Discrete logarithm and related schemes
|
|
- Tabitha Carroll
- 6 years ago
- Views:
Transcription
1 Discrete logarithm and related schemes Martin Stanek Department of Computer Science Comenius University Cryptology 1 (2017/18)
2 Content Discrete logarithm problem examples, equivalent key lengths choosing a base for DLOG Encryption schemes ElGamal, Cramer-Shoup Elliptic curves DLOG and related cryptosystems 2 / 26,
3 Discrete logarithm problem Given a finite group (G, ) and elements g, y G. Compute x Z such that g x = y. usually cyclic (sub)groups with generator g are used DLOG is easy/hard depending on the group G Easy: (Z n, +) DLOG by solving congruence gx y (mod n) Hard: (Z p, ) for prime p; usually with g generating a subgroup of large prime order q Elliptic curve groups (various curve types over various finite fields) DLOG and related cryptosystems 3 / 26,
4 Example of DLOG in (Z p, ) let p = 11 case 1: g = 5 x x mod log 5 9 = 4; log 5 7 does not exist case 2: g = 7 x x mod log 7 2 = 3; log 7 10 = 5 DLOG and related cryptosystems 4 / 26,
5 Solving hard instances of DLOG (Z p, ) Specific algorithms, e.g. when p 1 lacks large prime factor General algorithm: Number Field Sieve for DLOG complexity as GNFS for factorization ( equal key length) Generic algorithms for any cyclic group the best algorithms for some groups, e.g. elliptic curve groups complexity O(n 1/2 ), for n = G algorithms: baby-step/giant-step, Pollard s ρ, Pohlig-Hellman DLOG and related cryptosystems 5 / 26,
6 Equivalent key lengths symmetric modular (subgroup) elliptic curves (160) (224) (256) (384) (512) 512 NIST Recommendations (SP part 1 rev. 4) (2016) various methods are compared at DLOG and related cryptosystems 6 / 26,
7 Selection of the base is irrelevant for DLOG g, h generators of G, G = n y input if DLOG w.r.t. the base h can be computed efficiently, then DLOG w.r.t the base g can be computed: 1. compute a, b: h a = g, h b = y 2. g ba 1 = (h a ) ba 1 = h b = y, where the inverse is computed mod n since g, h are generators, the inverse a 1 mod n must exist For some constructions, e.g. ElGamal digital signature scheme, it is important to choose the generator carefully (there are strong and weak ones)! DLOG and related cryptosystems 7 / 26,
8 How to choose a generator of (Z p, ) generator of (Z p, ) assume p = 2q + 1 for a prime number q (p is called a safe prime) Z p = p 1, thus any element has order in {1, 2, q, p 1} there are ϕ(p 1) = ϕ(2)ϕ(q) = q 1 generators the probability of a random element being a generator is (q 1)/(p 1) = (q 1)/(2q) 50% testing: g {1, 1} is a generator g q mod p 1 generator of a subgroup assume a prime q (p 1) choose random h and compute g = h (p 1)/q mod p; if g = 1 choose again trivially g q 1 (mod p) (FLT), so we have ord(g) q since ord(g) > 1, it follows ord(g) = q useful for working in smaller subgroup (shorter exponents are used) DLOG and related cryptosystems 8 / 26,
9 Security of the last bit(s) of DLOG in (Z p, ) let g be a generator of (Z p, ) we can write p = 2 s t + 1 for s 1 and some odd t input: y Z p let x be the DLOG of y, i.e. g x mod p = y we use the binary representation of x = (x l x 1 x 0 ) 2 = 2 l x l + + 2x 1 + x 0 compute: y (p 1)/2 g x(p 1)/2 g x 0(p 1)/2 x 0 can be found { 1 if x 0 = 0 1 if x 0 = 1 (mod p) DLOG and related cryptosystems 9 / 26,
10 ...cont. we can continue for s bits let us assume that x 0,, x i 1 are known (i < s) compute (mod p): (y g (x i 1 x i 1 ) ) (p 1)/2 i+1 g (2i x i + +2 l x l )(p 1)/2 i+1 g x i(p 1)/2 { 1 if x i = 0 1 if x i = 1 cannot be extended for more than s bits we can limit the damage to a single bit by choosing a safe prime DLOG and related cryptosystems 10 / 26,
11 ElGamal encryption scheme ElGamal (1985) example: originally, a default algorithm in GPG (still an option for public-key encryption in GPG) variants exists (what (sub)groups are used) Initialization: 1. choose a large random prime p, and a generator g of (Z p, ) 2. choose a random x {1,, p 2} 3. y = g x mod p public key: y, p, g (the values p, g can be shared) private key: x DLOG and related cryptosystems 11 / 26,
12 ElGamal encryption and decryption Encryption (plaintext m Z p): (r, s) = (g k mod p, y k m mod p), for random k Z p 1 Decryption (ciphertext (r, s), computation mod p): s r x = y k m r x = g xk g xk m = m encryption: two exponentiations; decryption: single exponentiation r = g k and y k can be precomputed randomized encryption: 1 plaintext maps to approx. p ciphertexts security of the private key: DLOG problem knowledge of k allows to decrypt without x: s y k = m computing k from r: DLOG problem DLOG and related cryptosystems 12 / 26,
13 Remarks Reusing k: m 1 (r, s 1 ), m 2 (r, s 2 ), we can compute s 1 /s 2 = m 1 /m 2 Homomorphic property: encryptions of two plaintexts m 1, m 2 : m 1 (r 1, s 1 ) = (g k 1, y k1 m 1 ), m 2 (r 2, s 2 ) = (g k 2, y k2 m 2 ) multiplying the ciphertexts: (r 1 r 2, s 1 s 2 ) = (g k 1+k 2, y k 1+k2 (m 1 m 2 )) Simple malleability: (r, s) (r, s m ) changes the plaintext from m to m m Blinding (CCA): access to a CCA oracle How to decrypt (r, s) if the oracle won t decrypt this message? use (rg c, sy c m ) for a random value c and m after decryption we get a message m m, so m can be recovered easily DLOG and related cryptosystems 13 / 26,
14 ElGamal security and CDH Computational Diffie-Hellman problem (CDH): compute g ab given g, g a, g b for random generator g, and random a, b DLOG CDH (opposite direction is open in general) ElGamal decryption without the private key CDH use CDH to compute g xk from r = g k and y = g x ; then the plaintext can be computed: m = s (g xk ) 1 input: g a, g b set y = (g a ) 1, r = g b and s = g c for a random c use the decryption oracle for y and (r, s) to get the value m = s r a = g c+ab finally, divide m by s: m s 1 = g c+ab g c = g ab DLOG and related cryptosystems 14 / 26,
15 Semantic insecurity of ElGamal we can test the parity of k (it is the last bit of discrete logarithm of r) another view: for a generator g we have r QR p k is even for even k: s QR p for odd k: m QR p if y QR p : s QR p m QR p if y QNR p : s QR p m QNR p we can compute something about m from the ciphertext and y how to achieve semantic security: use a subgroup QR p for a safe prime p = 2q + 1 (or a general cyclic group of some prime order) and assume the hardness of a DDH problem in this group DDH (Decisional Diffie-Hellman) problem: efficiently distinguish triplets (g a, g b, g ab ) and (g a, g b, g c ) where c is random there are groups where CDH seems to be hard and DDH is easy (e.g. (Z p, ), elliptic-curve groups with pairing) DLOG and related cryptosystems 15 / 26,
16 Some variants of ElGamal scheme ElGamal in a general cyclic group: G = q (for prime q) with generator g private key: x Z q; public key y = g x encryption of m G: (r, s) = (g k, m y k ) for random k Z q decryption of (r, s): s r x = m y k g kx = m ElGamal with a hash function: overcoming the group encoding problem (m G) encryption m {0, 1} l : (r, s) = (g k, m H(y k )) for random k Z q and suitable H and l security depends on CDH and properties of H still malleable DLOG and related cryptosystems 16 / 26,
17 Cramer Shoup scheme group G, G = q for a prime q H cryptographic hash function (outputs from Z q ) generators g 1, g 2 G private key: random x 1, x 2, y 1, y 2, z 1, z 2 Z q public key: g 1, g 2, h = g x 1 1 gx 2 2, c = gy 1 1 gy 2 2, d = gz 1 1 gz 2 2 Encryption (m G): (u 1, u 2, w, π) = (g1 r, gr 2, hr m, (cd α ) r ), where α = H(g1 r gr 2 hr m), and r is a random element from Z q Decryption of a ciphertext (u 1, u 2, w, π): 1. α = H(u v w) 2. if u y 1+α z 1 1 u y 2+α z 2 2 π then reject: invalid ciphertext 3. compute w/(u x 1 1 ux 2 2 ) = hr m/(g x 1r 1 g x 2r 2 ) = (g x 1 1 gx 2 2 )r m/(g x 1r 1 g x 2r 2 ) = m π is a non-interactive proof that log g1 u 1 = log g2 u 2 DLOG and related cryptosystems 17 / 26,
18 Cramer Shoup scheme (2) IND-CCA2 secure scheme assumptions: DDH and H is collision resistant hash function DLOG and related cryptosystems 18 / 26,
19 Elliptic curves introduction we start with elliptic curves over real numbers Weierstrass equation (a, b R): y 2 = x 3 + ax + b we are interested in non-singular curves, i.e. 4a b 2 0 non-singular x 3 + ax + b has no repeated roots points: E = {(x, y) y 2 = x 3 + ax + b} {0}, where 0 is an identity element (point in infinity) group (E, +) uses a commutative addition : notation: P = (x P, y P ), P = (x P, y P ) P + P = 0 P + P = R = (x R, y R ) such that the line PR is a tangent in P P + Q = R = (x R, y R ) such that R, P and Q are collinear DLOG and related cryptosystems 19 / 26,
20 Elliptic curves addition formulas P = (x P, y P ), Q = (x Q, y Q ) case 1: P + ( P) = (x P, y P ) + (x P, y P ) = 0 case 2 and case 3: P + Q = (x R, y R ) x R = λ 2 x P x Q y R = λ(x P x R ) y P λ = { (3x 2 P + a)(2y P) 1 P = Q (y Q y P )(x Q x P ) 1 x P x Q DLOG and related cryptosystems 20 / 26,
21 Elliptic curves over finite field GF(p) = (Z p, +, ), for prime p > 3 other finite fields can be used, e.g. GF(2 n ), with different forms, conditions and addition formulas E = {(x, y) y 2 = x 3 + ax + b mod p} {0}, for a, b Z p satisfying 4a b 2 0 (mod p) addition of points still works (mod p), i.e. (E, +) is an abelian group no geometric interpretation anymore Hasse s theorem: E p 1 2 p counting the exact number of points: Schoof s algorithm with O(log 5 p) operations in Z p or improved version Schoof-Elkies-Atkin algorithm with O(log 4 p) operations in Z p remark: a point P = (x P, y P ) can be uniquely represented by x P and the sign of y P DLOG and related cryptosystems 21 / 26,
22 Real world examples (1): NIST P-256 curve prime: p = the curve: y 2 = x 3 3x+ number of points (prime): DLOG and related cryptosystems 22 / 26,
23 Real world examples (2): NIST P-384 curve prime: p = the curve: y 2 = x 3 3x+ number of points (prime): required for TOP SECRET classification (NSA Suite B, 2015) critique: Failures in NIST s ECC standards (Bernstein, Lange, 2016) DLOG and related cryptosystems 23 / 26,
24 Real world examples (3): Curve25519 prime: p = the curve: y 2 = x x 2 + x number of points 8 p 1 for a prime p 1 = Montgomery form (different addition formulas, it can be translated into Weierstrass form) non-standard curve used (along other curves) in various applications (OpenSSH, ios, TextSecure, etc.) DLOG and related cryptosystems 24 / 26,
25 DLOG in elliptic curve groups (E, +) elliptic curve group point P E kp = P + P + + P, for an integer k 0 } {{ } k DLOG: given a point kp, compute k CDH: given ap and bp, compute (ab)p DLOG and related cryptosystems 25 / 26,
26 EC version of ElGamal scheme (E, +) elliptic curve group G E generator of some subgroup of E, ord(g) = q (prime) private key: random x Z q public key: Y = xg Encryption (M E): (R, S) = (kg, ky + M) for random k Z q Decryption ((R, S) E E): S xr = (ky + M) xr = (kx)g + M (kx)g = M group encoding DLOG and related cryptosystems 26 / 26,
Lecture 7: ElGamal and Discrete Logarithms
Lecture 7: ElGamal and Discrete Logarithms Johan Håstad, transcribed by Johan Linde 2006-02-07 1 The discrete logarithm problem Recall that a generator g of a group G is an element of order n such that
More informationShort Exponent Diffie-Hellman Problems
Short Exponent Diffie-Hellman Problems Takeshi Koshiba 12 and Kaoru Kurosawa 3 1 Secure Computing Lab., Fujitsu Laboratories Ltd. 2 ERATO Quantum Computation and Information Project, Japan Science and
More informationCPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Instructor: Michael Fischer Lecture by Ewa Syta Lecture 13 March 3, 2013 CPSC 467b, Lecture 13 1/52 Elliptic Curves Basics Elliptic Curve Cryptography CPSC
More informationOne can use elliptic curves to factor integers, although probably not RSA moduli.
Elliptic Curves Elliptic curves are groups created by defining a binary operation (addition) on the points of the graph of certain polynomial equations in two variables. These groups have several properties
More informationCPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Security Michael J. Fischer 1 Lecture 13 October 16, 2017 (notes revised 10/23/17) 1 Derived from lecture notes by Ewa Syta. CPSC 467, Lecture 13 1/57 Elliptic Curves
More informationElliptic Curve Cryptography
Elliptic Curve Cryptography Elliptic Curves An elliptic curve is a cubic equation of the form: y + axy + by = x 3 + cx + dx + e where a, b, c, d and e are real numbers. A special addition operation is
More informationPublic Key Cryptography
Public Key Cryptography Introduction Public Key Cryptography Unlike symmetric key, there is no need for Alice and Bob to share a common secret Alice can convey her public key to Bob in a public communication:
More informationWeek : Public Key Cryptosystem and Digital Signatures
Week 10-11 : Public Key Cryptosystem and Digital Signatures 1. Public Key Encryptions RSA, ElGamal, 2 RSA- PKC(1/3) 1st public key cryptosystem R.L.Rivest, A.Shamir, L.Adleman, A Method for Obtaining Digital
More informationG Advanced Cryptography April 10th, Lecture 11
G.30-001 Advanced Cryptography April 10th, 007 Lecturer: Victor Shoup Lecture 11 Scribe: Kristiyan Haralambiev We continue the discussion of public key encryption. Last time, we studied Hash Proof Systems
More informationOther Public-Key Cryptosystems
Other Public-Key Cryptosystems Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-11/
More informationAdvanced Topics in Cryptography
Advanced Topics in Cryptography Lecture 6: El Gamal. Chosen-ciphertext security, the Cramer-Shoup cryptosystem. Benny Pinkas based on slides of Moni Naor page 1 1 Related papers Lecture notes of Moni Naor,
More informationIntroduction to Elliptic Curve Cryptography
Indian Statistical Institute Kolkata May 19, 2017 ElGamal Public Key Cryptosystem, 1984 Key Generation: 1 Choose a suitable large prime p 2 Choose a generator g of the cyclic group IZ p 3 Choose a cyclic
More information8 Elliptic Curve Cryptography
8 Elliptic Curve Cryptography 8.1 Elliptic Curves over a Finite Field For the purposes of cryptography, we want to consider an elliptic curve defined over a finite field F p = Z/pZ for p a prime. Given
More informationElliptic Curve Cryptography with Derive
Elliptic Curve Cryptography with Derive Johann Wiesenbauer Vienna University of Technology DES-TIME-2006, Dresden General remarks on Elliptic curves Elliptic curces can be described as nonsingular algebraic
More informationIntroduction to Cybersecurity Cryptography (Part 4)
Introduction to Cybersecurity Cryptography (Part 4) Review of Last Lecture Blockciphers Review of DES Attacks on Blockciphers Advanced Encryption Standard (AES) Modes of Operation MACs and Hashes Message
More informationElliptic Curves. Giulia Mauri. Politecnico di Milano website:
Elliptic Curves Giulia Mauri Politecnico di Milano email: giulia.mauri@polimi.it website: http://home.deib.polimi.it/gmauri May 13, 2015 Giulia Mauri (DEIB) Exercises May 13, 2015 1 / 34 Overview 1 Elliptic
More informationIntroduction to Cryptography. Lecture 8
Introduction to Cryptography Lecture 8 Benny Pinkas page 1 1 Groups we will use Multiplication modulo a prime number p (G, ) = ({1,2,,p-1}, ) E.g., Z 7* = ( {1,2,3,4,5,6}, ) Z p * Z N * Multiplication
More informationArithmétique et Cryptographie Asymétrique
Arithmétique et Cryptographie Asymétrique Laurent Imbert CNRS, LIRMM, Université Montpellier 2 Journée d inauguration groupe Sécurité 23 mars 2010 This talk is about public-key cryptography Why did mathematicians
More informationPublic Key Cryptography
Public Key Cryptography Ali El Kaafarani Mathematical Institute Oxford University 1 of 60 Outline 1 RSA Encryption Scheme 2 Discrete Logarithm and Diffie-Hellman Algorithm 3 ElGamal Encryption Scheme 4
More informationCryptography IV: Asymmetric Ciphers
Cryptography IV: Asymmetric Ciphers Computer Security Lecture 7 David Aspinall School of Informatics University of Edinburgh 31st January 2011 Outline Background RSA Diffie-Hellman ElGamal Summary Outline
More informationIntroduction to Elliptic Curve Cryptography. Anupam Datta
Introduction to Elliptic Curve Cryptography Anupam Datta 18-733 Elliptic Curve Cryptography Public Key Cryptosystem Duality between Elliptic Curve Cryptography and Discrete Log Based Cryptography Groups
More informationCryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Module No. # 01 Lecture No. # 33 The Diffie-Hellman Problem
More informationOther Public-Key Cryptosystems
Other Public-Key Cryptosystems Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: 10-1 Overview 1. How to exchange
More informationIntroduction to Cybersecurity Cryptography (Part 4)
Introduction to Cybersecurity Cryptography (Part 4) Review of Last Lecture Blockciphers Review of DES Attacks on Blockciphers Advanced Encryption Standard (AES) Modes of Operation MACs and Hashes Message
More informationElliptic curves: Theory and Applications. Day 4: The discrete logarithm problem.
Elliptic curves: Theory and Applications. Day 4: The discrete logarithm problem. Elisa Lorenzo García Université de Rennes 1 14-09-2017 Elisa Lorenzo García (Rennes 1) Elliptic Curves 4 14-09-2017 1 /
More informationChapter 8 Public-key Cryptography and Digital Signatures
Chapter 8 Public-key Cryptography and Digital Signatures v 1. Introduction to Public-key Cryptography 2. Example of Public-key Algorithm: Diffie- Hellman Key Exchange Scheme 3. RSA Encryption and Digital
More information14 Years of Chosen Ciphertext Security: A Survey of Public Key Encryption. Victor Shoup New York University
14 Years of Chosen Ciphertext Security: A Survey of Public Key Encryption Victor Shoup New York University A Historical Perspective The wild years (mid 70 s-mid 80 s): Diffie-Hellman, RSA, ElGamal The
More informationPublic-Key Encryption: ElGamal, RSA, Rabin
Public-Key Encryption: ElGamal, RSA, Rabin Introduction to Modern Cryptography Benny Applebaum Tel-Aviv University Fall Semester, 2011 12 Public-Key Encryption Syntax Encryption algorithm: E. Decryption
More informationElliptic Curves Cryptography and factorization. Part VIII. Elliptic curves cryptography and factorization. Historical Remarks.
Elliptic Curves Cryptography and factorization Part VIII Elliptic curves cryptography and factorization Cryptography based on manipulation of points of so called elliptic curves is getting momentum and
More informationCSC 774 Advanced Network Security
CSC 774 Advanced Network Security Topic 2.6 ID Based Cryptography #2 Slides by An Liu Outline Applications Elliptic Curve Group over real number and F p Weil Pairing BasicIdent FullIdent Extensions Escrow
More informationPublic-key Cryptography and elliptic curves
Public-key Cryptography and elliptic curves Dan Nichols University of Massachusetts Amherst nichols@math.umass.edu WINRS Research Symposium Brown University March 4, 2017 Cryptography basics Cryptography
More informationCSC 774 Advanced Network Security
CSC 774 Advanced Network Security Topic 2.6 ID Based Cryptography #2 Slides by An Liu Outline Applications Elliptic Curve Group over real number and F p Weil Pairing BasicIdent FullIdent Extensions Escrow
More informationDigital Signatures. Saravanan Vijayakumaran Department of Electrical Engineering Indian Institute of Technology Bombay
Digital Signatures Saravanan Vijayakumaran sarva@ee.iitb.ac.in Department of Electrical Engineering Indian Institute of Technology Bombay July 24, 2018 1 / 29 Group Theory Recap Groups Definition A set
More informationCS 282A/MATH 209A: Foundations of Cryptography Prof. Rafail Ostrovsky. Lecture 7
CS 282A/MATH 209A: Foundations of Cryptography Prof. Rafail Ostrovsky Lecture 7 Lecture date: Monday, 28 February, 2005 Scribe: M.Chov, K.Leung, J.Salomone 1 Oneway Trapdoor Permutations Recall that a
More informationCPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 11 February 21, 2013 CPSC 467b, Lecture 11 1/27 Discrete Logarithm Diffie-Hellman Key Exchange ElGamal Key Agreement Primitive Roots
More informationQuestion 2.1. Show that. is non-negligible. 2. Since. is non-negligible so is μ n +
Homework #2 Question 2.1 Show that 1 p n + μ n is non-negligible 1. μ n + 1 p n > 1 p n 2. Since 1 p n is non-negligible so is μ n + 1 p n Question 2.1 Show that 1 p n - μ n is non-negligible 1. μ n O(
More informationMATH 158 FINAL EXAM 20 DECEMBER 2016
MATH 158 FINAL EXAM 20 DECEMBER 2016 Name : The exam is double-sided. Make sure to read both sides of each page. The time limit is three hours. No calculators are permitted. You are permitted one page
More informationOn The Security of The ElGamal Encryption Scheme and Damgård s Variant
On The Security of The ElGamal Encryption Scheme and Damgård s Variant J. Wu and D.R. Stinson David R. Cheriton School of Computer Science University of Waterloo Waterloo, ON, Canada {j32wu,dstinson}@uwaterloo.ca
More information5.4 ElGamal - definition
5.4 ElGamal - definition In this section we define the ElGamal encryption scheme. Next to RSA it is the most important asymmetric encryption scheme. Recall that for a cyclic group G, an element g G is
More informationApplied Cryptography and Computer Security CSE 664 Spring 2018
Applied Cryptography and Computer Security Lecture 17: Elliptic Curves and Applications Department of Computer Science and Engineering University at Buffalo 1 Lecture Outline We previously looked at discrete
More informationLecture 4 Chiu Yuen Koo Nikolai Yakovenko. 1 Summary. 2 Hybrid Encryption. CMSC 858K Advanced Topics in Cryptography February 5, 2004
CMSC 858K Advanced Topics in Cryptography February 5, 2004 Lecturer: Jonathan Katz Lecture 4 Scribe(s): Chiu Yuen Koo Nikolai Yakovenko Jeffrey Blank 1 Summary The focus of this lecture is efficient public-key
More informationLecture Notes, Week 6
YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE CPSC 467b: Cryptography and Computer Security Week 6 (rev. 3) Professor M. J. Fischer February 15 & 17, 2005 1 RSA Security Lecture Notes, Week 6 Several
More informationRSA-OAEP and Cramer-Shoup
RSA-OAEP and Cramer-Shoup Olli Ahonen Laboratory of Physics, TKK 11th Dec 2007 T-79.5502 Advanced Cryptology Part I: Outline RSA, OAEP and RSA-OAEP Preliminaries for the proof Proof of IND-CCA2 security
More informationA Practical Elliptic Curve Public Key Encryption Scheme Provably Secure Against Adaptive Chosen-message Attack
A Practical Elliptic Curve Public Key Encryption Scheme Provably Secure Against Adaptive Chosen-message Attack Huafei Zhu InfoComm Security Department, Institute for InfoComm Research. 21 Heng Mui Keng
More informationLecture 9 Julie Staub Avi Dalal Abheek Anand Gelareh Taban. 1 Introduction. 2 Background. CMSC 858K Advanced Topics in Cryptography February 24, 2004
CMSC 858K Advanced Topics in Cryptography February 24, 2004 Lecturer: Jonathan Katz Lecture 9 Scribe(s): Julie Staub Avi Dalal Abheek Anand Gelareh Taban 1 Introduction In previous lectures, we constructed
More informationSuppose F is a field and a1,..., a6 F. Definition 1. An elliptic curve E over a field F is a curve given by an equation:
Elliptic Curve Cryptography Jim Royer CIS 428/628: Introduction to Cryptography November 6, 2018 Suppose F is a field and a 1,..., a 6 F. Definition 1. An elliptic curve E over a field F is a curve given
More informationTi Secured communications
Ti5318800 Secured communications Pekka Jäppinen September 20, 2007 Pekka Jäppinen, Lappeenranta University of Technology: September 20, 2007 Relies on use of two keys: Public and private Sometimes called
More informationTechnische Universität München (I7) Winter 2013/14 Dr. M. Luttenberger / M. Schlund SOLUTION. Cryptography Endterm
Technische Universität München (I7) Winter 2013/14 Dr. M. Luttenberger / M. Schlund SOLUTION Cryptography Endterm Exercise 1 One Liners 1.5P each = 12P For each of the following statements, state if it
More informationPublic-key Cryptography and elliptic curves
Public-key Cryptography and elliptic curves Dan Nichols nichols@math.umass.edu University of Massachusetts Oct. 14, 2015 Cryptography basics Cryptography is the study of secure communications. Here are
More informationJoseph Fadyn Kennesaw State University 1100 South Marietta Parkway Marietta, Georgia
ELLIPTIC CURVE CRYPTOGRAPHY USING MAPLE Joseph Fadyn Kennesaw State University 1100 South Marietta Parkway Marietta, Georgia 30060 jfadyn@spsu.edu An elliptic curve is one of the form: y 2 = x 3 + ax +
More informationID-based Encryption Scheme Secure against Chosen Ciphertext Attacks
ID-based Encryption Scheme Secure against Chosen Ciphertext Attacks ongxing Lu and Zhenfu Cao Department of Computer Science and Engineering, Shanghai Jiao Tong University, Shanghai 200030, P.. China {cao-zf,
More informationLecture Summary. 2 Simplified Cramer-Shoup. CMSC 858K Advanced Topics in Cryptography February 26, Chiu Yuen Koo Nikolai Yakovenko
CMSC 858K Advanced Topics in Cryptography February 26, 2004 Lecturer: Jonathan Katz Lecture 10 Scribe(s): Jeffrey Blank Chiu Yuen Koo Nikolai Yakovenko 1 Summary We had previously begun to analyze the
More informationDefinition: For a positive integer n, if 0<a<n and gcd(a,n)=1, a is relatively prime to n. Ahmet Burak Can Hacettepe University
Number Theory, Public Key Cryptography, RSA Ahmet Burak Can Hacettepe University abc@hacettepe.edu.tr The Euler Phi Function For a positive integer n, if 0
More informationIntroduction to Public-Key Cryptosystems:
Introduction to Public-Key Cryptosystems: Technical Underpinnings: RSA and Primality Testing Modes of Encryption for RSA Digital Signatures for RSA 1 RSA Block Encryption / Decryption and Signing Each
More informationDefinition of a finite group
Elliptic curves Definition of a finite group (G, * ) is a finite group if: 1. G is a finite set. 2. For each a and b in G, also a * b is in G. 3. There is an e in G such that for all a in G, a * e= e *
More informationLecture 1: Introduction to Public key cryptography
Lecture 1: Introduction to Public key cryptography Thomas Johansson T. Johansson (Lund University) 1 / 44 Key distribution Symmetric key cryptography: Alice and Bob share a common secret key. Some means
More informationPublic Key Algorithms
Public Key Algorithms Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-09/
More informationLemma 1.2. (1) If p is prime, then ϕ(p) = p 1. (2) If p q are two primes, then ϕ(pq) = (p 1)(q 1).
1 Background 1.1 The group of units MAT 3343, APPLIED ALGEBRA, FALL 2003 Handout 3: The RSA Cryptosystem Peter Selinger Let (R, +, ) be a ring. Then R forms an abelian group under addition. R does not
More informationASYMMETRIC ENCRYPTION
ASYMMETRIC ENCRYPTION 1 / 1 Recommended Book Steven Levy. Crypto. Penguin books. 2001. A non-technical account of the history of public-key cryptography and the colorful characters involved. 2 / 1 Recall
More informationNotes for Lecture 17
U.C. Berkeley CS276: Cryptography Handout N17 Luca Trevisan March 17, 2009 Notes for Lecture 17 Scribed by Matt Finifter, posted April 8, 2009 Summary Today we begin to talk about public-key cryptography,
More informationBreaking Plain ElGamal and Plain RSA Encryption
Breaking Plain ElGamal and Plain RSA Encryption (Extended Abstract) Dan Boneh Antoine Joux Phong Nguyen dabo@cs.stanford.edu joux@ens.fr pnguyen@ens.fr Abstract We present a simple attack on both plain
More informationThe Decisional Diffie-Hellman Problem and the Uniform Boundedness Theorem
The Decisional Diffie-Hellman Problem and the Uniform Boundedness Theorem Qi Cheng and Shigenori Uchiyama April 22, 2003 Abstract In this paper, we propose an algorithm to solve the Decisional Diffie-Hellman
More informationThe Cramer-Shoup Cryptosystem
The Cramer-Shoup Cryptosystem Eileen Wagner October 22, 2014 1 / 28 The Cramer-Shoup system is an asymmetric key encryption algorithm, and was the first efficient scheme proven to be secure against adaptive
More informationL7. Diffie-Hellman (Key Exchange) Protocol. Rocky K. C. Chang, 5 March 2015
L7. Diffie-Hellman (Key Exchange) Protocol Rocky K. C. Chang, 5 March 2015 1 Outline The basic foundation: multiplicative group modulo prime The basic Diffie-Hellman (DH) protocol The discrete logarithm
More informationTopics in Cryptography. Lecture 5: Basic Number Theory
Topics in Cryptography Lecture 5: Basic Number Theory Benny Pinkas page 1 1 Classical symmetric ciphers Alice and Bob share a private key k. System is secure as long as k is secret. Major problem: generating
More informationElliptic Curve Cryptography
The State of the Art of Elliptic Curve Cryptography Ernst Kani Department of Mathematics and Statistics Queen s University Kingston, Ontario Elliptic Curve Cryptography 1 Outline 1. ECC: Advantages and
More informationSM9 identity-based cryptographic algorithms Part 1: General
SM9 identity-based cryptographic algorithms Part 1: General Contents 1 Scope... 1 2 Terms and definitions... 1 2.1 identity... 1 2.2 master key... 1 2.3 key generation center (KGC)... 1 3 Symbols and abbreviations...
More informationCSC 5930/9010 Modern Cryptography: Number Theory
CSC 5930/9010 Modern Cryptography: Number Theory Professor Henry Carter Fall 2018 Recap Hash functions map arbitrary-length strings to fixedlength outputs Cryptographic hashes should be collision-resistant
More informationSecurity Issues in Cloud Computing Modern Cryptography II Asymmetric Cryptography
Security Issues in Cloud Computing Modern Cryptography II Asymmetric Cryptography Peter Schwabe October 21 and 28, 2011 So far we assumed that Alice and Bob both have some key, which nobody else has. How
More informationEx1 Ex2 Ex3 Ex4 Ex5 Ex6
Technische Universität München (I7) Winter 2012/13 Dr. M. Luttenberger / M. Schlund Cryptography Endterm Last name: First name: Student ID no.: Signature: If you feel ill, let us know immediately. Please,
More information5199/IOC5063 Theory of Cryptology, 2014 Fall
5199/IOC5063 Theory of Cryptology, 2014 Fall Homework 2 Reference Solution 1. This is about the RSA common modulus problem. Consider that two users A and B use the same modulus n = 146171 for the RSA encryption.
More informationQuestion: Total Points: Score:
University of California, Irvine COMPSCI 134: Elements of Cryptography and Computer and Network Security Midterm Exam (Fall 2016) Duration: 90 minutes November 2, 2016, 7pm-8:30pm Name (First, Last): Please
More informationPoints of High Order on Elliptic Curves ECDSA
! Independent thesis advanced level (degree of master (two years)) Points of High Order on Elliptic Curves ECDSA Author: Behnaz Kouchaki Barzi Supervisor: Per-Anders Svensson Examiner: Andrei Khrennikov
More informationAsymmetric Encryption
-3 s s Encryption Comp Sci 3600 Outline -3 s s 1-3 2 3 4 5 s s Outline -3 s s 1-3 2 3 4 5 s s Function Using Bitwise XOR -3 s s Key Properties for -3 s s The most important property of a hash function
More informationRecent Advances in Identity-based Encryption Pairing-free Constructions
Fields Institute Workshop on New Directions in Cryptography 1 Recent Advances in Identity-based Encryption Pairing-free Constructions Kenny Paterson kenny.paterson@rhul.ac.uk June 25th 2008 Fields Institute
More information1 Number Theory Basics
ECS 289M (Franklin), Winter 2010, Crypto Review 1 Number Theory Basics This section has some basic facts about number theory, mostly taken (or adapted) from Dan Boneh s number theory fact sheets for his
More informationFinite Field Cryptography
Finite Field Cryptography Martijn Stam EPFL LACAL ECRYPT-II Winter School 2-6 February, 2009 Roadmap 1 Groups Denitions Cryptographic Applications 2 Finite Fields Basics F q 2 Arithmetic Cyclotomic Subgroups
More informationChapter 4 Asymmetric Cryptography
Chapter 4 Asymmetric Cryptography Introduction Encryption: RSA Key Exchange: Diffie-Hellman [NetSec/SysSec], WS 2008/2009 4.1 Asymmetric Cryptography General idea: Use two different keys -K and +K for
More informationNAVAL POSTGRADUATE SCHOOL THESIS
NAVAL POSTGRADUATE SCHOOL MONTEREY, CALIFORNIA THESIS AN ANALYSIS OF ALGORITHMS FOR SOLVING DISCRETE LOGARITHMS IN FIXED GROUPS by Joseph Mihalcik March 2010 Thesis Advisor: Second Reader: Dennis Volpano
More informationAsymmetric Cryptography
Asymmetric Cryptography Chapter 4 Asymmetric Cryptography Introduction Encryption: RSA Key Exchange: Diffie-Hellman General idea: Use two different keys -K and +K for encryption and decryption Given a
More informationIntroduction to Modern Cryptography. Benny Chor
Introduction to Modern Cryptography Benny Chor RSA: Review and Properties Factoring Algorithms Trapdoor One Way Functions PKC Based on Discrete Logs (Elgamal) Signature Schemes Lecture 8 Tel-Aviv University
More informationPublic Key 9/17/2018. Symmetric Cryptography Review. Symmetric Cryptography: Shortcomings (1) Symmetric Cryptography: Analogy
Symmetric Cryptography Review Alice Bob Public Key x e K (x) y d K (y) x K K Instructor: Dr. Wei (Lisa) Li Department of Computer Science, GSU Two properties of symmetric (secret-key) crypto-systems: The
More informationElliptic Curve Cryptosystems
Elliptic Curve Cryptosystems Santiago Paiva santiago.paiva@mail.mcgill.ca McGill University April 25th, 2013 Abstract The application of elliptic curves in the field of cryptography has significantly improved
More informationLecture 17 - Diffie-Hellman key exchange, pairing, Identity-Based Encryption and Forward Security
Lecture 17 - Diffie-Hellman key exchange, pairing, Identity-Based Encryption and Forward Security Boaz Barak November 21, 2007 Cyclic groups and discrete log A group G is cyclic if there exists a generator
More informationPart VIII. Elliptic curves cryptography and factorization
Part VIII Elliptic curves cryptography and factorization ELLIPTIC CURVES CRYPTOGRAPHY and FACTORIZATION Elliptic curve cryptography (ECC) is an approach to public-key cryptography based on the algebraic
More informationDiscrete Logarithm Problem
Discrete Logarithm Problem Çetin Kaya Koç koc@cs.ucsb.edu (http://cs.ucsb.edu/~koc/ecc) Elliptic Curve Cryptography lect08 discrete log 1 / 46 Exponentiation and Logarithms in a General Group In a multiplicative
More informationPublic Key Cryptography with a Group of Unknown Order
Public Key Cryptography with a Group of Unknown Order Richard P. Brent 1 Oxford University rpb@comlab.ox.ac.uk Programming Research Group Report PRG TR 02 00 5 June 2000 Abstract We present algorithms
More informationIntroduction to Cryptography. Lecture 6
Introduction to Cryptography Lecture 6 Benny Pinkas page 1 Public Key Encryption page 2 Classical symmetric ciphers Alice and Bob share a private key k. System is secure as long as k is secret. Major problem:
More informationProvable Security for Public-Key Schemes. Outline. I Basics. Secrecy of Communications. Outline. David Pointcheval
Provable Security for Public-Key Schemes I Basics David Pointcheval Ecole normale supérieure, CNRS & INRIA IACR-SEAMS School Cryptographie: Foundations and New Directions November 2016 Hanoi Vietnam Introduction
More informationDigital signature schemes
Digital signature schemes Martin Stanek Department of Computer Science Comenius University stanek@dcs.fmph.uniba.sk Cryptology 1 (2017/18) Content Introduction digital signature scheme security of digital
More informationNetwork Security Technology Spring, 2018 Tutorial 3, Week 4 (March 23) Due Date: March 30
Network Security Technology Spring, 2018 Tutorial 3, Week 4 (March 23) LIU Zhen Due Date: March 30 Questions: 1. RSA (20 Points) Assume that we use RSA with the prime numbers p = 17 and q = 23. (a) Calculate
More informationMathematics of Public Key Cryptography
Mathematics of Public Key Cryptography Eric Baxter April 12, 2014 Overview Brief review of public-key cryptography Mathematics behind public-key cryptography algorithms What is Public-Key Cryptography?
More informationPublic-Key Cryptosystems CHAPTER 4
Public-Key Cryptosystems CHAPTER 4 Introduction How to distribute the cryptographic keys? Naïve Solution Naïve Solution Give every user P i a separate random key K ij to communicate with every P j. Disadvantage:
More informationMathematics of Cryptography
UNIT - III Mathematics of Cryptography Part III: Primes and Related Congruence Equations 1 Objectives To introduce prime numbers and their applications in cryptography. To discuss some primality test algorithms
More informationLecture V : Public Key Cryptography
Lecture V : Public Key Cryptography Internet Security: Principles & Practices John K. Zao, PhD (Harvard) SMIEEE Amir Rezapoor Computer Science Department, National Chiao Tung University 2 Outline Functional
More informationCryptography and Security Protocols. Previously on CSP. Today. El Gamal (and DSS) signature scheme. Paulo Mateus MMA MEIC
Cryptography and Security Protocols Paulo Mateus MMA MEIC Previously on CSP Symmetric Cryptosystems. Asymmetric Cryptosystem. Basics on Complexity theory : Diffie-Hellman key agreement. Algorithmic complexity.
More informationCourse Business. Homework 3 Due Now. Homework 4 Released. Professor Blocki is travelling, but will be back next week
Course Business Homework 3 Due Now Homework 4 Released Professor Blocki is travelling, but will be back next week 1 Cryptography CS 555 Week 11: Discrete Log/DDH Applications of DDH Factoring Algorithms,
More informationPolynomial Interpolation in the Elliptic Curve Cryptosystem
Journal of Mathematics and Statistics 7 (4): 326-331, 2011 ISSN 1549-3644 2011 Science Publications Polynomial Interpolation in the Elliptic Curve Cryptosystem Liew Khang Jie and Hailiza Kamarulhaili School
More information10 Public Key Cryptography : RSA
10 Public Key Cryptography : RSA 10.1 Introduction The idea behind a public-key system is that it might be possible to find a cryptosystem where it is computationally infeasible to determine d K even if
More informationPublic Key Encryption
Public Key Encryption KG October 17, 2017 Contents 1 Introduction 1 2 Public Key Encryption 2 3 Schemes Based on Diffie-Hellman 3 3.1 ElGamal.................................... 5 4 RSA 7 4.1 Preliminaries.................................
More information