%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\documentstyle[12pt,twoside,alltt]{article}
\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {2}
\sloppy

\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of 
Proof}\hspace*{1em}}{\qed\bigskip}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}

\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1996}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture #1 : #2 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: #3 \hfill Scribe: #4} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%		ordinal number of the lecure
%		date of the lecure
%		lecturer
%		scribe---that is you
%
\lecture{10}{October 8, 1996}{Ron Rivest}{K. Burrell} 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% For theorems, lemmas, definitions, remarks, etc. use commands
% \begin{theorem} .... \end{theorem} 
% \begin{definition} ... \end{definition} 
% \begin{proof} ... \end{proof}
% and so on ...
%
% If you want to insert figures in your notes do the following: 
% 1) Prepare your figures using your favourite graphic editor
% 	for example idraw or xfig
% 2) Save your pictures in PostScript form using the following convention
% 	notes-nn-fig-mm.ps where nn is the number of the lecture you 
% 	are scribing and mm is the sequential number of the picture in the 
% 	notes
% 3) Insert the following block in your LaTeX code in the place you 
% 	want to insert the figure BUT LEAVE IT AS A COMMENT (with the %
% 	at the beginning of the line) since it will not work on athena: 
%
% \begin{figure}[h]
% \begin{center}
% \mbox{\psfig{figure=notes-nn-fig-mm.ps}}
% \caption{A very nice picture.}
% \label{fig:mm}
% \end{center}
% \end{figure}
%
% 	of course the picture will not show up when you compile and 
% 	print your notes, but don't worry the TA will take care of it. 
% 4) When you mail the TA the LaTeX code mail him/her the PostScript
%	files for the figures as well 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Topics Covered:
\begin{enumerate}
\item Factoring: Algorithms, Difficulties
\item Discrete Log Problem
\item Public-key systems: Diffie-Hellman, RSA, El-Gamal, DSA
\end{enumerate}

\section{Factoring}
RSA Data Security, Inc. regularly holds a contests where they publish an
$n$-digit decimal number and challenge people to factor it.  As expected,
the length of the factorable number is steadily increasing. This is due to
three factors (no pun intended):
\begin{enumerate}
\item More powerful computers
\item Increased network capabilities
\item Better algorithms
\end{enumerate}

These are the results of the RSA contest ordered by number length:
\begin{itemize}
\item 100 digits: April '91, took 7 MIPS-yrs,    used quadratic sieve
\item 110 digits: April '92, unknown MIPS-yrs,   used quadratic sieve
\item 120 digits: June  '93, took 835 MIPS-yrs,  used quadratic sieve
\item 129 digits: April '94, took 5000 MIPS-urs, used quadratic sieve
\item 130 digits: April '96, took 5000 MIPS-yrs, used number-field sieve
\item 140 digits: unfactored
\end{itemize}

An intersting number length to consider is 155. A 155 digit number is 
about 512 digits, a popular key length in modern cryptographic systems.

Lets take a look at the asymptotic behvaior of factoring algorithms.  The time
it takes to factor an $n$ digit number using the Number-Field Sieve is 
asymptotically:

 $${e}^{ 1.92\ln (n) ^{1/3}\ln (n)^{2/3}}$$

It's exponenential in the cube root of the binary length of $n$.  

The increases in computing power follow a very predictable growth rate.  We can
also predict the number of computers on the Internet.  Using these we can 
determine a constant factor to go in front of the $e$. It's predicting where
algorithms are going that is difficult.  

Contests like these help guage how difficult these cryptographic problems are.
Results are published, making the knowledge available to all. It is expected 
that RSA-140 will fall in a year or so.  These challenges also help builders of
crypto systems recommend key sizes.

Bottom line: Factoring large numbers is hard.

Despite recent advances, factoring, say, a 1000-bit number will still be hard
for some years.

\section{Discrete Log Problem}
Given:
\begin{itemize}
\item $p$ prime
\item $g$ generator $\{g^0, g^1, g^2,....g^{(p-2)}\}  = Z^*_P$
\end{itemize}

Find:
\begin{itemize}
\item $x$ s.t. $g^{x}=y(mod p)$
\end{itemize}
$x$ is the discrete log (base g, modulo p) of y.

This problem is the foundation for many crypto systems.  It is very closely 
related to factoring.  Algorithms to solve these problems tend to have the
same running time as those for factoring.  Discrete log algorithms may be
somewhat harder if you choose $p$ to be large enough.

Variations:
\begin{itemize}
\item $g$ may not be a generator
\item $g$ may only generate a subgroup
\end{itemize}

For the second variation, if you know $y$ is one of the elements that $g$ 
generates then the problem is still solvable.  Doesn't work for small groups.

Variation:
\begin{itemize}
\item $p$ is not prime
\end{itemize}
In this variation, $Z^*_P$ is everything that is relatively prime to p. Typically no generators, 
in this set except special cases.  The Problem is still solvable.

Most problems don't move away from the asymptotic running time of factoring.  
Can always pick a number big enough but is still usable. The next sections 
outline mathematical problem based crypto.  These crypto systems are always 
prone to a mathematical breakthrough.  There is no proof that they are hard, 
so an algorithm may exist.

\section{Public Key Cryptography}

Math based problems are good for public key cryptography.

The idea for public key systems originated with Merkle at Berkley when he was
trying to develop an algorithm for talking over secure lines withou any prior
exchange.  He came up with a puzzle scheme.  You have to solve one puzzle, I
have to solve one puzzle, the adversary has to solve 1000. puzzles.  Berkley
wasn't interested in his work so he talked to Diffie and Hellman at Stanford.

Idea:
\begin{itemize}
\item public key $P_A$ available in telephone directory, etc.
\item secret key $S_S$ can't be derived from $P_A$
\end{itemize}

Initially only one key was used for encrypting and decrypting.  Next, it was
one key for encrypting and a different one for decrypting.  This enabled need 
to know messaging.  You only need one or the other, so it was more secure.

Diffie-Hellman:

\begin{itemize}
\item Encrypt: $E(P_A,M)=C$ 
\item Decrypt: $D(S_A, C)=M$
\end{itemize}

This was a conceptual breakthrough.  One of it's more interesting implications
was digital signatures.

\begin{itemize}
\item signature $\sigma=$SIGN$(S_A, M)$
\item verification VERIFY$(M, \sigma, P_A)=$\{YES, NO\}
\end{itemize}
Anybody can verify a signature using the public key.

Diffie-Hellman:
\begin{itemize}
\item sign $\sigma=E(S_A, M)$
\item verifiy $D(P_A, \sigma)=M$
\end{itemize}

\section{RSA}
RSA is based on the difficulty of factoring.
\begin{itemize}
\item $p, q$ prime
\item $n=pq$ s.t. $n$ is difficult to factor
\item $\phi(n)=|z_n^*|=(p-1)(q-1)$
\item Pick $e$ s.t. gcd$(\phi(n), e)=1$ [$e$ small]
\item Publish $(e, n)$ as your public key
\item $n$ is published, but only you know it's factorization
\end{itemize}
Typically:
\begin{itemize}
\item $|p|=|q|=512$ bits
\item $|n|=1024$
\end{itemize}

Compute $d$ s.t. $e\cdot d=1(\pmod \phi(n))$
\begin{itemize}
\item $d$ is modular inverse of $e$
\item $\phi(n)\cdot f+e\cdot d=1$ from Euclid's Algorithm
\end{itemize}

Encryption: $C=E(P_A, M)=M^e(\pmod n)$
\begin{itemize}
\item Compute $M^e$ from repeated squaring
\item $M=D(S_A, C)=C^d(\pmod n)$
\item secret key $=(d, n)$
\end{itemize}

\begin{itemize}
\item $M^{p-1}=1(\pmod p)$
\item $M^{k(p-1)(q-1)}=1(\pmod p)$
\item $M^{k\phi(n)+1}=M(\pmod p)$ even if $m=0$
\item $(M^e)^d = M(\pmod p)$
\item $(M^e)^d = M(\pmod q)$
\item $(M^e)^d = M(\pmod n)=(M^d)^e$
\item Can encrypt/decrypt with pub/priv key 
\end{itemize}

RSA is a block cipher.  How do you use it as a stream? Can use CBC.  Not 
typically used as a bulk encryption algorithm.  True for most public key 
systems .  People tend to use hybrid systems. Send short message using RSA
key (say DES key) and then use that DES key for bulk encryption.  Similar
for signing. Sign hash of file instead of whole file:
\begin{itemize}
\item $\sigma=(H(M)^d) \pmod n$
\end{itemize}

RSA depends intrinsically on the discrete log problem

\section{El-Gamal}
\begin{itemize}
\item $p, q$ prime
\item $g$ generator mod $p$
\end{itemize}

How do you find $g$?
\begin{itemize}
\item Pick $g$ at random, $g\not=1$
\item Check that $g^{(p-1)/q}\not=1$ for all primes q dividing $p-1$
\end{itemize}
How do you find $q$?
\begin{itemize}
\item Construct $p$ so that you know the $q$'s
\item Make at least one of the $q$'s large or this is easy with discrete log algorithm
\end{itemize}

Setting up:
\begin{itemize}
\item Choose private key $x$ s.t. $0<= x < p-1$
\item Choose public key $y = g^x(mod p)$
\end{itemize}
What can you do with the public key?
To encrypt messages:
\begin{itemize}
\item Generate random $k$ s.t. $0<= k < p-1$
\item send $(c_1, c_2)=(g^k, M+y^k)$
\end{itemize}
To decrypt:
\begin{itemize}
\item $y^k=(g^k)^x$
\item $M=c_2-C_1$
\end{itemize}

Signatures:
\begin{itemize}
\item Generate random $k 0<= k < p-1$ and gcd$(k, p-1)=1$
\item Compute $a=g^k$
\item Signature $\sigma=(a, b)$ where $b={(M-ax)/k}\pmod p-1$
\item $x$ is secret
\end{itemize}

Verify:
\begin{itemize}
\item $y^a \cdot a^b \stackrel{?}{=} g^M \pmod p$
\item $g^{(ax+kb)} \stackrel{?}{=} g^M \pmod p$
\item $M \stackrel{\surd}{=} ax+kb \pmod{p-1}$
\end{itemize}

\section{Government's Digital Signature Algorithm}
\begin{itemize}
\item $p$ public prime $= q_1q_2...q_{k+1}$
\item $g$ phas order $q \pmod p$
\item Pick g at random, $g \not=1$
\item Check that $g^{(p-1)/q'}=1$ for all primes $q'$ that divide $(p-1)$
\end{itemize}
Signature algorithm specified, but no encryption algorithm. Probably don't
want to do another "DES"

Signature:
\begin{itemize}
\item Pick $k 1<= k <=q-1$
\item Pick $r = g^k \pmod p \pmod q$
\item Pick $s = {(H(M)+x \cdot r)/k} \pmod q$
\end{itemize}

Verification:
\begin{itemize}
\item $g^{{H(M)}/s}-y^{r/s}\pmod p\pmod q = r$
\end{itemize}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes end here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\end{document}



