Lecture V : Public Key Cryptography

Transcription

1 Lecture V : Public Key Cryptography Internet Security: Principles & Practices John K. Zao, PhD (Harvard) SMIEEE Amir Rezapoor Computer Science Department, National Chiao Tung University

2 2 Outline Functional Components One-Way Functions One-Way Trapdoor Functions Cryptographic Systems Diffie-Hellman (Key Agreement) Algorithm RSA Algorithm Digital Signature Algorithm

3 3 One-Way Function Definition : A one-to-one mapping x S, y S y = f (x) of which Forward Mapping f is computationally feasible Inverse Mapping f -1 is computationally infeasible Characteristics : Cryptographically Strong / Secure Inverse Infeasibility f -1 is computationally infeasible Collision Improbability Example : Given a, b S, P ( f (a) = f (b) ) #(S)/2 Modular Exponentiation Message Digest (Cryptographically Strong Hashing)

4 4 One-Way Trapdoor Function Definition : A one-to-one parameterized mapping x S, y S y = f k (x) of which Forward Mapping f k is computationally feasible if k is known Inverse Mapping f k -1 is Question : Computationally infeasible if k is unknown, but Computationally feasible if k is known Does such function ever exist? Diffie and Hellman thought so! Diffie, w. and Hellman, M.E., New Directions in Cryptography, IEEE Transaction on Information Theory 22(6), 1976, pp

5 5 Outline Functional Components One-Way Functions One-Way Trapdoor Functions Cryptographic Systems Diffie-Hellman (Key Agreement) Algorithm RSA (Rivest-Shamir-Adleman) Algorithm

6 6 Diffie-Hellman Key Agreement Algorithm On-line Exchanges Eve Off-line Exchanges Alice Bob A B Private Key : Exponent = a Public Key : Exponential = A = ε a mod p System Parameter Base = ε, Modulus = p Private Key : Exponent = b Public Key : Exponential = B = ε b mod p Shared Secret (Agreed Key) K = A b mod p = B a mod p = ε ab mod p

7 7 Diffie-Hellman Key Agreement Algorithm Alice & Bob arrived at the same value: (g a ) b mod p = (g b ) a mod p Once Alice & Bob compute the shared secret, they can use it as a symmetric (secret) session key. knows Alice p = 23 b =? base g = 5 a = 6 A = 5 6 mod 23 = 8 B = 5 b mod 23 = 19 s = 19 6 mod 23 = 2 s = 8 b mod 23 = 2 s = 19 6 mod 23 = 8 b mod 23 = 2 doesn't know Eve knows doesn't know p = 23 a =? base g = 5 b =? s =? A = 5 a mod 23 = 8 B = 5 b mod 23 = 19 s = 19 a mod 23 =? s = 8 b mod 23 =? knows Bob p = 23 a =? base g = 5 b = 15 B = 5 15 mod 23 = 19 A = 5 a mod 23 = 8 s = 8 15 mod 23 = 2 s = 19 a mod 23 = 2 s = 8 15 mod 23 = 19 a mod 23 = 2 doesn't know

8 8 Man-In-Middle Attacks & Defenses

9 9 RSA (Rivest-Shamir-Adleman) Algorithm Mathematical Basis Abelian Group: Trapdoor: factorization of a large number n = p q is hard Capability ℵ n = p q Encryption / Decryption Digital Signature / Verification where p, q are prime

10 10 RSA Algorithm : Components Trapdoor Secrets n = p q where p,q are large primes Public Key (n, e ) where e is relative prime to ϕ(n) = (p 1)(q 1) Private Key (n, d ) where d = e -1 mod ϕ(n) is the multiplicative inverse of e Encryption / Digital Signature Verification c = m e mod n where m is plaintext and c is ciphertext Decryption / Digital Signature Production m = c d mod n

11 11 RSA Algorithm : Rationale Why it works? c = m e mod n c d mod n = m ed mod n d = e -1 mod ϕ(n) ed = κϕ(n) + 1 Thus, c d mod n = m ed mod n = m κϕ(n)+1 mod n By generalization of Euler s Theorem: m κϕ(n)+1 mod n = m mod n m ℵ n = m mod n m ℵ n if n = p q Since m < n c d mod n = m ed mod n = m κϕ(n)+1 mod n = m

12 12 RSA Algorithm : Rationale Why it is secure? Knowing p, q and e, one can easily compute : n = p q ϕ(n) = (p 1)(q 1) d = e -1 mod ϕ(n) Without knowing p and q, but knowing n and e, one cannot compute : ϕ(n) or d

13 13 How to design Safe RSA? Choose right values for e Choose good values for n = p q Small m value : m e < n

14 14 How to Compute Modular Exponentiation? Fermat s Little Theorem Reducing the exponent (mod 10) (mod 10) (7 4 ) (mod 10) (mod 10) 49 (mod 10) 9. Why? Because 7 and 10 have no common factor and φ(10) = 4, Euler's theorem states that 7 4 (mod 10) 1 Double & Square Algorithm function modular_exp(base, exponent, modulus) result := 1 while exponent > 0 if (exponent & 1) equals 1: result := (result * base) mod modulus exponent := exponent >> 1 base = (base * base) mod modulus return result

15 15 Public-Key Cryptography Standards (PKCS) Short RSA Encryption Messages (PKCS#1) 0 2 PRN (8B) 0 Data Short RSA Signature Messages (PKCS#1) 0 1 PRN (8B) 0 Message Digest (ASN.1)

16 16 Outline Cryptographic Systems Diffie-Hellman (Key Agreement) Algorithm RSA Algorithm Digital Signature Algorithm

17 17 Digital Signature, Properties Generated from signed message Based on information (private key) only known to signer Prevent forgery and denial Relatively easy to be recognized & verified Computationally infeasible to forge Hard to find different messages with same signature Hard to compute signature of a message without knowing private key Digital signature can be kept in storage

18 18 Digital Signature Algorithm (DSA) Key Generation 1. Select a prime q with 160 bits 2. Choose 0 t 8, select t <p< t with q p 1 3. Select g Z p*, α = g (p - 1)/q mod p, α 1 (ord(α)=q) 4. Select 1 a q 1, compute y= α a mod p 5. Then, public key is (p, q, α, y), private key is a

19 19 DSA Signature Signature Generation Select random integer k, 0 < k < q Compute r =(α k mod p) mod q Compute k -1 mod q Compute s = k -1 (H(m) + a r) mod q Signature is (r, s)

20 20 DSA Signature DSA signature verification Verify 0<r<q and 0<s<q; if not then invalid Compute w = s -1 mod q Compute u 1 = w H(m) mod q, u 2 =r w mod q Compute v = (α u 1 y u 2 mod p) mod q Signature is verified if and only if v = r Proof : h( m) ar + ks (mod q) wh( m) + arw k (mod q) u + au k (mod q) α =α y mod p(mod q) mod p(mod q) u u k