Asymmetric Encryption

Transcription

1 -3 s s Encryption Comp Sci 3600

2 Outline -3 s s s s

3 Outline -3 s s s s

4 Function Using Bitwise XOR -3 s s

5 Key Properties for -3 s s The most important property of a hash function is being one-way: easy to compute but hard to invert Given M it is easy to compute h(m) Given y = h(m), it is hard to find M Cryptographic hash functions are collision resistant: hard to find two messages with the same hash value Given M, it is hard to find a different message M such that h(m ) = h(m)

6 Outline -3 s s s s

7 () -3 s s was originally developed by NIST Published as FIPS 180 in 1993 Was revised in 1995 as -1 (Produces 160-bit hash values) NIST issued revised FIPS in 2002 Adds 3 additional versions of -256, -384, -512 With 256/384/512-bit hash values Same basic structure as -1 but greater security In 2005 NIST announced the intention to phase out approval of -1 and move to a reliance on the other versions by 2010

8 Comparison on Parameters -3 s s in bits

9 Message Digest Generation Using s s IV = 512 H 1 F F H Message N 1024 bits 1024 bits 1024 bits 1024 bits M 1 M 2 M N 1024 L bits + + = word-by-word addition mod 2 64 H 2 F bits + L H N = hash code Figure 21.2 Message Digest Generation Using -512

10 -512 Processing of a Single 1024-Bit Block -3 s s M i H i 1 message schedule 64 a b c d e f g h W 0 K 0 Round 0 W t a b c d e f g h Round t a b c d e f g h W 79 K 79 Round K t H i

11 Outline -3 s s s s

12 -3-3 s s -2 shares same structure and mathematical operations as its predecessors and causes concern Due to time required to replace -2 should it become vulnerable, NIST announced in 2007 a competition to produce -3 Requirements -2 shares same structure and mathematical operations as its predecessors and causes concern Due to time required to replace -2 should it become vulnerable, NIST announced in 2007 a competition to produce -3

13 Outline -3 s s s s

14 -3 s s Interest in developing a MAC derived from a cryptographic hash code Cryptographic hash functions generally execute faster Library code is widely available -1 was not deigned for use as a MAC because it does not rely on a secret key Issued as RFC2014 Has been chosen as the mandatory-to-implement MAC for IP security Used in other Internet protocols such as Transport Layer (TLS) and Secure Electronic Transaction (SET)

15 Outline -3 s s s s

16 -3 s s To use, without modifications, available hash functions To use and handle keys in a simple way To allow for easy replaceability of the embedded hash function in case faster or more secure hash functions are found or required To preserve the original performance of the hash function without incurring a significant degradation To have a well-understood cryptographic analysis of the strength of the authentication mechanism based on reasonable assumptions on the embedded hash function

17 Outline -3 s s s s

18 Structure -3 s s K + K + ipad b bits b bits b bits S i Y 0 Y 1 Y L 1 IV n bits Hash opad n bits H(S i M) b bits pad to b bits S o IV n bits Hash n bits (K, M)

19 Outline -3 s s s s

20 Outline -3 s s s s

21 -3 s s Definition () A group G is a set of elements together with a binary operation (e.g., +), s.t., 1 Closure under +: For every a and b in G, a + b is a unique element of G. 2 Associative: For all a, b and c in G, a + (b + c) = (a + b) + c 3 Identity element: The set has a unique identity element e for every element a of G, s.t., a + e = e + a = a 4 Inverse: Every a of G has a unique inverse a 1 in G, s.t., a + a 1 = a 1 + a = e

22 -3 s s Example (Additive s) Z n = {0, 1, 3,..., n 1} generally denotes an additive group with addition modulo n as the group operator Suppose n = 35, then Z 35 = {0, 1, 2,..., 34} If a = 7 and b = 13, then a + b = mod 35 = 20 If a = 17 and b = 33, then a + b = mod 35 = 15 The identity element of Z 35 is 0 The inverse of 17 is 18 in Z 35

23 -3 s s Example (Multiplicative s) Z n = {a 0 < a < n gcd(a, n) = 1} generally denotes a multiplicative group with multiplication modulo n as the group operator Suppose n = 35, then Z35 = {1, 2, 3, 4, 6, 8, 9, 11, 12, 13, 16, 17, 18, 19, 22, 23, 24, 26, 27, 29, 31, 32, 33, 34} If a = 8 and b = 13, then a b = 8 13 mod 35 = 34 If a = 17 and b = 33, then a b = mod 35 = 1 The identity element of Z 35 is 1 The inverse of 17 is 33 in Z 35 How to efficiently find the inverse of an element in a large multiplicative group?

24 Outline -3 s s s s

25 Prime Numbers - Basic Definitions -3 s s Definition (Prime Numbers) A prime number is an integer greater than 1 and is divisible only by 1 and itself. A composite number of an integer greater than 1 and not a prime. Definition (Relative Prime) Two integers a and b are relatively prime if gcd(a, b) = 1. Definition For positive real numbers x, let π(x) be the number of prime numbers less than or equal to x.

26 Prime Numbers - Important Theorems -3 s s Theorem (Fundamental Theorem of Arithmetic) Every integer greater than 1 can be written as a product of primes, and this product is unique if the primes are written in nondecreasing order. Theorem (The Prime Number Theorem) The ratio of π(x) to x/ ln x tends to 1 as x goes to infinity: lim x π(x) x/ ln x = 1

27 Identifying Primes - Trial Division -3 s s 1 Is Prime(n) Require: n a positive integer 1: if (n < 2 ) then 2: return false 3: end if 4: for (i = 2; i n ; i = i + 1) do 5: if (n mod i = 0 ) then 6: return false 7: end if 8: end for 9: return true

28 Identifying Primes - Sieve of Eratosthenes -3 s s 2 Prime Sieve(T, n) Require: n a positive integer > 2; T is an array of size n and each entry is initialize to true 1: T [0] = false 2: T [1] = false 3: p = 2 4: while (p n T [p] = true ) do 5: i = 2p 6: while (i n) do 7: T [i] = false 8: i = i + p 9: end while 10: end while

29 -3 s s Theorem () Let a and n are positive integers and relative primes. Then a φ(n) 1 mod n where φ(n) is Euler s totient function. Theorem (Euler s totient function φ(n)) Suppose n = pq where p and q are primes. Then φ(n) = (p 1)(q 1)

30 -3 s s Example (Suppose n = 35 and a = 17) φ(35) = (5 1)(7 1) = 24 a φ(n) mod n = 17 φ(35) mod 35 = 1 a φ(n) 1 mod n = 17 φ(35) 1 mod 35 = 33

31 Computing Exponentiation -3 s s 3 Fast Exponentiation(a,n) a n Require: a 0 and n > 0 1: e n, y 1, z a 2: while e > 0 do 3: if e mod 2 = 1 then 4: y y z 5: end if 6: z z z 7: e e 2 8: end while 9: return y

32 Fast and Randomized Primality Testing -3 s s Euler s theorem forms a foundation for identifying primes If a and n are relative prime and a φ(n) mod n = 1, then n is a probably a prime Miller-Rabin probabilistic primality test

33 Outline -3 s s s s

34 RSA Encryption -3 s s By Rivest, Shamir, and Adleman of MIT in 1977 Best known and widely used public-key algorithm Uses exponentiation of integers modulo a prime

35 Outline -3 s s s s

36 System Parameters -3 s s n = pq where p and q are large primes with similar sizes The size of p or q needs to be at least 2, 048 bits Plaintext space: Z n Ciphertext space: Z n Public key: n, e where is an integer relative prime to φ(n) Private key: d where ed 1 mod φ(n)

37 Outline -3 s s s s

38 -3 s s Encryption: E(x, n, e) = x e : D(y, d) = y d mod n mod n D(y, d) = y d mod n = x ed mod n = x kφ(n) 1 mod n ( = x φ(n)) k x mod n = x

39 -3 s s Example (p = 11, q = 17 and e = 3) Using Extended Euclidean: d = 107 x = 10 y = 10 3 mod 187 = 65 D(y, e) = mod 187 = 10

40 RSA -3 s s

41 Example of RSA -3 plaintext 88 Encryption 7 88 mod 187 = 11 ciphertext mod 187 = 88 plaintext 88 PU = 7, 187 PR = 23, 187 s s Figure 21.6 Example of RSA

42 Outline -3 s s s s

43 of RSA -3 s s Brute force: Involves trying all possible private keys Mathematical attacks: There are several approaches, all equivalent in effort to factoring the product of two primes Timing attacks: These depend on the running time of the decryption algorithm Chosen cipehrtext attacks: This type of attack exploits properties of the RSA algorithm

44 Factorization of Large Numbers -3 s s The security of the RSA algorithm depends on the difficulty of finding the prime factors of a large number RSA Labs ( were used to sponsor a challenge to factor the numbers provided by them

45 Progress in Factorization -3 s s

46 Outline -3 s s s s

47 Key Exchange -3 s s First published public-key algorithm By Diffie and Hellman in 1976 along with the exposition of public key concepts Used in a number of commercial products Practical method to exchange a secret key securely that can then be used for subsequent encryption of messages relies on difficulty of computing discrete logarithms

48 Outline -3 s s s s

49 Key Exchange -3 s s

50 Example -3 s s Public Parameters Prime number q = 353 Primitive root α = 3 Private Parameters A randomly selects X A = 97 B randomly selects X B = 233 A and B each compute their public keys A computes Y A = 3 97 mod 353 = 40 B computes Y B = mod 353 = 248 Then exchange the public keys and compute secret key For A: K = (Y B ) X A mod 353 = mod 353 = 160 For B: K = (Y A ) X B mod 353 = mod 353 = 160

51 Key Exchange -3 Alice Alice and Bob share a prime q and α, such that α < q and α is a primitive root of q Bob Alice and Bob share a prime q and α, such that α < q and α is a primitive root of q s s Alice generates a private key X A such that X A < q Alice calculates a public key Y A = α X A mod q Alice receives Bob s public key YB in plaintext Alice calculates shared secret key K = (Y B ) X A mod q Y A Y B Bob generates a private key X B such that X B < q Bob calculates a public key Y B = α X B mod q Bob receives Alice s public key Y A in plaintext Bob calculates shared secret key K = (Y A ) X B mod q

52 Man-in-the-Middle Attack -3 s s 1 Darth generates private keys X D1 and X D2, and their public keys Y D1 and Y D2 2 Alice transmits Y A to Bob 3 Darth intercepts Y A and transmits Y D1 to Bob. Darth also calculates K2 = (Y A ) X D2 4 Bob receives Y D1 and calculates K1 = (Y D1 ) X B 5 Bob transmits Y B to Alice 6 Darth intercepts Y B and transmits Y D2 to Alice Darth calculates K1 = (Y B ) X D1 7 Alice receives Y D2 and calculates K2 = (Y D2 ) X A All subsequent communications compromised

53 Outline -3 s s s s

54 s -3 s s Digital Signature Standard (DSS) FIPS PUB 186 Makes use of -1 and the Digital Signature (DSA) Originally proposed in 1991, revised in 1993 due to security concerns, and another minor revision in 1996 Cannot be used for encryption or key exchange Uses an algorithm that is designed to provide only the digital signature function Elliptic-Curve Cryptography (ECC) Equal security for smaller bit size than RSA Seen in standards such as IEEE P1363 Confidence level in ECC is not yet as high as that in RSA Based on a mathematical construct known as the elliptic curve