Field theory is an important subdiscipline of cryptography that helps us determine fundamental abstract relationships between symbol sets and mappings. In this class, we will use field theory primarily to demonstrate the utility of encryptions, and as background for cryptanalysis.
In this section, we present an introduction to Galois fields, also called finite fields. The crux of this presentation is that all finite fields can be generated by (a) constructing the ring of polynomials over a prime ground field and (b) by the choice of an irreducible polynomial of appropriate degree. There are many choices for irreducible polynomials, namely, O(pn-1) for a given p and n. This large polynomial space has yet to be explored extensively in the open literature of cryptology.
Additionally, the study of structural requirements of two operations related by distributivity, as well as the difficulty of solving even small inversion problems inside small fields, leads directly to the development of functions whose inversion is not tractable. This has direct application in public key cryptosystems.
For those who are mathematically inclined, a more detailed summary of finite fields is given in [Lid83]. Much of the development of this section is a corrected and elaborated version of Patterson [Pat87], to which the reader is referred for an interesting (but notationally ambiguous) overview. We will follow the general development given by Patterson, which demonstrates the key structure theorem for finite fields.
Example. F = Z with addition (· = +) having identity e = 0, where f-1 = -f.
Example. F = Zn with addition
(· = +) taken modulo n, identity e = 0, and inverse
f-1 = n - f. Thus,
a+b 0 (resulting from mod n).
Example. Let F = Zp \ {0}, a prime number p, and a group G = (F,·) with the operation · taken modulo p. Observe that:
f · g · h = f · g · h,
f,g,h
F.
f · f-1 = e,
f
F.
Observation. If F = Zm \ {0}
and m is not prime, then there exists some x,y
F such that x and
y have the same inverse. The proof is left as an
exercise to the reader.
Remark. The reals with multiplication (R, ·) are not a group, because zero has no multiplicative inverse. However, (R\{0}, ·) and (R+, ·) are groups.
Definition. A subgroup G'
=
(G,·) of a group G = (F,·)
is a group such that
GF.
Example. (Q,·) is a subgroup of (R\{0},·) .
Example. (Z,+) is a subgroup of (Q,+).
Example. An onto mapping M: {1,2,3} -> {1,2,3} is exemplified by the graph G(M) = {(1,3), (1,2), (2,1)}.
Remark. It follows that, if M is an onto mapping, then p2(G(M)) = range(M), where p2 denotes projection onto the second coordinate.
Definition. A one-to-one mapping M : S -> S maps a given element of S to one and only one element of S.
Example. A one-to-one mapping M: {1,2,3} -> {1,2,3} is exemplified by the graph G(M) = {(1,3), (3,2), (2,1)}.
Definition. A bijection on F is a one-to-one and onto mapping.
Example. Let S = {a,b,c} and T = {1,2,3}. A bijection f: S -> T could have the graph G(f) = {(a,1),(b,3),(c,2)}. The mapping is one-to-one, i.e., each element of S maps uniquely to an element of T. Additionally, f is onto, since |G(f)| = |T|.
Example. Let S = {a,b,c} and T = {1,2,3}. Let f: S -> T have the graph G(f) = {(a,1),(b,1),(c,2)}. The mapping is not one-to-one, since two elements of S (a and b) map to the same element of T, namely, 1.
Example. Let S = {a,b,c} and T = {1,2,3,4}. The mapping f: S -> T cannot be a bijection, since the condition |T| > |S| obviates the onto property.
Definition. A permutation is a bijection. Example. Let S = {a,b,c} and let a = (a,c,b). If f is a permutation on S, then f(a) could have as its result (a,b,c) but not (a,a,c).
Definition. Let A be a set with n members, and let
S = { |
: A -> A }
denote a set of permutations on A.
Observation. G = (S,o) is a group, where o denotes functional composition.
One can prove the group properties of G, as follows:
Remark. The set of all permutations on F, denoted by SF, is called a symmetric group, since
Remark. SF is important in group and field theory, since every group is contained in some permutation group.
We next discuss fields, with emphasis upon the finite discrete case (i.e., Galois fields).
Definition. A field F = (F,+,·) contains a set F with two binary operations +,· : F × F -> F, such that:
f · (g + h) = (f · g) + (f · h),
f,g,h
F .
Example. F = Zn, where n is a prime with + and · taken modulo n.
f · (g + h) = (f · g) + (f · h),
(g + h) · f = (g · f) + (h · f),
f,g,h
F ,
Remark. F need not contain an inverse under ·. For example, the operation of multiplication does not have an inverse with respect to the zero element in (R,·).
Example. The integers (Z,+,·) form a ring.
Example. A field (F,+,·) is a ring.
f = e · f = f · e,
f
F .
Definition. A ring (F,+,·) is called a commutative ring if the operation · is commutative.
Definition. An element
fF
of a ring R = (F,+,·) is called a unit
if
f
'
F such that
f · f'
= f'
· f = e,
where e denotes the identity of F with respect to operation
· . The set of all f'
in R
form a group, called the group of units.
Definition. A division ring R =
(F,+,·) with identity IF under the operation · satisfies the following condition:
f · g = g · f,
f
0
I, g
I .
Thus, the group of units in R = F\{0}.
Observation. If R = (F,+,·) is a commutative division then R is a field.
Definition. A finite integral domain is an integral domain whose set is finite.
Theorem 1. Every finite integral domain R = (F,+,·) is a field.
Definition. A subring R'
=
(G,+,·) of a ring R = (F,+,·)
is a ring such that
GF and
(G,+) is a subgroup of (F,+).
Definition. A subring R'
=
(G,+,·) of R = (F,+,·) is called
an ideal or two-sided ideal if
f · g = g · f,
f
F,
g
G.
If f · g (or g · f) is in F, then R'
is called a left (right) ideal. However, this
distinction is moot in commutative rings, which are two-sided ideals.
Definition. Given a ring (R,+,·) and an element
rR, the symbol (r)
denotes an ideal
(r) = {r'
·r + n·r : r'
R,
n
Z} .
Note that (r) is called a principal ideal generated by r.
Definition. An ideal R'
partitions
the set F in a ring R = (F,+,·) into
disjoint residue classes denoted by
R/R'
.
Theorem 2. If R = (F,+,·) is a ring with
ideal R'
= (G,+,·), then
R/R'
forms a ring with operations
(f + G) + (g + G) = f + g + G and
(f + G) · (g + G) = f · g + G ,
f,gF.
Figure 1. Algebraic Structures with Binary Operations.
Theorem 3. Let pZ
be prime and let Z = (Z,+,·). The residue classes
Z/p form a field denoted by Zp.
(f + k1(p)) · (g + k2(p)) = 0 + k3(p).
Thus, fg = (k3 - k1g - k2f)
· p, which means that f or g divides p. Let f divide p
and let k4Z.
Then, a = k4p and
a + (p) = 0 + (p) ,
which is a contradiction. Thus, Zp is an
integral domain.
Theorem 4. If R is a nonzero ring with
then R has prime characteristic.
0 - n · 1 = km · 1 = (k · 1) · (m · 1),
which implies k · 1 = 0 or m · 1 = 0, since there exists
no zero divisors of n. This further implies k · 1 · f =
0 or m · 1 · f = 0,
f
F. Thus,
char(R) < n, a contradiction. Therefore n must
not be factorable, so n is prime.
Theorem 5. Finite fields have prime characteristic.
Definition. A maximal ideal I of ring R = (F,+,·) exists if
Definition. A ring R is a principal ideal domain (PID) if R is an integral domain and every ideal of R is a principal ideal.
Theorem 6. If R = (F,+,·) is a commutative ring with identity and ideals I,J, then the following statements hold:
(a + M) · (f + M) = a f + M = (1-m) + M = 1 + M,
which implies that R/M is a field.
(1, only-if part): Let I
M and I
M be an ideal of
R. For a
I\M, a + M has
an inverse, since R/M is a field. Thus,
(a + M) · (r + M) = 1 + M
implies af+m = 1 for some mM,
which further implies that 1
I.
If the preceding statements hold, then I = F and M is a
maximal ideal of R.
(2, if part): Assume that P is a prime ideal of
R. Then R/P is a commutative ring with identity
and 1 + P 0 + P.
If R/P is not an integral domain and
(f + P) · (g + P) = 0 + P, then if
fg
P, where
f,g
F, either
f
P or
g
P. This implies that
R/P has no divisors. Therefore, R/P is an
integral domain.
(2, only-if part): If R/P is an integral
domain and fgP, then
(f + P) · (g + P) = 0 + P. Since R/P is an integral
domain, either (f + P) = 0 + P or (g + P) = 0 + P. Thus, if either
f
P or
g
P, then P is a prime ideal.
(3,4): follow from Parts 1 & 2 and the preceding theorems.
F[x] = {f(x): f(x) = f0 +
fi· xi,
f0,fi
F} .
Definition. The highest nonzero coefficient fn of a
polynomial f(x) is called the leading coefficient, and
f is called the constant term. The degree
of a polynomial whose leading coefficient is fn is n.
If the leading coefficient is an element of the ring
P = (F[x],+,·), then f(x) is said to be
monic.
Definition. Given polynomials f(x) =
h(x) = f(x) + g(x)
=
where k =
r =
with l =
Definition. Given multiplication over monomials expressed as
fxm · gxn = f·g·xm+n ,
multiplication over polynomials of equal degree follows from the
distributive property as
%%%LEFT OFF HERE%%%
fi·
xi, fi
F and
gi·
xi, gi
F, polynomial addition is defined as
(fi + gi) · xi + r ,
(m,n) and
gi · xi
(m,n) if m > n,
and symmetrically (using f instead of g) if m < n.
[Lid83] Lidl, R. and H. Niederreiter. "Finite Fields", in Encyclopedia of Mathematics, Reading, MA: Addison-Wesley (1983).
[Pat87] Patterson, W. Mathematical Cryptology for Computer Scientists and Mathematicians, Totowa, NJ:Rowan and Littlefield (1987).
This concludes our discussion of basic field theory. More involved concepts will be defined when they are introduced in theory development.