%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\documentstyle[12pt,twoside,alltt,psfig]{article}
\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {2}
\sloppy

\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of 
Proof}\hspace*{1em}}{\qed\bigskip}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}

\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1997}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture #1 : #2 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: #3 \hfill Scribe: #4} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%		ordinal number of the lecure
%		date of the lecure
%		lecturer
%		scribe---that is you
%
\lecture{7}{September 25,1997}{Ron Rivest}{Vijak Sethaput} 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% For theorems, lemmas, definitions, remarks, etc. use commands
% \begin{theorem} .... \end{theorem} 
% \begin{definition} ... \end{definition} 
% \begin{proof} ... \end{proof}
% and so on ...
%
% If you want to insert figures in your notes do the following: 
% 1) Prepare your figures using your favourite graphic editor
% 	for example idraw or xfig
% 2) Save your pictures in PostScript form using the following convention
% 	notes-nn-fig-mm.ps where nn is the number of the lecture you 
% 	are scribing and mm is the sequential number of the picture in the 
% 	notes
% 3) Insert the following block in your LaTeX code in the place you 
% 	want to insert the figure BUT LEAVE IT AS A COMMENT (with the %
% 	at the beginning of the line) since it will not work on athena: 
%
% \begin{figure}[h]
% \begin{center}
% \mbox{\psfig{figure=notes-nn-fig-mm.ps}}
% \caption{A very nice picture.}
% \label{fig:mm}
% \end{center}
% \end{figure}
%
% 	of course the picture will not show up when you compile and 
% 	print your notes, but don't worry the TA will take care of it. 
% 4) When you mail the TA the LaTeX code mail him/her the PostScript
%	files for the figures as well 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{Review}

\begin{itemize}
\item $Z_p^*$ is cyclic since there exist generator $g$ s.t. $\{g,g^2,...,g^{p-1}\} = Z_p^*$
\item 
\begin{definition} 
Order(a): least $x$ s.t. $a^x \equiv 1 \pmod p$
\end{definition}
\item ($\forall a \in Z_p^*$) $order(a)$ divides p-1
\item $a$ is a square iff $a^{\frac{p-1}{2}} \equiv 1\pmod p$
\item if $a=g^x$ for some generator $g$, $order(a) = \frac{p-1}{gcd(x,p-1)}$
\item $a \equiv b\pmod p$, where $a=g^x, b=g^y \Longleftrightarrow x \equiv y\pmod{p-1}$
\end{itemize}

\section{Density of Primes}

\subsection{The Theorem}
\begin{theorem}
Prime Number Theorem

if $\pi (x) =$ The number of primes between 1 and x, then
$\pi(x) \approx \frac{x}{ln(x)}$
\end{theorem}
This approximation gets better for large values of $x$.  Informally, the
theorem states that if one picks a number less than $x$ at random, the
probablility that it is prime approaches $\frac{1}{ln(x)}$. Therefore, large prime number are relatively common, so large prime number can be found easily by random search (e.g. just picking an odd number at random and a test for primality will terminate in a reasonable about of time)

\subsection{Variation}

For the reason that will be clear later in the discussion of security algorithms, one may want $p-1$ to have a large prime factor. This can be done by finding large prime $q$ and then check $p = (iq+1)$ where $i=2,4,6,..$ for primility. 
It is not necessary that one needs to find large prime $q$ everytime.

\section{Generator}
\begin{theorem} 
$g$ is a generator (mod $p$) iff $g^{p-1} \equiv 1\pmod p$
\end{theorem}
\begin{itemize}
\item Problem: factor $p-1$ requires knowing all prime $q$ that divide $p-1$
\item Solution: One should generate primes using $p = i \cdot q + 1$ e.g. $48 \cdot q + 1 $
\item generator are common
\end{itemize}
\section{Discrete Log Problem}

\begin{definition} Discrete Log Problem

$x$ is the discrete log (base g, modulo p) of y. If given 
prime $p$, generator $g$:$\{g^0, g^1, g^2,....g^{(p-2)}\}  = Z^*_P$
,and  $g^{x}$ (mod $p$) then the adversary need to find $x$ s.t. $g^{x}=y\pmod p$
\end{definition}

This problem is the foundation for many crypto system. Its security based on computational difficulties of the problem. Discrete log algorithms may be somewhat harder if you choose $p$ to be large enough. However, if $p-1$ has only small factors, then this problem is easy to solve.

The next sections outline mathematical problems based on cryptography.  These crypto systems are always prone to a mathematical breakthrough.  There is no proof that they are hard, so an algorithm may exist. 

\section{Public Key Cryptography}

The idea for public key systems originated with Merkle at UC Berkley when he was trying to develop an algorithm for communicating over secure lines without prior exchange for key as we have seen so far. Merkle came up with a puzzle scheme. This requires people who are communicating to solve just one puzzle but the adversary has to solve many more puzzles. Berkley wasn't interested in his work, so he went to talked to Diffie and Hellman at Standford about the idea. Diffie Hellman then came up with the key exchange protocol which is based on the discrete Log Problem.

\section{Key Exchange Protocol}

\begin{figure}[h]
\begin{center}
\mbox{\psfig{figure=notes-07-fig-01.eps}}
\caption{Diffie-Hellman Key Exchange Protocol.}
\label{fig:mm}
\end{center}
\end{figure}
As shown in the figure, Eve faces the Diffie-Hellman problem which can be state as follows:
\begin{definition} Diffie-Hellman Problem
 
Given $g$, $p$, $g^{a} \pmod p$, $g^{b} \pmod p$
The adversary has to compute $g^{ab} \pmod p$ 
\end{definition} 

The nice property about this  protocol is that it can bootstap the parties from no secret key to have shared secret key using global public value. The protocol is secured base on the fact that Discrete Log Problem is hard. However, if Eve start to be active, there will need to be more steps added.

\section{El Gamel}

\subsection{Setting up:}
\begin{itemize}
\item Alice choose private key $a$ s.t. $0<= a < p-1$ ($a \in Z_{p-1}$)
\item Alice can then compute her public key, $ g^{a}\pmod p$ which she can then publish somewhere
\end{itemize}

\subsection{Privacy}

To encrypt messages:
\begin{itemize}
\item Bob pick a random $k$ s.t. $0<= k < p-1$ ($k \in Z_{p-1}$) which corresponding to $b$ in Diffie-Hellman Key exchange protocol.
\item Now both parties can computer their share key $g^{ka}$
\item Bob send $(c_1, c_2)=(g^k, M*g^{ka})$ 
\end{itemize}
To decrypt:
\begin{itemize}
\item Alice can now compute thier share key, $(g^k)^a$
\item The message $M$ is then $M=\frac{c_2}{(g^k)^a} = \frac{c_2}{(c_1)^a}$
\end{itemize}

\subsection{Authentication}

Signature:

The idea for signature is that only Alice can produce the signature but others just using Alice public key, $g^a$, can verify that $k^{-1}$ (mod $(p-1)$) exist. 
\begin{itemize}
\item Alice generate a random $k$, $0<= k < p-1$ and gcd$(k, p-1)=1$
\item Alice then compute $r=g^k$ (mod $p$)
\item Signature $\sigma=(r, s)$ where $b={(M-ra)/k}$  (mod $(p-1)$)
\end{itemize}

Verify:
\begin{itemize}
\item $y = g^a$
\item $y^r \cdot r^s \stackrel{?}{=} g^M \pmod p$
\item $g^{ar} \cdot g^{ks} \stackrel{?}{=} g^M \pmod p$ 
\item $g^{ar+ks} \stackrel{?}{=} g^M \pmod p$
\item iff $M \stackrel{\surd}{=} ar+ks \pmod{(p-1)}$
\end{itemize}

Note that in this scheme the value of $k$ need to be protected. Since, if adversary knows $k$ then he/she can solve for $a$ thus find out the secret.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes end here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\end{document}
