UNIT 2 PUBLIC KEY ENCRYPTION - India’s Premier ... · UNIT 2 PUBLIC KEY ENCRYPTION •Number...
79
UNIT 2 PUBLIC KEY ENCRYPTION •Number Theory – Prime number – Modular arithmetic – Euclid’s algorithm ‐ Fermet’s and Euler’s theorem – Primality – Chinese remainder theorem – Discrete logarithm • Public key cryptography and RSA • Key distribution – Key management – Diffie Hellman key exchange • Elliptic curve cryptography Slides Courtesy of William Stallings, “Cryptography & Network Security”, Pearson Education, 4th Edition
UNIT 2 PUBLIC KEY ENCRYPTION - India’s Premier ... · UNIT 2 PUBLIC KEY ENCRYPTION •Number Theory –Prime number – Modular arithmetic – Euclid’s algorithm ‐ Fermet’s
•Number Theory – Prime number –Modular arithmetic – Euclid’s algorithm ‐Fermet’s and Euler’s theorem – Primality –Chinese remainder theorem – Discrete logarithm • Public key cryptography and RSA • Key distribution – Key management –Diffie Hellman key exchange • Elliptic curve cryptography
Slides Courtesy of William Stallings, “Cryptography & Network Security”, Pearson Education, 4th Edition
Chapter‐1 Number Theory
• Prime number
• Modular arithmetic
• Euclid’s algorithm
• Fermet’s and Euler’s theorem
• Primality
• Chinese remainder theorem
• Discrete logarithm
Prime Numbers
• prime numbers only have divisors of 1 and self – they cannot be written as a product of other numbers
– note: 1 is prime, but is generally not of interest
• eg. 2,3,5,7 are prime, 4,6,8,9,10 are not
• prime numbers are central to number theory
• list of prime number less than 200 is: 2 3 5 7 11 13 17 19 23 29 31 37 41 43 47 53 59 61 67 71 73 79 83 89 97 101 103 107 109 113 127 131 137 139 149 151 157 163 167 173 179 181 191 193 197 199
Presenter
Presentation Notes
A central concern of number theory is the study of prime numbers. Indeed, whole books have been written on the subject. An integer p>1 is a prime number if and only if its only divisors are 1 and itself. Prime numbers play a critical role in number theory and in the techniques discussed in this chapter. Stallings Table 8.1 (excerpt above) shows the primes less than 2000. Note the way the primes are distributed. In particular note the number of primes in each range of 100 numbers.
Prime Factorisation
• to factor a number n is to write it as a product of other numbers: n=a x b x c
• note that factoring a number is relatively hard compared to multiplying the factors together to generate the number
• the prime factorisation of a number n is when its written as a product of primes – eg. 91=7x13 ; 3600=24x32x52
Presenter
Presentation Notes
The idea of "factoring" a number is important - finding numbers which divide into it. Taking this as far as can go, by factorising all the factors, we can eventually write the number as a product of (powers of) primes - its prime factorisation. Note also that factoring a number is relatively hard compared to multiplying the factors together to generate the number.
Relatively Prime Numbers & GCD
• two numbers a, b are relatively prime if have no common divisors apart from 1 – eg. 8 & 15 are relatively prime since factors of 8 are 1,2,4,8 and of 15 are 1,3,5,15 and 1 is the only common factor
• conversely can determine the greatest common divisor by comparing their prime factorizations and using least powers– eg. 300=21x31x52 18=21x32 henceGCD(18,300)=21x31x50=6
Presenter
Presentation Notes
Have the concept of “relatively prime” if two number share no common factors other than 1. Another common problem is to determine the "greatest common divisor” GCD(a,b) which is the largest number that divides into both a & b.
Modular Arithmetic
• define modulo operator “a mod n” to be remainder when a is divided by n
• use the term congruence for: a = b mod n– when divided by n, a & b have same remainder – eg. 100 = 34 mod 11
• b is called a residue of a mod n– since with integers can always write: a = qn + b– usually chose smallest positive remainder as residue
• ie. 0 <= b <= n-1
– process is known as modulo reduction• eg. -12 mod 7 = -5 mod 7 = 2 mod 7 = 9 mod 7
Presenter
Presentation Notes
Given any positive integer n and any nonnegative integer a, if we divide a by n, we get an integer quotient q and an integer remainder r. In modular arithmetic we are only interested in the remainder (or residue) after division by some modulus, and results with the same remainder are regarded as equivalent. Two integers a and b are said to be congruent modulo n, if (a mod n) =(b mod n).
Divisors
• say a non‐zero number b divides a if for some m have a=mb (a,b,m all integers)
• that is b divides into a with no remainder
• denote this b|a• and say that b is a divisor of a
• eg. all of 1,2,3,4,6,8,12,24 divide 24
Presenter
Presentation Notes
Define concept of “divisors”. We say that a nonzero b divides a if a=m.b for some m, where a, b, and m are integers. That is, b divides a if there is no remainder on division. Can denote this as b|a, and say that b is a divisor of a. For example, the positive divisors of 24 are 1,2,3,4,6,8,12, and 24.
Modular Arithmetic Operations
• is 'clock arithmetic'
• uses a finite number of values, and loops back from either end
• modular arithmetic is when do addition & multiplication and modulo reduce answer
• can do reduction at any point, ie– a+b mod n = [a mod n + b mod n] mod n
Presenter
Presentation Notes
Modular arithmetic is where we perform arithmetic operations within the confines of some set of integers mod n. It uses a finite number of values, and loops back from either end where needed. When reducing, we "usually" want to find the positive remainder after dividing by the modulus. For positive numbers, this is simply the normal remainder. For negative numbers we have to "overshoot" (ie find the next multiple larger than the number) and "come back" (ie add a positive remainder to get the number); rather than have a "negative remainder". Then note some important properties of modular arithmetic which mean you can modulo reduce at any point and obtain an equivalent answer.
Modular Arithmetic
• can do modular arithmetic with any group of integers: Zn = {0, 1, … , n-1}
• form a commutative ring for addition
• with a multiplicative identity
• note some peculiarities– if (a+b)=(a+c) mod n then b=c mod n
– but if (a.b)=(a.c) mod n then b=c mod n only if a is relatively prime to n
Presenter
Presentation Notes
Note some more important properties of modular arithmetic, as discussed further in the text.
Example showing addition in GF(8), from Stallings Table 4.1a.
Greatest Common Divisor (GCD)
• a common problem in number theory
• GCD (a,b) of a and b is the largest number that divides evenly into both a and b – eg GCD(60,24) = 12
• often want no common factors (except 1) and hence numbers are relatively prime– eg GCD(8,15) = 1
– hence 8 & 15 are relatively prime
Presenter
Presentation Notes
One of the basic techniques of number theory is the Euclidean algorithm, which is a simple procedure for determining the greatest common divisor of two positive integers. Use the notation gcd(a,b) to mean the greatest common divisor of a and b. The positive integer c is said to be the greatest common divisor of a and b if c is a divisor of a and of b; and any divisor of a and b is a divisor of c. State that two integers a and b are relatively prime if their only common positive integer factor is 1, ie GCD(a,b)=1.
Euclidean Algorithm
• an efficient way to find the GCD(a,b)• uses theorem that:
– GCD(a,b) = GCD(b, a mod b)
• Euclidean Algorithm to compute GCD(a,b) is: EUCLID(a,b)1. A = a; B = b 2. if B = 0 return A = gcd(a, b) 3. R = A mod B 4. A = B 5. B = R 6. goto 2
Presenter
Presentation Notes
The Euclidean algorithm is an efficient way to find the GCD(a,b). The Euclidean algorithm is derived from the observation that if a & b have a common factor d (ie. a=m.d & b=n.d) then d is also a factor in any difference between them, vis: a-p.b = (m.d)-p.(n.d) = d.(m-p.n). Euclid's Algorithm keeps computing successive differences until it vanishes, at which point the greatest common divisor has been reached.
Example GCD(1970,1066)
1970 = 1 x 1066 + 904 gcd(1066, 904)1066 = 1 x 904 + 162 gcd(904, 162)904 = 5 x 162 + 94 gcd(162, 94)162 = 1 x 94 + 68 gcd(94, 68)94 = 1 x 68 + 26 gcd(68, 26)68 = 2 x 26 + 16 gcd(26, 16)26 = 1 x 16 + 10 gcd(16, 10)16 = 1 x 10 + 6 gcd(10, 6)10 = 1 x 6 + 4 gcd(6, 4)6 = 1 x 4 + 2 gcd(4, 2)4 = 2 x 2 + 0 gcd(2, 0)
Presenter
Presentation Notes
Illustrate how we can compute successive instances of GCD(a,b) = GCD(b,a mod b), example taken from text. Note this MUST always terminate since will eventually get a mod b = 0 (ie no remainder left). Answer is then the last non-zero value. In this case GCD(1970,1066)=2.
Fermat's Theorem
• ap-1 = 1 (mod p)– where p is prime and gcd(a,p)=1
• also known as Fermat’s Little Theorem• also ap = p (mod p)
• useful in public key and primality testing
Presenter
Presentation Notes
Two theorems that play important roles in public-key cryptography are Fermat’s theorem and Euler’s theorem. Fermat’s theorem (also known as Fermat’s Little Theorem) as listed above, states an important property of prime numbers. See Stallings section 8.2 for its proof.
Euler Totient Function ø(n)
• when doing arithmetic modulo n • complete set of residues is: 0..n-1
• reduced set of residues is those numbers (residues) which are relatively prime to n – eg for n=10,
– complete set of residues is {0,1,2,3,4,5,6,7,8,9}
– reduced set of residues is {1,3,7,9}
• number of elements in reduced set of residues is called the Euler Totient Function ø(n)
Presenter
Presentation Notes
Now introduce the Euler’s totient function ø(n), defined as the number of positive integers less than n & relatively prime to n. Note the term “residue” refers to numbers less than some modulus, and the “reduced set of residues” to those numbers (residues) which are relatively prime to the modulus (n). Note by convention that ø(1) = 1.
Euler Totient Function ø(n)
• to compute ø(n) need to count number of residues to be excluded
• in general need prime factorization, but– for p (p prime) ø(p) = p-1– for p.q (p,q prime) ø(pq) =(p-1)x(q-1)
• eg.ø(37) = 36ø(21) = (3–1)x(7–1) = 2x6 = 12
Presenter
Presentation Notes
To compute ø(n) need to count the number of residues to be excluded. In general you need use a complex formula on the prime factorization of n, but have a couple of special cases as shown.
Euler's Theorem
• a generalisation of Fermat's Theorem • aø(n) = 1 (mod n)
– for any a,n where gcd(a,n)=1
• eg.a=3;n=10; ø(10)=4; hence 34 = 81 = 1 mod 10
a=2;n=11; ø(11)=10;hence 210 = 1024 = 1 mod 11
Presenter
Presentation Notes
Euler's Theorem is a generalization of Fermat's Theorem for any number n. See Stallings section 8.2 for its proof.
Primality Testing
• often need to find large prime numbers • traditionally sieve using trial division
– ie. divide by all numbers (primes) in turn less than the square root of the number
– only works for small numbers• alternatively can use statistical primality tests based on properties of primes – for which all primes numbers satisfy property – but some composite numbers, called pseudo‐primes, also satisfy the property
• can use a slower deterministic primality test
Presenter
Presentation Notes
For many cryptographic functions it is necessary to select one or more very large prime numbers at random. Thus we are faced with the task of determining whether a given large number is prime. Traditionally sieve for primes using trial division of all possible prime factors of some number, but this only works for small numbers. Alternatively can use repeated statistical primality tests based on properties of primes, and then for certainty, use a slower deterministic primality test, such as the AKS test.
Chinese Remainder Theorem
• used to speed up modulo computations
• if working modulo a product of numbers – eg. mod M = m1m2..mk
• Chinese Remainder theorem lets us work in each moduli mi separately
• since computational cost is proportional to size, this is faster than working in the full modulus M
Presenter
Presentation Notes
One of the most useful results of number theory is the Chinese remainder theorem (CRT), so called because it is believed to have been discovered by the Chinese mathematician Sun-Tse in around 100 AD. It is very useful in speeding up some operations in the RSA public-key scheme, since it allows you to do perform calculations modulo factors of your modulus, and then combine the answers to get the actual result. Since the computational cost is proportional to size, this is faster than working in the full modulus sized modulus.
Chinese Remainder Theorem
• can implement CRT in several ways• to compute A(mod M)
– first compute all ai = A mod mi separately– determine constants ci below, where Mi = M/mi– then combine results to get answer using:
Presenter
Presentation Notes
One of the useful features of the Chinese remainder theorem is that it provides a way to manipulate (potentially very large) numbers mod M, in terms of tuples of smaller numbers.This can be useful when M is 150 digits or more. However note that it is necessary to know beforehand the factorization of M. See worked examples in Stallings section 8.4.
Primitive Roots
• from Euler’s theorem have aø(n)mod n=1 • consider am=1 (mod n), GCD(a,n)=1
– must exist for m = ø(n) but may be smaller
– once powers reach m, cycle will repeat
• if smallest is m = ø(n) then a is called a primitive root
• if p is prime, then successive powers of a "generate" the group mod p
• these are useful but relatively hard to find
Presenter
Presentation Notes
Consider the powers of an integer modulo n. By Eulers theorem, for every relatively prime a, there is at least one power equal to 1 (being ø(n)), but there may be a smaller value. If the smallest value is m = ø(n) then a is called a primitive root. If n is prime, then the powers of a primitive root “generate” all residues mod n. Such generators are very useful, and are used in a number of public-key algorithms, but they are relatively hard to find.
Discrete Logarithms
• the inverse problem to exponentiation is to find the discrete logarithm of a number modulo p
• that is to find x such that y = gx (mod p)• this is written as x = logg y (mod p)• if g is a primitive root then it always exists, otherwise it may not, eg.x = log3 4 mod 13 has no answer x = log2 3 mod 13 = 4 by trying successive powers
• whilst exponentiation is relatively easy, finding discrete logarithms is generally a hard problem
Presenter
Presentation Notes
Discrete logarithms are fundamental to a number of public-key algorithms, including Diffie-Hellman key exchange and the digital signature algorithm (DSA). Discrete logs (or indices) share the properties of normal logarithms, and are quite useful. The logarithm of a number is defined to be the power to which some positive base (except 1) must be raised in order to equal that number. If working with modulo arithmetic, and the base is a primitive root, then an integral discrete logarithm exists for any residue. However whilst exponentiation is relatively easy, finding discrete logs is not, in fact is as hard as factoring a number. This is an example of a problem that is "easy" one way (raising a number to a power), but "hard" the other (finding what power a number is raised to giving the desired answer). Problems with this type of asymmetry are very rare, but are of critical usefulness in modern cryptography.
Summary
• have considered:– prime numbers
– Fermat’s and Euler’s Theorems & ø(n)
– Primality Testing
– Chinese Remainder Theorem
– Discrete Logarithms
Presenter
Presentation Notes
Chapter 8 summary.
Chapter‐2 Public key cryptography
• Public key cryptography
• RSA
Private‐Key Cryptography
• traditional private/secret/single keycryptography uses one key
• shared by both sender and receiver • if this key is disclosed communications are compromised
• also is symmetric, parties are equal • hence does not protect sender from receiver forging a message & claiming is sent by sender
Presenter
Presentation Notes
So far all the cryptosystems discussed, from earliest history to modern times, have been private/secret/single key (symmetric) systems. All classical, and modern block and stream ciphers are of this form, and still rely on the fundamental building blocks of substitution and permutation (transposition).
Public‐Key Cryptography
• probably most significant advance in the 3000 year history of cryptography
• uses two keys – a public & a private key
• asymmetric since parties are not equal
• uses clever application of number theoretic concepts to function
• complements rather than replaces private key crypto
Presenter
Presentation Notes
Will now discuss the radically different public key systems, in which two keys are used. The development of public-key cryptography is the greatest and perhaps the only true revolution in the entire history of cryptography. It is asymmetric, involving the use of two separate keys, in contrast to symmetric encryption,which uses only one key. Anyone knowing the public key can encrypt messages or verify signatures, but cannot decrypt messages or create signatures, counter-intuitive though this may seem. It works by the clever use of number theory problems that are easy one way but hard the other. Note that public key schemes are neither more nor less secure than private key (security depends on the key size for both), nor do they replace private key schemes (they are too slow to do so), rather they complement them. Both also have issues with key distribution, requiring the use of some suitable protocol.
Why Public‐Key Cryptography?
• developed to address two key issues:– key distribution – how to have secure communications in general without having to trust a KDC with your key
– digital signatures – how to verify a message comes intact from the claimed sender
• public invention due to Whitfield Diffie & Martin Hellman at Stanford Uni in 1976– known earlier in classified community
Presenter
Presentation Notes
The concept of public-key cryptography evolved from an attempt to attack two of the most difficult problems associated with symmetric encryption: key distribution and digital signatures. The idea of public key schemes, and the first practical scheme, which was for key distribution only, was published in 1977 by Diffie & Hellman. The concept had been previously described in a classified report in 1970 by James Ellis (UK CESG) - and subsequently declassified [ELLI99]. Its interesting to note that they discovered RSA first, then Diffie-Hellman, opposite to the order of public discovery! There is also a claim that the NSA knew of the concept in the mid-60’s [SIMM93].
Public‐Key Cryptography
• public‐key/two‐key/asymmetric cryptography involves the use of two keys: – a public‐key, which may be known by anybody, and can be used to encrypt messages, and verify signatures
– a private‐key, known only to the recipient, used to decrypt messages, and sign (create) signatures
• is asymmetric because– those who encrypt messages or verify signatures cannotdecrypt messages or create signatures
Presenter
Presentation Notes
Emphasize here the radical difference with Public-Key Cryptography is the use of two related keys but with very different roles and abilities. Anyone knowing the public key can encrypt messages or verify signatures, but cannot decrypt messages or create signatures, all thanks to some clever use of number theory.
Public‐Key Cryptography
Presenter
Presentation Notes
Stallings Figure 9.1a “Public-Key Cryptography”, shows that a public-key encryption scheme has six ingredients: plaintext, encryption algorithm, public & private keys, ciphertext & decryption algorithm. Consider the following analogy using padlocked boxes: traditional schemes involve the sender putting a message in a box and locking it, sending that to the receiver, and somehow securely also sending them the key to unlock the box. The radical advance in public key schemes was to turn this around, the receiver sends an unlocked box (their public key) to the sender, who puts the message in the box and locks it (easy - and having locked it cannot get at the message), and sends the locked box to the receiver who can unlock it (also easy), having the (private) key. An attacker would have to pick the lock on the box (hard).
Public‐Key Characteristics
• Public‐Key algorithms rely on two keys where:– it is computationally infeasible to find decryption key knowing only algorithm & encryption key
– it is computationally easy to en/decrypt messages when the relevant (en/decrypt) key is known
– either of the two related keys can be used for encryption, with the other used for decryption (for some algorithms)
Presenter
Presentation Notes
Asymmetric algorithms rely on one key for encryption and a different but related key for decryption. These algorithms have the following important characteristic: that it is computationally infeasible to determine the decryption key given only knowledge of the cryptographic algorithm and the encryption key. That is public key schemes utilise problems that are easy (P type) one way but hard (NP type) the other way, eg exponentiation vs logs, multiplication vs factoring. In addition, some algorithms, such as RSA, are also able to use either key as public & other private.
Public‐Key Cryptosystems
Presenter
Presentation Notes
Stallings Figure 9.4 “Public-Key Cryptosystems: Secrecy and Authentication” illustrates the essential elements of a public-key encryption scheme. Note that public-key schemes can be used for either secrecy or authentication, or both (as shown here). In this case, separate key pairs are used for each of these purposes. The receiver owns and creates secrecy keys, sender owns and creates authentication keys. In practice typically DO NOT do this, because of the computational cost of public-key schemes. Rather encrypt a session key which is then used with a block cipher to encrypt the actual message, and separately sign a hash of the message as a digital signature - this will be discussed more later.
Public‐Key Applications
• can classify uses into 3 categories:– encryption/decryption (provide secrecy)
– digital signatures (provide authentication)
– key exchange (of session keys)
• some algorithms are suitable for all uses, others are specific to one
Presenter
Presentation Notes
Public-key systems are characterized by the use of a cryptographic type of algorithm with two keys. Depending on the application, the sender uses either the sender’s private key or the receiver’s public key, or both, to perform some type of cryptographic function. In broad terms, we can classify the use of public-key cryptosystems into the three categories: • Encryption/decryption: The sender encrypts a message with the recipient’s public key. • Digital signature: The sender “signs”a message with its private key, either to the whole message or to a small block of data that is a function of the message. • Key exchange: Two sides cooperate to exchange a session key. Several different approaches are possible, involving the private key(s) of one or both parties. Some algorithms are suitable for all three applications, whereas others can be used only for one or two of these applications.
Security of Public Key Schemes
• like private key schemes brute force exhaustive search attack is always theoretically possible
• but keys used are too large (>512bits) • security relies on a large enough difference in difficulty between easy (en/decrypt) and hard(cryptanalyse) problems
• more generally the hard problem is known, but is made hard enough to be impractical to break
• requires the use of very large numbers• hence is slow compared to private key schemes
Presenter
Presentation Notes
Public key schemes are no more or less secure than private key schemes - in both cases the size of the key determines the security. Note also that you can't compare key sizes - a 64-bit private key scheme has very roughly similar security to a 512-bit RSA - both could be broken given sufficient resources. But with public key schemes at least there is usually a firmer theoretical basis for determining the security since its based on well-known and well studied number theory problems.
RSA
• by Rivest, Shamir & Adleman of MIT in 1977
• best known & widely used public‐key scheme
• based on exponentiation in a finite (Galois) field over integers modulo a prime – nb. exponentiation takes O((log n)3) operations (easy)
• uses large integers (eg. 1024 bits)
• security due to cost of factoring large numbers – nb. factorization takes O(e log n log log n) operations (hard)
Presenter
Presentation Notes
RSA is the best known, and by far the most widely used general public key encryption algorithm, and was first published by Rivest, Shamir & Adleman of MIT in 1978 [RIVE78]. Since that time RSA has reigned supreme as the most widely accepted and implemented general-purpose approach to public-key encryption. It is based on exponentiation in a finite (Galois) field over integers modulo a prime, using large integers (eg. 1024 bits). Its security is due to the cost of factoring large numbers.
RSA Key Setup
• each user generates a public/private key pair by: • selecting two large primes at random ‐ p, q• computing their system modulus n=p.q
– note ø(n)=(p-1)(q-1)
• selecting at random the encryption key e• where 1<e<ø(n), gcd(e,ø(n))=1
• solve following equation to find decryption key d– e.d=1 mod ø(n) and 0≤d≤n
• publish their public encryption key: PU={e,n} • keep secret private decryption key: PR={d,n}
Presenter
Presentation Notes
RSA key setup is done once (rarely) when a user establishes (or replaces) their public key, using the steps as shown. The exponent e is usually fairly small, just must be relatively prime to ø(n). Need to compute its inverse mod ø(n) to find d. It is critically important that the factors p & q of the modulus n are kept secret, since if they become known, the system can be broken. Note that different users will have different moduli n.
RSA Use
• to encrypt a message M the sender:– obtains public key of recipient PU={e,n}– computes: C = Me mod n, where 0≤M<n
• to decrypt the ciphertext C the owner:– uses their private key PR={d,n}– computes: M = Cd mod n
• note that the message M must be smaller than the modulus n (block if needed)
Presenter
Presentation Notes
The actual RSA encryption and decryption computations are each simply a single exponentiation mod (n). Note that the message must be smaller than the modulus. The “magic” is in the choice of the exponents which makes the system work.
Why RSA Works
• because of Euler's Theorem:– aø(n)mod n = 1 where gcd(a,n)=1
• in RSA have:– n=p.q– ø(n)=(p-1)(q-1)– carefully chose e & d to be inverses mod ø(n)– hence e.d=1+k.ø(n) for some k
• hence :Cd = Me.d = M1+k.ø(n) = M1.(Mø(n))k
= M1.(1)k = M1 = M mod n
Presenter
Presentation Notes
Can show that RSA works as a direct consequence of Euler’s Theorem, so that raising a number to power e then d (or vica versa) results in the original number!
RSA Example ‐ Key Setup
1. Select primes: p=17 & q=112. Compute n = pq =17 x 11=1873. Compute ø(n)=(p–1)(q-1)=16 x 10=1604. Select e: gcd(e,160)=1; choose e=75. Determine d: de=1 mod 160 and d < 160
Value is d=23 since 23x7=161= 10x160+16. Publish public key PU={7,187}7. Keep secret private key PR={23,187}
Presenter
Presentation Notes
Here walk through example RSA key generation using “trivial” sized numbers. Selecting primes requires the use of a primality test. Finding d as inverse of e mod ø(n) requires use of Euclid’s Inverse algorithm (see Ch4)
RSA Example ‐ En/Decryption
• sample RSA encryption/decryption is: • given message M = 88 (nb. 88<187)
• encryption:C = 887 mod 187 = 11
• decryption:M = 1123 mod 187 = 88
Presenter
Presentation Notes
Then show that the encryption and decryption operations are simple exponentiations mod 187. Rather than having to laborious repeatedly multiply, can use the "square and multiply" algorithm with modulo reductions to implement all exponentiations quickly and efficiently (see next).
Exponentiation
• can use the Square and Multiply Algorithm
• a fast, efficient algorithm for exponentiation
• concept is based on repeatedly squaring base
• and multiplying in the ones that are needed to compute the result
• look at binary representation of exponent
• only takes O(log2 n) multiples for number n – eg. 75 = 74.71 = 3.7 = 10 mod 11– eg. 3129 = 3128.31 = 5.3 = 4 mod 11
Presenter
Presentation Notes
To perform the modular exponentiations, you can use the “Square and Multiply Algorithm”, a fast, efficient algorithm for doing exponentiation. The idea is to repeatedly square the base, and multiply in the ones that are needed to compute the result, as found by examining the binary representation of the exponent.
Exponentiation
c = 0; f = 1
for i = k downto 0
do c = 2 x c
f = (f x f) mod n
if bi == 1 then
c = c + 1
f = (f x a) mod n
return f
Presenter
Presentation Notes
State here one version of the “Square and Multiply Algorithm”, from Stallings Figure 9.7.
Efficient Encryption
• encryption uses exponentiation to power e• hence if e small, this will be faster
– often choose e=65537 (216‐1)– also see choices of e=3 or e=17
• but if e too small (eg e=3) can attack– using Chinese remainder theorem & 3 messages with different modulii
• if e fixed must ensure gcd(e,ø(n))=1– ie reject any p or q not relatively prime to e
Presenter
Presentation Notes
To speed up the operation of the RSA algorithm using the public key, can choose to use a small value of e (but not too small, since its then vulnerable to attack). Must then ensure any p or q chosen are relatively prime to the fixed e (and reject and find another if not), for system to work.
Efficient Decryption
• decryption uses exponentiation to power d– this is likely large, insecure if not
• can use the Chinese Remainder Theorem (CRT) to compute mod p & q separately. then combine to get desired answer– approx 4 times faster than doing directly
• only owner of private key who knows values of p & q can use this technique
Presenter
Presentation Notes
To speed up the operation of the RSA algorithm using the private key, can use the Chinese Remainder Theorem (CRT) to compute mod p & q separately, and then combine results to get the desired answer. This is approx 4 times faster than calculating “C^d mod n” directly. Note that only the owner of the private key details (who knows the values of p & q) can do this, but of course that’s exactly where help is needed, since if e is small then d will be likely be large!
RSA Key Generation
• users of RSA must:– determine two primes at random ‐ p, q– select either e or d and compute the other
• primes p,qmust not be easily derived from modulus n=p.q– means must be sufficiently large– typically guess and use probabilistic test
• exponents e, d are inverses, so use Inverse algorithm to compute the other
Presenter
Presentation Notes
Before the application of the public-key cryptosystem, each participant must generate a pair of keys, which requires finding primes and computing inverses. Both the prime generation and the derivation of a suitable pair of inverse exponents may involve trying a number of alternatives. Typically make random guesses for a possible p or q, and check using a probabalistic primality test whether the guessed number is indeed prime. If not, try again. Note that the prime number theorem shows that the average number of guesses needed is not too large. Then compute decryption exponent d using Euclid’s Inverse Algorithm, which is quite efficient.
RSA Security
• possible approaches to attacking RSA are:– brute force key search (infeasible given size of numbers)
– mathematical attacks (based on difficulty of computing ø(n), by factoring modulus n)
– timing attacks (on running of decryption)
– chosen ciphertext attacks (given properties of RSA)
Presenter
Presentation Notes
Note some possible possible approaches to attacking the RSA algorithm, as shown. The defense against the brute-force approach is the same for RSA as for other cryptosystems, namely, use a large key space. Thus the larger the number of bits in d, the better. However because the calculations involved both in key generation and in encryption/decryption are complex, the larger the size of the key, the slower the system will run. Will now review the other possible types of attacks.
Factoring Problem
• mathematical approach takes 3 forms:– factor n=p.q, hence compute ø(n) and then d– determine ø(n) directly and compute d– find d directly
• currently believe all equivalent to factoring– have seen slow improvements over the years
• as of May‐05 best is 200 decimal digits (663) bit with LS
– biggest improvement comes from improved algorithm• cf QS to GHFS to LS
– currently assume 1024‐2048 bit RSA is secure• ensure p, q of similar size and matching other constraints
Presenter
Presentation Notes
We can identify three approaches to attacking RSA mathematically, as shown. Mathematicians currently believe all equivalent to factoring. See Stallings Table 9.4 for progress in factoring, where see slow improvements over the years, with the biggest improvements coming from improved algorithms. The best current algorithm is the “Lattice Sieve” (LS), which replaced the “Generalized Number Field Sieve” (GNFS), which replaced the “Quadratic Sieve”(QS). Have to assume computers will continue to get faster, and that better factoring algorithms may yet be found. Numbers of size 1024-2048 bits look reasonable at present, provided the factors meet other constraints.
Timing Attacks
• developed by Paul Kocher in mid‐1990’s• exploit timing variations in operations
– eg. multiplying by small vs large number – or IF's varying which instructions executed
• infer operand size based on time taken • RSA exploits time taken in exponentiation• countermeasures
– use constant exponentiation time– add random delays– blind values used in calculations
Presenter
Presentation Notes
Had a new category of attacks developed by Paul Kocher in mid-1990’s, based on observing how long it takes to compute the cryptographic operations. Timing attacks are applicable not just to RSA, but to other public-key cryptography systems. This attack is alarming for two reasons: It comes from a completely unexpected direction and it is a ciphertextonly attack. A timing attack is somewhat analogous to a burglar guessing the combination of a safe by observing how long it takes for someone to turn the dial from number to number. Although the timing attack is a serious threat, there are simple countermeasures that can be used, including using constant exponentiation time algorithms, adding random delays, or using blind values in calculations.
Chosen Ciphertext Attacks
• RSA is vulnerable to a Chosen Ciphertext Attack (CCA)
• attackers chooses ciphertexts & gets decrypted plaintext back
• choose ciphertext to exploit properties of RSA to provide info to help cryptanalysis
• can counter with random pad of plaintext• or use Optimal Asymmetric Encryption
Padding (OASP)
Presenter
Presentation Notes
The RSA algorithm is vulnerable to a chosen ciphertext attack (CCA). CCA is defined as an attack in which adversary chooses a number of ciphertexts and is then given the corresponding plaintexts, decrypted with the target’s private key. The adversary exploits properties of RSA and selects blocks of data that, when processed using the target’s private key, yield information needed for cryptanalysis. Can counter simple attacks with random pad of plaintext. More sophisticated variants need to modify the plaintext using a procedure known as optimal asymmetric encryption padding (OAEP).
Summary
• have considered:– principles of public‐key cryptography
– RSA algorithm, implementation, security
Presenter
Presentation Notes
Chapter 9 summary.
Chapter‐3 Key Management
• Key distribution – Key management – DiffieHellman key exchange
Key Management
• public‐key encryption helps address key distribution problems
• have two aspects of this:– distribution of public keys
– use of public‐key encryption to distribute secret keys
Presenter
Presentation Notes
One of the major roles of public-key encryption has been to address the problem of key distribution, with two distinct aspects: the distribution of public keys, and the use of public-key encryption to distribute secret keys.
Distribution of Public Keys
• can be considered as using one of:– public announcement
– publicly available directory
– public‐key authority
– public‐key certificates
Presenter
Presentation Notes
Several techniques have been proposed for the distribution of public keys, which can mostly be grouped into the categories shown.
Public Announcement
• users distribute public keys to recipients or broadcast to community at large– eg. append PGP keys to email messages or post to news groups or email list
• major weakness is forgery– anyone can create a key claiming to be someone else and broadcast it
– until forgery is discovered can masquerade as claimed user
Presenter
Presentation Notes
The point of public-key encryption is that the public key is public, hence any participant can send his or her public key to any other participant, or broadcast the key to the community at large. Its major weakness is forgery, anyone can create a key claiming to be someone else and broadcast it, and until the forgery is discovered they can masquerade as the claimed user.
Publicly Available Directory
• can obtain greater security by registering keys with a public directory
• directory must be trusted with properties:– contains {name,public‐key} entries– participants register securely with directory– participants can replace key at any time– directory is periodically published– directory can be accessed electronically
• still vulnerable to tampering or forgery
Presenter
Presentation Notes
A greater degree of security can be achieved by maintaining a publicly available dynamic directory of public keys. Maintenance and distribution of the public directory would have to be the responsibility of some trusted entity or organization. This scheme is clearly more secure than individual public announcements but still has vulnerabilities to tampering or forgery.
Public‐Key Authority
• improve security by tightening control over distribution of keys from directory
• has properties of directory• and requires users to know public key for the directory
• then users interact with directory to obtain any desired public key securely– does require real‐time access to directory when keys are needed
Presenter
Presentation Notes
Stronger security for public-key distribution can be achieved by providing tighter control over the distribution of public keys from the directory. It requires users to know the public key for the directory, and that they interact with directory in real-time to obtain any desired public key securely. Note that a total of seven messages are required, as shown next.
Public‐Key Authority
Presenter
Presentation Notes
Stallings Figure 10.3 “Public-Key Authority” illustrates a typical protocol interaction. See text for details of steps in protocol.
Public‐Key Certificates
• certificates allow key exchange without real‐time access to public‐key authority
• a certificate binds identity to public key– usually with other info such as period of validity, rights of use etc
• with all contents signed by a trusted Public‐Key or Certificate Authority (CA)
• can be verified by anyone who knows the public‐key authorities public‐key
Presenter
Presentation Notes
An further improvement is to use certificates, which can be used to exchange keys without contacting a public-key authority, in a way that is as reliable as if the keys were obtained directly from a public-key authority. A certificate binds an identity to public key, with all contents signed by a trusted Public-Key or Certificate Authority (CA). This can be verified by anyone who knows the public-key authorities public-key. One scheme has become universally accepted for formatting public-key certificates: the X.509 standard. X.509 certificates are used in most network security applications, including IP security, secure sockets layer (SSL), secure electronic transactions (SET), and S/MIME. Will discuss it in much more detail later.
Public‐Key Certificates
Presenter
Presentation Notes
Stallings Figure 10.4 “Public-Key Certificates” illustrates such a scheme. See text for details of steps in protocol.
Public‐Key Distribution of Secret Keys
• use previous methods to obtain public‐key• can use for secrecy or authentication• but public‐key algorithms are slow• so usually want to use private‐key encryption to protect message contents
• hence need a session key• have several alternatives for negotiating a suitable session
Presenter
Presentation Notes
Once public keys have been distributed or have become accessible, secure communication that thwarts eavesdropping, tampering, or both, is possible. However, few users will wish to make exclusive use of public-key encryption for communication because of the relatively slow data rates that can be achieved. Accordingly, public-key encryption provides for the distribution of secret keys to be used for conventional encryption.
Simple Secret Key Distribution
• proposed by Merkle in 1979– A generates a new temporary public key pair
– A sends B the public key and their identity
– B generates a session key K sends it to A encrypted using the supplied public key
– A decrypts the session key and both use
• problem is that an opponent can intercept and impersonate both halves of protocol
Presenter
Presentation Notes
An extremely simple scheme was put forward by Merkle [MERK79]. But it is insecure against an adversary who can intercept messages and then either relay the intercepted message or substitute another message. Such an attack is known as a man-in-the-middle attack [RIVE84].
Public‐Key Distribution of Secret Keys
• if have securely exchanged public‐keys:
Presenter
Presentation Notes
Stallings Figure 10.6 “Public-Key Distribution of Secret Keys” illustrates such an exchange. See text for details of steps in protocol. Note that these steps correspond to final 3 of Figure 10.3, hence can get both secret key exchange and authentication in a single protocol.
Hybrid Key Distribution
• retain use of private‐key KDC
• shares secret master key with each user
• distributes session key using master key
• public‐key used to distribute master keys– especially useful with widely distributed users
• rationale– performance
– backward compatibility
Presenter
Presentation Notes
Yet another way to use public-key encryption to distribute secret keys is a hybrid approach in use on IBM mainframes [LE93]. This scheme retains the use of a key distribution center (KDC) that shares a secret master key with each user and distributes secret session keys encrypted with the master key. A public key scheme is used to distribute the master keys. The addition of a public-key layer provides a secure, efficient means of distributing master keys. This is an advantage in a configuration in which a single KDC serves a widely distributed set of users.
Diffie‐Hellman Key Exchange
• first public‐key type scheme proposed
• by Diffie & Hellman in 1976 along with the exposition of public key concepts– note: now know that Williamson (UK CESG) secretly proposed the concept in 1970
• is a practical method for public exchange of a secret key
• used in a number of commercial products
Presenter
Presentation Notes
The idea of public key schemes, and the first practical scheme, which was for key distribution only, was published in 1977 by Diffie & Hellman. The concept had been previously described in a classified report in 1970 by Williamson (UK CESG) - and subsequently declassified in 1987, see [ELLI99].
Diffie‐Hellman Key Exchange
• a public‐key distribution scheme – cannot be used to exchange an arbitrary message – rather it can establish a common key – known only to the two participants
• value of key depends on the participants (and their private and public key information)
• based on exponentiation in a finite (Galois) field (modulo a prime or a polynomial) ‐ easy
• security relies on the difficulty of computing discrete logarithms (similar to factoring) – hard
Presenter
Presentation Notes
The purpose of the algorithm is to enable two users to securely exchange a key that can then be used for subsequent encryption of messages. The algorithm itself is limited to the exchange of secret values, which depends on the value of the public/private keys of the participants. The Diffie-Hellman algorithm uses exponentiation in a finite (Galois) field (modulo a prime or a polynomial), and depends for its effectiveness on the difficulty of computing discrete logarithms.
Diffie‐Hellman Setup
• all users agree on global parameters:– large prime integer or polynomial q– a being a primitive root mod q
• each user (eg. A) generates their key– chooses a secret key (number): xA < q– compute their public key: yA = a
xA mod q
• each user makes public that key yA
Presenter
Presentation Notes
In the Diffie-Hellman key exchange algorithm, there are two publicly known numbers: a prime number q and an integer a that is a primitive root of q. The prime q and primitive root a can be common to all using some instance of the D-H scheme. Note that the primitive root a is a number whose powers successively generate all the elements mod q. Users Alice and Bob choose random secrets x's, and then "protect" them using exponentiation to create their public y's. For an attacker monitoring the exchange of the y's to recover either of the x's, they'd need to solve the discrete logarithm problem, which is hard.
Diffie‐Hellman Key Exchange
• shared session key for users A & B is KAB: KAB = a
xA.xB mod q= yA
xB mod q (which B can compute) = yB
xA mod q (which A can compute)
• KAB is used as session key in private‐key encryption scheme between Alice and Bob
• if Alice and Bob subsequently communicate, they will have the same key as before, unless they choose new public‐keys
• attacker needs an x, must solve discrete log
Presenter
Presentation Notes
The actual key exchange for either party consists of raising the others "public key' to power of their private key. The resulting number (or as much of as is necessary) is used as the key for a block cipher or other private key scheme. For an attacker to obtain the same value they need at least one of the secret numbers, which means solving a discrete log, which is computationally infeasible given large enough numbers. Note that if Alice and Bob subsequently communicate, they will have the same key as before, unless they choose new public-keys.
Diffie‐Hellman Example
• users Alice & Bob who wish to swap keys:• agree on prime q=353 and a=3• select random secret keys:
– A chooses xA=97, B chooses xB=233
• compute respective public keys:– yA=3
97 mod 353 = 40 (Alice)
– yB=3233
mod 353 = 248 (Bob)
• compute shared session key as:– KAB= yB
xA mod 353 = 24897
= 160 (Alice)– KAB= yA
xB mod 353 = 40233
= 160 (Bob)
Presenter
Presentation Notes
Here is an example of Diffie-Hellman from the text.
Key Exchange Protocols
• users could create random private/public D‐H keys each time they communicate
• users could create a known private/public D‐H key and publish in a directory, then consulted and used to securely communicate with them
• both of these are vulnerable to a meet‐in‐the‐Middle Attack
• authentication of the keys is needed
Presenter
Presentation Notes
Detail a couple of possible Key Exchange Protocols based on Diffie-Hellman. Note that these are vulnerable to a meet-in-the-Middle Attack, and that authentication of the keys is needed.
Chapter‐4 Elliptic curve cryptography
• Elliptic curve cryptography
Elliptic Curve Cryptography
• majority of public‐key crypto (RSA, D‐H) use either integer or polynomial arithmetic with very large numbers/polynomials
• imposes a significant load in storing and processing keys and messages
• an alternative is to use elliptic curves
• offers same security with smaller bit sizes
• newer, but not as well analysed
Presenter
Presentation Notes
A major issue with the use of Public-Key Cryptography, is the size of numbers used, and hence keys being stored. Recently, an alternate approach has emerged, elliptic curve cryptography (ECC), which performs the computations using elliptic curve arithmetic instead of integer or polynomial arithmetic. Already, ECC is showing up in standardization efforts, including the IEEE P1363 Standard for Public-Key Cryptography. Although the theory of ECC has been around for some time, it is only recently that products have begun to appear and that there has been sustained cryptanalytic interest in probing for weaknesses. Accordingly, the confidence level in ECC is not yet as high as that in RSA.
Real Elliptic Curves
• an elliptic curve is defined by an equation in two variables x & y, with coefficients
• consider a cubic elliptic curve of form– y2 = x3 + ax + b– where x,y,a,b are all real numbers– also define zero point O
• have addition operation for elliptic curve– geometrically sum of Q+R is reflection of intersection R
Presenter
Presentation Notes
First consider elliptic curves using real number values. See text for detailed rules of addition and relation to zero point O. Can derive an algebraic interpretation of addition, based on computing gradient of tangent and then solving for intersection with curve. There is also an algebraic description of additions over elliptic curves, see text.
Real Elliptic Curve Example
Presenter
Presentation Notes
Stallings Figure 10.9b “Example of Elliptic Curves”, illustrates the geometric interpretation of elliptic curve addition.
• have two families commonly used:– prime curves Ep(a,b) defined over Zp
• use integers modulo a prime
• best in software
– binary curves E2m(a,b) defined over GF(2n)• use polynomials with binary coefficients
• best in hardware
Presenter
Presentation Notes
Elliptic curve cryptography makes use of elliptic curves in which the variables and coefficients are all restricted to elements of a finite field. Two families of elliptic curves are used in cryptographic applications: prime curves over Zp (best for software use), and binary curves over GF(2m) (best for hardware use). There is no obvious geometric interpretation of elliptic curve arithmetic over finite fields. The algebraic interpretation used for elliptic curve arithmetic over does readily carry over. See text for detailed discussion.
Elliptic Curve Cryptography
• ECC addition is analog of modulo multiply• ECC repeated addition is analog of modulo exponentiation
• need “hard” problem equiv to discrete log– Q=kP, where Q,P belong to a prime curve– is “easy” to compute Q given k,P– but “hard” to find k given Q,P– known as the elliptic curve logarithm problem
• Certicom example: E23(9,17)
Presenter
Presentation Notes
Elliptic Curve Cryptography uses addition as an analog of modulo multiply, and repeated addition as an analog of modulo exponentiation. The “hard” problem is the elliptic curve logarithm problem.
ECC Diffie‐Hellman
• can do key exchange analogous to D‐H• users select a suitable curve Ep(a,b)• select base point G=(x1,y1)
– with large order n s.t. nG=O
• A & B select private keys nA<n, nB<n• compute public keys: PA=nAG, PB=nBG• compute shared key: K=nAPB, K=nBPA
– same since K=nAnBG
Presenter
Presentation Notes
Illustrate here the elliptic curve analog of Diffie-Hellman key exchange, which is a close analogy given elliptic curve multiplication equates to modulo exponentiation.
ECC Encryption/Decryption
• several alternatives, will consider simplest
• must first encode any message M as a point on the elliptic curve Pm
• select suitable curve & point G as in D‐H• each user chooses private key nA<n• and computes public key PA=nAG• to encrypt Pm : Cm={kG, Pm+kPb}, k random
• decrypt Cm compute: Pm+kPb–nB(kG) = Pm+k(nBG)–nB(kG) = Pm
Presenter
Presentation Notes
Several approaches to encryption/decryption using elliptic curves have been analyzed in the literature. This one is an analog of the ElGamal public-key encryption algorithm. The sender must first encode any message M as a point on the elliptic curve Pm (there are relatively straightforward techniques for this). Note that the ciphertext is a pair of points on the elliptic curve. The sender masks the message using random k, but also sends along a “clue” allowing the receiver who know the private-key to recover k and hence the message. For an attacker to recover the message, the attacker would have to compute k given G and kG, which is assumed hard.
ECC Security
• relies on elliptic curve logarithm problem
• fastest method is “Pollard rho method”
• compared to factoring, can use much smaller key sizes than with RSA etc
• for equivalent key lengths computations are roughly equivalent
• hence for similar security ECC offers significant computational advantages
Presenter
Presentation Notes
The security of ECC depends on how difficult it is to determine k given kP and P. This is referred to as the elliptic curve logarithm problem. The fastest known technique for taking the elliptic curve logarithm is known as the Pollard rho method. Compared to factoring integers or polynomials, can use much smaller numbers for equivalent levels of security.
Stallings Table 10.3 - “ Comparable Key Sizes in Terms of Computational Effort for Cryptanalysis” illustrates the relative key sizes needed for security.
