About this project

CryptoBook is a community project, developed by members of CryptoHack to create a resource for people to learn cryptography. The focus of this project is to create a friendly resource for the mathematical fundamentals of cryptography, along with corresponding SageMath implementation.

Think of this as an alternative SageMath documentation source, where the focus is its application in solving cryptographic problems.

If you're interested in contributing, come chat to us in our Discord Channel

Introduction

Throughout CryptoBook, discussions are made more concise by using various mathematical symbols. For some of you, all of these will feel familiar, while for others, it will feel new and confusing. This chapter is devoted to helping new readers gain insight into the notation used.

Mathematical Objects

Special Sets

• $\mathbb{C}$: denotes the set of complex numbers

• $\mathbb{R}$: denotes the set of real numbers

• $\mathbb{Z}$: denotes the set of integers

• $\mathbb{Q}$: denotes the set of rational numbers

• $\mathbb{N}$: denotes the set of natural numbers (non-negative integers)

• $\mathbb{Z}/n\mathbb Z$: denotes the set of integers mod $n$

"""
We can call each of these sets with Sage using the 
following commands. Comments are the result of the
input.
"""
CC
# Complex Field with 53 bits of precision
RR
# Real Field with 53 bits of precision
ZZ
# Integer Ring
QQ
# Rational Field
NN
# Non negative integer semiring
Zmod(11) # or `Integers(11)` or `IntegerModRing(11)` 
# Ring of integers modulo 11

• We refer to unit groups by $R^\times$ or $R^*$. Example: $(\mathbb Z/n \mathbb Z)^\times$

• We refer to finite fields with $q$ elements by $\mathbb{F}_q$

• We refer to a general field by $k$

• We refer to the algebraic closure of this field by $\bar{k}$

"""
Example of defining a field and then its 
algebraic closure
"""
GF(3)
# Finite Field of size 3 , where GF stands for Galois Field 
GF(3).algebraic_closure()
# Algebraic closure of Finite Field of size 3

"""
If you want to find which field an element belongs to you can use the 
`.parent()` function
"""

x = 7
print(x.parent())
# Integer Ring

y = 3.5
print(y.parent())
# Real Field with 53 bits of precision

"""
If you want to "lift" an element from a quotient ring R/I to the ring R
use the `.lift()` function
"""
R = ZZ
RI = Zmod(11)
x =  RI(5)

print(x.parent())
# Ring of integers modulo 11

y = x.lift()
print(y.parent())
# Integer Ring

print(y in R)
# True

Relation operators

• $\in$means is an element of (belongs to)

Logical Notation

• $\forall$means for all

• $\exists$means there exists. $\exists!$ means uniquely exists

Operators

• $Pr(A)$ means the probability of an event $A$to happen. Sometimes denoted as $Pr[A]$or as $P(A)$

Philosophy

The aim of CryptoBook is to have a consolidated space for all of the mathematics required to properly learn and enjoy cryptography. The focus of any topic should be to introduce a reader to a subject in a way that is fun, engaging and with an attempt to frame it as an applied resource.

The second focus should be to cleanly implement the various topics using SageMath, so that there is a clear resource for a new reader to gain insight on how SageMath might be used to create the objects needed.

Proposed topics

This list is not complete so please add to it as you see fit.

Mathematical Background

Fundamentals

• Congruences

• GCD, LCM

  • Bézout's Theorem

  • Gauss' Lemma and its ten thousand corollaries

• Euclid's algorithm

• Modular Arithmetic

• Morphisms et al.

• Frobenius endomorphism

Number Theory

Mainly thinking things like

• Prime decomposition and distribution

• Primality testing

• Euler's theorem

• Factoring

• Legendre / Jacobi symbol

Abstract Algebra

Mainly thinking things like:

• Groups, Rings, Fields, etc.

• Abelian groups and their relationship to key-exchange

• Lagrange's theorem and small subgroup attacks

Basilar Cryptanalysis forms

• Introduction to Cryptanalysis

• A linear Approach to Cryptanalysis

• Matsui's Best biases algorithm

• A Differential Approach to Cryptanalysis

Elliptic Curves

• Weierstrass

• Montgomery

• Edwards

• Counting points (Schoof's algorithm)

• Complex multiplication

Generating Elliptic Curves

• Generating curves of prime order

• Generating curves of arbitary order (hard)

Hyperelliptic curves

• Generalization of elliptic curves

• Recovering a group structure using the Jacobian

• Example: genus one curves, jacobian is isomorphic to the set of points

• Mumford representation of divisors

• Computing the order of the Jacobian

  • Hyper Metroid example

Security background

• Basic Concepts

  • Confidentiality, Integrity etc

  • Encryption, Key generation

• Attacker goals + Attack games

• Defining Security - Perfect security, semantic security

• Proofs of security + Security Reductions

Asymmetric Cryptography

RSA

• Textbook protocol

• Padding

  • Bleichenbacher's Attack

  • OAEP

• Coppersmith

  • Håstad's Attack

  • Franklin-Reiter Attack

• Wiener's Attack

• RSA's Integer fattorization Attacks

• • Fermat Factoring Attack

  • Quadratic Sieve Attack

  • Number Fielde Sieve Attack

• RSA Digital Signature Scheme

• Timing Attacks on RSA

• RSA with Chinese Remainder Theorem (CRT)

Paillier Cryptosystem

• Textbook protocol

ElGamal Encryption System

• Textbook protocol

• ElGamal Digital Signature Scheme

Diffie-Hellman

• Textbook protocol

• Strong primes, and why

Elliptic Curve Cryptography

• ECDSA

• EdDSA

Symmetric Cryptography

One Time Pad

• XOR and its properties

• XOR as One Time Pad

• Generalized One Time Pad

Block Ciphers

• AES

Stream Ciphers

• Affine

• RC4

Hashes

• Introduction

• Trapdoor Functions

• MD family

• SHA family

• BLAKE Hash family

• // TODO: Insert Attacks

Isogeny Based Cryptography

• Isogenies

• Isogeny graphs

• Torsion poins

• SIDH

• SIKE

• BIKE

Cryptographic Protocols

Zero-knowledge proofs

• Schnorr proof of knowledge for dlog

• Core definitions

• Proof of equality of dlog

• Proof of knowledge of a group homomorphism preimage

Formal Verification of Security Protocols

• Definition of Formal Verification

• Uses of Formal Verification

• Handshake protocols, flawed protocols

• The external threat: Man-In-The-Middle attacks

• Attacking the (flawed) Needham-Shroeder public key exchange protocol

Usefull Resources ( Books, articles ..) // based on my material

• Cryptanalytic Attacks on RSA (Yan, Springer, 2008)

• Algorithmic Cryptanalysis (Antoine Joux, CRC Press, 2009)

• Algebraic Cryptanalysis (Brad, Springer, 2009)

• RC4 stream Cipher and its variants (H. Rosen, CRC Press, 2013)

• Formal Models and Techniques for Analyzing Security Protocols (Cortier, IOS Press, 2011)

• Algebraic Shift Register Sequences (Goresky && Klapper, Cambridge Press, 2012)

• The Modelling and Analysis of Security Protocols (Schneider, Pearson, 2000)

• Secure Transaction Protocol Analysis (Zhang && Chen, Springer, 2008)

Thank you!

Our Writers

• ...

• You?

Join CryptoBook

If you would like to join the team, come over to our and talk with us about your ideas

Working together

• If something doesn't make sense, make a comment using GitBook, or ask in the Discord.

• If you are confident that something is wrong, just fix it. There's no need to ask.

• If you think something doesn't have enough detail, expand on it, or leave a comment suggesting that.

• If a page is getting too long, break it down into new pages. If you're unsure, then leave a comment or talk in the discord

• If you want to write about something new and learn as you type, this is fine! But please leave a warning at the top that this is new to you and needs another pair of eyes.

• If there's big subject you're working on, claim the page and save it, show us that that's what you're doing so we don't overlap too much

General Tips

• Introduce new objects slowly, if many things need to be assumed, then try to plan for them to appear within the somewhere.

• It is better to cover less, and explain something well, than it is to quickly cover a lot. We're not racing

• When explaining anything, imagine you are introducing it for a first time. Summaries exist elsewhere online, the goal of CryptoBook is education

• Contribute as much or as little as you want, but try to only work on topics that

  • You are interested in

  • You have some experience of thinking about

• External resources should be included at the end of the page. Ideally the book should be self-contained (within reason) but other resources are great as they offer other ways to learn

• Try and use the hints / tips blocks to break up dense text, for example:

Page Structure

• The topic should be presented initially with theory, showing the mathematics and structures we will need. A discussion should be pointed towards how this appears within Cryptography

• Within a discussion of a topic, a small snippet of code to give an example is encouraged

• If you write code better than you write maths, then just include what you can and the page will form around that

Formatting

Mathematics notation

There's no "right or wrong" but it's good to be consistent, I think?

• We seem to be using mathbb for our fields / rings. So let's stick with that? Maybe someone has a good resource for notation we can work from?

Code Blocks

• Make sure all code blocks have the right language selected for syntax highlighting

• Preference is to SageMath, then to Python, then others.

• Code should be cope-pastable. So if you include print statement, include the result of the output as a comment

Algorithms

• Algorithms should be presented as??

Introduction

Two of the skills a cryptographer must master are:

1. Knowing his way and being comfortable to work with numbers.

2. Understanding and manipulating abstract objects.

This chapter of fundamentals proposes to prepare you for understanding the basics of number theory and abstract algebra .We will start with the most basic concepts such as division and build up knowledge until you, future cryptographer, are able to follow and understand the proofs and intricacies of the cryptosystems that make our everyday life secure.

We will provide examples and snippets of code and be sure to play with them. If math is not your strongest suit, we highly suggest to pause and ponder for each concept and take it slow.

For the math-savy people we cover advanced topics in specific chapters on the subjects of number theory and group theory.

So what are we waiting for? Let's jump right in!

Division

Let $\mathbb{Z} = \{\dots , -1, 0, 1, 2, 3 \dots \}$be the set denoting the integers.

Definition - Divisibility

For $a, b, \in \mathbb{Z}$we say that $a$divides $b$if there is some $k \in \mathbb{Z}$such that $a \cdot k = b$

Notation: $a | b$

Example

For $a = 2, b = 6$ we have $2 | 6$ because we can find $k = 3$such that $6 = 2 \cdot 3$.

Properties

• $a | a, \ 1 | a \text{ and } a | 0$

• $a | b$ and $a | c$ implies $a | (bu + cv) \ \forall u, v, \in \mathbb{Z}$

  • Example: Let $b = 6, u = 5$ and $c = 9, v = 2$

  • $3 | 6$ and $3 | 9 \Rightarrow 3 | (6 \cdot 5 + 9 \cdot 2) \iff 3 | 48$ . We can find $k = 16$such that $48 = 3 \cdot 16$

• $a | b$ and $b | c$ implies $a | c$

• if $a|b$and $b|a$ then $a = \pm b$

Definition - Division with remainder

Let $a, b \in \mathbb{Z}$with $b≥1$,

There exists unique $q, r \in \mathbb{Z}$such that $\boxed{a = bq + r}$and $0 \leq r < b$

$q$ is called the quotient and $r$ the remainder

Examples:

• To find $q, r$ python offers us the divmod() function that takes $a, b$as arguments

q, r = divmod(6, 2)
print(q, r)
# 3 0 

q, r = divmod(13, 5)
print(q, r)
# 2 3 
# Note that 13 = 2 * 5 + 3

• If we want to find only the quotient $q$ we can use the // operator

• If we want to find the remainder $r$ we can use the modulo % operator

q = 13 // 5
print(q)
# 2

r = 13 % 5
print(r)
# 3

Exercises:

1. Now it's your turn! Play with the proprieties of the division in Python and see if they hold.

Greatest common divisor

Definition

Let $a, b \in \mathbb{Z}$ be 2 integers. The greatest common divisor is the largest integer $d \in \mathbb{Z}$such that $d | a$and $d | b$

Notation: $\gcd(a, b) = d$

Examples:

# In python we can import math to get the GCD algo
import math
print(math.gcd(18, 12)) # -> 6
# Sage has it already!
print(gcd(18, 12)) # -> 6

Remark:

• for all other common divisors $c$ of $a, b$we have $c | d$

Things to think about

What can we say about numbers$a, b$ with $\gcd(a, b) = 1$? How are their divisors?

Introduction

Give a description of the topic, and what you hope the reader will get from this. For example, this page will cover addition of the natural numbers. Talk about how this relates to something in cryptography, either through a protocol, or an attack. This can be a single sentence, or verbose.

Laws of Addition

For all integers, the addition operation is

• Associative: $a + (b + c) = (a + b) + c$

• Commutative: $a + b = b + a$

• Distributive: $a(b + c) = ab + ac$

• Contains an identity element: $a + 0 = 0 + a = a$

• Has an inverse for every element: $a + (-a) = (-a) + a = 0$

• Closed: $\forall a, b \in \mathbb{Z}, a + b \in \mathbb{Z}$

Interesting Identity

Sage Example

sage: 1 + (2 + 3) == (1 + 2) + 3
True
sage: 1 + 2 == 2 + 1
True
sage: 5*(7 + 11) == 5*7 + 5*11
True
sage: sum(i for i in range(1000))^2 == sum(i^3 for i in range(1000))
True

Further Resources

• Links to

• Other interesting

• Resources

Wilson's Theorem

A positive integer $n > 1$is a prime if and only if:

Euler's Theorem

Let $n \in \mathbb{Z}^{+}$ and $a \in \mathbb{Z}$ s.t. $gcd(a, n) = 1$, then:

Fermat's Little Theorem

Let $p$be a prime and $a \in \mathbb{Z}$, then:

or equivalently:

Reference

1. Wilson's Theorem - Brilliant

2. Euler's Theorem - Brilliant

3. Fermat's Little Theorem - Brilliant

Introduction

Although we have functions that can compute our $\gcd$easily it's important enough that we need to give and study an algorithm for it: the euclidean algorithm.

It's extended version will help us calculate modular inverses which we will define a bit later.

Euclidean Algorithm

Important Remark

If $a = b \cdot q + r$and $d = \gcd(a, b)$ then $d | r$. Therefore $\gcd(a, b) = \gcd(b, r)$

Algorithm

We write the following:

$a = q_0 \cdot b + r_0 \\ b = q_1 \cdot r_0 + r_1 \\ r_0 = q_2 \cdot r_1 + r_2 \\ \vdots \\ r_{n-2} = r_ {n-1} \cdot q_{n - 1} + r_n \\ r_n = 0$

Or iteratively $r_{k-2} = q_k \cdot r_{k-1} + r_k$ until we find a $0$. Then we stop

Now here's the trick:

If $d = \gcd(a, b)$ then $d$ divides $r_0, r_1, ... r_{n-1}$

Example:

Calculate $\gcd(24, 15)$

$24 = 1 \cdot 15 + 9 \\ 15 = 1 \cdot 9 + 6 \\ 9 = 1 \cdot 6 + 3 \\ 6 = 2 \cdot 3 + 0 \Rightarrow 3 = \gcd(24, 15)$

Code

def my_gcd(a, b):
    # If a < b swap them
    if a < b: 
        a, b = b, a
    # If we encounter 0 return a
    if b == 0: 
        return a
    else:
        r = a % b
        return my_gcd(b, r)

print(my_gcd(24, 15))
# 3

Exercises:

1. Pick 2 numbers and calculate their $\gcd$by hand.

2. Implement the algorithm in Python / Sage and play with it. Do not copy paste the code

Extended Euclidean Algorithm

Bezout's identity

Let $d = \gcd(a, b)$. Then there exists $u, v$ such that $au + bv = d$

The extended euclidean algorithm aims to find $d = \gcd(a, b), \text{ and }u, v$given $a, b$

# In sage we have the `xgcd` function
a = 24
b = 15
g, u, v = xgcd(a, b)
print(g, u, v)
# 3 2 -3 

print(u * a + v * b)
# 3 -> because 24 * 2 - 15 * 3 = 48 - 45 = 3

Introduction

Thinking not over the integers as a whole but modulo some integer$n$instead can prove quite useful in a number of situation. This chapter attempts to introduce to you the basic concepts of working in such a context.

Congruences

For the following chapter, we will assume$n$is a natural integer, and$a$and$b$are two integers. We say that$a$and$b$are congruent modulo$n$when$n\mid (b-a)$, or equivalently when there is an integer$k$such that$a=b+kn$. We denote this by$a\equiv b~ [n]$or $a \equiv b\mod n$. I will use the first notation throughout this chapter.

Remark: When$b\neq0$, we have$a\equiv r~[b]$, where$r$is the remainder in the euclidean division of$a$by

This relation has a number of useful properties:

• $\forall c\in \mathbb Z, a\equiv b~[n] \implies ac \equiv bc ~ [n]$

• $\forall c \in \mathbb Z, a\equiv b~[n] \implies a+c\equiv b+c ~[n]$

• $\forall c \in \mathbb Z, a \equiv b ~[n] \text{ and } b\equiv c~[n]\implies a\equiv c ~[n]$

• $\forall m \in \mathbb N, a\equiv b~[n] \implies a^m\equiv b^m ~[n]$

• The proofs are left as an exercise to the reader :p (Hint: go back to the definition)

Seeing as addition and multiplication are well defined, the integers modulo$n$form a ring, which we note$\mathbb Z/n\mathbb Z$. In sage, you can construct such ring with either of the following

Zn = Zmod(5)
Zn = Integers(5)
Zn = IntegerModRing(5)
# Ring of integers modulo 5
Zn(7)
# 2
Zn(8) == Zn(13)
# True

Powering modulo$n$is relatively fast, thanks to the double-and-square algorithm, so we needn't worry about it taking too much time when working with high powers

pow(2, 564654533, 7) # Output result as member of Z/7Z
# 4
power_mod(987654321, 987654321, 7) # Output result as simple integer
# 6
Zmod(7)(84564685)^(2^100) # ^ stands for powering in sage. To get XOR, use ^^.
# 5

As a side note, remember that if an equality holds over the integers, then it holds modulo any natural integer$n$. This can be used to prove that a relation is never true by finding a suitable modulus, or to derive conditions on the potential solutions of the equation.

Example: by choosing an appropriate modulus, show that not even god is able to find integers$a$and$b$such that$a^2 = 2 + 4b$

Modular Inverse

Since we can multiply, a question arises: can we divide? The answer is yes, under certain conditions. Dividing by an integer$c$is the same as multiplying by its inverse; that is we want to find another integer$d$such that$cd\equiv 1~[n]$. Since$cd\equiv 1~[n]\iff\exists k\in\mathbb Z, cd = 1 + kn$, it is clear from Bézout's Identity that such an inverse exists if and only if$\gcd(c, n) = 1$. Therefore, the units modulo$n$are the integers coprime to$n$, lying in a set we call the unit group modulo$n$: $\left(\mathbb Z/n\mathbb Z\right)^\times$

Zn = Zmod(10)
Zn(7).is_unit()
# True
Zn(8).is_unit()
# False
3 == 1/Zn(7) == Zn(7)^(-1) == pow(7,-1,10) # member of Z/10Z
# True
inverse_mod(7, 10) # simple integer
# 3
Zn(3)/7
# 9
Zn(3)/8
# ZeroDivisionError: inverse of Mod(8, 10) does not exist
Zn.unit_group()
# Multiplicative Abelian group isomorphic to C4 (C4 being the cyclic group of order 4)

Finding the modular inverse of a number is an easy task, thanks to the extended euclidean algorithm (that outputs solutions in$d$and$k$to the equation$cd-kn=1$from above).

xgcd(7, 10) # find (gcd(a, b), u, v) in au + bv = gcd(a, b)
# (1, 3, -2) <-- (gcd(7, 10), d, -k)

// Visual

// Symmetries

// Permutations

• Polynomial GCD

  • Euclidean GCD

  • Half-GCD for speed when e=0x10001

  • demo application for that one RSA related message attack?

• Resultant

  • eliminate multivariate polynomials at the expense of increasing polynomial degree

  • demo application for that one RSA Coppersmith short padding related message attack?

• Groebner Basis

  • what if you did GCD and Resultants at the same time, like whoa

  • and what if it took forever to run!

Introduction

Since we can add, subtract, multiply, divide even... what would be missing? Powering! I'm not talking about some power fantasy here, but rather introduce some really really important theorems. Fermat little's theorem proves useful in a great deal of situation, and is along with Euler's theorem a piece of arithmetic you need to know. Arguably the most canonical example of using these is the RSA cryptosystem, whose decryption step is built around Euler's theorem.

Fermat's Little Theorem

Since we want to talk about powers, let's look at powers. And because I like 7, I made a table of all the powers of all the integers modulo 7.

On the last row, there is a clear pattern emerging, what's going on??? Hm, let's try again modulo 5 this time.

Huh, again?! Clearly, there is something going on... Sage confirms this!

p, itworks = 1, True
for _ in range(100):
    p = next_prime(p)
    Fp = GF(p) # Finite Field of size p
    itworks &= all(Fp(x)^(p-1) == 1 for x in range(1,p))

print(itworks)
# True

Claim (Fermat's Little Theorem): Let$p$a prime.$\forall a\in\mathbb Z, a^p\equiv a~[p]$

When$a\neq 0$, this is equivalent to what we observed:$a^{p-1}\equiv 1~[n]$. There are several proofs of Fermat's Little Theorem, but perhaps the fastest is to see it as a consequence of the Euler's Theorem which generalizes it. Still, let's look a bit at some applications of this before moving on.

A first funny thing is the following:$\forall a\in\mathbb Z, a\cdot a^{p-2}\equiv a^{p-1}\equiv 1~[p]$. When$p>2$, this means we have found a non-trivial integer that when multiplied to$a$yields 1. That is, we have found the inverse of$a$, wow. Since the inverse is unique modulo$p$, we can always invert non-zero integers by doing this. From a human point of view, this is really easier than using the extended euclidean algorithm.

Overview

Given a composite integer , can it be decomposed as a product of smaller integers (hopefully as a unique product of prime factors)?

As easy as it may sound, integer factorization in polynomial time on a classical computer stands one of the unsolved problems in computation for centuries!

Lets start dumb, all we need to do is check all the numbers such that or programmatically n%p==0

Seems like its an algorithm! whats all the deal about? By polynomial time, we mean polynomial time in when is a b-bit number, so what we looking at is actually a which is actually exponential (which everyone hates)

Now taking a better look at it, one would realize that a factor of can't be bigger than Other observation would be, if we already checked a number (say 2) to not be a divisor, we dont need to check any multiple of that number since it would not be a factor.

Example: Ideals of the integers

Definition - Ideal of

is an ideal we have

Example: - multiples of

Remarks:

1. we have

2. is an ideal

Example: Consider . This ideal contains

Greatest common divisor

Let be 2 integers. If

Continued Fractions

Continued fractions are a way of representing a number as a sum of an integer and a fraction.

Mathematically, a continued fraction is a representation

are complex numbers. The continued fraction with is called a simple continued fraction and continued fractions with finite number of are called finite continued fractions.

Consider example rational numbers,

the continued fractions could be written as

Notation

for the above example

Computation of simple continued fractions

The above notation might not be obvious. Observing the structure of continued fraction with few coefficients will make them more evident:

SageMath provides functions continued_fraction and continued_fraction_list to work with continued fractions. Below is presented a simple implementation of continued_fractions.

Convergents of continued fraction

One of the immediate applications of the convergents is that they give rational approximations given the continued fraction of a number. This allows finding rational approximations to irrational numbers.

Convergents of continued fractions can be calculated in sage

Continued fractions have many other applications. One such applicable in cryptology is based on Legendre's theorem in diophantine approximations.

Authors: Ariana, Zademn Reviewed by:

Introduction

Modern cryptography is based on the assumption that some problems are hard (unfeasable to solve). Since the we do not have infinite computational power and storage we usually work with finite messages, keys and ciphertexts and we say they lay in some finite sets and .

Furthermore, to get a ciphertext we usually perform some operations with the message and the key.

The study of sets, and different types of operations on them is the target of abstract algebra. In this chapter we will learn the underlying building blocks of cryptosystems and some of the hard problems that the cryptosystems are based on.

Definition

A setpaired with a binary operation is a group if the following requirements hold:

• Closure: For all - Applying the operation keeps the element in the set

• Associativity: For all

• Identity: There exists an elementsuch that for all

• Inverse: For all elements , there exists some such that . We usually denoteas

For , means when and when . For , .

If , then is commutative and the group is called abelian. We often denote the group operation by instead of and we typically use instead of .

Remark

Examples of groups

Example of non-groups

Exercise

sɹosᴉʌᴉp uoɯɯoɔ puɐ sǝɯᴉɹd ʇnoqɐ ʞuᴉɥ┴ :ʇuᴉH

Proprieties

1. The identity of a group is unique

2. The inverse of every element is unique

Orders

In abstract algebra we have two notions of order: Group order and element order

Group order

Element order

Subgroups

Definition

Proprieties

Generators

Example

Examples

// subgroups, quotient groups

// cyclic groups