Introduction to Cybersecurity Cryptography (Part 5)

Size: px
Start display at page:

Download "Introduction to Cybersecurity Cryptography (Part 5)"

Transcription

1 Introduction to Cybersecurity Cryptography (Part 5) Prof. Dr. Michael Backes

2 February 17 th Special Lecture! 45 Minutes Your Choice 1. Automotive Security 2. Smartphone Security 3. Side Channel Attacks February 10 th : Practice Exam 3 Hours (offered by your tutors) 45 Minutes Exam Preparation Questions and answers session The questions may cover the whole lecture Prepare questions for February 17 th! Foundations of Cybersecurity

3 Review: Public-key Encryption Now public-key encryption schemes (K,E,D): m E c:= E(pk,m) c m D pk K sk Legend Randomized Stateful Deterministic Foundations of Cybersecurity

4 Review: Modular Arithmetic Examples: let N = = 5 in Z = 11 in Z = 10 in Z 12 Arithmetic in Z N works as you expect, e.g. x y + z = x y + x z in Z N. Foundations of Cybersecurity

5 Review: Greatest Common Divisor (GCD) Definition: GCD For integers x, y we define gcd x, y is the greatest common divisor of x, y. Example: gcd 12, 18 = 6 Fact: GCD For all integers x, y there exist integers a, b such that a x + b y = gcd x, y a, b can be found efficiently using the extended Euclidean algorithm. If gcd x, y = 1 we say that x and y are relatively prime. Foundations of Cybersecurity

6 Review: Modular Inversion Over rationals, inverse of 2 is 1 2. What about Z N? Definition: Inverse The inverse of x in Z N is an element y in Z N such that x y = 1 in Z N. y is denoted by x 1. Lemma: x in Z N has an inverse if and only if gcd(x, N) = 1 Definition: Set of invertible Elements in Z N Z N { x Z N gcd x, N = 1} Foundations of Cybersecurity

7 Review: Easy problems Given composite N and x in Z N find x 1 in Z N. Given prime p and polynomial f x find x in Z p s.t. f x = 0 in Z p Running time is linear in deg f. (if one exists) but many problems are difficult. Foundations of Cybersecurity

8 Review: Intractable problems with primes discrete logarithm Fix a prime p > 2 and g in Z p of order q. Consider the function x g x in Z p Now, consider the inverse function: Dlog g g x = x where x {0,, q 2} Example: in : 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 Dlog 2 ( ) : 0, 1, 8, 2, 4, 9, 7, 3, 6, 5 Foundations of Cybersecurity

9 Review: ElGamal Encryption System (1984) Key Generation K(n) for security parameter n Pick random n-bit prime p Pick random generator g for Z p } Can be publicly known Pick random x {1,, p 1} Set pk = (p, g, h: = g x ) Set sk = (p, g, x) Output (pk, sk) Foundations of Cybersecurity

10 Review: ElGamal Encryption System (1984) Encryption Enc(pk, m); pk = (p, g, h), m Z p Pick random y {1,, p 1} Set i = g y, k = h y Set c: = (i, m k) Output c Decryption Dec sk, c ; sk = (p, g, x) and c = (A, B) Set d = B A x Output d Correctness: El-Gamal B A x = B g y x = B g x y = B h y = (m hy) h y = m Foundations of Cybersecurity

11 Problem of information secrecy solved? We need alternative schemes based on different assumptions! RSA based ciphers (origin in 1977) Foundations of Cybersecurity

12 Lecture Summary RSA Number Theory for RSA RSA-based Encryption Wiener s Attack RSA Improvements Digital Signatures Basic Definitions RSA-based Signatures Attacks Foundations of Cybersecurity

13 Number Theory Basics for RSA based Encryption Schemes

14 Assumption: Factorization For two prime numbers p, q it is easy to compute N = p q. But given N it is hard to computer p and q. Can we use this to construct Encryption / Decryption? Foundations of Cybersecurity

15 Euler s generalization of Fermat (1736) Definition: Euler s φ Function For N N we define φ N Z N Examples: φ 12 = 1,5,7,11 = 4; φ p = p 1 For N = p q: φ N = N p q + 1 = (p 1)(q 1) Theorem: Euler s Theorem For x Z N it holds that x φ N = 1 mod N. Example: 5 φ 12 = 5 4 = 625 = 1 in Z 12 Generalization of Fermat. Basis of the RSA cryptosystem. Foundations of Cybersecurity

16 Modular e th roots We know how to solve modular linear equations: a x + b = 0 in Z N Solution: x = b a 1 in Z N What about higher degree polynomials? Example: let p be a prime and c Z p. Can we solve: in Z p x 2 c = 0 y 3 c = 0 z 37 c = 0 Foundations of Cybersecurity

17 Modular e th roots Definition: e th root Let p be a prime and c Z p. x Z p such that x e = c in Z p is called the e th root of c. Examples: 7 1/3 = 6 in Z /2 = 5 in Z does not exist in Z /3 = 1 in Z 11 Foundations of Cybersecurity

18 The easy case When does c 1/e in Z p exist? Can we compute it efficiently? Lemma: The easy case Suppose gcd e, p 1 = 1. Then for all c Z p : c 1/e exists in Z p and is easy to find. Proof: on the blackboard Foundations of Cybersecurity

19 The case e=2: square roots If p is an odd prime then gcd 2, p 1 1 x x 2 x Fact: in Z p, x x 2 is a 2-to-1 function. Example: in Z Definition: Quadratic residue x in Z p is a quadratic residue (Q.R.) if it has a square root in Z p. If p is an odd prime, then the number of Q.R. in Z p is p Foundations of Cybersecurity

20 Euler s theorem for an odd prime p Theorem: x Z p is a Q.R. x (p 1)/2 = 1 in Z p. Example: in Z 11 : 1 5, 2 5, 3 5, 4 5, 5 5, 6 5, 7 5, 8 5, 9 5, 10 5 = , -1, -1, -1, 1, -1 Note: x 0 x (p 1)/2 = x p = 1 1/2 {1, 1} in Z p Definition: Legendre Symbol x (p 1)/2 is called the Legendre Symbol of x over p. Foundations of Cybersecurity

21 Computing square roots modulo p Suppose: p = 3 mod 4 Lemma: if c Z p is Q.R. then c = c (p+1)/4 in Z p. Proof: on the blackboard When p = 1 (mod 4), the computation can also be done efficiently, but a bit harder: runt time O(log 3 p) Foundations of Cybersecurity

22 Solving quadratic equations mod p Solve: a x 2 + b x + c = 0 in Z p Solution: x = b ± b 2 4 a c /2a in Z p Find 2a 1 using extended Euclid. Find square root of b 2 4 a c in Z p (if one exists) using a square root algorithm. Foundations of Cybersecurity

23 Computing e th roots mod N?? Let N be a composite number and e > 1 When does c 1/e in Z N exist? Can we compute it efficiently? Answering these questions requires the factorization of N. (as far as we know) Foundations of Cybersecurity

24 Intractable problems with composites Consider the set of integers: Z 2 n {N = p q where p, q are n-bit primes } Problem 1: Factorize a random N in Z 2 n (e.g. for n = 1024) Problem 2: Given a polynomial f(x) where deg f > 1 and a random N in Z 2 n. Find x in Z N such that f x = 0 in Z N. Foundations of Cybersecurity

25 The factoring problem Gauss (1805): The problem of distinguishing prime numbers from composite numbers and of resolving the latter into their prime factors is known to be one of the most important and useful in arithmetic. Best known algorithm (NFS): run time exp(o 3 n ) for n-bit integer Current world record: RSA-768 (232 digits) Work: two years on hundreds of machines Factoring a 1024-bit integer: about 1000 times harder likely possible this decade Foundations of Cybersecurity

26 RSA based Encryption Schemes

27 RSA Trapdoor Permutation Key Generation K(n) for security parameter n Pick two random n-bit primes p, q Set N = p q. } Can NOT be publicly known Typically, n = 1024 or 2048 Choose an arbitrary value e with gcd e, φ(n) = 1 } No need for randomness, but choose carefully! φ N : #invertible elements in Z N Set d e 1 mod φ N pk N, e sk (p, q, d) Output (pk, sk) Foundations of Cybersecurity

28 Naïve Use of RSA as an Encryption Scheme Encryption Enc(pk, m); pk = (N, e), m Z N Compute c m e mod N. Decryption Dec(sk, c); sk = (p, q, d) Compute m c d mod N. Output c Output m Problem: Not even secure against passive attacks! Deterministic! m = m Enc(pk, m) = Enc(pk, m ). Not CPA secure! Moreover, Jacobi symbol of m can be computed from Enc(pk, m)! Foundations of Cybersecurity

29 RSA is correct Lemma: RSA Correctness For N, e, d as constructed in the RSA Definition and for arbitrary m Z, it holds: m ed m mod N Foundations of Cybersecurity

30 Chinese Remainder Theorem Theorem: Chinese Remainder Theorem (CRT) for N = pq: Let p q be primes and N = pq. Then for all a, b Z: a = b mod N a = b mod p and a = b mod q It holds as well if p and q relatively prime. Foundations of Cybersecurity

31 RSA is correct Lemma: RSA Correctness For N, e, d as constructed in the RSA Definition and for arbitrary m Z, it holds: Proof. It is sufficient to show m ed m mod p and m ed m mod q (Chinese Remainder Theorem). For symmetry reasons, we only show this for p If m = 0 mod p, then m ed = 0 ed 0 mod p If m 0 mod p, then m Z p. - Since ed 1 mod φ(n), there is a k s.t. ed = k p 1 q Thus we obtain m ed m mod N m ed = m 1+k p 1 q 1 = m m p 1 k q 1 m 1 k q 1 m mod p Foundations of Cybersecurity

32 Improving RSA s performance Idee: Speeding up RSA encryption Use small values of e: fast function evaluation fast encryption Minimum: Minimal possible value: e = 3 (2 does not work since gcd(2,φ(n))=2 ) Be careful: sending the same message encrypted with 3 different public keys then breaks naïve RSA! Recommended value: e = = Runtime for encryption: 17 modular multiplications. Runtime of RSA: fast encryption/slow decryption Time: ElGamal Enc Dec Foundations of Cybersecurity

33 Improving RSA s performance Idea (Bad): Use small values of d to speed up decryption Fact: Cannot make d small and still stay secure!! Wiener 89: Suppose d < 1 3 N0.25 Then given N, e, it s easy to recover d. Boneh, Durfee, Frankel 98: Suppose d < N Then given N, e, it s easy to recover d. Open Problem: Recover d when d < N 0.5. Foundations of Cybersecurity

34 Wiener s Attack (Sketch) Recall: e d = 1 (mod φ(n) ) - k Z: e d = k φ N + 1 Thus e φ N k d 1 d φ(n) φ(n) = N p q + 1, hence N φ N p + q 3N 0.5 If d < 1 3 N0.25, the following holds:. e N k d 1 3d 2 Foundations of Cybersecurity

35 Continued Fraction Expansion Continued fraction expansion of a fraction of a b [q 1,, q m ] of non-negative integers such that is a tuple a b q 1 q 2 q 3 q q q m Continued fraction expansion q of a with gcd(a, b) = 1 can be efficiently b computed using the extended Euclidian algorithm: q = [q 1,, q m ] where the q i s are the quotients of the extended Euclidian algorithm. Foundations of Cybersecurity

36 Extended Euclidian Algorithm An example for a = 53, b = 30 : (1,0) -1 (0,1) (1,-1) -1 (0,1) (1,-1) -3 (-1,2) (4,-7) -3 (-1,2) (4,-7) -2 (-13,23) 0 1 (30,-53) (-13,23) Thus 30/53 = [0,1,1,3,3,2] Foundations of Cybersecurity

37 Continued Fraction Expansion Let q = [q 1,, q m ] be a continued fraction expansion.then the j-th prefix [q 1,, q j ] of q is called the j-th convergent of q. j th convergent easily computable from j-th convergents for j < i. Theorem: Continued Fractions If gcd(a,b) = gcd(c,d) = 1, and a c 1 b d 2d 2 then c is one of the convergents of the continued fraction expansion of a. d b Foundations of Cybersecurity

38 Wiener s Attack Back to Wiener s attack. We have e N k d 1 3d 2 Continued Fraction theorem implies that k d is one of the convergents of e N (which is publicly known) Remark: Continued fraction expansion polynomial in size of N - So, it is efficient to test all convergents. Final question: Which one to take? Foundations of Cybersecurity

39 Wiener s Attack If x y is a convergent of e N, we get two equations if x y = k d : 1. e y = x φ(n) N = p q Two equations in two variables (p, q). - Check if solutions over the naturals exist! Correct solution can be found like this. Foundations of Cybersecurity

40 Wiener s Attack: Example Suppose N = and e = Continued fraction expansion of e N is - [0,2,1,1,1,4,12,102,1,1,2,3,2,2,36] First convergents are - 0, 1 2, 1 3, 2 5, 3 8, For 14, we obtain = 14 φ(n) N = p q Solving equations yields p = 12347, q = And indeed p q = N. Thus d = 37 (!) Foundations of Cybersecurity

41 Towards Good RSA encryption Naïve RSA insecure How to do it correctly: m Preprocessing RSA ciphertext Main Question: How should the preprocessing be done? Can we argue about security of resulting system? Foundations of Cybersecurity

42 PKCS1 V2.1 OAEP (Optimal asymmetric encryption padding) New PKCS1: V2.1, 2002 New preprocessing function: OAEP by Bellare, Rogaway 94. m r G H Input to trapdoor permutation {0,1} n Foundations of Cybersecurity

43 On (in-)secure Implementations Decrypt(C) error = 0 error = 1; exit; error = 1; exit; true true If(RSA 1 (C) > 2 n 1) If(pad(RSA 1 (C)) not correct ) false false Problem: Timing If timing information leaks type of error, then Attacker can decrypt any ciphertext c Foundations of Cybersecurity

44 Recommended Key Lengths NIST (National Institute of Standards and Technology) Year Minimum of Strength Public key length bits 1024 bits bits 2048 bits > bits 3072 bits >> bits 7680 bits See also Foundations of Cybersecurity

45 Lecture Summary RSA Number Theory for RSA RSA-based Encryption Wiener s Attack RSA Improvements Digital Signatures Basic Definitions RSA-based Signatures Attacks Foundations of Cybersecurity

Introduction to Cybersecurity Cryptography (Part 4)

Introduction to Cybersecurity Cryptography (Part 4) Introduction to Cybersecurity Cryptography (Part 4) Review of Last Lecture Blockciphers Review of DES Attacks on Blockciphers Advanced Encryption Standard (AES) Modes of Operation MACs and Hashes Message

More information

Introduction to Cybersecurity Cryptography (Part 4)

Introduction to Cybersecurity Cryptography (Part 4) Introduction to Cybersecurity Cryptography (Part 4) Review of Last Lecture Blockciphers Review of DES Attacks on Blockciphers Advanced Encryption Standard (AES) Modes of Operation MACs and Hashes Message

More information

COMP4109 : Applied Cryptography

COMP4109 : Applied Cryptography COMP409 : Applied Cryptography Fall 203 M. Jason Hinek Carleton University Applied Cryptography Day 3 public-key encryption schemes some attacks on RSA factoring small private exponent 2 RSA cryptosystem

More information

Mathematics of Cryptography

Mathematics of Cryptography UNIT - III Mathematics of Cryptography Part III: Primes and Related Congruence Equations 1 Objectives To introduce prime numbers and their applications in cryptography. To discuss some primality test algorithms

More information

ENEE 457: Computer Systems Security 10/3/16. Lecture 9 RSA Encryption and Diffie-Helmann Key Exchange

ENEE 457: Computer Systems Security 10/3/16. Lecture 9 RSA Encryption and Diffie-Helmann Key Exchange ENEE 457: Computer Systems Security 10/3/16 Lecture 9 RSA Encryption and Diffie-Helmann Key Exchange Charalampos (Babis) Papamanthou Department of Electrical and Computer Engineering University of Maryland,

More information

CS 4770: Cryptography. CS 6750: Cryptography and Communication Security. Alina Oprea Associate Professor, CCIS Northeastern University

CS 4770: Cryptography. CS 6750: Cryptography and Communication Security. Alina Oprea Associate Professor, CCIS Northeastern University CS 4770: Cryptography CS 6750: Cryptography and Communication Security Alina Oprea Associate Professor, CCIS Northeastern University March 15 2018 Review Hash functions Collision resistance Merkle-Damgaard

More information

Introduction to Cryptography. Lecture 8

Introduction to Cryptography. Lecture 8 Introduction to Cryptography Lecture 8 Benny Pinkas page 1 1 Groups we will use Multiplication modulo a prime number p (G, ) = ({1,2,,p-1}, ) E.g., Z 7* = ( {1,2,3,4,5,6}, ) Z p * Z N * Multiplication

More information

Number Theory. CSS322: Security and Cryptography. Sirindhorn International Institute of Technology Thammasat University CSS322. Number Theory.

Number Theory. CSS322: Security and Cryptography. Sirindhorn International Institute of Technology Thammasat University CSS322. Number Theory. CSS322: Security and Cryptography Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 29 December 2011 CSS322Y11S2L06, Steve/Courses/2011/S2/CSS322/Lectures/number.tex,

More information

CIS 551 / TCOM 401 Computer and Network Security

CIS 551 / TCOM 401 Computer and Network Security CIS 551 / TCOM 401 Computer and Network Security Spring 2008 Lecture 15 3/20/08 CIS/TCOM 551 1 Announcements Project 3 available on the web. Get the handout in class today. Project 3 is due April 4th It

More information

Algorithmic Number Theory and Public-key Cryptography

Algorithmic Number Theory and Public-key Cryptography Algorithmic Number Theory and Public-key Cryptography Course 3 University of Luxembourg March 22, 2018 The RSA algorithm The RSA algorithm is the most widely-used public-key encryption algorithm Invented

More information

Chapter 8 Public-key Cryptography and Digital Signatures

Chapter 8 Public-key Cryptography and Digital Signatures Chapter 8 Public-key Cryptography and Digital Signatures v 1. Introduction to Public-key Cryptography 2. Example of Public-key Algorithm: Diffie- Hellman Key Exchange Scheme 3. RSA Encryption and Digital

More information

Cryptography. Course 1: Remainder: RSA. Jean-Sébastien Coron. September 21, Université du Luxembourg

Cryptography. Course 1: Remainder: RSA. Jean-Sébastien Coron. September 21, Université du Luxembourg Course 1: Remainder: RSA Université du Luxembourg September 21, 2010 Public-key encryption Public-key encryption: two keys. One key is made public and used to encrypt. The other key is kept private and

More information

Public Key Cryptography

Public Key Cryptography Public Key Cryptography Ali El Kaafarani 1 Mathematical Institute 2 PQShield Ltd. 1 of 44 Outline 1 Public Key Encryption: security notions 2 RSA Encryption Scheme 2 of 44 Course main reference 3 of 44

More information

Chapter 11 : Private-Key Encryption

Chapter 11 : Private-Key Encryption COMP547 Claude Crépeau INTRODUCTION TO MODERN CRYPTOGRAPHY _ Second Edition _ Jonathan Katz Yehuda Lindell Chapter 11 : Private-Key Encryption 1 Chapter 11 Public-Key Encryption Apologies: all numbering

More information

CS 4770: Cryptography. CS 6750: Cryptography and Communication Security. Alina Oprea Associate Professor, CCIS Northeastern University

CS 4770: Cryptography. CS 6750: Cryptography and Communication Security. Alina Oprea Associate Professor, CCIS Northeastern University CS 4770: Cryptography CS 6750: Cryptography and Communication Security Alina Oprea Associate Professor, CCIS Northeastern University March 26 2017 Outline RSA encryption in practice Transform RSA trapdoor

More information

Cryptography IV: Asymmetric Ciphers

Cryptography IV: Asymmetric Ciphers Cryptography IV: Asymmetric Ciphers Computer Security Lecture 7 David Aspinall School of Informatics University of Edinburgh 31st January 2011 Outline Background RSA Diffie-Hellman ElGamal Summary Outline

More information

Lecture 15 & 16: Trapdoor Permutations, RSA, Signatures

Lecture 15 & 16: Trapdoor Permutations, RSA, Signatures CS 7810 Graduate Cryptography October 30, 2017 Lecture 15 & 16: Trapdoor Permutations, RSA, Signatures Lecturer: Daniel Wichs Scribe: Willy Quach & Giorgos Zirdelis 1 Topic Covered. Trapdoor Permutations.

More information

CPSC 467b: Cryptography and Computer Security

CPSC 467b: Cryptography and Computer Security CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 11 February 21, 2013 CPSC 467b, Lecture 11 1/27 Discrete Logarithm Diffie-Hellman Key Exchange ElGamal Key Agreement Primitive Roots

More information

ASYMMETRIC ENCRYPTION

ASYMMETRIC ENCRYPTION ASYMMETRIC ENCRYPTION 1 / 1 Recommended Book Steven Levy. Crypto. Penguin books. 2001. A non-technical account of the history of public-key cryptography and the colorful characters involved. 2 / 1 Recall

More information

1 Number Theory Basics

1 Number Theory Basics ECS 289M (Franklin), Winter 2010, Crypto Review 1 Number Theory Basics This section has some basic facts about number theory, mostly taken (or adapted) from Dan Boneh s number theory fact sheets for his

More information

Lemma 1.2. (1) If p is prime, then ϕ(p) = p 1. (2) If p q are two primes, then ϕ(pq) = (p 1)(q 1).

Lemma 1.2. (1) If p is prime, then ϕ(p) = p 1. (2) If p q are two primes, then ϕ(pq) = (p 1)(q 1). 1 Background 1.1 The group of units MAT 3343, APPLIED ALGEBRA, FALL 2003 Handout 3: The RSA Cryptosystem Peter Selinger Let (R, +, ) be a ring. Then R forms an abelian group under addition. R does not

More information

Mathematical Foundations of Public-Key Cryptography

Mathematical Foundations of Public-Key Cryptography Mathematical Foundations of Public-Key Cryptography Adam C. Champion and Dong Xuan CSE 4471: Information Security Material based on (Stallings, 2006) and (Paar and Pelzl, 2010) Outline Review: Basic Mathematical

More information

Lecture Notes, Week 6

Lecture Notes, Week 6 YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE CPSC 467b: Cryptography and Computer Security Week 6 (rev. 3) Professor M. J. Fischer February 15 & 17, 2005 1 RSA Security Lecture Notes, Week 6 Several

More information

Lecture 4 Chiu Yuen Koo Nikolai Yakovenko. 1 Summary. 2 Hybrid Encryption. CMSC 858K Advanced Topics in Cryptography February 5, 2004

Lecture 4 Chiu Yuen Koo Nikolai Yakovenko. 1 Summary. 2 Hybrid Encryption. CMSC 858K Advanced Topics in Cryptography February 5, 2004 CMSC 858K Advanced Topics in Cryptography February 5, 2004 Lecturer: Jonathan Katz Lecture 4 Scribe(s): Chiu Yuen Koo Nikolai Yakovenko Jeffrey Blank 1 Summary The focus of this lecture is efficient public-key

More information

ECE596C: Handout #11

ECE596C: Handout #11 ECE596C: Handout #11 Public Key Cryptosystems Electrical and Computer Engineering, University of Arizona, Loukas Lazos Abstract In this lecture we introduce necessary mathematical background for studying

More information

Lecture 1: Introduction to Public key cryptography

Lecture 1: Introduction to Public key cryptography Lecture 1: Introduction to Public key cryptography Thomas Johansson T. Johansson (Lund University) 1 / 44 Key distribution Symmetric key cryptography: Alice and Bob share a common secret key. Some means

More information

Number Theory and Algebra: A Brief Introduction

Number Theory and Algebra: A Brief Introduction Number Theory and Algebra: A Brief Introduction Indian Statistical Institute Kolkata May 15, 2017 Elementary Number Theory: Modular Arithmetic Definition Let n be a positive integer and a and b two integers.

More information

Introduction to Public-Key Cryptosystems:

Introduction to Public-Key Cryptosystems: Introduction to Public-Key Cryptosystems: Technical Underpinnings: RSA and Primality Testing Modes of Encryption for RSA Digital Signatures for RSA 1 RSA Block Encryption / Decryption and Signing Each

More information

CPE 776:DATA SECURITY & CRYPTOGRAPHY. Some Number Theory and Classical Crypto Systems

CPE 776:DATA SECURITY & CRYPTOGRAPHY. Some Number Theory and Classical Crypto Systems CPE 776:DATA SECURITY & CRYPTOGRAPHY Some Number Theory and Classical Crypto Systems Dr. Lo ai Tawalbeh Computer Engineering Department Jordan University of Science and Technology Jordan Some Number Theory

More information

RSA. Ramki Thurimella

RSA. Ramki Thurimella RSA Ramki Thurimella Public-Key Cryptography Symmetric cryptography: same key is used for encryption and decryption. Asymmetric cryptography: different keys used for encryption and decryption. Public-Key

More information

Public-Key Cryptosystems CHAPTER 4

Public-Key Cryptosystems CHAPTER 4 Public-Key Cryptosystems CHAPTER 4 Introduction How to distribute the cryptographic keys? Naïve Solution Naïve Solution Give every user P i a separate random key K ij to communicate with every P j. Disadvantage:

More information

Public Key Algorithms

Public Key Algorithms Public Key Algorithms Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-09/

More information

Number Theory and Group Theoryfor Public-Key Cryptography

Number Theory and Group Theoryfor Public-Key Cryptography Number Theory and Group Theory for Public-Key Cryptography TDA352, DIT250 Wissam Aoudi Chalmers University of Technology November 21, 2017 Wissam Aoudi Number Theory and Group Theoryfor Public-Key Cryptography

More information

RABIN PUBLIC-KEY CRYPTOSYSTEM IN RINGS OF POLYNOMIALS OVER FINITE FIELDS

RABIN PUBLIC-KEY CRYPTOSYSTEM IN RINGS OF POLYNOMIALS OVER FINITE FIELDS RABIN PUBLIC-KEY CRYPTOSYSTEM IN RINGS OF POLYNOMIALS OVER FINITE FIELDS A. N. El-Kassar * Ramzi Haraty Y. A. Awad Department of Division of Computer Department of Mathematics Science and Mathematics Mathematics

More information

CPSC 467b: Cryptography and Computer Security

CPSC 467b: Cryptography and Computer Security CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 10 February 19, 2013 CPSC 467b, Lecture 10 1/45 Primality Tests Strong primality tests Weak tests of compositeness Reformulation

More information

Public-Key Cryptography. Lecture 10 DDH Assumption El Gamal Encryption Public-Key Encryption from Trapdoor OWP

Public-Key Cryptography. Lecture 10 DDH Assumption El Gamal Encryption Public-Key Encryption from Trapdoor OWP Public-Key Cryptography Lecture 10 DDH Assumption El Gamal Encryption Public-Key Encryption from Trapdoor OWP Diffie-Hellman Key-exchange Secure under DDH: (g x,g x,g xy ) (g x,g x,g r ) Random x {0,..,

More information

Pseudo-random Number Generation. Qiuliang Tang

Pseudo-random Number Generation. Qiuliang Tang Pseudo-random Number Generation Qiuliang Tang Random Numbers in Cryptography The keystream in the one-time pad The secret key in the DES encryption The prime numbers p, q in the RSA encryption The private

More information

RSA RSA public key cryptosystem

RSA RSA public key cryptosystem RSA 1 RSA As we have seen, the security of most cipher systems rests on the users keeping secret a special key, for anyone possessing the key can encrypt and/or decrypt the messages sent between them.

More information

Security Issues in Cloud Computing Modern Cryptography II Asymmetric Cryptography

Security Issues in Cloud Computing Modern Cryptography II Asymmetric Cryptography Security Issues in Cloud Computing Modern Cryptography II Asymmetric Cryptography Peter Schwabe October 21 and 28, 2011 So far we assumed that Alice and Bob both have some key, which nobody else has. How

More information

Iterated Encryption and Wiener s attack on RSA

Iterated Encryption and Wiener s attack on RSA Iterated Encryption Euler s function Euler s function: φ(n) = {1 x n : gcd(x, n) = 1} Theorem (Euler) If n is a positive integer and m is a positive integer coprime to n then m φ(n) mod n = 1. Iterated

More information

Basic elements of number theory

Basic elements of number theory Cryptography Basic elements of number theory Marius Zimand 1 Divisibility, prime numbers By default all the variables, such as a, b, k, etc., denote integer numbers. Divisibility a 0 divides b if b = a

More information

Basic elements of number theory

Basic elements of number theory Cryptography Basic elements of number theory Marius Zimand By default all the variables, such as a, b, k, etc., denote integer numbers. Divisibility a 0 divides b if b = a k for some integer k. Notation

More information

Public-Key Encryption: ElGamal, RSA, Rabin

Public-Key Encryption: ElGamal, RSA, Rabin Public-Key Encryption: ElGamal, RSA, Rabin Introduction to Modern Cryptography Benny Applebaum Tel-Aviv University Fall Semester, 2011 12 Public-Key Encryption Syntax Encryption algorithm: E. Decryption

More information

Introduction to Modern Cryptography. Benny Chor

Introduction to Modern Cryptography. Benny Chor Introduction to Modern Cryptography Benny Chor RSA: Review and Properties Factoring Algorithms Trapdoor One Way Functions PKC Based on Discrete Logs (Elgamal) Signature Schemes Lecture 8 Tel-Aviv University

More information

Asymmetric Cryptography

Asymmetric Cryptography Asymmetric Cryptography Chapter 4 Asymmetric Cryptography Introduction Encryption: RSA Key Exchange: Diffie-Hellman General idea: Use two different keys -K and +K for encryption and decryption Given a

More information

Chapter 4 Asymmetric Cryptography

Chapter 4 Asymmetric Cryptography Chapter 4 Asymmetric Cryptography Introduction Encryption: RSA Key Exchange: Diffie-Hellman [NetSec/SysSec], WS 2008/2009 4.1 Asymmetric Cryptography General idea: Use two different keys -K and +K for

More information

CHALMERS GÖTEBORGS UNIVERSITET. TDA352 (Chalmers) - DIT250 (GU) 11 April 2017, 8:30-12:30

CHALMERS GÖTEBORGS UNIVERSITET. TDA352 (Chalmers) - DIT250 (GU) 11 April 2017, 8:30-12:30 CHALMERS GÖTEBORGS UNIVERSITET CRYPTOGRAPHY TDA35 (Chalmers) - DIT50 (GU) 11 April 017, 8:30-1:30 No extra material is allowed during the exam except for pens and a simple calculator (not smartphones).

More information

Addition. Ch1 - Algorithms with numbers. Multiplication. al-khwārizmī. al-khwārizmī. Division 53+35=88. Cost? (n number of bits) 13x11=143. Cost?

Addition. Ch1 - Algorithms with numbers. Multiplication. al-khwārizmī. al-khwārizmī. Division 53+35=88. Cost? (n number of bits) 13x11=143. Cost? Ch - Algorithms with numbers Addition Basic arithmetic Addition ultiplication Division odular arithmetic factoring is hard Primality testing 53+35=88 Cost? (n number of bits) O(n) ultiplication al-khwārizmī

More information

Solution to Midterm Examination

Solution to Midterm Examination YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE CPSC 467a: Cryptography and Computer Security Handout #13 Xueyuan Su November 4, 2008 Instructions: Solution to Midterm Examination This is a closed book

More information

Cryptography. pieces from work by Gordon Royle

Cryptography. pieces from work by Gordon Royle Cryptography pieces from work by Gordon Royle The set-up Cryptography is the mathematics of devising secure communication systems, whereas cryptanalysis is the mathematics of breaking such systems. We

More information

Lecture 5: Arithmetic Modulo m, Primes and Greatest Common Divisors Lecturer: Lale Özkahya

Lecture 5: Arithmetic Modulo m, Primes and Greatest Common Divisors Lecturer: Lale Özkahya BBM 205 Discrete Mathematics Hacettepe University http://web.cs.hacettepe.edu.tr/ bbm205 Lecture 5: Arithmetic Modulo m, Primes and Greatest Common Divisors Lecturer: Lale Özkahya Resources: Kenneth Rosen,

More information

CPSC 467b: Cryptography and Computer Security

CPSC 467b: Cryptography and Computer Security Outline Quadratic residues Useful tests Digital Signatures CPSC 467b: Cryptography and Computer Security Lecture 14 Michael J. Fischer Department of Computer Science Yale University March 1, 2010 Michael

More information

Elementary Number Theory Review. Franz Luef

Elementary Number Theory Review. Franz Luef Elementary Number Theory Review Principle of Induction Principle of Induction Suppose we have a sequence of mathematical statements P(1), P(2),... such that (a) P(1) is true. (b) If P(k) is true, then

More information

CRYPTOGRAPHY AND NUMBER THEORY

CRYPTOGRAPHY AND NUMBER THEORY CRYPTOGRAPHY AND NUMBER THEORY XINYU SHI Abstract. In this paper, we will discuss a few examples of cryptographic systems, categorized into two different types: symmetric and asymmetric cryptography. We

More information

Semantic Security of RSA. Semantic Security

Semantic Security of RSA. Semantic Security Semantic Security of RSA Murat Kantarcioglu Semantic Security As before our goal is to come up with a public key system that protects against more than total break We want our system to be secure against

More information

Théorie de l'information et codage. Master de cryptographie Cours 10 : RSA. 20,23 et 27 mars Université Rennes 1

Théorie de l'information et codage. Master de cryptographie Cours 10 : RSA. 20,23 et 27 mars Université Rennes 1 Théorie de l'information et codage Master de cryptographie Cours 10 : RSA 20,23 et 27 mars 2009 Université Rennes 1 Master Crypto (2008-2009) Théorie de l'information et codage 20,23 et 27 mars 2009 1

More information

A New Attack on RSA with Two or Three Decryption Exponents

A New Attack on RSA with Two or Three Decryption Exponents A New Attack on RSA with Two or Three Decryption Exponents Abderrahmane Nitaj Laboratoire de Mathématiques Nicolas Oresme Université de Caen, France nitaj@math.unicaen.fr http://www.math.unicaen.fr/~nitaj

More information

Basic Algorithms in Number Theory

Basic Algorithms in Number Theory Basic Algorithms in Number Theory Algorithmic Complexity... 1 Basic Algorithms in Number Theory Francesco Pappalardi Discrete Logs, Modular Square Roots & Euclidean Algorithm. July 20 th 2010 Basic Algorithms

More information

Discrete Mathematics GCD, LCM, RSA Algorithm

Discrete Mathematics GCD, LCM, RSA Algorithm Discrete Mathematics GCD, LCM, RSA Algorithm Abdul Hameed http://informationtechnology.pk/pucit abdul.hameed@pucit.edu.pk Lecture 16 Greatest Common Divisor 2 Greatest common divisor The greatest common

More information

An Introduction to Probabilistic Encryption

An Introduction to Probabilistic Encryption Osječki matematički list 6(2006), 37 44 37 An Introduction to Probabilistic Encryption Georg J. Fuchsbauer Abstract. An introduction to probabilistic encryption is given, presenting the first probabilistic

More information

Lecture 22: RSA Encryption. RSA Encryption

Lecture 22: RSA Encryption. RSA Encryption Lecture 22: Recall: RSA Assumption We pick two primes uniformly and independently at random p, q $ P n We define N = p q We shall work over the group (Z N, ), where Z N is the set of all natural numbers

More information

Number Theory. Modular Arithmetic

Number Theory. Modular Arithmetic Number Theory The branch of mathematics that is important in IT security especially in cryptography. Deals only in integer numbers and the process can be done in a very fast manner. Modular Arithmetic

More information

CPSC 467: Cryptography and Computer Security

CPSC 467: Cryptography and Computer Security CPSC 467: Cryptography and Computer Security Michael J. Fischer Lecture 21 November 15, 2017 CPSC 467, Lecture 21 1/31 Secure Random Sequence Generators Pseudorandom sequence generators Looking random

More information

LECTURE 5: APPLICATIONS TO CRYPTOGRAPHY AND COMPUTATIONS

LECTURE 5: APPLICATIONS TO CRYPTOGRAPHY AND COMPUTATIONS LECTURE 5: APPLICATIONS TO CRYPTOGRAPHY AND COMPUTATIONS Modular arithmetics that we have discussed in the previous lectures is very useful in Cryptography and Computer Science. Here we discuss several

More information

Public Key Cryptography

Public Key Cryptography Public Key Cryptography Spotlight on Science J. Robert Buchanan Department of Mathematics 2011 What is Cryptography? cryptography: study of methods for sending messages in a form that only be understood

More information

Notes for Lecture Decision Diffie Hellman and Quadratic Residues

Notes for Lecture Decision Diffie Hellman and Quadratic Residues U.C. Berkeley CS276: Cryptography Handout N19 Luca Trevisan March 31, 2009 Notes for Lecture 19 Scribed by Cynthia Sturton, posted May 1, 2009 Summary Today we continue to discuss number-theoretic constructions

More information

Encryption: The RSA Public Key Cipher

Encryption: The RSA Public Key Cipher Encryption: The RSA Public Key Cipher Michael Brockway March 5, 2018 Overview Transport-layer security employs an asymmetric public cryptosystem to allow two parties (usually a client application and a

More information

Topics in Cryptography. Lecture 5: Basic Number Theory

Topics in Cryptography. Lecture 5: Basic Number Theory Topics in Cryptography Lecture 5: Basic Number Theory Benny Pinkas page 1 1 Classical symmetric ciphers Alice and Bob share a private key k. System is secure as long as k is secret. Major problem: generating

More information

Elementary Number Theory MARUCO. Summer, 2018

Elementary Number Theory MARUCO. Summer, 2018 Elementary Number Theory MARUCO Summer, 2018 Problem Set #0 axiom, theorem, proof, Z, N. Axioms Make a list of axioms for the integers. Does your list adequately describe them? Can you make this list as

More information

basics of security/cryptography

basics of security/cryptography RSA Cryptography basics of security/cryptography Bob encrypts message M into ciphertext C=P(M) using a public key; Bob sends C to Alice Alice decrypts ciphertext back into M using a private key (secret)

More information

Biomedical Security. Some Security News 9/17/2018. Erwin M. Bakker. Blockchains are not safe for voting (slashdot.org) : From: paragonie.

Biomedical Security. Some Security News 9/17/2018. Erwin M. Bakker. Blockchains are not safe for voting (slashdot.org) : From: paragonie. Biomedical Security Erwin M. Bakker Some Security News From: NYTimes Blockchains are not safe for voting (slashdot.org) : From Motherboard.vice.com ECDAA: Eliptic Curve Direct Anonymous Attestation for

More information

YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE

YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE CPSC 467a: Cryptography and Computer Security Notes 13 (rev. 2) Professor M. J. Fischer October 22, 2008 53 Chinese Remainder Theorem Lecture Notes 13 We

More information

Public Key Cryptography

Public Key Cryptography Public Key Cryptography Ali El Kaafarani Mathematical Institute Oxford University 1 of 74 Outline 1 Complexity measures 2 Algebra and Number Theory Background 3 Public Key Encryption: security notions

More information

Foundations of Network and Computer Security

Foundations of Network and Computer Security Foundations of Network and Computer Security John Black Lecture #9 Sep 22 nd 2005 CSCI 6268/TLEN 5831, Fall 2005 Announcements Midterm #1, next class (Tues, Sept 27 th ) All lecture materials and readings

More information

DATA PRIVACY AND SECURITY

DATA PRIVACY AND SECURITY DATA PRIVACY AND SECURITY Instructor: Daniele Venturi Master Degree in Data Science Sapienza University of Rome Academic Year 2018-2019 Interlude: Number Theory Cubum autem in duos cubos, aut quadratoquadratum

More information

Security II: Cryptography exercises

Security II: Cryptography exercises Security II: Cryptography exercises Markus Kuhn Lent 2015 Part II Some of the exercises require the implementation of short programs. The model answers use Perl (see Part IB Unix Tools course), but you

More information

Biomedical Security. Overview 9/15/2017. Erwin M. Bakker

Biomedical Security. Overview 9/15/2017. Erwin M. Bakker Biomedical Security Erwin M. Bakker Overview Cryptography: Algorithms Cryptography: Protocols Pretty Good Privacy (PGP) / B. Schneier Workshop Biomedical Security Biomedical Application Security (guest

More information

Applied Cryptography and Computer Security CSE 664 Spring 2017

Applied Cryptography and Computer Security CSE 664 Spring 2017 Applied Cryptography and Computer Security Lecture 11: Introduction to Number Theory Department of Computer Science and Engineering University at Buffalo 1 Lecture Outline What we ve covered so far: symmetric

More information

Public Key Cryptography

Public Key Cryptography Public Key Cryptography Ali El Kaafarani Mathematical Institute Oxford University 1 of 60 Outline 1 RSA Encryption Scheme 2 Discrete Logarithm and Diffie-Hellman Algorithm 3 ElGamal Encryption Scheme 4

More information

CPSC 467b: Cryptography and Computer Security

CPSC 467b: Cryptography and Computer Security CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 9 February 6, 2012 CPSC 467b, Lecture 9 1/53 Euler s Theorem Generating RSA Modulus Finding primes by guess and check Density of

More information

10 Public Key Cryptography : RSA

10 Public Key Cryptography : RSA 10 Public Key Cryptography : RSA 10.1 Introduction The idea behind a public-key system is that it might be possible to find a cryptosystem where it is computationally infeasible to determine d K even if

More information

Notes. Number Theory: Applications. Notes. Number Theory: Applications. Notes. Hash Functions I

Notes. Number Theory: Applications. Notes. Number Theory: Applications. Notes. Hash Functions I Number Theory: Applications Slides by Christopher M. Bourke Instructor: Berthe Y. Choueiry Fall 2007 Computer Science & Engineering 235 Introduction to Discrete Mathematics Sections 3.4 3.7 of Rosen cse235@cse.unl.edu

More information

Numbers. Çetin Kaya Koç Winter / 18

Numbers. Çetin Kaya Koç   Winter / 18 Çetin Kaya Koç http://koclab.cs.ucsb.edu Winter 2016 1 / 18 Number Systems and Sets We represent the set of integers as Z = {..., 3, 2, 1,0,1,2,3,...} We denote the set of positive integers modulo n as

More information

ICS141: Discrete Mathematics for Computer Science I

ICS141: Discrete Mathematics for Computer Science I ICS141: Discrete Mathematics for Computer Science I Dept. Information & Computer Sci., Jan Stelovsky based on slides by Dr. Baek and Dr. Still Originals by Dr. M. P. Frank and Dr. J.L. Gross Provided by

More information

Overview. Background / Context. CSC 580 Cryptography and Computer Security. March 21, 2017

Overview. Background / Context. CSC 580 Cryptography and Computer Security. March 21, 2017 CSC 580 Cryptography and Computer Security Math for Public Key Crypto, RSA, and Diffie-Hellman (Sections 2.4-2.6, 2.8, 9.2, 10.1-10.2) March 21, 2017 Overview Today: Math needed for basic public-key crypto

More information

8.1 Principles of Public-Key Cryptosystems

8.1 Principles of Public-Key Cryptosystems Public-key cryptography is a radical departure from all that has gone before. Right up to modern times all cryptographic systems have been based on the elementary tools of substitution and permutation.

More information

Number Theory & Modern Cryptography

Number Theory & Modern Cryptography Number Theory & Modern Cryptography Week 12 Stallings: Ch 4, 8, 9, 10 CNT-4403: 2.April.2015 1 Introduction Increasing importance in cryptography Public Key Crypto and Signatures Concern operations on

More information

5199/IOC5063 Theory of Cryptology, 2014 Fall

5199/IOC5063 Theory of Cryptology, 2014 Fall 5199/IOC5063 Theory of Cryptology, 2014 Fall Homework 2 Reference Solution 1. This is about the RSA common modulus problem. Consider that two users A and B use the same modulus n = 146171 for the RSA encryption.

More information

Introduction to Modern Cryptography. Benny Chor

Introduction to Modern Cryptography. Benny Chor Introduction to Modern Cryptography Benny Chor RSA Public Key Encryption Factoring Algorithms Lecture 7 Tel-Aviv University Revised March 1st, 2008 Reminder: The Prime Number Theorem Let π(x) denote the

More information

University of Tokyo: Advanced Algorithms Summer Lecture 6 27 May. Let s keep in mind definitions from the previous lecture:

University of Tokyo: Advanced Algorithms Summer Lecture 6 27 May. Let s keep in mind definitions from the previous lecture: University of Tokyo: Advanced Algorithms Summer 2010 Lecture 6 27 May Lecturer: François Le Gall Scribe: Baljak Valentina As opposed to prime factorization, primality testing is determining whether a given

More information

Instructor: Daniele Venturi. Master Degree in Data Science Sapienza University of Rome Academic Year

Instructor: Daniele Venturi. Master Degree in Data Science Sapienza University of Rome Academic Year Data Privacy and Security Instructor: Daniele Venturi Master Degree in Data Science Sapienza University of Rome Academic Year 2017-2018 Interlude: Number Theory Cubum autem in duos cubos, aut quadratoquadratum

More information

CPSC 467: Cryptography and Computer Security

CPSC 467: Cryptography and Computer Security CPSC 467: Cryptography and Computer Security Michael J. Fischer Lecture 9 September 30, 2015 CPSC 467, Lecture 9 1/47 Fast Exponentiation Algorithms Number Theory Needed for RSA Elementary Number Theory

More information

Number Theory: Applications. Number Theory Applications. Hash Functions II. Hash Functions III. Pseudorandom Numbers

Number Theory: Applications. Number Theory Applications. Hash Functions II. Hash Functions III. Pseudorandom Numbers Number Theory: Applications Number Theory Applications Computer Science & Engineering 235: Discrete Mathematics Christopher M. Bourke cbourke@cse.unl.edu Results from Number Theory have many applications

More information

Public Key Encryption

Public Key Encryption Public Key Encryption 3/13/2012 Cryptography 1 Facts About Numbers Prime number p: p is an integer p 2 The only divisors of p are 1 and p s 2, 7, 19 are primes -3, 0, 1, 6 are not primes Prime decomposition

More information

Security Level of Cryptography Integer Factoring Problem (Factoring N = p 2 q) December Summary 2

Security Level of Cryptography Integer Factoring Problem (Factoring N = p 2 q) December Summary 2 Security Level of Cryptography Integer Factoring Problem (Factoring N = p 2 ) December 2001 Contents Summary 2 Detailed Evaluation 3 1 The Elliptic Curve Method 3 1.1 The ECM applied to N = p d............................

More information

Chapter 9 Mathematics of Cryptography Part III: Primes and Related Congruence Equations

Chapter 9 Mathematics of Cryptography Part III: Primes and Related Congruence Equations Chapter 9 Mathematics of Cryptography Part III: Primes and Related Congruence Equations Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. 9.1 Chapter 9 Objectives

More information

El Gamal A DDH based encryption scheme. Table of contents

El Gamal A DDH based encryption scheme. Table of contents El Gamal A DDH based encryption scheme Foundations of Cryptography Computer Science Department Wellesley College Fall 2016 Table of contents Introduction El Gamal Practical Issues The El Gamal encryption

More information

10 Concrete candidates for public key crypto

10 Concrete candidates for public key crypto 10 Concrete candidates for public key crypto In the previous lecture we talked about public key cryptography and saw the Diffie Hellman system and the DSA signature scheme. In this lecture, we will see

More information

Lecture 19: Public-key Cryptography (Diffie-Hellman Key Exchange & ElGamal Encryption) Public-key Cryptography

Lecture 19: Public-key Cryptography (Diffie-Hellman Key Exchange & ElGamal Encryption) Public-key Cryptography Lecture 19: (Diffie-Hellman Key Exchange & ElGamal Encryption) Recall In private-key cryptography the secret-key sk is always established ahead of time The secrecy of the private-key cryptography relies

More information

Breaking Plain ElGamal and Plain RSA Encryption

Breaking Plain ElGamal and Plain RSA Encryption Breaking Plain ElGamal and Plain RSA Encryption (Extended Abstract) Dan Boneh Antoine Joux Phong Nguyen dabo@cs.stanford.edu joux@ens.fr pnguyen@ens.fr Abstract We present a simple attack on both plain

More information