1

I read about the Diffie-Hellman Algorithm in cryptography in which we choose a natural number $g\in\{0,\ldots p-1\}$ for a prime number $p$. Then two other natural numbers $a$ and $b$ are chosen. In the first step the numbers $$A=g^a\bmod p\\ B=g^b\bmod p$$ are computed. Notice that this is not a congruence, but instead the modulus of the division. (I will denote congruences with the usual '$\equiv'$)

Then $$ K_{1}:=B^{a}\bmod p\stackrel{(*)}{=}(g^{b}\bmod p)^{a} \bmod p=(g^{b})^{a}\bmod p=g^{ba}\bmod p$$ and $${\displaystyle K_{2}:=A^{b}\bmod p=(g^{a}\bmod p)^{b}\bmod p=(g^{a})^{b}\bmod p=g^{ab}\bmod p}$$ and therefore $K_1=K_2$. We will not discuss the cryptographical meaning of this, just take it as equations as they stand. In $(*)$ it is used that for a prime $p$ we have elementary multiplication e.g. ${\displaystyle \left((3{\bmod {5}})\cdot (3{\bmod {5}})\right){\bmod {5}}=9{\bmod {5}}}$

As I know this does not hold for non prime integers.

Now here is the thing that confused me: When I use congruence notation we have $$A\equiv g^a\ \pmod p\\B\equiv g^b\pmod p$$

It follows by elemtary properties of the congruence relation that $$A^b\equiv g^{ab}\pmod p$$

and likewise for $B^a$. We then get $K_1\equiv K_2$. This is not equivalent to the statement before where we got equality, but it does not rely on that the modulus has to be prime.

Now in cryptographical terms I don't think this would be of concern since I can choose the smallest modulus or make it unique in a similar way.

Is what I wrote mathematically correct? Is "the price to pay for equality" that we have to consider a prime modulus? Why does the Diffie-Hellman algorithm rely on choosing a prime number as modulus?

Bill Dubuque
  • 272,048
EpsilonDelta
  • 2,079
  • 1
    You seem to think of modulo as an operation. And in practice, when actually doing calculations, that may be convenient. But in my opinion, for theoretical work and learning the concepts, thinking of it as a relation is vastly superior. – Arthur Apr 09 '20 at 19:53
  • You don't actually need it to be prime. But to break DH, one needs to solve the discrete log problem. And discrete logs are easier for smaller numbers. If the modulus is $n = pq$ and one is capable of factoring $n$ to figure out $p$ and $q$, then one can solve the (much easier) discrete log problems mod $p$ and mod $q$ and reassemble the answer. Thus this adds a potential break with little added benefit. – davidlowryduda Apr 09 '20 at 19:59
  • I updated you question to use standard number theory notation so as to avoid the common confusion between mod as an operator vs. congruence relation (see the final link in my answer for more on that). – Bill Dubuque Apr 09 '20 at 21:33
  • While searching for background links I noticed it's a dupe, so please see the prior question too. – Bill Dubuque Apr 09 '20 at 21:37
  • @davidlowryduda Could you elaborate on that? If the modulus is $p$ I can solve the discrete log problem for mod $p$. How is that a disadvantage to using $n$? And what if $n$ cannot be factored in just 2 elements? – EpsilonDelta Apr 09 '20 at 22:47

1 Answers1

0

By inductive extension of the Congruence Sum, Product and Power operation rules it follows the value of a polynomial expression is preserved (stays congruent) if we replace arguments of said constituent operations by congruent arguments (only for the base (vs. expt) in powers). Therefore, in particular, we can replace $\,g^a\,$ by $\,g^a\bmod p\,$ and $\,g^b\,$ by $\,g^b\bmod p\,$ in $\,(g^a)^b = (g^b)^a\,$ to get

$$\begin{align} (g^a\bmod p)^b&\equiv\, (g^b\bmod p)^a\!\!\pmod{\!p},\ \ \text{so taking remainders}\\[.3em] \color{#c00}\Longrightarrow\ \ (g^a\bmod p)^b\bmod p \,&=\, (g^b\bmod p)^a\bmod p \end{align}$$

because $\,\ a\equiv b\pmod{\!p}\,\color{#c00}{\Longrightarrow}\, a\bmod p\, =\, b\bmod p\,\ $ [and conversely]

Remark $\ $ Generally, as above, it is straightforward to prove properties of the mod operator by first converting to congruence form, then applying the simpler arithmetical laws of congruences then, finally, converting back to mod operator form by taking remainders (normal forms) as the last step. While it is possible to perform such proofs without congruences, generally that will be messier, and less conceptual.

See here for background on the distinction between mod as an operator vs. congruence relation.

Bill Dubuque
  • 272,048
  • Do you see any reason why the algorithm chooses $p$ prime instead of an arbitrary $n$ as modulus? Because as you stated, the argument is not dependent on the modulus being a prime number. – EpsilonDelta Apr 09 '20 at 22:48
  • 1
    @EpsilonDelta The Diffie-Helman scheme is in a finite cyclic group, and $,\Bbb Z_n$ is group $\iff n,$ is prime. See also the same question on Crypt.SE. – Bill Dubuque Apr 09 '20 at 23:33