Public Key Cryptography

1. Public Key Cryptography Modular Arithmetic Tables CS 395: Computer Security

2. CS 395: Computer Security

3. CS 395: Computer Security

4. CS 395: Computer Security

5. Terminology • Asymmetric cryptography • Public key (known to entire world) • Private key (not secret key) • Encryption process (P to C with public key) • Decryption Process (C to P with private key) • Digital signature (P signed with private key) • Only holder of private key can sign, so can’t be forged • But, can be recognized! CS 395: Computer Security

6. Uses • Orders of magnitude slower than symmetric key crypto, so usually used to initiate symmetric key session • Much easier to configure, so used widely in network protocols to establish temporary shared key that is used to transmit secret (symmetric) key CS 395: Computer Security

7. Uses • Transmitting over insecure channel • Alice <puA, prA> , Bob <puB, PrB> • Alice to Bob encrypt m with puB • Bob to alice cncrypt m with puA • Accurately knowing public key of other person is one of biggest challenges of using public key crypto. CS 395: Computer Security

8. Uses • Secure storage on insecure media • Encrypt not whole file, but a randomly generated secret key with public key. Then encrypt file using secret key. • Note if lose private key, you’re out of luck. To backup, encrypt secret key with public key of a trusted friend (lawyer). • Important advantage: Alice can enrypt a message for Bob without knowing Bob’s decryption key CS 395: Computer Security

9. Uses • Authentication • If Bob wants to prove his identity with secret key crypto, he needs a different secret key shared with each potential correspondent (otherwise friends can impersonate him) • Alice can verify she’s talking to Bob (assuming she knows his public key) by sending a message r to Bob encrypted with Bob’s public key. Bob sends back the cleartext message r (which only he could have decrypted). • Note Alice need not keep any secret information in order to verify Bob. (Unlike secret key crypto, in which a backup tape with a copy of a secret key might be used to impersonate Bob) CS 395: Computer Security

10. Uses • Digital Signatures: prove message generated by particular individual • “Forged in USA (engraved on screwdriver claiming to be of brand Craftsman) • If Bob encrypts a message with his private key, this proves both • Bob generated the message • The message has not been modified (if so, the signature will no longer match!) CS 395: Computer Security

11. Uses • Digital Signatures: prove message generated by particular individual • Non-repudiation: Bob cannot deny having generated the message, since Alice could not have generated the proper signature without knowledge of Bob’s private key. • Note that this can’t be done with symmetric key. If Bob tries to claim he didn’t send the message, Alice would know he’s lying (because no one but herself and Bob would have the secret key), but Alice could not prove this to anyone else (since she herself could have generated the authentication code). CS 395: Computer Security

12. Modular Arithmetic • Addition • Can be used as scheme to encrypt digits, since it maps each digit to different digit in a reversible way (decryption is addition by additive inverse) • Actually a Caeser cipher (and not good) • Multiplication • Look at mod 10. Multiplication by 1,3,7, or 9 works, but not any of the others. Decryption done by multiplying by multiplicative inverse. • Multiplicative inverses can be found by using Euclid’s Algorithm (don’t sweat the details). Given x and n, it finds y such that xy = 1 mod n (if there is such a y) CS 395: Computer Security

13. Modular Arithmetic • Why 1,3,7,9? These are the numbers that are relatively prime to 10. All numbers that are relatively prime to 10 will have inverses, others won’t (so we can use these as ciphers, though not good ones). CS 395: Computer Security

14. Totient Function • Allegedly from total and quotient • How many numbers less than n are relatively prime to n? • Totient function, φ(n) gives this. • If n is prime, φ(n) = n-1 (1,2,…n-1) • If p and q are prime, φ(pq) = (p-1)(q-1) • 1p, 2p, … (q-1)p 1q, 2q, … (p-1)q and 0 so have • pq – ((p-1) + (q-1) + 1) = (p-1)(q-1) CS 395: Computer Security

15. Modular Exponentiation • Note exponentiation by 3 acts as encryption of digits. Is there an inverse to this operation? Sometimes. • Fact: • Not true for all n, but for all any square free n (any n that doesn’t have p^2 as a factor for any prime p) • Note that if y = 1 mod φ(n), then x^y mod n = x mod n. CS 395: Computer Security

16. RSA • Key length variable (usually around 512 or now 1024 bits) • Plaintext block must be smaller than key length • Ciphertext block will be length of key CS 395: Computer Security

17. RSA • Choose two large primes (around 256 bits each) p and q. Let n = pq (impossible to factor) • Choose number e that is relatively prime to φ(n). Can do this since you know p and q and thus φ(pq) (and from the derivation know exactly which numbers are relatively prime! • Public key is <e, n> • To make private key, find d that is the multiplicative inverse of e mod φ(n) (so ed = 1 mod φ(n)) (use Euclid’s algorithm) • Private key is <d,n> • To encrypt a number m, compute C = m^e mod n. • To decrypt: m = C^d mod n. CS 395: Computer Security

18. Questions • Why does it work? • Why is it secure? • Are operations sufficiently efficient? • How do we find big primes? CS 395: Computer Security

19. Why Does It Work? • We chose d and e so that de = 1 mod φ(n), so for any x, x^(ed) mod n = x^(ed mod φ(n)) mod n = x^1 mod n = x mod n. And (x^e)^d = x^(ed) CS 395: Computer Security

20. Why Is It Secure? • We’re not sure it is, but it seems to be • Based on premise that factoring a big number is difficult. Best known algorithm takes 30,000 MIPS years to factor a 512 bit number. • If you can factor n, you’re golden: • Problem is one of finding modular log (i.e. exponentiative inverse.) Why? Adversary knows <e,n>. So for message m, knowns ciphertext is c = m^e mod n. Also knows that key is value x that satisfies c^x = m, so if you can solve this, can find d. CS 395: Computer Security

21. Why Is It Secure? • How did we originally find this exponentiative inverse? By knowing φ(n). And this is difficult to know if you can’t factor n. If you can, then you’re golden. CS 395: Computer Security

22. Private-Key Cryptography • traditional private/secret/single key cryptography uses one key • shared by both sender and receiver • if this key is disclosed communications are compromised • also is symmetric, parties are equal • hence does not protect sender from receiver forging a message & claiming is sent by sender CS 395: Computer Security

23. Public-Key Cryptography • probably most significant advance in the 3000 year history of cryptography • uses two keys – a public & a private key • asymmetric since parties are not equal • uses clever application of number theoretic concepts • Complements, but does not replace private key crypto CS 395: Computer Security

24. Public-Key Cryptography • public-key/two-key/asymmetric cryptography involves the use of two keys: • a public-key, which may be known by anybody, and can be used to encrypt messages, and verify signatures • a private-key, known only to the recipient, used to decrypt messages, and sign (create) signatures • is asymmetric because • those who encrypt messages or verify signatures cannot decrypt messages or create signatures CS 395: Computer Security

25. Public-Key Cryptography This configuration provides privacy, but not authentication CS 395: Computer Security

26. Public-Key Cryptography This configuration provides authentication, but not privacy CS 395: Computer Security

27. Why Public-Key Cryptography? • developed to address two key issues: • key distribution – how to have secure communications in general without having to trust a KDC with your key • digital signatures – how to verify a message comes intact from the claimed sender • public invention due to Whitfield Diffie & Martin Hellman at Stanford University in 1976 • known earlier in classified community CS 395: Computer Security

28. Public-Key Characteristics • Public-Key algorithms rely on two keys with the characteristics that it is: • computationally infeasible to find decryption key knowing only algorithm & encryption key • computationally easy to en/decrypt messages when the relevant (en/decrypt) key is known • either of the two related keys can be used for encryption, with the other used for decryption (in some schemes) CS 395: Computer Security

29. Public-Key Characteristics • Public key schemes utilize problems that are easy (P type) one way but hard (NP type) the other way, eg exponentiation vs logs, multiplication vs factoring. • Consider the following analogy using padlocked boxes: • Symmetric Key: involves the sender putting a message in a box and locking it, sending that to the receiver, and somehow securely also sending them the key to unlock the box. • Public Key: The radical advance in public key schemes was to turn this around. The receiver sends an unlocked box to the sender, who puts the message in the box and locks it (easy - and having locked it cannot get at the message), and sends the locked box to the receiver who can unlock it (also easy), having the key. An attacker would have to pick the lock on the box (hard). CS 395: Computer Security

30. Public Key Privacy CS 395: Computer Security

31. Public Key Authentication CS 395: Computer Security

32. Public-Key Cryptosystems This configuration provides both authentication and privacy CS 395: Computer Security

33. Public-Key Applications • can classify uses into 3 categories: • encryption/decryption (provide secrecy) • digital signatures (provide authentication) • key exchange (of session keys) • some algorithms are suitable for all uses, others are specific to one CS 395: Computer Security

34. Security of Public Key Schemes • like private key schemes brute force exhaustive search attack is always theoretically possible • but keys used are too large (>512 bits) • security relies on a large enough difference in difficulty between easy (en/decrypt) and hard (cryptanalyse) problems • more generally the hard problem is known, its just made too hard to do in practice • requires the use of very large numbers • hence is slow compared to private key schemes CS 395: Computer Security

35. RSA • by Rivest, Shamir & Adleman of MIT in 1977 • best known & widely used public-key scheme • based on exponentiation in a finite (Galois) field over integers modulo a prime • nb. exponentiation takes O((log n)3) operations (easy) • uses large integers (eg. 1024 bits) • security due to cost of factoring large numbers • nb. factorization takes O(e log n log log n) operations (hard) CS 395: Computer Security

36. Description of RSA Algorithm • Plaintext encrypted in blocks, each block having a binary value less than some number n • I.e. block size  log2(n) • In practice, block size k bits where 2k < n  2k+1 • Let M be plaintext, C ciphertext. Then CS 395: Computer Security

37. Description of RSA Algorithm • Both sender and receiver know n • Only sender knows e, only receiver knows d • Thus: • Private key is {d,n} • Public key is {e,n} CS 395: Computer Security

38. Description of RSA Algorithm • To make this work, require • It is possible to find values of e,d, and n such that • It is relatively easy to calculate Me and Cd for all values of M<n • It is infeasible to determine d given e and n CS 395: Computer Security

39. Description of RSA Algorithm • Recall the corollary to Euler’s Theorem: If p, q prime, n=pq, m such that 0<m<n, then for any integer k, • Thus we have (1) from previous slide satisfied if we let CS 395: Computer Security

40. Description of RSA Algorithm • By rules of modular arithmetic, this can only occur if e and d are relatively prime to CS 395: Computer Security

41. RSA Ingredients CS 395: Computer Security

42. RSA Key Setup • each user generates a public/private key pair by: • selecting two large primes at random - p, q • computing their system modulus N=p.q • note ø(N)=(p-1)(q-1) • selecting at random the encryption key e • where 1<e<ø(N), gcd(e,ø(N))=1 • solve following equation to find decryption key d • e.d=1 mod ø(N) and 0≤d≤N • publish their public encryption key: KU={e,N} • keep secret private decryption key: KR={d,p,q} Note: all must remain private! CS 395: Computer Security

43. RSA Example • Select primes: p=17 & q=11 • Computen = pq =17×11=187 • Compute ø(n)=(p–1)(q-1)=16×10=160 • Select e : gcd(e,160)=1; choose e=7 • Determine d: de=1 mod 160 and d < 160 Value is d=23 since 23×7=161= 10×160+1 • Publish public key KU={7,187} • Keep secret private key KR={23,17,11} CS 395: Computer Security

44. RSA Example cont • sample RSA encryption/decryption is: • given message M = 88 (nb. 88<187) • encryption: C = 887 mod 187 = 11 • decryption: M = 1123 mod 187 = 88 CS 395: Computer Security

45. Exponentiation • can use the Square and Multiply Algorithm • a fast, efficient algorithm for exponentiation • concept is based on repeatedly squaring base • and multiplying in the ones that are needed to compute the result • look at binary representation of exponent • only takes O(log2 n) multiples for number n • eg. 75 = 74.71 = 3.7 = 10 mod 11 • eg. 3129 = 3128.31 = 5.3 = 4 mod 11 CS 395: Computer Security

46. Exponentiation CS 395: Computer Security

47. RSA Key Generation • users of RSA must: • determine two primes at random - p, q • select either e or d and compute the other • primes p,qmust not be easily derived from modulus N=p.q • means must be sufficiently large • typically guess and use probabilistic test • exponents e, d are inverses, so use Inverse algorithm to compute the other CS 395: Computer Security

48. RSA Security • three approaches to attacking RSA: • brute force key search (infeasible given size of numbers) • mathematical attacks (based on difficulty of computing ø(N), by factoring modulus N) • timing attacks (on running of decryption) CS 395: Computer Security

49. Factoring Problem • mathematical approach takes 3 forms: • factor N=p.q, hence find ø(N) and then d • determine ø(N) directly and find d • find d directly • currently believe all equivalent to factoring • have seen slow improvements over the years • as of Aug-99 best is 130 decimal digits (512) bit with GNFS • biggest improvement comes from improved algorithm • cf “Quadratic Sieve” to “Generalized Number Field Sieve” • barring dramatic breakthrough 1024+ bit RSA secure • ensure p, q of similar size and matching other constraints CS 395: Computer Security

50. Progress in Factorization • In 1977, RSA inventors dare Scientific American readers to decode a cipher printed in Martin Gardner’s column. • Reward of $100 • Predicted it would take 40 quadrillion years • Challenge used a public key size of 129 decimal digits (about 428 bits) • In 1994, a group working over the Internet solved the problem in 8 months. CS 395: Computer Security