Public-key cryptography and the Discrete-Logarithm Problem. Tanja Lange Technische Universiteit Eindhoven. with some slides by Daniel J.
|
|
|
- Amanda Shaw
- 5 years ago
- Views:
Transcription
1 Public-key cryptography and the Discrete-Logarithm Problem Tanja Lange Technische Universiteit Eindhoven with some slides by Daniel J. Bernstein
2 Cryptography Let s understand what our browsers do.
3 Schoolbook RSA Pick primes p; q of same bitlength, at least 512 bits (2048 to feel secure). Compute N = p q. Compute (N) = (p 1)(q 1). Pick e with gcdfe; (N)g = 1. Compute e with ed 1 (mod (N)): Public key is (e; N), secret key is d. Some systems keep p and q, to speed up decryption (CRT).
4 Encryption of message m < N: Compute c = m e (mod N). Decryption of ciphertext c:
5 Encryption of message m < N: Compute c = m e (mod N). Decryption of ciphertext c: Compute c d (m e ) d m k(n)+1 m modulo N.
6 Encryption of message m < N: Compute c = m e (mod N). Decryption of ciphertext c: Compute c d (m e ) d m k(n)+1 m modulo N. Signature on message m: Uses cryptographic hash function h : f0; 1g! Z=N Compute s = (h(m)) d (mod N). Verify signature by comparing h(m) with s e (mod N).
7 Problems with schoolbook RSA Encryption is deterministic: attacker can test candidate message; repeated messages are recognized. Small e is dangerous for small m (no effect of modular reduction). More number-theoretic fun, if A sends same message to B,C, D, who all use e = 3. Encryption is homomorphic: encryption of m 1 m 2 is c 1 c 2 (mod N).
8 Modern cryptography: allow attacker to use oracles for decryption or signatures. Can query anything except for target. Use this to decrypt c:
9 Modern cryptography: allow attacker to use oracles for decryption or signatures. Can query anything except for target. Use this to decrypt c: Pick random m 0. Ask oracle to decrypt c 0 = (m 0 ) e c (mod N). Get message by dividing my m 0.
10 RSA-OAEP Optimal asymmetric encryption padding, included in PKCS #1v2. Formats message (before RSA). Formatting unlikely to survive multiplication. If format is incorrect decryption will fail. Let n = blog 2 Nc. Algorithm uses parameters k 0 ; k 1, messages are in f0; 1g n k 0 k 1. Uses two hash functions G; H: G : f0; 1g k 0! f0; 1g n k 0 H : f0; 1g n k 0! f0; 1g k 0.
11 1. Pad m with k 1 zeros. 2. Pick random r 2 f0; 1g k Compute X = m00 : : : 0 G(r). 4. Compute Y = r H(X). 5. Output X; Y. Credit: Ozga at en.wikipedia
12 What does your browser do? 1. Check X.509 certificate: RSA signature verification. 2. OAEP format random message m; 3. RSA encrypt resulting message M = X; Y (interpreted as number mod N). 4. Send ciphertext to server. 5. Derive encryption and authentication keys from m. 6. Use these for the bulk encryption. Google uses RC4 for encryption; other common choice: AES.
13 Authenticated encryption Authentication key computes tag on message so that any change makes tag invalid. Cannot prove authenticity to third party. Convinces owners of secret key that they are communicating with one another. Typical examples: RC4-HMAC (keyed-hash message authentication code) AES-GCM (Galois Counter Mode)
14 The clock y x This is the curve x 2 + y 2 = 1. Warning: This is not an elliptic curve. Elliptic curve 6= ellipse.
15 Examples of points on this curve:
16 Examples of points on this curve: (0; 1) = 12:00.
17 Examples of points on this curve: (0; 1) = 12:00. (0; 1) = 6:00.
18 Examples of points on this curve: (0; 1) = 12:00. (0; 1) = 6:00. (1; 0) = 3:00.
19 Examples of points on this curve: (0; 1) = 12:00. (0; 1) = 6:00. (1; 0) = 3:00. ( 1; 0) = 9:00.
20 Examples of points on this curve: (0; 1) = 12:00. (0; 1) = 6:00. (1; 0) = 3:00. ( p 1; 0) = 9:00. ( 3=4; 1=2) =
21 Examples of points on this curve: (0; 1) = 12:00. (0; 1) = 6:00. (1; 0) = 3:00. ( p 1; 0) = 9:00. ( 3=4; 1=2) = 2:00.
22 Examples of points on this curve: (0; 1) = 12:00. (0; 1) = 6:00. (1; 0) = 3:00. ( p 1; 0) = 9:00. ( 3=4; 1=2) = 2:00. p (1=2; 3=4) =
23 Examples of points on this curve: (0; 1) = 12:00. (0; 1) = 6:00. (1; 0) = 3:00. ( 1; 0) = 9:00. p ( 3=4; 1=2) = 2:00. p (1=2; 3=4) = 5:00. p 3=4) = ( 1=2;
24 Examples of points on this curve: (0; 1) = 12:00. (0; 1) = 6:00. (1; 0) = 3:00. ( 1; 0) = 9:00. p ( 3=4; 1=2) = 2:00. p (1=2; 3=4) = 5:00. p 3=4) = 7:00. ( 1=2;
25 Examples of points on this curve: (0; 1) = 12:00. (0; 1) = 6:00. (1; 0) = 3:00. ( 1; 0) = 9:00. p ( 3=4; 1=2) = 2:00. p (1=2; 3=4) = 5:00. p 3=4) = 7:00. ( 1=2; p ( 1=2; p 1=2) = 1:30. (3=5; 4=5). ( 3=5; 4=5).
26 Examples of points on this curve: (0; 1) = 12:00. (0; 1) = 6:00. (1; 0) = 3:00. ( 1; 0) = 9:00. p ( 3=4; 1=2) = 2:00. p (1=2; 3=4) = 5:00. p 3=4) = 7:00. ( 1=2; p ( 1=2; p 1=2) = 1:30. (3=5; 4=5). ( 3=5; 4=5). (3=5; 4=5). ( 3=5; 4=5). (4=5; 3=5). ( 4=5; 3=5). (4=5; 3=5). ( 4=5; 3=5). Many more.
27 Addition on the clock: y neutral = (0; 1) P 1 = (x 1 ; y 1 ) 1 P 2 = (x 2 ; y 2 ) x P 3 = (x 3 ; y 3 ) x 2 + y 2 = 1, parametrized by x = sin, y = cos.
28 Addition on the clock: y neutral = (0; 1) P 1 = (x 1 ; y 1 ) 1 P 2 = (x 2 ; y 2 ) x P 3 = (x 3 ; y 3 ) x 2 + y 2 = 1, parametrized by x = sin, y = cos. Recall (sin( ); cos( )) =
29 Addition on the clock: y neutral = (0; 1) P 1 = (x 1 ; y 1 ) 1 P 2 = (x 2 ; y 2 ) x P 3 = (x 3 ; y 3 ) x 2 + y 2 = 1, parametrized by x = sin, y = cos. Recall (sin( ); cos( )) = (sin 1 cos 2 + cos 1 sin 2 ;
30 Addition on the clock: y neutral = (0; 1) P 1 = (x 1 ; y 1 ) 1 P 2 = (x 2 ; y 2 ) x P 3 = (x 3 ; y 3 ) x 2 + y 2 = 1, parametrized by x = sin, y = cos. Recall (sin( ); cos( )) = (sin 1 cos 2 + cos 1 sin 2 ; cos 1 cos 2 sin 1 sin 2 ).
31 Adding two points corresponds to adding the angles 1 and 2. Angles modulo 360 are a group, so points on clock are a group. Neutral element: angle = 0; point (0; 1); 12:00. The point with = 180 has order 2 and equals 6:00. 3:00 and 9:00 have order 4. Inverse of point with is point with since + ( ) = 0. There are many more points where angle is not nice.
32 Clock addition without sin, cos: y neutral = (0; 1) P 1 = (x 1 ; y 1 ) P 2 = (x 2 ; y 2 ) x P 3 = (x 3 ; y 3 ) Use Cartesian coordinates for addition. Addition formula for the clock x 2 + y 2 = 1: sum (x 1 ; y 1 ) + (x 2 ; y 2 ) = (x 3 ; y 3 ) = (x 1 y 2 + y 1 x 2 ; y 1 y 2 x 1 x 2 ). Note (x 1 ; y 1 ) + ( x 1 ; y 1 ) = (0; 1). kp = P + P + + P {z } k copies for k 0.
33 Examples of clock addition: 2:00 p + 5:00 p = ( 3=4; 1=2) + (1=2; 3=4) p = ( 1=2; 3=4) = 7:00. 5:00 + 9:00 p = (1=2; 3=4) + ( 1; 0) p = ( 3=4; 1=2) = 2: ; 4 24 = ;
34 Examples of clock addition: 2:00 p + 5:00 p = ( 3=4; 1=2) + (1=2; 3=4) p = ( 1=2; 3=4) = 7:00. 5:00 + 9:00 p = (1=2; 3=4) + ( 1; 0) p = ( 3=4; 1=2) = 2: ; 4 24 = ; ; = ;
35 Examples of clock addition: 2:00 p + 5:00 p = ( 3=4; 1=2) + (1=2; 3=4) p = ( 1=2; 3=4) = 7:00. 5:00 + 9:00 p = (1=2; 3=4) + ( 1; 0) p = ( 3=4; 1=2) = 2: ; 4 24 = ; ; = ; ; = ;
36 Examples of clock addition: 2:00 p + 5:00 p = ( 3=4; 1=2) + (1=2; 3=4) p = ( 1=2; 3=4) = 7:00. 5:00 + 9:00 p = (1=2; 3=4) + ( 1; 0) p = ( 3=4; 1=2) = 2: ; 4 24 = ; ; = ; ; = ; (x 1 ; y 1 ) + (0; 1) =
37 Examples of clock addition: 2:00 p + 5:00 p = ( 3=4; 1=2) + (1=2; 3=4) p = ( 1=2; 3=4) = 7:00. 5:00 + 9:00 p = (1=2; 3=4) + ( 1; 0) p = ( 3=4; 1=2) = 2: ; 4 24 = ; ; = ; ; = ; (x 1 ; y 1 ) + (0; 1) = (x 1 ; y 1 ).
38 Examples of clock addition: 2:00 p + 5:00 p = ( 3=4; 1=2) + (1=2; 3=4) p = ( 1=2; 3=4) = 7:00. 5:00 + 9:00 p = (1=2; 3=4) + ( 1; 0) p = ( 3=4; 1=2) = 2: ; 4 24 = ; ; = ; ; = ; (x 1 ; y 1 ) + (0; 1) = (x 1 ; y 1 ). (x 1 ; y 1 ) + ( x 1 ; y 1 ) =
39 Examples of clock addition: 2:00 p + 5:00 p = ( 3=4; 1=2) + (1=2; 3=4) p = ( 1=2; 3=4) = 7:00. 5:00 + 9:00 p = (1=2; 3=4) + ( 1; 0) p = ( 3=4; 1=2) = 2: ; 4 24 = ; ; = ; ; = ; (x 1 ; y 1 ) + (0; 1) = (x 1 ; y 1 ). (x 1 ; y 1 ) + ( x 1 ; y 1 ) = (0; 1).
40 Clocks over finite fields Clock(F 7 ) = (x; y) 2 F7 F 7 : x 2 + y 2 = 1. Here F 7 = f0; 1; 2; 3; 4; 5; 6g = f0; 1; 2; 3; 3; 2; 1g with +; ; modulo 7.
41 Larger example: Clock(F ). Examples of clock addition: 2(1000; 2) = (4000; 7). 4(1000; 2) = (56000; 97). 8(1000; 2) = (863970; 18817). 16(1000; 2) = (549438; ). 17(1000; 2) = (951405; ). With 30 clock additions we computed n(1000; 2) = (947472; ) for some 6-digit n. Can you figure out n?
42 Clock cryptography Standardize a large prime p and some (X; Y ) 2 Clock(F p ). Alice chooses big secret a. Computes her public key a(x; Y ). Bob chooses big secret b. Computes his public key b(x; Y ). Alice computes a(b(x; Y )). Bob computes b(a(x; Y )). I.e., both obtain (ab)(x; Y ). They use this shared value to encrypt with AES-GCM etc.
43 Alice s secret key a Bob s secret key b Alice s public key Bob s public key a(x; Y ) b(x; Y ) falice; Bobg s fbob; Aliceg s shared secret ab(x; Y ) = shared secret ba(x; Y )
44 Alice s secret key a Bob s secret key b Alice s public key Bob s public key a(x; Y ) b(x; Y ) falice; Bobg s fbob; Aliceg s shared secret ab(x; Y ) = shared secret ba(x; Y ) Warning: Clocks aren t elliptic! Can attack clock cryptography, e.g., compute a from public key, by combining congruences. To match RSA-3072 security need p
45 Addition on an Edwards curve Change the curve on which Alice and Bob work. y neutral = (0; 1) P 1 = (x 1 ; y 1 ) P 2 = (x 2 ; y 2 ) x P 3 = (x 3 ; y 3 ) x 2 + y 2 = 1 30x 2 y 2. Sum of (x 1 ; y 1 ) and (x 2 ; y 2 ) is ((x 1 y 2 +y 1 x 2 )=(1 30x 1 x 2 y 1 y 2 ), (y 1 y 2 x 1 x 2 )=(1+30x 1 x 2 y 1 y 2 )).
46 The clock again, for comparison: y neutral = (0; 1) P 1 = (x 1 ; y 1 ) P 2 = (x 2 ; y 2 ) x P 3 = (x 3 ; y 3 ) x 2 + y 2 = 1. Sum of (x 1 ; y 1 ) and (x 2 ; y 2 ) is (x 1 y 2 + y 1 x 2, y 1 y 2 x 1 x 2 ).
47 Hey, there were divisions in the Edwards addition law! What if the denominators are 0? Answer: They aren t! If x i = 0 or y i = 0 then 1 30x 1 x 2 y 1 y 2 = 1 6= 0. If x 2 + y 2 = 1 30x 2 y 2 then 30x 2 y 2 < 1 so p 30 jxyj < 1.
48 Hey, there were divisions in the Edwards addition law! What if the denominators are 0? Answer: They aren t! If x i = 0 or y i = 0 then 1 30x 1 x 2 y 1 y 2 = 1 6= 0. If x 2 + y 2 = 1 30x 2 y 2 then 30x 2 y 2 < 1 so p 30 jxyj < 1. If x y2 1 = 1 30x2 1 y2 1 and x y2 2 = 1 30x2 2 y2 2 then p 30 jx 1 y 1 j < 1 and p 30 jx 2 y 2 j < 1
49 Hey, there were divisions in the Edwards addition law! What if the denominators are 0? Answer: They aren t! If x i = 0 or y i = 0 then 1 30x 1 x 2 y 1 y 2 = 1 6= 0. If x 2 + y 2 = 1 30x 2 y 2 then 30x 2 y 2 < 1 so p 30 jxyj < 1. If x y2 1 = 1 30x2 1 y2 1 and x y2 2 = 1 30x2 2 y2 2 then p 30 jx 1 y 1 j < 1 and p 30 jx 2 y 2 j < 1 so 30 jx 1 y 1 x 2 y 2 j < 1 so 1 30x 1 x 2 y 1 y 2 > 0.
50 The Edwards addition law (x 1 ; y 1 ) + (x 2 ; y 2 ) = ((x 1 y 2 +y 1 x 2 )=(1 30x 1 x 2 y 1 y 2 ), (y 1 y 2 x 1 x 2 )=(1+30x 1 x 2 y 1 y 2 )) is a group law for the curve x 2 + y 2 = 1 30x 2 y 2. Some calculation required: addition result is on curve; addition law is associative. Other parts of proof are easy: addition law is commutative; (0; 1) is neutral element; (x 1 ; y 1 ) + ( x 1 ; y 1 ) = (0; 1).
51 More Edwards curves Fix an odd prime power q. Fix a non-square d 2 F q. f(x; y) 2 F q F q : x 2 + y 2 = 1 + dx 2 y 2 g is a commutative group with (x 1 ; y 1 ) + (x 2 ; y 2 ) = (x 3 ; y 3 ) defined by Edwards addition law: x 3 = x 1y 2 + y 1 x dx 1 x 2 y 1 y 2, y 3 = y 1y 2 x 1 x 2 1 dx 1 x 2 y 1 y 2.
52 Denominators are never 0. But need different proof; x 2 + y 2 > 0 doesn t work.
53 Denominators are never 0. But need different proof; x 2 + y 2 > 0 doesn t work. If x y2 1 = 1 + dx2 1 y2 1 and x y2 2 = 1 + dx2 2 y2 2 and dx 1 x 2 y 1 y 2 = 1
54 Denominators are never 0. But need different proof; x 2 + y 2 > 0 doesn t work. If x y2 1 = 1 + dx2 1 y2 1 and x y2 2 = 1 + dx2 2 y2 2 and dx 1 x 2 y 1 y 2 = 1 then dx 2 1 y2 1 (x 2 + y 2 ) 2 = dx 2 1 y2 1 (x2 2 + y x 2y 2 )
55 Denominators are never 0. But need different proof; x 2 + y 2 > 0 doesn t work. If x y2 1 = 1 + dx2 1 y2 1 and x y2 2 = 1 + dx2 2 y2 2 and dx 1 x 2 y 1 y 2 = 1 then dx 2 1 y2 1 (x 2 + y 2 ) 2 = dx 2 1 y2 1 (x2 2 + y x 2y 2 ) = dx 2 1 y2 1 (dx2 2 y x 2y 2 )
56 Denominators are never 0. But need different proof; x 2 + y 2 > 0 doesn t work. If x y2 1 = 1 + dx2 1 y2 1 and x y2 2 = 1 + dx2 2 y2 2 and dx 1 x 2 y 1 y 2 = 1 then dx 2 1 y2 1 (x 2 + y 2 ) 2 = dx 2 1 y2 1 (x2 2 + y x 2y 2 ) = dx 2 1 y2 1 (dx2 2 y x 2y 2 ) = d 2 x 2 1 y2 1 x2 2 y2 2 +dx2 1 y2 1 +2dx2 1 y2 1 x 2y 2
57 Denominators are never 0. But need different proof; x 2 + y 2 > 0 doesn t work. If x y2 1 = 1 + dx2 1 y2 1 and x y2 2 = 1 + dx2 2 y2 2 and dx 1 x 2 y 1 y 2 = 1 then dx 2 1 y2 1 (x 2 + y 2 ) 2 = dx 2 1 y2 1 (x2 2 + y x 2y 2 ) = dx 2 1 y2 1 (dx2 2 y x 2y 2 ) = d 2 x 2 1 y2 1 x2 2 y2 2 +dx2 1 y2 1 +2dx2 1 y2 1 x 2y 2 = 1 + dx 2 1 y2 1 2x 1y 1
58 Denominators are never 0. But need different proof; x 2 + y 2 > 0 doesn t work. If x y2 1 = 1 + dx2 1 y2 1 and x y2 2 = 1 + dx2 2 y2 2 and dx 1 x 2 y 1 y 2 = 1 then dx 2 1 y2 1 (x 2 + y 2 ) 2 = dx 2 1 y2 1 (x2 2 + y x 2y 2 ) = dx 2 1 y2 1 (dx2 2 y x 2y 2 ) = d 2 x 2 1 y2 1 x2 2 y2 2 +dx2 1 y2 1 +2dx2 1 y2 1 x 2y 2 = 1 + dx 2 1 y2 1 2x 1y 1 = x y2 1 2x 1y 1
59 Denominators are never 0. But need different proof; x 2 + y 2 > 0 doesn t work. If x y2 1 = 1 + dx2 1 y2 1 and x y2 2 = 1 + dx2 2 y2 2 and dx 1 x 2 y 1 y 2 = 1 then dx 2 1 y2 1 (x 2 + y 2 ) 2 = dx 2 1 y2 1 (x2 2 + y x 2y 2 ) = dx 2 1 y2 1 (dx2 2 y x 2y 2 ) = d 2 x 2 1 y2 1 x2 2 y2 2 +dx2 1 y2 1 +2dx2 1 y2 1 x 2y 2 = 1 + dx 2 1 y2 1 2x 1y 1 = x y2 1 2x 1y 1 = (x 1 y 1 ) 2.
60 Case 1: x 2 + y 2 6= 0. Then x 1 y 2 1 d =, x 1 y 1 (x 2 + y 2 ) contradiction.
61 Case 1: x 2 + y 2 6= 0. Then x 1 y 2 1 d =, x 1 y 1 (x 2 + y 2 ) contradiction. Case 2: x 2 y 2 6= 0. Then x 1 y 2 1, d = x 1 y 1 (x 2 y 2 ) contradiction.
62 Case 1: x 2 + y 2 6= 0. Then x 1 y 2 1 d =, x 1 y 1 (x 2 + y 2 ) contradiction. Case 2: x 2 y 2 6= 0. Then x 1 y 2 1, d = x 1 y 1 (x 2 y 2 ) contradiction. Case 3: x 2 + y 2 = x 2 y 2 = 0. Then x 2 = 0 and y 2 = 0, contradiction.
63 Using ECC sensibly Typical starting point: Client knows secret key a and server s public key b(x; Y ). Client computes (and caches) shared secret ab(x; Y ). Client has packet for server. Generates unique nonce. Uses shared secret to encrypt and authenticate packet. Total packet overhead: 24 bytes for nonce, 16 bytes for authenticator, 32 bytes for client s public key.
64 Server receives packet, sees client s public key a(x; Y ). Server computes (and caches) shared secret ab(x; Y ). Server uses shared secret to verify authenticator and decrypt packet. Client and server encrypt, authenticate, verify, and decrypt all subsequent packets in the same way, using the same shared secret.
65 Easy-to-use packet protection: crypto_box from nacl.cace-project.eu. High-security curve (Curve25519). High-security implementation (e.g., no secret array indices). Extensive code validation. Server can compute shared secrets for new clients in 40 seconds of computation on a Core 2 Quad. Not much hope for attacker if ECC user is running this!
66 Eliminating divisions Typical computation: P 7! np. Decompose into additions: P; Q 7! P + Q. Addition (x 1 ; y 1 ) + (x 2 ; y 2 ) = ((x 1 y 2 + y 1 x 2 )=(1 + dx 1 x 2 y 1 y 2 ), (y 1 y 2 x 1 x 2 )=(1 dx 1 x 2 y 1 y 2 )) uses expensive divisions. Better: postpone divisions and work with fractions. Represent (x; y) as (X : Y : Z) with x = X=Z and y = Y=Z for Z 6= 0.
67 Addition now has to handle fractions as input: X1 Z 1 ; Y 1 Z 1 + X2 Z 2 ; Y 2 Z 2 = X 1 Z 1 Y 2 Z 2 + Y 1 Z 1 X 2 Z d X, 1 X 2 Y 1 Y 2 Z 1 Z 2 Z 1 Z 2 Y 1 Z 1 Y 2 Z 2 X 1 Z 1 X 2 Z 2 1 d X 1 Z 1 X 2 Z 2 Y 1 Z 1 Y 2 Z 2! = Z 1 Z 2 (X 1 Y 2 + Y 1 X 2 ) Z 2 1 Z2 2 + dx 1X 2 Y 1 Y 2, Z 1 Z 2 (Y 1 Y 2 X 1 X 2 ) Z 2 1 Z2 2 dx 1X 2 Y 1 Y 2!
68 i.e. = X1 ; Y 1 Z 1 Z 1 X3 ; Y 3 Z 3 Z 3 + X2 Z 2 ; Y 2 Z 2 where F = Z1 2Z2 2 dx 1X 2 Y 1 Y 2, G = Z1 2Z2 2 + dx 1X 2 Y 1 Y 2, X 3 = Z 1 Z 2 (X 1 Y 2 + Y 1 X 2 )F, Y 3 = Z 1 Z 2 (Y 1 Y 2 X 1 X 2 )G, Z 3 = F G. Input to addition algorithm: X 1 ; Y 1 ; Z 1 ; X 2 ; Y 2 ; Z 2. Output from addition algorithm: X 3 ; Y 3 ; Z 3. No divisions needed!
69 Save multiplications by eliminating common subexpressions: A = Z 1 Z 2 ; B = A 2 ; C = X 1 X 2 ; D = Y 1 Y 2 ; E = d C D; F = B E; G = B + E; X 3 = A F (X 1 Y 2 + Y 1 X 2 ); Y 3 = A G (D C); Z 3 = F G. Cost: 11M + 1S + 1D. Can do better: 10M + 1S + 1D.
70 Faster doubling (x 1 ; y 1 ) + (x 1 ; y 1 ) = ((x 1 y 1 +y 1 x 1 )=(1+dx 1 x 1 y 1 y 1 ), (y 1 y 1 x 1 x 1 )=(1 dx 1 x 1 y 1 y 1 )) = ((2x 1 y 1 )=(1 + dx 2 1 y2 1 ), (y1 2 x2 1 )=(1 dx2 1 y2 1 )). x y2 1 = 1 + dx2 1 y2 1 so (x 1 ; y 1 ) + (x 1 ; y 1 ) = ((2x 1 y 1 )=(x y2 1 ), (y1 2 x2 1 )=(2 x2 1 y2 1 )). Again eliminate divisions using P 2 : only 3M + 4S. Much faster than addition. Useful: many doublings in ECC.
71 More addition strategies Dual addition formula: (x 1 ; y 1 ) + (x 2 ; y 2 ) = ((x 1 y 1 + x 2 y 2 )=(x 1 x 2 + y 1 y 2 ); (x 1 y 1 x 2 y 2 )=(x 1 y 2 x 2 y 1 )). Low degree, no need for d. Warning: fails for doubling! Is this really addition? Most EC formulas have failures.
72 More addition strategies Dual addition formula: (x 1 ; y 1 ) + (x 2 ; y 2 ) = ((x 1 y 1 + x 2 y 2 )=(x 1 x 2 + y 1 y 2 ); (x 1 y 1 x 2 y 2 )=(x 1 y 2 x 2 y 1 )). Low degree, no need for d. Warning: fails for doubling! Is this really addition? Most EC formulas have failures. More coordinate systems: Inverted: x = Z=X, y = Z=Y. Extended: x = X=Z, y = Y=T. Completed: x = X=Z, y = Y=Z, xy = T=Z.
73 More elliptic curves Edwards curves are elliptic. Easiest way to understand elliptic curves is Edwards. Geometrically, all elliptic curves are Edwards curves. Algebraically, more elliptic curves exist. Every odd-char curve can be expressed as Weierstrass curve v 2 = u 3 + a 2 u 2 + a 4 u + a 6. Warning: Weierstrass has different meaning in char 2.
74 Addition on Weierstrass curve v 2 = u 3 + u 2 + u + 1 v P1 + P 2 P 1 u P 2 (P 1 + P 2 ) Slope = (v 2 v 1 )=(u 2 u 1 ). Note that u 1 6= u 2.
75 Doubling on Weierstrass curve v 2 = u 3 u v P 1 2P 1 2P 1 u Slope = (3u 2 1 1)=(2v 1).
76 In most cases (u 1 ; v 1 ) + (u 2 ; v 2 ) = (u 3 ; v 3 ) where (u 3 ; v 3 ) = ( 2 u 1 u 2 ; (u 1 u 3 ) v 1 ): u 1 6= u 2, addition (alert!): = (v 2 v 1 )=(u 2 u 1 ). Total cost 1I + 2M + 1S. (u 1 ; v 1 ) = (u 2 ; v 2 ) and v 1 6= 0, doubling (alert!): = (3u a 2u 1 + a 4 )=(2v 1 ). Total cost 1I + 2M + 2S. Also handle some exceptions: (u 1 ; v 1 ) = (u 2 ; v 2 ); inputs at 1.
77 Birational equivalence Starting from point (x; y) on x 2 + y 2 = 1 + dx 2 y 2 : Define A = 2(1 + d)=(1 d), B = 4=(1 d); u = (1 + y)=(b(1 y)), v = u=x = (1 + y)=(bx(1 y)). (Skip a few exceptional points.) v 2 = u 3 + (A=B)u 2 + (1=B 2 )u. Maps Edwards to Weierstrass. Compatible with point addition! Easily invert this map: x = u=v, y = (Bu 1)=(Bu + 1).
78 Some history There are many perspectives on elliptic-curve computations (published 1987) Lenstra: ECM, the elliptic-curve method of factoring integers (published 1985) Miller, and independently 1984 (published 1987) Koblitz: Elliptic-curve cryptography. Bosma, Goldwasser Kilian, Chudnovsky Chudnovsky, Atkin: elliptic-curve primality proving.
79 The Edwards perspective is new! 1761 Euler, 1866 Gauss introduced an addition law for x 2 + y 2 = 1 x 2 y 2, the lemniscatic elliptic curve Edwards generalized to many curves x 2 +y 2 = 1+c 4 x 2 y 2. Theorem: have now obtained all elliptic curves over Q Bernstein Lange: Edwards addition law is complete for x 2 + y 2 = 1 + dx 2 y 2 if d 6= ; and gives new ECC speed records.
80 y 2 = x 3 0:4x + 0:7
81
82 x2 + y 2 = 1 300x2 y 2
83
84
85
86
87
88
Elliptic curves. Tanja Lange Technische Universiteit Eindhoven. with some slides by Daniel J. Bernstein
Elliptic curves Tanja Lange Technische Universiteit Eindhoven with some slides by Daniel J. Bernstein Diffie-Hellman key exchange Pick some generator. Diffie-Hellman key exchange Pick some generator. Diffie-Hellman
Tanja Lange Technische Universiteit Eindhoven
Crytanalysis Course Part I Tanja Lange Technische Universiteit Eindhoven 28 Nov 2016 with some slides by Daniel J. Bernstein Main goal of this course: We are the attackers. We want to break ECC and RSA.
ECDLP course. Daniel J. Bernstein University of Illinois at Chicago. Tanja Lange Technische Universiteit Eindhoven
ECDLP course Daniel J. Bernstein University of Illinois at Chicago Tanja Lange Technische Universiteit Eindhoven Main goal of this course: We are the attackers. We want to break ECC. Enemy: ECC users.
Daniel J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven. Tanja Lange Technische Universiteit Eindhoven
ECCHacks: a gentle introduction to elliptic-curve cryptography Daniel J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven Tanja Lange Technische Universiteit Eindhoven ecchacks.cr.yp.to
Lecture 1: Introduction to Public key cryptography
Lecture 1: Introduction to Public key cryptography Thomas Johansson T. Johansson (Lund University) 1 / 44 Key distribution Symmetric key cryptography: Alice and Bob share a common secret key. Some means
Public Key Cryptography
Public Key Cryptography Introduction Public Key Cryptography Unlike symmetric key, there is no need for Alice and Bob to share a common secret Alice can convey her public key to Bob in a public communication:
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Instructor: Michael Fischer Lecture by Ewa Syta Lecture 13 March 3, 2013 CPSC 467b, Lecture 13 1/52 Elliptic Curves Basics Elliptic Curve Cryptography CPSC
The Elliptic Curve in https
The Elliptic Curve in https Marco Streng Universiteit Leiden 25 November 2014 Marco Streng (Universiteit Leiden) The Elliptic Curve in https 25-11-2014 1 The s in https:// HyperText Transfer Protocol
CPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Security Michael J. Fischer 1 Lecture 13 October 16, 2017 (notes revised 10/23/17) 1 Derived from lecture notes by Ewa Syta. CPSC 467, Lecture 13 1/57 Elliptic Curves
Elliptic Curve Cryptography
Elliptic Curve Cryptography Elliptic Curves An elliptic curve is a cubic equation of the form: y + axy + by = x 3 + cx + dx + e where a, b, c, d and e are real numbers. A special addition operation is
Message Authentication Codes (MACs)
Message Authentication Codes (MACs) Tung Chou Technische Universiteit Eindhoven, The Netherlands October 8, 2015 1 / 22 About Me 2 / 22 About Me Tung Chou (Tony) 2 / 22 About Me Tung Chou (Tony) Ph.D.
Mathematics of Cryptography
UNIT - III Mathematics of Cryptography Part III: Primes and Related Congruence Equations 1 Objectives To introduce prime numbers and their applications in cryptography. To discuss some primality test algorithms
Addition laws on elliptic curves. D. J. Bernstein University of Illinois at Chicago. Joint work with: Tanja Lange Technische Universiteit Eindhoven
Addition laws on elliptic curves D. J. Bernstein University of Illinois at Chicago Joint work with: Tanja Lange Technische Universiteit Eindhoven 2007.01.10, 09:00 (yikes!), Leiden University, part of
1 Number Theory Basics
ECS 289M (Franklin), Winter 2010, Crypto Review 1 Number Theory Basics This section has some basic facts about number theory, mostly taken (or adapted) from Dan Boneh s number theory fact sheets for his
Hyperelliptic-curve cryptography. D. J. Bernstein University of Illinois at Chicago
Hyperelliptic-curve cryptography D. J. Bernstein University of Illinois at Chicago Thanks to: NSF DMS 0140542 NSF ITR 0716498 Alfred P. Sloan Foundation Two parts to this talk: 1. Elliptic curves; modern
8 Elliptic Curve Cryptography
8 Elliptic Curve Cryptography 8.1 Elliptic Curves over a Finite Field For the purposes of cryptography, we want to consider an elliptic curve defined over a finite field F p = Z/pZ for p a prime. Given
Elliptic Curve Cryptography
AIMS-VOLKSWAGEN STIFTUNG WORKSHOP ON INTRODUCTION TO COMPUTER ALGEBRA AND APPLICATIONS Douala, Cameroon, October 12, 2017 Elliptic Curve Cryptography presented by : BANSIMBA Gilda Rech BANSIMBA Gilda Rech
Public Key Algorithms
Public Key Algorithms Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-09/
Asymmetric Encryption
-3 s s Encryption Comp Sci 3600 Outline -3 s s 1-3 2 3 4 5 s s Outline -3 s s 1-3 2 3 4 5 s s Function Using Bitwise XOR -3 s s Key Properties for -3 s s The most important property of a hash function
Introduction to Public-Key Cryptosystems:
Introduction to Public-Key Cryptosystems: Technical Underpinnings: RSA and Primality Testing Modes of Encryption for RSA Digital Signatures for RSA 1 RSA Block Encryption / Decryption and Signing Each
One can use elliptic curves to factor integers, although probably not RSA moduli.
Elliptic Curves Elliptic curves are groups created by defining a binary operation (addition) on the points of the graph of certain polynomial equations in two variables. These groups have several properties
basics of security/cryptography
RSA Cryptography basics of security/cryptography Bob encrypts message M into ciphertext C=P(M) using a public key; Bob sends C to Alice Alice decrypts ciphertext back into M using a private key (secret)
Introduction to Elliptic Curve Cryptography. Anupam Datta
Introduction to Elliptic Curve Cryptography Anupam Datta 18-733 Elliptic Curve Cryptography Public Key Cryptosystem Duality between Elliptic Curve Cryptography and Discrete Log Based Cryptography Groups
Cryptography and Security Final Exam
Cryptography and Security Final Exam Serge Vaudenay 17.1.2017 duration: 3h no documents allowed, except one 2-sided sheet of handwritten notes a pocket calculator is allowed communication devices are not
Elliptic Curves and an Application in Cryptography
Parabola Volume 54, Issue 1 (2018) Elliptic Curves and an Application in Cryptography Jeremy Muskat 1 Abstract Communication is no longer private, but rather a publicly broadcast signal for the entire
Definition: For a positive integer n, if 0<a<n and gcd(a,n)=1, a is relatively prime to n. Ahmet Burak Can Hacettepe University
Number Theory, Public Key Cryptography, RSA Ahmet Burak Can Hacettepe University abc@hacettepe.edu.tr The Euler Phi Function For a positive integer n, if 0
1 Recommended Reading 1. 2 Public Key/Private Key Cryptography Overview RSA Algorithm... 2
Contents 1 Recommended Reading 1 2 Public Key/Private Key Cryptography 1 2.1 Overview............................................. 1 2.2 RSA Algorithm.......................................... 2 3 A Number
Overview. Background / Context. CSC 580 Cryptography and Computer Security. March 21, 2017
CSC 580 Cryptography and Computer Security Math for Public Key Crypto, RSA, and Diffie-Hellman (Sections 2.4-2.6, 2.8, 9.2, 10.1-10.2) March 21, 2017 Overview Today: Math needed for basic public-key crypto
Fundamentals of Modern Cryptography
Fundamentals of Modern Cryptography BRUCE MOMJIAN This presentation explains the fundamentals of modern cryptographic methods. Creative Commons Attribution License http://momjian.us/presentations Last
CIS 6930/4930 Computer and Network Security. Topic 5.2 Public Key Cryptography
CIS 6930/4930 Computer and Network Security Topic 5.2 Public Key Cryptography 1 Diffie-Hellman Key Exchange 2 Diffie-Hellman Protocol For negotiating a shared secret key using only public communication
ASYMMETRIC ENCRYPTION
ASYMMETRIC ENCRYPTION 1 / 1 Recommended Book Steven Levy. Crypto. Penguin books. 2001. A non-technical account of the history of public-key cryptography and the colorful characters involved. 2 / 1 Recall
Introduction to Cybersecurity Cryptography (Part 4)
Introduction to Cybersecurity Cryptography (Part 4) Review of Last Lecture Blockciphers Review of DES Attacks on Blockciphers Advanced Encryption Standard (AES) Modes of Operation MACs and Hashes Message
High-speed cryptography, part 3: more cryptosystems. Daniel J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven
High-speed cryptography, part 3: more cryptosystems Daniel J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven Cryptographers Working systems Cryptanalytic algorithm designers
Introduction to Cybersecurity Cryptography (Part 4)
Introduction to Cybersecurity Cryptography (Part 4) Review of Last Lecture Blockciphers Review of DES Attacks on Blockciphers Advanced Encryption Standard (AES) Modes of Operation MACs and Hashes Message
True & Deterministic Random Number Generators
True & Deterministic Random Number Generators Çetin Kaya Koç http://cs.ucsb.edu/~koc koc@cs.ucsb.edu 1.0 0.5 1.0 0.5 0.5 1.0 0.5 1.0 Koç (http://cs.ucsb.edu/~koc) HRL RNG April 11, 2013 1 / 47 Random Numbers
Slides by Kent Seamons and Tim van der Horst Last Updated: Oct 1, 2013
RSA Slides by Kent Seamons and Tim van der Horst Last Updated: Oct 1, 2013 Recap Recap Number theory o What is a prime number? o What is prime factorization? o What is a GCD? o What does relatively prime
Lecture Notes, Week 6
YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE CPSC 467b: Cryptography and Computer Security Week 6 (rev. 3) Professor M. J. Fischer February 15 & 17, 2005 1 RSA Security Lecture Notes, Week 6 Several
Edwards coordinates for elliptic curves, part 1
Edwards coordinates for elliptic curves, part 1 Tanja Lange Technische Universiteit Eindhoven tanja@hyperelliptic.org joint work with Daniel J. Bernstein 19.10.2007 Tanja Lange http://www.hyperelliptic.org/tanja/newelliptic/
Mathematical Foundations of Public-Key Cryptography
Mathematical Foundations of Public-Key Cryptography Adam C. Champion and Dong Xuan CSE 4471: Information Security Material based on (Stallings, 2006) and (Paar and Pelzl, 2010) Outline Review: Basic Mathematical
MATH 158 FINAL EXAM 20 DECEMBER 2016
MATH 158 FINAL EXAM 20 DECEMBER 2016 Name : The exam is double-sided. Make sure to read both sides of each page. The time limit is three hours. No calculators are permitted. You are permitted one page
Digital Signatures. Adam O Neill based on
Digital Signatures Adam O Neill based on http://cseweb.ucsd.edu/~mihir/cse207/ Signing by hand COSMO ALICE ALICE Pay Bob $100 Cosmo Alice Alice Bank =? no Don t yes pay Bob Signing electronically SIGFILE
Public Key 9/17/2018. Symmetric Cryptography Review. Symmetric Cryptography: Shortcomings (1) Symmetric Cryptography: Analogy
Symmetric Cryptography Review Alice Bob Public Key x e K (x) y d K (y) x K K Instructor: Dr. Wei (Lisa) Li Department of Computer Science, GSU Two properties of symmetric (secret-key) crypto-systems: The
Public Key Cryptography. All secret key algorithms & hash algorithms do the same thing but public key algorithms look very different from each other.
Public Key Cryptography All secret key algorithms & hash algorithms do the same thing but public key algorithms look very different from each other. The thing that is common among all of them is that each
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 11 February 21, 2013 CPSC 467b, Lecture 11 1/27 Discrete Logarithm Diffie-Hellman Key Exchange ElGamal Key Agreement Primitive Roots
Cryptography IV: Asymmetric Ciphers
Cryptography IV: Asymmetric Ciphers Computer Security Lecture 7 David Aspinall School of Informatics University of Edinburgh 31st January 2011 Outline Background RSA Diffie-Hellman ElGamal Summary Outline
Signatures and DLP-I. Tanja Lange Technische Universiteit Eindhoven
Signatures and DLP-I Tanja Lange Technische Universiteit Eindhoven How to compute ap Use binary representation of a to compute a(x; Y ) in blog 2 ac doublings and at most that many additions. E.g. a =
Elliptic Curves I. The first three sections introduce and explain the properties of elliptic curves.
Elliptic Curves I 1.0 Introduction The first three sections introduce and explain the properties of elliptic curves. A background understanding of abstract algebra is required, much of which can be found
Introduction to Modern Cryptography. Benny Chor
Introduction to Modern Cryptography Benny Chor RSA: Review and Properties Factoring Algorithms Trapdoor One Way Functions PKC Based on Discrete Logs (Elgamal) Signature Schemes Lecture 8 Tel-Aviv University
Cryptographical Security in the Quantum Random Oracle Model
Cryptographical Security in the Quantum Random Oracle Model Center for Advanced Security Research Darmstadt (CASED) - TU Darmstadt, Germany June, 21st, 2012 This work is licensed under a Creative Commons
HILA5 Pindakaas: On the CCA security of lattice-based encryption with error correction
HILA5 Pindakaas: On the CCA security of lattice-based encryption with error correction Daniel J. Bernstein 1 Leon Groot Bruinderink 2 Tanja Lange 2 Lorenz Panny 2 1 University of Illinois at Chicago 2
Introduction to Modern Cryptography. Benny Chor
Introduction to Modern Cryptography Benny Chor RSA Public Key Encryption Factoring Algorithms Lecture 7 Tel-Aviv University Revised March 1st, 2008 Reminder: The Prime Number Theorem Let π(x) denote the
CRYPTOGRAPHY AND NUMBER THEORY
CRYPTOGRAPHY AND NUMBER THEORY XINYU SHI Abstract. In this paper, we will discuss a few examples of cryptographic systems, categorized into two different types: symmetric and asymmetric cryptography. We
CS 4770: Cryptography. CS 6750: Cryptography and Communication Security. Alina Oprea Associate Professor, CCIS Northeastern University
CS 4770: Cryptography CS 6750: Cryptography and Communication Security Alina Oprea Associate Professor, CCIS Northeastern University March 26 2017 Outline RSA encryption in practice Transform RSA trapdoor
Digital Signatures. Saravanan Vijayakumaran Department of Electrical Engineering Indian Institute of Technology Bombay
Digital Signatures Saravanan Vijayakumaran sarva@ee.iitb.ac.in Department of Electrical Engineering Indian Institute of Technology Bombay July 24, 2018 1 / 29 Group Theory Recap Groups Definition A set
5199/IOC5063 Theory of Cryptology, 2014 Fall
5199/IOC5063 Theory of Cryptology, 2014 Fall Homework 2 Reference Solution 1. This is about the RSA common modulus problem. Consider that two users A and B use the same modulus n = 146171 for the RSA encryption.
Polynomial Interpolation in the Elliptic Curve Cryptosystem
Journal of Mathematics and Statistics 7 (4): 326-331, 2011 ISSN 1549-3644 2011 Science Publications Polynomial Interpolation in the Elliptic Curve Cryptosystem Liew Khang Jie and Hailiza Kamarulhaili School
Week : Public Key Cryptosystem and Digital Signatures
Week 10-11 : Public Key Cryptosystem and Digital Signatures 1. Public Key Encryptions RSA, ElGamal, 2 RSA- PKC(1/3) 1st public key cryptosystem R.L.Rivest, A.Shamir, L.Adleman, A Method for Obtaining Digital
10 Concrete candidates for public key crypto
10 Concrete candidates for public key crypto In the previous lecture we talked about public key cryptography and saw the Diffie Hellman system and the DSA signature scheme. In this lecture, we will see
L7. Diffie-Hellman (Key Exchange) Protocol. Rocky K. C. Chang, 5 March 2015
L7. Diffie-Hellman (Key Exchange) Protocol Rocky K. C. Chang, 5 March 2015 1 Outline The basic foundation: multiplicative group modulo prime The basic Diffie-Hellman (DH) protocol The discrete logarithm
Chapter 8 Public-key Cryptography and Digital Signatures
Chapter 8 Public-key Cryptography and Digital Signatures v 1. Introduction to Public-key Cryptography 2. Example of Public-key Algorithm: Diffie- Hellman Key Exchange Scheme 3. RSA Encryption and Digital
Introduction to Elliptic Curve Cryptography
Indian Statistical Institute Kolkata May 19, 2017 ElGamal Public Key Cryptosystem, 1984 Key Generation: 1 Choose a suitable large prime p 2 Choose a generator g of the cyclic group IZ p 3 Choose a cyclic
CPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Security Michael J. Fischer Lecture 11 October 7, 2015 CPSC 467, Lecture 11 1/37 Digital Signature Algorithms Signatures from commutative cryptosystems Signatures from
Discrete logarithm and related schemes
Discrete logarithm and related schemes Martin Stanek Department of Computer Science Comenius University stanek@dcs.fmph.uniba.sk Cryptology 1 (2017/18) Content Discrete logarithm problem examples, equivalent
Introduction to Cybersecurity Cryptography (Part 5)
Introduction to Cybersecurity Cryptography (Part 5) Prof. Dr. Michael Backes 13.01.2017 February 17 th Special Lecture! 45 Minutes Your Choice 1. Automotive Security 2. Smartphone Security 3. Side Channel
Exam Security January 19, :30 11:30
Exam Security January 19, 2016. 8:30 11:30 You can score a maximum of 100. Each question indicates how many it is worth. You are NOT allowed to use books or notes, or a (smart) phone. You may answer in
Winter 2011 Josh Benaloh Brian LaMacchia
Winter 2011 Josh Benaloh Brian LaMacchia Fun with Public-Key Tonight we ll Introduce some basic tools of public-key crypto Combine the tools to create more powerful tools Lay the ground work for substantial
CPSC 467b: Cryptography and Computer Security
Outline Quadratic residues Useful tests Digital Signatures CPSC 467b: Cryptography and Computer Security Lecture 14 Michael J. Fischer Department of Computer Science Yale University March 1, 2010 Michael
Information Security
SE 4472 / ECE 9064 Information Security Week 12: Random Number Generators and Picking Appropriate Key Lengths Fall 2015 Prof. Aleksander Essex Random Number Generation Where do keys come from? So far we
Elliptic Curve Cryptography
Areas for Discussion Elliptic Curve Cryptography Joseph Spring Department of Computer Science 7COM1027 - Distributed Systems Security Lecture - Elliptic Curves 1 1 Motivation Elliptic Curves Security of
Signatures and DLP. Tanja Lange Technische Universiteit Eindhoven. with some slides by Daniel J. Bernstein
Signatures and DLP Tanja Lange Technische Universiteit Eindhoven with some slides by Daniel J. Bernstein ECDSA Users can sign messages using Edwards curves. Take a point P on an Edwards curve modulo a
Public-Key Cryptosystems CHAPTER 4
Public-Key Cryptosystems CHAPTER 4 Introduction How to distribute the cryptographic keys? Naïve Solution Naïve Solution Give every user P i a separate random key K ij to communicate with every P j. Disadvantage:
10 Public Key Cryptography : RSA
10 Public Key Cryptography : RSA 10.1 Introduction The idea behind a public-key system is that it might be possible to find a cryptosystem where it is computationally infeasible to determine d K even if
Security Issues in Cloud Computing Modern Cryptography II Asymmetric Cryptography
Security Issues in Cloud Computing Modern Cryptography II Asymmetric Cryptography Peter Schwabe October 21 and 28, 2011 So far we assumed that Alice and Bob both have some key, which nobody else has. How
DATA PRIVACY AND SECURITY
DATA PRIVACY AND SECURITY Instructor: Daniele Venturi Master Degree in Data Science Sapienza University of Rome Academic Year 2018-2019 Interlude: Number Theory Cubum autem in duos cubos, aut quadratoquadratum
Post-quantum security models for authenticated encryption
Post-quantum security models for authenticated encryption Vladimir Soukharev David R. Cheriton School of Computer Science February 24, 2016 Introduction Bellare and Namprempre in 2008, have shown that
SIGNATURE SCHEMES & CRYPTOGRAPHIC HASH FUNCTIONS. CIS 400/628 Spring 2005 Introduction to Cryptography
SIGNATURE SCHEMES & CRYPTOGRAPHIC HASH FUNCTIONS CIS 400/628 Spring 2005 Introduction to Cryptography This is based on Chapter 8 of Trappe and Washington DIGITAL SIGNATURES message sig 1. How do we bind
Question: Total Points: Score:
University of California, Irvine COMPSCI 134: Elements of Cryptography and Computer and Network Security Midterm Exam (Fall 2016) Duration: 90 minutes November 2, 2016, 7pm-8:30pm Name (First, Last): Please
Lecture V : Public Key Cryptography
Lecture V : Public Key Cryptography Internet Security: Principles & Practices John K. Zao, PhD (Harvard) SMIEEE Amir Rezapoor Computer Science Department, National Chiao Tung University 2 Outline Functional
RSA RSA public key cryptosystem
RSA 1 RSA As we have seen, the security of most cipher systems rests on the users keeping secret a special key, for anyone possessing the key can encrypt and/or decrypt the messages sent between them.
Elliptic Curves Cryptography and factorization. Part VIII. Elliptic curves cryptography and factorization. Historical Remarks.
Elliptic Curves Cryptography and factorization Part VIII Elliptic curves cryptography and factorization Cryptography based on manipulation of points of so called elliptic curves is getting momentum and
Other Public-Key Cryptosystems
Other Public-Key Cryptosystems Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-11/
Chapter 10 Elliptic Curves in Cryptography
Chapter 10 Elliptic Curves in Cryptography February 15, 2010 10 Elliptic Curves (ECs) can be used as an alternative to modular arithmetic in all applications based on the Discrete Logarithm (DL) problem.
ENEE 457: Computer Systems Security 10/3/16. Lecture 9 RSA Encryption and Diffie-Helmann Key Exchange
ENEE 457: Computer Systems Security 10/3/16 Lecture 9 RSA Encryption and Diffie-Helmann Key Exchange Charalampos (Babis) Papamanthou Department of Electrical and Computer Engineering University of Maryland,
CSCI3390-Lecture 16: Probabilistic Algorithms: Number Theory and Cryptography
CSCI3390-Lecture 16: Probabilistic Algorithms: Number Theory and Cryptography 1 Two Problems Problem 1. Generate Primes Find a prime number p of between 200 and 1000 decimal digits that has never been
Course 2BA1: Trinity 2006 Section 9: Introduction to Number Theory and Cryptography
Course 2BA1: Trinity 2006 Section 9: Introduction to Number Theory and Cryptography David R. Wilkins Copyright c David R. Wilkins 2006 Contents 9 Introduction to Number Theory and Cryptography 1 9.1 Subgroups
Public-key Cryptography and elliptic curves
Public-key Cryptography and elliptic curves Dan Nichols nichols@math.umass.edu University of Massachusetts Oct. 14, 2015 Cryptography basics Cryptography is the study of secure communications. Here are
1 What are Physical Attacks. 2 Physical Attacks on RSA. Today:
Today: Introduction to the class. Examples of concrete physical attacks on RSA A computational approach to cryptography Pseudorandomness 1 What are Physical Attacks Tampering/Leakage attacks Issue of how
ECE596C: Handout #11
ECE596C: Handout #11 Public Key Cryptosystems Electrical and Computer Engineering, University of Arizona, Loukas Lazos Abstract In this lecture we introduce necessary mathematical background for studying
CIS 551 / TCOM 401 Computer and Network Security
CIS 551 / TCOM 401 Computer and Network Security Spring 2008 Lecture 15 3/20/08 CIS/TCOM 551 1 Announcements Project 3 available on the web. Get the handout in class today. Project 3 is due April 4th It
The RSA public encryption scheme: How I learned to stop worrying and love buying stuff online
The RSA public encryption scheme: How I learned to stop worrying and love buying stuff online Anthony Várilly-Alvarado Rice University Mathematics Leadership Institute, June 2010 Our Goal Today I will
CPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Security Michael J. Fischer Lecture 19 November 8, 2017 CPSC 467, Lecture 19 1/37 Zero Knowledge Interactive Proofs (ZKIP) ZKIP for graph isomorphism Feige-Fiat-Shamir
CPE 776:DATA SECURITY & CRYPTOGRAPHY. Some Number Theory and Classical Crypto Systems
CPE 776:DATA SECURITY & CRYPTOGRAPHY Some Number Theory and Classical Crypto Systems Dr. Lo ai Tawalbeh Computer Engineering Department Jordan University of Science and Technology Jordan Some Number Theory
Course MA2C02, Hilary Term 2013 Section 9: Introduction to Number Theory and Cryptography
Course MA2C02, Hilary Term 2013 Section 9: Introduction to Number Theory and Cryptography David R. Wilkins Copyright c David R. Wilkins 2000 2013 Contents 9 Introduction to Number Theory 63 9.1 Subgroups
Linear Congruences. The equation ax = b for a, b R is uniquely solvable if a 0: x = b/a. Want to extend to the linear congruence:
Linear Congruences The equation ax = b for a, b R is uniquely solvable if a 0: x = b/a. Want to extend to the linear congruence: ax b (mod m), a, b Z, m N +. (1) If x 0 is a solution then so is x k :=
Theme : Cryptography. Instructor : Prof. C Pandu Rangan. Speaker : Arun Moorthy CS
1 C Theme : Cryptography Instructor : Prof. C Pandu Rangan Speaker : Arun Moorthy 93115 CS 2 RSA Cryptosystem Outline of the Talk! Introduction to RSA! Working of the RSA system and associated terminology!
CONTINUED FRACTIONS, PELL S EQUATION, AND TRANSCENDENTAL NUMBERS
CONTINUED FRACTIONS, PELL S EQUATION, AND TRANSCENDENTAL NUMBERS JEREMY BOOHER Continued fractions usually get short-changed at PROMYS, but they are interesting in their own right and useful in other areas
YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE
YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE CPSC 467a: Cryptography and Computer Security Notes 13 (rev. 2) Professor M. J. Fischer October 22, 2008 53 Chinese Remainder Theorem Lecture Notes 13 We
Lecture 19: Public-key Cryptography (Diffie-Hellman Key Exchange & ElGamal Encryption) Public-key Cryptography
Lecture 19: (Diffie-Hellman Key Exchange & ElGamal Encryption) Recall In private-key cryptography the secret-key sk is always established ahead of time The secrecy of the private-key cryptography relies
Carmen s Core Concepts (Math 135)
Carmen s Core Concepts (Math 135) Carmen Bruni University of Waterloo Week 8 1 The following are equivalent (TFAE) 2 Inverses 3 More on Multiplicative Inverses 4 Linear Congruence Theorem 2 [LCT2] 5 Fermat
TECHNISCHE UNIVERSITEIT EINDHOVEN Faculty of Mathematics and Computer Science Exam Cryptology, Friday 25 January 2019
Faculty of Mathematics and Computer Science Exam Cryptology, Friday 25 January 2019 Name : TU/e student number : Exercise 1 2 3 4 5 total points Notes: Please hand in all sheets at the end of the exam.