1. UNIT III
PUBLIC KEY CRYPTOSYSTEM / ASYMMETRIC
CRYPTOSYSTEM
Prepared by
Dr. R. Arthy, AP/IT
Kamaraj College of Engineering and Technology (Autonomous), Madurai
CS8792 - CRYPTOGRAPHY AND
NETWORK SECURITY
4. Prime Number
A whole number greater than 1 that can not be made
by multiplying other whole numbers.
eg. 2,3,5,7 are prime
4,6,8,9,10 are not prime numbers are central to number
theory
list of prime number less than 200 is:
2 3 5 7 11 13 17 19 23 29 31 37 41 43 47 53 59 61 67 71 73 79 83
89 97 101 103 107 109 113 127 131 137 139 149 151 157 163
167 173 179 181 191 193 197 199
Prepared by R.Arthy, AP/IT
5. Primality Testing
To find large prime numbers
Traditionally sieve using trial division
ie. divide by all numbers (primes) in turn less than the
square root of the number
only works for small numbers
Alternatively can use statistical primality tests based
on properties of primes
for which all primes numbers satisfy property
but some composite numbers, called pseudo‐primes, also
satisfy the property
can use a slower deterministic primality test
Prepared by R.Arthy, AP/IT
6. Primality Testing - Miller Rabin
Algorithm
A test based on prime properties that result from
Fermat‟s Theorem
TEST (n) is:
1. Find integers k, q, k > 0, q odd, so that (n–1)=2kq
2. Select a random integer a, 1<a<n-1
3. if aq mod n = 1 then
4. return (“inconclusive");
5. for j = 0 to k – 1 do
6. if (a2jq mod n = n-1) then
7. return(“inconclusive")
8. return (“composite")
Prepared by R.Arthy, AP/IT
9. [contd…] Probabilistic Consideration
if Miller‐Rabin returns “composite” the number is
definitely not prime
otherwise is a prime or a pseudo‐prime
chance it detects a pseudo‐prime is < 1/4 chance it
detects a pseudo prime is < /4
hence if repeat test with different random a then
chance n is prime after t tests is:
Pr(n prime after t tests) = 1‐4‐t
eg. for t=10 this probability is > 0.99999
could then use the deterministic AKS test
Prepared by R.Arthy, AP/IT
10. Factorization
To factor a number n is to write it as a product of other
numbers: n=a x b x c
note that factoring a number is relatively hard compared
to multiplying the factors together to generate the number
The prime factorisation of a number n is when its
written as a product of primes
eg. 91=7x13 ; 3600=24x32x52
Prepared by R.Arthy, AP/IT
11. Euler‟s Totient Function
Number of elements in reduced set of residues
is called the Euler Totient Function ø(n)
To compute ø(n) need to count number of
residues to be excluded
In general need prime factorization
for p (p prime)
ø(p) = p-1
for p.q (p,q prime)
ø(p.q)=(p-1)x(q-1)
eg. ø(37) = 36
ø(21) = (3–1)x(7–1) = 2x6 = 12
Prepared by R.Arthy, AP/IT
12. Euler‟s Theorem
if n is a positive integer and a, n are coprime, then
aφ(n) ≡ 1 mod n
where φ(n) is the Euler's totient function.
Prepared by R.Arthy, AP/IT
14. Fermat‟s Theorem
ap-1 = 1 (mod p)
where p is prime and gcd(a,p)=1
also known as Fermat‟s Little Theorem
also have: ap = a (mod p) • useful in public
key and primality testing
Prepared by R.Arthy, AP/IT
16. Chinese Remainder Theorem
Let us consider the set of equations
a = x1 mod m1
a = x2 mod m2
…
a = xk mod mk
Then there exist a unique solution if the m1, m2,.. are
pairwise coprime (i.e.) gcd(mi, mj) = 1
Prepared by R.Arthy, AP/IT
17. [contd…]
Steps:
Find M = m1 * m2 * m3 *… *mk
Calculate
M1 = M/m1, M2 = M/m2, …, Mk = M/mk
Find the modulo inverse of Mi, i.e. M-1
1, M-1
2, …, M-1
k
Unique solution is
a = ((x1 * M1 * M-1
1) + (x2 * M2 * M-1
2) + … + (xk * Mk *
M-1
k)) mod M
Prepared by R.Arthy, AP/IT
20. Primitive Roots
From Euler‟s theorem have aø(n)mod n=1
Consider am=1 (mod n), GCD(a,n)=1
must exist for m = ø(n) but may be smaller
once powers reach m, cycle will repeat
If smallest is m = ø(n) then a is called a primitive root
if p is prime, then successive powers of a "generate"
the group mod p
These are useful but relatively hard to find
Prepared by R.Arthy, AP/IT
21. Exponentiation and Logarithm
The inverse problem to exponentiation is to find the
discrete logarithm of a number modulo p
That is to find i such that b = ai (mod p) • this is
written as i = dloga b (mod p)
If a is a primitive root then it always exists, otherwise
it may not
eg. x = log3 4 mod 13 has no answer x = log2 3 mod 13 =
4 by trying successive powers
whilst exponentiation is relatively easy, finding
discrete logarithms is generally a hard problem
Prepared by R.Arthy, AP/IT
23. Private-Key Cryptography
Traditional private/secret/single key cryptography
uses one key
Shared by both sender and receiver
If this key is disclosed communications are
compromised
also is symmetric, parties are equal
Hence does not protect sender from receiver forging a
message & claiming is sent by sender
Prepared by R.Arthy, AP/IT
24. Public-Key Cryptography
Probably most significant advance in the 3000 year
history of cryptography
Uses two keys – a public & a private key
Asymmetric since parties are not equal
Uses clever application of number theoretic concepts
to function
Complements rather than replaces private key crypto
Prepared by R.Arthy, AP/IT
25. Public-Key Cryptography
Public-key/two-key/asymmetric cryptography
involves the use of two keys:
A public-key, which may be known by anybody, and can
be used to encrypt messages, and verify signatures
A private-key, known only to the recipient, used to
decrypt messages, and sign (create) signatures
Is asymmetric because
Those who encrypt messages or verify signatures cannot
decrypt messages or create signatures
Prepared by R.Arthy, AP/IT
27. Why Public-Key Cryptography?
Developed to address two key issues:
Key distribution – how to have secure communications
in general without having to trust a kdc with your key
Digital signatures – how to verify a message comes
intact from the claimed sender
Public invention due to whitfield diffie & martin
hellman at stanford uni in 1976
Known earlier in classified community
Prepared by R.Arthy, AP/IT
28. Public-Key Characteristics
Public-key algorithms rely on two keys with the
characteristics that it is:
Computationally infeasible to find decryption key
knowing only algorithm & encryption key
Computationally easy to en/decrypt messages when the
relevant (en/decrypt) key is known
Either of the two related keys can be used for encryption,
with the other used for decryption (in some schemes)
Prepared by R.Arthy, AP/IT
30. Public-Key Applications
Can classify uses into 3 categories:
Encryption/decryption (provide secrecy)
Digital signatures (provide authentication)
Key exchange (of session keys)
Some algorithms are suitable for all uses, others are
specific to one
Prepared by R.Arthy, AP/IT
31. Security of Public Key Schemes
Like private key schemes brute force exhaustive
search attack is always theoretically possible
But keys used are too large (>512bits)
Security relies on a large enough difference in
difficulty between easy (en/decrypt) and hard
(cryptanalyse) problems
More generally the hard problem is known, its just
made too hard to do in practise
Requires the use of very large numbers
Hence is slow compared to private key schemes
Prepared by R.Arthy, AP/IT
32. RSA
By rivest, shamir & adleman of MIT in 1977
Best known & widely used public-key scheme
Based on exponentiation in a finite (galois) field
over integers modulo a prime
Nb. Exponentiation takes o((log n)3) operations (easy)
Uses large integers (eg. 1024 bits)
Security due to cost of factoring large numbers
Nb. Factorization takes o(e log n log log n) operations (hard)
Prepared by R.Arthy, AP/IT
33. RSA Key Setup
Each user generates a public/private key pair by:
Selecting two large primes at random - p, q
Computing their system modulus n=p.Q
Note ø(n)=(p-1)(q-1)
Selecting at random the encryption key e
Where 1<e<ø(n), gcd(e,ø(n))=1
Solve following equation to find decryption key d
E.D=1 mod ø(n) and 0≤d≤n
Publish their public encryption key: ku={e,n}
Keep secret private decryption key: kr={d,p,q}
Prepared by R.Arthy, AP/IT
34. RSA Use
To encrypt a message M the sender:
Obtains public key of recipient ku={e,n}
Computes: c=me mod N, where 0≤M<N
To decrypt the ciphertext C the owner:
Uses their private key kr={d,p,q}
Computes: m=cd mod N
Note that the message M must be smaller than the
modulus N (block if needed)
Prepared by R.Arthy, AP/IT
36. Why RSA Works
because of Euler's Theorem:
aø(n)mod N = 1
where gcd(a,N)=1
in RSA have:
N=p.q
ø(N)=(p-1)(q-1)
carefully chosen e & d to be inverses mod ø(N)
hence e.d=1+k.ø(N) for some k
hence :
Cd = (Me)d = M1+k.ø(N) = M1.(Mø(N))q =
M1.(1)q = M1 = M mod N
Prepared by R.Arthy, AP/IT
38. Exponentiation
Can use the square and multiply algorithm
A fast, efficient algorithm for exponentiation
Concept is based on repeatedly squaring base
And multiplying in the ones that are needed to
compute the result
Look at binary representation of exponent
Only takes o(log2 n) multiples for number n
Eg. 75 = 74.71 = 3.7 = 10 mod 11
Eg. 3129 = 3128.31 = 5.3 = 4 mod 11
Prepared by R.Arthy, AP/IT
40. RSA Key Generation
Users of RSA must:
Determine two primes at random - p, q
Select either e or d and compute the other
Primes p,q must not be easily derived from modulus
n=p.Q
Means must be sufficiently large
Typically guess and use probabilistic test
Exponents e, d are inverses, so use inverse algorithm
to compute the other
Prepared by R.Arthy, AP/IT
41. RSA Security
Three approaches to attacking RSA:
Brute force key search (infeasible given size of numbers)
Mathematical attacks (based on difficulty of computing
ø(n), by factoring modulus N)
Timing attacks (on running of decryption)
Prepared by R.Arthy, AP/IT
42. Factoring Problem
Mathematical approach takes 3 forms:
Factor n=p.Q, hence find ø(n) and then d
Determine ø(n) directly and find d
Find d directly
Currently believe all equivalent to factoring
Have seen slow improvements over the years
As of aug-99 best is 130 decimal digits (512) bit with GNFS
Biggest improvement comes from improved algorithm
Cf “quadratic sieve” to “generalized number field sieve”
Barring dramatic breakthrough 1024+ bit RSA secure
Ensure p, q of similar size and matching other constraints
Prepared by R.Arthy, AP/IT
43. Timing Attacks
Developed in mid-1990‟s
Exploit timing variations in operations
Eg. Multiplying by small vs large number
Or if's varying which instructions executed
Infer operand size based on time taken
RSA exploits time taken in exponentiation
Countermeasures
Use constant exponentiation time
Add random delays
Blind values used in calculations
Prepared by R.Arthy, AP/IT
45. Symmetric Key Distribution Using
Symmetric Encryption
Symmetric schemes require both parties to share a
common secret key
Issue is how to securely distribute this key
Frequent key changes can be desirable
Often secure system failure due to a break in the key
distribution scheme
Prepared by R.Arthy, AP/IT
46. [contd…]
Given parties A and B have various key distribution
alternatives:
A can select key and physically deliver to B
Third party can select & deliver key to A & B
If A & B have communicated previously can use
previous key to encrypt a new key
If A & B have secure communications with a third party
C, C can relay key between A & B
Prepared by R.Arthy, AP/IT
48. [contd…]
Hierarchies of KDC‟s required for large networks, but
must trust each other
Session key lifetimes should be limited for greater
security
Use of automatic key distribution on behalf of users,
but must trust system
Use of decentralized key distribution
Controlling key usage
Prepared by R.Arthy, AP/IT
49. Symmetric Key Distribution Using
Public-key Encryption
Public key cryptosystems are inefficient
So almost never use for direct data encryption
Rather use to encrypt secret keys for distribution
Merkle proposed this very simple scheme
allows secure communications
no keys before/after exist
Prepared by R.Arthy, AP/IT
50. [contd…]
Secret Key Distribution with Confidentiality and
Authentication
Prepared by R.Arthy, AP/IT
51. Distribution of Public Keys
Public announcement
Publicly available directory
Public-key authority
Public-key certificates
Prepared by R.Arthy, AP/IT
52. Public Announcement
Users distribute public keys to recipients or broadcast
to community at large
Eg. Append PGP keys to email messages or post to news
groups or email list
Major weakness is forgery
Anyone can create a key claiming to be someone else and
broadcast it
Until forgery is discovered can masquerade as claimed
user
Prepared by R.Arthy, AP/IT
53. Publicly Available Directory
Can obtain greater security by registering keys with a
public directory
Directory must be trusted with properties:
Contains {name,public-key} entries
Participants register securely with directory
Participants can replace key at any time
Directory is periodically published
Directory can be accessed electronically
Still vulnerable to tampering or forgery
Prepared by R.Arthy, AP/IT
54. Public-Key Authority
Improve security by tightening control over
distribution of keys from directory
Has properties of directory
And requires users to know public key for the
directory
Then users interact with directory to obtain any desired
public key securely
Does require real-time access to directory when keys are
needed
Prepared by R.Arthy, AP/IT
56. Public-Key Certificates
Certificates allow key exchange without real-time
access to public-key authority
A certificate binds identity to public key
Usually with other info such as period of validity, rights
of use etc
With all contents signed by a trusted public-key or
certificate authority (CA)
Can be verified by anyone who knows the public-key
authorities public-key
Prepared by R.Arthy, AP/IT
59. Diffie-Hellman Key Exchange
The Diffie–Hellman (DH) key exchange technique
was first defined in their seminal paper in 1976.
DH key exchange is a method of exchanging public
(i.e. non-secret) information to obtain a shared secret.
DH is not an encryption algorithm.
Prepared by R.Arthy, AP/IT
60. Diffie-Hellman Key Exchange
DH key exchange has the following important
properties:
The resulting shared secret cannot be computed by either
of the parties without the cooperation of the other.
A third party observing all the messages transmitted
during DH key exchange cannot deduce the resulting
shared secret at the end of the protocol.
Prepared by R.Arthy, AP/IT
61. [contd…]
A public-key distribution scheme
Cannot be used to exchange an arbitrary message
Rather it can establish a common key
Known only to the two participants
Value of key depends on the participants (and their
private and public key information)
Based on exponentiation in a finite (galois) field
(modulo a prime or a polynomial) - easy
Security relies on the difficulty of computing discrete
logarithms (similar to factoring) – hard
Prepared by R.Arthy, AP/IT
62. Diffie-Hellman Setup
All users agree on global parameters:
Large prime integer or polynomial q
Α a primitive root mod q
Each user (eg. A) generates their key
Chooses a secret key (number): xa < q
Compute their public key: ya = α
xa
mod q
Each user makes public that key ya
Prepared by R.Arthy, AP/IT
63. Diffie-Hellman Key Exchange
shared session key for users A & B is KAB:
KAB = α
xA.xB
mod q
= yA
xB
mod q (which B can compute)
= yB
xA
mod q (which A can compute)
KAB is used as session key in private-key
encryption scheme between Alice and Bob
if Alice and Bob subsequently communicate, they
will have the same key as before, unless they
choose new public-keys
attacker needs an x, must solve discrete log
Prepared by R.Arthy, AP/IT
67. Man-in-the-middle Attack
1.Darth prepares by creating two private / public keys
2.Alice transmits her public key to Bob
3.Darth intercepts this and transmits his first public key to
Bob. Darth also calculates a shared key with Alice
4.Bob receives the public key and calculates the shared key
(with Darth instead of Alice)
5.Bob transmits his public key to Alice
6.Darth intercepts this and transmits his second public key
to Alice. Darth calculates a shared key with Bob
7.Alice receives the key and calculates the shared key (with
Darth instead of Bob)
Darth can then intercept, decrypt, re-encrypt, forward all
messages between Alice & Bob Prepared by R.Arthy, AP/IT
69. Objective
To show that RSA is not the only public key system
To exhibit a public key system based on a different one
way function
ElGamal is the basis for several well-known
cryptographic primitives
Prepared by R.Arthy, AP/IT
70. Elgamal Key Exchange
Public-key cryptosystem related to D-H
Uses exponentiation in a finite field
With security based difficulty of computing discrete
logarithms, as in D-H
Each user (e.g. A) generates their key
Chooses a secret key (number): 1 < XA < q-1
Computes their public key: YA = a XA mod q
Prepared by R.Arthy, AP/IT
71. Elgamal Key Exchange
Bob encrypt a message to send to A computing
represent message M in range 0 <= M <= q-1
longer messages must be sent as blocks
chose random integer k with 1 <= k <= q-1
compute one-time key K = YA
k mod q
encrypt M as a pair of integers (C1,C2) where
C1 = ak mod q ; C2 = KM mod q
A then recovers message by
recovering key K as K = C1
xA mod q
computing M as M = C2 K-1 mod q
a unique k must be used each time
otherwise result is insecure Prepared by R.Arthy, AP/IT
75. Elliptic Curve Cryptography
Majority of public-key crypto (RSA, D-H) use either
integer or polynomial arithmetic with very large
numbers/polynomials
Imposes a significant load in storing and processing
keys and messages
An alternative is to use elliptic curves
Offers same security with smaller bit sizes
Prepared by R.Arthy, AP/IT
76. Real Elliptic Curves
an elliptic curve is defined by an equation in two
variables x & y, with coefficients
consider a cubic elliptic curve of form
y2 = x3 + ax + b
where x,y,a,b are all real numbers
also define zero point O
have addition operation for elliptic curve
geometrically sum of Q+R is reflection of intersection R
Prepared by R.Arthy, AP/IT
78. Finite Elliptic Curves
Elliptic curve cryptography uses curves whose
variables & coefficients are finite
Have two families commonly used:
Prime curves ep(a,b) defined over zp
Use integers modulo a prime
Best in software
Binary curves e2m(a,b) defined over gf(2n)
Use polynomials with binary coefficients
Best in hardware
Prepared by R.Arthy, AP/IT
79. Elliptic Curve Cryptography
ECC addition is analog of modulo multiply
ECC repeated addition is analog of modulo
exponentiation
Need “hard” problem equiv to discrete log
Q=kp, where Q,P belong to a prime curve
Is “easy” to compute Q given k,p
But “hard” to find k given Q,P
Known as the elliptic curve logarithm problem
Certicom example: E23(9,17)
Prepared by R.Arthy, AP/IT
80. ECC Diffie-Hellman
can do key exchange analogous to D-H
users select a suitable curve Ep(a,b)
select base point G=(x1,y1) with large order n s.t. nG=O
A & B select private keys nA<n, nB<n
compute public keys: PA=nA×G, PB=nB×G
compute shared key: K=nA×PB, K=nB×PA
same since K=nA×nB×G
Prepared by R.Arthy, AP/IT
81. ECC Encryption/Decryption
several alternatives, will consider simplest
must first encode any message M as a point on the
elliptic curve Pm
select suitable curve & point G as in D-H
each user chooses private key nA<n
and computes public key PA=nA×G
to encrypt Pm : Cm={kG, Pm+k Pb}, k random
decrypt Cm compute:
Pm+kPb–nB(kG) = Pm+k(nBG)–nB(kG) = Pm
Prepared by R.Arthy, AP/IT
82. ECC Security
relies on elliptic curve logarithm problem
fastest method is “Pollard rho method”
compared to factoring, can use much smaller key sizes
than with RSA etc
for equivalent key lengths computations are roughly
equivalent
hence for similar security ECC offers significant
computational advantages
Prepared by Dr. R.Arthy, AP/IT
