T-79 5501 Slides 3

Cryptology T-79.
5501
Kaisa Nyberg
Department of Information and Computer Science Aalto University School of Science Spring 2013
Lecture 3:
Structure of Finite Field
Galois Fields
T-79.5501 Cryptology Spring 2013 2/19
Lecture 3: Structure of Finite Fields February 2, 2012
Structure of Finite Fields Galois Fields
Finite Fields
Complementary material to Section 5.2.3 of the text-book. The notation and numbering is the same as in the textbook New theorems and facts are marked by an asterisk ( ). Let G be a nite group. The order of an element g G to be the smallest positive integer m such that g m = 1. Similarily, in an additive group G, the order of the element g G is the smallest positive integer m such that mg = 0, where 0 is the neutral element of addition. An example of a nite additive group is a group formed by the points on an elliptic curve to be discussed later. We will use multiplicative notation.
Lagrange Theorem
Theorem 5.4. Suppose (G, ) is a multiplicative group of order n, and g G. Then the order of g divides n. Proof. Denote by r the order of g , and consider the subset H of G formed by the r distinct powers of g : H = {1, g , g 2 , . . . , g r 1 }. H is a subgroup of G. Dene a relation in G by setting f f f fH = {f , fg , . . . , fg r 1 }. This relation is an equivalence relation, and therefore, divides the elements of G into disjoint equivalence classes which can be given as follows fH , f G. Clearly, |fH | = r , for all f G. Consequently, r divides the number |G| of all elements in G.
Corollary
Corollary 5.5. If b Zn then b(n) 1( mod n). Proof. Eulers -function is dened as (n) = |{x Z | 0 < x < n, gcd(x , n) = 1}|, for a positive integer n. Thus |Zn | = (n). Let b Zn . Let us denote by r the order of b. By Theorem 5.4 r divides (n). Since br 1( mod n), the claim follows.
More Corollaries
Corollary . (Eulers theorem.) Let F be a nite eld, which has q elements, and let b F . Then the order of b divides q 1 and bq 1 = 1. Proof. (F , ) is a multiplicative group with q 1 elements.
Corollary 5.6 (Fermat) Suppose p is prime and b Zp . Then bp b( mod p). Proof. Zp is a nite eld with p elements. For b = 0, the congruence holds. If b = 0, then b Zp , and the claim follows from Eulers theorem.
Order of Group Element

Proposition 1 Suppose G is a nite group, and g G. Then the order r of b divides every integer m such that g m = 1. Proof. By denition, the order of g is the least positive integer with this property, ence r m. When dividing m by r , let s be the quotient and t the remainder, that is, we have m = r s + t , where 0 t < r . Then 1 = g m = g rs+t = (g r )s g t = g t , since g r = 1. Since t is strictly less than r , this is possible only if t = 0, or what is the same, that r divides m.
Order of Group Element

Proposition 2 Suppose G is a nite group and b G has order equal to r . Let k be a positive integer, and consider an element a = bk G. Then the order of a = bk is equal to r . gcd(k , r ) Proof. Since (bk ) gcd(k ,r ) = (br ) gcd(k ,r ) = 1, it follows from Proposition 1 that the order of a = bk divides the r integer gcd( k ,r ) . To prove the converse, denote the order of a by t . Then 1 = (bk )t = bk t hence r divides k t . Then it must be that which is the order of a = bk .
r gcd(k ,r )
r k
divides t ,
A Property of Eulers -function

For positive integers k , n, we denote k |n if k divides n. Proposition 3 For any positive integer n, ( k ) = n ,
k |n
where is the Euler phi-function. Proof. Let integer d be such that d |n, and denote Ad = {r | 1 r n, gcd(r , n) = d }, or what is the same, Ad = {r | r = d , 1
n ). Hence it follows that |Ad | = ( d
n n , gcd( , ) = 1}. d d
Proof Continued
On the other hand, we have that Ad Ad = , if d = d . Also, Ad = {r | 1 r n}.

d |n
It follows that n=
d |n
|Ad | =
d |n
n ( ) = d
n d |n
n ( ) = d
(k ).
k |n
Number of Elements of Certain Order

Proposition 4 Suppose that F is a nite eld of q elements. Let d be a divisor of q 1. Then there are (d ) elements in F with order equal to d . Proof. Let a F such that the order of a is equal to d . Then d |(q 1). Denote Bd = {x F | order of x = d }. Then by Proposition 2, we have {ak | gcd(k , d ) = 1} Bd . On the other hand, {1, a, a2 , . . . , ad 1 } {x F | x d = 1 }. Since the set on the left hand side has exactly d elements, and the set on the right hand side has at most d elements, it follows that these sets must be equal. Hence we have Bd {x F | x d = 1 } = {1, a, a2 , . . . , ad 1 }. It follows that Bd = {ak | gcd(k , d ) = 1} and that |Bd | = (d ).
Proof Continued
Suppose now that d is an arbitrary divisor of q 1. If Bd = , then |Bd | = 0. If Bd = , then we know from above that |Bd | = (d ). It follows that q 1 = |F | =
d |(q 1)
|Bd |
d |(q 1)
(d ).
But Proposition 3 states that (d ) = q 1.

d |(q 1)
Consequently, (d ) =
d |(q 1) d |(q 1)
|Bd | = q 1,
and this happens exactly if, |Bd | = (d ), for all divisors d of q 1.
Primitive Element
Denition Suppose there is g G such that for all h G there is an integer k such that h = g k . Then we say that G is a cyclic group and that G is generated by g . Corollary Suppose that F is a nite eld. Then the multiplicative group (F , ) is a cyclic group. Proof. Denote |F| = q . By Proposition 4 there are (q 1) elements of order q 1 in F . Clearly, each such element is a generator of F .
Denition. Suppose that F is a nite eld. An element in F with maximal order that is equal to |F| 1 = |F |, is called a primitive element. A nite eld F has (|F| 1) primitive elements.
Example
Consider the eld Z19 . Then the number 2 is primitive modulo 19, which we can verify, for example, as follows. The factorization of the integer 19 -1 = 18 is 18 = 2 3 3. By exercise 5.4 of the textbook it sufces to check that that 29 = 512 = 1( mod19) and 26 = 64 = 1( mod19). Hence Z19 = {2k mod 19 | k = 0, 1, . . . , 17}. Next we determine the cyclic subgroups of Z19 . The number of elements of a cyclic subgroup of Z19 must be a divisor of 18. By Eulers theorem, the following numbers are possible: 1, 2, 3, 6, 9 and 18. We denote by Sr the cyclic subgroup of r elements. Below, we list the exponents k such that 2k Sr , for all divisors r of 18.
Multiplicative Groups in Z19

r 18 9 6 3 2 1 k all k even 3 divides k 6 divides k 9 divides k k =0 Sr 1, 2, 4, 8, 16, 13, 7, 14, 9, 18, 17, 15, 11, 3, 6, 12, 5, 10 1, 4, 16, 7, 9, 17, 11, 6, 5 1, 8, 7, 18, 11, 12 1, 7, 11 1, 18 1
Galois Fields
For every prime p and positive integer n there is a nite eld with cardinality pn . Construction: Take a polynomial f (x ) of degree n with coefcients in Zp . Consider a set of polynomials with degree less than n. This set has pn polynomials. With polynomial arithmetic modulo f (x ) this set is a ring denoted as Zp [x ]/ f (x ) . Fact: If f (x ) is irreducible, then this ring is a eld and it is denoted by GF (pn ). If f (x ) is irreducible, then every nonzero polynomial has a multiplicative inverse modulo f (x ). We can compute a multiplicative inverse of a polynomial using the Extended Euclidean Algorithm (EEA).
EEA for Polynomials: Example

Let p = 2. We compute the multiplicative inverse of x 2 modulo x 4 + x + 1: i 0 1 2 3 4 ri x +x +1 x2 x +1 x 1
4
qi x2 x 1
ti 0 1 x2 x3 + 1 3 x + x2 + 1
si 1 0 1 x x +1
We get t4 x 2 + s4 (x 4 + x + 1) = (x 3 + x 2 + 1)x 2 + (x + 1)(x 4 + x + 1) = 1 = r4 . The multiplicative inverse of x 2 mod (x 4 + x + 1) is equal to x 3 + x 2 + 1.
The Multiplicative Group GF (24 ).

The element x is a primitive element of GF (24 ) with polynomial x 4 + x + 1. Then the other primitive elements are: x k , gcd(k , 15) = 1. There is a total of (24 1) = 8 primitive elements. They are : x x2 x4 x x
7
= x +1 = x3 + x + 1 = x2 + 1 = x3 + x2 + x = x3 + x2 + 1 = x3 + 1
x8
11
x 13 x 14

T-79 5501 Slides 3

Uploaded by

Copyright:

Available Formats

T-79 5501 Slides 3

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

T-79 5501 Slides 3

Uploaded by

Copyright:

Available Formats

Cryptology T-79.

Structure of Finite Field

T-79.5501 Cryptology Spring 2013 2/19

Lecture 3: Structure of Finite Fields February 2, 2012

Structure of Finite Fields Galois Fields

T-79.5501 Cryptology Spring 2013 3/19

T-79.5501 Cryptology Spring 2013 4/19

T-79.5501 Cryptology Spring 2013 5/19

T-79.5501 Cryptology Spring 2013 6/19

T-79.5501 Cryptology Spring 2013 7/19

Order of Group Element

T-79.5501 Cryptology Spring 2013 8/19

Order of Group Element

T-79.5501 Cryptology Spring 2013 9/19

A Property of Eulers -function

T-79.5501 Cryptology Spring 2013 10/19

On the other hand, we have that Ad Ad = , if d = d . Also, Ad = {r | 1 r n}.

T-79.5501 Cryptology Spring 2013 11/19

Number of Elements of Certain Order

But Proposition 3 states that (d ) = q 1.

and this happens exactly if, |Bd | = (d ), for all divisors d of q 1.

T-79.5501 Cryptology Spring 2013 13/19

T-79.5501 Cryptology Spring 2013 14/19

T-79.5501 Cryptology Spring 2013 15/19

Multiplicative Groups in Z19

T-79.5501 Cryptology Spring 2013 16/19

T-79.5501 Cryptology Spring 2013 17/19

EEA for Polynomials: Example

We get t4 x 2 + s4 (x 4 + x + 1) = (x 3 + x 2 + 1)x 2 + (x + 1)(x 4 + x + 1) = 1 = r4 . The multiplicative inverse of x 2 mod (x 4 + x + 1) is equal to x 3 + x 2 + 1.

T-79.5501 Cryptology Spring 2013 18/19

The Multiplicative Group GF (24 ).

T-79.5501 Cryptology Spring 2013 19/19

You might also like