3

Assume I have the following modular congruences, where $n = pq$ is the product of two (large) primes:

$$A \equiv (xp+yq)^{e_1} \mod n$$

$$B \equiv (zp+uq)^{e_2} \mod n$$

We know $A,B, x,y,z,u, e_1, e_2$ and $n$, but not its prime factors $p$ and $q$.

I have some vague recollections from one of my classes that using this system of congruences, given the properties of modular exponentiation, I can find $p$ and $q$. I am not necessarily looking for a plain solution but for an explanation why.

My first instinct was to solve the following system:

$$k_1n + A = (xp+yq)^{e_1}$$

$$k_2n + B = (zp+uq)^{e_2}$$

$$n = pq$$

But that has 4 unknowns so I'd need 4 equations.

Ilmari Karonen
  • 26,117
S. L.
  • 157
  • 1
    what do you note about the expansiin onnthe right. –  May 23 '19 at 12:05
  • I made a few copyedits and clarifications to your question. Could you please check that I didn't introduce any errors while doing so (and if I did, please fix them or just revert my edit)? Thanks! – Ilmari Karonen May 23 '19 at 12:18
  • @IlmariKaronen seems good to me, thanks :) – S. L. May 23 '19 at 12:23
  • @RoddyMacPhee not sure, perhaps that each element of the expansion would be mod n? But assuming $e1$ and $e2$ are very large not sure how it helps – S. L. May 23 '19 at 12:24
  • because each power combo in the expansion is 0 mod n except 2. They force a lower bound on the k values. etc. –  May 23 '19 at 13:03
  • @RoddyMacPhee what do you mean? Like, how is that? – S. L. May 23 '19 at 14:02
  • $pq\mid(zp)^g(uq)^{e_2-g}\implies g>0\land e_2-g>0$ –  May 23 '19 at 14:13
  • Ok so I get a lower bound, but k could be arbitrarily larger? – S. L. May 23 '19 at 14:26
  • 1
    yes as the exponent goes up so will the terms in the expansion. as will the remaining terms but if z>q and u>p you can reduce those mod n. –  May 23 '19 at 21:13

1 Answers1

3

The following may be what you are thinking of from your class. You have the following $2$ congruence equations:

$$A \equiv (xp+yq)^{e_1} \pmod n \tag{1}\label{eq1A}$$ $$B \equiv (zp+uq)^{e_2} \pmod n \tag{2}\label{eq2A}$$

Let $e = \text{lcm}(e_1,e_2)$. Take both sides of \eqref{eq1A} to the power of $f = \frac{e}{e_1}$ and both sides of \eqref{eq2A} to the power of $g = \frac{e}{e_2}$ to get

$$A^f \equiv (xp+yq)^e \pmod n \tag{3}\label{eq3A}$$ $$B^{\, g} \equiv (zp+uq)^e \pmod n \tag{4}\label{eq4A}$$

As Roddy MacPhee stated in the comments, in the binomial expansions of the RHS of \eqref{eq3A} and \eqref{eq4A}, each term except for the first & last ones have a factor of $pq$, so are congruent to $0$ modulo $n$ and, thus, can be ignored. We then end up with

$$A^f \equiv x^e p^e + y^e q^e \pmod n \tag{5}\label{eq5A}$$ $$B^{\, g} \equiv z^e p^e + u^e q^e \pmod n \tag{6}\label{eq6A}$$

We now basically have $2$ linear equations in $2$ unknowns of $p^e$ and $q^e$. To solve them, multiply both sides of \eqref{eq5A} by $u^e$ and subtract \eqref{eq6A} multiplied by $y^e$ to get

$$u^e A^f - y^e B^{\, g} \equiv \left(\left(ux\right)^e - \left(zy\right)^e\right)p^e \pmod n \tag{7}\label{eq7A}$$

Since $n = pq$, this means the LHS of \eqref{eq7A} must be a multiple of $p$. There are $2$ basic cases to consider now. If the LHS is not congruent to $0$ modulo $n$, then we can use the Euclidean algorithm to relatively efficiently get $p = \gcd(n,u^e A^f - y^e B^{\, g})$, and then $q = \frac{n}{p}$. However, if the LHS is congruent to $0$ modulo $n$, then if $p \neq q$ (note: if there is any chance of this not being true, you should check for & handle this initially), we have instead that $C = \left(ux\right)^e - \left(zy\right)^e \equiv 0 \pmod q$, so there are now $2$ sub-cases to handle. If $C$ is not congruent to $0$ modulo $n$, we can use the Euclidean algorithm to get $q = \gcd(n,C)$, and then $p = \frac{n}{q}$. However, if it is, then we can eliminate $p^e$ from \eqref{eq5A} and \eqref{eq6A} to use those other values instead. If they also fail in this respect, I don't offhand know what's best to do next, but I doubt this will happen very often, if at all, especially since $p$ and $q$ are both large primes.

One thing to note is there are relatively fast and efficient means to get the modulo results of $j^k \pmod m$ for even quite large values of $j, k$ and $m$. For example, Congruence Modulo with large exponents has a few ideas, with my suggestion being to consider a binary method, like repeated squaring and reduction, as outlined in the answer by André Nicolas, or repeated squaring & multiplication of the values corresponding to the $1$ coefficients in the binary representation of $k$.

John Omielan
  • 47,976