Question

An exponentiation cipher encodes a message A using a ciphertext C = Ae (mod p) where p is a prime number and e is an integer exponent. (Here A and C are also integers.) You are given integers A, C, e and p, and you would like to determine whether C is a valid ciphertext for message A.

(a) Formulate this problem as a language EC.

(b) Explain why the following algorithm for EC does not run in polynomial time: Compute Ae using e − 1 multiplications. Take the result modulo p using one integer division, and compare the answer to C.

(c) Show that EC ∈ P. Analyze the running time of your algorithm using O-notation. Hint: First, find an algorithm for the case when e is a power of 2.

Answer 1

(a) The language is the following: .

(b) The proposed solution computes using many multiplications. But the input to the problem will be given in binary. Hence, the input length will actually be .

Thus the running time in terms of the input size is . This is not a polynomial.

(c) The idea is to use repeated squaring.

For simplicity, first let . In this case, .

Thus, the value of the exponent gets halved in each iteration. Thus, the number of iterations will be . For each iteration, there is only one multiplication to perform.

Hence, the total time taken will be .

Now, in general do the following.

If is even, then use .

If is odd, then use .

This way, in each iteration, the value of the exponent gets halved, and there are at most three multiplications to perform.

Hence, the complexity is again . This is clearly polynomial time.

Comment in case of any doubts.