Correctness, Security and Efficiency of RSA

Transcription

1 Correttezza di RSA Correctness, Security and Efficiency of RSA Ozalp Babaoglu! Bisogna dimostrare D(C(m)) = m ALMA MATER STUDIORUM UNIVERSITA DI BOLOGNA 2 Correttezza di RSA Correttezza di RSA! Risultati classici:! Property of modular arithmetic:! if x mod n = 1, then for any integer y, we have x y mod n = 1! if x mod n = 0, then for any integer y, we have x y mod n = 0! Let m be an integer encoding of the original message M such that 0 < m < n 3 4

2 Correttezza di RSA Correttezza di RSA = m follows by Euler s theorem when m is relatively prime to n but can be shown to hold for all m 5 6 Sicurezza di RSA Sicurezza di RSA! Brute force attack! Try all possible private keys! Defense (as for any other cryptosystem)! Use large enough key space! Mathematical attacks:! Fattorizzo n e ottengo p e q! Calcolo!(n), senza fattorizzare n, e poi calcolo d = e -1 (mod!(n))! Both approaches are characterized by the cost of factoring n 7 8

3 The Factoring Problem The Factoring Problem! No theorems or lower-bound results! Only empirical evidence about its difficulty! No guarantee that what is secure today will remain secure tomorrow Number of decimal digits! 1GHz Pentium is about a 250-MIPS machine 9 Number of bits Date achieved MIPS-years Algorithm April Quadratic Sieve April Quadratic Sieve June Quadratic Sieve April Quadratic Sieve April Generalized number field sieve February Generalized number field sieve August Generalized number field sieve April Lattice sieve December Lattice sieve May Lattice sieve (18 months using 80 Opteron processors) 10 Some RSA Numbers The Factoring Problem State-of-the-art! RSA-155= = ! ! RSA-160= = ! ! RSA-174= = ! ! RSA-200= = ! ! As of the end of 2007, thanks to the constant decline in memory prices, the ready availability of multi-core 64-bit computers, and the availability of the Bonn group's efficient sieving code and robust open-source software for the finishing stages, special-form numbers of up to 750 bits and general-form numbers of up to about 520 bits can be factored in a few months on a few PCs by a single person without any special mathematical experience 11 12

4 Efficiency Efficiency! How to compute (x y mod n) efficiently:! What if y is not a power of two?! Base operations:! From x y we can obtain x 2y and x y+1 with one multiplication each:! x 2y = x y x y! x y+1 = x x y Efficiency Efficiency! Example: 15 16

5 Efficiency Generation of Large Primes! Property of modular arithmetic: [(a mod n) " (b mod n)] mod n = (a " b) mod n! Therefore, each of the intermediate results can be reduced by modulo n! This makes the computation practical! For small primes, we can look them up in a table! But what if we want primes that have hundreds of digits?! How are prime numbers distributed? What is the probability that a number n picked at random is prime? ln(n) Generation of Large Primes Primality Testing! If n has 10 digits, then! If n has 100 digits, then! These probabilities are too small for using a randomly picked number as prime without further testing! Given positive integer n, respond yes if it is prime, no otherwise (composite)! Naïve method: check wether any integer k from 2 to n-1 divides n! Rather than testing all integers up to n-1, if suffices to test k only up to #n! Complexity: O(#n) or O(2 $m ) where m = log n is the size of the input 19 20

6 Primality Testing! Until recently, no polynomial (in the size of the input) algorithm existed for primality testing! If we assume the generalized Riemann hypothesis, an O((log n) 4 ) for primality testing exists! In 2002, Agrawal, Kayal and Saxena (AKS) discovered an O((log n) 6 ) for primality testing! Even though these algorithms are polynomial, they are too expensive to be practical! Resort to probabilistic primality testing! Teorema di Fermat: Se allora 21 22! Risultato di Pomerance (1981):! n numero casuale di circa 100 cifre! a numero casuale inferiore a n 1. genero n (dispari) a caso 2. genero a<n a caso 3. calcolo 4. if x = 1 then n primo else n composto 23 24

7 ! If n fails the test, then it is not prime! If n passes the test, then it may still not be a prime with probability! What if this probability is not small enough? 1. genero n (dispari) a caso 2. repeat k times begin 3. genero a<n a caso 4. calcolo 5. if x = 1 6. then continue 7. else reject n and go to 1 8. end 25 26! Probability of accepting an n that is not prime is reduced to! On the average, how many numbers are tested before accepting? log(n)/2! Example: for a 200-bit random number, need about log(2 200 )/2=70 trials 27