Great Theoretical Ideas in Computer Science

Transcription

1 Great Theoretical Ideas in Computer Science Lecture 22: Cryptography November 12th, 2015

2 What is cryptography about? Adversary Eavesdropper I will cut your throat I will cut your throat

3 What is cryptography about? I will cut your throat encryption loru23n8uladjkfb!#@ decryption I will cut your throat

4 What is cryptography about? Study of protocols that avoid the bad affects of adversaries. - Can we have secure online voting schemes? - Can we use digital signatures. - Can we do computation on encrypted data? - Can I convince you that I have proved P=NP without giving you any information about the proof?.

5 Reasons to like cryptography Can do pretty cool and unexpected things. Has many important applications. Is fundamentally related to computational complexity. In fact, computational complexity revolutionized crypto. Applications of computationally hard problems. There is good math (e.g. number theory).

6 The plan First, we will review modular arithmetic. Then we ll talk about private (secret) key cryptography. Finally, we ll talk about public key cryptography.

7 Review of Modular Arithmetic

8 A mod N = remainder when you divide A by N Example N = Z 5 mod 5 We write A B mod N or A N B when A mod N = B mod N. Can view the universe as Z N = {0, 1, 2,...,N 1}.

9 > addition A + B mod N Do regular addition. Then take mod N. > subtraction A B = A +( B) modn -B = N-B. Then do addition. A B mod N Do regular multiplication. Then take mod N. A/B = A B 1 mod N -1 Find B. Then do multiplication. A B mod N Fast modular exponentiation: repeatedly square and mod. > multiplication > division > exponentiation > taking roots > logarithm No known efficient algorithm exists.

10 > addition A + B mod N Do regular addition. Then take mod N. > subtraction A B = A +( B) modn -B = N-B. Then do addition. A B mod N Do regular multiplication. Then take mod N. B 1 exists A/B = A B 1 iff gcd(b,n) =1. mod N -1 Find B. Then do multiplication. gives A B mod you NB 1. Fast modular exponentiation: repeatedly square and mod. > multiplication > division > exponentiation > taking roots > logarithm A modification of Euclid s Algorithm No known efficient algorithm exists.

11 Z 4 Z Z N = {0, 1, 2,...,N 1} Z N = {A 2 Z N : gcd(a, N) =1} behaves nicely with respect to addition behaves nicely with respect to multiplication '(N) = Z N if P prime, '(P )=P 1 if P, Q distinct primes, '(PQ)=(P 1)(Q 1)

12 Z '(5) = and 3 are called generators.

13 Z '(5) = A, A 4 =1 =) A 4k =(A 4 ) k =1

14 Euler s Theorem: For any A 2 Z N, A '(N) =1. Fermat s Little Theorem: Let P be a prime. For any A 2 Z P, A P 1 =1. 1 = A 0 A 1 A 2 A '(N) 1 = = = = A '(N) A '(N)+1 A '(N)+2 A 2'(N) 1 = = = = A 2'(N) A 2'(N)+1 A 2'(N)+2 A 3'(N) 1

15 IMPORTANT When exponentiating elements A 2 Z N, can think of the exponent living in the universe Z '(N).

16 In Z (B,E) EXP B E hard Two inverse functions: (B E,E) ROOT E B easy (B E,B) LOG B E easy

17 In Z (B E,E) ROOT E B easy ( , 3) (can do binary search) (B E,B) LOG B E easy ( , 3) (keep dividing by B) 123

18 In Z N (B,E,N) EXP B E mod N easy Two inverse functions: (B E,E,N) ROOT E B seems hard (B E,B,N) LOG B E seems hard Exercise: Convince yourself that the algorithms in the setting of Z do not work in. Z N

19 In Z N (B,E,N) EXP B E mod N easy Two inverse functions: (B E,E,N) ROOT E B seems hard (B E,B,N) LOG B E seems hard One-way function: easy to compute, hard to invert. EXP seems to be one-way.

20 Private Key Cryptography

21 Private key cryptography Parties must agree on a key pair beforehand.

22 Private key cryptography there must be a secure way of exchanging the key

23 Private key cryptography C KA M (plaintext) KB (M, KA ) Enc should be one-way. (C, KB ) Enc Try to ensure it using the secrecy of the key. Dec C (ciphertext) M

24 A note about security Better to consider worst-case conditions. Assume the adversary knows everything except the key(s) and the message: Completely sees cipher text C. Completely knows the algorithms Enc and Dec.

25 Caesar shift Example: shift by 3 abcdefghijklmno pqrstuvwxyz defghijklmno pqrstuvwxyz abc (similarly for capital letters) Dear Math, please grow up and solve your own problems. Ghdu Pdwk, sohdvh jurz xs dqg vroyh brxu rzq sureohpv. : the shift number Easy to break.

26 Substitution cipher abcdefghijklmno pqrstuvwxyz jk b delm cfg noxyrs vwz atu pqhi : permutation of the alphabet Easy to break by looking at letter frequencies.

27 Enigma A much more complex cipher.

28 One-time pad M = message K = key C = encrypted message (everything in binary) Encryption: M = K = C = C = M + K (bit-wise XOR) For all i: C[i] = M[i] + K[i] (mod 2)

29 One-time pad M = message K = key C = encrypted message Decryption: (everything in binary) + C = K = M = Encryption: Decryption: C = M + K C + K = (M + K) + K = M + (K + K) = M (because K + K = 0)

30 One-time pad + M = K = C = One-time pad is perfectly secure: For any M, if K is chosen uniformly at random, then C is uniformly at random. So adversary learns nothing about M by seeing C. But you need to share a key that is as long as the message! Could we reuse the key?

31 One-time pad + M = K = C = Could we reuse the key? One-time only: Suppose you encrypt two messages M and M with K. C = M + K 1 1 C = M + K 2 2 Then C + C = M + M

32 Shannon s Theorem Is it possible to have a secure system like one-time pad with a smaller key size? Shannon proved no. If K is shorter than M: An adversary with unlimited computational power could learn some information about M.

33 Question What if we relax the assumption that the adversary is computationally unbounded? We can find a way to share a random secret key. (over an insecure channel) We can get rid of the secret key sharing part. (public key cryptography)

34 Secret Key Sharing

35 Secret Key Sharing K K

36 Diffie-Hellman key exchange 1976 Whitfield Diffie Martin Hellman

37 Diffie-Hellman key exchange In Z N (B,E,N) EXP B E mod N easy (B E,B,N) LOG B E seems hard Want to make sure for the inputs we pick, e.g. we don t want B 0 B 1 B 2 B 3 B 4... = = = = = 1 B 1 B 1... Much better to have a generator B. LOG is hard.

38 Diffie-Hellman key exchange In Z N (B,E,N) EXP B E mod N easy (B E,B,N) LOG B E seems hard We ll pick N = P a prime number. (This ensures there is a generator in.) Z P We ll pick B 2 Z P so that it is a generator. {B 0,B 1,B 2,B 3,,B P 2 } = Z P

39 Diffie-Hellman key exchange Pick prime P Pick generator B 2 Z P Pick random E 1 2 Z '(P ) P, B, B E 1 P, B, B E 1 B E 2 Compute (B E 2 ) E 1 = B E 1E 2 B E 2 Pick random E 2 2 Z '(P ) Compute (B E 1 ) E 2 = B E 1E 2

40 Diffie-Hellman key exchange Pick prime P Pick generator B 2 Z P Pick random E 1 2 Z '(P ) This is what the adversary sees. If he can compute we are screwed! LOG B P, B, B E 1 P, B, B E 1 B E 2 Compute (B E 2 ) E 1 = B E 1E 2 B E 2 Pick random E 2 2 Z '(P ) Compute (B E 1 ) E 2 = B E 1E 2

41 Secure? Adversary sees: P, B, B E 1,B E 2 Hopefully he can t compute E 1 from B E 1. (our hope that LOG B is hard) Good news: No one knows how to compute LOG B efficiently. Bad news: Proving that it cannot be computed efficiently is at least as hard as the P vs NP problem. Diffie-Hellman assumption: Computing from P, B, B E 1,B E 2 is hard. B E 1E 2 Decisional Diffie-Hellman assumption: You actually learn no information about B E 1E 2.

42 One could use: Diffie-Hellman (to share a secret key) + One-time Pad Note This is only as secure as its weakest link, i.e. Diffie-Hellman.

43 Question What if we relax the assumption that the adversary is computationally unbounded? We can find a way to share a random secret key. (over an insecure channel) We can get rid of the secret key sharing part. (public key cryptography)

44 Public Key Cryptography

45 Public Key Cryptography public private

46 Public Key Cryptography public private Can be used to lock. But can t be used to unlock.

47 Public key cryptography C M Kpub Kpri (M, Kpub ) Enc should be one-way. (C, Kpri ) Enc Try to ensure it using computational complexity. Dec C M

48 (M,K pub )=(M,E,N) Enc M E mod N = C RSA crypto system In Z N (B,E,N) EXP B E mod N easy (B E,E,N) ROOT E B seems hard What if we encode using EXP? ( M = B ) Public key can be. (E,N)

49 (M,K pub )=(M,E,N) Enc M E mod N = C RSA crypto system In Z N (B,E,N) EXP B E mod N easy (B E,E,N) ROOT E B assume What if we encode using EXP? ( M = B ) 2 seems hard Z N Public key can be. (E,N) So E 2 Z '(N)

50 RSA crypto system C (N, E) (M, E, N ) EXP C = M E mod N 2 M Z'(N ) Private key should allow us to invert EXP. i.e. compute ROOTE Kpri (C, Kpri ) Dec M

51 RSA crypto system (M,E,N) EXP M 2 Z N E 2 Z '(N) C = M E mod N (C, K pri ) Dec M

52 RSA crypto system (M,E,N) EXP M 2 Z N E 2 Z '(N) C = M E mod N (M E,E 1,N) EXP M EE 1 mod N = M (C, K pri ) Dec M

53 RSA crypto system (M,E,N) EXP M 2 Z N E 2 Z '(N) C = M E mod N (M E,E 1,N) EXP M EE 1 mod N = M (C, K pri ) Dec M E Z '(N) lives in. We want inverse. E to have an So we choose E 2 Z '(N)

54 RSA crypto system C (N, E) M N = PQ E 2 Z '(N ) 1 E (M, E, N ) (C, E 1, N) EXP EXP E E M =C M =C 1

55 RSA crypto system C (N, E) M (M, E, N ) Why is N = PQ (product of distinct primes)? EXP What if, say, N = P? M E =C N = PQ E 2 Z '(N ) 1 E (C, E 1, N) EXP M =C E 1

56 Secure? If the adversary can compute E 1 2 Z '(N), we are screwed! Computing E 1 2 Z '(N) if you know '(N). Adversary sees (N,E). Can he compute '(N)? is easy We believe this is computationally hard. How does Margaery compute '(N)? She knows P and Q, so '(PQ)=(P 1)(Q 1). If the adversary can factor N efficiently, he can also compute '(N). N = PQ E 2 Z '(N) E 1 (C, E 1,N) EXP M = C E 1

57 Secure? The advantage Margaery has over the adversary is that she can compute E 1 (and therefore ) '(N). If the adversary can factor N efficiently, he can also compute '(N). (and therefore E 1 ) N = PQ E 2 Z '(N) E 1 (C, E 1,N) EXP M = C E 1

58 RSA crypto system 1977 Ron Rivest Adi Shamir Leonard Adleman

59 RSA crypto system Clifford Cocks Discovered RSA system 3 years before them. Remained secret until (was classified information)

60 Concluding remarks A variant of this is widely used in practice. From N, if we can efficiently compute '(N), we can crack RSA. If we can factor N, we can compute '(N). Quantum computers can factor efficiently. Is this the only way to crack RSA? We don t know! So we are really hoping it is secure.