Factoring Algorithm B Sample Clauses

Factoring Algorithm B. The basic idea of the proof given here is inspired by the technique of Biham, et al. [9], where they showed that breaking the generalized Xxxxxx-Xxxxxxx assumption modulo a Xxxx integer is at least as hard as factoring Xxxx integers. Assume that the adversary A breaks the scheme P without forging a signature. Then, we construct from A an efficient factoring algorithm B which given as input a Xxxx integer N = p · q chosen from FIG(1k), outputs either p or q. B begins by running G(1k) to generate i (PK , SK ) for each user U ∈ U , and setting g = v2 mod N where v is an integer chosen N uniformly at random in Z∗N such that the Xxxxxx symbol ( v ) is −1. Because N is a Xxxx integer, v2 is a uniformly distributed quadratic residue in Z∗N and furthermore, squaring is a permutation on the set of quadratic residues in Z∗N . Therefore, g is also a uniformly distributed quadratic residue in ZN∗ . Let d be the order of g in Z∗N , which of course is unknown to B. Then, since d is always odd, we have that 2 ∈ Zd∗; i.e., 2−1 mod d exists. For brevity, we use g2−i mod N to denote g2−i mod d mod N for i = 1, 2. B now invokes A and simulates all the queries from A as follows. • Send: B handles all the Send queries of A as per the specifications of the protocols, except that it computes each zi in the following different yet indistinguishable way. B first selects a random ai ∈ [1, N ] and then computes zi as i z = gri = gai+2−1 = gai · g2−1 = gai · v2,