SlideShare a Scribd company logo
Asymmetric Key Signatures
David Evans and Samee Zahur
CS4501, Fall 2015
Please pay $1000 to
my employee
--TheBoss
You have money!
Real-life Signatures
Easy to verify
• Bank has your signature
Forging unlikely
• Legal consequences of forging
• Checkbooks are well-guarded
• Copying it requires physical access
Hard to repudiate
• Bank keeps a copy for few months
Digital Signatures
Easy to verify
• Everybody has your “verification key”, vk
Hard to forge
• Nobody but you has the “signing key”, sk
Hard to repudiate
• Everybody knows only you have signing key
𝑠 = sign 𝑠𝑘 𝑚
true, false = verify 𝑣𝑘(𝑚, 𝑠)
Topics
• Asymmetric cryptography
• Digital signatures
• Elliptic curve cryptography
• Implementation pitfalls
Ordinary (or symmetric) crypto
Message
key key
Whitfield Diffie
Martin Hellman
New Directions in
Cryptography, 1976
Diffie-Hellman Key Exchange
𝑔 𝑎
mod 𝑝
𝑔 𝑏
mod 𝑝
Picks secret a
Computes
𝑔 𝑏 𝑎
= 𝑔 𝑎𝑏
Picks secret b
Computes
𝑔 𝑎 𝑏 = 𝑔 𝑎𝑏
Public values: 𝑔, 𝑝, 𝑔 𝑎
, 𝑔 𝑏
Shared secret: 𝑔 𝑎𝑏
Discrete Logarithm Problem
Given 𝑔, 𝑦, 𝑝 find 𝑥 such that:
𝑔 𝑥
mod 𝑝 = 𝑦
Discrete
Logarithm
Problem
Random element out of …?
𝑔 𝑎
mod 𝑝
𝑔 𝑏
mod 𝑝
Picks random a
Computes
𝑔 𝑏 𝑎
= 𝑔 𝑎𝑏
Picks random b
Computes
𝑔 𝑎 𝑏 = 𝑔 𝑎𝑏
Mod 5 Exponentiation
0 1 2 3 4 5 6 …
0 - 0 0 0 0 0 0 …
1 1 1 1 1 1 1 1 …
2 1 2 4 3 1 2 4 …
3 1 3 4 2 1 3 4 …
4 1 4 1 4 1 4 1 …
Order 1
Order 2
In mod 𝑝 multiplication, multiplicative
order is always a factor of (𝑝 − 1)
Exponent Modulus
• Multiplicative order 𝑛 is at most 𝑝 − 1
• Pick random 𝑥 such that 0 ≤ 𝑥 < 𝑝 − 1
• 𝑔 𝑎
𝑔 𝑏
mod 𝑝 = 𝑔 𝑎+𝑏
mod 𝑝 = 𝑔 𝑎+𝑏 mod 𝑛
mod 𝑝
Public-key Cryptography
Publicly announces 𝑔 𝑎
𝑔 𝑏
, 𝑔 𝑎𝑏
𝑚
Picks secret a
Computes
𝑔 𝑏 𝑎
= 𝑔 𝑎𝑏
Picks random secret b.
Computes
𝑔 𝑎 𝑏 = 𝑔 𝑎𝑏
Encrypts message 𝑚:
𝑔 𝑎𝑏
𝑚
Public values: 𝑔, 𝑝, 𝑔 𝑎
, 𝑔 𝑏
Shared secret: 𝑔 𝑎𝑏
Man-in-the-Middle (MITM)
𝑔 𝑎
𝑔 𝑏′, 𝑔 𝑎𝑏′ 𝑚
Picks secret a
Computes
𝑔 𝑏 𝑎
= 𝑔 𝑎𝑏
Picks secret b. Computes
𝑔 𝑎′ 𝑏
= 𝑔 𝑎′𝑏
Encrypts message 𝑚:
𝑔 𝑎′𝑏 𝑚
𝑔 𝑎′
𝑔 𝑏, 𝑔 𝑎′𝑏 𝑚
Picks random 𝑎’, 𝑏’,
Reads everything
Digital Signature
Recall
Easy to verify
• Everybody has your “verification key”, vk
Hard to forge
• Nobody but you has the “signing key”, sk
Hard to repudiate
• Everybody knows only you have signing key
𝑠 = sign 𝑠𝑘 𝑚
true, false = verify 𝑣𝑘(𝑚, 𝑠)
Discrete-log based signature
ElGamal Signature Scheme
Signing
Input: message 𝑚
1. Pick random 𝑘
2. Compute 𝑟 = 𝑔 𝑘 mod 𝑝 ;
𝑠 = 𝑚 − 𝑎𝑟 𝑘−1 mod(𝑝 − 1)
3. Send (𝑟, 𝑠) with message 𝑚
Verification
Input: message 𝑚, 𝑟, 𝑠
Check if 𝑟 𝑠 𝑔 𝑎 𝑟 = 𝑔 𝑚(mod 𝑝)
Fixed global parameters: 𝑔, 𝑝
Private key: 𝑎
Public key: 𝑔 𝑎 mod 𝑝
Bitcoin Payment
Sign it like a check!
Recap
1. We want to sign transactions digitally on the bitcoin network, such
that they are:
a) Easy to verify
b) Hard to forge
c) Hard to repudiate
2. Discrete exponentiation is easy, logarithm is hard
3. We used it to make asymmetric (aka. public) key crypto
4. Same principle used for digital signatures
Avoiding (overly) long
numbers
Informal Requirements
Given 𝑔 and 𝑦,
𝑔 𝑥
= 𝑦 should be hard to solve for 𝑥
Group
A group is a set of elements (denoted 𝐺) and an associated binary
operation (denoted ∗) that satisfies the following:
• Closure: 𝑎 ∗ 𝑏 is also a group element, or ∀𝑎, 𝑏: 𝑎 ∗ 𝑏 ∈ 𝐺
• Associativity: ∀𝑎, 𝑏, 𝑐: 𝑎 ∗ 𝑏 ∗ 𝑐 = 𝑎 ∗ (𝑏 ∗ 𝑐)
• Identity element: ∃𝑒∀𝑎: 𝑎 ∗ 𝑒 = 𝑎 = 𝑒 ∗ 𝑎
• Inverse: ∀𝑎∃𝑏: 𝑎 ∗ 𝑏 = 𝑒 = 𝑏 ∗ 𝑎
Not necessary, but okay to have:
• Commutativity: ∀𝑎, 𝑏: 𝑎 ∗ 𝑏 = 𝑏 ∗ 𝑎
Additional Cryptographic Properties
• Discrete logarithm should be hard
• Group operation should be efficient
• Implies small key sizes
Elliptic Curve Cryptography (ECC)
• Group elements: points
on the curve, P, Q, and R
• Point “addition”: using
“geometry”. P+Q=R
𝑦2 = 𝑥3 + 7
P
Q
R
Elliptic “Curve”
Image from: http://www.coindesk.com/math-behind-bitcoin/
Elliptic Curve Digital Signature Algorithm (ECDSA)
ElGamal Signature
Inputs: message 𝑚, private key 𝑎
1. Pick random 𝑘
2. Compute
a) 𝑟 = 𝑔 𝑘 mod 𝑝
b) 𝑠 = 𝑚 − 𝑎𝑟 𝑘−1
mod 𝑛
3. Send 𝑟, 𝑠 with message 𝑚
Verification
Check if 𝑟 𝑠
𝑔 𝑎 𝑟
= 𝑔 𝑚
ECDSA
Inputs: message , private key
1. Pick random k
2. Compute
a) , let
3. Send with message
Verification
If , check
Please pay $1000 to
my employee
--TheBoss
You have money!
Jason Benjamin
Logistics
• Next class: hash functions and Bitcoin consensus
• Checkup 1 on Monday. Includes everything till today

More Related Content

Viewers also liked

Hidden Services, Zero Knowledge
Hidden Services, Zero KnowledgeHidden Services, Zero Knowledge
Hidden Services, Zero Knowledge
David Evans
 
Altcoins
AltcoinsAltcoins
Altcoins
sameezahur
 
Scripting Transactions
Scripting TransactionsScripting Transactions
Scripting Transactions
David Evans
 
Midterm Confirmations
Midterm ConfirmationsMidterm Confirmations
Midterm Confirmations
David Evans
 
Bitcoin Script
Bitcoin ScriptBitcoin Script
Bitcoin Script
David Evans
 
The Blockchain
The BlockchainThe Blockchain
The Blockchain
David Evans
 
Anonymity in Bitcoin
Anonymity in BitcoinAnonymity in Bitcoin
Anonymity in Bitcoin
David Evans
 
Cryptocurrency Jeopardy!
Cryptocurrency Jeopardy!Cryptocurrency Jeopardy!
Cryptocurrency Jeopardy!
David Evans
 

Viewers also liked (8)

Hidden Services, Zero Knowledge
Hidden Services, Zero KnowledgeHidden Services, Zero Knowledge
Hidden Services, Zero Knowledge
 
Altcoins
AltcoinsAltcoins
Altcoins
 
Scripting Transactions
Scripting TransactionsScripting Transactions
Scripting Transactions
 
Midterm Confirmations
Midterm ConfirmationsMidterm Confirmations
Midterm Confirmations
 
Bitcoin Script
Bitcoin ScriptBitcoin Script
Bitcoin Script
 
The Blockchain
The BlockchainThe Blockchain
The Blockchain
 
Anonymity in Bitcoin
Anonymity in BitcoinAnonymity in Bitcoin
Anonymity in Bitcoin
 
Cryptocurrency Jeopardy!
Cryptocurrency Jeopardy!Cryptocurrency Jeopardy!
Cryptocurrency Jeopardy!
 

Similar to Asymmetric Key Signatures

暗認本読書会11
暗認本読書会11暗認本読書会11
暗認本読書会11
MITSUNARI Shigeo
 
digital signatures.pptx
digital signatures.pptxdigital signatures.pptx
digital signatures.pptx
AliAshraf68199
 
module_14_digital_signatures (1).pptx
module_14_digital_signatures (1).pptxmodule_14_digital_signatures (1).pptx
module_14_digital_signatures (1).pptx
AliAshraf68199
 
digital signatures1.pptx
digital signatures1.pptxdigital signatures1.pptx
digital signatures1.pptx
AliAshraf68199
 
digital signatures10.pptx
digital signatures10.pptxdigital signatures10.pptx
digital signatures10.pptx
AliAshraf68199
 
module_14_digital_signatures.pptx
module_14_digital_signatures.pptxmodule_14_digital_signatures.pptx
module_14_digital_signatures.pptx
MehediHasanShaon1
 
Cs166 mynote
Cs166 mynoteCs166 mynote
Cs166 mynote
Kaya Ota
 
digital Information BD.pptx
digital Information BD.pptxdigital Information BD.pptx
digital Information BD.pptx
AliAshraf68199
 
digital10.pptx
digital10.pptxdigital10.pptx
digital10.pptx
AliAshraf68199
 
Smart City Lecture 5 - Introduction to Encryption
Smart City Lecture 5 - Introduction to EncryptionSmart City Lecture 5 - Introduction to Encryption
Smart City Lecture 5 - Introduction to Encryption
Peter Waher
 
digital Information.pptx
digital Information.pptxdigital Information.pptx
digital Information.pptx
AliAshraf68199
 
暗認本読書会5
暗認本読書会5暗認本読書会5
暗認本読書会5
MITSUNARI Shigeo
 
Homomorphic Encryption
Homomorphic EncryptionHomomorphic Encryption
Homomorphic Encryption
Göktuğ Serez
 
Lifted-ElGamal暗号を用いた任意関数演算の二者間秘密計算プロトコルのmaliciousモデルにおける効率化
Lifted-ElGamal暗号を用いた任意関数演算の二者間秘密計算プロトコルのmaliciousモデルにおける効率化Lifted-ElGamal暗号を用いた任意関数演算の二者間秘密計算プロトコルのmaliciousモデルにおける効率化
Lifted-ElGamal暗号を用いた任意関数演算の二者間秘密計算プロトコルのmaliciousモデルにおける効率化
MITSUNARI Shigeo
 
keyex.pptx
keyex.pptxkeyex.pptx
keyex.pptx
Vaibhavwankhede18
 
A compact zero knowledge proof to restrict message space in homomorphic encry...
A compact zero knowledge proof to restrict message space in homomorphic encry...A compact zero knowledge proof to restrict message space in homomorphic encry...
A compact zero knowledge proof to restrict message space in homomorphic encry...
MITSUNARI Shigeo
 
Number theory and cryptography
Number theory and cryptographyNumber theory and cryptography
Number theory and cryptography
Yasser Ali
 
Class3
Class3Class3
暗認本読書会6
暗認本読書会6暗認本読書会6
暗認本読書会6
MITSUNARI Shigeo
 
apidays LIVE Australia 2020 - WT* is JWT? by Maciej Treder
apidays LIVE Australia 2020 -  WT* is JWT? by Maciej Trederapidays LIVE Australia 2020 -  WT* is JWT? by Maciej Treder
apidays LIVE Australia 2020 - WT* is JWT? by Maciej Treder
apidays
 

Similar to Asymmetric Key Signatures (20)

暗認本読書会11
暗認本読書会11暗認本読書会11
暗認本読書会11
 
digital signatures.pptx
digital signatures.pptxdigital signatures.pptx
digital signatures.pptx
 
module_14_digital_signatures (1).pptx
module_14_digital_signatures (1).pptxmodule_14_digital_signatures (1).pptx
module_14_digital_signatures (1).pptx
 
digital signatures1.pptx
digital signatures1.pptxdigital signatures1.pptx
digital signatures1.pptx
 
digital signatures10.pptx
digital signatures10.pptxdigital signatures10.pptx
digital signatures10.pptx
 
module_14_digital_signatures.pptx
module_14_digital_signatures.pptxmodule_14_digital_signatures.pptx
module_14_digital_signatures.pptx
 
Cs166 mynote
Cs166 mynoteCs166 mynote
Cs166 mynote
 
digital Information BD.pptx
digital Information BD.pptxdigital Information BD.pptx
digital Information BD.pptx
 
digital10.pptx
digital10.pptxdigital10.pptx
digital10.pptx
 
Smart City Lecture 5 - Introduction to Encryption
Smart City Lecture 5 - Introduction to EncryptionSmart City Lecture 5 - Introduction to Encryption
Smart City Lecture 5 - Introduction to Encryption
 
digital Information.pptx
digital Information.pptxdigital Information.pptx
digital Information.pptx
 
暗認本読書会5
暗認本読書会5暗認本読書会5
暗認本読書会5
 
Homomorphic Encryption
Homomorphic EncryptionHomomorphic Encryption
Homomorphic Encryption
 
Lifted-ElGamal暗号を用いた任意関数演算の二者間秘密計算プロトコルのmaliciousモデルにおける効率化
Lifted-ElGamal暗号を用いた任意関数演算の二者間秘密計算プロトコルのmaliciousモデルにおける効率化Lifted-ElGamal暗号を用いた任意関数演算の二者間秘密計算プロトコルのmaliciousモデルにおける効率化
Lifted-ElGamal暗号を用いた任意関数演算の二者間秘密計算プロトコルのmaliciousモデルにおける効率化
 
keyex.pptx
keyex.pptxkeyex.pptx
keyex.pptx
 
A compact zero knowledge proof to restrict message space in homomorphic encry...
A compact zero knowledge proof to restrict message space in homomorphic encry...A compact zero knowledge proof to restrict message space in homomorphic encry...
A compact zero knowledge proof to restrict message space in homomorphic encry...
 
Number theory and cryptography
Number theory and cryptographyNumber theory and cryptography
Number theory and cryptography
 
Class3
Class3Class3
Class3
 
暗認本読書会6
暗認本読書会6暗認本読書会6
暗認本読書会6
 
apidays LIVE Australia 2020 - WT* is JWT? by Maciej Treder
apidays LIVE Australia 2020 -  WT* is JWT? by Maciej Trederapidays LIVE Australia 2020 -  WT* is JWT? by Maciej Treder
apidays LIVE Australia 2020 - WT* is JWT? by Maciej Treder
 

More from David Evans

Trick or Treat?: Bitcoin for Non-Believers, Cryptocurrencies for Cypherpunks
Trick or Treat?: Bitcoin for Non-Believers, Cryptocurrencies for CypherpunksTrick or Treat?: Bitcoin for Non-Believers, Cryptocurrencies for Cypherpunks
Trick or Treat?: Bitcoin for Non-Believers, Cryptocurrencies for Cypherpunks
David Evans
 
How to Live in Paradise
How to Live in ParadiseHow to Live in Paradise
How to Live in Paradise
David Evans
 
Mining Economics
Mining EconomicsMining Economics
Mining Economics
David Evans
 
Multi-Party Computation for the Masses
Multi-Party Computation for the MassesMulti-Party Computation for the Masses
Multi-Party Computation for the Masses
David Evans
 
Proof of Reserve
Proof of ReserveProof of Reserve
Proof of Reserve
David Evans
 
Silk Road
Silk RoadSilk Road
Silk Road
David Evans
 
Blooming Sidechains!
Blooming Sidechains!Blooming Sidechains!
Blooming Sidechains!
David Evans
 
Useful Proofs of Work, Permacoin
Useful Proofs of Work, PermacoinUseful Proofs of Work, Permacoin
Useful Proofs of Work, Permacoin
David Evans
 
Alternate Cryptocurrencies
Alternate CryptocurrenciesAlternate Cryptocurrencies
Alternate Cryptocurrencies
David Evans
 
Script
ScriptScript
Script
David Evans
 
Selfish Mining
Selfish MiningSelfish Mining
Selfish Mining
David Evans
 
Quiz 2: Bitcoin Protocol, Mining, Supsersizing
Quiz 2: Bitcoin Protocol, Mining, SupsersizingQuiz 2: Bitcoin Protocol, Mining, Supsersizing
Quiz 2: Bitcoin Protocol, Mining, Supsersizing
David Evans
 
Mostly About Superfish
Mostly About SuperfishMostly About Superfish
Mostly About Superfish
David Evans
 
Mining Pools and Profits
Mining Pools and ProfitsMining Pools and Profits
Mining Pools and Profits
David Evans
 
More Mining
More MiningMore Mining
More Mining
David Evans
 
Mining
MiningMining
Mining
David Evans
 
Proofs of Work
Proofs of WorkProofs of Work
Proofs of Work
David Evans
 
DigiCash
DigiCashDigiCash
DigiCash
David Evans
 

More from David Evans (18)

Trick or Treat?: Bitcoin for Non-Believers, Cryptocurrencies for Cypherpunks
Trick or Treat?: Bitcoin for Non-Believers, Cryptocurrencies for CypherpunksTrick or Treat?: Bitcoin for Non-Believers, Cryptocurrencies for Cypherpunks
Trick or Treat?: Bitcoin for Non-Believers, Cryptocurrencies for Cypherpunks
 
How to Live in Paradise
How to Live in ParadiseHow to Live in Paradise
How to Live in Paradise
 
Mining Economics
Mining EconomicsMining Economics
Mining Economics
 
Multi-Party Computation for the Masses
Multi-Party Computation for the MassesMulti-Party Computation for the Masses
Multi-Party Computation for the Masses
 
Proof of Reserve
Proof of ReserveProof of Reserve
Proof of Reserve
 
Silk Road
Silk RoadSilk Road
Silk Road
 
Blooming Sidechains!
Blooming Sidechains!Blooming Sidechains!
Blooming Sidechains!
 
Useful Proofs of Work, Permacoin
Useful Proofs of Work, PermacoinUseful Proofs of Work, Permacoin
Useful Proofs of Work, Permacoin
 
Alternate Cryptocurrencies
Alternate CryptocurrenciesAlternate Cryptocurrencies
Alternate Cryptocurrencies
 
Script
ScriptScript
Script
 
Selfish Mining
Selfish MiningSelfish Mining
Selfish Mining
 
Quiz 2: Bitcoin Protocol, Mining, Supsersizing
Quiz 2: Bitcoin Protocol, Mining, SupsersizingQuiz 2: Bitcoin Protocol, Mining, Supsersizing
Quiz 2: Bitcoin Protocol, Mining, Supsersizing
 
Mostly About Superfish
Mostly About SuperfishMostly About Superfish
Mostly About Superfish
 
Mining Pools and Profits
Mining Pools and ProfitsMining Pools and Profits
Mining Pools and Profits
 
More Mining
More MiningMore Mining
More Mining
 
Mining
MiningMining
Mining
 
Proofs of Work
Proofs of WorkProofs of Work
Proofs of Work
 
DigiCash
DigiCashDigiCash
DigiCash
 

Recently uploaded

Embedded machine learning-based road conditions and driving behavior monitoring
Embedded machine learning-based road conditions and driving behavior monitoringEmbedded machine learning-based road conditions and driving behavior monitoring
Embedded machine learning-based road conditions and driving behavior monitoring
IJECEIAES
 
22CYT12-Unit-V-E Waste and its Management.ppt
22CYT12-Unit-V-E Waste and its Management.ppt22CYT12-Unit-V-E Waste and its Management.ppt
22CYT12-Unit-V-E Waste and its Management.ppt
KrishnaveniKrishnara1
 
LLM Fine Tuning with QLoRA Cassandra Lunch 4, presented by Anant
LLM Fine Tuning with QLoRA Cassandra Lunch 4, presented by AnantLLM Fine Tuning with QLoRA Cassandra Lunch 4, presented by Anant
LLM Fine Tuning with QLoRA Cassandra Lunch 4, presented by Anant
Anant Corporation
 
Optimizing Gradle Builds - Gradle DPE Tour Berlin 2024
Optimizing Gradle Builds - Gradle DPE Tour Berlin 2024Optimizing Gradle Builds - Gradle DPE Tour Berlin 2024
Optimizing Gradle Builds - Gradle DPE Tour Berlin 2024
Sinan KOZAK
 
Use PyCharm for remote debugging of WSL on a Windo cf5c162d672e4e58b4dde5d797...
Use PyCharm for remote debugging of WSL on a Windo cf5c162d672e4e58b4dde5d797...Use PyCharm for remote debugging of WSL on a Windo cf5c162d672e4e58b4dde5d797...
Use PyCharm for remote debugging of WSL on a Windo cf5c162d672e4e58b4dde5d797...
shadow0702a
 
官方认证美国密歇根州立大学毕业证学位证书原版一模一样
官方认证美国密歇根州立大学毕业证学位证书原版一模一样官方认证美国密歇根州立大学毕业证学位证书原版一模一样
官方认证美国密歇根州立大学毕业证学位证书原版一模一样
171ticu
 
AI assisted telemedicine KIOSK for Rural India.pptx
AI assisted telemedicine KIOSK for Rural India.pptxAI assisted telemedicine KIOSK for Rural India.pptx
AI assisted telemedicine KIOSK for Rural India.pptx
architagupta876
 
Electric vehicle and photovoltaic advanced roles in enhancing the financial p...
Electric vehicle and photovoltaic advanced roles in enhancing the financial p...Electric vehicle and photovoltaic advanced roles in enhancing the financial p...
Electric vehicle and photovoltaic advanced roles in enhancing the financial p...
IJECEIAES
 
Null Bangalore | Pentesters Approach to AWS IAM
Null Bangalore | Pentesters Approach to AWS IAMNull Bangalore | Pentesters Approach to AWS IAM
Null Bangalore | Pentesters Approach to AWS IAM
Divyanshu
 
People as resource Grade IX.pdf minimala
People as resource Grade IX.pdf minimalaPeople as resource Grade IX.pdf minimala
People as resource Grade IX.pdf minimala
riddhimaagrawal986
 
Redefining brain tumor segmentation: a cutting-edge convolutional neural netw...
Redefining brain tumor segmentation: a cutting-edge convolutional neural netw...Redefining brain tumor segmentation: a cutting-edge convolutional neural netw...
Redefining brain tumor segmentation: a cutting-edge convolutional neural netw...
IJECEIAES
 
spirit beverages ppt without graphics.pptx
spirit beverages ppt without graphics.pptxspirit beverages ppt without graphics.pptx
spirit beverages ppt without graphics.pptx
Madan Karki
 
Properties Railway Sleepers and Test.pptx
Properties Railway Sleepers and Test.pptxProperties Railway Sleepers and Test.pptx
Properties Railway Sleepers and Test.pptx
MDSABBIROJJAMANPAYEL
 
BRAIN TUMOR DETECTION for seminar ppt.pdf
BRAIN TUMOR DETECTION for seminar ppt.pdfBRAIN TUMOR DETECTION for seminar ppt.pdf
BRAIN TUMOR DETECTION for seminar ppt.pdf
LAXMAREDDY22
 
cnn.pptx Convolutional neural network used for image classication
cnn.pptx Convolutional neural network used for image classicationcnn.pptx Convolutional neural network used for image classication
cnn.pptx Convolutional neural network used for image classication
SakkaravarthiShanmug
 
学校原版美国波士顿大学毕业证学历学位证书原版一模一样
学校原版美国波士顿大学毕业证学历学位证书原版一模一样学校原版美国波士顿大学毕业证学历学位证书原版一模一样
学校原版美国波士顿大学毕业证学历学位证书原版一模一样
171ticu
 
integral complex analysis chapter 06 .pdf
integral complex analysis chapter 06 .pdfintegral complex analysis chapter 06 .pdf
integral complex analysis chapter 06 .pdf
gaafergoudaay7aga
 
原版制作(Humboldt毕业证书)柏林大学毕业证学位证一模一样
原版制作(Humboldt毕业证书)柏林大学毕业证学位证一模一样原版制作(Humboldt毕业证书)柏林大学毕业证学位证一模一样
原版制作(Humboldt毕业证书)柏林大学毕业证学位证一模一样
ydzowc
 
Unit-III-ELECTROCHEMICAL STORAGE DEVICES.ppt
Unit-III-ELECTROCHEMICAL STORAGE DEVICES.pptUnit-III-ELECTROCHEMICAL STORAGE DEVICES.ppt
Unit-III-ELECTROCHEMICAL STORAGE DEVICES.ppt
KrishnaveniKrishnara1
 
Computational Engineering IITH Presentation
Computational Engineering IITH PresentationComputational Engineering IITH Presentation
Computational Engineering IITH Presentation
co23btech11018
 

Recently uploaded (20)

Embedded machine learning-based road conditions and driving behavior monitoring
Embedded machine learning-based road conditions and driving behavior monitoringEmbedded machine learning-based road conditions and driving behavior monitoring
Embedded machine learning-based road conditions and driving behavior monitoring
 
22CYT12-Unit-V-E Waste and its Management.ppt
22CYT12-Unit-V-E Waste and its Management.ppt22CYT12-Unit-V-E Waste and its Management.ppt
22CYT12-Unit-V-E Waste and its Management.ppt
 
LLM Fine Tuning with QLoRA Cassandra Lunch 4, presented by Anant
LLM Fine Tuning with QLoRA Cassandra Lunch 4, presented by AnantLLM Fine Tuning with QLoRA Cassandra Lunch 4, presented by Anant
LLM Fine Tuning with QLoRA Cassandra Lunch 4, presented by Anant
 
Optimizing Gradle Builds - Gradle DPE Tour Berlin 2024
Optimizing Gradle Builds - Gradle DPE Tour Berlin 2024Optimizing Gradle Builds - Gradle DPE Tour Berlin 2024
Optimizing Gradle Builds - Gradle DPE Tour Berlin 2024
 
Use PyCharm for remote debugging of WSL on a Windo cf5c162d672e4e58b4dde5d797...
Use PyCharm for remote debugging of WSL on a Windo cf5c162d672e4e58b4dde5d797...Use PyCharm for remote debugging of WSL on a Windo cf5c162d672e4e58b4dde5d797...
Use PyCharm for remote debugging of WSL on a Windo cf5c162d672e4e58b4dde5d797...
 
官方认证美国密歇根州立大学毕业证学位证书原版一模一样
官方认证美国密歇根州立大学毕业证学位证书原版一模一样官方认证美国密歇根州立大学毕业证学位证书原版一模一样
官方认证美国密歇根州立大学毕业证学位证书原版一模一样
 
AI assisted telemedicine KIOSK for Rural India.pptx
AI assisted telemedicine KIOSK for Rural India.pptxAI assisted telemedicine KIOSK for Rural India.pptx
AI assisted telemedicine KIOSK for Rural India.pptx
 
Electric vehicle and photovoltaic advanced roles in enhancing the financial p...
Electric vehicle and photovoltaic advanced roles in enhancing the financial p...Electric vehicle and photovoltaic advanced roles in enhancing the financial p...
Electric vehicle and photovoltaic advanced roles in enhancing the financial p...
 
Null Bangalore | Pentesters Approach to AWS IAM
Null Bangalore | Pentesters Approach to AWS IAMNull Bangalore | Pentesters Approach to AWS IAM
Null Bangalore | Pentesters Approach to AWS IAM
 
People as resource Grade IX.pdf minimala
People as resource Grade IX.pdf minimalaPeople as resource Grade IX.pdf minimala
People as resource Grade IX.pdf minimala
 
Redefining brain tumor segmentation: a cutting-edge convolutional neural netw...
Redefining brain tumor segmentation: a cutting-edge convolutional neural netw...Redefining brain tumor segmentation: a cutting-edge convolutional neural netw...
Redefining brain tumor segmentation: a cutting-edge convolutional neural netw...
 
spirit beverages ppt without graphics.pptx
spirit beverages ppt without graphics.pptxspirit beverages ppt without graphics.pptx
spirit beverages ppt without graphics.pptx
 
Properties Railway Sleepers and Test.pptx
Properties Railway Sleepers and Test.pptxProperties Railway Sleepers and Test.pptx
Properties Railway Sleepers and Test.pptx
 
BRAIN TUMOR DETECTION for seminar ppt.pdf
BRAIN TUMOR DETECTION for seminar ppt.pdfBRAIN TUMOR DETECTION for seminar ppt.pdf
BRAIN TUMOR DETECTION for seminar ppt.pdf
 
cnn.pptx Convolutional neural network used for image classication
cnn.pptx Convolutional neural network used for image classicationcnn.pptx Convolutional neural network used for image classication
cnn.pptx Convolutional neural network used for image classication
 
学校原版美国波士顿大学毕业证学历学位证书原版一模一样
学校原版美国波士顿大学毕业证学历学位证书原版一模一样学校原版美国波士顿大学毕业证学历学位证书原版一模一样
学校原版美国波士顿大学毕业证学历学位证书原版一模一样
 
integral complex analysis chapter 06 .pdf
integral complex analysis chapter 06 .pdfintegral complex analysis chapter 06 .pdf
integral complex analysis chapter 06 .pdf
 
原版制作(Humboldt毕业证书)柏林大学毕业证学位证一模一样
原版制作(Humboldt毕业证书)柏林大学毕业证学位证一模一样原版制作(Humboldt毕业证书)柏林大学毕业证学位证一模一样
原版制作(Humboldt毕业证书)柏林大学毕业证学位证一模一样
 
Unit-III-ELECTROCHEMICAL STORAGE DEVICES.ppt
Unit-III-ELECTROCHEMICAL STORAGE DEVICES.pptUnit-III-ELECTROCHEMICAL STORAGE DEVICES.ppt
Unit-III-ELECTROCHEMICAL STORAGE DEVICES.ppt
 
Computational Engineering IITH Presentation
Computational Engineering IITH PresentationComputational Engineering IITH Presentation
Computational Engineering IITH Presentation
 

Asymmetric Key Signatures

  • 1. Asymmetric Key Signatures David Evans and Samee Zahur CS4501, Fall 2015
  • 2. Please pay $1000 to my employee --TheBoss You have money!
  • 3. Real-life Signatures Easy to verify • Bank has your signature Forging unlikely • Legal consequences of forging • Checkbooks are well-guarded • Copying it requires physical access Hard to repudiate • Bank keeps a copy for few months
  • 4. Digital Signatures Easy to verify • Everybody has your “verification key”, vk Hard to forge • Nobody but you has the “signing key”, sk Hard to repudiate • Everybody knows only you have signing key 𝑠 = sign 𝑠𝑘 𝑚 true, false = verify 𝑣𝑘(𝑚, 𝑠)
  • 5. Topics • Asymmetric cryptography • Digital signatures • Elliptic curve cryptography • Implementation pitfalls
  • 6. Ordinary (or symmetric) crypto Message key key
  • 7. Whitfield Diffie Martin Hellman New Directions in Cryptography, 1976
  • 8. Diffie-Hellman Key Exchange 𝑔 𝑎 mod 𝑝 𝑔 𝑏 mod 𝑝 Picks secret a Computes 𝑔 𝑏 𝑎 = 𝑔 𝑎𝑏 Picks secret b Computes 𝑔 𝑎 𝑏 = 𝑔 𝑎𝑏 Public values: 𝑔, 𝑝, 𝑔 𝑎 , 𝑔 𝑏 Shared secret: 𝑔 𝑎𝑏
  • 9. Discrete Logarithm Problem Given 𝑔, 𝑦, 𝑝 find 𝑥 such that: 𝑔 𝑥 mod 𝑝 = 𝑦
  • 11. Random element out of …? 𝑔 𝑎 mod 𝑝 𝑔 𝑏 mod 𝑝 Picks random a Computes 𝑔 𝑏 𝑎 = 𝑔 𝑎𝑏 Picks random b Computes 𝑔 𝑎 𝑏 = 𝑔 𝑎𝑏
  • 12. Mod 5 Exponentiation 0 1 2 3 4 5 6 … 0 - 0 0 0 0 0 0 … 1 1 1 1 1 1 1 1 … 2 1 2 4 3 1 2 4 … 3 1 3 4 2 1 3 4 … 4 1 4 1 4 1 4 1 … Order 1 Order 2 In mod 𝑝 multiplication, multiplicative order is always a factor of (𝑝 − 1)
  • 13. Exponent Modulus • Multiplicative order 𝑛 is at most 𝑝 − 1 • Pick random 𝑥 such that 0 ≤ 𝑥 < 𝑝 − 1 • 𝑔 𝑎 𝑔 𝑏 mod 𝑝 = 𝑔 𝑎+𝑏 mod 𝑝 = 𝑔 𝑎+𝑏 mod 𝑛 mod 𝑝
  • 14.
  • 15.
  • 16. Public-key Cryptography Publicly announces 𝑔 𝑎 𝑔 𝑏 , 𝑔 𝑎𝑏 𝑚 Picks secret a Computes 𝑔 𝑏 𝑎 = 𝑔 𝑎𝑏 Picks random secret b. Computes 𝑔 𝑎 𝑏 = 𝑔 𝑎𝑏 Encrypts message 𝑚: 𝑔 𝑎𝑏 𝑚 Public values: 𝑔, 𝑝, 𝑔 𝑎 , 𝑔 𝑏 Shared secret: 𝑔 𝑎𝑏
  • 17. Man-in-the-Middle (MITM) 𝑔 𝑎 𝑔 𝑏′, 𝑔 𝑎𝑏′ 𝑚 Picks secret a Computes 𝑔 𝑏 𝑎 = 𝑔 𝑎𝑏 Picks secret b. Computes 𝑔 𝑎′ 𝑏 = 𝑔 𝑎′𝑏 Encrypts message 𝑚: 𝑔 𝑎′𝑏 𝑚 𝑔 𝑎′ 𝑔 𝑏, 𝑔 𝑎′𝑏 𝑚 Picks random 𝑎’, 𝑏’, Reads everything
  • 19. Recall Easy to verify • Everybody has your “verification key”, vk Hard to forge • Nobody but you has the “signing key”, sk Hard to repudiate • Everybody knows only you have signing key 𝑠 = sign 𝑠𝑘 𝑚 true, false = verify 𝑣𝑘(𝑚, 𝑠)
  • 21. ElGamal Signature Scheme Signing Input: message 𝑚 1. Pick random 𝑘 2. Compute 𝑟 = 𝑔 𝑘 mod 𝑝 ; 𝑠 = 𝑚 − 𝑎𝑟 𝑘−1 mod(𝑝 − 1) 3. Send (𝑟, 𝑠) with message 𝑚 Verification Input: message 𝑚, 𝑟, 𝑠 Check if 𝑟 𝑠 𝑔 𝑎 𝑟 = 𝑔 𝑚(mod 𝑝) Fixed global parameters: 𝑔, 𝑝 Private key: 𝑎 Public key: 𝑔 𝑎 mod 𝑝
  • 22. Bitcoin Payment Sign it like a check!
  • 23. Recap 1. We want to sign transactions digitally on the bitcoin network, such that they are: a) Easy to verify b) Hard to forge c) Hard to repudiate 2. Discrete exponentiation is easy, logarithm is hard 3. We used it to make asymmetric (aka. public) key crypto 4. Same principle used for digital signatures
  • 25.
  • 26. Informal Requirements Given 𝑔 and 𝑦, 𝑔 𝑥 = 𝑦 should be hard to solve for 𝑥
  • 27. Group A group is a set of elements (denoted 𝐺) and an associated binary operation (denoted ∗) that satisfies the following: • Closure: 𝑎 ∗ 𝑏 is also a group element, or ∀𝑎, 𝑏: 𝑎 ∗ 𝑏 ∈ 𝐺 • Associativity: ∀𝑎, 𝑏, 𝑐: 𝑎 ∗ 𝑏 ∗ 𝑐 = 𝑎 ∗ (𝑏 ∗ 𝑐) • Identity element: ∃𝑒∀𝑎: 𝑎 ∗ 𝑒 = 𝑎 = 𝑒 ∗ 𝑎 • Inverse: ∀𝑎∃𝑏: 𝑎 ∗ 𝑏 = 𝑒 = 𝑏 ∗ 𝑎 Not necessary, but okay to have: • Commutativity: ∀𝑎, 𝑏: 𝑎 ∗ 𝑏 = 𝑏 ∗ 𝑎
  • 28. Additional Cryptographic Properties • Discrete logarithm should be hard • Group operation should be efficient • Implies small key sizes
  • 29. Elliptic Curve Cryptography (ECC) • Group elements: points on the curve, P, Q, and R • Point “addition”: using “geometry”. P+Q=R 𝑦2 = 𝑥3 + 7 P Q R
  • 30. Elliptic “Curve” Image from: http://www.coindesk.com/math-behind-bitcoin/
  • 31. Elliptic Curve Digital Signature Algorithm (ECDSA) ElGamal Signature Inputs: message 𝑚, private key 𝑎 1. Pick random 𝑘 2. Compute a) 𝑟 = 𝑔 𝑘 mod 𝑝 b) 𝑠 = 𝑚 − 𝑎𝑟 𝑘−1 mod 𝑛 3. Send 𝑟, 𝑠 with message 𝑚 Verification Check if 𝑟 𝑠 𝑔 𝑎 𝑟 = 𝑔 𝑚 ECDSA Inputs: message , private key 1. Pick random k 2. Compute a) , let 3. Send with message Verification If , check
  • 32.
  • 33.
  • 34. Please pay $1000 to my employee --TheBoss You have money! Jason Benjamin
  • 35. Logistics • Next class: hash functions and Bitcoin consensus • Checkup 1 on Monday. Includes everything till today