\documentclass[letterpaper,11pt]{article}
\input{latexdefs}

\begin{document}
\makeheader{Number Theory and Algebra Fact Sheet}

\subsection*{Groups}
\begin{itemize}
  \item A group $(\G, \star)$ consists of a group $\G$ together with an operation
  $\star$ with the following properties:
  \begin{itemize}
    \item {\bf Closure:} If $g, h \in \G$, then $g \star h \in \G$.

    \item {\bf Associativity:} For all $g, h, k \in \G$, $g \star (h \star k) = (g \star h) \star k$.

    \item {\bf Identity:} There exists an (unique)
    element $e \in \G$ such that for all $g \in \G$, $e \star g = g = g \star e$.

    \item {\bf Inverse:} For every element $g \in \G$, there exists an (unique) element
    $h \in \G$ where $g \star h = e = h \star g$.
  \end{itemize}

  \item A group $(\G, \star)$ is {\bf commutative} (or {\em abelian}) if for all $g, h \in \G$,
  $g \star h = h \star g$.

  \item {\bf Notation:} Unless otherwise noted, we will denote the group operation
  by `$\cdot$' (i.e., multiplicative notation). If $g, h \in \G$, we write
  $gh$ to denote $g \cdot h$. For a group element $g \in \G$,
  we write $g^{-1}$ to denote the inverse of $g$. We write $g^0$ and $1$
  to denote the identity element. For a positive integer
  $k$, we write $g^k$ to denote
  \[ g^k \deq \underbrace{g \cdot g \cdots g}_{k \text{ copies}}. \]
  For a negative integer $k$, we write $g^{-k}$ to denote $(g^k)^{-1}$.

  \item A group $\G$ is {\em cyclic} if there exists a {\em generator}
  $g$ such that $\G = \set{g^0, \ldots, g^{\abs{\G} - 1}}$.

  \item For an element $g \in \G$, we write $\langle g \rangle \deq \set{g^0, g^1, \ldots, g^{\abs{\G}} - 1}$
  to denote the {\em subgroup generated by $g$}.
  The {\em order} $\text{ord}(g)$ of $g$ in $\G$ is the size of the subgroup
  generated by $g$: $\text{ord}(g) \deq \abs{\langle g \rangle}$.
  The order of the group $\G$ is the size of the group:
  $\text{ord}(\G) = \abs{\G}$.

  \item {\bf Lagrange's theorem:} For a group $\G$ and any element $g \in \G$,
  the order of $g$ divides the order of the group:
  $\text{ord}(g) \mid \abs{\G}$.

  \item If $\G$ is a group of prime order, then $\G = \langle g \rangle$
  for every $g \ne 1$ (i.e., every non-identity element of a prime-order group
  is a generator).
\end{itemize}

\subsection*{The Groups $\Z_n$ and $\Z_n^*$}
\begin{itemize}
  \item We write $\Z_n$ to denote the group of integers $\Z_n \deq \set{0, 1, \ldots n -1}$
  under addition modulo $n$.

  \item We write $\Z_n^*$ to denote the group of integers
  $\Z_n^* \deq \set{x \in \Z_n : (\exists y \in \Z_n : x y = 1 \bmod n)}$
  under multiplication modulo $n$.

  \item {\bf Bezout's identity:} For all integers $x, y \in \Z$, there exists integers
  $s, t \in \Z$ such that $xs + yt = \gcd(x, y)$.
  \begin{itemize}
    \item Given $x, y$, computing $s, t$ can be computed in time
    $O\left( \log \abs{x} \cdot \log \abs{y} \right)$
    using the {\em extended Euclidean algorithm}.

    \item An element $x \in \Z_n$ is invertible if and only if $\gcd(x, n) = 1$.
    This gives an equivalent characterization of $\Z_n^*$:
    $\Z_n^* = \set{x \in \Z_n : \gcd(x, n) = 1}$. Computing an inverse
    of $x \in \Z_n^*$ can be done efficiently via the extended Euclidean algorithm.

    \item For prime $p$, the group $\Z_p^* = \set{1, 2, \ldots, p - 1}$.
    The order of $\Z_p^*$ is $\big| \Z_p^* \big| = p - 1$. In particular
    $\Z_p^*$ is {\em not} a group of prime order (whenever $p > 3$).
    Computing the order of an element $g \in \Z_p^*$ is efficient if the
    factorization of the group order (i.e., $p - 1$)l is known.
  \end{itemize}

  \item For a positive integer $n$, {\em Euler's phi function} (also called {\em Euler's
  totient function}) is defined to be the number of integers $1 \le x \le n$
  where $\gcd(x, n) = 1$. In particular, $\varphi(n)$ is the order of $\Z_n^*$.
  If $p_1^{k_1} p_2^{k_2} \cdots p_{\ell}^{k_\ell}$ is the prime factorization of $n$,
  then
  \begin{align*}
    \varphi(n) = n \cdot \prod_{i \in [\ell]} \left( 1 - \frac{1}{p_i} \right)
               = \prod_{i \in [\ell]} p_i^{k_i - 1}(p_i - 1).
  \end{align*}

  \item Special cases of Lagrange's theorem:
  \begin{itemize}
    \item {\bf Fermat's theorem:} For prime $p$ and $x \in \Z_p^*$, $x^{p - 1} = 1 \pmod p$.

    \item {\bf Euler's theorem:} For a positive integer $n$ and $x \in \Z_n^*$, $x^{\varphi(n)} = 1 \pmod n$.
  \end{itemize}
\end{itemize}

\subsection*{Operations over Groups}
\begin{itemize}
  \item Let $n$ be a positive integer. Take any $x, y \in \Z_n$.
  The following operations can be performed efficiently
  (i.e., in time $\poly(\log n)$):
  \begin{itemize}
    \item Sampling a random element $r \getsr \Z_n$.

    \item Basic arithmetic operations: $x + y \pmod n, x - y \pmod n, xy \pmod n, x^{-1} \pmod n$.
    These operations suffice to solve linear systems.

    \item Exponentiation: Computing $x^k \pmod n$ can be done in $\poly(\log n, \log k)$ time using
    repeated squaring.
  \end{itemize}

  \item Suppose $N = pq$ where $p, q$ are two large primes. Let $x \in \Z_n$.
  Then, the following problems are believed to be hard:
  \begin{itemize}
    \item Finding the prime factors of $N$. This is equivalent to the problem 
    of computing $\varphi(N)$.

    \item Computing an $\ord{e}$ root of $x$ where $\gcd(N, e) = 1$ (i.e., a value
    $y$ such that $x^e = y \bmod N$).
  \end{itemize}

  \item Let $\G$ be a group of prime order $p$ with generator $g$.
  We often consider the following computational problems over $\G$:
  \begin{itemize}
    \item {\bf Discrete logarithm:} Given $(g, h)$ where $h = g^x$ and $x \getsr \Z_p$,
    compute $x$.

    \item {\bf Computational Diffie-Hellman (CDH):} Given $(g, g^x, g^y)$ where $x, y \getsr \Z_p$,
    compute $g^{xy}$.

    \item {\bf Decisional Diffie-Hellman (DDH):} Distinguish between $(g, g^x, g^y, g^{xy})$
    and $(g, g^x, g^y, g^r)$ where $x, y, r \getsr \Z_p$.
  \end{itemize}
\end{itemize}

\end{document}
