Factoring integers, Producing primes and the RSA cryptosystem. December 14, 2005

Transcription

1 Factoring integers, Producing primes and the RSA cryptosystem December 14, 2005

2 RSA cryptosystem University of Kathmandu, December 14, RSA 2048 = RSA 2048 is a 617 (decimal) digit number

3 RSA cryptosystem University of Kathmandu, December 14, RSA 2048 =p q, p, q PROBLEM: Compute p and q Price: US$ ( 13, 948, NPR)!! Theorem. If a N! p 1 < p 2 < < p k primes s.t. a = p α 1 1 pα k k Regrettably: RSAlabs believes that factoring in one year requires: number computers memory RSA Tb RSA , 000, Gb RSA ,000 4Gb.

4 RSA cryptosystem University of Kathmandu, December 14, Challenge Number Prize ($US) RSA 576 $10,000 RSA 640 $20,000 RSA 704 $30,000 RSA 768 $50,000 RSA 896 $75,000 RSA 1024 $100,000 RSA 1536 $150,000 RSA 2048 $200,000

5 RSA cryptosystem University of Kathmandu, December 14, Challenge Number Prize ($US) Status RSA 576 $10,000 Factored December 2003 RSA 640 $20,000 Not Factored RSA 704 $30,000 Not Factored RSA 768 $50,000 Not Factored RSA 896 $75,000 Not Factored RSA 1024 $100,000 Not Factored RSA 1536 $150,000 Not Factored RSA 2048 $200,000 Not Factored

6 RSA cryptosystem University of Kathmandu, December 14, History of the Art of Factoring 220 BC Greeks (Eratosthenes of Cyrene ) 1730 Euler = Fermat, Gauss (Sieves - Tables) 1880 Landry & Le Lasseur: = Pierre and Eugène Carissan (Factoring Machine) 1970 Morrison & Brillhart = , Richard Brent and John Pollard = Quadratic Sieve QS (Pomerance) Number Fields Sieve NFS 1987 Elliptic curves factoring ECF (Lenstra)

7 RSA cryptosystem University of Kathmandu, December 14, Carissan s ancient Factoring Machine Figure 1: Conservatoire Nationale des Arts et Métiers in Paris shallit/papers/carissan.html

8 RSA cryptosystem University of Kathmandu, December 14, Figure 2: Lieutenant Eugène Carissan = minutes = minutes = minutes

9 RSA cryptosystem University of Kathmandu, December 14, Contemporary Factoring 1/2 ❶ 1994, Quadratic Sieve (QS): (8 months, 600 voluntaries, 20 countries) D.Atkins, M. Graff, A. Lenstra, P. Leyland RSA 129 = = = ❷ (February ), Number Fields Sieve (NFS): (160 Sun, 4 months) RSA 155 = = = ❸ (December 3, 2003) (NFS): J. Franke et al. (174 decimal digits) RSA 576 = = = ❹ (May 9,2005) (NFS): F. Bahr, et al (663 binary digits) RSA 200 = =

10 RSA cryptosystem University of Kathmandu, December 14, Contemporary Factoring 2/2 Elliptic curves factoring (ECM) H. Lenstra (1985) - small factors (50 digits) ❻ (1993) A. Lenstra, H. Lenstra, Jr., M. Manasse, and J. Pollard = p99 ❻ (April 6, 2005) (ECM) B. Dodson is divisible by ; ❼ (Sept. 5, 2005) (ECM) K. Aoki & T. Shimoyama is divisible by For updates see Paul Zimmerman s Integer Factoring Records : zimmerma/records/factor.html More infoes about fatroring in Update on factorization of Fermat Numbers :

11 RSA cryptosystem University of Kathmandu, December 14, Date: Thu, 10 Nov :07: From: Jens Franke <franke@math.uni-bonn.de> To: NMBRTHRY@LISTSERV.NODAK.EDU Last Minute News We have factored RSA640 by GNFS. The factors are and We did lattice sieving for most special q between 28e7 and 77e7 using factor base bounds of 28e7 on the algebraic side and 15e7 on the rational side. The bounds for large primes were 2^ 34. This produced 166e7 relations. After removing duplicates 143e7 relations remained. A filter job produced a matrix with 36e6 rows and columns, having 74e8 non-zero entries. This was solved by Block-Lanczos. Sieving has been done on GHz Opteron CPUs and took 3 months. The matrix step was performed on a cluster of GHz Opterons connected via a Gigabit network and took about 1.5 months. Calendar time for the factorization (without polynomial selection) was 5 months. More details will be given later. F. Bahr, M. Boehm, J. Franke, T. Kleinjung

12 RSA cryptosystem University of Kathmandu, December 14, RSA Adi Shamir, Ron L. Rivest, Leonard Adleman (1978)

13 RSA cryptosystem University of Kathmandu, December 14, The RSA cryptosystem 1978 R. L. Rivest, A. Shamir, L. Adleman (Patent expired in 1998) Problem: Alice wants to send the message P to Bob so that Charles cannot read it A (Alice) B (Bob) C (Charles) ❶ Key generation ❷ Encryption ❸ Decryption ❹ Attack Bob has to do it Alice has to do it Bob has to do it Charles would like to do it

14 RSA cryptosystem University of Kathmandu, December 14, Bob: Key generation He chooses randomly p and q primes (p, q ) He computes M = p q, ϕ(m) = (p 1) (q 1) He chooses an integer e s.t. 0 e ϕ(m) and gcd(e, ϕ(m)) = 1 Note. One could take e = 3 and p q 2 mod 3 Experts recommend e = He computes arithmetic inverse d of e modulo ϕ(m) (i.e. d N (unique ϕ(m)) s.t. e d 1 (mod ϕ(m))) Publishes (M, e) public key and hides secret key d Problem: How does Bob do all this?- We will go came back to it!

15 RSA cryptosystem University of Kathmandu, December 14, Alice: Encryption Represent the message P as an element of Z/MZ (for example) A 1 B 2 C 3... Z 26 AA NEPAL = Note. Better if texts are not too short. Otherwise one performs some padding C = E(P) = P e (mod M) Example: p = , q = , M = , e = = 65537, P = NEPAL: E(NEPAL) = (mod ) = = C = ZKUFANERFPXDKAA

16 RSA cryptosystem University of Kathmandu, December 14, Bob: Decryption P = D(C) = C d (mod M) Note. Bob decrypts because he is the only one that knows d. Therefore (ed 1 mod ϕ(m)) Theorem. (Euler) If a, m N, gcd(a, m) = 1, a ϕ(m) 1 (mod m). If n 1 n 2 mod ϕ(m) then a n 1 a n 2 mod m. D(E(P)) = P ed P mod M Example(cont.):d = mod ϕ( ) = D(ZKUFANERFPXDKAA) = (mod ) = NEPAL

17 RSA cryptosystem University of Kathmandu, December 14, RSA at work

18 RSA cryptosystem University of Kathmandu, December 14, Repeated squaring algorithm Problem: How does one compute a b mod c? (mod ) Compute the binary expansion b = [log 2 b] j=0 ɛ j 2 j = Compute recursively a 2j mod c, j = 1,..., [log 2 b]: ( 2 a 2j mod c = a 2j 1 mod c) mod c Multiply the a 2j mod c with ɛ j = 1 ) a b mod c = mod c ( [log2 b] j=0,ɛ j =1 a2j mod c

19 RSA cryptosystem University of Kathmandu, December 14, #{oper. in Z/cZ to compute a b mod c} 2 log 2 b ZKUFANERFPXDKAA is decrypted with 131 operations in Z/ Z Pseudo code: e c (a, b) = a b mod c e c (a, b) = if b = 1 then a mod c if 2 b then e c (a, b 2 )2 mod c else a e c (a, b 1 2 )2 mod c To encrypt with e = , only 17 operations in Z/MZ are enough

20 RSA cryptosystem University of Kathmandu, December 14, Key generation Problem. Produce a random prime p subproblems: Probabilistic algorithm (type Las Vegas) 1. Let p = Random( ) 2. If isprime(p)=1 then Output=p else goto 1 A. How many iterations are necessary? (i.e. how are primes distributes?) B. How does one check if p is prime? (i.e. how does one compute isprime(p)?) Primality test False Metropolitan Legend: Check primality is equivalent to factoring

21 RSA cryptosystem University of Kathmandu, December 14, A. Distribution of prime numbers Quantitative version: π(x) = #{p x t. c. p is prime} Theorem. (Hadamard - de la vallee Pussen ) π(x) x log x Therefore Theorem. (Rosser - Schoenfeld) if x 67 x log x 1/2 < π(x) < x log x 3/ < P rob ( (Random( ) = prime ) <

22 RSA cryptosystem University of Kathmandu, December 14, If P k is the probability that among k random numbers there is a prime one, then P k = 1 ( ) k 1 π(10100 ) Therefore < P 250 < To speed up the process: One can consider only odd random numbers not divisible by 3 nor by 5. Let Ψ(x, 30) = # {n x s.t. gcd(n, 30) = 1}

23 RSA cryptosystem University of Kathmandu, December 14, To speed up the process: One can consider only odd random numbers not divisible by 3 nor by 5. Let Ψ(x, 30) = # {n x s.t. gcd(n, 30) = 1} then 4 4 x 4 < Ψ(x, 30) < x + 4 Hence, if P k is the probability that among k random numbers coprime with 30, there is a prime one, then P k = 1 ( ) k 1 π(10100 ) Ψ(10 100, 30) and < P 250 <

24 RSA cryptosystem University of Kathmandu, December 14, B. Primality test Fermat Little Theorem. If p is prime, p a N a p 1 1 mod p NON-primality test M Z, 2 M 1 1 mod M => Mcomposite! Example: 2 RSA mod RSA 2048 Therefore RSA 2048 is composite! Fermat little Theorem does not invert. Infact (mod 93961) but =

25 RSA cryptosystem University of Kathmandu, December 14, Strong pseudo primes From now on m 3 mod 4 (just to simplify the notation) Definition. m N, m 3 mod 4, composite is said strong pseudo prime (SPSP) in base a if a (m 1)/2 ±1 (mod m). Note. If p > 2 prime => a (p 1)/2 ±1 (mod p) Let S = {a Z/mZ s.t. gcd(m, a) = 1, a (m 1)/2 ±1 (mod m)} ➀ S (Z/mZ) subgroup ➁ If m is composite => proper subgroup ➂ If m is composite => #S ϕ(m) 4 ➃ If m is composite => P rob(m SPSP in base a) 0, 25

26 RSA cryptosystem University of Kathmandu, December 14, Miller Rabin primality test Let m 3 mod 4 Miller Rabin algorithm with k iterations N = (m 1)/2 for j = 0 to k do a =Random(m) if a N ±1 mod m then OUPUT=(m composite): endfor OUTPUT=(m prime) END Monte Carlo primality test P rob(miller Rabin says m prime and m is composite) 1 4 k In the real world, software uses Miller Rabin with k = 10

27 RSA cryptosystem University of Kathmandu, December 14, Deterministic primality tests Theorem. (Miller, Bach) If m is composite, then GRH => a 2 log 2 m s.t. a (m 1)/2 ±1 (mod m). (i.e. m is not SPSP in base a.) Consequence: Miller Rabin de randomizes on GRH (m 3 mod 4) for a = 2 to 2 log 2 m do if a (m 1)/2 ±1 mod m then OUPUT=(m composite): endfor OUTPUT=(m prime) END Deterministic Polynomial time algorithm It runs in O(log 5 m) operations in Z/mZ.

28 RSA cryptosystem University of Kathmandu, December 14, Top 10 Largest primes: Certified prime records Nowak 2005 Mersenne 42? Findley 2004 Mersenne 41? Shafer 2003 Mersenne 40? Cameron 2001 Mersenne Gordon SB Hajratwala 1999 Mersenne Sundquist Hassler Clarkson 1998 Mersenne 37 Mersenne s Numbers:M p = 2 p 1 For more see

29 RSA cryptosystem University of Kathmandu, December 14, The AKS deterministic primality test Department of Computer Science & Engineering, I.I.T. Kanpur, Agost 8, Nitin Saxena, Neeraj Kayal and Manindra Agarwal New deterministic, polynomial time, primality test. Solves #1 open question in computational number theory

30 RSA cryptosystem University of Kathmandu, December 14, How does the AKS work? Theorem. (AKS) Let n N. Assume q, r primes, S N finite: q r 1; n (r 1)/q mod r {0, 1}; gcd(n, b b ) = 1, b, b S (distinct); ( ) q+#s 1 #S n 2 r ; (x + b) n = x n + b in Z/nZ[x]/(x r 1), b S; Then n is a power of a prime Bernstein formulation Fouvry Theorem (1985) => r log 6 n, s log 4 n => AKS runs in O(log 17 n) operations in Z/nZ. Many simplifications and improvements: Bernstein, Lenstra, Pomerance...

31 RSA cryptosystem University of Kathmandu, December 14, Why is RSA safe? It is clear that if Charles can factor M, then he can also compute ϕ(m) and then also d so to decrypt messages Computing ϕ(m) is equivalent to completely factor M. In fact p, q = M ϕ(m) + 1 ± (M ϕ(m) + 1) 2 4M 2 RSA Hypothesis. The only way to compute efficiently x 1/e mod M, x Z/MZ (i.e. decrypt messages) is to factor M In other words The two problems are polynomially equivalent

32 RSA cryptosystem University of Kathmandu, December 14, Two kinds of Cryptography Private key (or symmetric) Lucifer DES AES Public key RSA Diffie Hellmann Knapsack NTRU