Winter 2011 Josh Benaloh Brian LaMacchia
|
|
|
- Ashlee French
- 5 years ago
- Views:
Transcription
1 Winter 2011 Josh Benaloh Brian LaMacchia
2 Fun with Public-Key Tonight we ll Introduce some basic tools of public-key crypto Combine the tools to create more powerful tools Lay the ground work for substantial applications February 17, 2011 Practical Aspects of Modern Cryptography 2
3 Challenge-Response Protocols February 17, 2011 Practical Aspects of Modern Cryptography 3
4 Challenge-Response Protocols One party often wants to convince another party that something is true February 17, 2011 Practical Aspects of Modern Cryptography 4
5 Challenge-Response Protocols One party often wants to convince another party that something is true without giving everything away. February 17, 2011 Practical Aspects of Modern Cryptography 5
6 Proof of Knowledge I know the secret key k. February 17, 2011 Practical Aspects of Modern Cryptography 6
7 PoK: Method 1 February 17, 2011 Practical Aspects of Modern Cryptography 7
8 PoK: Method 1 Here is k. February 17, 2011 Practical Aspects of Modern Cryptography 8
9 PoK: Method 2 February 17, 2011 Practical Aspects of Modern Cryptography 9
10 PoK: Method 2 Here is a nonce c. February 17, 2011 Practical Aspects of Modern Cryptography 10
11 PoK: Method 2 Here is a nonce c. Here is the hash (c, k). February 17, 2011 Practical Aspects of Modern Cryptography 11
12 Traditional Proofs February 17, 2011 Practical Aspects of Modern Cryptography 13
13 Traditional Proofs I want to convince you that something is true. February 17, 2011 Practical Aspects of Modern Cryptography 14
14 Traditional Proofs I want to convince you that something is true. I write down a proof and give it to you. February 17, 2011 Practical Aspects of Modern Cryptography 15
15 Interactive Proofs We engage in a dialogue at the conclusion of which you are convinced that my claim is true. February 17, 2011 Practical Aspects of Modern Cryptography 16
16 Graph Isomorphism February 17, 2011 Practical Aspects of Modern Cryptography 17
17 Graph Isomorphism A B E C D February 17, 2011 Practical Aspects of Modern Cryptography 18
18 Graph Isomorphism B C A A E D C D B E February 17, 2011 Practical Aspects of Modern Cryptography 19
19 IP of Graph Isomorphism G 1 G 2 February 17, 2011 Practical Aspects of Modern Cryptography 20
20 IP of Graph Isomorphism Generate, say, 100 additional graphs isomorphic to G 1 (and therefore also isomorphic to G 2 ). February 17, 2011 Practical Aspects of Modern Cryptography 21
21 IP of Graph Isomorphism H 1 H 2 H 3 G 1 G 2 H 100 February 17, 2011 Practical Aspects of Modern Cryptography 22
22 IP of Graph Isomorphism February 17, 2011 Practical Aspects of Modern Cryptography 23
23 IP of Graph Isomorphism Accept a single bit challenge L/R for each of the 100 additional graphs. February 17, 2011 Practical Aspects of Modern Cryptography 24
24 IP of Graph Isomorphism Accept a single bit challenge L/R for each of the 100 additional graphs. Display the indicated isomorphism for each of the additional graphs. February 17, 2011 Practical Aspects of Modern Cryptography 25
25 IP of Graph Isomorphism H 1 H 2 H 3 G 1 G 2 H 100 February 17, 2011 Practical Aspects of Modern Cryptography 26
26 IP of Graph Isomorphism L H 1 H 2 R G 1 G 2 H 3 R L H 100 February 17, 2011 Practical Aspects of Modern Cryptography 27
27 IP of Graph Isomorphism H 1 H 2 H 3 G 1 G 2 H 100 February 17, 2011 Practical Aspects of Modern Cryptography 28
28 IP of Graph Isomorphism February 17, 2011 Practical Aspects of Modern Cryptography 29
29 IP of Graph Isomorphism If graphs G 1 and G 2 were not isomorphic, then the prover would not be able to show any additional graph to be isomorphic to both G 1 and G 2. February 17, 2011 Practical Aspects of Modern Cryptography 30
30 IP of Graph Isomorphism If graphs G 1 and G 2 were not isomorphic, then the prover would not be able to show any additional graph to be isomorphic to both G 1 and G 2. A successful false proof would require the prover to guess all 100 challenges in advance: probability 1 in February 17, 2011 Practical Aspects of Modern Cryptography 31
31 Fiat-Shamir Heuristic February 17, 2011 Practical Aspects of Modern Cryptography 32
32 Fiat-Shamir Heuristic Instead of challenge bits being externally generated, they can be produced by applying a one-way hash function to the full set of additional graphs. February 17, 2011 Practical Aspects of Modern Cryptography 33
33 Fiat-Shamir Heuristic Instead of challenge bits being externally generated, they can be produced by applying a one-way hash function to the full set of additional graphs. This allows an interactive proof to be published without need for interaction. February 17, 2011 Practical Aspects of Modern Cryptography 34
34 IP of Graph Non-Isomorphism February 17, 2011 Practical Aspects of Modern Cryptography 35
35 IP of Graph Non-Isomorphism G 1 G 2 February 17, 2011 Practical Aspects of Modern Cryptography 36
36 IP of Graph Non-Isomorphism A verifier can generate 100 additional graphs, each isomorphic to one of G 1 and G 2, and present them to the prover. February 17, 2011 Practical Aspects of Modern Cryptography 37
37 IP of Graph Non-Isomorphism A verifier can generate 100 additional graphs, each isomorphic to one of G 1 and G 2, and present them to the prover. The prover can then demonstrate that the graphs are not isomorphic by identifying which of G 1 and G 2 each additional graph is isomorphic to. February 17, 2011 Practical Aspects of Modern Cryptography 38
38 IP of Graph Non-Isomorphism G 1 G 2 February 17, 2011 Practical Aspects of Modern Cryptography 39
39 IP of Graph Non-Isomorphism H 1 H 2 H 3 G 1 G 2 H 100 February 17, 2011 Practical Aspects of Modern Cryptography 40
40 IP of Graph Non-Isomorphism H 1 H 2 H 3 G 1 G 2 H 100 February 17, 2011 Practical Aspects of Modern Cryptography 41
41 Proving Something is a Square February 17, 2011 Practical Aspects of Modern Cryptography 42
42 Proving Something is a Square Suppose I want to convince you that Y is a square modulo N. [There exists an X such that Y = X 2 mod N.] February 17, 2011 Practical Aspects of Modern Cryptography 43
43 Proving Something is a Square Suppose I want to convince you that Y is a square modulo N. [There exists an X such that Y = X 2 mod N.] First approach: I give you X. February 17, 2011 Practical Aspects of Modern Cryptography 44
44 An Interactive Proof Y Y 1 Y 2 Y 3 Y 4 Y 5 Y 100 February 17, 2011 Practical Aspects of Modern Cryptography 45
45 An Interactive Proof Y Y 1 Y 2 Y 3 Y 4 Y 5 Y February 17, 2011 Practical Aspects of Modern Cryptography 46
46 An Interactive Proof Y Y 1 Y 2 Y 3 Y 4 Y 5 Y Y Y 1 3 Y 4 February 17, 2011 Practical Aspects of Modern Cryptography 47
47 An Interactive Proof Y Y 1 Y 2 Y 3 Y 4 Y 5 Y Y Y 1 3 Y 4 (Y 2 Y) (Y 5 Y) (Y 100 Y) February 17, 2011 Practical Aspects of Modern Cryptography 48
48 An Interactive Proof February 17, 2011 Practical Aspects of Modern Cryptography 49
49 An Interactive Proof In order for me to fool you, I would have to guess your exact challenge sequence. February 17, 2011 Practical Aspects of Modern Cryptography 50
50 An Interactive Proof In order for me to fool you, I would have to guess your exact challenge sequence. The probability of my successfully convincing you that Y is a square when it is not is February 17, 2011 Practical Aspects of Modern Cryptography 51
51 An Interactive Proof In order for me to fool you, I would have to guess your exact challenge sequence. The probability of my successfully convincing you that Y is a square when it is not is This interactive proof is said to be zero-knowledge because the challenger received no information (beyond the proof of the claim) that it couldn t compute itself. February 17, 2011 Practical Aspects of Modern Cryptography 52
52 Applying Fiat-Shamir Once again, the verifier challenges can be simulated by the use of a one-way function to generate the challenge bits. February 17, 2011 Practical Aspects of Modern Cryptography 53
53 An Non-Interactive ZK Proof Y Y 1 Y 2 Y 3 Y 4 Y 5 Y 100 February 17, 2011 Practical Aspects of Modern Cryptography 54
54 An Non-Interactive ZK Proof Y Y 1 Y 2 Y 3 Y 4 Y 5 Y where the bit string is computed as xxx = SHA-1(Y 1, Y 2,, Y 100 ) February 17, 2011 Practical Aspects of Modern Cryptography 55
55 An Non-Interactive ZK Proof Y Y 1 Y 2 Y 3 Y 4 Y 5 Y Y Y 1 3 Y 4 February 17, 2011 Practical Aspects of Modern Cryptography 56
56 An Non-Interactive ZK Proof Y Y 1 Y 2 Y 3 Y 4 Y 5 Y Y Y 1 3 Y 4 (Y 2 Y) (Y 5 Y) (Y 100 Y) February 17, 2011 Practical Aspects of Modern Cryptography 57
57 Proving Knowledge Suppose that we share a public key consisting of a modulus N and an encryption exponent E and that I want to convince you that I have the corresponding decryption exponent D. How can I do this? February 17, 2011 Practical Aspects of Modern Cryptography 58
58 Proving Knowledge February 17, 2011 Practical Aspects of Modern Cryptography 59
59 Proving Knowledge I can give you my private key D. February 17, 2011 Practical Aspects of Modern Cryptography 60
60 Proving Knowledge I can give you my private key D. You can encrypt something for me and I decrypt it for you. February 17, 2011 Practical Aspects of Modern Cryptography 61
61 Proving Knowledge I can give you my private key D. You can encrypt something for me and I decrypt it for you. You can encrypt something for me and I can engage in an interactive proof with you to show that I can decrypt it. February 17, 2011 Practical Aspects of Modern Cryptography 62
62 A Proof of Knowledge Y February 17, 2011 Practical Aspects of Modern Cryptography 63
63 A Proof of Knowledge Y Y 1 Y 2 Y 3 Y 4 Y 5 Y 100 February 17, 2011 Practical Aspects of Modern Cryptography 64
64 A Proof of Knowledge Y Y 1 Y 2 Y 3 Y 4 Y 5 Y February 17, 2011 Practical Aspects of Modern Cryptography 65
65 A Proof of Knowledge Y Y 1 Y 2 Y 3 Y 4 Y 5 Y Y 1 D Y 3 D Y 4 D February 17, 2011 Practical Aspects of Modern Cryptography 66
66 A Proof of Knowledge Y Y 1 Y 2 Y 3 Y 4 Y 5 Y Y 1 D (Y 2 Y) D Y 3 D Y 4 D (Y 5 Y) D (Y 100 Y) D February 17, 2011 Practical Aspects of Modern Cryptography 67
67 A Proof of Knowledge By engaging in this proof, the prover has demonstrated its knowledge of Y D without revealing this value. If Y is generated by a challenger, this is compelling evidence that the prover possesses D. February 17, 2011 Practical Aspects of Modern Cryptography 68
68 Facts About Interactive Proofs Anything in PSPACE can be proven with a polynomial-time interactive proof. Anything in NP can be proven with a zero-knowledge interactive proof. February 17, 2011 Practical Aspects of Modern Cryptography 69
69 Secret Sharing February 17, 2011 Practical Aspects of Modern Cryptography 70
70 Secret Sharing Suppose that I have some data that I want to share amongst three people such that February 17, 2011 Practical Aspects of Modern Cryptography 71
71 Secret Sharing Suppose that I have some data that I want to share amongst three people such that any two can uniquely determine the data February 17, 2011 Practical Aspects of Modern Cryptography 72
72 Secret Sharing Suppose that I have some data that I want to share amongst three people such that any two can uniquely determine the data but any one alone has no information whatsoever about the data. February 17, 2011 Practical Aspects of Modern Cryptography 73
73 Secret Sharing Some simple cases: AND I have a secret value z that I would like to share with Alice and Bob such that both Alice and Bob can together determine the secret at any time, but such that neither has any information individually. February 17, 2011 Practical Aspects of Modern Cryptography 74
74 Secret Sharing AND Let z Z m = 0,1,, m 1 be a secret value to be shared with Alice and Bob. Randomly and uniformly select values x and y from Z m subject to the constraint that x + y mod m = z. February 17, 2011 Practical Aspects of Modern Cryptography 75
75 Secret Sharing AND The secret value is z = (x + y) mod m. February 17, 2011 Practical Aspects of Modern Cryptography 76
76 Secret Sharing AND The secret value is z = (x + y) mod m. Me x y February 17, 2011 Practical Aspects of Modern Cryptography 77
77 Secret Sharing AND The secret value is z = (x + y) mod m. Me Alice x y February 17, 2011 Practical Aspects of Modern Cryptography 78
78 Secret Sharing AND The secret value is z = (x + y) mod m. Me y February 17, 2011 Practical Aspects of Modern Cryptography 79
79 Secret Sharing AND The secret value is z = (x + y) mod m. Me Bob y February 17, 2011 Practical Aspects of Modern Cryptography 80
80 Secret Sharing AND The secret value is z = (x + y) mod m. Me February 17, 2011 Practical Aspects of Modern Cryptography 81
81 Secret Sharing AND The secret value is z = (x + y) mod m. February 17, 2011 Practical Aspects of Modern Cryptography 82
82 Secret Sharing AND The secret value is z = (x + y) mod m. Alice x February 17, 2011 Practical Aspects of Modern Cryptography 83
83 Secret Sharing AND The secret value is z = (x + y) mod m. Bob Alice x y February 17, 2011 Practical Aspects of Modern Cryptography 84
84 Secret Sharing AND The secret value is z = (x + y) mod m. Bob Alice x y February 17, 2011 Practical Aspects of Modern Cryptography 85
85 Secret Sharing AND This trick easily generalizes to more than two shareholders. February 17, 2011 Practical Aspects of Modern Cryptography 86
86 Secret Sharing AND This trick easily generalizes to more than two shareholders. A secret S can be written as S = (s 1 + s s n ) mod m for any randomly chosen integer values s 1, s 2,, s n in the range 0 s i < m. February 17, 2011 Practical Aspects of Modern Cryptography 87
87 Secret Sharing Some simple cases: OR I have a secret value z that I would like to share with Alice and Bob such that either Alice or Bob can determine the secret at any time. February 17, 2011 Practical Aspects of Modern Cryptography 88
88 Secret Sharing OR The secret value is z. February 17, 2011 Practical Aspects of Modern Cryptography 89
89 Secret Sharing OR The secret value is z. Me z z February 17, 2011 Practical Aspects of Modern Cryptography 90
90 Secret Sharing OR The secret value is z. Me Alice z z February 17, 2011 Practical Aspects of Modern Cryptography 91
91 Secret Sharing OR The secret value is z. Me z February 17, 2011 Practical Aspects of Modern Cryptography 92
92 Secret Sharing OR The secret value is z. Me Bob z February 17, 2011 Practical Aspects of Modern Cryptography 93
93 Secret Sharing OR The secret value is z. Me February 17, 2011 Practical Aspects of Modern Cryptography 94
94 Secret Sharing OR The secret value is z. Alice z February 17, 2011 Practical Aspects of Modern Cryptography 95
95 Secret Sharing OR The secret value is z. Bob z February 17, 2011 Practical Aspects of Modern Cryptography 96
96 Secret Sharing OR This case also generalizes easily to more than two shareholders. February 17, 2011 Practical Aspects of Modern Cryptography 97
97 Secret Sharing More complex access structures I want to share secret value z amongst Alice, Bob, and Carol such that any two of the three can reconstruct z. S = (A B) (A C) (B C) February 17, 2011 Practical Aspects of Modern Cryptography 98
98 Secret Sharing OR AND AND AND A B A C B C February 17, 2011 Practical Aspects of Modern Cryptography 99
99 Secret Sharing z Z m OR AND AND AND A B A C B C February 17, 2011 Practical Aspects of Modern Cryptography 100
100 Secret Sharing z Z m OR z z z AND AND AND A B A C B C February 17, 2011 Practical Aspects of Modern Cryptography 101
101 Secret Sharing z Z m OR z z z AND AND AND z 1 z 2 z 3 z 4 z 5 z 6 A B A C B C February 17, 2011 Practical Aspects of Modern Cryptography 102
102 Threshold Schemes February 17, 2011 Practical Aspects of Modern Cryptography 103
103 Threshold Schemes I want to distribute a secret datum amongst n trustees such that February 17, 2011 Practical Aspects of Modern Cryptography 104
104 Threshold Schemes I want to distribute a secret datum amongst n trustees such that any k of the n trustees can uniquely determine the secret datum, February 17, 2011 Practical Aspects of Modern Cryptography 105
105 Threshold Schemes I want to distribute a secret datum amongst n trustees such that any k of the n trustees can uniquely determine the secret datum, but any set of fewer than k trustees has no information whatsoever about the secret datum. February 17, 2011 Practical Aspects of Modern Cryptography 106
106 Threshold Schemes OR 1 out of n AND n out of n February 17, 2011 Practical Aspects of Modern Cryptography 107
107 Shamir s Threshold Scheme Any k points s 1, s 2,, s k in a field uniquely determine a polynomial P of degree at most k 1 with P i = s i for i = 1, 2,, k. This not only works of the reals, rationals, and other infinite fields, but also over the finite field Z p = 0,1,, p 1 where p is a prime. February 17, 2011 Practical Aspects of Modern Cryptography 108
108 Shamir s Threshold Scheme To distribute a secret value s Z p amongst a set of n Trustees T 1, T 2,, T n such that any k can determine the secret February 17, 2011 Practical Aspects of Modern Cryptography 109
109 Shamir s Threshold Scheme To distribute a secret value s Z p amongst a set of n Trustees T 1, T 2,, T n such that any k can determine the secret pick random coefficients a 1, a 2,, a k 1 Z p February 17, 2011 Practical Aspects of Modern Cryptography 110
110 Shamir s Threshold Scheme To distribute a secret value s Z p amongst a set of n Trustees T 1, T 2,, T n such that any k can determine the secret pick random coefficients a 1, a 2,, a k 1 Z p let P x = a k 1 x k a 2 x 2 + a 1 x + s February 17, 2011 Practical Aspects of Modern Cryptography 111
111 Shamir s Threshold Scheme To distribute a secret value s Z p amongst a set of n Trustees T 1, T 2,, T n such that any k can determine the secret pick random coefficients a 1, a 2,, a k 1 Z p let P x = a k 1 x k a 2 x 2 + a 1 x + s give P(i) to trustee T i. February 17, 2011 Practical Aspects of Modern Cryptography 112
112 Shamir s Threshold Scheme To distribute a secret value s Z p amongst a set of n Trustees T 1, T 2,, T n such that any k can determine the secret pick random coefficients a 1, a 2,, a k 1 Z p let P x = a k 1 x k a 2 x 2 + a 1 x + s give P(i) to trustee T i. The secret value is s = P(0). February 17, 2011 Practical Aspects of Modern Cryptography 113
113 Shamir s Threshold Scheme The threshold 2 case: Example: Range = Z 11 = 0,1,, 10, Secret = 9 February 17, 2011 Practical Aspects of Modern Cryptography 114
114 Shamir s Threshold Scheme The threshold 2 case: Example: Range = Z 11 = 0,1,, 10, Secret = 9 February 17, 2011 Practical Aspects of Modern Cryptography 115
115 Shamir s Threshold Scheme The threshold 2 case: Example: Range = Z 11 = 0,1,, 10, Secret = 9 Secret (0,9) February 17, 2011 Practical Aspects of Modern Cryptography 116
116 Shamir s Threshold Scheme The threshold 2 case: Example: Range = Z 11 = 0,1,, 10, Secret = 9 Secret (0,9) February 17, 2011 Practical Aspects of Modern Cryptography 117
117 Shamir s Threshold Scheme The threshold 2 case: Example: Range = Z 11 = 0,1,, 10, Secret = 9 Secret (0,9) (1,7) Share 1 (2,5) Share 2 (3,3) Share 3 February 17, 2011 Practical Aspects of Modern Cryptography 118
118 Shamir s Threshold Scheme The threshold 2 case: Example: Range = Z 11 = 0,1,, 10, Secret = 9 February 17, 2011 Practical Aspects of Modern Cryptography 119
119 Shamir s Threshold Scheme The threshold 2 case: Example: Range = Z 11 = 0,1,, 10, Secret = 9 Share 1 (1,7) February 17, 2011 Practical Aspects of Modern Cryptography 120
120 Shamir s Threshold Scheme The threshold 2 case: Example: Range = Z 11 = 0,1,, 10, Secret = 9 (1,7) Share 1 Share 3 (3,3) February 17, 2011 Practical Aspects of Modern Cryptography 121
121 Shamir s Threshold Scheme The threshold 2 case: Example: Range = Z 11 = 0,1,, 10, Secret = 9 (1,7) Share 1 Share 3 (3,3) February 17, 2011 Practical Aspects of Modern Cryptography 122
122 Shamir s Threshold Scheme The threshold 2 case: Example: Range = Z 11 = 0,1,, 10, Secret = 9 Secret (0,9) Share 1 (1,7) Share 3 (3,3) February 17, 2011 Practical Aspects of Modern Cryptography 123
123 Shamir s Threshold Scheme The threshold 2 case: Example: Range = Z 11 = 0,1,, 10 February 17, 2011 Practical Aspects of Modern Cryptography 124
124 Shamir s Threshold Scheme The threshold 2 case: Example: Range = Z 11 = 0,1,, 10 Share 1 (1,7) February 17, 2011 Practical Aspects of Modern Cryptography 125
125 Shamir s Threshold Scheme The threshold 2 case: Example: Range = Z 11 = 0,1,, 10 (1,7) Share 1 Share 3 (3,4) February 17, 2011 Practical Aspects of Modern Cryptography 126
126 Shamir s Threshold Scheme The threshold 2 case: Example: Range = Z 11 = 0,1,, 10 (1,7) Share 1 Share 3 (3,4) February 17, 2011 Practical Aspects of Modern Cryptography 127
127 Shamir s Threshold Scheme The threshold 2 case: Example: Range = Z 11 = 0,1,, 10 Secret (0,8.5) Share 1 (1,7) Share 3 (3,4) February 17, 2011 Practical Aspects of Modern Cryptography 128
128 Shamir s Threshold Scheme The threshold 2 case: Example: Range = Z 11 = 0,1,, 10 Secret (0,8.5) Share 1 (1,7) Share 3 (3,4) In Z 11, February 17, 2011 Practical Aspects of Modern Cryptography 129
129 Shamir s Threshold Scheme Two methods are commonly used to interpolate a polynomial given a set of points. February 17, 2011 Practical Aspects of Modern Cryptography 130
130 Shamir s Threshold Scheme Two methods are commonly used to interpolate a polynomial given a set of points. Lagrange interpolation February 17, 2011 Practical Aspects of Modern Cryptography 131
131 Shamir s Threshold Scheme Two methods are commonly used to interpolate a polynomial given a set of points. Lagrange interpolation Solving a system of linear equations February 17, 2011 Practical Aspects of Modern Cryptography 132
132 Lagrange Interpolation February 17, 2011 Practical Aspects of Modern Cryptography 133
133 Lagrange Interpolation For each point (i, s i ), construct a polynomial P i with the correct value at i and a value of zero at the other given points. February 17, 2011 Practical Aspects of Modern Cryptography 134
134 Lagrange Interpolation For each point (i, s i ), construct a polynomial P i with the correct value at i and a value of zero at the other given points. P i x = s i (x j) j i (i j) j i February 17, 2011 Practical Aspects of Modern Cryptography 135
135 Lagrange Interpolation For each point (i, s i ), construct a polynomial P i with the correct value at i and a value of zero at the other given points. P i x = s i (x j) j i (i j) j i Then sum the P i x to compute P x. February 17, 2011 Practical Aspects of Modern Cryptography 136
136 Lagrange Interpolation For each point (i, s i ), construct a polynomial P i with the correct value at i and a value of zero at the other given points. P i x = s i (x j) j i (i j) j i Then sum the P i x to compute P x. P(x) = P i x February 17, 2011 Practical Aspects of Modern Cryptography 137 i
137 Solving a Linear System February 17, 2011 Practical Aspects of Modern Cryptography 138
138 Solving a Linear System Regard the polynomial coefficients as unknowns. February 17, 2011 Practical Aspects of Modern Cryptography 139
139 Solving a Linear System Regard the polynomial coefficients as unknowns. Plug in each known point to get a linear equation in terms of the unknown coefficients. February 17, 2011 Practical Aspects of Modern Cryptography 140
140 Solving a Linear System Regard the polynomial coefficients as unknowns. Plug in each known point to get a linear equation in terms of the unknown coefficients. Once there are as many equations as unknowns, use linear algebra to solve the system of equations. February 17, 2011 Practical Aspects of Modern Cryptography 141
141 Verifiable Secret Sharing Secret sharing is very useful when the dealer of a secret is honest, but what bad things can happen if the dealer is potentially dishonest? Can measures be taken to eliminate or mitigate the damages? February 17, 2011 Practical Aspects of Modern Cryptography 142
142 Homomorphic Encryption Recall that with RSA, there is a multiplicative homomorphism. E x E y E(xy) Can we find an encryption function with an additive homomorphism? February 17, 2011 Practical Aspects of Modern Cryptography 143
143 An Additive Homomorphism Can we find an encryption function for which the sum (or product) of two encrypted messages is the (an) encryption of the sum of the two original messages? E(x) E(y) E(x + y) February 17, 2011 Practical Aspects of Modern Cryptography 144
144 An Additive Homomorphism Recall the one-way function given by f(x) = g x mod m. For this function, f(x)f(y) mod m = g x g y mod m = g x+y mod m = f(x + y) mod m. February 17, 2011 Practical Aspects of Modern Cryptography 145
145 Verifiable Secret Sharing February 17, 2011 Practical Aspects of Modern Cryptography 146
146 Verifiable Secret Sharing Select a polynomial with secret a 0 as P x = a k 1 x k a 2 x 2 + a 1 x + a 0. February 17, 2011 Practical Aspects of Modern Cryptography 147
147 Verifiable Secret Sharing Select a polynomial with secret a 0 as P x = a k 1 x k a 2 x 2 + a 1 x + a 0. Commit to the coefficients by publishing g a 0, g a 1, g a 2,, g a k 1. February 17, 2011 Practical Aspects of Modern Cryptography 148
148 Verifiable Secret Sharing Select a polynomial with secret a 0 as P x = a k 1 x k a 2 x 2 + a 1 x + a 0. Commit to the coefficients by publishing g a 0, g a 1, g a 2,, g a k 1. Compute a commitment to P(i) from public values as g P(i) = g a 0i 0 g a 1i 1 g a 2i 2 g a k 1i k 1. February 17, 2011 Practical Aspects of Modern Cryptography 149
149 Verifiable Secret Sharing An important detail Randomness must be included to prevent small spaces of possible secrets and shares from being exhaustively searched. February 17, 2011 Practical Aspects of Modern Cryptography 150
150 Secret Sharing Homomorphisms All of these secret sharing methods have an additional useful feature: If two secrets are separately shared amongst the same set of people in the same way, then the sum of the individual shares constitute shares of the sum of the secrets. February 17, 2011 Practical Aspects of Modern Cryptography 151
151 Secret Sharing Homomorphisms OR Secret: a Shares: a, a,, a Secret: b Shares: b, b,, b Secret sum: a + b Share sums: a + b, a + b,, a + b February 17, 2011 Practical Aspects of Modern Cryptography 152
152 Secret Sharing Homomorphisms AND Secret: a Shares: a 1, a 2,, a n Secret: b Shares: b 1, b 2,, b n Secret sum: a + b Share sums: a 1 + b 1, a 2 + b 2,, a n + bn February 17, 2011 Practical Aspects of Modern Cryptography 153
153 Secret Sharing Homomorphisms THRESHOLD Secret: P 1 (0) Shares: P 1 (1), P 1 (2),, P 1 (n) Secret: P 2 (0) Shares: P 2 (1), P 2 (2),, P 2 (n) Secret sum: P 1 (0) + P 2 (0) Share sums: P 1 (1) + P 2 (1), P 1 (2) + P 2 (2),, P 1 (n) + P 2 (n) February 17, 2011 Practical Aspects of Modern Cryptography 154
154 Threshold Encryption I want to encrypt a secret message M for a set of n recipients such that any k of the n recipients can uniquely decrypt the secret message M, but any set of fewer than k recipients has no information whatsoever about the secret message M. February 17, 2011 Practical Aspects of Modern Cryptography 155
155 Recall Diffie-Hellman Alice Randomly select a large integer a and send A = g a mod p. Compute the key K = B a mod p. Bob Randomly select a large integer b and send B = g b mod p. Compute the key K = A b mod p. B a = g ba = g ab = A b February 17, 2011 Practical Aspects of Modern Cryptography 156
156 ElGamal Encryption February 17, 2011 Practical Aspects of Modern Cryptography 157
157 ElGamal Encryption Alice selects a large random private key a and computes an associated public key A = g a mod p. February 17, 2011 Practical Aspects of Modern Cryptography 158
158 ElGamal Encryption Alice selects a large random private key a and computes an associated public key A = g a mod p. To send a message M to Alice, Bob selects a random value r and computes the pair (X, Y) = (A r M mod p, g r mod p). February 17, 2011 Practical Aspects of Modern Cryptography 159
159 ElGamal Encryption Alice selects a large random private key a and computes an associated public key A = g a mod p. To send a message M to Alice, Bob selects a random value r and computes the pair (X, Y) = (A r M mod p, g r mod p). To decrypt, Alice computes X/Y a mod p = A r M/g ra mod p = M. February 17, 2011 Practical Aspects of Modern Cryptography 160
160 ElGamal Re-Encryption If A = g a mod p is a public key and the pair (X, Y) = (A r M mod p, g r mod p) is an encryption of message M, then for any value c, the pair (A c X, g c Y) = (A c+r M mod p, g c+r mod p) is an encryption of the same message M, for any value c. February 17, 2011 Practical Aspects of Modern Cryptography 161
161 Group ElGamal Encryption February 17, 2011 Practical Aspects of Modern Cryptography 162
162 Group ElGamal Encryption Each recipient selects a large random private key a i and computes an associated public key A i = g a i mod p. February 17, 2011 Practical Aspects of Modern Cryptography 163
163 Group ElGamal Encryption Each recipient selects a large random private key a i and computes an associated public key A i = g a i mod p. The group key is A = A i mod p = g a i mod p. February 17, 2011 Practical Aspects of Modern Cryptography 164
164 Group ElGamal Encryption Each recipient selects a large random private key a i and computes an associated public key A i = g a i mod p. The group key is A = A i mod p = g a i mod p. To send a message M to the group, Bob selects a random value r and computes the pair (X, Y) = (A r M mod p, g r mod p). February 17, 2011 Practical Aspects of Modern Cryptography 165
165 Group ElGamal Encryption Each recipient selects a large random private key a i and computes an associated public key A i = g a i mod p. The group key is A = A i mod p = g a i mod p. To send a message M to the group, Bob selects a random value r and computes the pair (X, Y) = (A r M mod p, g r mod p). To decrypt, each group member computes Y i = Y a i mod p. The message M = X/ Y i mod p. February 17, 2011 Practical Aspects of Modern Cryptography 166
166 Threshold Encryption (ElGamal) February 17, 2011 Practical Aspects of Modern Cryptography 167
167 Threshold Encryption (ElGamal) Each recipient selects k large random secret coefficients a i,0, a i,1,, a i,k 2, a i,k 1 and forms the polynomial P i x = a i,k 1 x k 1 + a i,k 2 x k a i,1 x + a i,0 February 17, 2011 Practical Aspects of Modern Cryptography 168
168 Threshold Encryption (ElGamal) Each recipient selects k large random secret coefficients a i,0, a i,1,, a i,k 2, a i,k 1 and forms the polynomial P i x = a i,k 1 x k 1 + a i,k 2 x k a i,1 x + a i,0 Each polynomial P i (x) is then verifiably shared with the other recipients by distributing each g a i,j. February 17, 2011 Practical Aspects of Modern Cryptography 169
169 Threshold Encryption (ElGamal) Each recipient selects k large random secret coefficients a i,0, a i,1,, a i,k 2, a i,k 1 and forms the polynomial P i x = a i,k 1 x k 1 + a i,k 2 x k a i,1 x + a i,0 Each polynomial P i (x) is then verifiably shared with the other recipients by distributing each g a i,j. The joint (threshold) public key is g a i,0. February 17, 2011 Practical Aspects of Modern Cryptography 170
170 Threshold Encryption (ElGamal) Each recipient selects k large random secret coefficients a i,0, a i,1,, a i,k 2, a i,k 1 and forms the polynomial P i x = a i,k 1 x k 1 + a i,k 2 x k a i,1 x + a i,0 Each polynomial P i (x) is then verifiably shared with the other recipients by distributing each g a i,j. The joint (threshold) public key is g a i,0. Any set of k recipients can form the secret key decrypt. a i,0 to February 17, 2011 Practical Aspects of Modern Cryptography 171
Threshold Cryptography
Threshold Cryptography Cloud Security Mechanisms Björn Groneberg - Summer Term 2013 09.07.2013 Threshold Cryptography 1 ? 09.07.2013 Threshold Cryptography 2 Threshold Cryptography Sharing Secrets Treasure
CPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Security Michael J. Fischer Lecture 19 November 8, 2017 CPSC 467, Lecture 19 1/37 Zero Knowledge Interactive Proofs (ZKIP) ZKIP for graph isomorphism Feige-Fiat-Shamir
1 Number Theory Basics
ECS 289M (Franklin), Winter 2010, Crypto Review 1 Number Theory Basics This section has some basic facts about number theory, mostly taken (or adapted) from Dan Boneh s number theory fact sheets for his
Introduction to Modern Cryptography Lecture 11
Introduction to Modern Cryptography Lecture 11 January 10, 2017 Instructor: Benny Chor Teaching Assistant: Orit Moskovich School of Computer Science Tel-Aviv University Fall Semester, 2016 17 Tuesday 12:00
COS433/Math 473: Cryptography. Mark Zhandry Princeton University Spring 2018
COS433/Math 473: Cryptography Mark Zhandry Princeton University Spring 2018 Identification Identification Non- Repudiation Consider signature- based C- R sk ch=r res = Sig(vk,ch) Bob can prove to police
CIS 6930/4930 Computer and Network Security. Topic 5.2 Public Key Cryptography
CIS 6930/4930 Computer and Network Security Topic 5.2 Public Key Cryptography 1 Diffie-Hellman Key Exchange 2 Diffie-Hellman Protocol For negotiating a shared secret key using only public communication
Basics in Cryptology. Outline. II Distributed Cryptography. Key Management. Outline. David Pointcheval. ENS Paris 2018
Basics in Cryptology II Distributed Cryptography David Pointcheval Ecole normale supérieure, CNRS & INRIA ENS Paris 2018 NS/CNRS/INRIA Cascade David Pointcheval 1/26ENS/CNRS/INRIA Cascade David Pointcheval
2. Cryptography 2.5. ElGamal cryptosystems and Discrete logarithms
CRYPTOGRAPHY 19 Cryptography 5 ElGamal cryptosystems and Discrete logarithms Definition Let G be a cyclic group of order n and let α be a generator of G For each A G there exists an uniue 0 a n 1 such
Lecture 10: Zero-Knowledge Proofs
Lecture 10: Zero-Knowledge Proofs Introduction to Modern Cryptography Benny Applebaum Tel-Aviv University Fall Semester, 2011 12 Some of these slides are based on note by Boaz Barak. Quo vadis? Eo Romam
Lecture 19: Public-key Cryptography (Diffie-Hellman Key Exchange & ElGamal Encryption) Public-key Cryptography
Lecture 19: (Diffie-Hellman Key Exchange & ElGamal Encryption) Recall In private-key cryptography the secret-key sk is always established ahead of time The secrecy of the private-key cryptography relies
Lecture Notes 20: Zero-Knowledge Proofs
CS 127/CSCI E-127: Introduction to Cryptography Prof. Salil Vadhan Fall 2013 Lecture Notes 20: Zero-Knowledge Proofs Reading. Katz-Lindell Ÿ14.6.0-14.6.4,14.7 1 Interactive Proofs Motivation: how can parties
Session 4: Efficient Zero Knowledge. Yehuda Lindell Bar-Ilan University
Session 4: Efficient Zero Knowledge Yehuda Lindell Bar-Ilan University 1 Proof Systems Completeness: can convince of a true statement Soundness: cannot convince for a false statement Classic proofs: Written
Lecture 10. Public Key Cryptography: Encryption + Signatures. Identification
Lecture 10 Public Key Cryptography: Encryption + Signatures 1 Identification Public key cryptography can be also used for IDENTIFICATION Identification is an interactive protocol whereby one party: prover
Cryptography CS 555. Topic 23: Zero-Knowledge Proof and Cryptographic Commitment. CS555 Topic 23 1
Cryptography CS 555 Topic 23: Zero-Knowledge Proof and Cryptographic Commitment CS555 Topic 23 1 Outline and Readings Outline Zero-knowledge proof Fiat-Shamir protocol Schnorr protocol Commitment schemes
Lecture Notes, Week 10
YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE CPSC 467b: Cryptography and Computer Security Week 10 (rev. 2) Professor M. J. Fischer March 29 & 31, 2005 Lecture Notes, Week 10 1 Zero Knowledge Interactive
Multiparty Computation
Multiparty Computation Principle There is a (randomized) function f : ({0, 1} l ) n ({0, 1} l ) n. There are n parties, P 1,...,P n. Some of them may be adversarial. Two forms of adversarial behaviour:
Public Key Cryptography. All secret key algorithms & hash algorithms do the same thing but public key algorithms look very different from each other.
Public Key Cryptography All secret key algorithms & hash algorithms do the same thing but public key algorithms look very different from each other. The thing that is common among all of them is that each
8 Elliptic Curve Cryptography
8 Elliptic Curve Cryptography 8.1 Elliptic Curves over a Finite Field For the purposes of cryptography, we want to consider an elliptic curve defined over a finite field F p = Z/pZ for p a prime. Given
CPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Security Michael J. Fischer Lecture 18 November 3, 2014 CPSC 467, Lecture 18 1/43 Zero Knowledge Interactive Proofs (ZKIP) Secret cave protocol ZKIP for graph isomorphism
Chapter 8 Public-key Cryptography and Digital Signatures
Chapter 8 Public-key Cryptography and Digital Signatures v 1. Introduction to Public-key Cryptography 2. Example of Public-key Algorithm: Diffie- Hellman Key Exchange Scheme 3. RSA Encryption and Digital
Homework 3 Solutions
5233/IOC5063 Theory of Cryptology, Fall 205 Instructor Prof. Wen-Guey Tzeng Homework 3 Solutions 7-Dec-205 Scribe Amir Rezapour. Consider an unfair coin with head probability 0.5. Assume that the coin
Intro to Public Key Cryptography Diffie & Hellman Key Exchange
Introduction to Modern Cryptography Lecture 5 Number Theory: 1. Quadratic residues. 2. The discrete log problem. Intro to Public Key Cryptography Diffie & Hellman Key Exchange Course Summary - Math Part
L7. Diffie-Hellman (Key Exchange) Protocol. Rocky K. C. Chang, 5 March 2015
L7. Diffie-Hellman (Key Exchange) Protocol Rocky K. C. Chang, 5 March 2015 1 Outline The basic foundation: multiplicative group modulo prime The basic Diffie-Hellman (DH) protocol The discrete logarithm
Introduction to Modern Cryptography. Benny Chor
Introduction to Modern Cryptography Benny Chor RSA Public Key Encryption Factoring Algorithms Lecture 7 Tel-Aviv University Revised March 1st, 2008 Reminder: The Prime Number Theorem Let π(x) denote the
CPSC 467b: Cryptography and Computer Security
Outline Authentication CPSC 467b: Cryptography and Computer Security Lecture 18 Michael J. Fischer Department of Computer Science Yale University March 29, 2010 Michael J. Fischer CPSC 467b, Lecture 18
1 Recommended Reading 1. 2 Public Key/Private Key Cryptography Overview RSA Algorithm... 2
Contents 1 Recommended Reading 1 2 Public Key/Private Key Cryptography 1 2.1 Overview............................................. 1 2.2 RSA Algorithm.......................................... 2 3 A Number
Lecture Notes, Week 6
YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE CPSC 467b: Cryptography and Computer Security Week 6 (rev. 3) Professor M. J. Fischer February 15 & 17, 2005 1 RSA Security Lecture Notes, Week 6 Several
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 16 March 19, 2012 CPSC 467b, Lecture 16 1/58 Authentication While Preventing Impersonation Challenge-response authentication protocols
during transmission safeguard information Cryptography: used to CRYPTOGRAPHY BACKGROUND OF THE MATHEMATICAL
THE MATHEMATICAL BACKGROUND OF CRYPTOGRAPHY Cryptography: used to safeguard information during transmission (e.g., credit card number for internet shopping) as opposed to Coding Theory: used to transmit
CS-E4320 Cryptography and Data Security Lecture 11: Key Management, Secret Sharing
Lecture 11: Key Management, Secret Sharing Céline Blondeau Email: celine.blondeau@aalto.fi Department of Computer Science Aalto University, School of Science Key Management Secret Sharing Shamir s Threshold
Introduction to Elliptic Curve Cryptography. Anupam Datta
Introduction to Elliptic Curve Cryptography Anupam Datta 18-733 Elliptic Curve Cryptography Public Key Cryptosystem Duality between Elliptic Curve Cryptography and Discrete Log Based Cryptography Groups
Question: Total Points: Score:
University of California, Irvine COMPSCI 134: Elements of Cryptography and Computer and Network Security Midterm Exam (Fall 2016) Duration: 90 minutes November 2, 2016, 7pm-8:30pm Name (First, Last): Please
Lemma 1.2. (1) If p is prime, then ϕ(p) = p 1. (2) If p q are two primes, then ϕ(pq) = (p 1)(q 1).
1 Background 1.1 The group of units MAT 3343, APPLIED ALGEBRA, FALL 2003 Handout 3: The RSA Cryptosystem Peter Selinger Let (R, +, ) be a ring. Then R forms an abelian group under addition. R does not
Public-Key Encryption: ElGamal, RSA, Rabin
Public-Key Encryption: ElGamal, RSA, Rabin Introduction to Modern Cryptography Benny Applebaum Tel-Aviv University Fall Semester, 2011 12 Public-Key Encryption Syntax Encryption algorithm: E. Decryption
Theory of Computation Chapter 12: Cryptography
Theory of Computation Chapter 12: Cryptography Guan-Shieng Huang Dec. 20, 2006 0-0 Introduction Alice wants to communicate with Bob secretely. x Alice Bob John Alice y=e(e,x) y Bob y??? John Assumption
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 11 February 21, 2013 CPSC 467b, Lecture 11 1/27 Discrete Logarithm Diffie-Hellman Key Exchange ElGamal Key Agreement Primitive Roots
Cryptographical Security in the Quantum Random Oracle Model
Cryptographical Security in the Quantum Random Oracle Model Center for Advanced Security Research Darmstadt (CASED) - TU Darmstadt, Germany June, 21st, 2012 This work is licensed under a Creative Commons
Cryptographic Protocols FS2011 1
Cryptographic Protocols FS2011 1 Stefan Heule August 30, 2011 1 License: Creative Commons Attribution-Share Alike 3.0 Unported (http://creativecommons.org/ licenses/by-sa/3.0/) Contents I Interactive Proofs
RSA. Ramki Thurimella
RSA Ramki Thurimella Public-Key Cryptography Symmetric cryptography: same key is used for encryption and decryption. Asymmetric cryptography: different keys used for encryption and decryption. Public-Key
Some ZK security proofs for Belenios
Some ZK security proofs for Belenios Pierrick Gaudry CNRS, INRIA, Université de Lorraine January 30, 2017 The purpose of this document is to justify the use of ZK proofs in Belenios. Most of them are exactly
Lecture 28: Public-key Cryptography. Public-key Cryptography
Lecture 28: Recall In private-key cryptography the secret-key sk is always established ahead of time The secrecy of the private-key cryptography relies on the fact that the adversary does not have access
Lecture 15: Interactive Proofs
COM S 6830 Cryptography Tuesday, October 20, 2009 Instructor: Rafael Pass Lecture 15: Interactive Proofs Scribe: Chin Isradisaikul In this lecture we discuss a new kind of proofs that involves interaction
Digital Signatures. Saravanan Vijayakumaran Department of Electrical Engineering Indian Institute of Technology Bombay
Digital Signatures Saravanan Vijayakumaran sarva@ee.iitb.ac.in Department of Electrical Engineering Indian Institute of Technology Bombay July 24, 2018 1 / 29 Group Theory Recap Groups Definition A set
b = 10 a, is the logarithm of b to the base 10. Changing the base to e we obtain natural logarithms, so a = ln b means that b = e a.
INTRODUCTION TO CRYPTOGRAPHY 5. Discrete Logarithms Recall the classical logarithm for real numbers: If we write b = 10 a, then a = log 10 b is the logarithm of b to the base 10. Changing the base to e
March 19: Zero-Knowledge (cont.) and Signatures
March 19: Zero-Knowledge (cont.) and Signatures March 26, 2013 1 Zero-Knowledge (review) 1.1 Review Alice has y, g, p and claims to know x such that y = g x mod p. Alice proves knowledge of x to Bob w/o
MATH 158 FINAL EXAM 20 DECEMBER 2016
MATH 158 FINAL EXAM 20 DECEMBER 2016 Name : The exam is double-sided. Make sure to read both sides of each page. The time limit is three hours. No calculators are permitted. You are permitted one page
Lecture 1: Introduction to Public key cryptography
Lecture 1: Introduction to Public key cryptography Thomas Johansson T. Johansson (Lund University) 1 / 44 Key distribution Symmetric key cryptography: Alice and Bob share a common secret key. Some means
Zero-Knowledge Proofs and Protocols
Seminar: Algorithms of IT Security and Cryptography Zero-Knowledge Proofs and Protocols Nikolay Vyahhi June 8, 2005 Abstract A proof is whatever convinces me. Shimon Even, 1978. Zero-knowledge proof is
COMP424 Computer Security
COMP424 Computer Security Prof. Wiegley jeffw@csun.edu Rivest, Shamir & Adelman (RSA) Implementation 1 Relatively prime Prime: n, is prime if its only two factors are 1 and n. (and n 1). Relatively prime:
Lecture 18 - Secret Sharing, Visual Cryptography, Distributed Signatures
Lecture 18 - Secret Sharing, Visual Cryptography, Distributed Signatures Boaz Barak November 27, 2007 Quick review of homework 7 Existence of a CPA-secure public key encryption scheme such that oracle
Cryptographic Protocols Notes 2
ETH Zurich, Department of Computer Science SS 2018 Prof. Ueli Maurer Dr. Martin Hirt Chen-Da Liu Zhang Cryptographic Protocols Notes 2 Scribe: Sandro Coretti (modified by Chen-Da Liu Zhang) About the notes:
Elliptic Curves. Giulia Mauri. Politecnico di Milano website:
Elliptic Curves Giulia Mauri Politecnico di Milano email: giulia.mauri@polimi.it website: http://home.deib.polimi.it/gmauri May 13, 2015 Giulia Mauri (DEIB) Exercises May 13, 2015 1 / 34 Overview 1 Elliptic
Lecture 04: Secret Sharing Schemes (2) Secret Sharing
Lecture 04: Schemes (2) Recall: Goal We want to Share a secret s Z p to n parties, such that {1,..., n} Z p, Any two parties can reconstruct the secret s, and No party alone can predict the secret s Recall:
Course 2BA1: Trinity 2006 Section 9: Introduction to Number Theory and Cryptography
Course 2BA1: Trinity 2006 Section 9: Introduction to Number Theory and Cryptography David R. Wilkins Copyright c David R. Wilkins 2006 Contents 9 Introduction to Number Theory and Cryptography 1 9.1 Subgroups
Lecture 12: Interactive Proofs
princeton university cos 522: computational complexity Lecture 12: Interactive Proofs Lecturer: Sanjeev Arora Scribe:Carl Kingsford Recall the certificate definition of NP. We can think of this characterization
Public Key Encryption
Public Key Encryption KG October 17, 2017 Contents 1 Introduction 1 2 Public Key Encryption 2 3 Schemes Based on Diffie-Hellman 3 3.1 ElGamal.................................... 5 4 RSA 7 4.1 Preliminaries.................................
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Module No. # 01 Lecture No. # 33 The Diffie-Hellman Problem
CHALMERS GÖTEBORGS UNIVERSITET. TDA352 (Chalmers) - DIT250 (GU) 11 April 2017, 8:30-12:30
CHALMERS GÖTEBORGS UNIVERSITET CRYPTOGRAPHY TDA35 (Chalmers) - DIT50 (GU) 11 April 017, 8:30-1:30 No extra material is allowed during the exam except for pens and a simple calculator (not smartphones).
Cryptography and RSA. Group (1854, Cayley) Upcoming Interview? Outline. Commutative or Abelian Groups
Great Theoretical Ideas in CS V. Adamchik CS 15-251 Upcoming Interview? Lecture 24 Carnegie Mellon University Cryptography and RSA How the World's Smartest Company Selects the Most Creative Thinkers Groups
Lecture 15 - Zero Knowledge Proofs
Lecture 15 - Zero Knowledge Proofs Boaz Barak November 21, 2007 Zero knowledge for 3-coloring. We gave a ZK proof for the language QR of (x, n) such that x QR n. We ll now give a ZK proof (due to Goldreich,
Notes 10: Public-key cryptography
MTH6115 Cryptography Notes 10: Public-key cryptography In this section we look at two other schemes that have been proposed for publickey ciphers. The first is interesting because it was the earliest such
Cryptography. Course 1: Remainder: RSA. Jean-Sébastien Coron. September 21, Université du Luxembourg
Course 1: Remainder: RSA Université du Luxembourg September 21, 2010 Public-key encryption Public-key encryption: two keys. One key is made public and used to encrypt. The other key is kept private and
Non-Interactive Zero-Knowledge from Homomorphic Encryption. Ivan Damgård (Aarhus Universitet) Nelly Fazio, Antonio Nicolosi (NYU)
Non-Interactive Zero-Knowledge from Homomorphic Encryption Ivan Damgård (Aarhus Universitet) Nelly Fazio, Antonio Nicolosi (NYU) January 27th, 2006 NYU Crypto Reading Group Zero-Knowledge and Interaction
Definition: For a positive integer n, if 0<a<n and gcd(a,n)=1, a is relatively prime to n. Ahmet Burak Can Hacettepe University
Number Theory, Public Key Cryptography, RSA Ahmet Burak Can Hacettepe University abc@hacettepe.edu.tr The Euler Phi Function For a positive integer n, if 0
1 Basic Number Theory
ECS 228 (Franklin), Winter 2013, Crypto Review 1 Basic Number Theory This section has some basic facts about number theory, mostly taken (or adapted) from Dan Boneh s number theory fact sheets for his
Public Key Algorithms
Public Key Algorithms Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-09/
CPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Security Michael J. Fischer Lecture 11 October 7, 2015 CPSC 467, Lecture 11 1/37 Digital Signature Algorithms Signatures from commutative cryptosystems Signatures from
Introduction to Cryptography. Lecture 8
Introduction to Cryptography Lecture 8 Benny Pinkas page 1 1 Groups we will use Multiplication modulo a prime number p (G, ) = ({1,2,,p-1}, ) E.g., Z 7* = ( {1,2,3,4,5,6}, ) Z p * Z N * Multiplication
10 Modular Arithmetic and Cryptography
10 Modular Arithmetic and Cryptography 10.1 Encryption and Decryption Encryption is used to send messages secretly. The sender has a message or plaintext. Encryption by the sender takes the plaintext and
Lecture 9 Julie Staub Avi Dalal Abheek Anand Gelareh Taban. 1 Introduction. 2 Background. CMSC 858K Advanced Topics in Cryptography February 24, 2004
CMSC 858K Advanced Topics in Cryptography February 24, 2004 Lecturer: Jonathan Katz Lecture 9 Scribe(s): Julie Staub Avi Dalal Abheek Anand Gelareh Taban 1 Introduction In previous lectures, we constructed
14 Diffie-Hellman Key Agreement
14 Diffie-Hellman Key Agreement 14.1 Cyclic Groups Definition 14.1 Example Let д Z n. Define д n = {д i % n i Z}, the set of all powers of д reduced mod n. Then д is called a generator of д n, and д n
ECS 189A Final Cryptography Spring 2011
ECS 127: Cryptography Handout F UC Davis Phillip Rogaway June 9, 2011 ECS 189A Final Cryptography Spring 2011 Hints for success: Good luck on the exam. I don t think it s all that hard (I do believe I
Lecture 7: ElGamal and Discrete Logarithms
Lecture 7: ElGamal and Discrete Logarithms Johan Håstad, transcribed by Johan Linde 2006-02-07 1 The discrete logarithm problem Recall that a generator g of a group G is an element of order n such that
Univ.-Prof. Dr. rer. nat. Rudolf Mathar. Written Examination. Cryptography. Tuesday, August 29, 2017, 01:30 p.m.
Cryptography Univ.-Prof. Dr. rer. nat. Rudolf Mathar 1 2 3 4 15 15 15 15 60 Written Examination Cryptography Tuesday, August 29, 2017, 01:30 p.m. Name: Matr.-No.: Field of study: Please pay attention to
1 What are Physical Attacks. 2 Physical Attacks on RSA. Today:
Today: Introduction to the class. Examples of concrete physical attacks on RSA A computational approach to cryptography Pseudorandomness 1 What are Physical Attacks Tampering/Leakage attacks Issue of how
Cosc 412: Cryptography and complexity Lecture 7 (22/8/2018) Knapsacks and attacks
1 Cosc 412: Cryptography and complexity Lecture 7 (22/8/2018) Knapsacks and attacks Michael Albert michael.albert@cs.otago.ac.nz 2 This week Arithmetic Knapsack cryptosystems Attacks on knapsacks Some
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 10 February 19, 2013 CPSC 467b, Lecture 10 1/45 Primality Tests Strong primality tests Weak tests of compositeness Reformulation
Discrete Mathematics and Probability Theory Spring 2015 Vazirani Midterm #2 Solution
CS 70 Discrete Mathematics and Probability Theory Spring 015 Vazirani Midterm # Solution PRINT your name:, (last) SIGN your name: (first) PRINT your student ID: CIRCLE your exam room: 3106 Etcheverry 3108
Lecture 17 - Diffie-Hellman key exchange, pairing, Identity-Based Encryption and Forward Security
Lecture 17 - Diffie-Hellman key exchange, pairing, Identity-Based Encryption and Forward Security Boaz Barak November 21, 2007 Cyclic groups and discrete log A group G is cyclic if there exists a generator
RSA RSA public key cryptosystem
RSA 1 RSA As we have seen, the security of most cipher systems rests on the users keeping secret a special key, for anyone possessing the key can encrypt and/or decrypt the messages sent between them.
Evidence that the Diffie-Hellman Problem is as Hard as Computing Discrete Logs
Evidence that the Diffie-Hellman Problem is as Hard as Computing Discrete Logs Jonah Brown-Cohen 1 Introduction The Diffie-Hellman protocol was one of the first methods discovered for two people, say Alice
ENEE 457: Computer Systems Security 10/3/16. Lecture 9 RSA Encryption and Diffie-Helmann Key Exchange
ENEE 457: Computer Systems Security 10/3/16 Lecture 9 RSA Encryption and Diffie-Helmann Key Exchange Charalampos (Babis) Papamanthou Department of Electrical and Computer Engineering University of Maryland,
Lecture 14. Outline. 1. Finish Polynomials and Secrets. 2. Finite Fields: Abstract Algebra 3. Erasure Coding
Lecture 14. Outline. 1. Finish Polynomials and Secrets. 2. Finite Fields: Abstract Algebra 3. Erasure Coding Modular Arithmetic Fact and Secrets Modular Arithmetic Fact: There is exactly 1 polynomial of
Commitment Schemes and Zero-Knowledge Protocols (2011)
Commitment Schemes and Zero-Knowledge Protocols (2011) Ivan Damgård and Jesper Buus Nielsen Aarhus University, BRICS Abstract This article is an introduction to two fundamental primitives in cryptographic
ECash and Anonymous Credentials
ECash and Anonymous Credentials CS/ECE 598MAN: Applied Cryptography Nikita Borisov November 9, 2009 1 E-cash Chaum s E-cash Offline E-cash 2 Anonymous Credentials e-cash-based Credentials Brands Credentials
Cryptography and Security Final Exam
Cryptography and Security Final Exam Serge Vaudenay 17.1.2017 duration: 3h no documents allowed, except one 2-sided sheet of handwritten notes a pocket calculator is allowed communication devices are not
The RSA public encryption scheme: How I learned to stop worrying and love buying stuff online
The RSA public encryption scheme: How I learned to stop worrying and love buying stuff online Anthony Várilly-Alvarado Rice University Mathematics Leadership Institute, June 2010 Our Goal Today I will
Lecture 14: Secure Multiparty Computation
600.641 Special Topics in Theoretical Cryptography 3/20/2007 Lecture 14: Secure Multiparty Computation Instructor: Susan Hohenberger Scribe: Adam McKibben 1 Overview Suppose a group of people want to determine
Circuit Complexity. Circuit complexity is based on boolean circuits instead of Turing machines.
Circuit Complexity Circuit complexity is based on boolean circuits instead of Turing machines. A boolean circuit with n inputs computes a boolean function of n variables. Now, identify true/1 with yes
Public-Key Cryptosystems CHAPTER 4
Public-Key Cryptosystems CHAPTER 4 Introduction How to distribute the cryptographic keys? Naïve Solution Naïve Solution Give every user P i a separate random key K ij to communicate with every P j. Disadvantage:
Security Issues in Cloud Computing Modern Cryptography II Asymmetric Cryptography
Security Issues in Cloud Computing Modern Cryptography II Asymmetric Cryptography Peter Schwabe October 21 and 28, 2011 So far we assumed that Alice and Bob both have some key, which nobody else has. How
CODING AND CRYPTOLOGY III CRYPTOLOGY EXERCISES. The questions with a * are extension questions, and will not be included in the assignment.
CODING AND CRYPTOLOGY III CRYPTOLOGY EXERCISES A selection of the following questions will be chosen by the lecturer to form the Cryptology Assignment. The Cryptology Assignment is due by 5pm Sunday 1
Lecture 3,4: Multiparty Computation
CS 276 Cryptography January 26/28, 2016 Lecture 3,4: Multiparty Computation Instructor: Sanjam Garg Scribe: Joseph Hui 1 Constant-Round Multiparty Computation Last time we considered the GMW protocol,
Public Key Algorithms
1 Public Key Algorithms ffl hash: irreversible transformation(message) ffl secret key: reversible transformation(block) encryption digital signatures authentication RSA yes yes yes El Gamal no yes no Zero-knowledge
Fundamentals of Modern Cryptography
Fundamentals of Modern Cryptography BRUCE MOMJIAN This presentation explains the fundamentals of modern cryptographic methods. Creative Commons Attribution License http://momjian.us/presentations Last
Introduction to Cybersecurity Cryptography (Part 4)
Introduction to Cybersecurity Cryptography (Part 4) Review of Last Lecture Blockciphers Review of DES Attacks on Blockciphers Advanced Encryption Standard (AES) Modes of Operation MACs and Hashes Message
LECTURE 5: APPLICATIONS TO CRYPTOGRAPHY AND COMPUTATIONS
LECTURE 5: APPLICATIONS TO CRYPTOGRAPHY AND COMPUTATIONS Modular arithmetics that we have discussed in the previous lectures is very useful in Cryptography and Computer Science. Here we discuss several
Lecture 11: Key Agreement
Introduction to Cryptography 02/22/2018 Lecture 11: Key Agreement Instructor: Vipul Goyal Scribe: Francisco Maturana 1 Hardness Assumptions In order to prove the security of cryptographic primitives, we
CPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Security Michael J. Fischer Lecture 22 November 27, 2017 CPSC 467, Lecture 22 1/43 BBS Pseudorandom Sequence Generator Secret Splitting Shamir s Secret Splitting Scheme
Secret Sharing Schemes
Secret Sharing Schemes 1.1 Introduction 1 1 Handling secret has been an issue of prominence from the time human beings started to live together. Important things and messages have been always there to