Post-quantum RSA. We built a great, great 1-terabyte RSA wall, and we had the university pay for the electricity
|
|
|
- Wesley Conley
- 6 years ago
- Views:
Transcription
1 We built a great, great 1-terabyte RSA wall, and we had the university pay for the electricity Daniel J. Bernstein Joint work with: Nadia Heninger Paul Lou Luke Valenta
2 The referees are questioning applicability... Reviewer 1: The cryptosystem is an interesting thought experiment, but I cannot believe it will be actually used
3 The referees are questioning applicability... Reviewer 1: The cryptosystem is an interesting thought experiment, but I cannot believe it will be actually used Reviewer 2: I can t see it ever being used.... the main result is almost comical
4 The referees are questioning applicability... Reviewer 1: The cryptosystem is an interesting thought experiment, but I cannot believe it will be actually used Reviewer 2: I can t see it ever being used.... the main result is almost comical Reviewer 3: I m not really convinced by the practicality of the scheme.... I can t imagine exchanging 1 terabyte keys to secure communications
5 The referees are questioning applicability... Reviewer 1: The cryptosystem is an interesting thought experiment, but I cannot believe it will be actually used Reviewer 2: I can t see it ever being used.... the main result is almost comical Reviewer 3: I m not really convinced by the practicality of the scheme.... I can t imagine exchanging 1 terabyte keys to secure communications Reviewer 4: a paranoid post-quantum solution may be sought at the great expense of performance
6 The referees are questioning applicability... Reviewer 1: The cryptosystem is an interesting thought experiment, but I cannot believe it will be actually used Reviewer 2: I can t see it ever being used.... the main result is almost comical Reviewer 3: I m not really convinced by the practicality of the scheme.... I can t imagine exchanging 1 terabyte keys to secure communications Reviewer 4: a paranoid post-quantum solution may be sought at the great expense of performance Reviewer 5: not cheap
7 ... so how do we respond? Appeal to the past:
8 ... so how do we respond? Appeal to the past: Make RSA Great Again!
9 ... so how do we respond? Appeal to the past: Make RSA Great Again! Appeal to the future:
10 ... so how do we respond? Appeal to the past: Make RSA Great Again! Appeal to the future: Moore s law says it ll be okay!
11 ... so how do we respond? Appeal to the past: Make RSA Great Again! Appeal to the future: Moore s law says it ll be okay! Double down:
12 ... so how do we respond? Appeal to the past: Make RSA Great Again! Appeal to the future: Moore s law says it ll be okay! Double down: Digital cash with RSA blind signatures!
13 ... so how do we respond? Appeal to the past: Make RSA Great Again! Appeal to the future: Moore s law says it ll be okay! Double down: Digital cash with RSA blind signatures! FUD:
14 ... so how do we respond? Appeal to the past: Make RSA Great Again! Appeal to the future: Moore s law says it ll be okay! Double down: Digital cash with RSA blind signatures! FUD: Maybe all the alternatives will be broken!
15 ... so how do we respond? Appeal to the past: Make RSA Great Again! Appeal to the future: Moore s law says it ll be okay! Double down: Digital cash with RSA blind signatures! FUD: Maybe all the alternatives will be broken! Put it in perspective:
16 ... so how do we respond? Appeal to the past: Make RSA Great Again! Appeal to the future: Moore s law says it ll be okay! Double down: Digital cash with RSA blind signatures! FUD: Maybe all the alternatives will be broken! Put it in perspective: It s better than QKD!
17 ... so how do we respond? Appeal to the past: Make RSA Great Again! Appeal to the future: Moore s law says it ll be okay! Double down: Digital cash with RSA blind signatures! FUD: Maybe all the alternatives will be broken! Put it in perspective: It s better than QKD! The real answer:
18 ... so how do we respond? Appeal to the past: Make RSA Great Again! Appeal to the future: Moore s law says it ll be okay! Double down: Digital cash with RSA blind signatures! FUD: Maybe all the alternatives will be broken! Put it in perspective: It s better than QKD! The real answer: Someone is wrong on the Internet.
19 RSA scalability vs. Shor scalability Conventional wisdom: Shor s algorithm has the same scalability as legitimate usage of RSA. there s not going to be a larger key-size where a classical user of RSA gains [a] significant advantage over a quantum computing attacker If you increase the key size, it d still be just as easy to break it as it is to encrypt What is the actual scalability of integer factorization? What is the actual scalability of legitimate usage of RSA?
20 What is the fastest sorting algorithm? def blindsort(x): while not issorted(x): permuterandomly(x)
21 What is the fastest sorting algorithm? def blindsort(x): while not issorted(x): permuterandomly(x) def bubblesort(x): for j in range(len(x)): for i in reversed(range(j)): x[i],x[i+1] = min(x[i],x[i+1]),max(x[i],x[i+1]) bubblesort takes poly time. Θ(n 2 ) comparisons. Huge speedup over blindsort!
22 What is the fastest sorting algorithm? def blindsort(x): while not issorted(x): permuterandomly(x) def bubblesort(x): for j in range(len(x)): for i in reversed(range(j)): x[i],x[i+1] = min(x[i],x[i+1]),max(x[i],x[i+1]) bubblesort takes poly time. Θ(n 2 ) comparisons. Huge speedup over blindsort! Is this the end of the story? No, still not optimal.
23 What is the fastest factoring algorithm? Shor s algorithm? Poly time. Huge speedup over NFS! b 2 (log b) 1+o(1) qubit operations to factor b-bit integer, using standard subroutines for fast integer arithmetic.
24 What is the fastest factoring algorithm? Shor s algorithm? Poly time. Huge speedup over NFS! b 2 (log b) 1+o(1) qubit operations to factor b-bit integer, using standard subroutines for fast integer arithmetic. Is this the end of the story? No, still not optimal. Exercise to illustrate suboptimality of Shor s algorithm: Find a prime divisor of π.
25 π
26 When can we beat Shor s algorithm? Costs for various algorithms (log factors suppressed): b 2 ops for Shor s algorithm. Assume best case: qubit ops as cheap as bit ops.
27 When can we beat Shor s algorithm? Costs for various algorithms (log factors suppressed): b 2 ops for Shor s algorithm. Assume best case: qubit ops as cheap as bit ops. by ops for trial division to find primes q y. Beats Shor s algorithm for y below b.
28 When can we beat Shor s algorithm? Costs for various algorithms (log factors suppressed): b 2 ops for Shor s algorithm. Assume best case: qubit ops as cheap as bit ops. by ops for trial division to find primes q y. Beats Shor s algorithm for y below b. b + y ops to first compute q y q, then gcd. Beats Shor s algorithm for y below b 2.
29 When can we beat Shor s algorithm? Costs for various algorithms (log factors suppressed): b 2 ops for Shor s algorithm. Assume best case: qubit ops as cheap as bit ops. by ops for trial division to find primes q y. Beats Shor s algorithm for y below b. b + y ops to first compute q y q, then gcd. Beats Shor s algorithm for y below b 2. b y ops for rho method to find primes q y. Not helpful here.
30 When does ECM beat Shor s algorithm? b exp((log y) 1/2+o(1) ) ops for ECM to find primes q y. Beats Shor s algorithm for log y below (log b) 2+o(1).
31 When does ECM beat Shor s algorithm? b exp((log y) 1/2+o(1) ) ops for ECM to find primes q y. Beats Shor s algorithm for log y below (log b) 2+o(1). Choose ECM parameter z with z exp((α + o(1)) log y log log y). Each prime q y is found by 1/C of all curves where C exp((1/2α + o(1)) log y log log y).
32 When does ECM beat Shor s algorithm? b exp((log y) 1/2+o(1) ) ops for ECM to find primes q y. Beats Shor s algorithm for log y below (log b) 2+o(1). Choose ECM parameter z with z exp((α + o(1)) log y log log y). Each prime q y is found by 1/C of all curves where C exp((1/2α + o(1)) log y log log y). ECM searches through C 1+o(1) curves. Choose α = 1/ 2. Cost: exp(( 2 + o(1)) log y log log y).
33 When does ECM beat Shor s algorithm? b exp((log y) 1/2+o(1) ) ops for ECM to find primes q y. Beats Shor s algorithm for log y below (log b) 2+o(1). Choose ECM parameter z with z exp((α + o(1)) log y log log y). Each prime q y is found by 1/C of all curves where C exp((1/2α + o(1)) log y log log y). ECM searches through C 1+o(1) curves. Choose α = 1/ 2. Cost: exp(( 2 + o(1)) log y log log y). New: Use a Grover search through C 1+o(1) curves. Choose α = 1/2. Cost: exp((1 + o(1)) log y log log y).
34 (PQRSA) Make RSA fast again (see paper for asymptotics): Build public key N as product of many small primes. New: Batch generation of primes. Take exponent 3. (Could 2 be better? Not clear.) Use CRT for decryption. Security qubit ops against all known attacks: Take b = 2 43 bits in N. Take 2 12 bits in each prime. Use proper padding to stop chosen-ciphertext attacks.
35 Implementing PQRSA OpenSSL doesn t support large key sizes 0
36 Implementing PQRSA OpenSSL doesn t support large key sizes 0
37 Implementing PQRSA We implemented RSA key generation, encryption, decryption in C with modified version of GMP library: Change mpz struct internal typing from int to int64 t. Extend upper bound on memory allocation for mpz t. Extend output and input functions to accomodate new mpz struct type.
38 Key generation 1TB multi-prime RSA key uses 2 billion 4096-bit primes
39 Key generation 1TB multi-prime RSA key uses 2 billion 4096-bit primes Use batch algorithm to find primes
40 Key generation 1TB multi-prime RSA key uses 2 billion 4096-bit primes Use batch algorithm to find primes 1,975,000 core-hours Four months on 1,400-core cluster
41 Key generation (continued...) Construct multi-prime RSA modulus from generated primes Use product-tree algorithm
42 Key generation (continued...) Construct multi-prime RSA modulus from generated primes Use product-tree algorithm Four days multithreaded on single machine Max usage of 3.2TB RAM and 2.5TB swap First terabyte RSA key ever created! (At least in public.)
43 Encryption Use RSA-KEM Generate random 1TB element with AES-256-CTR mode Theoreticians might complain: Hey, is this indifferentiable? Are there any fast alternatives with indifferentiability proofs? Does indifferentiability matter? Hash element to construct shared secret for key exchange To compute 3rd power: Use multiply-and-reduce algorithm instead of GMP s modular exponentiation
44 Encryption Use RSA-KEM Generate random 1TB element with AES-256-CTR mode Theoreticians might complain: Hey, is this indifferentiable? Are there any fast alternatives with indifferentiability proofs? Does indifferentiability matter? Hash element to construct shared secret for key exchange To compute 3rd power: Use multiply-and-reduce algorithm instead of GMP s modular exponentiation 256GB encryption in 100 hours on a single machine
45 Recent improvements Reviewer 2: in a world where most people are anxious to shave clock cycles, a cryptosystem with one-week encryption times isn t going to fly
46 Recent improvements Reviewer 2: in a world where most people are anxious to shave clock cycles, a cryptosystem with one-week encryption times isn t going to fly Recent work from Josh Fried: Cluster-distributed parallelized FFT Completed 1TB encryption in about 4 hours with 896 cores Expect 1TB key generation (after primegen) to complete in about 5 hours with 896 cores
47 Ongoing work Decryption: Precompute d i = e 1 mod (p i 1) and m i = C d i mod p i
48 Ongoing work Decryption: Precompute d i = e 1 mod (p i 1) and m i = C d i mod p i Run CRT on pairs of m i, m j, i j and multiply p i, p j to create a node in the next level of the tree
49 Ongoing work Decryption: Precompute d i = e 1 mod (p i 1) and m i = C d i mod p i Run CRT on pairs of m i, m j, i j and multiply p i, p j to create a node in the next level of the tree 16GB decryption in about 132 hours on single machine In progress: decryption with interpolator (save lg n factor over CRT-tree)
50 Ongoing work Decryption: Precompute d i = e 1 mod (p i 1) and m i = C d i mod p i Run CRT on pairs of m i, m j, i j and multiply p i, p j to create a node in the next level of the tree 16GB decryption in about 132 hours on single machine In progress: decryption with interpolator (save lg n factor over CRT-tree) Try to unify quantum-factoring landscape: Gal Dor suggests some bits of Shor, followed by Grover.
University of Illinois at Chicago. Prelude: What is the fastest algorithm to sort an array?
Challenges in quantum algorithms for integer factorization 1 D. J. Bernstein University of Illinois at Chicago Prelude: What is the fastest algorithm to sort an array? def blindsort(x): while not issorted(x):
Logic gates. Quantum logic gates. α β 0 1 X = 1 0. Quantum NOT gate (X gate) Classical NOT gate NOT A. Matrix form representation
Quantum logic gates Logic gates Classical NOT gate Quantum NOT gate (X gate) A NOT A α 0 + β 1 X α 1 + β 0 A N O T A 0 1 1 0 Matrix form representation 0 1 X = 1 0 The only non-trivial single bit gate
Mathematics of Public Key Cryptography
Mathematics of Public Key Cryptography Eric Baxter April 12, 2014 Overview Brief review of public-key cryptography Mathematics behind public-key cryptography algorithms What is Public-Key Cryptography?
Integer factorization, part 1: the Q sieve. part 2: detecting smoothness. D. J. Bernstein
Integer factorization, part 1: the Q sieve Integer factorization, part 2: detecting smoothness D. J. Bernstein The Q sieve factors by combining enough -smooth congruences ( + ). Enough log. Plausible conjecture:
Number Theory: Applications. Number Theory Applications. Hash Functions II. Hash Functions III. Pseudorandom Numbers
Number Theory: Applications Number Theory Applications Computer Science & Engineering 235: Discrete Mathematics Christopher M. Bourke cbourke@cse.unl.edu Results from Number Theory have many applications
RSA. Ramki Thurimella
RSA Ramki Thurimella Public-Key Cryptography Symmetric cryptography: same key is used for encryption and decryption. Asymmetric cryptography: different keys used for encryption and decryption. Public-Key
Discrete Mathematics GCD, LCM, RSA Algorithm
Discrete Mathematics GCD, LCM, RSA Algorithm Abdul Hameed http://informationtechnology.pk/pucit abdul.hameed@pucit.edu.pk Lecture 16 Greatest Common Divisor 2 Greatest common divisor The greatest common
Foundations of Network and Computer Security
Foundations of Network and Computer Security John Black Lecture #9 Sep 22 nd 2005 CSCI 6268/TLEN 5831, Fall 2005 Announcements Midterm #1, next class (Tues, Sept 27 th ) All lecture materials and readings
Notes. Number Theory: Applications. Notes. Number Theory: Applications. Notes. Hash Functions I
Number Theory: Applications Slides by Christopher M. Bourke Instructor: Berthe Y. Choueiry Fall 2007 Computer Science & Engineering 235 Introduction to Discrete Mathematics Sections 3.4 3.7 of Rosen cse235@cse.unl.edu
Public Key 9/17/2018. Symmetric Cryptography Review. Symmetric Cryptography: Shortcomings (1) Symmetric Cryptography: Analogy
Symmetric Cryptography Review Alice Bob Public Key x e K (x) y d K (y) x K K Instructor: Dr. Wei (Lisa) Li Department of Computer Science, GSU Two properties of symmetric (secret-key) crypto-systems: The
Number theory (Chapter 4)
EECS 203 Spring 2016 Lecture 12 Page 1 of 8 Number theory (Chapter 4) Review Compute 6 11 mod 13 in an efficient way What is the prime factorization of 100? 138? What is gcd(100, 138)? What is lcm(100,138)?
Cosc 412: Cryptography and complexity Lecture 7 (22/8/2018) Knapsacks and attacks
1 Cosc 412: Cryptography and complexity Lecture 7 (22/8/2018) Knapsacks and attacks Michael Albert michael.albert@cs.otago.ac.nz 2 This week Arithmetic Knapsack cryptosystems Attacks on knapsacks Some
CPE 776:DATA SECURITY & CRYPTOGRAPHY. Some Number Theory and Classical Crypto Systems
CPE 776:DATA SECURITY & CRYPTOGRAPHY Some Number Theory and Classical Crypto Systems Dr. Lo ai Tawalbeh Computer Engineering Department Jordan University of Science and Technology Jordan Some Number Theory
COMP4109 : Applied Cryptography
COMP409 : Applied Cryptography Fall 203 M. Jason Hinek Carleton University Applied Cryptography Day 3 public-key encryption schemes some attacks on RSA factoring small private exponent 2 RSA cryptosystem
Thanks to: University of Illinois at Chicago NSF DMS Alfred P. Sloan Foundation
Building circuits for integer factorization D. J. Bernstein Thanks to: University of Illinois at Chicago NSF DMS 0140542 Alfred P. Sloan Foundation I want to work for NSA as an independent contractor.
Cryptography. pieces from work by Gordon Royle
Cryptography pieces from work by Gordon Royle The set-up Cryptography is the mathematics of devising secure communication systems, whereas cryptanalysis is the mathematics of breaking such systems. We
McBits: fast constant-time code-based cryptography. (to appear at CHES 2013)
McBits: fast constant-time code-based cryptography (to appear at CHES 2013) D. J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven Joint work with: Tung Chou Technische Universiteit
High-speed cryptography, part 3: more cryptosystems. Daniel J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven
High-speed cryptography, part 3: more cryptosystems Daniel J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven Cryptographers Working systems Cryptanalytic algorithm designers
Daniel J. Bernstein University of Illinois at Chicago. means an algorithm that a quantum computer can run.
Quantum algorithms 1 Daniel J. Bernstein University of Illinois at Chicago Quantum algorithm means an algorithm that a quantum computer can run. i.e. a sequence of instructions, where each instruction
Lecture 6: Cryptanalysis of public-key algorithms.,
T-79.159 Cryptography and Data Security Lecture 6: Cryptanalysis of public-key algorithms. Helsinki University of Technology mjos@tcs.hut.fi 1 Outline Computational complexity Reminder about basic number
Advanced code-based cryptography. Daniel J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven
Advanced code-based cryptography Daniel J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven Lattice-basis reduction Define L = (0; 24)Z + (1; 17)Z = {(b; 24a + 17b) : a;
Public-Key Cryptosystems CHAPTER 4
Public-Key Cryptosystems CHAPTER 4 Introduction How to distribute the cryptographic keys? Naïve Solution Naïve Solution Give every user P i a separate random key K ij to communicate with every P j. Disadvantage:
Attacks on RSA & Using Asymmetric Crypto
Attacks on RSA & Using Asymmetric Crypto Luke Anderson luke@lukeanderson.com.au 7 th April 2017 University Of Sydney Overview 1. Crypto-Bulletin 2. Breaking RSA 2.1 Chinese Remainder Theorem 2.2 Common
Review. CS311H: Discrete Mathematics. Number Theory. Computing GCDs. Insight Behind Euclid s Algorithm. Using this Theorem. Euclidian Algorithm
Review CS311H: Discrete Mathematics Number Theory Instructor: Işıl Dillig What does it mean for two ints a, b to be congruent mod m? What is the Division theorem? If a b and a c, does it mean b c? What
Introduction. What is RSA. A Guide To RSA by Robert Yates. Topics
A Guide To RSA by Robert Yates. Topics Introduction...01/09 What is RSA...01/09 Mod-Exponentiation...02/09 Euler's Theorem...03/09 RSA Algorithm...08/09 RSA Security...09/09 Introduction Welcome to my
1 What are Physical Attacks. 2 Physical Attacks on RSA. Today:
Today: Introduction to the class. Examples of concrete physical attacks on RSA A computational approach to cryptography Pseudorandomness 1 What are Physical Attacks Tampering/Leakage attacks Issue of how
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 10 February 19, 2013 CPSC 467b, Lecture 10 1/45 Primality Tests Strong primality tests Weak tests of compositeness Reformulation
ICS141: Discrete Mathematics for Computer Science I
ICS141: Discrete Mathematics for Computer Science I Dept. Information & Computer Sci., Jan Stelovsky based on slides by Dr. Baek and Dr. Still Originals by Dr. M. P. Frank and Dr. J.L. Gross Provided by
8 Elliptic Curve Cryptography
8 Elliptic Curve Cryptography 8.1 Elliptic Curves over a Finite Field For the purposes of cryptography, we want to consider an elliptic curve defined over a finite field F p = Z/pZ for p a prime. Given
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 9 February 6, 2012 CPSC 467b, Lecture 9 1/53 Euler s Theorem Generating RSA Modulus Finding primes by guess and check Density of
Code-based post-quantum cryptography. D. J. Bernstein University of Illinois at Chicago
Code-based post-quantum cryptography D. J. Bernstein University of Illinois at Chicago Once the enormous energy boost that quantum computers are expected to provide hits the street, most encryption security
RSA Key Extraction via Low- Bandwidth Acoustic Cryptanalysis. Daniel Genkin, Adi Shamir, Eran Tromer
RSA Key Extraction via Low- Bandwidth Acoustic Cryptanalysis Daniel Genkin, Adi Shamir, Eran Tromer Mathematical Attacks Input Crypto Algorithm Key Output Goal: recover the key given access to the inputs
Public-key cryptography and the Discrete-Logarithm Problem. Tanja Lange Technische Universiteit Eindhoven. with some slides by Daniel J.
Public-key cryptography and the Discrete-Logarithm Problem Tanja Lange Technische Universiteit Eindhoven with some slides by Daniel J. Bernstein Cryptography Let s understand what our browsers do. Schoolbook
cse 311: foundations of computing Fall 2015 Lecture 12: Primes, GCD, applications
cse 311: foundations of computing Fall 2015 Lecture 12: Primes, GCD, applications n-bit unsigned integer representation Represent integer x as sum of powers of 2: If x = n 1 i=0 b i 2 i where each b i
Senior Math Circles Cryptography and Number Theory Week 2
Senior Math Circles Cryptography and Number Theory Week 2 Dale Brydon Feb. 9, 2014 1 Divisibility and Inverses At the end of last time, we saw that not all numbers have inverses mod n, but some do. We
cse 311: foundations of computing Spring 2015 Lecture 12: Primes, GCD, applications
cse 311: foundations of computing Spring 2015 Lecture 12: Primes, GCD, applications casting out 3s Theorem: A positive integer n is divisible by 3 if and only if the sum of its decimal digits is divisible
Introduction to Elliptic Curve Cryptography. Anupam Datta
Introduction to Elliptic Curve Cryptography Anupam Datta 18-733 Elliptic Curve Cryptography Public Key Cryptosystem Duality between Elliptic Curve Cryptography and Discrete Log Based Cryptography Groups
Theme : Cryptography. Instructor : Prof. C Pandu Rangan. Speaker : Arun Moorthy CS
1 C Theme : Cryptography Instructor : Prof. C Pandu Rangan Speaker : Arun Moorthy 93115 CS 2 RSA Cryptosystem Outline of the Talk! Introduction to RSA! Working of the RSA system and associated terminology!
Introduction to Modern Cryptography. Benny Chor
Introduction to Modern Cryptography Benny Chor RSA: Review and Properties Factoring Algorithms Trapdoor One Way Functions PKC Based on Discrete Logs (Elgamal) Signature Schemes Lecture 8 Tel-Aviv University
Lecture 1: Introduction to Public key cryptography
Lecture 1: Introduction to Public key cryptography Thomas Johansson T. Johansson (Lund University) 1 / 44 Key distribution Symmetric key cryptography: Alice and Bob share a common secret key. Some means
The factorization of RSA D. J. Bernstein University of Illinois at Chicago
The factorization of RSA-1024 D. J. Bernstein University of Illinois at Chicago Abstract: This talk discusses the most important tools for attackers breaking 1024-bit RSA keys today and tomorrow. The same
Homework 4 for Modular Arithmetic: The RSA Cipher
Homework 4 for Modular Arithmetic: The RSA Cipher Gregory V. Bard April 25, 2018 This is a practice workbook for the RSA cipher. It is not suitable for learning the RSA cipher from scratch. However, there
A brief survey of post-quantum cryptography. D. J. Bernstein University of Illinois at Chicago
A brief survey of post-quantum cryptography D. J. Bernstein University of Illinois at Chicago Once the enormous energy boost that quantum computers are expected to provide hits the street, most encryption
Cryptography IV: Asymmetric Ciphers
Cryptography IV: Asymmetric Ciphers Computer Security Lecture 7 David Aspinall School of Informatics University of Edinburgh 31st January 2011 Outline Background RSA Diffie-Hellman ElGamal Summary Outline
KTH, NADA , and D1449 Kryptografins grunder. Lecture 6: RSA. Johan Håstad, transcribed by Martin Lindkvist
Lecture 6: RSA Johan Håstad, transcribed by Martin Lindkvist 2006-01-31, 2006-02-02 and 2006-02-07 1 Introduction Using an ordinary cryptosystem, encryption uses a key K and decryption is performed by
10 Public Key Cryptography : RSA
10 Public Key Cryptography : RSA 10.1 Introduction The idea behind a public-key system is that it might be possible to find a cryptosystem where it is computationally infeasible to determine d K even if
Factoring. Number Theory # 2
1 Number Theory # 2 Factoring In the last homework problem, it takes many steps of the Euclidean algorithm to find that the gcd of the two numbers is 1. However, if we had initially observed that 11384623=5393*2111,
Information Security
SE 4472 / ECE 9064 Information Security Week 12: Random Number Generators and Picking Appropriate Key Lengths Fall 2015 Prof. Aleksander Essex Random Number Generation Where do keys come from? So far we
Lecture V : Public Key Cryptography
Lecture V : Public Key Cryptography Internet Security: Principles & Practices John K. Zao, PhD (Harvard) SMIEEE Amir Rezapoor Computer Science Department, National Chiao Tung University 2 Outline Functional
Lecture Notes, Week 6
YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE CPSC 467b: Cryptography and Computer Security Week 6 (rev. 3) Professor M. J. Fischer February 15 & 17, 2005 1 RSA Security Lecture Notes, Week 6 Several
ECE297:11 Lecture 12
ECE297:11 Lecture 12 RSA Genesis, operation & security Public Key (Asymmetric) Cryptosystems Public key of Bob - K B Private key of Bob - k B Network Alice Encryption Decryption Bob 1 Trap-door one-way
Integer factorization, part 1: the Q sieve. D. J. Bernstein
Integer factorization, part 1: the Q sieve D. J. Bernstein Sieving small integers 0 using primes 3 5 7: 1 3 3 4 5 5 6 3 7 7 8 9 3 3 10 5 11 1 3 13 14 7 15 3 5 16 17 18 3 3 19 0 5 etc. Sieving and 611 +
For your quiz in recitation this week, refer to these exercise generators:
Monday, Oct 29 Today we will talk about inverses in modular arithmetic, and the use of inverses to solve linear congruences. For your quiz in recitation this week, refer to these exercise generators: GCD
CS March 17, 2009
Discrete Mathematics CS 2610 March 17, 2009 Number Theory Elementary number theory, concerned with numbers, usually integers and their properties or rational numbers mainly divisibility among integers
1 Recommended Reading 1. 2 Public Key/Private Key Cryptography Overview RSA Algorithm... 2
Contents 1 Recommended Reading 1 2 Public Key/Private Key Cryptography 1 2.1 Overview............................................. 1 2.2 RSA Algorithm.......................................... 2 3 A Number
Chapter 4 Asymmetric Cryptography
Chapter 4 Asymmetric Cryptography Introduction Encryption: RSA Key Exchange: Diffie-Hellman [NetSec/SysSec], WS 2008/2009 4.1 Asymmetric Cryptography General idea: Use two different keys -K and +K for
Asymmetric Cryptography
Asymmetric Cryptography Chapter 4 Asymmetric Cryptography Introduction Encryption: RSA Key Exchange: Diffie-Hellman General idea: Use two different keys -K and +K for encryption and decryption Given a
Practice Assignment 2 Discussion 24/02/ /02/2018
German University in Cairo Faculty of MET (CSEN 1001 Computer and Network Security Course) Dr. Amr El Mougy 1 RSA 1.1 RSA Encryption Practice Assignment 2 Discussion 24/02/2018-29/02/2018 Perform encryption
The quantum threat to cryptography
The quantum threat to cryptography Ashley Montanaro School of Mathematics, University of Bristol 20 October 2016 Quantum computers University of Bristol IBM UCSB / Google University of Oxford Experimental
ENHANCING THE PERFORMANCE OF FACTORING ALGORITHMS
ENHANCING THE PERFORMANCE OF FACTORING ALGORITHMS GIVEN n FIND p 1,p 2,..,p k SUCH THAT n = p 1 d 1 p 2 d 2.. p k d k WHERE p i ARE PRIMES FACTORING IS CONSIDERED TO BE A VERY HARD. THE BEST KNOWN ALGORITHM
Speeding up characteristic 2: I. Linear maps II. The Å(Ò) game III. Batching IV. Normal bases. D. J. Bernstein University of Illinois at Chicago
Speeding up characteristic 2: I. Linear maps II. The Å(Ò) game III. Batching IV. Normal bases D. J. Bernstein University of Illinois at Chicago NSF ITR 0716498 Part I. Linear maps Consider computing 0
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Module No. # 01 Lecture No. # 33 The Diffie-Hellman Problem
Introduction to Modern Cryptography. Benny Chor
Introduction to Modern Cryptography Benny Chor RSA Public Key Encryption Factoring Algorithms Lecture 7 Tel-Aviv University Revised March 1st, 2008 Reminder: The Prime Number Theorem Let π(x) denote the
5199/IOC5063 Theory of Cryptology, 2014 Fall
5199/IOC5063 Theory of Cryptology, 2014 Fall Homework 2 Reference Solution 1. This is about the RSA common modulus problem. Consider that two users A and B use the same modulus n = 146171 for the RSA encryption.
Introduction to cryptology (GBIN8U16) More on discrete-logarithm based schemes
Introduction to cryptology (GBIN8U16) More on discrete-logarithm based schemes Pierre Karpman pierre.karpman@univ-grenoble-alpes.fr https://www-ljk.imag.fr/membres/pierre.karpman/tea.html 2018 03 13 More
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 8 February 1, 2012 CPSC 467b, Lecture 8 1/42 Number Theory Needed for RSA Z n : The integers mod n Modular arithmetic GCD Relatively
Security Issues in Cloud Computing Modern Cryptography II Asymmetric Cryptography
Security Issues in Cloud Computing Modern Cryptography II Asymmetric Cryptography Peter Schwabe October 21 and 28, 2011 So far we assumed that Alice and Bob both have some key, which nobody else has. How
Introduction to Public-Key Cryptosystems:
Introduction to Public-Key Cryptosystems: Technical Underpinnings: RSA and Primality Testing Modes of Encryption for RSA Digital Signatures for RSA 1 RSA Block Encryption / Decryption and Signing Each
Shor s Algorithm. Polynomial-time Prime Factorization with Quantum Computing. Sourabh Kulkarni October 13th, 2017
Shor s Algorithm Polynomial-time Prime Factorization with Quantum Computing Sourabh Kulkarni October 13th, 2017 Content Church Thesis Prime Numbers and Cryptography Overview of Shor s Algorithm Implementation
Q 2.0.2: If it s 5:30pm now, what time will it be in 4753 hours? Q 2.0.3: Today is Wednesday. What day of the week will it be in one year from today?
2 Mod math Modular arithmetic is the math you do when you talk about time on a clock. For example, if it s 9 o clock right now, then it ll be 1 o clock in 4 hours. Clearly, 9 + 4 1 in general. But on a
CRYPTOGRAPHY AND LARGE PRIMES *
CRYPTOGRAPHY AND LARGE PRIMES * B. Hartley University of Manchester, England, and National University of Singapore The word "cryptography" derives from Greek and means "secret writing". Since ancient times,
Integers and Division
Integers and Division Notations Z: set of integers N : set of natural numbers R: set of real numbers Z + : set of positive integers Some elements of number theory are needed in: Data structures, Random
Number Theory. Modular Arithmetic
Number Theory The branch of mathematics that is important in IT security especially in cryptography. Deals only in integer numbers and the process can be done in a very fast manner. Modular Arithmetic
RSA Implementation. Oregon State University
RSA Implementation Çetin Kaya Koç Oregon State University 1 Contents: Exponentiation heuristics Multiplication algorithms Computation of GCD and Inverse Chinese remainder algorithm Primality testing 2
Public Key Cryptography
Public Key Cryptography Introduction Public Key Cryptography Unlike symmetric key, there is no need for Alice and Bob to share a common secret Alice can convey her public key to Bob in a public communication:
Mathematics of Cryptography
UNIT - III Mathematics of Cryptography Part III: Primes and Related Congruence Equations 1 Objectives To introduce prime numbers and their applications in cryptography. To discuss some primality test algorithms
Implementation Tutorial on RSA
Implementation Tutorial on Maciek Adamczyk; m adamczyk@umail.ucsb.edu Marianne Magnussen; mariannemagnussen@umail.ucsb.edu Adamczyk and Magnussen Spring 2018 1 / 13 Overview Implementation Tutorial Introduction
Public-key Cryptography and elliptic curves
Public-key Cryptography and elliptic curves Dan Nichols nichols@math.umass.edu University of Massachusetts Oct. 14, 2015 Cryptography basics Cryptography is the study of secure communications. Here are
CSE 311 Lecture 13: Primes and GCD. Emina Torlak and Kevin Zatloukal
CSE 311 Lecture 13: Primes and GCD Emina Torlak and Kevin Zatloukal 1 Topics Modular arithmetic applications A quick wrap-up of Lecture 12. Primes Fundamental theorem of arithmetic, Euclid s theorem, factoring.
Lemma 1.2. (1) If p is prime, then ϕ(p) = p 1. (2) If p q are two primes, then ϕ(pq) = (p 1)(q 1).
1 Background 1.1 The group of units MAT 3343, APPLIED ALGEBRA, FALL 2003 Handout 3: The RSA Cryptosystem Peter Selinger Let (R, +, ) be a ring. Then R forms an abelian group under addition. R does not
Message Authentication Codes (MACs)
Message Authentication Codes (MACs) Tung Chou Technische Universiteit Eindhoven, The Netherlands October 8, 2015 1 / 22 About Me 2 / 22 About Me Tung Chou (Tony) 2 / 22 About Me Tung Chou (Tony) Ph.D.
Introduction to Modern Cryptography. Lecture RSA Public Key CryptoSystem 2. One way Trapdoor Functions
Introduction to Modern Cryptography Lecture 7 1. RSA Public Key CryptoSystem 2. One way Trapdoor Functions Diffie and Hellman (76) New Directions in Cryptography Split the Bob s secret key K to two parts:
Quantum Computing and the Possible Effects on Modern Security Practices
Quantum Computing and the Possible Effects on Modern Security Practices SE 4C03 Winter 2005 Kartik Sivaramakrishnan Researched by: Jeffery Lindner, 9904294 Due: April 04, 2005 Table of Contents Introduction...
CSc 466/566. Computer Security. 5 : Cryptography Basics
1/84 CSc 466/566 Computer Security 5 : Cryptography Basics Version: 2012/03/03 10:44:26 Department of Computer Science University of Arizona collberg@gmail.com Copyright c 2012 Christian Collberg Christian
Algorithmic Number Theory and Public-key Cryptography
Algorithmic Number Theory and Public-key Cryptography Course 3 University of Luxembourg March 22, 2018 The RSA algorithm The RSA algorithm is the most widely-used public-key encryption algorithm Invented
Lecture 6: Introducing Complexity
COMP26120: Algorithms and Imperative Programming Lecture 6: Introducing Complexity Ian Pratt-Hartmann Room KB2.38: email: ipratt@cs.man.ac.uk 2015 16 You need this book: Make sure you use the up-to-date
Question: Total Points: Score:
University of California, Irvine COMPSCI 134: Elements of Cryptography and Computer and Network Security Midterm Exam (Fall 2016) Duration: 90 minutes November 2, 2016, 7pm-8:30pm Name (First, Last): Please
ENEE 457: Computer Systems Security 10/3/16. Lecture 9 RSA Encryption and Diffie-Helmann Key Exchange
ENEE 457: Computer Systems Security 10/3/16 Lecture 9 RSA Encryption and Diffie-Helmann Key Exchange Charalampos (Babis) Papamanthou Department of Electrical and Computer Engineering University of Maryland,
Unbelievable Security Matching AES security using public key systems
Unbelievable Security Matching AES security using public key systems Arjen K. Lenstra Citibank, N.A. and Technische Universiteit Eindhoven 1 North Gate Road, Mendham, NJ 07945-3104, U.S.A. arjen.lenstra@citicorp.com
In fact, 3 2. It is not known whether 3 1. All three problems seem hard, although Shor showed that one can solve 3 quickly on a quantum computer.
Attacks on RSA, some using LLL Recall RSA: N = pq hard to factor. Choose e with gcd(e,φ(n)) = 1, where φ(n) = (p 1)(q 1). Via extended Euclid, find d with ed 1 (mod φ(n)). Discard p and q. Public key is
Slides by Kent Seamons and Tim van der Horst Last Updated: Oct 1, 2013
RSA Slides by Kent Seamons and Tim van der Horst Last Updated: Oct 1, 2013 Recap Recap Number theory o What is a prime number? o What is prime factorization? o What is a GCD? o What does relatively prime
You separate binary numbers into columns in a similar fashion. 2 5 = 32
RSA Encryption 2 At the end of Part I of this article, we stated that RSA encryption works because it s impractical to factor n, which determines P 1 and P 2, which determines our private key, d, which
Remote Timing Attacks are Practical
Remote Timing Attacks are Practical by David Brumley and Dan Boneh Presented by Seny Kamara in Advanced Topics in Network Security (600/650.624) Outline Traditional threat model in cryptography Side-channel
19. Coding for Secrecy
19. Coding for Secrecy 19.1 Introduction Protecting sensitive information from the prying eyes and ears of others is an important issue today as much as it has been for thousands of years. Government secrets,
Breaking Plain ElGamal and Plain RSA Encryption
Breaking Plain ElGamal and Plain RSA Encryption (Extended Abstract) Dan Boneh Antoine Joux Phong Nguyen dabo@cs.stanford.edu joux@ens.fr pnguyen@ens.fr Abstract We present a simple attack on both plain
MATH 158 FINAL EXAM 20 DECEMBER 2016
MATH 158 FINAL EXAM 20 DECEMBER 2016 Name : The exam is double-sided. Make sure to read both sides of each page. The time limit is three hours. No calculators are permitted. You are permitted one page
9 Knapsack Cryptography
9 Knapsack Cryptography In the past four weeks, we ve discussed public-key encryption systems that depend on various problems that we believe to be hard: prime factorization, the discrete logarithm, and
The RSA Cipher and its Algorithmic Foundations
Chapter 1 The RSA Cipher and its Algorithmic Foundations The most important that is, most applied and most analyzed asymmetric cipher is RSA, named after its inventors Ron Rivest, Adi Shamir, and Len Adleman.
Solutions to homework 2
ICS 180: Introduction to Cryptography 4/22/2004 Solutions to homework 2 1 Security Definitions [10+20 points] Definition of some security property often goes like this: We call some communication scheme
Numbers. Çetin Kaya Koç Winter / 18
Çetin Kaya Koç http://koclab.cs.ucsb.edu Winter 2016 1 / 18 Number Systems and Sets We represent the set of integers as Z = {..., 3, 2, 1,0,1,2,3,...} We denote the set of positive integers modulo n as