%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\documentstyle[12pt,twoside,alltt,psfig]{article}
\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {2}
\sloppy

\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of 
Proof}\hspace*{1em}}{\qed\bigskip}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}

\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1997}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture #1 : #2 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: #3 \hfill Scribe: #4} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%		ordinal number of the lecure
%		date of the lecure
%		lecturer
%		scribe---that is you
%
\lecture{9}{September 25,1997}{Ron Rivest}{Vijak Sethaput} 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% For theorems, lemmas, definitions, remarks, etc. use commands
% \begin{theorem} .... \end{theorem} 
% \begin{definition} ... \end{definition} 
% \begin{proof} ... \end{proof}
% and so on ...
%
% If you want to insert figures in your notes do the following: 
% 1) Prepare your figures using your favourite graphic editor
% 	for example idraw or xfig
% 2) Save your pictures in PostScript form using the following convention
% 	notes-nn-fig-mm.ps where nn is the number of the lecture you 
% 	are scribing and mm is the sequential number of the picture in the 
% 	notes
% 3) Insert the following block in your LaTeX code in the place you 
% 	want to insert the figure BUT LEAVE IT AS A COMMENT (with the %
% 	at the beginning of the line) since it will not work on athena: 
%
% \begin{figure}[h]
% \begin{center}
% \mbox{\psfig{figure=notes-nn-fig-mm.ps}}
% \caption{A very nice picture.}
% \label{fig:mm}
% \end{center}
% \end{figure}
%
% 	of course the picture will not show up when you compile and 
% 	print your notes, but don't worry the TA will take care of it. 
% 4) When you mail the TA the LaTeX code mail him/her the PostScript
%	files for the figures as well 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{Public Key Cryptography}

The idea for public key systems originated with Merkle at UC Berkley when he was trying to develop an algorithm for communicating over secure lines without prior exchange for key as we have seen so far. Merkle came up with a puzzle scheme. This requires people who are communicating to solve just one puzzle but the adversary has to solve many more puzzles. Berkley wasn't interested in his work, so he went to talked to Diffie and Hellman at Standford about the idea. Diffie Hellman then came up with the key exchange protocol which is based on the discrete Log Problem.

\subsection{Key Exchange Protocol}

\begin{figure}[h]
\begin{center}
\mbox{\psfig{figure=notes-09-fig-01.eps}}
\caption{Diffie-Hellman Key Exchange Protocol.}
\label{fig:mm}
\end{center}
\end{figure}
As shown in the figure, Eve faces the Diffie-Hellman problem which can be state as follows:
\begin{definition} Diffie-Hellman Problem
 
Given $g$, $p$, $g^{a} \pmod p$, $g^{b} \pmod p$
The adversary has to compute $g^{ab} \pmod p$ 
\end{definition} 

The nice property about this  protocol is that it can bootstap the parties from no secret key to have shared secret key using global public value. The protocol is secured base on the fact that Discrete Log Problem is hard. However, if Eve start to be active, there will need to be more steps added.

\subsection{El Gamal}

\subsubsection{Setting up:}
\begin{itemize}
\item Alice choose private key $a$ s.t. $0<= a < p-1$ ($a \in Z_{p-1}$)
\item Alice can then compute her public key, $ g^{a}\pmod p$ which she can then publish somewhere
\end{itemize}

\subsubsection{Privacy}

To encrypt messages:
\begin{itemize}
\item Bob pick a random $k$ s.t. $0<= k < p-1$ ($k \in Z_{p-1}$) which corresponding to $b$ in Diffie-Hellman Key exchange protocol.
\item Now both parties can computer their share key $g^{ka}$
\item Bob send $(c_1, c_2)=(g^k, M*g^{ka})$ 
\end{itemize}
To decrypt:
\begin{itemize}
\item Alice can now compute thier share key, $(g^k)^a$
\item The message $M$ is then $M=\frac{c_2}{(g^k)^a} = \frac{c_2}{(c_1)^a}$
\end{itemize}

\subsubsection{Authentication}

Signature:

The idea for signature is that only Alice can produce the signature but others just using Alice public key, $g^a$, can verify that $k^{-1}$ (mod $(p-1)$) exist. 
\begin{itemize}
\item Alice generate a random $k$, $0<= k < p-1$ and gcd$(k, p-1)=1$
\item Alice then compute $r=g^k$ (mod $p$)
\item Signature $\sigma=(r, s)$ where $b={(M-ra)/k}$  (mod $(p-1)$)
\end{itemize}

Verify:
\begin{itemize}
\item $y = g^a$
\item $y^r \cdot r^s \stackrel{?}{=} g^M \pmod p$
\item $g^{ar} \cdot g^{ks} \stackrel{?}{=} g^M \pmod p$ 
\item $g^{ar+ks} \stackrel{?}{=} g^M \pmod p$
\item iff $M \stackrel{\surd}{=} ar+ks \pmod{(p-1)}$
\end{itemize}

Note that in this scheme the value of $k$ need to be protected. Since, if adversary knows $k$ then he/she can solve for $a$ thus find out the secret.

\section{Digital Signature Standard (DSS) [proposed by NIST, 1991]}
This is a fairly interesting, non-deterministic cryptography scheme
which was proposed by the government.  Accordingly, there has also
been some criticism and skepticism surrounding this scheme, because
part of the proposal had the government ``supply'' the large prime p.
Some believed that this could lead to a weakness in the scheme because
a p could be chosen such that one could take discrete logs for that p.
Or, other weaknesses in a specific p could be exploited as a
``back-door'' mechanism, should the p be a ``weaker'' prime.  This is
not very likely, however.  Another interesting fact about DSS is that
it is designed specifically for signatures, making using DSS for any
kind of encryption more difficult (but modification of DSS into an
encryption scheme is possible).

DSS starts off similarly to ElGamal.  

\begin{itemize}
\item Start off by finding a large (public) prime p.  This time,
however, do {\it not} find a generator for p.  Instead,
\item Find another prime q $|$ p-1, where $|q|$ = 160 bits.  (Often,
you find q first and then guess at various p's until you find one that
works.)
\item Find a (public) generator g of order q modulo p ($g^q = 1 \bmod
p$).  This need only generate a subgroup, however.  Specifically, we
want $g^i \neq 1$ if $0 \leq i < q$.
\item Now, pick x s.t. $0 \leq x \leq q-1$ as the public key.
\item Compute $y=g^x (\bmod \ p)$ as the private key.
\end{itemize}

To sign a message M:
\begin{itemize}
\item Pick $k {\in}_R Z_q^*$
\item $a = g^k (\bmod \ p) (\bmod \ q)$.  This has the advantage of
reducing the message size even further.  If $|p|$ = 1000, but $|q|$ =
160, we now have a shorter signature.
\item $b = \frac{m + ax}{k} (\bmod \ q)$ (NOTE: here we use a +, not a -,
as in ElGamal).  
\item $\sigma(M) = (a,b)$
\end{itemize}

To verify a signature:
\begin{itemize}
\item Check that $y^{\frac{a}{b}}g^{\frac{M}{b}} (\bmod \ p) (\bmod \
q) = a$\\ \\
$g^{\frac{ax}{b}}g^{\frac{M}{b}} (\bmod \ p) (\bmod \ q)$\\
$=g^{\frac{M+ax}{b}} (\bmod \ p) (\bmod \ q)$\\ 
$=g^k (\bmod \ p) (\bmod \ q)$\\ 
$=a \surd$
\end{itemize}

How can we find a generator?
\begin{itemize}
\item Know p
\item Find h s.t. $h^{p-1} \equiv 1 (\bmod \ p)$.
\item So, $g = h^{\frac{p-1}{q}}$ -- of order q
\end{itemize}

Again, in this scheme, the security rests on the difficulty in finding
and computing discrete logarithms.  Also, as before, releasing {\it k}
compromises the security of the signature.  Finally, DSS appears to
have the advantages of computing shorter signatures, not being
suitable for encryption, ease in finding generators, and having
generators whose order is prime.  Throughout all of this, we assume we
use a short M.  However, we can also use H(M), the hash of M (using
MD5, etc.), and just sign the shorter hash of the message.

\section{RSA [Rivest, Shamir, and Adleman, 1977]}
Unlike the above schemes, RSA is based on a composite modulus.  Let us
try using a prime modulus p, as before, and try to develop some
motivation for why we might want a composite modulus.

Consider:
\begin{eqnarray*}
C = M^e (\bmod \ p) \\
C^d = M^{ed} (\bmod \ p)\\
= M^{k(p-1)+1} (\bmod \ p)\\
= M^{(p-1)k} \cdot M (\bmod \ p)\\
= 1 \cdot M (\bmod \ p)\\
= M (\bmod \ p)\\
\end{eqnarray*}
(Let $gcd(e,p-1) = 1$, so $e^{-1} (\bmod \ p-1)$ exists.)\\
(Let $d = e^{-1} (\bmod \ p-1)$)\\

This works well privately, but it simply does not work well as a
public key cryptography mechanism.  If you know p and e, you can get
p-1 easily and hence can compute $e^{-1}$ to decrypt the message.  So,
how can we make this secure?  One possibility is to make p secret.
Instead of using {\it mod p}, how about {\it mod n}?

$C = M^e (\bmod \ n)$ (Let n=pq, gcd(e,p-1) = 1, gcd(e,q-1) = 1.)\\

When thinking about doing computations mod n, it is helpful to think
about coordinate representations and residues.\\

$Z_n \cong Z_p \times Z_q$\\

e.x.: p = 5, q = 7

We can fill in a residue table as follows: ...

\begin{center}
\begin{tabular}{|c||c|c|c|c|c|c|c|}
\hline \hline
&0&1&2&3&4&5&6\\ \hline
0&0&&&&&5&\\ \hline
1&&1&&&&&6\\ \hline
2&7&&2&&&&\\ \hline
3&&8&&3&&&\\ \hline
4&&&9&&4&&\\ \hline
\end{tabular}
\end{center}

... until we get the complete table:

\begin{center}
\begin{tabular}{|c||c|c|c|c|c|c|c|}
\hline \hline
&0&1&2&3&4&5&6\\ \hline
0&0&15&30&10&25&5&20\\ \hline
1&21&1&16&31&11&26&6\\ \hline
2&7&22&2&17&32&12&27\\ \hline
3&28&8&23&3&18&33&13\\ \hline
4&14&29&9&24&4&19&34\\ \hline
\end{tabular}
\end{center}

In this table, we can easily find the value of a number x mod n.
First, we compute what x is mod p, as well as mod q, and then looking
up the number in the above table according to the ``coordinates'' from
the mod p and mod q calculations.  For example:\\

\begin{tabular}{ccc}
x mod n&&(x mod p, x mod q)\\ \hline \hline
23&$\longleftrightarrow$&(3,2)\\
2&$\longleftrightarrow$&(2,2)\\ \hline
46&$\longleftrightarrow$&(6,4)=(1,4)\\
\\
$M^e$&$\longleftrightarrow$&($M^e (\bmod \ p)$,$M^e \bmod \ q$)\\
\end{tabular}

This of course, relates to the Chinese Remainder Theorem (covered in
the readings) and how one can convert a number back and forth from the
two representations (mod n and (mod p, mod q)):

$r (\bmod \ n) \longleftrightarrow\ (s (\bmod \ p), t (\bmod \ q))$\\
where s = r mod p, t = r mod q.

and

$r = (q(q^{-1}((\bmod \ p))) \cdot s + (p \cdot (p^{-1} (\bmod \ q))
\cdot t))$

So, it is relatively straightforward to convert back and forth between
these representations.

With this background, we can now proceed to the RSA algorithm.

\begin{itemize}
\item Pick large (private) primes p,q.
\item Pick small integer e s.t. gcd(e,(p-1)$\times$(q-1)) = 1.  (Use
something small, such as $2^{16} + 1$, so encryption is fast.)
\item Pick $d = e^{-1} (\bmod \ p-1) \times (q-1)$.  Also, we know
that $d=e^{-1}(\bmod \ p-1)$ and $d=e^{-1}(\bmod \ q-1)$.

\item So,
\begin{eqnarray*}
C=M^e (\bmod \ n) \\
C^d = M^{ed} (\bmod \ n) \\
=M^{k(p-1)(q-1)+1} (\bmod \ n)\\
=M^{(p-1)(q-1)} \cdot M (\bmod \ n)\\
=1 \cdot M (\bmod \ n)\\
=M (\bmod \ n)\\
\end{eqnarray*}
\item Thus, we can leave p, q, d private but make n=pq, e public.  We
use (n,e) as our public key and d as our private key (which depends on
the privacy of p,q in order to keep an adversary from computing d from
e, which is possible with knowledge of p-1, q-1).
\item $C=M^e (\bmod \ n)$, $M=C^d (\bmod \ n)$
\item To find d, we need to know p-1, q-1.  This is tough - probably
as tough as factoring large numbers.  What if you get unlucky, and p
and q are not primes?  You might get p and q as Carmichael Numbers, in
which case there will be more factors of n, making it somewhat easier
to factor.  If you do not get Carmichael Numbers, most likely you will
get garbage out of trying to ``decrypt'' an encrypted message, which
should notify you that something is wrong with p and q.
\end{itemize}

To sign a message M:
\begin{itemize}
\item $\sigma = M^d (\bmod \ n) \rightarrow (M,\sigma)$\\
\end{itemize}

To verify:
\begin{itemize}
\item Check that ${\sigma}^e = M$\\
\end{itemize}

Finally, there is a potential problem with RSA.  Namely, RSA adheres
to a multiplicative property.  Suppose you have simple messages
$M_1$=2, $M_2$=3.  Then, 

\begin{tabular}{rr}
&$E(M_1)=2^d (\bmod \ n)$\\
$\times$&$E(M_2)=3^d (\bmod \ n)$\\ \hline
&$(2 \cdot 3)^d (\bmod \ n)$\\
\end{tabular}

Hence, you now know $6^d$ = E(6)!  In practice, however, you typically
sign the {\it hash} of the message, which scrambles up the bits and
keeps this from being a real problem.

Because RSA depends on the difficulty of factoring, one must consider
exactly how difficult factoring is.  To date, most of the best
algorithms are on the order of $\sim e^{c\ (ln\ n)^{\frac{1}{3}} (ln\
ln\ n)^{\frac{2}{3}}}$.  One can actually do slightly better; the best
known algorithm is the {\it Number Field Sieve} (which sacrifices some
from the ${\frac{1}{3}}{rd}$ term in order to lower and improve the
${\frac{2}{3}}{rds}$ term).  Also, while it is known that if you can
factor a large number, you can break RSA, it is {\it not} known (or
proven) that decrypting a message means that you can factor a large
number.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes end here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\end{document}
