unRSA: solve the private key

4

Given positive integer n and e, knowing that e<n and that n is the product of two different odd primes(but the primes are not directly given to you), find such a positive integer d smaller than n that, for each integer m, (me)d ≡ m (mod n).

Your program should handle n up to 24096 in 1TB space, but not necessary reasonable time. You can assume such a d exist.

Sample Input: n=53*61=3233, e=17

Sample output: d=413

Note that your program will not be given the prime factor of n.

Shortest code in bytes win.

l4m2

Posted 2018-03-26T03:55:33.587

Reputation: 5 985

1Is n given to us via its prime factors as in the sample input? May we assume n is odd? – xnor – 2018-03-26T05:59:15.870

@xnor Challenge edited. – user202729 – 2018-03-26T09:53:13.797

(now the challenge had been clarified, there is no reason to close as unclear) – user202729 – 2018-03-26T09:53:59.607

Are we guaranteed that e>1? – xnor – 2018-03-26T10:34:44.500

@xnor Apart from making the problem trivial, is there any other problems with it? May some algorithm only work correctly with e>1 (except one that start brute-forcing at 2, but I don't think that's very special)? – user202729 – 2018-03-26T10:57:23.947

@user202729 No problems, it's was just a corner case for a golfed I was looking it. – xnor – 2018-03-26T11:01:54.313

For solutions that don't work for some special cases, just make note about that – l4m2 – 2018-03-26T16:05:08.930

1 We requires every solutions equally, or, bonuses in code-golf are bad. 2 Because the site is based on [se], having too many poorly-received questions can cause you to be question-banned, while they are not even questions. That's a limit of [se], not PPCG. 3 (about the colliding ball challenge) Putting puzzles (solve an equation) in the challenge is often discouraged, because once the first person post their answer, otherusers can just use that approach. Not to say that puzzles are always bad, however. – user202729 – 2018-03-27T00:48:44.000

Answers

3

Python 3, 77 bytes

def f(n,e):r=range(n);all(any(m-pow(m,e*d,n)for m in r)or print(d)for d in r)

Try it online!

Direct translation of the requirement. any(...) becomes false when the smallest correct d is found, and print(d) returns None, making all(...) stop running.

76 bytes, if unlimited memory is allowed

def f(n,e):r=range(n);all(any(m**(e*d)%n-m for m in r)or print(d)for d in r)

Try it online!

Bubbler

Posted 2018-03-26T03:55:33.587

Reputation: 16 616

2

Python 2, 65 bytes

n,e=input()
p=s=1
while n%~p:p+=1
while s%e:s-=p*n/~p+p
print s/e

Try it online!

Finds a prime factor p of n to obtain the order φ(n)=(p-1)(n/p-1). Then, solves the modular equation d * e % φ(n) == 1 by counting up values s of the form s = 1 + c * φ(n) until a multiple of eis obtained. Since all expressions are arithmetical without exponents, only log-space is used.

The code actually uses p to stand for one below the prime to save bytes on initialization.


Python 2, 78 bytes

lambda n,e:pow(e,F(F(n))-1,F(n))
F=lambda n:sum(k/n*k%n==1for k in range(n*n))

Try it online!

A direct expression using Dennis's totient function implementation.

xnor

Posted 2018-03-26T03:55:33.587

Reputation: 115 687

Nope, only for square-free numbers. – user202729 – 2018-03-26T11:11:36.333

1

Jelly, 5 bytes

Thanks to xnor for -2 bytes! (pointing out ÆṪ, totient function)

ÆṪæi@

Try it online!

Previously I used Æf’Pæi@ at 7 bytes.

user202729

Posted 2018-03-26T03:55:33.587

Reputation: 14 620

Let me check how sympy.ntheory.factor_.factorint and sympy.numbers.igcdex works... – user202729 – 2018-03-26T11:13:51.420

It looks like you're factoring to compute (p-1)(q-1), but would totient function ÆṪ be shorter and memory-efficient enough? – xnor – 2018-03-26T11:16:19.630

@xnor I searched for "euler" and can only find ÆE. Thanks! – user202729 – 2018-03-26T11:16:54.973

Now I should check this... | No problem, totient uses factorint internally, which uses "trial division, Pollard rho algorithm, or p-1 algorithm", all of them use polynomial memory (if I read correctly).

– user202729 – 2018-03-26T11:20:13.250

The Carmichael function Æc should also work if that's any better. – xnor – 2018-03-26T11:21:25.563

@xnor Which also uses factorint. There are no apparent benefit except the result is smaller. – user202729 – 2018-03-26T11:23:47.287