Method, software and apparatus for computing discrete logarithms modulo a prime

Abstract

A decoding apparatus having a non-transient memory in which is stored an electromagnetic signal representative of data which were encrypted relying on the difficulty of computing discrete logarithms. The decoding apparatus has a computer in communication with the memory that decodes the encrypted data in the memory by computing the data's discrete logarithm. The decoding apparatus has a display on which the decoded encrypted data are displayed by the computer. A method for decoding.

Description

I. FIELD OF THE INVENTION

The present invention considers the exponential congruencea₀^x≡y₀(mod p)  (1)where p is prime and a₀ is a primitive root modulo p. Since a₀ is primitive, x and y₀ are in a one-to-one correspondence for integer values in the range 1≤x, y₀≤p−1 [3]. Let G denote the set of integers {1, 2, . . . , p−1} and let |G| denote their number. Given p and a₀ and given y₀ in G, it is desired to find x modulo p−1. The integer x is usually referred to as the discrete logarithm of y₀ in base a₀ modulo p. (As used herein, references to the “present invention” or “invention” relate to exemplary embodiments and not necessarily to every embodiment encompassed by the appended claims.)

BACKGROUND OF THE INVENTION

Pohlig and Hellman discussed the significance of this problem for cryptographic systems [3]. It was concluded by Pohlig and Hellman that, if p−1 has only small prime factors, x can be computed in a time of the order of log² p. However, if p−1 has a large prime factor p′, the search for x requires a time of the order p′ ·log p and may be untraceable. As an illustration, Pohlig and Hellman presented two large primes of the form p=2·p′+1, where p′ is also prime and wherep′=2¹³·5·7·11·13·17·19·23·29·31·37·41·43·47·530.59+1  (2)orp′=2¹²¹·5²·7²·11²·13·17·19·23·29·31·37·41·43·47·53·59+1.  (3)

In general, let p=2·p′+1, where p′ is prime andp′−1=2^ε0·q₁^ε1·q₂^ε2· . . . ·q_i^εi· . . . ·q_h^εh,  (4)where ε₀≥1 and, for 1≤i≤h, q₁ denotes an odd prime and ε_i>0. Also, for 1≤i<h, 2<q_i<q_i+1.NOTE 1: Pohlig and Hellman observed that q₁≠3. In fact p=2·p′+1=2·(p′−1)+3. Since p is prime, it must be gcd (3, p′−1)=1.NOTE 2: Let X denote the set of elements of G which are relatively prime to p−1 and let A denote the set of primitive roots modulo p. Then |X|=|A|=φ(p−1), where φ(n) denotes the Euler totient function.NOTE 3: The elements of X form a commutative (abelian) group under the operation of multiplication modulo p−1. An integer m≥1 has a primitive root if and only if m=1, 2, 4, p^d or 2·p^d, where p is prime number and a is a positive integer [1, p. 211]. When X is cyclic, there exist integers p which are primitive roots of X modulo p−1. When primitive roots of X exist, let Y denote the set of elements of X which are primitive roots of X modulo p−1.NOTE 4: Section VIII below shows that, when p′−1 can be described as in (4), X is cyclic only if ε₀<3

BRIEF SUMMARY OF THE INVENTION

The present invention introduces an algorithm which, when p=2·p′+1, p′ is prime and p′−1 contains only small prime factors, produces the solution of (1) in a time of the order of log log p·log² p.

The present invention pertains to a decoding apparatus. The decoding apparatus comprises a non-transient memory in which is stored an electromagnetic signal representative of data which were encrypted relying on the difficulty of computing discrete logarithms. The decoding apparatus comprises a computer in communication with the memory that decodes the encrypted data in the memory by computing the data's discrete logarithm. The decoding apparatus comprises a display on which the decoded encrypted data are displayed by the computer.

The present invention pertains to a method for processing an electromagnetic signal representative of encrypted data which were produced relying on the difficulty of computer discrete logarithms, comprising a first computer. The method comprises the steps of storing the encrypted data in a non-transient memory of a second computer. There is the step of performing with the second computer in communication with the memory the computer-generated steps of decoding the encrypted data in the memory by computing the data's discrete logarithms, and displaying on a display the decoded data.

The present invention pertains to a computer program stored in a non-transient memory for decoding an electromagnetic signal which is encrypted relying on the difficulty of computing discrete logarithms. The program has the computer-generated steps of storing the encrypted data in a non-transient memory. There is the step of decoding the encrypted data in the memory by computing the data's discrete logarithms. There is the step of displaying on a display the decoded data.

The present invention pertains to a method for reducing the complexity of an exponential congruence, preferably for decoding, which is defined modulo p, where p=2·p′+1, p′ is also a prime and p′−1 contains only factors which are smaller than 100,000. The method comprises the steps of executing with a computer a sequence of reversible transformations supported by a non-transient memory in such a way that the exponential congruence modulo p is restated as a problem involving new relationships modulo p and a concurrent independent congruence modulo p−1. There is the step of reporting the restated problem on a display.

The present invention pertains to a method for decoding. The method comprises the steps of selecting with a computer primitives of sub-groups of a group stored in a non-transient memory, where the group is defined modulo φ(p−1) in such a way that an exponent of any one primitive is independent on an exponent of any other primitive, thus reducing the complexity of a search for such exponents to a number of operations of the order of a sum of such exponents as opposed to their product. There is the step of reporting the exponents on a display.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWING

In the accompanying drawings, the preferred embodiment of the invention and preferred methods of practicing the invention are illustrated in which:

FIG. 1 is a block diagram of the apparatus of the claimed invention.

FIG. 2 is a representation of ρ₁^x1·ρ₂^x2(mod 70) using orthogonal primitives.

DETAILED DESCRIPTION OF THE INVENTION

Referring now to the drawings wherein like reference numerals refer to similar or identical parts throughout the several views, and more specifically to FIG. 1 thereof, there is shown a decoding apparatus 10. The decoding apparatus 10 comprises a non-transient memory 14 in which is stored an electromagnetic signal representative of data which were encrypted relying on the difficulty of computing discrete logarithms. The decoding apparatus 10 comprises a computer 12 in communication with the memory 14 that decodes the encrypted data in the memory 14 by computing the data's discrete logarithm. The decoding apparatus 10 comprises a display 18 on which the decoded encrypted data are displayed by the computer 12.

The computer 12 may reduce the complexity of an exponential congruence which is defined modulo p, where p=2·p′+1, p′ is also a prime and p′−1 contains only factors which are smaller than 100,000, and executes a sequence of reversible transformations supported by the non-transient memory 14 in such a way that the exponential congruence modulo p is restated as a problem involving new relationships modulo p and a concurrent independent congruence modulo p−1. The computer 12 may select primitives of sub-groups of a group stored in the non-transient memory 14, where the group is defined modulo φ(p−1) in such a way that an exponent of any one primitive is independent on an exponent of any other primitive, thus reducing the complexity of a search for such exponents to a number of operations of the order of a sum of such exponents as opposed to their product.

The present invention pertains to a method for processing an electromagnetic signal representative of encrypted data which were produced relying on the difficulty of computing discrete logarithms. The method comprises the steps of producing the electromagnetic signal by a first computer 12. There is the step of providing the signal to a second computer 22 through an input 20 of the second computer 22. The input 20 can be a keyboard in communication with the second computer 22 or a memory port, such as a USB port that receives a flash drive or a CD reader that receives a CD with the signal; or the input 20 can be a network interface card in communication with the second computer 22 having a network port which is in communication with a network 24 over which the signal is transmitted from the first computer 12. The second computer 22 obtains the signal from the network 24 through the input 20 of the second computer 22. There is the step of storing the encrypted data in a non-transient memory 14 of a second computer 22. There is the step of performing with the second computer 22 in communication with the memory 14 the computer-generated steps of decoding the encrypted data in the memory 14 by computing the data's discrete logarithms, and displaying on a display 18 the decoded data.

The performing step may include the steps of reducing the complexity of an exponential congruence which is defined modulo p, where p=2·p′+1, p′ is also a prime and p′−1 contains only factors which are smaller than 100,000. There may be the step of executing with the computer a sequence of reversible transformations supported by a non-transient memory 14 in such a way that the exponential congruence modulo p is restated as a problem involving new relationships modulo p and a concurrent independent congruence modulo p−1. There may be the step of reporting the restated problem on a display 18. The performing step may include the step of selecting with the computer primitives of sub-groups of a group stored in the non-transient memory 14, where the group is defined modulo φ(p−1) in such a way that an exponent of any one primitive is independent on an exponent of any other primitive, thus reducing the complexity of a search for such exponents to a number of operations of the order of a sum of such exponents as opposed to their product.

The present invention pertains to a computer program 16 stored in a non-transient memory 14 for decoding an electromagnetic signal which is encrypted relying on the difficulty of computing discrete logarithms. The program has the computer-generated steps of storing the encrypted data in a non-transient memory 14. There is the step of decoding the encrypted data in the memory 14 by computing the data's discrete logarithms. There is the step of displaying on a display 18 the decoded data.

The decoding step may include the steps of reducing the complexity of an exponential congruence which is defined modulo p, where p=2·p′+1, p′ is also a prime and p′−1 contains only factors which are smaller than 100,000. There may be the step of executing with the computer a sequence of reversible transformations supported by a non-transient memory 14 in such a way that the exponential congruence modulo p is restated as a problem involving new relationships modulo p and a concurrent independent congruence modulo p−1.

The decoding step may include the steps of selecting with the computer primitives of sub-groups of a group stored in the non-transient memory 14, where the group is defined modulo (p−1) in such a way that an exponent of any one primitive is independent on an exponent of any other primitive, thus reducing the complexity of a search for such exponents to a number of operations of the order of a sum of such exponents as opposed to their product.

The present invention pertains to a method for reducing the complexity of an exponential congruence, preferably for decoding, which is defined modulo p, where p=2·p′+1, p′ is also a prime and p′−1 contains only factors which are smaller than 100,000. The method comprises the steps of executing with a computer a sequence of reversible transformations supported by a non-transient memory 14 in such a way that the exponential congruence modulo p is restated as a problem involving new relationships modulo p and a concurrent independent congruence modulo p−1. There is the step of reporting the restated problem on a display 18.

The present invention pertains to an apparatus 10 for reducing the complexity of an exponential congruence, preferably for decoding, which is defined modulo p, where p=2·p′+1, p′ is also a prime and p′−1 contains only factors which are smaller than 100,000. The apparatus 10 comprises a non-transient memory 14. The apparatus 10 comprises a computer in communication with the non-transient memory 14 which executes a sequence of reversible transformations supported by the non-transient memory 14 in such a way that the exponential congruence modulo p is restated as a problem involving new relationships modulo p and a concurrent independent congruence modulo p−1. The apparatus 10 comprises a display 18 on which the restated problem is reported.

The present invention pertains to a computer program 16 stored in a non-transient memory 14 for reducing the complexity of an exponential congruence, preferably for decoding, which is defined modulo p, where p=2·p′+1, p′ is also a prime and p′−1 contains only factors which are smaller than 100,000. The program comprises the computer generated steps of executing a sequence of reversible transformations supported by a non-transient memory 14 in such a way that the exponential congruence modulo p is restated as a problem involving new relationships modulo p and a concurrent independent congruence modulo p−1. There is the step of reporting the restated problem on a display 18.

The present invention pertains to a method for decoding. The method comprises the steps of selecting with a computer primitives of sub-groups of a group stored in a non-transient memory 14, where the group is defined modulo φ(p−1) in such a way that an exponent of any one primitive is independent on an exponent of any other primitive, thus reducing the complexity of a search for such exponents to a number of operations of the order of a sum of such exponents as opposed to their product. There is the step of reporting the exponents on a display 18.

The present invention pertains to a computer program 16 stored in a non-transient memory 14 for decoding. The program comprises the computer generated steps of selecting primitives of sub-groups of a group stored in a non-transient memory 14, where the group is defined modulo φ(p−1) in such a way that an exponent of any one primitive is independent on an exponent of any other primitive, thus reducing the complexity of a search for such exponents to a number of operations of the order of a sum of such exponents as opposed to their product. There is the step of reporting the exponents on a display 18.

The present invention pertains to an apparatus 10 for decoding. The apparatus 10 comprises a non-transient memory 14. The apparatus 10 comprises a computer in communication with the memory 14 which selects primitives of sub-groups of a group stored in the non-transient memory 14, where the group is defined modulo φ(p−1) in such a way that an exponent of any one primitive is independent on an exponent of any other primitive, thus reducing the complexity of a search for such exponents to a number of operations of the order of a sum of such exponents as opposed to their product. The apparatus 10 comprises a display 18 in communication with the computer on which the exponents are reported.

In the operation of the invention, the following is a description of the solution of (1).

II. THE CASE WHEN ε₀−1. A RESTATEMENT

1) Step One. Definition of “Superprimitives”

In general in (1) a₀ is not a primitive root of X modulo p−1. It is convenient to restate (1) in such a way that on the LHS of (1) a₀ be replaced by a primitive of X modulo p−1.

If ρ denotes a primitive of X modulo p−1, consider the process of raising both sides of (1) by ρ_l. As l increases, a₀^ρl modulo p traces an orbit of primitives modulo p.

If p is large, and if p=2·p′+1, where p′ is also prime, approximately half of the elements of G are elements of this orbit [2, p. 269].

For some integer {tilde over (l)}, a₀^{p{tilde over (l)}} is also a primitive of X modulo p−1. In this case, define

$\begin{array}{cc}\{\begin{array}{c}{a}_0^{{\rho }^{\stackrel{\_}{l}}}\equiv a\left(\mathrm{mod}p\right)\\ y_0^{{\rho }^{\stackrel{\_}{l}}}\equiv y\left(\mathrm{mod}p\right)\end{array}.& \left(5\right)\end{array}$ Thena^x≡y(mod p).  (6)

An integer which is a primitive root of p and also a primitive of X modulo p−1 will be referred to as a superprimitive of p.

Table I shows the superprimitives of a set of small primes (ε₀≤2).

Table II shows some relevant variables for such primes.

TABLE I
p   Superprimitives of p
11  7
23  7, 17, 19
47  5, 11, 15, 19, 33, 43
59  11, 31, 37, 39, 43, 47, 55
107 5, 21, 31, 45, 51, 55, 65, 67, 71, 73, 103
167 5, 13, 15, 35, 39, 43, 45, 53, 55, 67, 71, 73, 79, 91, 101, 103, 105, 117,
    125, 129, 135, 139, 143, 145, 149, 155, 159, 163
263 29, 57, 67, 85, 87, 97, 115, 119, 127, 130, 139, 141, 161, 171, 185, 197,
    213, 219, 227, 229, 237, 241, 247, 251, 255, 257, 259
347 5, 7, 17, 19, 45, 63, 65, 69, 79, 91, 97, 101, 103, 111, 123, 125, 141, 145,
    153, 155, 165, 171, 175, 191, 193, 203, 215, 217, 221, 223, 231, 239,
    245, 247, 283, 301, 307, 335, 343,
359 7, 21, 35, 53, 63, 71, 97, 103, 105, 109, 113, 119, 137, 143, 157, 159, 163,
    167, 175, 189, 197, 209, 211, 213, 223, 251, 257, 263, 265, 269, 271,
    277, 291, 293, 299, 309, 311, 313, 315, 319, 327, 329, 339, 341, 343,
    349, 353, 355
383 33, 35, 47, 53, 61, 83, 89, 91, 95, 99, 105, 111, 123, 127, 131, 141, 145,
    151, 157, 167, 179, 181, 183, 187, 233, 247, 249, 253, 267, 285, 297,
    307, 315, 337, 355, 359, 365, 367, 369, 379
479 13, 19, 37, 39, 41, 43, 47, 53, 57, 59, 65, 79, 95, 117, 119, 123, 129, 143,
    149, 159, 171, 177, 179, 185, 191, 205, 209, 223, 227, 235, 237, 265,
    281, 285, 295, 317, 325, 333, 351, 353, 357, 369, 379, 387, 391, 395,
    423, 429, 433, 447, 449, 451, 461, 463, 467, 469, 473, 475
503 19, 29, 37, 53, 55, 57, 71, 87, 107, 109, 111, 127, 133, 137, 139, 159, 163,
    165, 167, 191, 193, 203, 213, 215, 239, 269, 277, 295, 305, 307, 313,
    321, 327, 333, 341, 347, 349, 371, 381, 385, 399, 409, 417, 419, 437,
    453, 457, 461, 467, 471, 475, 479, 481, 485, 487, 489, 495, 499
587 5, 11, 13, 19, 23, 41, 45, 85, 99, 103, 105, 111, 117, 125, 127, 131, 139,
    157, 171, 173, 183, 187, 207, 213, 215, 221, 227, 231, 241, 245, 251,
    259, 265, 263, 273, 275, 291, 295, 321, 323, 325, 327, 335, 337, 341,
    365, 367, 369, 373, 391, 399, 403, 405, 415, 427, 435, 467, 473, 475,
    483, 487, 497, 523, 539, 541, 557, 559, 583

TABLE II
p	|A| = |X|	|Y|	|A ∩ Y|	|A|/(A ∩ Y)
11	4	2	1	4.0000
23	10	4	3	3.3333
47	22	10	6	3.6666
59	28	12	7	4.0000
107	52	24	11	4.7273
167	82	40	28	2.9286
263	130	48	26	5.0000
347	172	84	39	4.4103
359	178	88	48	3.7083
383	190	72	40	4.7500
479	238	96	58	4.1034
503	250	100	58	4.3103
587	292	144	68	4.2941

NOTE 1: If ε₀≤2, X is cyclic and there exist an integer ρ which is a primitive root of X modulo p−1. If p is large, to determine ρ it is sufficient to select any random integer and to verify that a) ρ is an element of X, which means that it is relatively prime to p−1, and b) ρ is an element of Y, which means that it is relatively prime to φ(p−1)=p′−1. The process of producing ρ should not be long, because, if p is large, the probability that two integers be prime to one another is 6/π² [2, p. 269]. Thus, the probability that an integer chosen at random be prime to p−1 and p′−1 is approximately (6/π²)² or 1/2.7055.NOTE 2: The ratio |A|/|(A∩Y)| is relevant because it is related to the number of trials which should be expected when is employed in the search for a.NOTE 3: The ratio |A|/|(A∩Y)| may grow when p increases. As an example, when p=6466463=2·p′+1 and p′=2·5·7·11·13·17·19+1, |A|/|A∩Y|=7.7931.NOTE 4: Comparing the data for p₂=6466463 and p₁=587, observe that, when p is replaced by p₂, the ratio |A|/|A∩Y| is multiplied by a factor of 7.7931/4.2941, which is less than 2, while 6466463 is greater than 587².

2) Step Two

In general in (6) y is not a primitive root modulo p. It is convenient to restate (6) in such a way that the RHS of (6) be a primitive modulo p. This can be accomplished by multiplying both sides of (6) by a, a sufficient number of times until the desired condition is satisfied. If after 7′-iterations this condition is satisfied, let

$\begin{array}{cc}\{\begin{array}{c}b\equiv a^{\tilde{r}}·y\left(\mathrm{mod}p\right)\\ s\equiv x+\tilde{r}\left(\mathrm{mod}\left(p-1\right)\right)\end{array}.& \left(7\right)\end{array}$ Thena^s≡b(mod p).  (8)

After this restatement the search for x is conducted in a smaller, more structured environment. Since b is a primitive modulo p and a is a primitive of X modulo p−1, s is relative prime to p−1 and can be represented as follows

$\begin{array}{cc}\{\begin{array}{c}s\equiv a^t\left(\mathrm{mod}\left(p-1\right)\right)\\ a^{a^t}\equiv b\left(\mathrm{mod}p\right)\end{array},& \left(9\right)\end{array}$ where t denotes an integer and 0≤t<φ(p−1).

3) Step Three

Consider the process of raising the second of (9) to a^u modulo p. Let d denote the least positive residue modulo p of the corresponding RHS of (9). As u increases, the integer d describes an orbit of primitives modulo p. It is desired that d be also a primitive of X modulo p−1. If, after L operations this condition is satisfied, define

$\begin{array}{cc}{a}^{a^{\upsilon }}\equiv d\left(\mathrm{mod}p\right)& \left(10\right)\end{array}$ where

$\begin{array}{cc}\{\begin{array}{c}\upsilon \equiv t+\tilde{u}\left(\mathrm{mod}\phi \left(p-1\right)\right)\\ d\equiv b^{a^{\stackrel{\_}{\pi }}}\left(\mathrm{mod}p\right)\end{array}.& \left(11\right)\end{array}$

Consider the integer d^dw, where w denotes an integer. Since d is a primitive modulo p and a primitive of X modulo p−1, when w varies d^dw traces an orbit which contains all the primitives modulo p, including a.

Therefore, there does exist an integer w such that

$\begin{array}{cc}a\equiv d^{d^w}\left(\mathrm{mod}p\right).& \left(12\right)\end{array}$

4) Conclusion

The exponential congruence (1) is referred to as a “one-way” transaction, meaning that, when x is known, it is easy to compute a₀^x modulo p, while, when y₀ is known, the computation of x may be untractable. The restatement introduced by this section produces the congruences (10) and (12), which have similar structure and comparable complexity.

In order to determine the relationship between υ and w, raise (12) to a^υ modulo p. It will be

$\begin{array}{cc}{a}^{a^{\upsilon }}\equiv d^{a^{\upsilon }·d^w}\left(\mathrm{mod}p\right).& \left(13\right)\end{array}$ whence, by (10),a^υ·d^w=1(mod p−1)  (14)ora^υ≡d^−w(mod p−1).  (14)As a conclusion: υ and w are exponents of known superprimitives of p, a and d, respectively. The integers a^υ and d^w are related in a congruence which is defined modulo p−1.NOTE 1: In general, given (1), the integers a and d which result from the proposed restatements are not unique.NOTE 2: In principle, it would be possible to explore the case when a is a superprimitive of p and p−1. As an example, 19 is a superprimitive of 47 and 23. However, not all primes have superprimitives modulo p and modulo p−1.

III. ORTHOGONAL PRIMITIVES WHEN ε₀=1

Refer to (15). Let V denote the set of integers υ and w (1≤υ, w≤p′−1) which are candidate solutions of (10), (12), and (15) and let |V| denote their number.

A) It is desired to represent Vas the direct product of distinct subsets of T; each one associated with one of the factors (q_i^ε1 or 2^ε0) of p′−1.

B) It is desired to partition and process independently the corresponding sets of candidate solutions.

To reach these aims:

A) The number of significant candidate elements associated with each of such sets is φ(q_i^εi). Then the total number of candidate elements, say |V|, would be

$\begin{array}{cc}\begin{array}{c}V=\phi \left(p^{\prime }-1\right)\\ =2^{{\varepsilon }_0-1}·\prod _{i=1}^h\phi \left(q_i^{{\varepsilon }_{\iota }}\right).\end{array}& \left(16\right)\end{array}$

The candidate elements associated to φ(q_i^εi), say ρ_i^υi, are relatively prime to q_i and can be represented as the elements of a cyclic group having ρ_i as its generator. Notice that, thus far, nothing has been stated concerning the divisibility of ρ_i by q_j when i≠j. B) Consider the case when υ and w are represented as the direct product of their component subgroups. In the case when ε₀=1, ε₀−1=0. In order to process independently the cyclic subsets of V, consider the case when the primitive of the cycle i is defined as follows:

$\begin{array}{cc}\begin{array}{c}{\rho }_i=1+{\lambda }_i·\phi \left(p-1\right)/q_i^{{\varepsilon }_{\iota }}\\ ={\sigma }_i+{\mu }_i·q_i^{{\varepsilon }_{\iota }},\end{array}& \left(17\right)\end{array}$ where σ_i denotes any primitive modulo q_i and (λ_i, μ_i) denotes a pair of integers. Given σ_i, the pair (λ_i,μ_i) can be any one of the solution pairs of the following:σ_i−1+μ_i·q_i^εi=λ_i·φ(p−1)/q_i^εi.  (18)Given any solution pair ({tilde over (λ)}_i, {tilde over (μ)}_i), its substitution into (17) produces ρ_i modulo φ(p−1).After this restatement, ρ_i is relatively prime to φ(p−1).

Consider the case when p′−1 has a structure of the form (2) or (3), that is

a) 5 is the smallest odd prime divisor of p′−1, and

b) each divisor q_i is the smallest odd prime greater than q_i−1.

Under these conditions, all the odd prime divisors of φ(p′−1), with the exception of 3, are also divisors of φ(p−1). It is possible to select σ_i in such a way that ρ_i is not a multiple of 3. In this case, p_i^υi is relatively prime with φ(p−1) and φ(p′−1).

Thus, when p′−1 has the structure of (8) and (10) and υ is relatively prime with φ(p−1) and 3, it is possible to represent υ and w as follows

$\begin{array}{cc}\{\begin{array}{c}\upsilon \equiv \prod _{i=1}^h{\rho }_i^{{\upsilon }_{\iota }}\left(\mathrm{mod}\phi \left(p-1\right)\right)\\ \stackrel{.}{w}\equiv \prod _{i=1}^h{\rho }_i^{w_{\iota }}\left(\mathrm{mod}\phi \left(p-1\right)\right)\end{array},& \left(19\right)\end{array}$ where υ_i and w_i denote integers defined modulo φ(e).It will be

$\begin{array}{cc}\{\begin{array}{cc}\frac{\phi \left(p-1\right)}{q_i^{{\varepsilon }_{\iota }}}·{\rho }_j\equiv \frac{\phi \left(p-1\right)}{q_i^{{\varepsilon }_{\iota }}}\left(\mathrm{mod}\phi \left(p-1\right)\right)& \mathrm{for}i\ne j\\ \frac{\phi \left(p-1\right)}{q_i^{{\varepsilon }_{\iota }}}·{\rho }_j\equiv \frac{\phi \left(p-1\right)}{q_i^{{\varepsilon }_{\iota }}}·{\sigma }_j\left(\mathrm{mod}\phi \left(p-1\right)\right)& \mathrm{for}i=j\end{array}.& \left(20\right)\end{array}$

The congruences (20) define the orthogonality between ρ_i and ρ_j, for i≠j, and validate the definition of ρ_i offered by (17).

Notice that the definitions (17) imply that

${\rho }_i^{\phi \left(q_i^{{\varepsilon }_i}\right)}\equiv 1\left(\mathrm{mod}\phi \left(p-1\right)\right).$

In fact,

$\begin{array}{cc}\begin{array}{c}{\rho }_i^{\phi \left(q_i^{{\varepsilon }_{\prime }}\right)}={\left({\sigma }_i+{\mu }_i·q_i^{{\varepsilon }_{\iota }}\right)}^{\phi \left(q_i^{{\varepsilon }_{\iota }}\right)}\\ \equiv 1+{\chi }_i·q_i^{{\varepsilon }_{\iota }}\left(\mathrm{mod}{q}_i^{{\varepsilon }_{\iota }}\right)\end{array}& \left(22\right)\end{array}$ and also, for all positive integers n,

$\begin{array}{cc}\begin{array}{c}{\rho }_i^n={\left(1+{\lambda }_i·\phi \left(p-1\right)/q_i^{{\varepsilon }_{\iota }}\right)}^n\\ =1+{\psi }_i·\phi \left(p-1\right)/q_i^{{\varepsilon }_{\iota }}\end{array}& \left(23\right)\end{array}$ for some χ_i and ψ_i integers. Combining (22) and (23), (21) follows. Refer to Section I of the Appendix.

IV. THE RELATIONSHIP BETWEEN υ_i AND w_i MODULO φ(q_i^εi) WHEN ε₀=1

Using orthogonal primitives (17), consider raising (15) to

$\frac{\phi \left(p-1\right)}{q_i^{{\varepsilon }_{\iota }}}$ modulo p−1.It will be

$\begin{array}{cc}{\left(a^{\frac{\phi \left(p-1\right)}{q_i^{{\varepsilon }_{\iota }}}}\right)}^{{\sigma }_i^{{\upsilon }_i}}\equiv {\left(d^{\frac{\phi \left(p-1\right)}{q_i^{{\varepsilon }_{\iota }}}}\right)}^{-{\sigma }_i^{w_i}}\left(\mathrm{mod}\left(p-1\right)\right).& \left(24\right)\end{array}$ Let

$\begin{array}{cc}\{\begin{array}{c}{\alpha }_i\equiv a^{\frac{\phi \left(p-1\right)}{q_i^{{\varepsilon }_i}}}\left(\mathrm{mod}\left(p-1\right)\right)\\ {\delta }_i\equiv d^{\frac{\phi \left(p-1\right)}{q_i^{{\varepsilon }_i}}}\left(\mathrm{mod}\left(p-1\right)\right)\end{array}.& \left(25\right)\end{array}$ Then

$\begin{array}{cc}{\alpha }_i^{{\sigma }_i^{{\upsilon }_i}}\equiv {\delta }_i^{-{\sigma }_i^{w_i}}\left(\mathrm{mod}\left(p-1\right)\right).& \left(26\right)\end{array}$

This congruence establishes a relationship between υ_i and w_i which does not depend on any of the values of υ_i and w_j, for i≠j. However, this relationship does not identify the value of v which is consistent with (6).

NOTE 1: a and d are primitives modulo p−1. Therefore, they are relatively prime with φ(p−1). When a or d are raised to a divisor of φ(p−1), such as φ(p−1)/q_i^εi, they produce primitives modulo φ(p−1) for the sets

$\left\{{\sigma }_i^{v_i}\right\}\mathrm{and}\left\{{\sigma }_i^{w_i}\right\},$ respectively.

V. INVERTIBLE SUPERPRIMITIVE

1) Definition

A superprimitive of p is defined as invertible if its inverse modulo p is also a superprimitive of p. In general, only some of the superprimitives are invertible. Table III shows the invertible superprimitives of the set of primes which are included in Tables I and II.

TABLE III
				Number of
		Invertible	Number of	Invertible
p	Superprimitives of p	Superprimitives	Superprimitives	Superprimitives	Ratio
11	7		1	0	0
23	7, 17, 19	17, 19	3	2	0.666667
47	5, 11, 15, 19, 33, 43	5, 19	6	2	0.333333
59	11, 31, 37, 39, 43, 47, 55	11, 43	7	2	0.285714
107	5, 21, 31, 45, 51, 55, 65, 67, 71, 73, 103	21, 51	11	2	0.181818
167	5, 13, 15, 35, 39, 43, 45, 53, 55, 67, 71, 73, 79,	5, 35, 43, 67, 101, 105,	28	10	0.357143
	91, 101, 103, 105, 117, 125, 129, 135, 139, 143,	125, 129, 145, 163
	145, 149, 155, 159, 163
263	29, 57, 67, 85, 87, 97, 115, 119, 127, 130, 139,	29, 97, 115, 127, 141,	26	12	0.461538
	141, 161, 171, 185, 197, 213, 219, 227, 229,	197, 219, 241, 247,
	237, 241, 247, 251, 255, 257, 259	251, 257, 259
347	5, 7, 17, 19, 45, 63, 65, 69, 79, 91, 97, 101, 103,	17, 69, 79, 103,	39	8	0.205128
	111, 123, 125, 141, 145, 153, 155, 165, 171,	123, 171, 245, 283
	175, 191, 193, 203, 215, 217, 221, 223, 231,
	239, 245, 247, 283, 301, 307, 335, 343,
359	7, 21, 35, 53, 63, 71, 97, 103, 105, 109, 113,	157, 197, 209, 213,	48	16	0.333333
	119, 137, 143, 157, 159, 163, 167, 175, 189,	223, 257, 269, 271,
	197, 209, 211, 213, 223, 251, 257, 263, 265,	277, 293, 299, 339,
	269, 271, 277, 291, 293, 299, 309, 311, 313,	341, 343, 353, 355
	315, 319, 327, 329, 339, 341, 343, 149, 353,
	355
383	33, 35, 47, 53, 61, 83, 89, 91, 95, 99, 105, 111,	359, 367	40	2	0.05
	123, 127, 131, 141, 145, 151, 157, 167, 179,
	181, 183, 187, 233, 247, 249, 253, 267, 285,
	297, 307, 315, 337, 355, 359, 365, 367, 369,
	379
479	13, 19, 37, 39, 41, 43, 47, 53, 57, 59, 65, 79, 95,	19, 47, 53, 177, 235,	58	12	0.206897
	117, 119, 123, 129, 143, 149, 159, 171, 177,	265, 325, 353, 433,
	179, 185, 191, 205, 209, 223, 227, 235, 237,	449, 451, 463
	265, 281, 285, 295, 317, 325, 333, 351, 353,
	357, 369, 379, 387, 391, 395, 423, 429, 433,
	447, 449, 451, 461, 463, 467, 469, 473, 475
503	19, 29, 37, 53, 55, 57, 71, 87, 107, 109, 111,	19, 53, 133, 193, 213,	58	14	0.241379
	127, 133, 137, 139, 159, 163, 165, 167, 191,	295, 305, 307, 409,
	193, 203, 213, 215, 239, 269, 277, 295, 305,	417, 467, 475, 485,
	307, 313, 321, 327, 333, 341, 347, 349, 371,	489
	381, 385, 399, 409, 417, 419, 437, 453, 457,
	461, 467, 471, 475, 479, 481, 485, 487, 489,
	495, 499
587	5, 11, 13, 19, 23, 41, 45, 85, 99, 103, 105, 111,	11, 85, 111, 117, 215,	69	16	0.231884
	117, 125, 127, 131, 139, 157, 171, 173, 183,	221, 241, 275, 291,
	187, 207, 213, 215, 221, 227, 231, 241, 245,	321, 341, 415, 427,
	251, 259, 265, 263, 273, 275, 291, 295, 321,	435, 475, 523
	323, 325, 327, 335, 337, 341, 365, 367, 369,
	373, 391, 399, 403, 405, 415, 427, 435, 467,
	473, 475, 483, 487, 497, 523, 539, 541, 557,
	559, 583

Consider the case when a denotes an invertible superprimitive, and let g denote its inverse modulo p. Then, for some integers υ and w, the conditions (10) and (12) take the following forms:

$\begin{array}{cc}{a}^{a^{\upsilon }}\equiv a^{-1}\left(\mathrm{mod}p\right)& \left(27\right)\end{array}$ and

$\begin{array}{cc}{g}^{-1}\equiv g^{g^w}\left(\mathrm{mod}p\right).& \left(28\right)\end{array}$ Therefore,

$\begin{array}{cc}{a}^{a^v+1}\equiv 1\left(\mathrm{mod}p\right)& \left(29\right)\end{array}$ whencea^υ≡−1(mod(p−1))  (30)ora^2·υ≡1(mod(p−1)).  (31)Similarly,g^2·w≡1(mod(p−1)).  (32)Then2·υ≡0(mod φ(p−1))  (33)and2·w≡0(mod φ(p−1)).  (34)Thus,

$\begin{array}{cc}\upsilon \equiv w\left(\mathrm{mod}\frac{\phi \left(p-1\right)}{2}\right).& \left(35\right)\end{array}$

VI. THE DETERMINATION OF υ AND w WHEN ε₀=1

1) The Selection of a and d

Section II.1 describes how to select a superprimitive a. The algorithm proposed herein will require that a be an invertible superprimitive of p. This can be accomplished by raising a₀ to an increasing integer p^l>p^{{tilde over (l)}}, until the desired condition is satisfied. (Step One).

After the definition of a, it will be necessary to transform (6) in such a way that the RHS be an invertible superprimitive of p, namely d. (Step Two and Three).

Thus, the proposed algorithm will operate on two invertible superprimitives of p, namely

1) a (invertible superprimitive)

2) d (invertible superprimitive)

2) The Problem

Given the pair (a, d), to determine υ there are two conditions which must be satisfied.

A) The first condition is equation (14), which is defined modulo p−1.

B) A second condition on the pair (υ, w) is placed by the congruences (10) and (12), which are defined modulo p.

Consider the problem of solving the system of (10) and (12)

$\begin{array}{cc}\{\begin{array}{c}{a}^{a^{\upsilon }}=d\left(\mathrm{mod}p\right)\\ a=d^{d^w}\left(\mathrm{mod}p\right)\end{array}& \left(36\right)\end{array}$ under the condition (14).

Define

$\begin{array}{cc}\{\begin{array}{c}{a}^U·d\equiv 1\left(\mathrm{mod}p-1\right)\\ a·d^W\equiv 1\left(\mathrm{mod}p-1\right)\end{array}.& \left(37\right)\end{array}$ Refer to Appendix II.

Substitute the second of (37) into (14). It will be

$\begin{array}{cc}{d}^{-W·\upsilon }·d^w\equiv 1\left(\mathrm{mod}p-1\right),& \left(38\right)\end{array}$ orw=W·υ modulo φ(p−1).

Then the second of (37) becomes

$\begin{array}{cc}\begin{array}{c}a=d^{d^{W·\upsilon }}\left(\mathrm{mod}p\right)\\ =d^{-a·v}\left(\mathrm{mod}p\right).\end{array}& \left(40\right)\end{array}$

Thus, the system (36) becomes

$\begin{array}{cc}\{\begin{array}{c}{a}^{a^{\upsilon }}\equiv d\left(\mathrm{mod}p\right)\\ a\equiv d^{a^{-\upsilon }}\left(\mathrm{mod}p\right)\end{array}.& \left(41\right)\end{array}$

The original problem requires finding the solution of the first of (41).

3) The Solution

1) a and d are two physical numbers and are independent on any modular transactions of which they may become a part. Specifically, if we say d=317, we mean that d denotes the number 317, not 317 modulo anything.

2) If υ were known, the transition from a to d could be executed by raising a to a^υ modulo p.

3) Also, the transition from a to d can be executed by computing the discrete logarithm of d module p−1 in base a. To this end, definea^U(a,d)≡d(mod p−1).  (42)

Refer to Section II of the Appendix.

4) The two bridges from a to d are defined modulo p−1 and produce the same transition.

They can be compared operating modulo p−1.

5) A different approach consists of considering the following integers:

$\begin{array}{cc}\{\begin{array}{c}{A}_i=a^{\frac{\phi \left(p-1\right)}{q_i^{{\varepsilon }_i}}}\\ D_i=d^{\frac{\phi \left(p-1\right)}{q_i^{{\varepsilon }_i}}}\end{array}.& \left(43\right)\end{array}$

These integers can be very large. In principle, their definition is independent of any modular transaction of which they may become a part. It is possible to substitute the pair (A_i, D_i) into (41). It will be

$\begin{array}{cc}{A}_i^{{\alpha }_i^{{\sigma }_i^{{\upsilon }_i}}}\equiv D_i\left(\mathrm{mod}p\right).& \left(44\right)\end{array}$

The solution {tilde over (υ)}_i of this congruence is unique.

NOTE 1: After the solution {tilde over (υ)}₁ of (44) has been produced, the process must be repeated for all j≠i. Then υ can be computed using (19). The integer x follows, using (11) (9), (8) and (7).

VII. THE CASE WHEN ε₀=2

Refer to (16) and (19). If ε₀=2, the set of generators {p_i|1≤i≤h} must be expanded to include the generator ρ_{0, 0} of a subgroup of V consisting of two elements. In this case (19) must be replaced by the following

$\begin{array}{cc}\{\begin{array}{c}\upsilon \equiv {\rho }_{0,0}·\prod _{i=1}^h{\rho }_i^{{\upsilon }_i}\left(\mathrm{mod}\phi \left(p-1\right)\right)\\ w\equiv {\rho }_{0,0}·\prod _{i=1}^h{\rho }_i^{w_i}\left(\mathrm{mod}\phi \left(p-1\right)\right)\end{array}.& \left(45\right)\end{array}$ Let σ_{0, 0} denote the primitive of a cycle of two elements modulo 2^ε0. It will beσ_0,0≡3(mod 2²).  (46)Then, by (17),

$\begin{array}{cc}\begin{array}{c}{\rho }_{0,0}=1+{\lambda }_{0,0}·\frac{\phi \left(p-1\right)}{4}\\ =-1+{\mu }_{0,0}·4.\end{array}& \left(47\right)\end{array}$ Let

$\begin{array}{cc}{\mu }_{0,0}·4=2+{\lambda }_{0,0}·\frac{\phi \left(p-1\right)}{4}.& \left(48\right)\end{array}$

Given a solution pair ({tilde over (λ)}_{0, 0}, {tilde over (μ)}_{0, 0}) of (48), after substitution into (47),

ρ_{0, 0} modulo φ(p−1) follows.

It will be:

$\begin{array}{cc}\{\begin{array}{c}gcd\left({\rho }_{0,0},p-1\right)=1\\ gcd\left({\rho }_{0,0},\phi \left(p-1\right)\right)=1\end{array}.& \left(49\right)\end{array}$

To determine the pair (υ_0,0, w_0,0), define

$\begin{array}{cc}\{\begin{array}{c}{\alpha }_{0,0}\equiv a^{\frac{\phi \left(p-1\right)}{4}}\left(\mathrm{mod}p-1\right)\\ A_{0,0}\equiv a^{\frac{\phi \left(p-1\right)}{4}}\left(\mathrm{mod}p\right).\end{array}& \left(50\right)\end{array}$ and

$\begin{array}{cc}{D}_{0,0}\equiv d^{\frac{\phi \left(p-1\right)}{4}}\left(\mathrm{mod}p\right).& \left(51\right)\end{array}$

Then υ_{0, 0} is a solution of the following:

$\begin{array}{cc}{A}_{0,0}^{{\alpha }_{0,0}^{{\sigma }_{0,0}^{{\upsilon }_{0,0}}}}\equiv D_{0,0}\left(\mathrm{mod}p\right),& \left(52\right)\end{array}$ where υ_{0, 0} is either 0 or 1.

VIII. THE CASE WHEN ε₀>2

1) The Problem

If ε₀>2, X is not a cyclic group and there does not exist an integer σ_{0, 0} which generates a subgroup of V containing 2^ε0−1 elements modulo 2^ε0 [1, p. 206]. However, there exist integers σ₀ such that

$\begin{array}{cc}\{\begin{array}{c}{\sigma }_0^{2^{{\varepsilon }_0-3}}\not\equiv 1\left(\mathrm{mod}{2}^{{\varepsilon }_0}\right)\\ {\sigma }_0^{2^{{\varepsilon }_0-2}}\equiv 1\left(\mathrm{mod}{2}^{{\varepsilon }_0}\right)\end{array}.& \left(53\right)\end{array}$ As an example, if ε₀=5, for any integer of the form ε₀=4·ODD+1 it is

$\begin{array}{cc}\{\begin{array}{c}{\sigma }_0^4\not\equiv 1\left(\mathrm{mod}{2}^5\right)\\ {\sigma }_0^8\equiv 1\left(\mathrm{mod}{2}^5\right)\end{array}.& \left(54\right)\end{array}$ Refer to Section III of the Appendix.

As a result, if ε₀>2, in order to produce 2^ε0−1 elements modulo 2^ε0, it is necessary to employ the direct product of two subgroups of V, one containing 2^ε0−2 elements and one containing 2 elements. Let σ_0,0 and σ₀ denote the generators of the two subgroups having 2 and 2^ε0−2 elements, respectively. Of course, ε_0,0 should be an integer which cannot be produced by computing σ₀^υ0(mod 2^ε0−2), for any integer υ₀. This can be accomplished by defining

$\begin{array}{cc}\{\begin{array}{c}{\sigma }_0=4·ODD+1\\ {\sigma }_{0,0}=-1+2^{{\varepsilon }_0-1}\end{array}.& \left(55\right)\end{array}$

With this selection of σ₀ and σ_0,0 the product σ_0,0^υ0,0·σ₀^υ0(mod 2^ε0) generates all the odd integers from 1 to 2^ε0−1.

The integer ρ₀ can be determined by letting

$\begin{array}{cc}\begin{array}{c}{\rho }_0=1+{\lambda }_0·\frac{\phi \left(p-1\right)}{2^{{\varepsilon }_0}}\\ ={\sigma }_0+{\mu }_0·2^{{\varepsilon }_0-2}.\end{array}& \left(56\right)\end{array}$ Since gcd

$\left(2^{{\varepsilon }_0-2},\frac{\phi \left(p-1\right)}{2^{{\varepsilon }_0}}\right)=1,$ the integers λ₀ and μ₀ exist, and so does ρ₀.

Likewise, p_0,0 can be defined by letting

$\begin{array}{cc}\begin{array}{c}{\rho }_{0,0}=1+{\lambda }_{0,0}·\frac{\phi \left(p-1\right)}{2^{{\varepsilon }_0}}\\ =-1+{\mu }_{0,0}·2^{{\varepsilon }_0-2}.\end{array}& \left(57\right)\end{array}$

Then the general expression (17) of the integers υ and w must be restated as follows:

$\begin{array}{cc}\{\begin{array}{c}\upsilon \equiv {\rho }_{0,0}^{{\upsilon }_{0,0}}·{\rho }_0^{{\upsilon }_0}·\prod _{i=1}^h{\rho }_i^{{\upsilon }_i}\left(\mathrm{mod}\phi \left(p-1\right)\right)\\ w\equiv {\rho }_{0,0}^{w_{0,0}}·{\rho }_0^{w_0}·\prod _{i=1}^h{\rho }_i^{w_i}\left(\mathrm{mod}\phi \left(p-1\right)\right)\end{array}.& \left(58\right)\end{array}$

For 1≤i≤h it is still possible to produce primitives ρ_i which are orthogonal to each other and to ρ₀. However, it is not possible to identify two values of ρ_0,0 and ρ₀ which are orthogonal to each other. In other words, there does not exist a primitive of X modulo ρ−1 which enables the restatement described in Section II. Therefore, after the determination of all p_i, for 1≤i≤h, it is necessary to explore all the possibilities produced by ρ_0,0 and ρ₀. Since the order of ρ_0,0 is 2, two sets of circumstances must be considered.

In general, the elements of X can be grouped into two sets, namely X₀ and X₁, which correspond to the cases when υ_{0, 0}=0 and υ_{0, 0}=1, respectively.

2) The Case when υ_{0, 0}=0

If υ_0,0=0, the number of elements in V is

$\begin{array}{cc}\{\begin{array}{c}{\upsilon }_{0,0}=0\\ V=2^{{\varepsilon }_0-2}·\prod _{i=1}^h\phi \left(q_i^{{\varepsilon }_i}\right)\end{array}.& \left(59\right)\end{array}$ Compare with (16).In this case X₀ is a cyclic group and there exist integers p which are primitive roots of X₀ modulo p−1. Let Y₀ denote the set of primitive roots of X₀ modulo p−1. If p∈Y₀, let A₀ denote the set of primitive roots of p which are produced by letting

$\begin{array}{cc}{a}_0^{{\rho }^i}\equiv a\left(\mathrm{mod}p\right).& \left(60\right)\end{array}$

For some integers Ĩ, a will also be an element of Y₀. In these cases

$\begin{array}{cc}{\varepsilon }_0>2X=AX=X_0\bigcup X_1X_0=X_1A=A_0\bigcup A_1A_0=A_1X_0=A_0\frac{X_0}{A}=1/2.& \left(61\right)\end{array}$

Let σ₀ denote a primitive root of X₀ modulo 2^ε0−2. Assume that σ₀=4·ODD+1.

In this case, define

$\begin{array}{cc}\{\begin{array}{c}{\alpha }_0\equiv a^{\frac{\phi \left(p-1\right)}{2^{{\varepsilon }_0-1}}}\left(\mathrm{mod}p-1\right)\\ A_0\equiv a^{\frac{\phi \left(p-1\right)}{2^{{\varepsilon }_0-1}}}\left(\mathrm{mod}p-1\right)\end{array}& \left(62\right)\end{array}$ and

$\begin{array}{cc}{D}_0\equiv d^{{}^{\frac{\phi \left(p-1\right)}{2^{{\varepsilon }_0-1}}}}\left(\mathrm{mod}p-1\right).& \left(63\right)\end{array}$ Then

$\begin{array}{cc}{A}_0^{{\alpha }_0^{{\sigma }_0^{{\upsilon }_0}}}\equiv D_0\left(\mathrm{mod}p\right).& \left(64\right)\end{array}$

3) An Example

As an example, if ε₀=6 and 2^ε0=64, let σ₀=5 and σ_{0, 0}=31. The elements of X are 2^ε0−1=32. When υ_{0, 0}=0, the elements of X₀ are 2^ε0−2=16. When υ_{0, 0}=1, the elements of X₁ are 16. Thus, when the elements of X are reduced modulo 64, it will be

$\begin{array}{cc}\begin{array}{c}{X}_0=\left\{1,5,25,61,49,53,9,45,33,37,57,29,17,21,41,13\right\}\\ X_1=\left\{31,27,7,35,47,43,23,51,63,59,39,3,15,11,55,19\right\}\\ =\left\{31·\mathrm{each}\mathrm{one}\mathrm{of}\mathrm{the}\mathrm{elements}\mathrm{of}{X}_0\right\}.\end{array}& \left(65\right)\end{array}$

Since X₀ is a cyclic group, let Y₀ denote the set of primitive roots of X₀ modulo 2^ε0. In the example,Y₀={5,61,53,45,37,29,21,13}.  (66)

Also, define Y₁ as the set of elements produced when all the elements of Y₀ are multiplied by σ_{0, 0}. In the example, it will be

$\begin{array}{cc}\begin{array}{c}{Y}_1=\left\{27,35,43,51,59,3,11,19\right\}\\ =\left\{31·\mathrm{each}\mathrm{one}\mathrm{of}\mathrm{the}\mathrm{elements}{Y}_0\right\}.\end{array}& \left(67\right)\end{array}$ NOTE 1: In the example, 31 and 63 are the only elements of X₁ for which 31² ≡1(mod 64) and 63²≡1(mod 64).NOTE 2: In the example, any element of Y₀, when raised to 31 modulo 64, produces another elements of Y₀. In fact, gcd (31, 32)=1 and gcd (31, 64)=1. Thus,

$\begin{array}{cc}\{\begin{array}{c}{5}^{31}\equiv 13\left(\mathrm{mod}64\right)\\ {61}^{31}\equiv 21\left(\mathrm{mod}64\right)\\ \dots \\ {45}^{31}\equiv 37\left(\mathrm{mod}64\right)\end{array}.& \left(68\right)\end{array}$

4) The Algorithm when υ_{0, 0}=0

The solution υ₀ can be determined using the procedure defined by (64).

After the determination of υ₀, the algorithm should proceed to the determination of the candidate values of υ_i, for 1≤i≤h.

If the resulting value of υ is not consistent with (6), the assumption υ_{0, 0}=0 must be discarded and the case υ_{0, 0}=1 must be considered.

5) The Case when υ_0,0=1

Consider first the case when a∈A₀. Then

$a^{a^{\upsilon }}\equiv d\left(\mathrm{mod}p\right)$ and d∈A₀.

Define A₁ as the set of primitives modulo p which are not elements of A₀. One example is

$\begin{array}{cc}\stackrel{\_}{a}\equiv a^{{\rho }_{0,0}}\left(\mathrm{mod}p\right),& \left(69\right)\end{array}$ which implies that

$\begin{array}{cc}a\equiv {\stackrel{\_}{a}}^{{\rho }_{0,0}}\left(\mathrm{mod}p\right).& \left(70\right)\end{array}$ Notice that ā is a primitive modulo p because gcd (ρ_{0, 0}, p−1)=1.

Given ā, all the elements of A₁ can be produced by raising ā to the elements of X₀. Notice that, after the introduction of ā∈A₁, operating in A₁ follows the same procedures which were used operating in A₀ using a∈A₀. Thus the definition of ā given a can be used to produce all of the elements of A_i by raising ā to any element of X₀. In particular, consider the case when ā is raised to ā modulo p. Since a is an element of X₀ and Y₀, ā is an element of Y₀∩A₁.

$\begin{array}{cc}{\varepsilon }_0>2a\in A_{0}a\in X_{0}a\in Y_0\stackrel{\_}{a}\in A_1\stackrel{\_}{a}\in Y_0\stackrel{\_}{a}\in Y_0\bigcap A_1& \left(71\right)\end{array}$ Refer to NOTE 2 in Section 4 above.

The same observation can be made about d. Therefore, for some integers υ and w, it is

$\begin{array}{cc}\{\begin{array}{c}{\stackrel{\_}{a}}^{{\stackrel{\_}{a}}^{\upsilon }}\equiv \stackrel{\_}{d}\left(\mathrm{mod}p\right)\\ \stackrel{\_}{a}\equiv {\stackrel{\_}{d}}^{{\stackrel{\_}{d}}^w}\left(\mathrm{mod}p\right)\end{array},& \left(72\right)\end{array}$ whence

$\begin{array}{cc}{a}^{{\rho }_{0,0}·\upsilon }\equiv d^{-{\rho }_{0,0}·w}\left(\mathrm{mod}p-1\right).& \left(73\right)\end{array}$

Raising a and d to φ(p−1)/2^ε0 modulo p−1 produces

$\begin{array}{cc}{\alpha }_0^{{\rho }_{0,0}·{\sigma }_0^{{\upsilon }_0}}\equiv {\delta }_0^{-{\rho }_{0,0}·{\sigma }_0^{w_0}}\left(\mathrm{mod}p-1\right).& \left(74\right)\end{array}$ Compare with (26).

The procedures which were used to produce υ₀ and v, can be repeated.

IX. CONCLUSION

The procedures described in Sections III through VII above were designed to determine v given p and the pair (a, d). The integer υ is related to x through (11), (9), (8) and (7) that is through ū, t, s, and r.

To determine the execution time of the proposed algorithm, note that each one of such operations as multiplication, exponentiation, calculation of inverses and solution of linear congruences has an execution time not exceeding log² m, where m is the modulus of the operation. Also, the number of operations to be executed modulo p or modulo p′ is of the order of log log p. Therefore, the total execution time is of an order which does not exceed log log p·log² p.

APPENDIX

Notes on Orthogonal Primitives

I. An Example

Leta^x≡b(mod 71),  (A.1)where a and b are primitive roots modulo 71.Then x is an element of the set X, containing all the integers which are relatively prime to p−1=70=2·5·7.

The order of X is φ(70)=φ(5)·φ(7)=24. The exponent of X is e(X)=1 cm (4, 6)=12. Then X can be described as the direct product of a cyclic subgroup of order 2 and a cyclic subgroup of order 12 as follows:X=C₁(2)×C₂(12).  (A.2)

Also, the elements of X can be represented by using orthogonal primitives. In this case, given a selection of σ₁(mod 7) and σ₂(mod 5), ρ₁(mod 70) and ρ₂(mod 70) can be computed by letting

$\begin{array}{cc}\begin{array}{c}{\rho }_1=I+{\lambda }_1·\frac{p-1}{7}\\ ={\sigma }_1+{\mu }_1·7\end{array}& \left(A\mathrm{.3}\right)\end{array}$ and

$\begin{array}{cc}\begin{array}{c}{\rho }_2=1+{\lambda }_2·\frac{p-1}{5}\\ ={\sigma }_2+{\mu }_2·5.\end{array}& \left(A\mathrm{.4}\right)\end{array}$

For σ₁≡5(mod 7) and σ₂≡3(mod 5), it will be ρ₁≡61(mod 70) and ρ₂≡43(mod 70). Thenx≡61^x1·43^x2(mod 70).  (A.5)

FIG. 2 shows the elements of X as intersections of vertical and horizontal straight lines through 61^x1(mod 70) and 43^x2(mod 70), respectively.

It is apparent that the elements on a vertical line (constant x₁) are congruent to one another modulo 14=2·7. Likewise, the elements on a horizontal line are congruent to one another modulo 2·5=10.

Also, each elements of X is a product of its horizontal and vertical components. Thus, 67≡11·57(mod 70).

Different selections of the primitives σ₁ and σ₂ would cause appropriate permutations of the vertical and horizontal lines, respectively.

Observe that, by (A.3) and (A.4),

$\begin{array}{cc}\{\begin{array}{c}\frac{70}{7}·{\rho }_1\equiv \frac{70}{7}·{\sigma }_1·\left(\mathrm{mod70}\right)\\ \frac{70}{7}·{\rho }_2\equiv \frac{70}{7}\left(\mathrm{mod70}\right)\end{array}.& \left(A\mathrm{.6}\right)\end{array}$

Therefore, raising (A.1) to 10 (modulo 71) yields

$\begin{array}{cc}{\left(a^{10}\right)}^{5^{x_1}}\equiv b^{10}\left(\mathrm{mod}71\right).& \left(A\mathrm{.7}\right)\end{array}$

Likewise, raising (A.1) to 14 (modulo 71) yields

$\begin{array}{cc}{\left(a^{14}\right)}^{3^{x_2}}\equiv b^{14}\left(\mathrm{mod}71\right).& \left(A\mathrm{.8}\right)\end{array}$ Therefore, in the example, x₂ and x₁ can be determined independently of each other.

II. Discrete Logarithms Modulo p−1

The congruence (14) defines the relationship between a^υ and d^w which is repeated here:a^υ·d^w≡1(mod p−1).  (75)

It is convenient to develop a simple relationship between the integers a and d which does not refer to the variations of the pair (υ, w). Specifically, when υ=1 or w=1, such a relationship can be stated as

$\begin{array}{cc}\{\begin{array}{c}v=1\\ a·d^W\equiv 1\left(\mathrm{mod}\left(p-1\right)\right)\end{array}& \left(76\right)\end{array}$ or

$\begin{array}{cc}\{\begin{array}{c}w=1\\ a^U·d\equiv 1\left(\mathrm{mod}\left(p-1\right)\right)\end{array}.& \left(77\right)\end{array}$ Notice thatU·W≡1(mod ω(p−1)).  (78)

To develop U and W, it is convenient to represent υ and w using (19) and to partition the problem as in (26), which is repeated here:

$\begin{array}{cc}{\alpha }_i^{{\sigma }_i^{v_i}}\equiv {\delta }_i^{-{\sigma }_i^{w_i}}\left(\mathrm{modp}-1\right).& \left(79\right)\end{array}$ Let w_{i, m} denote the value of w_i when υ_i=0(mod φ(q_i^εi)). Then

$\begin{array}{cc}{\alpha }_i\equiv {\delta }_i^{-{\sigma }_i^{w_{i,m}}}\left(\mathrm{mod}p-1\right).& \left(A\mathrm{.9}\right)\end{array}$ Likewise, let υ_{i, m} denote the value of υ_i when w_i ≡0(mod φ(q_i^εi)). Then

$\begin{array}{cc}{\alpha }_i^{{{\sigma }_i}^{v_{i,m}}}\equiv {\delta }_i^{-1}\left(\mathrm{mod}p-1\right).& \left(A\mathrm{.10}\right)\end{array}$ Consider the case when all the υ_j's are congruent to zero modulo φ(q_i^εi). In this case, from (19),

$\begin{array}{cc}a\equiv d^{-\prod _{j=1}^h{\rho }_j^{w_{j,m}}}\left(\mathrm{mod}p-1\right).& \left(A\mathrm{.11}\right)\end{array}$ Let

$\begin{array}{cc}W=\prod _{j=I}^h{\rho }_j^{w_{j,m}}.& \left(A\mathrm{.12}\right)\end{array}$ Thena≡d^−W(mod p−1).  (A.13)

Likewise, consider the case when all the w_j's are congruent to zero modulo φ(q_j^εj). In this case

$\begin{array}{cc}{a}^{\prod _{j=1}^h{\rho }_j^{v_{j,m}}}\equiv d^{-1}\left(\mathrm{mod}p-1\right).& \left(A\mathrm{.14}\right)\end{array}$ Let

$\begin{array}{cc}U=\prod _{j=1}^h{\rho }_j^{v_{j,m}}.& \left(A\mathrm{.15}\right)\end{array}$ Thena^U≡d⁻¹(mod p−1).  (A.16)

III. THE ORDER OF ε₀=4·ODD+1 MODULO 2^ε0

When σ₀=4·ODD+1, the order of σ₀ modulo 2^ε0 equals 2^ε0−2:

$\begin{array}{cc}{\sigma }_0^{2^{{\varepsilon }_0-2}}\equiv 1\left(\mathrm{mod}{2}^{{\varepsilon }_0}\right).& \left(A\mathrm{.17}\right)\end{array}$

Consider the case when σ₀=4·ODD+1. Then

$\begin{array}{cc}\{\begin{array}{ccc}{\sigma }_0& \equiv & 4·\left(2·k+1\right)+1\left(\mathrm{mod}{2}^{{\varepsilon }_0}\right)\\ & \equiv & 1+2^2+8·k\left(\mathrm{mod}{2}^{{\varepsilon }_0}\right)\\ {\sigma }_0^2& \equiv & 1+2^3+16·k_1\left(\mathrm{mod}{2}^{{\varepsilon }_0}\right)\\ {\sigma }_0^4& \equiv & 1+2^4+32·k_2\left(\mathrm{mod}{2}^{{\varepsilon }_0}\right)\\ & \dots & \\ {\sigma }_0^{2^{{\varepsilon }_0-3}}& \equiv & 1+2^{{\varepsilon }_0-1}\left(\mathrm{mod}{2}^{{\varepsilon }_0}\right)\\ {\sigma }_0^{2^{{\varepsilon }_0-2}}& \equiv & 1\left(\mathrm{mod}{2}^{{\varepsilon }_0}\right)\end{array}.& \left(A\mathrm{.18}\right)\end{array}$ (k, k₁, k₂ integers).

Notice that the integer σ_0,0 ≡−1+2^ε0−1 cannot be produced as a power of σ₀.

III. ATTACHMENT

There exist several variations of encryption systems based on the difficulty of computing discrete logarithms modulo a prime. In the core system the participants share the knowledge of a prime p and one of its primitives, usually denoted as a. All the participants publish their own address c_P, which they compute as c_P=a^mp, where m_p is a random integer which is known to the addressee only.

Any participant who wishes to communicate confidentially with any other participant, say with participant B, transmits to the addressee B a pair of integers denoted as (R, S), where

$\{\begin{array}{c}R=a^r\\ S=\mathrm{message}·c_B^r\end{array},$ where r is a random number selected by the sender.The receiver retrieves the message by computing

$\begin{array}{c}\frac{S}{R^{m_B}}=\mathrm{message}·\frac{a^{r·m_B}}{a^{r·m_B}}\\ =\mathrm{message}\end{array}.$

The only other persons who can retrieve the message are the persons who know m_B or can compute m_B as the discrete logarithm of c_B in base a.

Although the invention has been described in detail in the foregoing embodiments for the purpose of illustration, it is to be understood that such detail is solely for that purpose and that variations can be made therein by those skilled in the art without departing from the spirit and scope of the invention except as it may be described by the following claims.

REFERENCES, ALL OF WHICH ARE INCORPORATED BY REFERENCE HEREIN

• [1] T. M. Apostol, Introduction to Analytic Number Theory, New York, N.Y.: Springer-Verlag, 1976. [2] G H. Hardy, E. M. Wright, An Introduction to the Theory of Numbers, Oxford, UK: Clarendon Press, 1979.
• [3] S. C. Pohlig, M. E. Hellman, “An Improved Algorithm for Computing Logarithms over GF(p) and its Cryptographic Significance”, IEEE Trans, Inform. Theory, Vol IT-24, pp. 106-110, 1978.

Claims

1. A decoding apparatus comprising: a network port in communication with a communication network which receives from the connection network an electromagnetic signal representative of encrypted data which were produced with a first computer relying on a difficulty of computing discrete logarithms;a non-transient memory in which is stored the electromagnetic signal representative of encrypted data which were encrypted by the first computer relying on the difficulty of computing discrete logarithms, the data having a discrete logarithm;a second computer in communication with the memory that decodes the encrypted data in the memory in a time of an order of log log p·log2 p by computing the data's discrete logarithm, the second computer reduces the complexity of an exponential congruence which is defined modulo p, where p=2·p′+1, p′ is also a prime and p′−1 contains only factors which are smaller than 100,000, and executes a sequence of reversible transformations supported by the non-transient memory in such a way that the exponential congruence module p is restated as a problem involving new relationships modulo p and a concurrent independent congruence modulo p−1; anda display on which the decoded encrypted data are displayed by the second computer.

2. A method for processing an electromagnetic signal representative of encrypted data which were produced relying on a difficulty of computing discrete logarithms, the data having a discrete logarithm, with a first computer comprising the steps of: receiving the encrypted data at a network port of a second computer from a communication network, the second computer in communication with the communication network;storing the encrypted data in a non-transient memory of the second computer;performing with the second computer in communication with the memory the computer-generated steps of decoding the encrypted data in the memory in a time of an order of log log p·log2p by computing the data's discrete logarithms, the performing step includes the steps of reducing the complexity of an exponential congruence which is defined modulo p, where p=2·p′+1, p′ is also a prime and p′−1 contains only factors which are smaller than 100,000; and executing with the second computer a sequence of reversible transformations supported by a non-transient memory in such a way that the exponential congruence modulo p is restated as a problem involving new relationships modulo p and a concurrent independent congruence modulo p−1; anddisplaying on a display the decoded data.

3. A computer program stored in a non-transient memory in communication with a second computer for decoding with the second computer an electromagnetic signal representative of encrypted data which is encrypted by a first computer relying on a difficulty of computing discrete logarithms, the data having a discrete logarithm, the computer program having the second computer-generated steps of: receiving the encrypted data by the first computer at a network port of the second computer from a communication network;storing the encrypted data in the non-transient memory;decoding the encrypted data in the memory with the second computer in a time of an order of log log p·log2 p by computing the data's discrete logarithms, the decoding step includes the steps of reducing the complexity of an exponential congruence which is defined modulo p, where p=2·p′+1, p′ is also a prime and p′−1 contains only factors which are smaller than 100,000; and executing with the second computer a sequence of reversible transformations supported by the non-transient memory in such a way that the exponential congruence modulo p is restated as a problem involving new relationships modulo p and a concurrent independent congruence modulo p−1; anddisplaying on a display the decoded data.