Chapter 8 Public-key Cryptography and Digital Signatures

Transcription

1 Chapter 8 Public-key Cryptography and Digital Signatures v 1. Introduction to Public-key Cryptography 2. Example of Public-key Algorithm: Diffie- Hellman Key Exchange Scheme 3. RSA Encryption and Digital Signature 4. ElGamal Digital Signature 5. DSS (Digital Signature Standard) 6. ECDSA (Elliptic Curve Digital Signature Gong,

2 8.1. Introduction to Public-key Cryptography Bob s public key Bob s private key Plaintext Alice Encryption algorithm Ciphertext Decryption algorithm Plaintext Bob A. Figure 1. Simplified Model of Public-Key Gong,

3 B. Requirements of Public-key Cryptography One-way function: easy x infeasible f(x) Trapdoor one-way function: x easy infeasible if k is not known easy if k is known f Gong,

4 Therefore, security of public-key cryptosystems are based on the difficulty of different computational problems. Most important ones are - Factoring large integers - Finite field discrete logarithms - Elliptic curve discrete Gong,

5 C. Key pairs of the public-key system In a secure network system, for each user x, he has a pair of keys (E x, D x ): E x is an encryption key which is put into a public key directory or a file ( after certified), called a public-key of the user. D x is a decrypted key kept private, called a private key of the user. D x (E x ) = E x (D x ) = identity map From known E x, it is computational infeasible to obtain D x Alice C = E b (m) Bob: D b (C) = D b E b (m) = Gong,

6 8.2. Diffie-Hellman Key Exchange the first example of the public-key scheme System public parameters: p: a prime number, g: a primitive element in GF(p). Alice: Private key: a, 0 < a < p, and gcd(a, p - 1) = 1 Public key: g a Bob: Private key: b, 0 < b < p, and gcd(b, p -1) = 1 Public key: g Gong,

7 Diffie-Hellman Key Exchange Alice a g a Bob b g b (g b a ) = g ba b (g a ) = g Gong,

8 Example 1. Let p = 23. Then g = 5 is a primitive element of GF(p). Public key : g 7 = 5 Alice Private key : a = 7 7 = 17mod 23 g 7 =17 Private key : b = Public - key : g 3 = 5 Bob 3 3 = 10mod13 (g Compute: g 3 =10 Compute: 3 ) = 10 = 14 mod 23 ( g ) = 17 = 14 mod 23 The secret information shared by Alice and Bob is 14. Attacker: known 7 g 21 g 3 = 14 g = 10? In other words, is attacker able to compute g ab from known g a and g b?

9 Diffe-Hellman Problem: Given g a and g b, compute g ab. Thus the Diffe-Hellman key exchange scheme is secure if the DH problem is computationally infeasible. The DH problem is computational feasible if the solving discrete logarithm in GF(p) is computationally feasible. Thus, we may say that the security of the DH key exchange scheme is based on the difficulty of solving discrete logarithm in the finite field GF(p). Remark. The DH key exchange scheme has a very important application in key distribution and management, we will discuss more properties of the DH key exchange scheme in Chapter Gong,

10 Milestone work in public-key cryptography W. Diffie and M. E. Hellman, New direction in cryptography, IEEE Trans. On Inform. Theory, Vol. 22, pp , Gong,

11 8.3. RSA Encryption and Digital Signature Requirement for digital signatures: Everyone can verify digital signature. Only the signer can sign; no one can forge the signer s signature ( this prevents forgery and denial attacks.) Once the dispute occurs, the third party can solve Gong,

12 More about number theory (a) The Euclidean algorithm for computing gcd(a, b), the greatest common divisor of two positive integers a and b, b > a. Input: a and b, b > a Output: d = gcd(a, b) Procedure_(a, b, d) Set r b and r = a 0 Compute: = 1 r, < r < r 0 = b = q1r1 + r2 0 r, < r < r 1 = q2r2 + r Return: r m In other words, gcd(a,b) = r m r, < r < r 2 = q3r3 + r4 0 r = q m 1 m M r m 4 Gong,

13 (b) The Chinese Remainder Theorem Let m 1,..., m r are pairwise relatively primes, i.e., gcd( m i, m j ) = 1if i j, and a 1,..., a r are integers, then the system of r congruent equations: X a 1 mod m 1 X a 2 mod m 2 M X a r mod m r has a unique solutions X modulo M = m 1 m r, which is given by X r i= 1 a M i i y i mod M where M = i M / mi and y i = M 1 i mod m i, for 1 i Gong,

14 Example 1. Suppose r = 3, m 1 = 7, m 2 = 11 and m 3 = 13, then M =1001 M1 = M / m1 = 143 = 3mod 7 M 2 = 91= 3mod11 M 3 = 77 = 12mod13 and y =, y = 4 and y = If X X 5 3 mod7 mod11 X 10 mod13 Then X = mod1001 = 13907mod1001 = 894 Gong,

15 (c) Lagrange Theorem: suppose that G is a multiplicative group of order n (i.e. G =n) and g G, then the order of g divides n. Corollary: * Φ( n) If b Z, then b 1mod n, n where Φ(n) is the Euler function (i.e., Φ(n) is the number of integer in the range of 1 and n coprime with n), then Z * n = { a Z gcd( n, a) n = Gong,

16 RSA Encryption User Bob sets up: 1. Generates two large primes p and q. 2. Computes n = pq and Φ(n) = (p-1)(q-1) 3. Chooses a random number e: 0 < e < Φ(n) such that gcd(e, Φ(n) ) = Computes d = e -1 mod Φ(n) using the Euclidean algorithm. 5. Do registration for his public-key {n, e} and publish this pair in a directory as his public key. Keep {d, p, q} as his private key. Encryption: Plaintext m < n: ciphertext c = m e mod n Decryption: m = c d, (c e ) d = c mod Gong,

17 The RSA Algorithm Key Generation Select: p and q both prime; n = pq; e: gcd(e, φ(n)) = 1, 1<e< φ(n). Compute: d = e -1 mod φ(n). Public key: {e, n}. Private key: {d, p, q} Plaintext: m < n Encryption Ciphertext: c = m e mod n Decryption Ciphertext: c Plaintext: m = c d mod n

18 3. RSA Encryption and Digital Signature (Cont.) RSA Encryption User Bob sets up: 1. Generates two large primes p and q. 2. Computes n = pq and Φ(n) = (p-1)(q-1) 3. Chooses a random number e: 0 < e < Φ(n) such that gcd(e, Φ(n) ) = Computes d = e -1 mod Φ(n) using the Euclidean algorithm. 5. Do registration for his public-key {n, e} and publish this pair in a directory as his public key. Keep {d, p, q} as his private key. Encryption: Plaintext m < n: ciphertext c = m e mod n Decryption: m = c d, (c e ) d = c mod Gong,

19 The RSA Algorithm Key Generation Select: p and q both prime; n = pq; e: gcd(e, φ(n)) = 1, 1<e< φ(n). Compute: d = e -1 mod φ(n). Public key: {e, n}. Private key: {d, p, q} Plaintext: m < n Encryption Ciphertext: c = m e mod n Decryption Ciphertext: c Plaintext: m = c d mod Gong,

20 Example 2. Set up step: Bob: 1. Choose p = 101 and q = Compute n = pq = and Φ(n) = =11200= Choose e = 3533 with gcd(3533, Φ(n)) = 1 4. Compute d = e -1 = 6597 mod Bob s Public key: {3533, 11413}, private key: { 6597, 101,113} Encryption: Alice wants to send m = 9726 to Bob. She then computes c = mod 11413=5761 Decryption: Bob: c 6597 = (9726) = Gong,

21 Remark: Requirements for selection of p and q. (1) p and q should differ in length only a few digits. (2) Both p - 1 and q - 1 should contain a large prime factor. (3) gcd(p - 1, q - 1) should small. (4) d should not be small: d > n 1/4. Security of RSA: Security of RSA depends on the difficulty to compute d from known {e, n}. However, d = e -1 mod Φ(n). Usually it has no other way to compute Φ(n) except for knowing p and q. Thus the security of RSA depends on the difficulty of factorisation of a large digital Gong,

22 RSA Digital Signature Algorithm (RSA-DSA) User Bob wants to sign a message m, Signing process: 1. Compute h(m) = m, where h(x) is a hashing function. 2. r = m' d, r is a digital signature of m. Verifying process: Verifier uses Bob s public key {e, m} to compute whether r e m ' mod If yes, then r is a valid signature of m. = n Note. Hashing function h is public, which can be chosen as either MD5 (Message digest algorithm), Rivest 1990, or SHA (Secure Hash Algorithm), NIST, Employing a hashing function is required in any Gong,

23 RSA-DSA (Cont.) Bob: signer Message m m m r Hash: h r = h(m) d r signature mod n d: Bob s private key RSA-DSA Signing Gong,

24 RSA-DSA Verifying Process Alice: verifier m Hash: h r r e =h(m)? mod n e: Bob s public Gong,

25 Three milestone works which established the foundation of public-key cryptology: W. Diffe and M. E. Hellman, New direction in cryptography, IEEE Trans. On Inform. Theory, Vol. 22, pp , R. L. Rivest, A. Shamir and L. Adleman, A method for obtaining digital signatures and public cryptosystem, Communication of ACM, Vol. 21, No.2, pp , Feb T. Elgamal, A public-key cryptosystem and signature scheme based on discrete logarithm, IEEE Trans. on Inform. Theory, vol. IT-31, pp , July, Gong,