360 likes | 497 Views
Public Key Crypto RSA. RSA. CSCI284 Spring 2007 GWU Sections 5.1, 5.2.2, 5.3. How does Alice send Bob the decryption key in private key crypto?. If Alice wants it such that anyone can decrypt her messages, but know that they came from her
E N D
Public Key Crypto • RSA RSA CSCI284 Spring 2007 GWU Sections 5.1, 5.2.2, 5.3
How does Alice send Bob the decryption key in private key crypto? • If Alice wants it such that anyone can decrypt her messages, but know that they came from her • Suppose she could make the decryption key available in a public place • This would require that the decryption key should not give any information on the encryption key, in particular it should not be equal to it CS284-162/Spring07/GWU/Vora/RSA
How does Alice send Bob the decryption key in private key crypto? contd • If she wants it so that only Bob can read her messages, and Bob is ok with anyone sending him messages in this way • Suppose Bob makes his encryption key available publicly • No one should be able to compute the decryption key from the encryption key • This is the dual of the previous case CS284-162/Spring07/GWU/Vora/RSA
Public Key Cryptography Two injective functions f and g such that fg=I i.e. messages encrypted with one can be decrypted with the other; functions include association with key f cannot be used to find g and vice versa One is made public, the other kept private Encryption with public function provides confidential transmission, decryption with public function provides authentication CS284-162/Spring07/GWU/Vora/RSA
One-way function A one-way function is easy in the forward direction, difficult in the reverse direction. Example: f(x) = xa mod m CS284-162/Spring07/GWU/Vora/RSA
Trapdoor One-way Function A trapdoor one-way function is easy in the reverse direction for someone with access to a trapdoor (secret information enabling easy inversion). Example: if f(x) = xa mod m where gcd(a, (m))= 1, and (m) = pq for primes p and q, knowledge of p or q is a trapdoor CS284-162/Spring07/GWU/Vora/RSA
RSACocks (’73), Rivest, Shamir, Adleman (’76) n = pq, p and q (large) primes P = C = Zn K = {(n, p, q, a, b}: ab 1 mod (n)} fK(m) = ma mod n gK(m) = mb mod n CS284-162/Spring07/GWU/Vora/RSA
Efficient exponentiation(from Memon notes) Usual approach to computing xc mod n is inefficient when c is large. Example: 551involves 50 multiplications mod n Instead, represent c as bit string bk-1 … b0 and use the following algorithm: z = 1 For i = k-1 downto 0 do z = z2 mod n if bi = 1 then z = z x mod n How many multiplications? k = 2ceiling(log2c) CS284-162/Spring07/GWU/Vora/RSA
Example Calculate 551 mod 7 efficiently 51 = 110011 = 25 + 24 + 21 + 20 551 = ((((52)2)2)2)2 (((52)2)2)2 52 51 How many multiplications did you need? CS284-162/Spring07/GWU/Vora/RSA
551 mod 7 CS284-162/Spring07/GWU/Vora/RSA
RSA: Key generation Find p and q (two large random primes) n pq (n) (p-1)(q-1) Choose random a invertible mod (n) s.t 1 < a < (n) i.e. a s.t gcd(a, (n)) = 1 Use Euclidean algorithm to find b=a-1mod (n) Not known how to determine (n) without p and q One key: (n, a) other key (n, b) CS284-162/Spring07/GWU/Vora/RSA
Example CS284-162/Spring07/GWU/Vora/RSA
A Trapdoor One-way Function? • RSA encryption is believed to be a one-way function with the factorization of n as the trapdoor. • It is not known if encryption really is one-way • It is not known if there are other trapdoors • However, for security, it is certainly required that it not be possible to factor n CS284-162/Spring07/GWU/Vora/RSA
Security of RSAIs it based on hardness of factoring n? • It is not known if: • factoring a product of two primes into its prime components is • solvable in polynomial time • NP-complete • there are other trapdoors to RSA, i.e. other ways of breaking it in general • Factoring is an easy problem in the quantum computing model. CS284-162/Spring07/GWU/Vora/RSA
Computational Complexity Computational complexity of the following operations on x (k bit) and y (l bit), k l: • x + y • x – y • xy • Floor(x/y) O(l(k-l)) • gcd(x, y) O(k3) CS284-162/Spring07/GWU/Vora/RSA
Computational Complexity mod n Computational complexity of the following operations on mod n, where n is a k-bit integer: • x + y • x – y • xy • x-1 • xc c< n O(k2log c) = O(k3) CS284-162/Spring07/GWU/Vora/RSA
RSA: Computational complexity • 512 bit primes, n is 1024 bits • Encryption: b3 where a plaintext character is b-bits • Decryption by brute force: 2bb3 • Key generation: Primes? O(b2), O(b3) CS284-162/Spring07/GWU/Vora/RSA
Encryption of blocks of symbols Block ABCD…, each symbol is base N (e.g. N=2, 16) Convert a block of a few symbols to an integer mod n RSA encrypt Convert back to base N Example. CS284-162/Spring07/GWU/Vora/RSA
RSA Decryption Show that fK and gK are inverses f(g(x)) = xba mod n = xt(n)+1 mod n = x xt (n) mod n What do we do now? CS284-162/Spring07/GWU/Vora/RSA
We will need • Chinese Remainder Theorem (CRT) • Lagrange’s Theorem CS284-162/Spring07/GWU/Vora/RSA
CRT: Solve congruences What is x? 17x 3 mod 101 5x 2 mod 7 CS284-162/Spring07/GWU/Vora/RSA
Chinese Remainder Theorem There is exactly one number modulo xy which is bmodx and Bmody if x and y are relatively prime. Proof: Suppose not. Then: First number = ax + b = Ay + B Second number = cx + b = Cy + B (a-c)x = (A-C)y • y | (a-c)x y | (a-c) because x and y rel. prime • a = my + c • first number = mxy + cx + b = second number modulo xy CS284-162/Spring07/GWU/Vora/RSA
Determine a number x given x = ai modmi for i = 1 … n gcd(mi mj ) = 1 ij Let M = i mi And Mi = M/mi Find yi such that yiMi = 1 mod mi Then x = (I aiyiMi) mod M Example. CS284-162/Spring07/GWU/Vora/RSA
So we have shown that: There is exactly one number that satisfies the congruences, and that it can be determined using the formula provided. Define : ZM Zm1 Zm2 …. Zmr (x) = (x mod m1 x mod m2 ...…x mod mr) Example. CRT is equivalent to saying that is bijective (one-to-one, i.e. injective; and onto, i.e. surjective) CS284-162/Spring07/GWU/Vora/RSA
Order of an element Smallest number such that repeated group operation on the element gives the identity That is, for any ggroup G with operation ○, i is the smallest number such that o(g) = i g○ g ○...○g = group identity Example { i times CS284-162/Spring07/GWU/Vora/RSA
Lagrange’s theorem on the order of a group element Theorem: Suppose G is a multiplicative group of order n (i.e. the group operation is multiplication) and gG. Then the order of g divides n. Example: multiplicative group. True also of additive groups. Example: additive group. CS284-162/Spring07/GWU/Vora/RSA
Lagrange’s theorem on the order of a group element - II Proof: Consider the following relation: a b iff axi = b for some i • is an equivalence relation because: • axo(x) = a • If a bthen b = axi and a = bx-i and b a • If a b and b c, then b = axi and c = bxj = axi+j and a c Hence, the cosets of this relation partition the group and are of equal size. Example: the relation for some x and composite n CS284-162/Spring07/GWU/Vora/RSA
Lagrange’s theorem on the order of a group element - III Hence, the size of any coset divides the size of the group if it is finite {e, x1, x2, …xo(x)} is a coset of size o(x) Because any coset that contains x = {a s.t axi = x i} = {a = x1-i i} = {xj j } Hence o(x) | n Example, composite n CS284-162/Spring07/GWU/Vora/RSA
Euler Phi function(number of invertible elements in Zm) If m = pq, 1, 2, 3, …p, ..2p, ..3p, …qpq numbers divisible by p 1, 2, 3, …q, ..2q, ..3q, …pqp numbers divisible by q pq only number counted twice. No other numbers. • pq – p – q + 1 = (p-1)(q-1) invertible elements CS284-162/Spring07/GWU/Vora/RSA
Can also show previous result using CRT CS284-162/Spring07/GWU/Vora/RSA
RSA Decryption Show that fK and gK are inverses f(g(x)) = xba mod n = xt(n)+1 mod n = x xt (n) mod n = x mod n if x Zn* (By Lagrange’s Theorem) What if x Zn\Zn*? CS284-162/Spring07/GWU/Vora/RSA
x xt (n) mod n = ? For x Zn\Zn* Write Zn = ZpX Zq Use CRT: x (x mod p, x mod q) = wlog (0, d) (because x Zn\Zn*) x(n) = (0, d(n)) = (0, 1) x. x(n) = (0, 1) (0, d(n)) = x CS284-162/Spring07/GWU/Vora/RSA
A simple inefficient algorithm for generating a prime • Generate a b-bit random number • It is prime with probability 1/ln 2b = 1/(ln2 b) = O(1/b) • Generate enough and will be done, in O(b) complexity. • How do you check if it is prime? CS284-162/Spring07/GWU/Vora/RSA
Eratosthenes Sieve If want a prime of length b bits, list the numbers 2 to 2b/2 Starting from the beginning, delete all multiples of each prime: delete 4, 6, 8, …; 6, 9, …… At the end will be left with the primes Check if these primes divide your randomly generated number If not, it is prime. CS284-162/Spring07/GWU/Vora/RSA