This morning I attended Martin Hellman’s stimulating keynote address at the 2013 Georgia Tech Cyber Security Summit. Martin Hellman is the co-inventor, with Whitfield Diffie, of the Diffie-Hellman Key Exchange Protocol, which began the (public) public-key cryptography revolution.  Among the interesting things I learned during Martin Hellman’s talk are:

1. Hellman feels that Ralph Merkle deserves equal credit for inventing public-key cryptography and refers to his own invention as the Diffie-Hellman-Merkle key exchange protocol.  (Merkle was the director of the Georgia Tech Information Security Center from 2003-2006.)

2. Hellman came up with the famous “double padlock” thought experiment after the invention of the Diffie-Hellman-Merkle key exchange protocol, as a way to explain it to others.  The mathematics came first.  (I had always wondered about this.)

3. Most interestingly, Hellman said that he got the idea to use modular exponentiation/discrete logarithms as a “one-way function” from the engineer and mathematician John Gill (who I never heard of before this morning).  John Gill’s other suggestion was to use multiplication/factoring, which forms the basis of RSA!  It’s all the more amazing that I’ve never heard of John Gill because he earned his bachelor’s degree in Applied Mathematics from Georgia Tech (where I now teach) and his Ph.D. in Mathematics from U.C. Berkeley (where I got my Ph.D.)!  Hellman also recounted a conversation in which Gill (who is African-American) mentioned having encountered very little racial intolerance during his undergraduate studies in the 1960’s — apparently Georgia Tech was (relatively speaking) an oasis of tolerance among southern universities during that time.

Now on to the mathematical part of this post, which is an unusual proof of the existence of primitive roots modulo primes which I came up with recently while preparing a lecture for my course on Number Theory and Cryptography.  The proof is much less elementary than every other proof I’ve seen, but I would argue that it nevertheless has some merit.   I have always been intrigued by the fact that it is difficult to find primitive roots modulo a large prime , and also by the fact that there is no known way to efficiently compute an isomorphism even when a primitive root is known.  The usual elementary proofs of the fact that is cyclic do not directly construct an isomorphism with ; instead, one assumes that every element of has order smaller than and derives a contradiction by some counting argument.  One can in fact construct an isomorphism in a very natural (but somewhat unusual) way as follows.

By Fermat’s Little Theorem and the fact that a polynomial of degree over a field can have at most roots, the polynomial has distinct roots modulo .  By Hensel’s Lemma, therefore has distinct roots in the ring of -adic integers.  The set of roots of in forms a (multiplicative) group, and reduction modulo gives a  isomorphism from to whose inverse is usually called the “Teichmuller lift”.  We view as the group of roots of unity in the field of -adic numbers.  The subfield of is a splitting field for over .  Let denote the group of roots of unity in the field of complex numbers.  Then the subfield of is also a splitting field for over .  By the uniqueness of splitting fields, there is an isomorphism from to , which necessarily induces an isomorphism of multiplicative groups .  Since has order , the group is cyclic of order . Composing the isomorphisms , , and gives the desired isomorphism .

Of course, the isomorphism which we just constructed is not really explicit, since it invoked the uniqueness of splitting fields as a black box.  But this is really the only non-explicit step, and the only one which is not efficiently computable (Hensel’s Lemma is proved by -adic Newton iteration, which as in the classical case is efficient).   So the hardness of the Discrete Logarithm Problem (on which the Diffie-Hellman-Merkle key exchange protocol is based) is intimately related to the non-explicit nature of the fact that any two splitting fields are isomorphic!

Rhetorical question: Can one turn the above proof into an algorithm for computing discrete logarithms?  Normally I would be highly skeptical, but today Martin Hellman has inspired me to be an optimist!

The existence of primitive roots modulo (where is an odd prime and is a positive integer), assuming the result for , can also be proved by a rather non-elementary argument using basic properties of the -adic exponential and logarithm maps.  I haven’t seen this written down before, but I assume that it must be known to many experts.  Anyway, here is a sketch of the argument.  The -adic logarithm map converges for all satisfying .  Similarly, the -adic exponential map converges for all satisfying .  When defined, these functions are inverse to each other.  These two maps furnish a group isomorphism .  By the Hensel’s Lemma argument above, there is a group isomorphism , where is the group of roots of unity in .  Reducing both sides of the isomorphism modulo gives an isomorphism .  Since we already know that is cyclic of order , the Chinese Remainder Theorem implies that as desired.

When , the above argument does not quite work but the -adic exponential and logarithm maps still define an isomorphism .  The above argument can then be modified to show that for .

Concluding observations:

1. More information about the history of public key cryptography, including a mention of John Gill’s role, can be found here.

2. The reader will find six elementary proofs of the fact that is cyclic in this expository paper by Keith Conrad.

3. The unusual interplay between -adic and complex analysis in the first argument above is reminiscent of the more sophisticated arguments which Laura DeMarco and I use in this paper to prove the following result in complex dynamics: if are complex numbers with , then there are only finitely many complex numbers such that and both have finite orbit under iteration of the polynomial map .  (See the overview of the proof in Section 1.3 of our paper.)

4. My Ph.D. student Andrew Dudzik worked out a more elementary version of the second argument above in which one works throughout with truncations of the -adic logarithm and exponential maps as polynomials in and never needs to mention -adic numbers at all.