%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\documentstyle[12pt,twoside,alltt,psfig]{article}
\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {2}
\sloppy

\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of 
Proof}\hspace*{1em}}{\qed\bigskip}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}

\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1996}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture #1 : #2 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: #3 \hfill Scribe: #4} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%		ordinal number of the lecure
%		date of the lecure
%		lecturer
%		scribe---that is you
%
\lecture{8}{October 8, 1996}{Ron Rivest}{K. Burrell} 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% For theorems, lemmas, definitions, remarks, etc. use commands
% \begin{theorem} .... \end{theorem} 
% \begin{definition} ... \end{definition} 
% \begin{proof} ... \end{proof}
% and so on ...
%
% If you want to insert figures in your notes do the following: 
% 1) Prepare your figures using your favourite graphic editor
% 	for example idraw or xfig
% 2) Save your pictures in PostScript form using the following convention
% 	notes-nn-fig-mm.ps where nn is the number of the lecture you 
% 	are scribing and mm is the sequential number of the picture in the 
% 	notes
% 3) Insert the following block in your LaTeX code in the place you 
% 	want to insert the figure BUT LEAVE IT AS A COMMENT (with the %
% 	at the beginning of the line) since it will not work on athena: 
%
% \begin{figure}[h]
% \begin{center}
% \mbox{\psfig{figure=notes-nn-fig-mm.ps}}
% \caption{A very nice picture.}
% \label{fig:mm}
% \end{center}
% \end{figure}
%
% 	of course the picture will not show up when you compile and 
% 	print your notes, but don't worry the TA will take care of it. 
% 4) When you mail the TA the LaTeX code mail him/her the PostScript
%	files for the figures as well 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{Factoring}
RSA Data Security, Inc. regularly holds a contests where they publish an
$n$-digit decimal number and challenge people to factor it.  As expected,
the length of the factorable number is steadily increasing. This is due to
three factors (no pun intended):
\begin{enumerate}
\item More powerful computers
\item Increased network capabilities
\item Better algorithms
\end{enumerate}

These are the results of the RSA contest ordered by number length:
\begin{itemize}
\item 100 digits: April '91, took 7 MIPS-yrs,    used quadratic sieve
\item 110 digits: April '92, unknown MIPS-yrs,   used quadratic sieve
\item 120 digits: June  '93, took 835 MIPS-yrs,  used quadratic sieve
\item 129 digits: April '94, took 5000 MIPS-urs, used quadratic sieve
\item 130 digits: April '96, took 5000 MIPS-yrs, used number-field sieve
\item 140 digits: unfactored
\end{itemize}

An intersting number length to consider is 155. A 155 digit number is 
about 512 digits, a popular key length in modern cryptographic systems.

Lets take a look at the asymptotic behvaior of factoring algorithms.  The time
it takes to factor an $n$ digit number using the Number-Field Sieve is 
asymptotically:

 $${e}^{ 1.92\ln (n) ^{1/3}\ln (n)^{2/3}}$$

It's exponenential in the cube root of the binary length of $n$.  

The increases in computing power follow a very predictable growth rate.  We can
also predict the number of computers on the Internet.  Using these we can 
determine a constant factor to go in front of the $e$. It's predicting where
algorithms are going that is difficult.  

Contests like these help guage how difficult these cryptographic problems are.
Results are published, making the knowledge available to all. It is expected 
that RSA-140 will fall in a year or so.  These challenges also help builders of
crypto systems recommend key sizes.

Bottom line: Factoring large numbers is hard.

Despite recent advances, factoring, say, a 1000-bit number will still be hard
for some years.

\section{Discrete Log Problem}
Given:
\begin{itemize}
\item $p$ prime
\item $g$ generator $\{g^0, g^1, g^2,....g^{(p-2)}\}  = Z^*_P$
\end{itemize}

Find:
\begin{itemize}
\item $x$ s.t. $g^{x}=y(mod p)$
\end{itemize}
$x$ is the discrete log (base g, modulo p) of y.

This problem is the foundation for many crypto systems.  It is very closely 
related to factoring.  Algorithms to solve these problems tend to have the
same running time as those for factoring.  Discrete log algorithms may be
somewhat harder if you choose $p$ to be large enough.

Variations:
\begin{itemize}
\item $g$ may not be a generator
\item $g$ may only generate a subgroup
\end{itemize}

For the second variation, if you know $y$ is one of the elements that $g$ 
generates then the problem is still solvable.  Doesn't work for small groups.

Variation:
\begin{itemize}
\item $p$ is not prime
\end{itemize}
In this variation, $Z^*_P$ is everything that is relatively prime to p. Typically no generators, 
in this set except special cases.  The Problem is still solvable.

Most problems don't move away from the asymptotic running time of factoring.  
Can always pick a number big enough but is still usable. The next sections 
outline mathematical problem based crypto.  These crypto systems are always 
prone to a mathematical breakthrough.  There is no proof that they are hard, 
so an algorithm may exist.

\section{Elliptic Curves [Victor Miller, Neil Koblitz]}
Elliptic Curves provide another foundation upon which cryptography
algorithms can be built.  Now, instead of working strictly with
residues mod p, we deal with geometric relations.  A primary advantage
of elliptic curves is that through the complex geometric calculations,
a more difficult (analog of the) discrete log problem exists (or, at
least, one that is not as well understood), which allows for shorter
primes p.  And, of course, with shorter primes p, cryptography
algorithms will be somewhat faster.

Here, the prime p is public and is utilized in equations of the
following format:

$y^2 \equiv x^3 + ax + b (\bmod \ p)$ (denoted Weierstrauss normal
form)\\

In addition, the above adheres to the following constraint:
\[4a^3 + 27b^2 \neq 0 (\bmod \ p)\]

Elliptic Curves thus consist of the points:\\ {(x,y) : $y^2 \equiv x^3
+ ax + b (\bmod \ p)$}, which is symmetric with respect to the
x-axis.\\

In addition, we add an extra point, I, which represents the point at
{\it infinity}.  

Thus, we have a {\bf finite} set of solutions to this equation, with
{\it p + t + 1} pairs of points, where $|t| \leq 2 \sqrt{p}$.  In
other words, points on an elliptic curve form a finite abelian set and
can thus be used in a similar manner to fields and the such.  We will
now define the basic operations on this set.


\begin{figure}[h]
\begin{center}
\mbox{\psfig{figure=notes-08-fig-01.ps}}
\caption{An elliptic curve consisting of more than one ``piece.''  One
can see the process for addition of points P and Q (as well as R + R)
illustrated above.  Also note special point I and the vertical line
connecting it and any points S and -S.}
\label{fig:01}
\end{center}
\end{figure}


Addition is defined as follows: P + Q, where P and Q are points
anywhere on the curve, is defined to be the {\it reflection} of the
third point on the curve touched by the line connecting P and Q
(essentially, utilizing tangents and chords; see Figure 1).  If P and
Q are the same point (say, P=Q=R), then the addition is defined to be
[2]R (or, more simply, 2R), where the line ``connecting'' R is simply
the tangent to the curve at R.  Since I is at infinity, the line
connecting P and I is vertical and simply crosses the elliptic curve
at P's reflection (-P).  Thus, the reflection of this point is merely
P; effectively, I is the identity function for this finite set.
Equivalently, if the line connecting points P and Q is vertical
(Q=-P), their sum is defined to be I, as this line ``touches'' the
elliptic curve again at the point at infinity.

More formally, we define addition using geometry, calculating the
equation for the line between P and Q as $y={\lambda}x + \beta$, find
the third point of intersection between the elliptic curve and this
line, and subsequently take the reflection of that point as the sum.
The following algorithm outlines this procedure:

\begin{itemize}
\item Given P = ($x_1$,$y_1$), Q = ($x_2$,$y_2$),

if $(x_1 = x_2) \wedge (y_1 = -y_2)$ then P+I := I (Q=-P).\\ if $(x_1
= x_2)$ then $\lambda = \frac{3x_1^2 + a}{2y_1} (\bmod \ p)$, (where
$\lambda$ is the slope. i.e., this formula is obtained by taking the
derivative of the curve at the point ($x_1$,$y_1$)).

else $\lambda = \frac{y_2 - y_1}{x_2-x_1} (\bmod \ p)$

\item Define $\beta = y_1 - {\lambda}x_1$.

\item Then, $x_3 = {\lambda}^2 - x_1 - x_2$, $y_3 = -({\lambda}x_3 +
\beta)$

\item P+Q := ($x_3$,$y_3$) $(\bmod \ p)$.
\end{itemize}

This addition operation is commutative as well as {\it
associative} (somewhat surprising; the proof is beyond the scope of
this class).  Thus, we now have a system where we can define addition
analogously to multiplication mod p.

We utilize the following notation with this set of numbers.
\begin{itemize}
\item $E_n(a,b)$ = set of points on the elliptic curve;
i.e. satisfies:
\begin{itemize}
\item $y^2 = x^3 + ax + b$
\item gcd($4a^3+27b^2$,n)=1
\end{itemize}
plus contains the special point I.
\item $E_p$, for prime p, represents an elliptic group
\item $N_p(a,b)$ = order of $E_p(a,b)$.
\item $O_{E_p}(M)$ = order of an element M in $E_p$.
\end{itemize}

So, now, instead of multiplication, we use the addition operation
defined above.  Subsequently, instead of exponentiation $g^k (\bmod \
p)$, we ``multiply'' P (g's equivalent in this realm) by k (= [k]P),
defined as: P + P + P + P ... + P (k times).  This makes the
``discrete log problem'' equivalent to discovering how many times P
must be added to itself to equal another point Q.  In summary:

\begin{center}
\begin{tabular}{lcl}
Elliptic Curves&&ElGamal\\ \hline
P+Q&$\approx$&$x\cdot y (\bmod \ p)$\\
$[k]P$ = P+P+P...+P (k times)&$\approx$&$g^k (\bmod \ p)$\\
\end{tabular}
\end{center}

We can make the points P and Q=[k]P public as long as we keep k
secret; this is completely analogous to working mod p.  However,
now some discrete log ``tricks'' no longer work, which effectively
allows us to use shorter keys, making for overall faster cryptography
algorithms and implementations.
\section{Handouts and References}
\begin{itemize}
\item Handout 8: Readings for Lecture 8 (Description of MD5 from {\it
Applied Cryptography}).
\end{itemize}

\end{document}



