Topic 6. Digital Signatures and Identity Based Encryption

Transcription

1 Topic 6. Digital Signature and Identity Baed Encryption. Security of Public-key Cryptography 2. Example of Public-key Algorithm: Diffie- Hellman Key Exchange Scheme 3. RSA Encryption and Digital Signature 4. ElGamal Digital Signature 5. DSS (Digital Signature Standard) 6. LFSR baed DSA (GH and XTR) 7. ECDSA (Elliptic Curve Digital Signature Algorithm) 8. Pairing-baed Identity Baed cryptoytem Gong

2 . Security of Public-key Cryptography Bob public key Bob private key Plaintext Alice Encryption algorithm Ciphertext Decryption algorithm Plaintext Bob A. Simplified Model of Public-Key Gong 2

3 B. Requirement of Public-key Cryptography One-way function: x eay infeaible f(x) Trapdoor one-way function: x eay infeaible if k i not known eay if k i known f Gong 3

4 Therefore, ecurity of public-key cryptoytem are baed on the difficulty of different computational problem. Mot important one are - Factoring large integer - Finite field dicrete logarithm - Elliptic curve dicrete Gong 4

5 Key pair of the public-key ytem In a ecure network ytem, each uer x ha a pair of key (E x, D x ): E x i an encryption key which i put into a public key directory or a file (after certified), called a public-key of the uer. D x i a decrypted key kept private, called a private key of the uer. D x (E x ) = E x (D x ) = identity map From known E x, it i computational infeaible to obtain D x Alice C = E b (m) Bob: D b (C) = D b E b (m) = Gong 5

6 2. Diffie-Hellman Key Exchange the firt example of the public-key cheme Sytem public parameter: p: a prime number, g: a primitive element in GF(p). Alice: Private key: a, 0 < a < p, and gcd(a, p - ) = Public key: g a Bob: Private key: b, 0 < b < p, and gcd(b, p -) = Public key: g Gong 6

7 Diffie-Hellman Key Exchange Alice a g a Bob b g b (g b a ) = g ba b (g a ) = g Gong 7

8 Example. Let p = 23. Then g = 5 i a primitive element of GF(p). Public key : g Compute: (g 3 7 ) 7 Alice Private key : a = = 5 7 = 0 = 7 mod 23 7 = 4 7 mod 23 g 7 =7 g 3 =0 ( g Private key : b = Public - key : g 3 = 5 Bob 3 Compute: 7 ) 3 = 7 3 = 0 mod3 3 = 4 mod 23 The ecret information hared by Alice and Bob i 4. Attacker: known 7 g 2 g 3 = 7" % $ g = 0 "# = 4? In other word, i attacker able to compute g ab from known g a and g b?

9 Diffe-Hellman Problem: Given g a and g b, compute g ab. Thu the Diffe-Hellman key exchange cheme i ecure if the DH problem i computationally infeaible. The DH problem i computational feaible if the olving dicrete logarithm in GF(p) i computationally feaible. Thu, we may ay that the ecurity of the DH key exchange cheme i baed on the difficulty of olving dicrete logarithm in the finite field GF(p). Remark. The DH key exchange cheme ha a very important application in key ditribution and management, we will dicu more propertie of the DH key exchange cheme Gong 9

10 Miletone work in public-key cryptography W. Diffie and M. E. Hellman, New direction in cryptography, IEEE Tran. On Inform. Theory, Vol. 22, pp , Gong 0

11 3. RSA Encryption and Digital Signature More about number theory (a) The Euclidean algorithm for computing gcd(a, b), the greatet common divior of two poitive integer a and b, b > a. Input: a and b, b > a Output: d = gcd(a, b) Procedure_(a, b, d) Set r b and r = 0 = a Return: r m Compute: r, < r < r 0 = b = qr + r2 0 r, < r < r = q2r2 + r In other word, gcd(a,b) = r m r, < r < r 2 = q3r3 + r4 0 r = q m m M r m 4 Gong

12 (b) The Chinee Remainder Theorem Let m,..., m r are pairwie relatively prime, i.e., gcd( mi, m ) = if i, and a,..., a r are integer, then the ytem of r congruent equation: X a mod m X a 2 mod m 2 M X a r mod m r ha a unique olution X modulo M = m m r, which i given by X " r i= a M i i y i mod M where M = i M / mi and y i = " M i mod mi, for i Gong 2

13 Example. Suppoe r = 3, m = 7, m 2 = and m 3 = 3, then M =00 M = M / m = 43 = M 2 = 9 = 3mod M 3 = 77 = 2 mod3 3mod 7 and y =, y = 4 and y = If X X X 5 mod 7 3 mod 0 mod3 Then X = mod00 = 3907 mod00 = 894 Gong 3

14 (c) Lagrange Theorem: uppoe that G i a multiplicative group of order n (i.e. G =n) and g G, then the order of g divide n. * # ( n) Corollary: If b" Z, then b mod n, n where φ(n) i the Euler function (i.e., φ(n) i the number of integer in the range of and n coprime with n), then Z * n = { a Z gcd( n, a) n = Gong 4

15 RSA Encryption Uer Bob et up:. Generate two large prime p and q. 2. Compute n = pq and φ(n) = (p-)(q-) 3. Chooe a random number e: 0 < e < φ (n) uch that gcd(e, φ (n) ) =. 4. Compute d = e - mod φ(n) uing the Euclidean algorithm. 5. Do regitration for hi public-key {n, e} for getting a certificate for the public-key and publih it in the public-key certificate center. Keep {d, p, q} a hi private key. Encryption: Plaintext m < n: ciphertext c = m e mod n Decryption: m = c d, (c e ) d = c mod Gong 5

16 The RSA Algorithm Key Generation Select: p and q both prime; n = pq; e: gcd(e, φ(n)) =, <e< φ(n). Compute: d = e - mod φ(n). Public key: {e, n}. Private key: {d, p, q} Encryption Plaintext: m < n Ciphertext: c = m e mod n Decryption Ciphertext: c Plaintext: m = c d mod n

17 Example 2. Set up tep: Bob:. Chooe p = 0 and q = 3 2. Compute n = pq = 43 and φ(n) =00 2=200= Chooe e = 3533 with gcd(3533, φ(n)) = 4. Compute d = e - = 6597 mod Bob Public key: {3533, 43}, private key: { 6597, 0,3} Encryption: Alice want to end m = 9726 to Bob. She then compute c = mod 43=576 Decryption: Bob: c 6597 = (9726) = Gong 7

18 Remark: Requirement for election of p and q.. p and q hould differ in length only a few digit. 2. Both p - and q - hould contain a large prime factor. 3. gcd(p -, q - ) hould mall. 4. d hould not be mall: d > n/4. Security of RSA: Security of RSA depend on the difficulty to compute d from known {e, n}. However, d = e - mod φ(n). Uually it i difficult to find a way to compute φ(n) except for knowing p and q. Thu the ecurity of RSA depend on the difficulty of factorization of a large integer Gong 8

19 Requirement of Digital Signature Everyone can verify digital ignature. Only the igner can ign; no one can forge the igner ignature (thi prevent forgery and denial attack.) Once a dipute occur, a third party can olve Gong 9

20 RSA Digital Signature Algorithm (RSA-DSA) Signer: - Select p and q both prime; n = pq; e: gcd(e, φ(n)) =, <e< φ(n). Compute: d = e - mod φ(n). Public key: {e, n}. Private key: {d, p, q} - h(.): a hah function (e.g. SHA-) Signer Compute h(m) and r = h( m) d mod n r i a digital ignature of the meage m Note. Hahing function h i public, which can be choen a either MD5 (Meage diget algorithm), Rivet 990, or SHA or SHA2 (Secure Hah Algorithm), NIST, 995. Employing a hahing function i required in any DSA. Verifier compute check whether r e = h(m) r e mod n () If () i true, accept a a valid ignature. Otherwie, reect it. Note 2: Mot frequently ued in wirele communication ince e can be choen a 3 which extremely ave the cot of the verification proce.

21 RSA-DSA (Cont.) Bob: igner Meage m m m r Hah: h r = h(m) d mod n r ignature d: Bob private key RSA-DSA Signing Gong 2

22 Alice: verifier RSA-DSA Verifying Proce m Hah: h r r e =h(m)? mod n e: Bob public Gong 22

23 The following three miletone work which etablihed the foundation of public-key cryptology:. W. Diffe and M. E. Hellman, New direction in cryptography, IEEE Tran. On Inform. Theory, Vol. 22, pp , R. L. Rivet, A. Shamir and L. Adleman, A method for obtaining digital ignature and public cryptoytem, Communication of ACM, Vol. 2, No.2, pp.20-26, Feb T. Elgamal, A public-key cryptoytem and ignature cheme baed on dicrete logarithm, IEEE Tran. on Inform. Theory, vol. IT-3, pp , July, Gong 23

24 4 ElGamal Digital Signature Algorithm - Sytem public key: p, a prime, and g a primitive element in GF(p) - h(.): a hah function - Signer, private key: 0< x < p with (x, p ) =, public key: y = g x. Signing (a) randomly pick k: 0 < k < Q coprime with Q (per meage) (b) compute r = g k (c) olve for t in the equation: h(m) xr +kt (mod Q) Verifying Check whether m = y r () If () i true, accept a a valid ignature. Otherwie, reect it. r (r, t) i a digital ignature of the meage Gong 24

25 ElGamal and DSS Signing Proce Meage m m r m α x r = α k Hah Sign (r, ) ignature x: private key k: ecret number per Gong 25

26 ElGamal and DSS Verifying Proce m Hah r Verifying y =α x : public Gong 26

27 Security of the ElGamal Signature Scheme: Conider m = xr + k mod p () x If the attacker can compute y = to obtain x, then he can forge any ignature ince in () he can pick k to compute r, and therefore, obtain. Thu the ecurity of the ElGamal digital ignature algorithm i baed on the difficulty of olving dicrete log problem in F p. Remark: The random number k hould be different per Gong 27

28 Example. Sytem parameter: p = 23, (p = 2 ) then α = 5 primitive in Z 23 Signing Proce: Uer Bob: Private key: x = 3 Public-key: y = 5 3 =0 Meage m = 7 (We aume that thi i the hahed value for implicity, i.e., h(m) = 7.) (a) Pick a random number k = 9 (b) Compute r = 9 = 5 m = xr + k mod p- 9 = mod 23 (c) Solving for in the equation: = k ( m xr) = 5(7 3" ) = 2 mod 22 Signature: (r, ) = (, 20) Verifying proce: Check whether Compute: m r r y m = 5 7 = 7 = 0 = 20 y r r and = 22 6 = 7 Thu, (, 20) i a valid ignature of m = Gong 28

29 5. Digital Signature Standard (DSS), NIST 94 Sytem Parameter p: prime with bit length of 52-bit and 024-bit in increment of 64-bit, i.e., logp { k k = 0,,, 8}. q: a prime factor of (p - ) where < q < 2 (i.e., bit length of q i about 60 bit.) α GF(p) with order q. The element α can be elected in the following way: for 0 < u < p if ( p )/ q ( p )/ q u >, then et " = u Uer A: elect 0 < x < q a hi private key, compute Signing (a) randomly pick k: 0 < k < Q coprime with Q (per meage) (b) compute r = g k (c) olve for in the equation: h(m) xr +k (mod Q) (r, ) i a digital ignature of the meage m (both r and are 60-bit number). ) x y = a hi public key. Verifying (a) etting u = h(m)t - mod Q v = r t - mod Q (b) compute w = g u y v (c) check whether w = r () If () i true, accept a a valid ignature. Otherwie, reect it.

30 6. LFSR baed DSA (GH and XTR) Mathematical Tool of Deign of A New Public-key Cryptoytem -- GH-PKS - Third-order Characteritic Sequence - Motivation of GH (Gong-Harn) -PKS - Two Theorem on 3rd-order Characteritic equence GH-DH Key Agreement Protocol and the XTR Gong 30

31 A. Mathematical Tool for the Deign of GH-PKS Third-order Characteritic Sequence: Let q be a prime or a power of a prime and f(x) = x 3 a x 2 + bx, a, b GF(q), be irreducible over GF(q). A equence { k } i aid to be an LFSR equence generated by f(x) if If an initial tate of { k } i given by 3+k = a 2+k + b +k + k, k = 0,, 0 = 3, = a, and 2 = a 2 2b, then { k } i called a (3rd-order) characteritic equence. We denote k = k (a, b), k = Gong 3

32 Example. Let K = GF(5), r = 3 and f(x) = x 3 + x which i irreducible over K. The characteritic equence generated by f(x): which ha period 3 = The reciprocal polynomial of f(x) i f ( x) = x 3 x Gong 32

33 3 4 0 Output Output Figure 2. A Pair of Reciprocal LFSR in Gong 33

34 @G. Gong One period of the LFSR f(x) = x 3 + x and it reciprocal

35 0, -,, -k, Output Output ,,, k, b -a a -b Figure 2. A Pair of Reciprocal Gong 35

36 Profile of Third-order Characteritic Sequence Period : a factor of q 2 + q + Trace repreentation: k k kq kq k = Tr( ) = + +, k 2 = 0,,... where α i a root of f(x) in the extenion field GF(q 3 Gong 36

37 Motivation of GH-PKS Develop a PKC whoe ecurity i baed on the difficulty of olving the dicrete logarithm (DL) in GF(q 3 ), but all computation are performed in GF(q). Ideal candidate: LFSR equence of order 3. Two iue need to be olved: Commutative law among the term of 3rdorder char. equence. Fat computation algorithm for evaluating k, the k th term of the equence, Gong and Harn Gong 37

38 Two Theorem We denote k = k (a, b). Theorem (Commutative Law) Let f(x) = x 3 a x 2 + bx be irreducible over GF(q) and { i } be the char. equence generated by f(x). Then for any poitive integer k and e, ( ( a, b), ( a, b)) ( a, b) k e e = where -e (a, b) = e (b, a) which i the reciprocal equence of the equence { i (a, b)}. Gong 38

39 -ke ke k k -e e Gong 39

40 Theorem 2 (Dual State Fat Evaluation Algorithm (DSEA), Gong and Harn 999) Given an poitive integer k, the kth term of a pair of the reciprocal charateritic equence, ( k, -k ) can be computed in 9logk multiplication in GF(q) in Gong 40

41 B. The GH-DH Key Agreement Protocol (999) and the XTR Sytem public parameter: p: a prime number, and q a power of p f(x) = x 3 a x 2 + bx, irreducible over GF(q) with period Q = q 2 + q + Alice: Private key: e, 0 < e < Q with (e, Q)= Public key: ( e, -e ) Bob: Private key: r, 0 < r < Q with (r, Q)= Public key: ( r, -r ) The hared key: ( er, -er Gong 4

42 The GH-DH Key Agreement Protocol Alice e ( e, -e ) r Bob ( r, -r ) e ( r, -r ) = er -e ( r, -r ) = -er r ( e, -e ) = re -r ( e, -e ) = -re The hared key: ( er, -er Gong 42

43 Example 2. For implicity, we will ue q = p = 5 to demontrate the GH-DH key agreement protocol. Sytem parameter: q = p = 5 and f(x) = x 3 + x in E.g.. Alice: e = 3, ( 3, -3 ) = (3, 4) Uing Bob public-key to form a pair of the reciprocal polynomial: f 6 (x) = x 3 x 2 and f -6 (x) = x 3 + x Bob: r = 6, ( 6, -6 ) = (, 0) Uing Alice public-key to form a pair of the reciprocal polynomial: f 3 (x) = x 3 3x 2 +4x and f -3 (x) = x 3 4x 2 +3x f 6 (x): f -6 (x): ( 6, -6 ) = 4 and -3 ( 6, -6 ) = 3 f 3 (x): f -3 (x): ( 3, -3 ) = 4 and -6 ( 3, -3 ) = 3 Common key: (4, 3) Common key: (4, 3)

44 Alice (private key e = 3) -3 ( 6, -6 ) = 3 = -8 3 ( 6, -6 ) = 4 = 8-6 = 0 0 = 3 6 Gong 44

45 Bob (private key r = 6) -6 ( 3, -3 ) = 3 = -8 6 ( 3, -3 ) = 4 = 8-3 = 4 0 = 3 3 = Gong 45

46 Profile of GH-DH for the verion q = p 2 Security: the difficulty of olving dicrete logarithm in the finite field GF(p 6 ) 70 bit GH-DH 70 bit EC-DH 024 bit RSA 024 bit Gong 46

47 Related Public-key XTR (Lentra and Verheul, 2000) uing pecial characteritic equence Sytem public parameter: p, a prime number and q = p 2 f(x) = x 3 a x 2 + a p x, irreducible over GF(q) with period Q p 2 p + Alice: Private key: e, 0<e<Q Bob: Private key: r, 0<r<Q Public key: e Public key: r The hared key: e ( r, r p ) = er = r ( e, e p Gong 47

48 XTR Alice e e Bob r r e ( r, r p )= er r ( e, e p )= re Common key: Gong 48

49 @G. Gong 49 Let { k } be generated by f(x), State vector: State tranition matrix: State Tranition of LFSR Sequence ),, (, + + = n L " # $ $ $ $ $ $ % & ' ' ' = ' ' ' ' ) ( 0 0 ) ( 0 0 ) ( n n n n a a a A L L n n A A ),, ( ),, (, 0 2, + = = = L L L Let " # $ $ $ $ $ % & = ' + + ) ( n M M n ) ( ) ( x x x a n n n n + +L+ Property. )) ( (0) ( M M v v + = Therefore, the (v+)th term, v+, i the inner product of v and the firt column of. ) ( (0) M M State tranition formula: C. GH-DSA

50 @G. Gong 50 Algorithm 2. An Algorithm for Computing a Mixed Term v+, Unknown Input: v and. Output: v+,, the (v+)th term of the Char. Sequence. Procedure: Step : Applying DSEA to compute, the vth tate of the LFSR f(x). Step3: Pack the matrice M(0), and M(): compute the inner product of v and the firt column of, which give v+, ( are computed from the linear recurive relation from ). ),, ( = v v v v " # $ $ $ % & = (0) a a M " # $ $ $ % & = ) ( M ) ( (0) M M ),, ( = 4 3 and + +

51 GH-DSA: ElGamal-like Digital Signature Algorithm of Degree 3 - Sytem public key: p, a prime, q = p v, Q, a prime factor of q 2 + q + for v 2 and Q = P P 2, P p 2 + p +, P 2 p 2 - p + for v = 2 re., and f(x) = x 3 a x 2 + bx, irreducible over GF(q) with period Q - h(.): a hah function (SHA-) - Signer, private key: 0< x < Q with (x, Q) =, public key y,, x ). = ( x x+ x+ 2 Signer randomly pick k: 0 < k < Q coprime with Q (per meage) applying the DSEA to compute ( k, k ) etting r, an integer converted from k olve for t in the equation: h(m) xr +kt (mod Q) (r, t) i a digital ignature of the meage m ( -k need to be tranmitted) Verifier etting v = h(m)t - mod Q u = r t - mod Q compute A = v+x by Algorithm 2 by the DSEA, compute B = u ( f k ), the uth term of the char. equence of the LFSR f k ( x 3 2 ) = x x + x k check whether A = B () If () i true, accept. Otherwie, reect. Gong 5

52 Signer: x ( x, x+, x+ 2) (DSEA) Verifier: m, r, h(x) t, r Signing for the meage m: k f k = ( k, k ( x, x+, x+ 2) ) (DSEA) v = h( m) r A v + x = (Alg 2) u = tr ( k, k ) B = u ( f k )(DSEA) x k m r = convert( h ( m) xr + kt (mod Q) k ) A =? B t Ye, accept it. No, reect it. Signature: (r, t). Sign and Verifi. of Gong 52

53 Reference. G. Gong and L. Harn, Public-key cryptoytem baed on cubic finite field extenion, IEEE Tran. on Inform. Theory, vol. IT-45, No.7, November 999, pp GH-RSA i alo dicued in thi paper. 2. G. Gong, L. Harn and H.P. Wu, The GH public-key cryptoytem, the Proceeding of the Eighth Annual Workhop on Selected Area in Cryptography, Toronto, Augut 6-8, Gong 53

54 Reference of Some Related Work W. Diffie and M.E. Hellman, New direction in cryptography, IEEE Tran. On Inform. Theory, vol. IT-22, November 976, pp Comment: Exponentiation in DH can be conidered a evaluating k th term of a firt order LFSR equence over GF(q). W.B. Müller and W. Nöbauer, "Cryptanalyi of the Dickon-cheme, " Advance in Cryptology, Proceeding of Eurocrypt'85, pp P. Smith, "LUC public-key encryption, " Dr. Dobb' Journal, pp , January 993. Comment: The mathematical function ued in thi family of the public-key cryptoytem i a 2 nd -order LFSR characteritic equence over GF(p). A.K. Lentra and E.R. Verheul, The XTR public key ytem, Advance in Cryptology, Proceeding of Crypto2000, pp. -9, Augut, Comment: the mathematical function i a 3 rd -order LFSR characteritic equence over GF(p 2 ) which i a pecial cae of the equence ued in the GH public key cryptoytem. Karl Rubin, Alice Silverberg, Toru-baed cryptography, Advance in Cryptology, Proceeding of Crypto2003, Augut Comment: Generalize GH and XTR in a general model uing an algebraic tool: Gong 54