%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\documentstyle[12pt,twoside,alltt]{article}
\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {2}
\sloppy

\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of 
Proof}\hspace*{1em}}{\qed\bigskip}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}

\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1997}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture #1 : #2 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: #3 \hfill Scribe: #4} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%		ordinal number of the lecure
%		date of the lecure
%		lecturer
%		scribe---that is you
%
\lecture{6}{September 23, 1997}{Ron Rivest}{Elliot Schwartz} 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% For theorems, lemmas, definitions, remarks, etc. use commands
% \begin{theorem} .... \end{theorem} 
% \begin{definition} ... \end{definition} 
% \begin{proof} ... \end{proof}
% and so on ...
%
% If you want to insert figures in your notes do the following: 
% 1) Prepare your figures using your favourite graphic editor
% 	for example idraw or xfig
% 2) Save your pictures in PostScript form using the following convention
% 	notes-nn-fig-mm.ps where nn is the number of the lecture you 
% 	are scribing and mm is the sequential number of the picture in the 
% 	notes
% 3) Insert the following block in your LaTeX code in the place you 
% 	want to insert the figure BUT LEAVE IT AS A COMMENT (with the %
% 	at the beginning of the line) since it will not work on athena: 
%
% \begin{figure}[h]
% \begin{center}
% \mbox{\psfig{figure=notes-nn-fig-mm.ps}}
% \caption{A very nice picture.}
% \label{fig:mm}
% \end{center}
% \end{figure}
%
% 	of course the picture will not show up when you compile and 
% 	print your notes, but don't worry the TA will take care of it. 
% 4) When you mail the TA the LaTeX code mail him/her the PostScript
%	files for the figures as well 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\section{Topics Covered}

 
\begin{itemize}
\item Concepts of Public-Key Cryptography
\item Number Theory
\end{itemize}

\section{Concepts of Public-Key Cryptography}

So far our cryptographic techniques have utilized a shared secret; because of
this they operate in a symmetric and point-to-point manner. Because it
breaks the symmetry and allows one-to-many and many-to-one operation, public
key cryptography is also called {\it asymmetric cryptography}.

The main idea is to separate the capability of encryption from decryption.
Thus, the system has the following requirements:
\begin{itemize}
\item an encryption key $E_A$, such that $E_A(M)=C'$
\item a decryption key $D_A$, such that $D_A(E_A(M))=M$
\item knowing $E_A$ does not imply knowing $D_A$ (i.e. knowing how to encrypt 
does not imply knowing how to decrypt)
\end{itemize}
With such a system, $E_A$ can be published in a directory as Alice's {\it public key}, and people can use the key to create messages that only Alice can decrypt.

{\it Open question:} How do we organize such a directory?

The encryption function could be a deterministic, one-to-one function, but
this would allow a {\it guess and check} attack: An adversary could compute
$E_A(M')$ for a guessed $M'$, and see if the result matches an overheard $C'$.
Therefore, $E_A$ should be (and is) randomized in practice.

\subsection{Digital Signatures}

We can use a corresponding idea to public-key encryption for providing
authentication: we separate the process of signing from verifying. This
allows anyone to verify that an individual signed a message. Since this is
like signing a paper document, the technique is called a {\it digital signature}.

Requirements:
\begin{itemize}
\item public key verifies signature: $V_A(M,S)=\left\{ {true \atop false} \right.$
\item private key signs: $\sigma_A(M)=S$; transmit $(M,S)$
\item knowing verify does not imply knowing how to sign
\end{itemize}

\subsection{Miscellany}

We can combine digital signatures and public-key encryption to get both
privacy and authentication.

Under the Diffie-Hellman paradigm, $D_A$ can be used to {\bf encrypt} and $E_A$ to {\bf decrypt}. This is a special case, and the way RSA works. Mathematically, $\sigma_A(M)=D_A(M)$, and verification uses $E_A$.

A signature once valid is always valid, therefore replay attacks are possible.
Attaching sequence numbers or the date to a message are common ways of allowing
a verifier to remember whether he's seen the message before.

\section{Number Theory}

Public-key cryptography can be implemented using number theory.

For a prime $p$, \\
$Z_p = \{0,1,\dots,p-1\}$ forms a group under $+$ (identity is 0, associative, inverses exist) \\
$Z_p^\star = \{1,2,\dots,p-1\}$ forms a group under $\times$ (identity is 1) \\
$Z_p$ actually forms a field with $+$ $-$ $\times$ $\div$ (distributive law holds, etc.)

If $p$ is not a prime, say 10, not all numbers between 1 and 9 have multiplicative inverses modulo 10 (for example, 2 and 5 do not). So, $Z_n^\star=\{a: gcd(a,n)=1\}, a \in \{1,2,\dots,n-1\}$ ($a$'s that are relatively prime to $n$). $Z_{10}^\star = \{1,3,7,9\}$.

\begin{theorem}
If $p$ is prime, then $Z_p^\star$ is cyclic.
\end{theorem}
This means, there exists a generator $g$ such that $\{g^1, g^2, \dots, g^{p-1}\}=Z_p^\star$. \\
For example, in modulo 7, take $g=3$: $g^2=2, g^3=6=-1, g^4=4, g^5=5, g^6=1$. \\
Note that $(g^a)^b=(g^b)^a=g^{ab} \pmod{p}$.

\begin{theorem}
If $p$ is prime, then $(\forall a \in Z_p^\star) a^{p-1} \equiv 1 \pmod{p}$. (Fermat's Little Theorem)
\end{theorem}
\begin{lemma}
If $p$ is prime, and $g$ is a generator of $Z_p^\star$, then $g^{p-1} \equiv 1 \pmod{p}$.
\end{lemma}
\begin{proof}
For some generator $g$, $g$ generates all the elements in $Z_p^\star$.
Therefore, the generator must generate a 1. 
If a 1 was generated before $p-1$ exponentiations, the sequence would repeat
and be missing some elements. If a 1 was generated after $p-1$ exponentiations,
then the sequence would have repeated before generating a 1, which is not possible.
Therefore, $g^{p-1} \equiv 1 \pmod{p}$.
\end{proof}

\begin{proof}
$(\forall a \in Z_p^\star) \exists x: a \equiv g^x \pmod{p}$. \\
Therefore, $a^{p-1} \equiv (g^x)^{p-1} \equiv (g^{p-1})^x \equiv 1^x \equiv
1 \pmod{p}$.
\end{proof}
\begin{corollary}
$a^{-1} \equiv a^{p-2} \pmod{p}$
\end{corollary}

\subsection{Fast Modular Exponentiation}
To find $a/b$, we calculate $a \cdot b^{-1}$ using exponentiation. How do we compute $a^b \pmod{p}$ efficiently?

$a^b = \left\{ \begin{array}{ll}
	1			& b=0 \\
	(a^{b/2})^2 \pmod{p}	& b\neq 0 \wedge b \equiv 0 \pmod{2} \\
	a \cdot (a^{\lfloor b/2 \rfloor})^2 \pmod{p}
				& b\neq 0 \wedge b \equiv 1 \pmod{2}
	\end{array} \right.$

Note that modulus $p$ doesn't need to be prime here, since were are only
doing multiplication and squarings.

Number of recursive calls is $O(\lg b)$. Total work is $O(k^3)$ for $k$-bit numbers $a$, $b$, $p$, and a algorithm for multiplying in modulo $p$ that's $O(k^2)$. This is reasonable to do on a PC.

\subsection{Finding Primes}

How do we find large primes? Pick a random number, and then check with some tests.

{\bf Rabin-Miller Primality Test:} \\
\begin{enumerate}
\item Given a large (odd) number $p$, to test for primality:
\item Pick at random $a \in \{1, 2, \dots, p-1\}$.
\item Test if $a^{p-1} \equiv 1 \pmod{p}$. If $\neq$ 1 then halt; $p$ is not prime.
\item Test if we ever saw an $r$, $r \neq \pm1$ such that $r^2 \equiv 1 \pmod{p}$ in step 3. If so, halt; $p$ is not prime.
\item Repeat steps 2-4 20 times, or until happy.
\item Declare $p$ to be probably prime.
\end{enumerate}

Each pass has a chance of at least $1/2$ of declairing $p$ to be non-prime, if
$p$ is indeed non-prime. If $p$ is prime, it is never declaired non-prime.

{\it Density:} About $1/1000$ 1000-bit numbers are prime, so this is reasonable to do on a PC.

\section{References}
\begin{itemize}
\item W. Biffie and M. E. Hellman. New directions in cryptography. {\it IEEE 
Trans. Inform. Theory}, IT-22:644-654, November 1976.
\end{itemize}







%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes end here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\end{document}
