dankrad / rsacash Goto Github PK

There seems to be some confusion in last two points under Trivial reductions:

• It is not true that QR_N contains no elements of low order: for example, let N=17*53=901, and 531^4 = (521^2)^2 = 849^2 = 1 (mod 901). That is, 849 is a quadratic residue of a low order.
  However, the statement is true if N is the product of distinct safe primes.
• For an integer N of unknown factorization, the Order assumption in the multiplicative group mod N is equivalent to factoring.

In addition, the Low Order assumption implies factoring in the following specific case:
For the pair (u,l) such that u^l = 1 (mod N), where l is even and u^(l/2) != -1 (mod N).
Indeed, in this case one can apply the classical step in Shor's factoring algorithm.