\documentstyle[12pt,twoside,amssymb,amstex]{article}
\input{macros-course-lectures}
\parindent0pt
\parskip1.5ex

\begin{document}
\lecture{notes7}{Notes 7}{February 27, 1997}


\setcounter{section}{6}
\setcounter{subsection}{4}


\renewcommand{\gcd}[2]{\mbox{GCD}(#1,#2)}
\renewcommand{\lcm}[2]{\mbox{LCM}(#1,#2)}

you've been moved to 24-115, F1 and F2 and you'll be in 36-156 F1.



\subsection{Finding GCD coefficients}

Recall Euclid's algorithm:
\begin{example}
Table method for getting GCD and Coefficients: run Euclid's algorithm,
then fill in the coefficients from the bottom up.
\begin{verbatim}
q     x    y   
     949  273  
3    273  130  
2    130   13  
10    13    0  
\end{verbatim}
\end{example}

The algorithm finds the GCD.  \\
It can be modified to give the coefficients in the sum expression.

\newcommand{\Euclidb}[2]{\mbox{Euclid-Coefficients}(#1,#2)}
{\bf Procedure} $\Euclidb{x}{y}$, where $x$ and $y$ are not both $0$, and $x\ge y$ 
\begin{enumerate}
\item If $y=0$, return $(1,0)$.
\item Else $x = qy + r$  $(r=x mod y)$
\item Use $\Euclidb{y}{r}$ to find $(a,b)$ such that $\gcd{y}{r}=ay+br$ 
\item Return $(b,a-qb)$.
\end{enumerate}

\begin{theorem}
If $\Euclidb{x}{y}$ terminates, its output $(a,b)$ satisfies
$ax+by = \gcd{x}{y}$.
\end{theorem}

\begin{proof}
  Induction on the number of recursive calls the algorithm takes to
  terminate. \\ 
\\
BASE: no recursion: \\
Then $y = 0$, the GCD is $x$, and the return values are $(1,0)$.  
Since $(1)(x) + (0)(y) = x$, this is correct. \\
\\
INDUCTIVE STEP: \\
Show for $n$ passes, assuming OK for $n-1$ passes: \\
\\
Say $x = qy + r$. \\
By induction, recursive call returns $(a,b)$ with 
$ay + br = g$, where $g$ is $\gcd{y}{x \bmod y}$. \\
Remember, this is also $\gcd{x}{y}$. \\
Just rewrite $g$ in terms of $x$ and $y$ instead of in terms of $y$
and $x \bmod y$: \\
$g = ay + br = ay + b(x-qy) = bx + (a-bq)y$. \\
Says the return values $(b,a-bq)$ are as claimed. 
\end{proof}

\begin{example}
Table method for getting GCD and Coefficients: run Euclid's algorithm,
then fill in the coefficients from the bottom up.
\begin{verbatim}
q     x    y      a   b
     949  273    -2   7 
3    273  130     1  -2
2    130   13     0   1   
10    13    0     1   0   
\end{verbatim}
Filling in table entries from the bottom: $g = (1)(13) + (0)(0)$. \\
Then $g = (0)(130) + (1)(13)$. \\
Then $g = (1)(273) + (-2)(130)$. \\
Then $g = (-2)(949) + (7)(273)$. 
\end{example}

\subsection{RSA cryptosystem}

Here's a nice application of number theory to
cryptography. \\
RSA is a {\em public key} cryptosystem: anyone can encrypt (encode) a message
to me, but no one else can decrypt (decode) it. \\
\\
Uses two {\em keys}, which are positive integers. \\
$e$, the {\em encryption key}.  Public. \\
$d$, the {\em decryption key}.  Private (to the decrypter). \\
\\
Encryption can be done using just $e$.

Decryption is hard unless you have $d$.

RSA uses modular arithmetic to build $e$ and $d$.

Recall def of mod.  There's a different defn:

Lots of properties, see book.  one we'll use a lot: $ab \bmod n = (a
\bmod n)(b \bmod n) \bmod n)$ (mod floats around).

Another theorem we need: Fermat: if $p$ is prime, then $a^{p-1} = 1
\pmod p$.

To do RSA:
\begin{itemize}
\item user picks two large primes $p$ and $q$.
\item let $n=pq$
\item pick (any) encryption key $e$
\item pick a related $d$ so that $ed \bmod (p-1)(q-1) = 1$
\item publishes $e$ and $n$, keeps $d$.
\end{itemize}

To encrypt messaage $m$, treat as number.

Build $m^{e} \bmod n$ (Anyone can do this, because $e$ and $n$ are
public. )

When user receieves $m^e$, computes $(m^e)^d=m^{ed} =
m^{1+k(p-1)(k-1)} \pmod n$.   

Fermat says $m^{p-1}=1 \pmod p$, and $m^{q-1}=1 \pmod q$.  

Chinese remainder theorem says can multiply: $m^{(p-1)(q-1)}=1 \pmod n$
\begin{theorem}
Suppose that $p$ and $q$ are primes, $n = p q$,
and $e$, $d$ are positive integers with 
$ed \bmod (p-1)(q-1) = 1$. \\
Suppose that $m$ is any natural number $< n$ such that 
(technicality, usually holds) neither $p$ nor $q$ divides $m$. \\
Then $m^{ed} \bmod n = m$. 
\end{theorem}
\begin{proof}
In book, see p. 147. \\
Basically, a bunch of exponential calculations and modular arithmetic.
\end{proof}

So $m^{ed} = m \pmod n$.  gets message back.

Example (from book):
Let $p = 43$, $q = 59$, so $n = 43 \times 59 = 2537$. \\
Let $e = 13$, $d = 937$.  Then $ed \bmod (p-1)(q-1) = 1$, as needed
(check). \\
Encrypt a number 1819 using exponentiation with $13$, mod 2537, get
2081. \\
Decrypt 2081 using exponentiation with 937, mod 2537, get back 1819.
Left to the reader to check this. \\
\\
Fast exponentiation: \\
In recitation, we will show how to compute the big exponentiations
needed to implement RSA quickly.  It relies on the fact that 
$x^{ab}\bmod n = (x^a \bmod n)^b \bmod n$. \\
\\
This all works to encrypt and decrypt. \\
But we haven't addressed the important issue: {\em secrecy}, \\
i.e., the property that the coded message is hard to decrypt without
having access to $d$, the decryption key. 
This turns out to depend on whether or not $p$ and $q$ are very large numbers
(currently 200 digits), and keeping them, as well as $d$, secret. 
(Finding $d$ actually lets you find $p$, $q$, and vice versa.) 
\\
In case $p$ and $q$ are large, no one yet knows how to ``break'' RSA: 
\begin{itemize}
\item   No one knows how to compute $p$, $q$ efficiently from $n$.
(Factoring large numbers is hard, though there's been progress.) \\
\item   No one knows how to compute $d$ efficiently without $p$, $q$.
\item   No one knows how to find $m$ efficiently without $d$ (ie,
solve $c=n^e$ for $m$). 
\end{itemize}

In practice, how do we find suitable $p$, $q$, $e$ and $d$? \\
\\
There are fast algorithms for generating large prime numbers $p$,
$q$. (pick a random number)\\
\\
For $e$ and $d$: \\ Recall our objective: \\ Need $de \bmod k = 1$,
where $k = (p-1)(q-1)$. \\ Pick $e$ relatively prime to $k$ (lots of
choices here). \\ That is, $\gcd{e}{k} = 1$. \\ By GCD theorems, we
can find coefficients $a$, $b$ such that $a e + b k = 1$. \\ Just use
$d = a$ -- then $d e \bmod k = 1$ since $de + bk = 1 \longrightarrow
de = -bk + 1 \longrightarrow de \bmod k = 1$.
\\
\\
Used by Netscape, e.g.

\subsection{Algorithm Verification}

Induction can also be used to verify iterative algorithms.

Algorithm for multiplying $a \times b$, where $a$ and $b$ are
arbitrary length positive integers represented in binary, and result
is to be represented in binary. \\
Assume that we have integer addition available, \\
and can examine individual bits. \\
$b(k)$ denotes $k$th high order bit of $b$. \\
\\
Algorithm: \\
Maintain accumulator $\ms{acc}$, initially set to $a$. \\
Suppose that $b$ has $n$ bits. \\
For $k = 1$ to $n-1$ do: \\
if $b(k+1) = 0$ then $\ms{acc} := 2 \ms{acc}$ \\
else $\ms{acc} := 2 \ms{acc} + a$ \\
\\
At end, result is in $\ms{acc}$. \\
\\
Example: $a = 5$, $b = 13 = 1101$. \\
\begin{tabbing}
XXX\=XXX\=XXX\= \kill
$k$ \> $\ms{acc}$ \> $\ms{high}(b,k+1)$ \\
$0$ \> $5$        \> $1$ \\
$1$ \> $15$       \> $3 = 11$ \\
$2$ \> $30$       \> $6 = 110$ \\
$3$ \> $65$       \> $13 = 1101$ 
\end{tabbing}

How do we know this is correct?  \\
Can prove, by induction. \\
For every $k$, $0 \leq k \leq n-1$, $P(k)$, where \\
$P(k)$: After $k$ iterations, $\ms{acc}$ is equal to $a \times
\ms{high}(b,k+1)$. \\
\\
Writing $\ms{high}(b,m)$ for the integer defined by the $m$
highest-order bits of $b$.) \\
\\
BASE: $k = 0$. \\
The highest-order bit is $1$, so $\ms{high}(b,1) = 1$. \\
Initially, $\ms{acc}$ contains $a = a \times 1$, as needed. \\
INDUCTIVE STEP: \\
Assume for $k$.  After $k$ iterations, $\ms{acc}$ contains 
$a \times \ms{high}(b,k+1)$. \\
Show after one more iteration, $\ms{acc}$ contains $a \times
\ms{high}(b,k+2)$. \\
\\
Depends on examining the $k+1$st iterative step. \\
At this step, examine $k+2$nd bit of $b$. \\
Rule says if $0$, double, else double and add $a$. \\
Check cases to see this is the right thing to do: \\
If $0$, new desired number is just double the old. \\
If $1$, new desired number is double plus $a$, ... \\
\\
Why does this say that the final answer is correct? \\
\\
Specialize the result to $k = n-1$, $P(n-1)$: \\
After $n-1$ iterations, $\ms{acc}$ is equal to 
$a \times \ms{high}(b,n) = b$. 

\section{State Machines}

{\it Everything following is a summary of a more complete version of
Handout 11.} 

\\
Now start the final discrete structure we will study in this course: \\
``state machines''. \\
\\
\\
Used as the basis for modelling algorithms and physical machines, in
order to give precise specifications of their behavior and in order to
verify their properties. \\
\\
Will present: \\
Definitions of state machines, executions, reachability. \\
\\
Basic examples: \\
Illustrate how to use state machines to represent interesting
computational processes. \\
Decomposition of state into variables, for convenience in
representation and manipulation. \\
Deterministic vs. nondeterministic state machines. \\
\\
Then introduce the key notion of ``invariants'': \\
Properties that are always preserved by state machines. \\
These are the main tool used in practice, in careful reasoning about
algorithms and machines. \\
\\
Show how invariants can be proved. \\
By induction. \\
Some that don't need strengthening of inductive hypothesis. \\
Others that do. \\
Proofs of invariants in batches. \\
\\
\\
Examples: \\
Numbers: \\
hopscotch
Euclid's GCD algorithm \\
fast multiplication \\
\\
Distributed algorithms: \\
Leader election \\
Alternating Bit Protocol \\
\\
\\

\subsection{Definitions: State Machine, Executions and Reachability}
{\it This section is a summary of a more complete version of Handout 11.}
\\

A {\em state machine} is a triple $(Q, Q_0, \delta)$, 
where:
\begin{enumerate}
\item 
$Q$ is a nonempty (finite or infinite) set of {\em states}.
\item
$Q_0 \subseteq Q$ is a nonempty subset of the states known as the {\em
start states}.
\item
$\delta$ is a set of {\em transitions} from state to state.
\end{enumerate}

Don't confuse with 6.045 FSM's -- these machines need not be finite. \\
\\
Similar to digraphs, but has distinguished start states. \\
\\
\\
The point of a state machine is that it {\em executes\/}, producing
{\em executions}. \\
Starts from any start state, and moves along, following transitions. \\
In this way, it models a computational process. \\
\\
An {\em execution fragment} of a state machine is a finite or infinite
sequence $q_0, q_1, \ldots$ such that
$(q_i,q_{i+1}) \in \delta$ for every $i \geq 0$. \\
\\
An {\em execution} is an execution fragment in which the initial state
$q_0$ is an element of $Q_0$. \\
\\
A state of $Q$ is said to be {\em reachable} if it is the final state
of some finite execution. \\
\\
\\
Simple examples. \\
Begin with a simple state machine with one initial state, no choices
of what to do next. \\
Has infinitely many states. 

\begin{example} -- {\bf Deterministic}
Counter \\
\\
$Q = \naturals$, $Q_0 = \{ 0 \}$ \\
\\
$\delta = \{ (n, n+1) | n \in \naturals \}$ \\
\\
Intuitively, this models a counting process that starts with value $0$
and increments (forever). \\
\\
The reachable states are all of $Q = \naturals$. \\
Each natural number $n$ is only reached by an execution with $n$
transitions ($n+1$ states). \\
There is only one execution of each number of transitions. 
\end{example}
The counter is an example of a special kind of state machine that we
call {\em deterministic}. \\
This means that it has only a single start state: $|Q_0| = 1$, \\
and each state has at most one successor: for each $q \in Q$, there is
at most one $q'$ such that $(q,q') \in \delta$. \\
\\
If a state machine isn't deterministic, we say it's {\em
nondeterminisitic}. \\
Means it has choices, either of starting state, transitions, or both. \\
\\
The following is an example of a nondeterministic state machine: \\

\begin{example} -- {\bf Non-deterministic}
Linear hopscotch, with steps of $12$ and $18$: \\
\\
$Q = \mbox{ integers }$ \\
$Q_0 = \{ 0 \}$ \\
\\
$\delta = \{ (i,i+12) | i \in \integers \} 
\cup \{ (i,i-12) | ... \} 
\cup \{ (i,i+18) | ... \}
\cup \{ (i,i-18) | ... \}$.
\\
Thas has many different executions, all leading to states that are
multiples of the GCD, which is $6$. \\
\\
Can also vary this machine to allow multiple start states. \\
E.g., $Q_0 = \{ i | i = 0 \pmod 6 \}$. \\
E.g., $Q_0 = \{ 0, 2 \}$. \\
\end{example}
In most examples of state machines that occur in practice, the state
has {\em structure}. \\
Can describe it as containing different sorts of information,
represented as values of {\em state variables}. \\
Different from graphs, which are usually thought of as unstructured. \\
(Normally represented by a dot for each vertex, arrow for each edge.) \\
The variable structure leads to concise, understandable
representations. \\

\begin{example}
2-dimensional hopscotch, say with $12$ and $18$ in EW and $9$ and $12$
in NS direction. \\
$Q$: Consists of values for two {\em variables}: \\
$\ms{east-west} \in \integers$, initially $0$ \\
$\ms{north-south} \in \integers$, initially $0$ \\
\\
Formally, $Q$ is the Cartesian product, $\integers \times \integers$.
\\
And $Q_0$ consists of the single pair, $(0,0)$. \\
\\
$\delta$:  \\
All transitions of the following forms: \\
\\
$\ms{move-east}(12)$ \\
Effect: \\
  $\ms{east-west} := \ms{east-west} + 12$ \\
\\
$\ms{move-east}(18)$ \\
Effect: \\
  $\ms{east-west} := \ms{east-west} + 18$ \\
\\
$\ms{move-west}(12)$ \\
Effect: \\
  $\ms{east-west} := \ms{east-west} - 12$ \\
\\
$\ms{move-west}(18)$ \\
Effect: \\
  $\ms{east-west} := \ms{east-west} - 18$ \\
\\
$\ms{move-north}(9)$ \\
Effect: \\
  $\ms{east-west} := \ms{east-west} + 9$ \\
\\
Etc. \\
The names we associate with the transitions are called {\em labels}.  \\
They have no formal significance here, but are convenient for
presenting the state machine.  \\
Formally, $\delta$ consists of all pairs that are described by any of
the little code fragments. \\
A code fragment describes a {\em set} of pairs of states, in an
obvious way. \\
E.g., the first fragment denotes all pairs $(q,q')$, where
$\ms{east-west}$ in $q'$ is 12 more than it is in $q$, and
$\ms{north-south}$ is the same in $q'$ as it is in $q$. \\
\\
Written concisely: \\
$q'.\ms{east-west} = q.\ms{east-west} + 12$, \\
$q'.\ms{north-south} = q.\ms{north-south}$. \\
\end{example}
The transitions above are described using assignment statements. \\
Nice for programmers. \\
Sometimes use equations (like the ones just above) instead. \\
\\
One more wrinkle: \\
When using code fragments to represent state transitions, sometimes
it's convenient to give a predicate, {\it precondition}, restricting
when the code fragment is allowed to be applied. \\

\begin{example}
2-dim hopscotch on only northeast quadrant: \\
\\
The same as above, only now the two state components $\ms{east-west}$
and $\ms{north-south}$ take on nonnegative values only (values in
$\naturals$). \\
\\
So now we have to be careful -- some of the named transitions can't be
applied in all situations, e.g.: \\
\\
$\ms{move-west}(12)$ \\
Precondition: \\
  $\ms{east-west} \geq 12$ \\
Effect: \\
  $\ms{east-west} := \ms{east-west} - 12$ \\
\\
The precondition is a predicate on the state variables restricting
when the transitions denoted by this code fragment are permitted to
occur. \\
Formally, the transitions denoted by this fragment are all $(q,q')$
for which the precondition predicate is true of $q$ and for which $q'$
is obtained from $q$ by executing the effect code. 
\end{example}
State machines can be used to describe most computing processes,
including both algorithms and computing machines. \\
The state variable structure is usually crucial for obtaining
understandable respresentations.

\subsection{Invariants}

{\it This section is a summary of a more complete version of Handout 11.}
\\

Now we are ready to introduce the main practical method for reasoning
about the correctness of algorithms and physical machines represented
as state machines -- the method of {\em invariants}.
\\
Recall, we have proven correctness in recitation of an algorithm of fast
multiplicatiion mod m and correctness of a state machine of fast
multiplication.
Recall, that in lecture 6 we also discussed how to prove corectness.\\


This method of invariants involves arguing that the machine always preserves
properties of the state known as {\em invariants}.
This is often the key to understanding what the machine does, and why.
\\

\begin{defin}
An {\em invariant} of a state machine $M$ is any predicate  that is
true of all the reachable states of $M$.
\end{defin}

\begin{example}
In the general 2-dim hopscotch, with initial state $(0,0)$, the
statements that \\
$\ms{east-west}$ is a multiple of $6$, \\
and
$\ms{north-south}$ is a multiple of $3$, \\
are invariants.
\end{example}

Of course, these statements give a lot of insight into what this
machine does. \\
\\
How to prove that some state machine satisfies an invariant? \\
Must be true of all reachable states. \\
Reachable states are those that are reached by some number of
transitions, beginning from a start state. \\
So, prove by induction on number of transitions. \\
Breaks down into base, $0$ transitions, which shows the property is
true in the initial states, and inductive step, which shows the
property is preserved by all steps. \\
\\
\begin{example}
2-dimensional hopscotch. \\
\\
Invariant as stated above.  \\
Prove by induction \\
\\
BASE:  Initial state $(0,0)$ multiples of $6$, $3$ respectively. \\
INDUCTIVE STEP:  \\
Suppose true for all states reachable after $n$ steps.  \\
Now consider state reachable after $n+1$ steps. \\
That state is reached by an execution with $n$ steps, then one more
step.  \\
Say the state after $n$ steps is $q$ and the final state is $q'$. \\
By inductive hypothesis, we may assume that the invariants are true
for $q$. \\
That is, $q.\ms{east-west}$ is a multiple of $6$ and
$q.\ms{north-south}$ is a multiple of $3$. \\
We must show that $q'.\ms{east-west}$ is a multiple of $6$ and
$q'.\ms{north-south}$ is a multiple of $3$. \\
\\
Consider cases based on type of transition. \\
(The usual, when the machine is represented by code fragments.) \\
\\
Here, all the cases are basically the same, so I'll just do the first. \\
Since $q.\ms{east-west}$ is a multiple of $6$ and $q'.\ms{east-west} =
q.\ms{east-west} + 12$, we also have $q'.\ms{east-west}$ a multiple of
$6$. \\
Also (don't forget) since $q.\ms{north-south}$ is a multiple of $3$
and $q'.\ms{north-south} = q.\ms{north-south}$, we also have
$q'.\ms{north-south}$ a multiple of $3$. \\
\\
QED
\end{example}




\subsection{Fast Multiplication}

``Russian peasant's multiplication'' \\
\\
The states are composed of variables, all in $\naturals$: \\
$x$, $y$, the values to be multiplied, initially arbitrary positive \\
$a$, the accumulator for the answer \\
$r$, $s$, temporaries \\
\\
Initially, $r = x$, $s = y$, $a = 0$. \\
\\
Transitions: \\
\\
$\ms{even}$ \\
Pre: \\
$s$ is even \\
$s > 0$ \\
Eff: \\
$r := 2r$ \\
$s := {s \over 2}$ \\
\\
\\
$\ms{odd}$ \\
Pre: \\
$s$ is odd \\
Eff: \\
$a := a + r$ \\
$r := 2r$ \\
$s := {s-1 \over 2}$ \\
\\
The answer is the value in the accumulator $a$ when $s = 0$. \\
\\
This may not be completely obvious. \\
Example execution: \\
\\
\begin{verbatim}
$x$   $y$   $r$   $s$   $a$
 5     9     5     9     0
            10     4     5
            20     2     5
            40     1     5
            80     0    45
\end{verbatim}
Proof: To see this is correct, would like to prove invariant: \\
\\
Invariant 1: If $s = 0$ then $a = x y$. \\
\\
Of course, need to strengthen in order to prove. \\
Turns out that the key is: \\
\\
Invariant 2: $x y = r s + a$ \\
\\
Notice how this expresses the idea that explains why the algorithm
works. \\
This is typical for invariants. \\
\\
So, can prove Invt1 and Invt2 together by induction, as before. \\
Alternatively, and slightly better, can just prove Invt2 by itself, by
induction, and then infer Invt1 as a corollary. \\
\\
Proving Invt2 is straightforward by induction: \\
\\
BASE: \\
True initially because $r = x$, $s = y$ and $a = 0$. \\
\\
INDUCTIVE STEP: \\
Consider cases based on type of action, $\ms{even}$ or $\ms{odd}$. \\
\\
$\ms{even}$: \\
Doubling $r$ while halving $s$ doesn't change the product $rs$, \\
and $a$ doesn't change, so easy. \\
\\
$\ms{odd}$: \\
Assuming $(q.x)(q.y) = (q.r)(q.s) + q.a$. \\
Must show $(q'.x)(q'.y) = (q'.r)(q'.s) + q'.a$. \\
\\
Now $q'.x = q.x$, $q'.y = q.y$, so LHS unchanged. \\
Also, $q'.r = 2 (q.r)$, $q'.s = {q.s - 1 \over 2}$, and $q'.a = q.a + q.r$. \\
So $(q'.r)(q'.s) + q'.a = 2 (q.r)({ q.s - 1 \over 2 }) + q.a + q.r$. \\
Reorganizing terms yields $(q.r)(q.s) + q.a$, which suffices. 
\\
\\
So Invt2 is proved. \\
For Invt1, don't even need an induction: \\
\\
Already know that in all reachable states, $xy = rs + a$. \\
Need to show in all reachable states, if $s = 0$ then $a = xy$. \\
\\
So let $q$ be any reachable state. \\
We know that $(q.x)(q.y) = (q.r)(q.s) + (q.a)$. \\
If $q.s = 0$, we get $(q.x)(q.y) = q.a$. \\
As needed. \\
\\
\\
This has illustrated the idea of strengthening an invariant, then
proving only a part of it by induction and getting the rest as a
consequence (corollary). \\
\\
This strategy extends: \\
Sometimes to prove an invariant must extend it to a long list. \\
Then useful to prove one or a batch first, by induction. \\
After that, we can assume their results in proving another batch by
induction. \\
Etc. \\
Anywhere along the way, might get some as consequences, without using
induction. 

\end{document}

% Local Variables: 
% mode: latex
% TeX-master: t
% End: 
