6.857 Computer and Network Security Fall Term, 1997

Lecture 9 : September 25,1997

Lecturer: Ron Rivest Scribe: Vijak Sethaput

1 Public Key Cryptography

The idea for public key systems originated with Merkle at UC Berkley when he was trying to develop an algorithm for communicating over secure lines without prior exchange for key as we have seen so far. Merkle came up with a puzzle scheme. This requires people who are communicating to solve just one puzzle but the adversary has to solve many more puzzles. Berkley wasn’t interested in his work, so he went to talked to Diffie and Hellman at Standford about the idea. Diffie Hellman then came up with the key exchange protocol which is based on the discrete Log Problem.

1.1 Key Exchange Protocol

Figure 1: Diffie-Hellman Key Exchange Protocol.

As shown in the figure, Eve faces the Diffie-Hellman problem which can be state as follows:

Definition 1 Diffie-Hellman Problem Given g, p, g^{a} (mod p), g^{b} (mod p) The adversary has to compute g^{ab} (mod p)

The nice property about this protocol is that it can bootstap the parties from no secret key to have shared secret key using global public value. The protocol is secured base on the fact that Discrete Log Problem is hard. However, if Eve start to be active, there will need to be more steps added.

1.2 El Gamal

Setting up:

• Alice choose private key a s.t. 0 <= a < p − 1 (a ∈ Z_{p−1})

• Alice can then compute her public key, g^{a} (mod p) which she can then publish somewhere

Privacy

To encrypt messages:

• Bob pick a random k s.t. 0 <= k < p − 1 (k ∈ Z_{p−1}) which corresponding to b in Diffie-Hellman Key exchange protocol.

• Now both parties can computer their share key g^{ka}

• Bob send (c_{1}, c_{2}) = (g^{k}, M ∗ g^{ka})

To decrypt:

• Alice can now compute thier share key, (g^{k})^{a}

• The message M is then M = \frac{c_{2}}{(g^{k})^{a}} = \frac{c_{2}}{(c_{1})^{a}}

Authentication

Signature:

The idea for signature is that only Alice can produce the signature but others just using Alice public key, g^{a}, can verify that k^{−1} (mod (p − 1)) exist.

• Alice generate a random k, 0 <= k < p − 1 and gcd(k, p − 1) = 1

• Alice then compute r = g^{k} (mod p)

• Signature σ = (r, s) where b = (M − ra)/k (mod (p − 1))

Verify:

• y = g^{a}

• y^{r} · r^{s} =^{?} g^{M} (mod p)

• g^{ar} · g^{ks} =^{?} g^{M} (mod p)

• g^{ar+ks} =^{?} g^{M} (mod p)

• iff M =^{√} ar + ks (mod (p − 1))

Note that in this scheme the value of k need to be protected. Since, if adversary knows k then he/she can solve for a thus find out the secret.

2 Digital Signature Standard (DSS) [proposed by NIST, 1991]

This is a fairly interesting, non-deterministic cryptography scheme which was proposed by the government. Accordingly, there has also been some criticism and skepticism surrounding this scheme, because part of the proposal had the government “supply” the large prime p. Some believed that this could lead to a weakness in the scheme because a p could be chosen such that one could take discrete logs for that p. Or, other weaknesses in a specific p could be exploited as a “back-door” mechanism, should the p be a “weaker” prime. This is not very likely, however. Another interesting fact about DSS is that it is designed specifically for signatures, making using DSS for any kind of encryption more difficult (but modification of DSS into an encryption scheme is possible).

DSS starts off similarly to ElGamal.

• Start off by finding a large (public) prime p. This time, however, do not find a generator for p. Instead, 4 2 DIGITAL SIGNATURE STANDARD (DSS) [PROPOSED BY NIST, 1991]

• Find another prime q | p-1, where |q| = 160 bits. (Often, you find q first and then guess at various p’s until you find one that works.)

• Find a (public) generator g of order q modulo p (g^{q} = 1 mod p). This need only generate a subgroup, however. Specifically, we want g^{i} ≠ 1 if 0 ≤ i < q.

• Now, pick x s.t. 0 ≤ x ≤ q − 1 as the public key.

• Compute y = g^{x}(mod p) as the private key.

To sign a message M:

• Pick k∈_{R}Z_{q}^{∗}

• a = g^{k}(mod p)(mod q). This has the advantage of reducing the message size even further. If |p| = 1000, but |q| = 160, we now have a shorter signature.

• b = \frac{m+ax}{k}(mod q) (NOTE: here we use a +, not a -, as in ElGamal).

• σ(M) = (a, b) To verify a signature:

• Check that y^{\frac{a}{b}} g^{\frac{M}{b}} (mod p)(mod q) = a g^{\frac{ax}{b}} g^{\frac{M}{b}} (mod p)(mod q) = g^{\frac{M+ax}{b}} (mod p)(mod q) = g^{k}(mod p)(mod q) = a√

How can we find a generator?

• Know p

• Find h s.t. h^{p−1} ≡ 1(mod p).

• So, g = h^{\frac{p−1}{q}} – of order q Again, in this scheme, the security rests on the difficulty in finding and computing discrete logarithms. Also, as before, releasing k compromises the security of the signature. Finally, DSS appears to have the advantages of computing shorter signatures, not being suitable for encryption, ease in finding generators, and having generators whose order is prime. Throughout all of this, we assume we use a short M. However, we can also use H(M), the hash of M (using MD5, etc.), and just sign the shorter hash of the message.

3 RSA [Rivest, Shamir, and Adleman, 1977]

Unlike the above schemes, RSA is based on a composite modulus. Let us try using a prime modulus p, as before, and try to develop some motivation for why we might want a composite modulus.

Consider:

C = M^{e}(mod p)
C^{d} = M^{ed}(mod p)
= M^{k(p−1)+1}(mod p)
= M^{(p−1)k} · M(mod p)
= 1 · M(mod p)
= M(mod p)

(Let gcd(e, p − 1) = 1, so e^{−1}(mod p − 1) exists.) (Let d = e^{−1}(mod p − 1))

This works well privately, but it simply does not work well as a public key cryptography mechanism. If you know p and e, you can get p-1 easily and hence can compute e^{−1} to decrypt the message. So, how can we make this secure? One possibility is to make p secret. Instead of using mod p, how about mod n?

C = M^{e}(mod n) (Let n=pq, gcd(e,p-1) = 1, gcd(e,q-1) = 1.)

When thinking about doing computations mod n, it is helpful to think about coordinate representations and residues.

Z_{n} ≅ Z_{p} × Z_{q}

e.x.: p = 5, q = 7

We can fill in a residue table as follows: ...

0 1 2 3 4 5 6
0 0  5
1 1 6
2 7  2
3  8  3
4  9  4

... until we get the complete table:

0 1 2 3 4 5 6
0 0 15 30 10 25 5 20
1 21 1 16 31 11 26 6
2 7 22 2 17 32 12 27
3 28 8 23 3 18 33 13
4 14 29 9 24 4 19 34

In this table, we can easily find the value of a number x mod n. First, we compute what x is mod p, as well as mod q, and then looking up the number in the above table according to the “coordinates” from the mod p and mod q calculations. For example:

x mod n  (x mod p, x mod q)
23  ⟷  (3,2)
2  ⟷  (2,2)
46  ⟷  (6,4)=(1,4)
M^{e}  ⟷ (M^{e}(mod p),M^{e} mod q)

This of course, relates to the Chinese Remainder Theorem (covered in the readings) and how one can convert a number back and forth from the two representations (mod n and (mod p, mod q)): r(mod n) ⟷ (s(mod p), t(mod q)) where s = r mod p, t = r mod q.

and

r = (q(q^{−1}((mod p))) · s + (p · (p^{−1}(mod q)) · t))

So, it is relatively straightforward to convert back and forth between these representations.

With this background, we can now proceed to the RSA algorithm.

• Pick large (private) primes p,q.

• Pick small integer e s.t. gcd(e,(p-1)×(q-1)) = 1. (Use something small, such as 2^{16} + 1, so encryption is fast.)

• Pick d = e^{−1}(mod p − 1) × (q − 1). Also, we know that d = e^{−1}(mod p − 1) and d = e^{−1}(mod q − 1).

• So,

C = M^{e}(mod n)
C^{d} = M^{ed}(mod n)
= M^{k(p−1)(q−1)+1}(mod n)
= M^{(p−1)(q−1)} · M(mod n)
= 1 · M(mod n)
= M(mod n)

• Thus, we can leave p, q, d private but make n=pq, e public. We use (n,e) as our public key and d as our private key (which depends on the privacy of p,q in order to keep an adversary from computing d from e, which is possible with knowledge of p-1, q-1).

• C = M^{e}(mod n), M = C^{d}(mod n)

• To find d, we need to know p-1, q-1. This is tough - probably as tough as factoring large numbers. What if you get unlucky, and p and q are not primes? You might get p and q as Carmichael Numbers, in which case there will be more factors of n, making it somewhat easier to factor. If you do not get Carmichael Numbers, most likely you will get garbage out of trying to “decrypt” an encrypted message, which should notify you that something is wrong with p and q.

To sign a message M:

• σ = M^{d}(mod n) → (M, σ)

To verify:

• Check that σ^{e} = M

Finally, there is a potential problem with RSA. Namely, RSA adheres to a multiplicative property. Suppose you have simple messages M_{1}=2, M_{2}=3. Then,

E(M_{1}) = 2^{d}(mod n)
× E(M_{2}) = 3^{d}(mod n)
(2 · 3)^{d}(mod n)

Hence, you now know 6^{d} = E(6)! In practice, however, you typically sign the hash of the message, which scrambles up the bits and keeps this from being a real problem.

Because RSA depends on the difficulty of factoring, one must consider exactly how difficult factoring is. To date, most of the best algorithms are on the order of ∼ e^{c (ln n)^{\frac{1}{3}} (ln ln n)^{\frac{2}{3}}} . One can actually do slightly better; the best known algorithm is the Number Field Sieve (which sacrifices some from the \frac{1}{3}rd term in order to lower and improve the \frac{2}{3}rds term). Also, while it is known that if you can factor a large number, you can break RSA, it is not known (or proven) that decrypting a message means that you can factor a large number.