1 / 58

Public Key Cryptography

Public Key Cryptography. Tom Horton Alfred C. Weaver CS453 Electronic Commerce. References. Chap. 12 of our textbook Web articles on PGP, GPG, Phil Zimmerman Bruce Schneier, “Applied Cryptography,” John Wiley & Sons Andrew Tanenbaum, “Computer Networks,” Prentice-Hall

sancho
Download Presentation

Public Key Cryptography

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Public Key Cryptography Tom Horton Alfred C. Weaver CS453 Electronic Commerce

  2. References • Chap. 12 of our textbook • Web articles on PGP, GPG, Phil Zimmerman • Bruce Schneier, “Applied Cryptography,” John Wiley & Sons • Andrew Tanenbaum, “Computer Networks,” Prentice-Hall • Jim Kurose and Keith Ross, “Computer Networking,” Addison-Wesley

  3. Overview of PKC • Also known as using asymmetric keys • A pair of keys • (Can think of this as one long key in two parts) • One used for encryption, the other for decryption • One publicly accessible, the other private to one person • Algorithms / Systems • RSA (Rivest, Shamir, Adelman) • DSA (Digital Signature Algorithm) • PGP, OpenPGP, GPG (Gnu’s PGP) • ssh, sftp • SSL

  4. Original Plaintext Ciphertext Plaintext Encryption Decryption Encryption with Receiver’s Public Key Decryption with Receiver’s Private Key Public Key Cryptography

  5. Mailbox Analogy • Part of the system is public yet secure • Mailbox with slot • Public: everyone can access it and leave info • Secure: info not accessible to anyone except • Usefully accessing the info requires a private key • The recipient has something personal to get to the data and read it • Matches common use (shown in slide): Sending encrypted information to someone • Other ways to use this

  6. Public Key Cryptography • Key is some large number (string of bits) • Key has two parts, one public, one private • Public key is well-known • Trusted agents verify the public key • Private key is a secret forever • Key is arbitrarily large • Encrypt with receiver’s public key • Decrypt with receiver’s private key

  7. Public Key Cryptography • 1. Choose two large primes, p and q • 2. Compute n = (p)(q) • 3. Compute z = (p-1)(q-1) • 4. Choose d such that it is relatively prime to z (no common divisor) • 5. Find e such that (e)(d) modulo z = 1 • 6. Public key is (e,n) • 7. Private key is (d,n)

  8. Public Key Cryptography • 8. To encrypt plaintext message m, compute c = me mod n • 9. To decrypt ciphertext message c, compute m = cd mod n.

  9. PKC Example • 1. Choose two (large) primes, p and q • p = 3 and q = 11 • 2. Compute n = (p)(q) • n = (3)(11) = 33 • 3. Compute z = (p-1)(q-1) • z = (2)(10) = 20 • 4. Choose d such that it is relatively prime to z (no common divisor) • choose d = 7 • 7 and 20 have no common divisor

  10. PKC Example • 5. Find e such that (e)(d) modulo z = 1 • find e such that 7e mod 20 = 1 • one solution is e = 3 • 6. Public key is (e,n) • public key = (3, 33) • 7. Private key is (d,n) • private key is (7, 33)

  11. PKC Example • 8. To encrypt plaintext message m, compute c = me mod n • c = m3 mod 33 • note: require m < n • 9. To decrypt ciphertext message c, compute m = cd mod n • m = c7 mod 33

  12. PKC Example • Encode letter “S” as 19 just because it is the 19th letter of the alphabet, so plaintext message m = “S” = 19 • Of course we could use any other encoding, say ASCII • Encryption (e=3): • c = me mod n = 193 mod 33 • c = 6,859 mod 33 = 28 • Decryption (d=7): • m = cd mod n = 287 mod 33 • m = 13,492,928,512 mod 33 = 19

  13. Work an Example 1. Choose two (not so large) primes, p and q p = 47 and q = 71 = 3337 = n 2. n = (p)(q) = (47)(71) = 3220 = z 3. z = (p-1)(q-1) = (46)(70) 4. Choose e (or d) such that it is relatively prime to z (i.e., e and z share no common divisors) e=5? 3220/5=644 no e=23? 3220/23=140 no e=35? 3220/35=92 no e=79? 3220 and 79 share no divisors ... yes

  14. Work an Example 5. Choose d such that (e)(d) modulo z = 1 So: 79d mod z = 1 now what? Compute candidate values of d d = 1019 or 4239 or 7459 or ... 6. Public key = (e, n) = (79, 3337) 7. Private key = (d, n) = (1019, 3337)

  15. Work an Example 8. Encrypt: c = me mod n Let the message = m = 3 c = 379mod 3337 = 4926960980478197443869440340212776567 mod 3337 = 158

  16. Work an Example 9. Decrypt: m = cd mod n m = 1581019 mod 3337 m = 3

  17. Now Do This One m = 12871283761287623450982346231237462836428 e = 98982347326723847658728742384782347823477 d = 87385671910957210238457823842398472397471 n = 91239128371982491824912873918237918239183 What is me mod n? What is cd mod n? 123981203981297532739456374587469898274502399 129837129837923593045734658264927341204389245 987239472934729375923457935793457938573947593 981239123912371982749128379357935793579872391 893459873495873294573298572986798256984569873 987347373477609823497243958713057312409857753 134957831294709246798570398422362456698987987 239048203850923486095860396840958609832492398 203895793867938679387593857392720020204230...

  18. Public Key Cryptography • Now imagine that p and q are hundreds of digits long! • Power of PKC based upon the difficulty of factoring large numbers • Commercial firms provide: • choice of p and q • suitable e and d • software for large integer arithmetic • registration of keys to a particular entity

  19. RSA Implementation • Java implementation of the RSA version of public key cryptography • http://intercom.virginia.edu/crypto/crypto.html

  20. Public Key + Symmetric Key • Public key algorithms are slow when used with large numbers • Commercial practice: • generate random symmetric key for each message or session • use symmetric key techniques to encrypt message(s) • encrypt the random symmetric key using PKC • provide recipient with encrypted symmetric key, signed with a digital signature, and a signature certificate

  21. Digital Signatures • Digital signatures use PKC techniques to sign a message, proving the authenticity of the sender • Sender encrypts some message with his private key • Receiver consults a certification authority to verify sender’s public key • Receiver uses sender’s verified public key to decrypt sender’s message

  22. Digital Signatures Original Plaintext Ciphertext Plaintext Encryption Decryption Encryption with Sender’s Private Key Decryption with Sender’s Public Key

  23. Digital Signatures • ciphertext = (message)private-key mod n • message = (ciphertext)public-key mod n • In other words, reverse the use of “e” and “d” from PKC • But, PKC is slow when the keys are large • So instead, take a “hash” of the message and sign that

  24. Digital Signatures • Message = m = “ABCDE” • Let hash be mod 10 sum of bytes • hash(m) = (65+66+67+68+69) mod 10 • = 335 mod 10 = 5 • If any byte of message changes, there is a 1 in 10 change that we will catch it • Poor choice of h, but illustrative • Later we learn how to make a good hash function

  25. Digital Signatures • Sender computes hash H of plaintext • Sender encrypts hash with his private key • digsig = (H)private mod n • Receiver decrypts the digsig with sender’s public key • Hdecrypted = (digsig)public mod n • Receiver recovers the plaintext of the message from its ciphertext (however that’s done) • Receiver uses same hash function on recovered plaintext to get computed hash value, Hcomputed • If Hcomputed = Hdecrypted, then with probability p the plaintext was not altered enroute, and with probability 1 the hash was signed by the owner of the public key • How do we make p vanishingly small? (soon)

  26. Still Not Done • PKC is very, very powerful • So is symmetric key if key is long • But there are still ways to attack the process, if not the algorithm

  27. 1. Bob sends his public key 2. Alice sends her public key 4. Bob sends encrypted message to Alice 7. Alice sends encrypted message to Bob Bob Talks to Alice 3. Bob encrypts with Alice’s public key 5. Alice decrypts with Alice’s private key 6. Alice encrypts with Bob’s public key 8. Bob decrypts with Bob’s private key Bob and Alice are now communicating securely --- or are they?

  28. Risks Bob Alice Mallory replaces Alice's and Bob's public key with her own; records data and re-encrypts it with the other person's purported public key Mallory

  29. How Secure is Symmetric Key Cryptography? • DES is toast • Known that DES can be broken in a few hours, and probably in just minutes or seconds • If DES can be broken in one second, then 128-bit AES takes 119 trillion years • 3DES (168 bits) takes longer • 256-bit AES takes far longer • This assumes there are no trap doors (and no reason to suspect there are any)

  30. How Secure is Public Key Cryptography? • As secure as you wish it to be • Moore’s Law says that computing power doubles at no increase in cost every 18 months • Approximately true since 1976 • As computing power progresses, increase key length • But beware distributed computing! • Make sure key is much, much longer than any one machine can solve, because many computers might be working on it

  31. How Secure is Modern Crypto? • For now, crypto provides very serious protection for electronic commerce transactions when using • symmetric keys of length >= 128 bits • public keys of length >= 1024 bits • If cryptography is so strong, why is this not a completely solved problem?

  32. Key Management • Crypto is strong – so criminals, hackers, and the government go after key management • If the keys are not secure, the communication is not secure • The threat to modern cryptography is key management • key distribution • key revocation • key storage • key theft

  33. Digital Signature Sender’s data Hash algorithm (SHA-1, MD5) Hash code (message digest) Timestamp PKC encryption Sender’s private key Validate with sender’s public key Digital signature Timestamp

  34. Hash Code • What makes a good hash code? • Recall why we use it: • the hash code is digitally signed (rather than the message itself) for computational economy • the hash code is used to prove message integrity • hash(P) = hash ( D ( E ( P) ) )

  35. Characteristics • One-way hash function H operates on arbitrary length message M and returns a fixed length hash value, h=H(M) • Many functions can do that • Our goals are • given M, easy to compute h • given h, difficult to compute M s.t. H(M)=h • given M, hard to find M’ such that H(M’) = H(M)

  36. Hash Codes (Message Digests) One example scheme: 01011111 …. 11 01001110 …. 10 00100001 …. 01 01001001 …. 11 11010100 …. 10 11110000 …. 11 10001011 …. 00 File for which you wish to prove integrity (M) H = exclusive-OR h = 11010110 ... 10 = H(M)

  37. Discussion • Let the hash function H() be the n-bit wide exclusive-or of the message M. • Is that a good hash function? • Advantages? • Disadvantages?

  38. Discuss What if H(M) is a 16-bit wide exclusive OR? M = “I will buy your house for $1,000,000” M base 2 = 01100101 01101100 00101010 01101010 ..... H(M) = 10010100 01010110 Premise: If I use EX-OR as hash, and digitally sign the hash value, then neither you nor I can change the contract because doing so would change the hash, and thus H(D(E(P))) != H(P). Is that true?

  39. Cheating with Digital Signatures 1. Change $1,000,000 to $1 2. Hash is only 16 bits wide. 3. There are only 216 hash values. 4. Start generating other variations on the message that are merely cosmetic, e.g., replace space with space-backspace-space, or replace “.<CR>” with “.<space><CR>” 5. If this were a contract with >16 lines, making or not making one change on each of 16 lines would produce >216 variations of the document. 6. Not all 216 hash values are necessarily present---this just shows that it is relatively easy to produce a large number of variants quickly and easily – and automatically!

  40. Cheating with Digital Signatures • So take the original document and digitally sign it. • Take a version of the altered document where H(M’)=H(M) and sign that one also. • Present your check for $1. • Go to court to enforce the digitally signed contract M’ where the price is $1.

  41. Lessons • Lesson #1: H(M) needs to produce a lot more than 16 bits. Target 128 or 256. • Lesson #2: And while we’re at it, let’s stir the bits when computing H(M) so that hash bits are a function of more than just a single column of bits. Want each hash bit hi to be a function of many input bits (as with DES).

  42. MD5 • Bruce Schneier, “Applied Cryptography”, pages 436-441.

  43. Key Escrow • The story of the Clipper chip and the plan for key escrow

  44. Threats • Distributed computing (grid computing) on the scale of the Internet • Quantum computing

  45. Pretty Good Privacy • PGP designed by Phillip Zimmerman for electronic mail • Uses three known techniques: • IDEA for encrypting email message • International Data Exchange Algorithm • block cipher with 64-bit blocks • similar in concept but different in details from DES • uses 128-bit keys • patented, but free for non-commercial use

More Related