Tag: cryptography

One of the trends of 2010 was the proliferation of StackExchange sites. I guess by now most of us visit MathOverflow along with the arXiv daily. But, there are plenty of other StackExchange sites around that may be of interest to the mathematics-community :

“Opening a StackExchange site is damn hard. First you have to find at least 60 people interested in the site. Then, when this limit is reached, a large amount of people (in the hundreds, but it really depends on the reputation of each participant) must commit and promise to create momentum for the site, adding questions and answers. When this amount is reached, the site is open and stays in closed beta for seven days. During this time, the committers have to enrich the site so that the public beta (which starts after the first seven days) gets enough hits and participants to show a self-sustained community.” (quote from ForTheScience’s StackExchange sites proliferation, this post also contains a list of StackExchange-projects in almost every corner of Life)

The site keeping you up to date with StackExchange proposals and their progress is area51. Perhaps, you want to commit to some of these proposals

or simply browse around area51 until you find the ideal community for you to belong to…

In ONAG, John Conway proves that the symmetric version of his recursive definition of addition and multiplcation on the surreal numbers make the class On of all Cantor’s ordinal numbers into an algebraically closed Field of characteristic two : On2 (pronounced ‘Onto’), and, in particular, he identifies a subfield
with the algebraic closure of the field of two elements. What makes all of this somewhat confusing is that Cantor had already defined a (badly behaving) addition, multiplication and exponentiation on ordinal numbers.

Over the last week I’ve been playing a bit with sage to prove a few exotic identities involving ordinal numbers. Here’s one of them ($\omega$ is the first infinite ordinal number, that is, $\omega={ 0,1,2,\ldots }$),

$~(\omega^{\omega^{13}})^{47} = \omega^{\omega^7} + 1$

answering a question in Hendrik Lenstra’s paper Nim multiplication.

However, it will take us a couple of posts before we get there. Let’s begin by trying to explain what brought this on. On september 24th 2008 there was a meeting, intended for a general public, called a la rencontre des dechiffeurs, celebrating the 50th birthday of the IHES.

One of the speakers was Alain Connes and the official title of his talk was “L’ange de la géométrie, le diable de l’algèbre et le corps à un élément” (the angel of geometry, the devil of algebra and the field with one element). Instead, he talked about a seemingly trivial problem : what is the algebraic closure of $\mathbb{F}_2$, the field with two elements? My only information about the actual content of the talk comes from the following YouTube-blurb

Alain argues that we do not have a satisfactory description of $\overline{\mathbb{F}}_2$, the algebraic closure of $\mathbb{F}_2$. Naturally, it is the union (or rather, limit) of all finite fields $\mathbb{F}_{2^n}$, but, there are too many non-canonical choices to make here.

Recall that $\mathbb{F}_{2^k}$ is a subfield of $\mathbb{F}_{2^l}$ if and only if $k$ is a divisor of $l$ and so we would have to take the direct limit over the integers with respect to the divisibility relation… Of course, we can replace this by an increasing sequence of a selection of cofinal fields such as

$\mathbb{F}_{2^{1!}} \subset \mathbb{F}_{2^{2!}} \subset \mathbb{F}_{2^{3!}} \subset \ldots$

But then, there are several such suitable sequences! Another ambiguity comes from the description of $\mathbb{F}_{2^n}$. Clearly it is of the form $\mathbb{F}_2[x]/(f(x))$ where $f(x)$ is a monic irreducible polynomial of degree $n$, but again, there are several such polynomials. An attempt to make a canonical choice of polynomial is to take the ‘first’ suitable one with respect to some natural ordering on the polynomials. This leads to the so called Conway polynomials.

Conway polynomials for the prime $2$ have only been determined up to degree 400-something, so in the increasing sequence above we would already be stuck at the sixth term $\mathbb{F}_{2^{6!}}$…

So, what Alain Connes sets as a problem is to find another, more canonical, description of $\overline{\mathbb{F}}_2$. The problem is not without real-life interest as most finite fields appearing in cryptography or coding theory are subfields of $\overline{\mathbb{F}}_2$.

(My guess is that Alain originally wanted to talk about the action of the Galois group on the roots of unity, which would be the corresponding problem over the field with one element and would explain the title of the talk, but decided against it. If anyone knows what ‘coupling-problem’ he is referring to, please drop a comment.) Surely, Connes is aware of the fact that there exists a nice canonical recursive construction of $\overline{\mathbb{F}}_2$ due to John Conway, using Georg Cantor’s ordinal numbers.

In fact, in chapter 6 of his book On Numbers And Games, John Conway proves that the symmetric version of his recursive definition of addition and multiplcation on the surreal numbers make the class $\mathbf{On}$ of all Cantor’s ordinal numbers into an algebraically closed Field of characteristic two : $\mathbf{On}_2$ (pronounced ‘Onto’), and, in particular, he identifies a subfield

$\overline{\mathbb{F}}_2 \simeq [ \omega^{\omega^{\omega}} ]$

with the algebraic closure of $\mathbb{F}_2$. What makes all of this somewhat confusing is that Cantor had already defined a (badly behaving) addition, multiplication and exponentiation on ordinal numbers. To distinguish between the Cantor/Conway arithmetics, Conway (and later Lenstra) adopt the convention that any expression between square brackets refers to Cantor-arithmetic and un-squared ones to Conway’s. So, in the description of the algebraic closure just given $[ \omega^{\omega^{\omega}} ]$ is the ordinal defined by Cantor-exponentiation, whereas the exotic identity we started out with refers to Conway’s arithmetic on ordinal numbers.

Let’s recall briefly Cantor’s ordinal arithmetic. An ordinal number $\alpha$ is the order-type of a totally ordered set, that is, if there is an order preserving bijection between two totally ordered sets then they have the same ordinal number (or you might view $\alpha$ itself as a totally ordered set, namely the set of all strictly smaller ordinal numbers, so e.g. $0= \emptyset,1= { 0 },2={ 0,1 },\ldots$).

For two ordinals $\alpha$ and $\beta$, the addition $[\alpha + \beta ]$ is the order-type of the totally ordered set $\alpha \sqcup \beta$ (the disjoint union) ordered compatible with the total orders in $\alpha$ and $\beta$ and such that every element of $\beta$ is strictly greater than any element from $\alpha$. Observe that this definition depends on the order of the two factors. For example,$[1 + \omega] = \omega$ as there is an order preserving bijection ${ \tilde{0},0,1,2,\ldots } \rightarrow { 0,1,2,3,\ldots }$ by $\tilde{0} \mapsto 0,n \mapsto n+1$. However, $\omega \not= [\omega + 1]$ as there can be no order preserving bijection ${ 0,1,2,\ldots } \rightarrow { 0,1,2,\ldots,0_{max} }$ as the first set has no maximal element whereas the second one does. So, Cantor’s addition has the bad property that it may be that $[\alpha + \beta] \not= [\beta + \alpha]$.

The Cantor-multiplication $\alpha . \beta$ is the order-type of the product-set $\alpha \times \beta$ ordered via the last differing coordinate. Again, this product has the bad property that it may happen that $[\alpha . \beta] \not= [\beta . \alpha]$ (for example $[2 . \omega ] \not=[ \omega . 2 ]$). Finally, the exponential $\beta^{\alpha}$ is the order type of the set of all maps $f~:~\alpha \rightarrow \beta$ such that $f(a) \not=0$ for only finitely many $a \in \alpha$, and ordered via the last differing function-value.

Cantor’s arithmetic allows normal-forms for ordinal numbers. More precisely, with respect to any ordinal number $\gamma \geq 2$, every ordinal number $\alpha \geq 1$ has a unique expression as

$\alpha = [ \gamma^{\alpha_0}.\eta_0 + \gamma^{\alpha_1}.\eta_1 + \ldots + \gamma^{\alpha_m}.\eta_m]$

for some natural number $m$ and such that $\alpha \geq \alpha_0 > \alpha_1 > \ldots > \alpha_m \geq 0$ and all $1 \leq \eta_i < \gamma$. In particular, taking the special cases $\gamma = 2$ and $\gamma = \omega$, we have the following two canonical forms for any ordinal number $\alpha$

$[ 2^{\alpha_0} + 2^{\alpha_1} + \ldots + 2^{\alpha_m}] = \alpha = [ \omega^{\beta_0}.n_0 + \omega^{\beta_1}.n_1 + \ldots + \omega^{\beta_k}.n_k]$

with $m,k,n_i$ natural numbers and $\alpha \geq \alpha_0 > \alpha_1 > \ldots > \alpha_m \geq 0$ and $\alpha \geq \beta_0 > \beta_1 > \ldots > \beta_k \geq 0$. Both canonical forms will be important when we consider the (better behaved) Conway-arithmetic on $\mathbf{On}_2$, next time.

I couldn’t believe my eyes. I was watching an episode of numb3rs, ‘undercurrents’ to be precise, and there it was, circled in the middle of the blackboard, CEILIDH, together with some of the key-exchange maps around it… Only, the plot doesn’t involve any tori-crypto… okay, there is an I-Ching-coded-tattoo which turns out to be a telephone number, but that’s all. Still, this couldn’t just be a coincidence. Googling for ‘ceilidh+numbers‘ gives as top hit the pdf-file of an article Alice in NUMB3Rland written by … Alice Silverberg (of the Rubin-Silverberg paper starting tori-cryptography). Alice turns out to be one of the unpaid consultants to the series. The 2-page article gives some insight into how ‘some math’ gets into the script

Typically, Andy emails a draft of the
script to the consultants. The FBI plot
is already in place, and the writers want
mathematics to go with it. The placeholder “math” in the draft is often nonsense or
jargon; the sort of things people with no
mathematical background might find by
Googling, and think was real math. Since
there’s often no mathematics that makes
sense in those parts of the script, the best
the consultants can do is replace jargon
that makes us cringe a lot with jargon that
makes us cringe a little.

From then on, it’s the Telephone Game.
The consultants email Andy our suggestions (“replace ‘our discrete universes’
with ‘our disjoint universes'”; “replace
the nonsensical ‘we’ve tried everything
-a full frequency analysis, a Vignere
deconstruction- we even checked for
a Lucas sequence’ with the slightly less
nonsensical ‘It’s much too short to try
any cryptanalysis on. If it were longer
we could try frequency analyses, or try
to guess what kind of cryptosystem it is
and use a specialized technique. For example, if it were a long enough Vigenere
cipher we could try a Kasiski test or an
index-of-coincidence analysis’). Andy
chooses about a quarter of my sugges-
tions and forwards his interpretation
of them to the writers and producers.
The script gets changed, and then the
actors ad lib something completely dif-
ferent (‘disjointed universes’: cute, but
loses the mathematical allusion; ‘Kasiski
exam’ : I didn’t mean that kind of ‘test’).

She ends her article with :

I have mixed feelings about NUMB3RS. I still have concerns about the violence, the depiction of women, and the pretense
that the math is accurate. However, if NUMB3RS could interest people in the power of mathematics enough for society
to greater value and support mathematics teaching, learning, and research, and
motivate more students to learnthat would be a positive step.

Further, there is a whole blog dedicated to some of the maths featuring in NUMB3RS, the numb3rs blog. And it was the first time I had to take a screenshot of a DVD, something usually off limits to the grab.app, but there is a simple hack to do it… You may not have noticed, but the really hard work was done behind the scenes, resurrecting about 300 old posts (some of them hidden by giving them ‘private’-status). Ive only deleted about 10 posts with little or no content and am sorry I’ve self-destructed about 20-30 hectic posts over the years by pressing the ‘delete post’ button. I would have liked to reread them after all the angry mails Ive received. But, as Ive defended myself at the time, and as I continue to do today, a blog only records feelings at a specific moment. Often, the issue is closed for me once Ive put my frustrations in a post, and then Ill forget all about it. Sadly, the gossip-circuit in noncommutative circles is a lot, a lot, slower than my mood swings, so by the time people complain it’s no longer an issue for me and I tend to delete the post altogether. A blog really is a sort of diary. For example, it only struck me now, rereading the posts of the end of 2006, beginning of 2007, how depressed I must have been at the time. Fortunately, life has improved, somewhat… Still, after all these reminiscences, the real issue is : what comes next?

Some of you may have noticed that I’ve closed the open series on tori-cryptography and on superpotentials in a rather abrupt manner. It took me that long to realize that none of you is waiting for this kind of posts. You’re thinking : if he really wants to show off, let him do his damned thing on the arXiv, a couple of days a year, at worst, and then we can then safely ignore it, like we do with most papers. Isnt’t that true? Of course it is…

So, what are you waiting for? Here’s what I believe to be a sensible thing to try out. Over the last 4 years I must have posted well over 50 times what I believe noncommutative geometry is all about, so if you still don’t know, please consult the archive, I fear I can only repeat myself. Probably, it is more worthwhile to reach out to other approaches to noncommutative geometry, trying to figure out what, if anything, they are after, without becoming a new-age convert (‘connes-vert’, I’d say). The top-left picture may give you an inkling of what I’m after… Besides, Im supposed to run a ‘capita selecta’ course for third year Bachelors and Ive chosen to read with them the book The music of the primes and to expand on the mathematics hinted only at in the book. So, I’ll totally immerse myself in Connes’ project to solve the Riemann-hypothesis in the upcoming months.

Again, rereading old posts, it strikes me how much effort I’ve put into trying to check whether technology can genuinely help mathematicians to do what they want to do more efficiently (all post categorized as iMath). I plan some series of posts re-exploring these ideas. The first series will be about the overhyped Web-2 thing of social-bookmarking. So, in the next weeks I’ll go undercover and check out which socialsites are best for mathematicians (in particular, noncommutative geometers) to embrace…

Apart from these, admittedly vague, plans I am as always open for suggestions you might have. So, please drop a comment..

Last time we have seen that tori are dual (via their group of characters) to lattices with a Galois action. In particular, the Weil descent torus $R_n=R^1_{\mathbb{F}_{p^n}/\mathbb{F}_p} \mathbb{G}_m$ corresponds to the permutation lattices $R_n^* = \mathbb{Z}[x]/(x^n-1)$. The action of the generator $\sigma$ (the Frobenius) of the Galois group $Gal(\mathbb{F}_{p^n}/\mathbb{F}_p)$ acts on the lattice by multiplication with $x$.

An old result of Masuda (1955), using an even older lemma by Speiser (1919), asserts than whenever the character-lattice $T^*$ of a torus $T$ is a permutation-lattice, the torus is rational, that is, the function-field
of the torus $\mathbb{F}_p(T)$ is purely trancendental

$\mathbb{F}_p(y_1,\ldots,y_d) = \mathbb{F}_p(T) = (\mathbb{F}_{q^n}(T^*))^{Gal}$

(recall from last time that the field on the right-hand side is the field of fractions of the $Gal$-invariants of the group-algebra of the free Abelian group $T^* = \mathbb{Z} \oplus \ldots \oplus \mathbb{Z}$ where the rank is equal to the dimension $d$ of the torus).

The basic observation made by Rubin and Silverberg was that the known results on crypto-compression could be reformulated in the language of algebraic tori as : the tori $T_2$ (LUC-system) and $T_6$ (CEILIDH-system) are rational! So, what about the next cryptographic challenges? Are the tori $T_{30}$, $T_{210}$ etc. also rational varieties?

Recall that as a group, the $\mathbb{F}_p$-points of the torus $T_n$, is the subgroup of $\mathbb{F}_{p^n}^*$ corresponding to the most crypto-challenging cyclic subgroup of order $\Phi_n(p)$ where $\Phi_n(x)$ is the n-th cyclotomic polynomial. The character-lattice of this crypto-torus $T_n$ we call the crypto-lattice and it is

$T_n^* = \mathbb{Z}[x]/(\Phi_n(x))$

(again the action of the Frobenius is given by multiplication with $x$) and hence has rank $\phi(n)$, explaining that the torus $T_n$ has dimension $\phi(n)$ and hence that we can at best expect a compression from $n$-pits to $\phi(n)$-pits. Note that the lattice $T_n^*$ is no longer a permutation lattice, so we cannot use the Masuda-Speiser result to prove rationality of $T_n$.

What have mathematicians proved on $T_n$ before it became a hot topic? Well, there is an old conjecture by V. E. Voskresenskii asserting that all $T_n$ should be rational! Unfortunately, he could prove this only when $n$ is a prime power. Further, he proved that for all $n$, the lattice $T_n$ is at least stably-rational meaning that it is rational upto adding free parameters, that is

$\mathbb{F}_p(T_n)(z_1,\ldots,z_l) = \mathbb{F}_p(y_1,\ldots,y_{d+l})$

which, sadly, is only of cryptographic-use if $l$ is small (see below). A true rationality result on $T_n$ was proved by A.A. Klyashko : $T_n$ is rational whenever $n=p^a.q^b$ a product of two prime powers.But then, $30=2 \times 3 \times 5$ the first unknown case…

At Crypto 2004, Marten van Dijk and David Woodruff were able to use an explicit form of Voskresenskii stable rationality result to get an asymptotic optimal crypto-compression rate of $n/\phi(n)$, but their method was of little practical use in the $T_{30}$, for what their method gave was a rational map

$T_{30} \times \mathbb{A}^{32}_{\mathbb{F}_p} \rightarrow \mathbb{A}^{40}_{\mathbb{F}_p}$

and the number of added parameters (32) is way too big to be of use.

But then, one can use century-old results on cyclotomic polynomials to get a much better bound, as was shown in the paper Practical cryptography in high dimensional tori by the collective group of all people working (openly) on tori-cryptography. The idea is that whenever q is a prime and a is an integer not divisible by q, then on the level of cyclotomic polynomials we have the identity

$\Phi_{aq}(x) \Phi_a(x) = \Phi_a(x^q)$

On the level of tori this equality implies (via the character-lattices) an ismorphism (with same assumptions)

$T_{aq}(\mathbb{F}_p) \times T_a(\mathbb{F}_p) \simeq (R^1_{\mathbb{F}_{p^q}/\mathbb{F}_p} T_a)(\mathbb{F}_p) = T_a(\mathbb{F}_{p^q})$

whenever aq is not divisible by p. Apply this to the special case when $q=5,a=6$ then we get

$T_{30}(\mathbb{F}_p) \times T_6(\mathbb{F}_p) \simeq R^1_{\mathbb{F}_{p^5}/\mathbb{F}_p} T_6(\mathbb{F}_p)$

and because we know that $T_6$ is a 2-dimensional rational torus we get, using Weil descent, a rational map

$T_{30} \times \mathbb{A}^2_{\mathbb{F}_p} \rightarrow \mathbb{A}^{10}_{\mathbb{F}_p}$

which can be used to get better crypto-compression than the CEILIDH-system!

This concludes what I know of the OPEN state of affairs in tori-cryptography. I’m sure ‘people in hiding’ know a lot more at the moment and, if not, I have a couple of ideas I’d love to check out. So, when I seem to have disappeared, you know what happened…