Cryptography in Subgroups of Z n *

Cryptography in Subgroups of Zn* Jens Groth UCLA

RSA subgroup n = pq = (2p´rp+1)(2q´rq+1)G ≤ Zn* , |G|=p´q´RSA subgroup pair: (n, g) where g ← G |p´|=|q´|=100

Agenda • RSA subgroup • Strong RSA subgroup assumption • Homomorphic integer commitment • Digital signature • Digital signature II • Decisional RSA subgroup assumption • Homomorphic cryptosystem

Strong RSA subgroup assumption K generates RSA subgroup pair (n,g) n = pq = (2p´rp+1)(2q´rq+1), g ←G Strong RSA subgroup assumption for K: Hard to find u,w  Zn* and e,d>1: g = uwe and ud = 1 (mod n)

Homomorphic integer commitment Public key: n, g, h, where g, h ← G Commit to m: c = gmhr (small randomizer) Verify opening (u, e>1, r) of c with message m:c = ugmhr and ue = 1 Homomorphic: (Uu)gM+mhR+r = UgMhR ugmhr and (Uu)Ee = 1 Root extraction: Adversary c, e≠0 opening ce allows us to open c

Signature Public key: n, a, g, h, where a, g, h ← GSecret key: p´q´ Sign m  {0,1}l : e ← prime({0,1}l+1) r ← {0, . . . ,e-1} y = (agmhr)e-1 mod p´q´ Verify signature (y,e,r) on m: ye = agmhr Speedup: Use et, t>1 allowing smaller prime e

Signature II Public key: n, a, g, where a, g ←GSecret key: p´q´ Sign m  {0,1}l : e ← prime({0,1}l+1) y = (agm)e-1 mod p´q´ Verify signature (y,e) on m: ye = agm Theorem: Secure against adaptive chosen message attack

Proof Adversary adaptively queries m1, . . . , mk and receives signatures (y1,e1), . . . , (yk, ek) and forges signature (y,e) on m Two cases: I: e is new II: e = ei

Proof: e is new (n, ) RSA subgroup pair e1, . . . , ek ← prime({0,1}l+1) , E = ei  = r , a = E, g = E Simulated public key: n, a, g On query mi answer (yi,ei), where yi = E/eimE/ei Forged signature (y,e) on m so ye = agm = E(r+m) breaks strong RSA subgroup assumption

Proof: e = ei (n, ) RSA subgroup pair guess i e1, . . . , ek ← prime({0,1}l+1) , E = j≠ieja = rE , g = E On query mi hope to find l+1-bit prime factor ei of r+mi. Significant probability since r = sp´q´+t. Return yi = E(r+mi)/ei. Forged signature (y,ei) on m so yei = agm = E(r+m)breaks strong RSA subgroup assumption

Decisional RSA subgroup assumption K generates RSA subgroup pair (n,g) n = pq = (2p´rp+1)(2q´rq+1), g ←G with rprq B-smooth. |p´|=|q´|=160, B = 215 Decisional RSA subgroup assumption for K: Hard to distinguish G and QRn

Homomorphic cryptosystem Public key: n, g, h, where h ← G, g ← QRnSecret key: p´q´, factorization of ord(g) Encrypt m: c = ±gmhr Decrypt c: cp´q´ = ±(gmhr)p´q´ = ±(gp´q´)m rg = ord(gp´q´) is B-smooth For all pi|rg find m mod pi by searching for mi so (cp´q´)rg/pi = ±(gp´q´rg/pi)mi Chinese remainder: m mod rg

Properties of cryptosystem Homomorphic: ±gM+mhR+r = (±gMhR)(±gmhr) Root extraction: Adversary c, e≠0 opening ce allows us to open c Low expansion rate: |c|/|m| Homomorphic integer commitment

Conclusion • RSA subgroup- strong RSA subgroup assumption- decisional RSA subgroup assumption • Signature ye = agmhr speedup • Signature II ye = agm secure against CMA • Homomorphic integer commitment gmhr speedup • Homomorphic cryptosystem gmhr

Cryptography in Subgroups of Z n *