6.857 Computer and Network Security Fall Term, 1996

Lecture 8 : October 8, 1996

Lecturer: Ron Rivest Scribe: K. Burrell

1 Factoring

RSA Data Security, Inc. regularly holds a contests where they publish an n-digit decimal number and challenge people to factor it. As expected, the length of the factorable number is steadily increasing. This is due to three factors (no pun intended):

1. More powerful computers

2. Increased network capabilities

3. Better algorithms

These are the results of the RSA contest ordered by number length:

• 100 digits: April ’91, took 7 MIPS-yrs, used quadratic sieve

• 110 digits: April ’92, unknown MIPS-yrs, used quadratic sieve

• 120 digits: June ’93, took 835 MIPS-yrs, used quadratic sieve

• 129 digits: April ’94, took 5000 MIPS-urs, used quadratic sieve

• 130 digits: April ’96, took 5000 MIPS-yrs, used number-field sieve

• 140 digits: unfactored

An intersting number length to consider is 155. A 155 digit number is about 512 digits, a popular key length in modern cryptographic systems. Lets take a look at the asymptotic behvaior of factoring algorithms. The time it takes to factor an n digit number using the Number-Field Sieve is asymptotically:

e^{1.92 ln(n)^{1/3} ln(n)^{2/3}}

It’s exponenential in the cube root of the binary length of n.

The increases in computing power follow a very predictable growth rate. We can also predict the number of computers on the Internet. Using these we can determine a constant factor to go in front of the e. It’s predicting where algorithms are going that is difficult.

Contests like these help guage how difficult these cryptographic problems are. Results are published, making the knowledge available to all. It is expected that RSA-140 will fall in a year or so. These challenges also help builders of crypto systems recommend key sizes.

Bottom line: Factoring large numbers is hard.

Despite recent advances, factoring, say, a 1000-bit number will still be hard for some years.

2 Discrete Log Problem

Given:

• p prime

• g generator {g^{0}, g^{1}, g^{2}, ....g^{(p−2)}} = Z_{P}^{∗}

Find:

• x s.t. g^{x} = y(modp)

x is the discrete log (base g, modulo p) of y.

This problem is the foundation for many crypto systems. It is very closely related to factoring. Algorithms to solve these problems tend to have the same running time as those for factoring. Discrete log algorithms may be somewhat harder if you choose p to be large enough.

Variations:

• g may not be a generator

• g may only generate a subgroup

For the second variation, if you know y is one of the elements that g generates then the problem is still solvable. Doesn’t work for small groups.

Variation:

• p is not prime

In this variation, Z_{P}^{∗} is everything that is relatively prime to p. Typically no generators, in this set except special cases. The Problem is still solvable.

Most problems don’t move away from the asymptotic running time of factoring. Can always pick a number big enough but is still usable. The next sections outline mathematical problem based crypto. These crypto systems are always prone to a mathematical breakthrough. There is no proof that they are hard, so an algorithm may exist.

3 Elliptic Curves [Victor Miller, Neil Koblitz]

Elliptic Curves provide another foundation upon which cryptography algorithms can be built. Now, instead of working strictly with residues mod p, we deal with geometric relations. A primary advantage of elliptic curves is that through the complex geometric calculations, a more difficult (analog of the) discrete log problem exists (or, at least, one that is not as well understood), which allows for shorter primes p. And, of course, with shorter primes p, cryptography algorithms will be somewhat faster.

Here, the prime p is public and is utilized in equations of the following format:

y^{2} ≡ x^{3} + ax + b(mod p) (denoted Weierstrauss normal form)

In addition, the above adheres to the following constraint:

4a^{3} + 27b^{2} ≠ 0(mod p)

Elliptic Curves thus consist of the points: (x,y) : y^{2} ≡ x^{3} + ax + b(mod p), which is symmetric with respect to the x-axis.

In addition, we add an extra point, I, which represents the point at infinity.

Thus, we have a finite set of solutions to this equation, with p + t + 1 pairs of points, where |t| ≤ 2\sqrt{p}. In other words, points on an elliptic curve form a finite abelian set and can thus be used in a similar manner to fields and the such. We will now define the basic operations on this set.

Figure 1: An elliptic curve consisting of more than one “piece.” One can see the process for addition of points P and Q (as well as R + R) illustrated above. Also note special point I and the vertical line connecting it and any points S and -S.

Addition is defined as follows: P + Q, where P and Q are points anywhere on the curve, is defined to be the reflection of the third point on the curve touched by the line connecting P and Q (essentially, utilizing tangents and chords; see Figure 1). If P and Q are the same point (say, P=Q=R), then the addition is defined to be [2]R (or, more simply, 2R), where the line “connecting” R is simply the tangent to the curve at R. Since I is at infinity, the line connecting P and I is vertical and simply crosses the elliptic curve at P’s reflection (-P). Thus, the reflection of this point is merely P; effectively, I is the identity function for this finite set. Equivalently, if the line connecting points P and Q is vertical (Q=-P), their sum is defined to be I, as this line “touches” the elliptic curve again at the point at infinity.

More formally, we define addition using geometry, calculating the equation for the line between P and Q as y = λx + β, find the third point of intersection between the elliptic curve and this line, and subsequently take the reflection of that point as the sum. The following algorithm outlines this procedure:

• Given P = (x_{1},y_{1}), Q = (x_{2},y_{2}),

if (x_{1} = x_{2}) ∧ (y_{1} = −y_{2}) then P+I := I (Q=-P).

if (x_{1} = x_{2}) then λ = \frac{3x_{1}^{2}+a}{2y_{1}}(mod p), (where λ is the slope. i.e., this formula is obtained by taking the derivative of the curve at the point (x_{1},y_{1})).

else λ = \frac{y_{2}−y_{1}}{x_{2}−x_{1}} (mod p)

• Define β = y_{1} − λx_{1}.

• Then, x_{3} = λ^{2} − x_{1} − x_{2}, y_{3} = −(λx_{3} + β)

• P+Q := (x_{3},y_{3}) (mod p).

This addition operation is commutative as well as associative (somewhat surprising; the proof is beyond the scope of this class). Thus, we now have a system where we can define addition analogously to multiplication mod p.

We utilize the following notation with this set of numbers.

• E_{n}(a, b) = set of points on the elliptic curve; i.e. satisfies:

– y^{2} = x^{3} + ax + b

– gcd(4a^{3} + 27b^{2},n)=1

plus contains the special point I.

• E_{p}, for prime p, represents an elliptic group • N_{p}(a, b) = order of E_{p}(a, b).

• O_{E_{p}}(M) = order of an element M in E_{p}.

So, now, instead of multiplication, we use the addition operation defined above. Subsequently, instead of exponentiation g^{k}(mod p), we “multiply” P (g’s equivalent in this realm) by k (= [k]P), defined as: P + P + P + P ... + P (k times). This makes the “discrete log problem” equivalent to discovering how many times P must be added to itself to equal another point Q. In summary:

Elliptic Curves  ElGamal
P+Q  ≈ x · y(mod p)
[k]P = P+P+P...+P (k times) ≈ g^{k}(mod p)

We can make the points P and Q=[k]P public as long as we keep k secret; this is completely analogous to working mod p. However, now some discrete log “tricks” no longer work, which effectively allows us to use shorter keys, making for overall faster cryptography algorithms and implementations.

4 Handouts and References

• Handout 8: Readings for Lecture 8 (Description of MD5 from Applied Cryptography).