The RSA public encryption scheme: How I learned to stop worrying and love buying stuff online

Transcription

1 The RSA public encryption scheme: How I learned to stop worrying and love buying stuff online Anthony Várilly-Alvarado Rice University Mathematics Leadership Institute, June 2010

2 Our Goal Today I will describe how it is possible to safely send your credit card number over the internet to a trusted party you have never met. Why? Bring Math to life with a monumentally important application. Illustrate why pushing the boundary of pure Math is so important to our society s development. We can teach this to high-school students! (over many weeks)

3 Public key cryptography: What is it? A definition by example. Suppose that Alice wants to send a message half way around the world to Bob. The content of the message is a secret, and it is extremely important that nobody but Bob be able to read the message. There are two complications: Eave, a character with malicious intentions, will likely intercept the message. Alice and Bob have never met, so they don t have a secret code in place.

4 Public key cryptography: What is it? What can Alice and Bob do? Somehow, they have to establish a secret code in plain sight. They must assume that Eave can read anything they send to each other. Public key cryptography is a subject that, at heart, aims to produce solutions to this seemingly impossible task.

5 The Lunchbox Metaphor Here s one way to solve the problem: Bob sends Alice a lunchbox with an open padlock inside it. He keeps the key. Alice puts the message inside the lunchbox and uses the padlock to seal the lunchbox. She is no longer able to retrieve the message. Alice sends the sealed lunch box back to Bob. Bob uses his key to open the lunchbox and read Alice s message. Note: there is nothing Eave can do to read the message. To make this metaphor into a precise, mathematical crytosystem, we need the notion of modular arithmetic.

6 Modular Arithmetic Fix: A positive whole number n (the modulus). Two (possibly negative) integers a and b. We say that a is congruent to b modulo n, and write if a b is divisible by n. Example a b mod n Take n = 5, a = 27 and b = 8. Then 27 8 mod 5 because 27 8 = 35 is divisible by 5. In fact, 7 5 = 35, so 7 is the witness to this divisibility relation.

7 Examples mod 4 because = 32 is divisible by mod 19 because 27 8 = 19 is divisibile by mod 9 because 36 0 = 36 is divisible by 9.

8 Audience participation True or False? mod 5? = 5. True or False: mod 12? = 15. True or False: mod 7? = 91.

9 Audience participation True or False? mod 5? = 5. True or False: mod 12? = 15. True or False: mod 7? = 91.

10 Audience participation True or False? mod 5? = 5. True or False: mod 12? = 15. True or False: mod 7? = 91.

11 Audience participation True or False? mod 5? = 5. True or False: mod 12? = 15. True or False: mod 7? = 91.

12 The Power Property Fact Let k be a non-negative integer, and fix n, a and b as above. Then a b mod n = a k b k mod n. Let s see this in an example. We have 12 2 mod 5. Take k = 2. Then the theorem says that Let s simplify: mod mod 5. This is true: = 140 is divisible by 5.

13 Congruences multiply Fact Let c be an integer, and fix m, a and b as above. Then a b mod n = ca cb mod n. Proof. Since a b is divisible by n we know that there is a witness integer r such that a b = rn Multiply both sides by c: ca cb = crn. Hence ca cb is divisible by n as well (cr is a witness!).

14 Euler s φ function The last ingredient we need is Euler s φ function, which takes as input a positive number n and is defined as follows: φ(n) = number of integers between 1 and n 1 that have no common factors with n (other than 1). For example: φ(12) = 4 because out of {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11}, there are four integers, namely {1, 5, 7, 11} that don t share a common factor with 12.

15 Facts about Euler s φ function If p is prime then φ(p) = p 1. (Because every number smaller than p doesn t share a factor with p.) If p and q are two prime numbers, then φ(pq) = (p 1)(q 1). (Harder.) Euler s Theorem: If m and n are integers with no common factors, then m φ(n) 1 mod n. For example: take n = 12 and m = 5. Then φ(12) = 4 and we get mod 12, i.e., mod 12. This is true because = 624 =

16 The RSA cryptosystem RSA stands for Rivest, Shamir and Adleman, three cryptographers who came up with the following algorithm at MIT in 1978.

17 Step 1: The Public Key In our metaphor, Bob sent Alice an open lock (to which he kept the key). Mathematically, the padlock is called the public key. Bob chooses two BIG primes p and q. He computes n = pq. This will be our modulus. He computes φ(n) = φ(pq) = (p 1)(q 1). He picks an integer e in the range 1 < e < φ(pq) such that e and φ(pq) don t share a common factor. He finds an integer d such that de 1 mod φ(n). The pair of integers (n, e) is the public key. Bob sends them to Alice in the clear (i.e. Eave also knows what n and e are). The integer d is the private key (the key to the padlock in our metaphor).

18 Factoring integers is HARD Something important to note: Eave can get a hold of (n, e). If Eave can figure out what p and q are, then she can also figure out what d is! RSA relies heavily on the idea that factoring large numbers is a REALLY HARD problem.

19 Step 2: Encryption Alice is now in possession of of Bob s public key (n, e). Say Alice s credit card number is m. (Technical assumption: we need m < n and we need m and n to share no common factors. This is all easy to arrange.) Alice computes m e. She divides m e by n. Call the remainder c. In other words: c m e mod n. The number c is called the ciphertext. It s the scrambled message. Alice sends c to Bob in the clear. Eave can see it.

20 Step 3: Decryption Bob is now in possession of the scrambled message c. He also has the private key d, which no one else has. Here s the magic trick: the remainder when c d is divided by n is m. In other words: c d m mod n So Bob can figure out what m is!

21 Proof Recall that de 1 mod φ(n). This means that de 1 is divisible by n. Say that de 1 = kφ(n) so k is the witness to the division. Let s rewrite this as Now for the one line proof: de = 1 + kφ(n). c d (m e ) d m de m 1+kφ(n) m(m φ(n) ) k m 1 k m mod n.

22 In slow motion m φ(n) 1 mod n Euler s theorem = m kφ(n) 1 k mod n The Power Property = m kφ(n) 1 mod n = m 1+kφ(n) m mod n Congruences multiply = m de m mod n because de = 1 + kφ(n) = (m e ) d m mod n Law of Exponentiation = c d m mod n because c m e mod n QED.

23 Why RSA works There are two reasons why RSA is safe: Factoring integers is hard. The RSA problem: if we know c, n and e, and if c m e mod n then there is no known way to compute m!!! In other words, taking e-th roots modulo n is also hard.

24 Where can I learn more? Wikipedia! Just google RSA wiki. Introduction to cryptography by Johannes Buchmann.