Diffie-Hellman 协议中的弱密钥

1. Diffie-Hellman 协议中的弱密钥

2. 提纲 • Diffie-Hellman 协议 • 近世代数基础 • 关于Diffie-Hellman 协议的攻击方法 • 有限域上的Diffie-Hellman问题 • 一般线性群 (GLn)上的Diffie-Hellman问题 • 结论

3. Diffie-Hellman 协议

4. Diffie-Hellman Conjecture • Discrete Logarithm Problem (DLP) • To find z given gz • Diffie-Hellman problem (DHP) • Problem of solving the shared key • Diffie-Hellman conjecture (DHC) • To solve the DHP we need to solve the DLP

5. 代数基础 • Group (G, +) satisfying the properties of closure, associativity, identity and inverse. • Cyclic Group A group that can be generated by a single element g (the group generator). • Subgroup Subset H of group elements of a group G that satisfies the four group requirements.

6. 代数基础 (Cont..) • Ring (R, +, *) satisfying the properties of additiveassociativity, additive commutativity, additive identity, additive inverse, multiplicative associativity and left and right distributivity. • Fields Set of elements that satisfies the group axioms for both addition and multiplication and has no zero divisors. • General Linear Group General linear group of degree n over a field F (written as GL(n,F)) is the group of n-by-n invertible matrices with entries from F, with the group operation that of ordinary matrix multiplication.

7. 代数基础(Cont..) Minimal Polynomial Minimal polynomial of a matrix is the polynomial in A of smallest degree n such that Example For matrix The minimal polynomial is

8. 代数基础(Cont..) • Irreducible Polynomial A polynomial is said to be irreducible if it cannot be factored into nontrivial polynomials over the same field. • Extension Field A field K is said to be an extension field of field F if F is a subfield of K. For example, the complex numbers are an extension field of the real numbers

9. Trivial attacks on Diffie-Hellman Protocol • Simple Exponent • k = 1 or l =1 • k = p-1 or l = p-1 • Simple Substitution Attacks gk = 1 or gl = 1

10. Mathematical attacks on Diffie-Hellman Protocol • Subgroup Confinement Attack Example : p = 19, g = 2 Generated group {2, 4, 8, 16, 13, 7, 14, 9, 18, 17, 15, 11, 3, 6, 12, 5, 10, 1} k = 2, A = 22 = 4 Subgroup generated by A=SA = {4, 16, 7, 9, 17, 11, 6, 5, 1} l = 3, B = 23 = 8 Sub-group generated by B = SB = {8, 7, 18, 11, 12, 1} Kab =2 6 = 7 Note : Kab belongs to SA intersection SB Solution: Use Safe primes ( p= 2q + 1 )

11. Mathematical attacks on Diffie-Hellman Protocol (Cont..) Attacks based on composite order subgroup

12. Diffie-Hellman Problem over Field Extensions • Assume extension field of prime field 2 over irreducible polynomial x3 + x + 1. • Let g be the generator of the extension field. Hence, g3 + g + 1 = 0 • Now, generating all the elements of the field…..

13. Diffie-Hellman Problem over Field Extensions • Take k = 6 and l = 2 g3 + g + 1 = 0 • Now, A = gk = g6 = g2 + 1 = f(g) f(x)= x2 + 1 B = gl = g2 Shared key is g12 = g7.g5 = g5 = g2 + g+ 1 Also, f(B) = f(g2) = g4 + 1 = g2 + g+ 1

14. Conditions for DHP over Field Extensions A = gk B = gl There exist polynomial f(x) such that • A = f(g) • Bk = f(B) There exist polynomial h(x) such that • B = h(g) • Al = h(A)

15. Conjugate Class A = gk B = gl A triple (g, k, l) is said to belong to the conjugate class if minimal polynomial of g and A are same. MP(g) = MP(A) or minimal polynomial of g and B are same. MP(g) = MP(B)

16. The Modulus Condition A = gk B = gl The triple (g, k, l) is said to satisfy the modulus condition if any one of the following conditions hold xk mod (MP of g) = xk mod LCM( MP of g, MP of B) Or xl mod (MP of g) = xl mod LCM( MP of g, MP of A)

17. Implication of Modulus Condition The following statements hold : • There exists a polynomial f(x) which satisfies A = f(g) and Bk = f(B) iff (G, k, l) satisfies the first modulus condition. Such a polynomial is unique. • There exists a polynomial h(x) which satisfies B = h(g) and Al = h(A) iff (G, k, l) satisfies the second modulus condition. Such a polynomial is unique.

18. Diffie-Hellman Problem over General Linear Groups • A matrix G in GLn(K) and matrices A = Gk and B = Gl are given for some unknown positive integers k, l < ord(G). Determine the matrix Gkl = Al =Bk. The matrix Gkl is called the shared key of the DH protocol. • The triple (G,A,B) shall be called the public data of the DHP.

19. Example • Consider the field be F53 and G in GL2 given by • Let k = 3, l = 53 then Now the polynomial solution of the linear system A = f(G) gives f(x) = x + 47.

20. Example (Cont..) • The shared key is • It is easy to see that G53×3 = f(B) = B + 47I.

21. Conclusion • Diffie-Hellman Conjecture does not always hold . • For certain class of keys, the shared secret key can be determined without solving the Discrete Logarithm Problem. • There is no direct method available till date to enumerate all such keys except for a limited subset of keys that satisfy the Conjugate Class Property.

22. Thank you!