �� � �� � � , 4 42 & �h �$ " C �E � ' iE " � �E �" ( B , 4 e¥ &( �( wh %� � E � ��h % �a � %h �" � � �E � z

� � '� E E d ` �" �h � � � ' � �� � E � � � �$ " �" C� �$ E � '� E E d `E � " � � � � � �� %d c

� %& � m �� �# �$ � �c # � $ � %( gR& � �h � � � � � � � � � � � $ � E d ' �� m �" � �( ��E z

$ " � d � , ¤ �( s� � � � � ¢ ( lR� � � " � � �f ¥ � %� a � " ' �$ E � '� � % & � � � " � � � z

$ " � ��E �k � %y # � ` �� � ' �& � � �$ $ � `$ � �& �$ " � E h � �" � �� � � � ' � ` � �h � � $ �)( � " �h d � �$ " � ��E �k � � �$ " d c # � $ � % � �h � � mE � � � � $ � E d ' �f 4 � � �� ¥ �(  � z

" �h d � '� h �� " �# E �& � �� D �" � � ��h % �a �E ' �� 5 � � �h � � � �� � � '� E ' �2 ¤ �(u � � '�h �E E � k �E � � � � � �k � m � $ " � � � � �" � � d " �k � � � � $ � � �� � ' d c � � � z

$ " d c # � $ � %   � �$ �E E � � h �$ " C �E � '$ �" � iE " � �E �" ( �� �� � � � � C �$ �

%�� �� ` �$ " � %$ k � " �h � % % � �" �# � $ � � c � � � ' d c h %k �� � " � � � j� � � � # � z

$ � % � � �h � � mE � � � � $ � E E d ` ' � , ¥ �( B �" % �# � � �" �" �h � ' u � % %� �h � �

u � % %� �h � * x" �� $ $ �E � � � �" � � d � � � � �E " � � � '� E d E � � � � $ � � %�E b� � c

� � �$ " d c h � % � " � %� `# � $ � % � �" �h � % % � �" � # �$ � �c � � � ' d c � � j ' � %k � " E � z

c �h � " bh �$ " � " �# E � m � % b D � � h � % � " � % �)( BE � $ " �k �� � ' �� k �h E � � � j

E � � m � %� � h � `$ " ' �E E d c �" �h � ' �� � " � � � j� �� � k ' %k y " $ k � " �h d E �

�$ E � '� �� D �" � # � $ % � ' �& � � � %k %$ ( �f e � &( _ � $ " � � � � ` �� j ' � " �k " � � z

�� " � � � z# � $ % � ' d c � %& � � � " � ' �a E � � jE � � � � " b$ k � E � � � � � � � � � � m z

j � � C �f 5 �(v� jh � % � � � � �� �" $ k E � � E � & C � , 5 � � � " � � a � $ " � " b � �f f � � �f 4 �( l � � � % z

E � " � % bE Cy �E � � � � �� y � � � � � % �a �E �k $ � $ " � d � / � �a E � � � % C z

# � " b � E � � � � � � � '� E � & � c �2 2 � � � ¤ , � � % � � ,2 �(

Page 51: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

� N� L� J� �� J

� , � �� � � � � � � ? £$ E � ' d � � � by " � �E � ` � %& � m � d $ � � � % �a �E �k z

�)( *  ( +   � � � , 4 4�(

� ¤ � �� { � ? � � {} � � { �� z � ? � ��� �� � z � ? u �$ " � ��E � � � � E � % � j ' d z

# � $ % � " � % bE d c � %& � � � " � '( *  ( +   � � � , 4 5 4(

�f � �~ � �� � � � ? � ? s� � � �k # � $ � %( * ¤ z� � jh ( *  ( + u � �$ '� ��E � � � , 4� � (

�� � �� � � � �� � { � ? � ? _ � ' �� �E E d � $ � �$ � md � � � ' � �� � � � �$ " �" d # � z

$ � % � � r � m� �E ( $ m � �E � � ( * , 4 e e( * s( ¤2 ( * _( ,� ¤ * , e e(

�2 � � � � {� � � � { � � ? � ? £$ E � ' d " � � � � � # � $ � %( * 4 z � � jh ( � �� �� �� m( *  ( +¢ � C� � � , 4 e ,(

�� � �� � { �� � � � ? � ? � ��� � � � � � � { � ? � ? � �� � � { ��� � � � ? � ? B ' �h �E � � '

" � � � � y # � $ � % *  ( + i jh z ' �   � �� , 4 42 (

� 5 � �� �� { � � ? � ? � �~ �� � �� { � � ? � ? A � � �! �" � � � � � %& � � � " d � $ % �a z

E �$ " b ' d # � $ %�E � `( �# � mE �� � �$ � m � �( *  ( + B x � ¤¥ ¥ ¥ (

� e � z � � �� } { �� z � ? � �� � � � ? � �~ �� � � � ? r � � b y " � �E � k � %& � m z

�� ( *  ( +   � � � , 4 4 ,(

� 4 � �� ~ � z ? i$ � C$ $ " ' � � � �& �� � � � '� E �k ( s( ¤( u � % C# � $ %�E E d � � % z

& � � � " d ( *f z� � jh ( *  ( + B � % bk $ � ¤¥ ¥ ¥ (

� , ¥ � � { ��� �� � ? r C �$ " � � � � � # � $ � % � � � � �" �& �� � � �)( *  ( +¢ � C# E ��

� jh � " � % b$ " ' � s B u � ¤¥ ¥ ,(

� , , � � { � �� � � ? � �� �� � �� {� � ? � �� � �� � � ? A %& � � � " d + � �$ " � ��E � � �

� E � % � j( *  ( +  ¡¢   £ � , 4 4 4(

� , ¤ � ��� � � �� � ? � ? A % & � � � " d � � � '� �� � E � � � �$ " �" C � � A %& � m �� �

" � � � � k # � $ � % %$ � � � % �a �E �k � & + _ m( $ " � " � `( *  ( +   � � � , 4 e 5( *B d �( � f ( * _( � 5 *� � (

� ,f � �|{ ��� � ? � �� � � � � ? A % & � m �� � # �$ � � k � %& � � � " � � � ( *  ( +   � � �, 4 4 4(

� , � � � {� � { �� � � � ? A %& � m �� �# �$ � � � �$ E � ' d � � � �" �& �� � � � ( * _ u m( +  � � � $ � bk * iE " � � %� `E � ¤¥ ¥ ¥ (

� ,2 � � {� � { �� � � � ? � �� � { � �� � { = ? B '�h �E � � '� � � �" �& �� � � y $ �" � � d z

" d � %y # � ( * _ u m( +   � � � $ � bk * iE " � � %� `E � ¤¥ ¥ ,(

� ,� � �� � � � � � ? v� $ � � �h � %�E � � � � �$ " d c # � $ � %( *  ( +   � � � , 4� 5(

� , 5 � �� � { �� � � ? r � � �" �& �� � �k $ �" � � d " d � %y # � ( *  ( +   � � � , 4 4� (

�� 1 � � �1 3 � � ,� ,

� , e � �~ �� � � � � � ? � ? s� � � �k # � $ � %( w %� �E " � �E d ` � C �$ ( * �� � b� � ' +

i jh ( �� � b� � '$ � �& � CE z" � � , 42 �(

� , 4 � � � {� � � ? u � �$ " d � # � $ %� ( *  ( + � i n   � � , 42 4(

� ¤¥ � �� � � � � ? ��� �� � � �" � � � � � # � $ � %( *  ( + i � � , 42 f (

� ¤ , � B '�h �E � � ' � � � �" �& �� � � y � u �h � m �( ��h ( B( B( � ��E � �( * f z�

� jh ( � h � �( *  ( +   ¡¢   £ +� �� v �� � ¤¥ ¥ ¥ (

� ¤ ¤ � � � � � � � � ? � ? 9 - � � � � � � �� �< � � � � �� � � �� � �� � 9 � � � �� �� � � � � � � � -(¤f � � � � /� �� ( � � � �� � � � � � � �� � �( � 1( ( � � �( * , 4 4 ,( *�( � � * 5 ,(

� ¤f � � � � � � � � ? � ? � � � � � � �� � ? � � � � �� � ? � ? � �� � � � � �� � � �� � �� � � ��

�� �< � � � �� � � -� �� � �� �� �� �< � � � � � � � �( � 9 � �( % ¤ &( * , 4 ef ( *

� ( , , 5 � 1 �( ,( * �( , 5f * ¤¥ � (

� ¤ � �� � � � � ? � ? � �� � � � �

� ? � �� 0 � � � * �� � - � �9 � � � � �� � � � � � � 9 � � z

� 9 �� � � � � � -� � �� � � � � � 9 -� � �� � � � -� � � � � � � � � � �� � �� �9 � < � � � � 9 �( *, 4 4� ( * � � �( ,( * �( f 4 * , ¥ f (

� ¤2 �� � � � � ? � ? � �9 � � �� � � � � �� < � �9 � � � � -� � �� 9 � 9 � �� � � � � � � � �� �� � � � � � �

9 � � � �� ���� � �� + 1� � � � � � - � � � � � 9 � � �� -� � � � � � � � � � �� ( ( �� 9 � <

� �( * 1� � �� � � + � -9 �� �� - � � � � � � , 4 5� ( * �( f ¤ , *f 2 2 (

� ¤� �� � � � �� � � � � ? � �� � � �� � � � ? � ? � �� � ��� � � � �9 - � � � � � � 9 � � � �� �9 - � � � � � 9 z

� � � � � � � � � 9 � �( � �� ( * , 4 52 ( * � ( ¤ 4( * �( , ef * ¤¥ 2 (

� ¤ 5 � �� �� � �� ? � � � � � � � ? � � � � � � �� � ? � 9 � � � < � � � � � � � � � �� � �

-� � -� � �� � � 9 - � � � � �9 � � � 1 � �� � � � � � � �� � � � �9 � � � 1 � �< � � � �� � � � ( *, 4 ef ( * � ( , 5( * �( , * ¤ e(

� ¤ e � �� � � �� � � � � ? ? � -� �� � �� �� �� �< � � � � �� - � �9 � � � �� � �� � � �9 �

-� � � � � � � -� � � � �� � � -9 � � 9 � �� �9 � � -9 � � � � � �� � ( * , 4 , ¤( * � ( , 4( *�( ¤ ¤ * ¤ 5(

� ¤ 4 � �� � � � ? � � � � � � � � ? ! ? � �� ? � � � �9 � � � � �� �� � � � � � 9 � �� 9 -� < � � � � � � �

�� � � � � e ¤ 3 , e � � 9 � �� �9 � � -9 � . � � � � � � � � � � �� � ���� � � �� �� � � � � � �� � z

�9 �( * � � � �� � �9 � � , 4 e ¤(

�f ¥ � � � �� � � � ? � � �� � 9 � � � � �� � � �� � � -� �� � � � � �� �� � � � � � �� 9 � 9 � �� �� � � �9 z

� � �� � � � � � -( � � � �� / . . � . � �( � � �( � � � �� ( /� �( � . . � � /� - � � � �� e e �� � � �� � �9 � � , 4 * ¤ , � 9 � � , 4 e e( * �( , * e(

�f , � �� � � � ? ? � �� �� � � � � -9 � � � �9 � � �9 - � � � � � 9 � � � � � � � � �� �� � � � � � 9 � �( � �� � �( * , 4 e ,( * � ( f � ( * �( ¤2 2 * ¤� ¥ (

�f ¤ �" � �# �� � ? � �� � � � �� �� 0 � � � * �� � - � �9 � � � ; 9 � � � � -9 � � � � 9 � � �� � � � ��

�� � � �9 �( * . �� � � �( � 9 � �( * , 4 e2 ( * � ( 5 4( * �( f ef *� ¥ 5(

Page 52: Cheremushkin a.v. Lekcii Po Arifmeticheskim Algoritmam v Kriptografii (MCNMO, 2002)(Ru)(52s)

,� � �� 1 � � �1 3 � �

�f f � � � � �� � � ? / � � � � � � / � �� � � � � ���� - � � � �� - � ��� � �� � �( * , 4 e�( * � ( ¤¥ ( *�( 2 , � *2 ,� (

�f � � �� � � � � �� � ? � � � �9 � � �� 9 � � � � � � � �� 9 � �� ( * 1( z �( � �� � � � � � � , 4 e2 (

�f 2 � � � � � ? � ? � � �� �� � �� � � �� � � � � � � � -9 � � �� � - � � � � � � � � � �(� 9 � �( * , 4f ¥ ( * 0 �( f ,( * /( � , 4 *� � e( �� � � � � �� � � � + /� ��� - �� � �9 � � � �(� � �( ,( � � ( � - 9 � � �� � � �( * �( 0 9 < < 9 �� �� �( � � �� � � / �( � �� � � � �� 9 �� � � < 9 9 �9 �9 � , 4 e ,( * �( , , *� e(

�f � � � � � � ? � ? / � � � � � 9 � �� - �9 � � �� �< � � � � �� ( � � � � � 9 �( � 9 � �( / � -(/� �( �( * , 4 5� ( * � ( ¤ , � �( � � �( 2 ¥ e *2 , ¥ (

�f 5 � � � � � � � � ? � ? � � � � � � � � ? !� �� ? �� �� � � � � � � � � �� �< � � � �� � � � � �

�9 � �< � � � � � � �� � � � � � -9 � -� �� � �� � � -�� � -� ( � � �( �( �� �� � � � � � � 9 � �

-� �� � �� � �� � �( , ¤( * � � � �� � �9 � + �� �� � �� � � , 4 4¥ ( * �( � 5� * 5 ,2 (

�f e � � �� �� � � � � � �� � � � � � �� �� �< � � �� � � ��� � � � �� � � � � 9 �( �( ��� � � � � 9 �( � � � �( � � � �( * 0 � � � � � + /� � � � �� � z � � � � 9 � � , 4 4f (

�f 4 � ��� � � � � ? � ? 9 � � �� �� � 9 � � � � � �� � � �� 1 � �< � � � 9 � � /� - � � � � � < � � - z�� � � � � � � �� 9 � �� - � 9 � 9 �� �� � � � � � ( � � � � � � � �� ( * , 4 42 ( * � ( e( *�( , ¤f * ,2 2 (

�� ¥ � � � � � � � � � � ? 9 � � �� �� � 9 � � � � � � � � � � 9 < ��� � � � �� � � �� � � �� 9 � - � � �

9 � � � � �� � � - � � � � � � � �� � � � � � � �� 9 � -� � � � - � � � � � � � �� * � � � � � 4�

% � 1 / � ef 4 &( * , 4 4 �( * �( ¤ e ¤ * ¤ 4f (

�� , � � � � � � � ? � ? ��� �9 � � � � �� � � � �� �� � 9 � � �� � � � �� � � � � �9 � � �� � �� ( � � z

� � �( /� � �� � / -�( * , 4 5� ( * � ( ,f ( * �( f ¥ ¥ *f , 5(

�� ¤ � �� � � � � � �� � ? � ? � � � � � 9 � � � � � �� � � -9 � � � � �� � ��� � � �� 9 � � � ��� � �� � � � �

� 9 � �( � � � �� ( * , 4 e2 ( * � ( � � � 1 �( , 5¥ ( * �( 2 , 4 *2 ¤ ,(

�� f � � � � � � �� � � � � ? � ? � �� �� �� �� �9 � � � � � � � �� � � � �� � � -� �� � �� �� �9 � � � �

� � � 9 � �� �� �< � � � < � � � �9 � � � � �� � � � � � � � � � -( � � � �� 9 �< � � � ��

/ � -�� �� ( * , 4 , � * , 4 ,� ( * � ( , e( * �( ¤ 4 *f ¥ (

�� � � � � � � � � � � ? � �� � � � � � � � �9 - � � � � � 9 � � � � 9 � � � � � �9 � � �� �� � � � � � � � � � � -( 9 �< � � � �� � �� �( / � -( * , 4 5�( * � ( 5� ( * �( 2 ¤ , *2 ¤ e(

�� 2 � � � � � � � � � ? � � � �� z 9 � � � �� � � � � �� � �9 - � � � � � 9 � � � � � � 0 . �( * , 4 5�( *

� ( ,2 ( * �( f f , *f f �(

��� � � � � � � � � � ? � � � �� z 9 � � � �� � ��� � �� � � � ��� -� �� � � 9 � � � � % �� � � & � �

� 9 � �� �9 � � - � � � � �� � � 9 � � � �( * , 4 5 e( * � ( f ¤( * �( 4 , e * 4 ¤ �(

�� 5 � � � � � � �� � ? � �� �� 9 � � 9 � � - ��� � � �9 - � � � � � � 9 � �� � � � � � � � � �� 9 � -� �

� � - � � � � � � � �� * � � � � . � � � e � % � 1 / � ¤¥ 4 &( * , 4 e2 ( * �( ,� 4 * , ef (

�� 1 � � �1 3 � � ,� �

�� e � � � � � � �� � ? 9 � � 9 � � � � �� � � � � �9 - � � � � � 9 � � � � 9 � � �� � - � � �� � � �9 � � � � �

9 � �� � � � � � � � � � � - � � �� 9 � �� � � � � � � 9 � � -� �� ���� � �� + � � � -( � � � ��� 9 � 9 � * � /� � � � � �� �� �9 �( * � � � ��� � + � -9 �( � � � � � � , 4 e 5( * �( , , 4 * , � f (

�� 4 � � � � � � � ? � � � < 9 < � � � � � � - 9 � �� � � � � � � �� � �� � � � � �� � � �9 � � �� � �� � � � �9 � � �

1 � �< � � � �� � � � ( * , 4 e¥ ( * � ( , ¤( * �( , ¤ e * ,f e(

�2 ¥ � � �# � � � ? � ? � �� � � � � � ? � � � � � � � � ? � �� � ��� � �� � � < � 9 � �� � � �� �� � 9 �

�� � �9 � � � � � 9 � �� � < � � - z �� � - � � � � � �� � �� � � � � � � �� �( � � ( * , 4 5 e( *

� ( ¤ , � 1 �( ¤( * �( , ¤¥ * , ¤� (

�2 , � �� � � � �� � ? � �� � � � � � � ? � �9 � � �� � � � 9 � � �� z � �� �� < � �9 � � � � 9 � �� � � � � � � �

� ( /� �< � � � - � �� � �( * , 4 42 ( * �( ,� 4 * , ef (

�2 ¤ � � � �# � � � � � ? ? � �� �� � � �� � � � � � � �� �� 9 � �� 9 � � 9 � � - ��� � � � � � 9 � �( � �� � �( * , 4 e 5( * � ( � e � 1 �( , 5 5( * �( f ¤ 4 *f f 4(

�2 f � �� ��# � � � ? � �� � � � � � � ? � 9 � � � � � �� z 9 � � � �� � � �� � � � � �9 � � �� � �

/ . � � � ( � �� � �( * , 4 5 5( * � ( � % , &( * �( e � * e2 (

�2 � � �� ��# � � � ? � �� � � � � � � ? � � � 9 � � � + � 9 � � � � � �� z 9 � � � �� � � �� �

� � � �9 � � �� � � / . � � � ( � �� � �( * , 4 5 e( � ( 5 % , &( * �( , , e(

�2 2 � �� � � � � � ? � ? � � � � � � � 9 � �� ( � �� � � � 9 � � � � 9 - � � -� * � �� � � � � � �

/� � �� � � � � � � - � � �� � 9 � �( 9 � � �� � �( � , 4 42 (

�2 � � ! � � � �

� ? � � � � � � � ? �9 < ��� � � � � � �� -� � 9 � � � � � �� � � � � � � � � � � � �� � 9 �

/ � -�� �� � 9 � �� �9 � � -9 � �9 < ��� �( * , 4� e( * � ( 4(

�2 5 � ! � � � � � � � � ? � ? � �� �� � -9 � � � � � � � �� � / �� � < � � - z �� � - � � � � � �� � �� � � �

. � � � �� 9 � �( . � �� � �( � �� � � � ( * , 4 e¥ ( * � ( ¤� � 1 �( � ( * �( 5 ¤� * 5 ¤ 4(

�2 e � ! � � � � � � � � ? � ? � �� �� � � -9 � � �� � � � � �9 � � � � � � � � � �� � � � � � � � � � �� � � � � � �

� � � �� -� � � � �� � � �� 9 - � � � ��� � 9 � �� � � � �√D

& � � � 9 � �( � �� ( * , 4 e ,( *

� ( f � ( * �( 2 4f *� ¥ ,(

�2 4 � ! � � � � � � ? / � � � � � � �� 9 � �� � � �� 9 � � �� 9 � � � � � � � � � � �� �� �� � � � �

. � � � �� 9 � �( . � �� � �( � �� � � � ( * , 4 e� ( * � ( f ¤ � 1 �( ,( * �( 2 � *� ¤(