1

Say one is doing some cryptography around the set of congruence classes, namely: $$\mathbb{Z}/n\mathbb{Z} = \mathbb{Z}_n = \{[0]_n, [1]_m, \dots, [n-1]_n\}.$$ Sometimes we use to write $a \leftarrow_R \mathbb{Z}_n$ to denote that we are sampling an element from $\mathbb{Z}_n$. But, what exactly means to perform such a sampling? I imagine that it is the following

  • Shorthand for $[a]_n \leftarrow_R \mathbb{Z}_n$ plus $a \leftarrow [a]_n$, i.e., taking the representative of the class, where $0 \leq a <n$.

Is it like that? We typically use this sampled number as an exponent, so it would not make sense to sample an entire congruence class.

At the begginning I though that $a \leftarrow_R \mathbb{Z}_n$ was writing to avoid writing $[a]_n \leftarrow_R \mathbb{Z}_n$ too many times. But it would not make sense.

It is also often to see that $\mathbb{Z}_n = \{0, 1, \dots, n-1\}$. Is it a shorthand for its real meaning?

Bean Guy
  • 732
  • 3
  • 11
  • 1
    This is the basic number theory ( congruence class) that after the congruence is thought no one is using the brackets ( only if there is a real distinction is required). Note that sometimes for efficiency we allow to use the number represented other than the least residue system modulo n. In latex, although $\equiv$ is written with '\equiv' it should be read as congruent not equivalent. – kelalaka Dec 22 '20 at 13:20
  • @kelalaka Yeah, but what we are taking when we sample from it? The whole class or the representative? For instance, when we want to use ElGamal we write $g^x$, but what we are actually writing? $g^x$ or $g^{[x]_q}$. – Bean Guy Dec 22 '20 at 13:45
  • 1
    I hope I've addressed all of your questions. – kelalaka Dec 22 '20 at 19:24

2 Answers2

1

Sometimes we use to write $a \leftarrow_R \mathbb{Z}_n$ to denote that we are sampling an element from $\mathbb{Z}_n$. But, what exactly means to perform such a sampling?

When we talked about $\mathbb{Z}_n$ we usually consider the least residue system modulo $n$ that is the integers $\{0,1,\ldots,n-1\}$

When we write $a \stackrel r\gets \mathbb{Z}_n$ we usually mean possibly probabilistic process assignment, there are other variants.

When sampling uniformly one should be careful about the random source, simple taking modulus is dangerous and can be biased, discarding is required. Consider your random number generates random numbers in the range $[0,15]$ and you want to sample for $\mathbb Z_{13}$ than taking $\mod 13$ can create a bias since the 13 will map to 0, the 14 will map 1, and 15 will map to 2. Therefore their sampling is more than others, $2/16$ instead of $1/16$. Just discard the numbers $>12$ and get a new random number.

One can use outside of the least residue system like

  • asked for RSA recently that $e > \varphi(n)$ that will still represent an $e' = e \bmod \varphi(n) $, or
  • one can get the private key $k$ in ECC longer than the order $n$ of the base point $G$. It is still useless since $[k]G = [k \bmod n]G$

But the devil in details; sampling outside may carry some unintended side effects. Always check according to the context!

A further question;

  • Are we restricted to the least residue system?

    Like the adversaries who can do whatever they want that suits their advantage, we can use it, too.

    • For example, to speed up the gcd we can allow negative remainders.
    • One may skip a modular reduction step that will cause the number not in the range $[0,n-1]$ and probably higher, Omura '90. In the end, the result must be in the least residue.

    In some context, we require the residue as $(n/2,n/2]$ because it forms a ball around the origin and can help to better understand.

For instance, when we want to use ElGamal we write $g^x$, but what we are actually writing? $g^x$ or $g^{[x]_q}$.

First one, since we sample from $[2,q-1]$. When $g^{[x]_q}$ is written it means that the $[x]_q$ can be any of $x+kq$ wher $k \in \mathbb Z - \{0\}$.

kelalaka
  • 48,443
  • 11
  • 116
  • 196
0

we are taking quotient of Z when divided by nZ. for ex. if we take Z/5Z then it will have all remainder mod 5. i.e., we will use the subgroup 5Z to partition the group Z.

  • {...-10,-5, 0, 5, 10, 15...} = 0 + 5Z ((normal)subgroup , can be called coset too)
  • {...-9, -4, 1, 6, 11, 16...} = 1 + 5Z (strictly the coset)
  • {...-8, -3, 2, 7, 12, 17...} = 2 + 5Z (strictly the coset)
  • {...-7, -2, 3, 8, 13, 18...} = 3 + 5Z (strictly the coset)
  • {...-6, -1, 4, 9, 14, 19...} = 4 + 5Z (strictly the coset)
  • Now rather than writing 0+5Z, 1+5Z and so on , it can be written as
  • Z/5Z = ${\{ \bar{0},\bar{1},\bar{2},\bar{3},\bar{4}\}}$
  • Now original group is completely covered by one subgroup 5Z and group of all cosets form a new group call, Quotient Group.
SSA
  • 640
  • 5
  • 11