David Evans cs.virginia/~evans

  • View
    54

  • Download
    0

Embed Size (px)

DESCRIPTION

Lecture 8: Non-secret Key Cryptosystems (How Euclid, Fermat and Euler Created E-Commerce). David Evans http://www.cs.virginia.edu/~evans. Real mathematics has no effects on war. No one has yet discovered any warlike purpose to be served by the theory of numbers. - PowerPoint PPT Presentation

Text of David Evans cs.virginia/~evans

  • David Evanshttp://www.cs.virginia.edu/~evansCS588: Security and PrivacyUniversity of VirginiaComputer ScienceLecture 8:Non-secret Key Cryptosystems (How Euclid, Fermat and Euler Created E-Commerce)Real mathematics has no effects on war. No one has yet discovered any warlike purpose to be served by the theory of numbers.G. H. Hardy, The Mathematicians Apology, 1940.

    University of Virginia CS 588

  • Public-Key Applications: PrivacyAlice encrypts message to Bob using Bobs Private KeyOnly Bob knows Bobs Private Key only Bob can decrypt messageEncryptDecryptPlaintextCiphertextPlaintextAliceBobBobs Public KeyBobs Private Key

    University of Virginia CS 588

  • SignaturesBob knows it was from Alice, since only Alice knows Alices Private KeyNon-repudiation: Alice cant deny signing message (except by claiming her key was stolen!)Integrity: Bob cant change message (doesnt know Alices Private Key)EncryptDecryptPlaintextSignedMessagePlaintextAliceBobAlices Private KeyAlices Public Key

    University of Virginia CS 588

  • Public-Key CryptographyPrivate procedure: EPublic procedure: DIdentity: E (D (m)) = D (E (m)) = mSecure: cannot determine E from DBut didnt know how to find suitable E and D

    University of Virginia CS 588

  • Properties of E and DTrap-door one way function: D (E (M)) = M E and D are easy to compute.Revealing E doesnt reveal an easy way to compute DTrap-door one way permutation: also E (D (M)) = M

    University of Virginia CS 588

  • RSAE(M) = Me mod nD(C) = Cd mod n (red = secret)n = pqp, q are primed is relatively prime to (p 1)(q 1)ed 1 (mod (p 1)(q 1))

    University of Virginia CS 588

  • RSA in Perlprint pack"C*", split/\D+/, `echo "16iII*o\U@{$/=$z; [(pop,pop,unpack"H*",)]} \EsMsKsN0[lN*1lK[d2%Sa2/d0
  • First AmendmentBecause computer source code is an expressive means for the exchange of information and ideas about computer programming, we hold that it is protected by the First Amendment.Sixth Circuit Court of Appeals, April 4, 2000Ruling that Peter Junger could post RSA source code on his web site

    University of Virginia CS 588

  • Properties of E and DTrap-door one way function: D (E (M)) = M E and D are easy to compute.Revealing E doesnt reveal an easy way to compute DTrap-door one way permutation: also E (D (M)) = M

    University of Virginia CS 588

  • Property 1: D (E (M)) = ME(M) = Me mod nD(E(M)) = (Me mod n)d mod n = Med mod n(as in D-H proof)Can we choose e, d and n so: M Med mod n1 Med-1 mod n

    University of Virginia CS 588

  • Eulers totient (phi) function (n) = number of positive integers < n which are relatively prime to n.If n is prime, (n) = n 1.Proof by contradiction.

    University of Virginia CS 588

  • Totient ProductsFor primes, p and q: n = pq (n) = (pq) (n) = numbers < n not relatively prime to pq = pq 1 numbers less than pq p, 2p, 3p, , (q 1)p ; q-1 of them q, 2q, 3q, , (p 1)q ; p-1 of them = pq 1 (q 1) (p 1) = pq (p + q) + 1 = (p 1) (q 1) = (p) (q)

    University of Virginia CS 588

  • Eulers TheoremFor a and n relatively prime:a (n) 1 mod nRecall: we are looking for e, d and n such that: Med-1 1 mod n

    University of Virginia CS 588

  • Fermats Little TheoremIf n is prime and a is not divisible by n an-1 1 mod n

    Stronger version: (in MBC p. 200):If n is prime, for any a: an a mod n

    University of Virginia CS 588

  • Fermats Little Theorem Proof{a mod n, 2a mod n, , (n-1)a mod n} = {1, 2, , (n 1) }

    if ab mod n = ac mod n and a is relatively prime to n then b = c mod n

    University of Virginia CS 588

  • Fermats Little Theorem Proof{a mod n, 2a mod n, , (n-1)a mod n} = {1, 2, , (n 1) }a 2a (n 1) a (n 1)! mod n (n 1)!an-1 (n 1)! mod n an-1 1 mod n

    University of Virginia CS 588

  • Eulers TheoremFor a and n relatively prime:a(n) 1 mod nProof:If n is prime, (n) = n 1 and an - 1 1 mod nby Fermats Little Theorem.What if n is not prime?

    University of Virginia CS 588

  • Eulers Theorem, cont.For a and n relatively prime:a(n) 1 mod n (n) = number of numbers < n not relatively prime to nWe can write those numbers as:R = { x1, x2, , x(n)}

    University of Virginia CS 588

  • Proving Eulers TheoremR = { x1, x2, , x(n)} multiply by a mod n:S = { ax1 mod n, ax2 mod n, , ax (n) mod n}S is a permutation of R:a is relatively prime to n and xi so axi is relatively prime to n hence all elements of S are in R.There are no duplicates in S. If axi mod n = axj mod n then i = j. since a is relatively prime to n.

    University of Virginia CS 588

  • Proving Eulers Theorem x1 x2 x (n) = ax1 mod n ax2 mod n ax (n) mod n (ax1 ax2 ax(n)) mod n a (n) x1 x2 x (n) mod n 1 a (n) mod nQED.

    University of Virginia CS 588

  • RecapEulers Theorem: 1 a (n) mod nfor a and n relatively primeIf n is prime, (n) = n 1.For p and q prime, (pq) = (p) (q)We are looking for e, d and n such that: Med-1 1 mod n

    University of Virginia CS 588

  • M and nSuppose M and n not relatively prime:gcd (M, n) 1Since n = pq and p and q are prime:gcd (M, p) 1 OR gcd (M, q) 1Case 1: M = cpgcd (M, q) = 1 (otherwise M is multiple of both p and q, but M < pq).So, M(q) 1 mod q(by Eulers theorem, since M and q are relatively prime)

    University of Virginia CS 588

  • M and n, contCase 1: M = cpgcd (M, q) = 1 (otherwise M is multiple of both p and q, but M < pq).So, M (q) 1 mod q(by Eulers theorem, since M and q are relatively prime)M (q) 1 mod q(M (q)) (p) 1 mod qM (q) (p) 1 mod qM (n) 1 mod q

    University of Virginia CS 588

  • M and nM (n) 1 mod qM (n) = 1 + kq for some kM = cp recall gcd (M, p) 1M M (n) = (1 + kq)cpM(n) + 1 = cp + kqcp = M + kcn M(n) + 1 M mod n

    University of Virginia CS 588

  • Wheres ED?ed 1 = (n) = (p-1)(q-1)So, we need to choose e and d:ed = (n) + 1 = n (p + q)Pick random d, relatively prime to (n) gcd (d, (n)) = 1Since d is relatively prime to (n) it has a multiplicative inverse e: de 1 mod (n)

    University of Virginia CS 588

  • Identityde 1 mod (n)So, d * e = (k * (n)) + 1 for some k.Hence,Med-1 mod n = Mk * (n) mod n

    University of Virginia CS 588

  • D (E (M)) = M Med-1 mod n = Mk * (n) mod n Euler says 1 M (n) mod n.So 1 Mk * (n) mod n 1 Med-1 mod n M Med mod nQED.

    University of Virginia CS 588

  • Properties of E and DTrap-door one way function: D (E (M)) = M E and D are easy to compute.Revealing E doesnt reveal an easy way to compute DTrap-door one way permutation: also E (D (M)) = M

    University of Virginia CS 588

  • Property 2: Easy to ComputeE(M) = Me mod nEasy every 4th grader can to exponents, every kindergartner can do mod n.How big are M, e, and n?M: 2n where n is the number of bits in MM and n must be big (~10200) for security

    University of Virginia CS 588

  • Fast Exponentiationam + n = am * anab = ab/2 * ab/2 (if 2 divides b)So, can compute Me in about log2e multiplies10150 < 2512, 512 multiplies is doable (by a computer, not a kindergartner)Faster bitwise algorithms known

    University of Virginia CS 588

  • Anything else hard to compute?We need to find large prime numbers p and qObvious way: Pick big number x for i = 2 to x - 1 if i divides x its not prime, start over with x + 1 done x is primesqrt (x)

    University of Virginia CS 588

  • How many prime numbers?Infinite (proved by Euclid, 300BC)Proof by contradiction:Suppose that there exist only finitely many primes p1 < p2 < ... < pr. Let N=(p1)(p2)...(pr) + 1N > pr so it is composite, N = p * MIf p = pi for some 1r, then, N = pi * M = pi * (p1)(p2)...(pi-1) (pi+1)...(pr) + 1 pi (M - (p1)(p2)...(pi-1) (pi+1)...(pr)) = 1Contradiction: pi > 1 Hence, there must be infinitely many primes.

    University of Virginia CS 588

  • Density of PrimesFrom http://www.utm.edu/research/primes/howmany.shtml(x) is the number of primes x

    University of Virginia CS 588

  • Approximating (x) The Prime Number Theorem: (x) ~ x/ln x So, to find a prime bigger than x, we need to make about ln x/2 guesses(Navely) Each guess requires sqrt(x) workFor 200 digits (worst imaginable case): 230 guesses * 10100More work than breaking 3DES!

    University of Virginia CS 588

  • Need a faster prime testThere are several fast probabilistic prime testsCan quickly test a prime with high probability, with a small amount of workIf we pick a non-prime, its not a disaster (exercise for reader, will be on PS3)

    University of Virginia CS 588

  • Fermat TestRecall Fermats Little Theorem: if n is prime and a is not divisible by n then an-1 1 mod nProve n is composite by finding an-1 1 mod nShowing an-1 1 mod n does not prove it is primeBut if it holds for many as it is likely than n is prime Holds for all as for some non-primes known as Carmichael Numbers: 561, 645, 1105, )

    University of Virginia CS 588

  • Properties of E and DTrap-door one way function: D (E (M)) = M E and D are easy to compute.Revealing E doesnt reveal an easy way to compute DTrap-door one way permutation: also E (D (M)) = M

    University of Virginia CS 588

  • Property 4: E (D (M)) = MD(M) = Md mod nE(D(M)) = (Md mod n)e mod n = Mde mod n = Med mod n = M(from the property 1 proof)

    University of Virginia CS 588

  • Applications of RSAPrivacy: Bob encrypts message to Alice using EAOnly Alice knows DASignatures: Alice encrypts a message to Alice using DABob decrypts u