czxczxczxczxc

1. Cryptography and
Cryptography and
Network Security
Network Security
Chapter 10
Chapter 10
Fifth Edition
Fifth Edition
by William Stallings
by William Stallings
Lecture slides by Lawrie Brown
Lecture slides by Lawrie Brown

2. Chapter 10 –
Chapter 10 – Other Public Key
Other Public Key
Cryptosystems
Cryptosystems
Amongst the tribes of Central Australia every man, woman,
Amongst the tribes of Central Australia every man, woman,
and child has a secret or sacred name which is bestowed
and child has a secret or sacred name which is bestowed
by the older men upon him or her soon after birth, and
by the older men upon him or her soon after birth, and
which is known to none but the fully initiated members of
which is known to none but the fully initiated members of
the group. This secret name is never mentioned except
the group. This secret name is never mentioned except
upon the most solemn occasions; to utter it in the hearing of
upon the most solemn occasions; to utter it in the hearing of
men of another group would be a most serious breach of
men of another group would be a most serious breach of
tribal custom. When mentioned at all, the name is spoken
tribal custom. When mentioned at all, the name is spoken
only in a whisper, and not until the most elaborate
only in a whisper, and not until the most elaborate
precautions have been taken that it shall be heard by no
precautions have been taken that it shall be heard by no
one but members of the group. The native thinks that a
one but members of the group. The native thinks that a
stranger knowing his secret name would have special
stranger knowing his secret name would have special
power to work him ill by means of magic.
power to work him ill by means of magic.
—
—The Golden Bough,
The Golden Bough, Sir James George Frazer
Sir James George Frazer

3. Diffie-Hellman Key Exchange
Diffie-Hellman Key Exchange
 first public-key type scheme proposed
first public-key type scheme proposed
 by Diffie & Hellman in 1976 along with the
by Diffie & Hellman in 1976 along with the
exposition of public key concepts
exposition of public key concepts

note: now know that
note: now know that Williamson
Williamson (UK CESG)
(UK CESG)
secretly proposed the concept in 1970
secretly proposed the concept in 1970
 is a practical method for public exchange
is a practical method for public exchange
of a secret key
of a secret key
 used in a number of commercial products
used in a number of commercial products

4. Diffie-Hellman Key Exchange
Diffie-Hellman Key Exchange
 a public-key distribution scheme
a public-key distribution scheme

cannot be used to exchange an arbitrary message
cannot be used to exchange an arbitrary message

rather it can establish a common key
rather it can establish a common key

known only to the two participants
known only to the two participants
 value of key depends on the participants (and
value of key depends on the participants (and
their private and public key information)
their private and public key information)
 based on exponentiation in a finite (Galois) field
based on exponentiation in a finite (Galois) field
(modulo a prime or a polynomial) - easy
(modulo a prime or a polynomial) - easy
 security relies on the difficulty of computing
security relies on the difficulty of computing
discrete logarithms (similar to factoring) – hard
discrete logarithms (similar to factoring) – hard

5. Diffie-Hellman Setup
Diffie-Hellman Setup
 all users agree on global parameters:
all users agree on global parameters:

large prime integer or polynomial
large prime integer or polynomial q
q

a
a being a primitive root mod
being a primitive root mod q
q
 each user (eg. A) generates their key
each user (eg. A) generates their key
 chooses a secret key (number):
chooses a secret key (number): x
xA
A < q
< q

compute their
compute their public key
public key:
: y
yA
A =
= a
a
x
xA
A
mod q
mod q
 each user makes public that key
each user makes public that key y
yA
A

6. Diffie-Hellman Key Exchange
Diffie-Hellman Key Exchange
 shared session key for users A & B is K
shared session key for users A & B is KAB
AB:
:
K
KAB
AB =
= a
a
x
xA.
A.x
xB
B
mod q
mod q
= y
= yA
A
x
xB
B
mod q (which
mod q (which B
B can compute)
can compute)
= y
= yB
B
x
xA
A
mod q (which
mod q (which A
A can compute)
can compute)
 K
KAB
AB is used as session key in private-key
is used as session key in private-key
encryption scheme between Alice and Bob
encryption scheme between Alice and Bob
 if Alice and Bob subsequently communicate,
if Alice and Bob subsequently communicate,
they will have the
they will have the same
same key as before, unless
key as before, unless
they choose new public-keys
they choose new public-keys
 attacker needs an x, must solve discrete log
attacker needs an x, must solve discrete log

7. Diffie-Hellman Example
Diffie-Hellman Example
 users Alice & Bob who wish to swap keys:
users Alice & Bob who wish to swap keys:
 agree on prime
agree on prime q=353
q=353 and
and a
a=3
=3
 select random secret keys:
select random secret keys:

A chooses
A chooses x
xA
A=97,
=97, B chooses
B chooses x
xB
B=233
=233
 compute respective public keys:
compute respective public keys:

y
yA
A=
=3
3
97
97
mod 353 = 40
mod 353 = 40 (Alice)
(Alice)

y
yB
B=
=3
3
233
233
mod 353 = 248
mod 353 = 248(Bob)
(Bob)
 compute shared session key as:
compute shared session key as:

K
KAB
AB= y
= yB
B
x
xA
A
mod 353 =
mod 353 = 248
248
97
97
= 160
= 160 (Alice)
(Alice)

K
KAB
AB= y
= yA
A
x
xB
B
mod 353 =
mod 353 = 40
40
233
233
= 160
= 160 (Bob)
(Bob)

8. Key Exchange Protocols
Key Exchange Protocols
 users could create random private/public
users could create random private/public
D-H keys each time they communicate
D-H keys each time they communicate
 users could create a known private/public
users could create a known private/public
D-H key and publish in a directory, then
D-H key and publish in a directory, then
consulted and used to securely
consulted and used to securely
communicate with them
communicate with them
 both of these are vulnerable to a Man-in-
both of these are vulnerable to a Man-in-
the-Middle Attack
the-Middle Attack
 authentication of the keys is needed
authentication of the keys is needed

9. Man-in-the-Middle Attack
Man-in-the-Middle Attack
1.
1. Darth prepares by creating two private / public keys
Darth prepares by creating two private / public keys
2.
2. Alice transmits her public key to Bob
Alice transmits her public key to Bob
3.
3. Darth intercepts this and transmits his first public key to
Darth intercepts this and transmits his first public key to
Bob. Darth also calculates a shared key with Alice
Bob. Darth also calculates a shared key with Alice
4.
4. Bob receives the public key and calculates the shared key
Bob receives the public key and calculates the shared key
(with Darth instead of Alice)
(with Darth instead of Alice)
5.
5. Bob transmits his public key to Alice
Bob transmits his public key to Alice
6.
6. Darth intercepts this and transmits his second public key
Darth intercepts this and transmits his second public key
to Alice. Darth calculates a shared key with Bob
to Alice. Darth calculates a shared key with Bob
7.
7. Alice receives the key and calculates the shared key (with
Alice receives the key and calculates the shared key (with
Darth instead of Bob)
Darth instead of Bob)
 Darth can then intercept, decrypt, re-encrypt, forward all
Darth can then intercept, decrypt, re-encrypt, forward all
messages between Alice & Bob
messages between Alice & Bob

10. ElGamal Cryptography
ElGamal Cryptography
 public-key cryptosystem related to D-H
public-key cryptosystem related to D-H
 uses exponentiation in a finite field
uses exponentiation in a finite field
 with security based difficulty of computing
with security based difficulty of computing
discrete logarithms, as in D-H
discrete logarithms, as in D-H
 each user (eg. A) generates their key
each user (eg. A) generates their key
 chooses a secret key (number):
chooses a secret key (number): 1 <
1 < x
xA
A < q-1
< q-1

compute their
compute their public key
public key:
: y
yA
A =
= a
a
x
xA
A
mod q
mod q

11. ElGamal Message Exchange
ElGamal Message Exchange
 Bob encrypts a message to send to A computing
Bob encrypts a message to send to A computing

represent message
represent message M
M in range
in range 0 <= M <= q-1
0 <= M <= q-1
• longer messages must be sent as blocks
longer messages must be sent as blocks

chose random integer
chose random integer k
k with
with 1 <= k <= q-1
1 <= k <= q-1

compute one-time key
compute one-time key K = y
K = yA
A
k
k
mod q
mod q

encrypt M as a pair of integers
encrypt M as a pair of integers (C
(C1
1,C
,C2
2)
) where
where
• C
C1
1 =
= a
a
k
k
mod q ;
mod q ; C
C2
2 = KM mod q
= KM mod q
 A then recovers message by
A then recovers message by

recovering key K as
recovering key K as K =
K = C
C1
1
x
xA
A
mod q
mod q

computing M as
computing M as M = C
M = C2
2 K
K-1
-1
mod q
mod q
 a unique k must be used each time
a unique k must be used each time

otherwise result is insecure
otherwise result is insecure

12. ElGamal Example
ElGamal Example
 use field GF(19)
use field GF(19) q=19
q=19 and
and a
a=10
=10
 Alice computes her key:
Alice computes her key:

A chooses
A chooses x
xA
A=5 &
=5 & computes
computes y
yA
A=
=10
10
5
5
mod 19 = 3
mod 19 = 3
 Bob send message
Bob send message m=17
m=17 as
as (11,5)
(11,5) by
by

chosing random
chosing random k=6
k=6

computing
computing K = y
K = yA
A
k
k
mod q = 3
mod q = 3
6
6
mod 19 = 7
mod 19 = 7

computing
computing C
C1
1 =
= a
a
k
k
mod q = 10
mod q = 10
6
6
mod 19 = 11;
mod 19 = 11;
C
C2
2 = KM mod q = 7.17 mod 19 = 5
= KM mod q = 7.17 mod 19 = 5
 Alice recovers original message by computing:
Alice recovers original message by computing:

recover
recover K =
K = C
C1
1
x
xA
A
mod q =
mod q = 11
11
5
5
mod 19 = 7
mod 19 = 7

compute inverse
compute inverse K
K-1
-1
= 7
= 7-1
-1
= 11
= 11

recover
recover M = C
M = C2
2 K
K-1
-1
mod q = 5.11 mod 19 = 17
mod q = 5.11 mod 19 = 17

13. Elliptic Curve Cryptography
Elliptic Curve Cryptography
 majority of public-key crypto (RSA, D-H)
majority of public-key crypto (RSA, D-H)
use either integer or polynomial arithmetic
use either integer or polynomial arithmetic
with very large numbers/polynomials
with very large numbers/polynomials
 imposes a significant load in storing and
imposes a significant load in storing and
processing keys and messages
processing keys and messages
 an alternative is to use elliptic curves
an alternative is to use elliptic curves
 offers same security with smaller bit sizes
offers same security with smaller bit sizes
 newer, but not as well analysed
newer, but not as well analysed

14. Real Elliptic Curves
Real Elliptic Curves
 an
an elliptic curve is defined by an
elliptic curve is defined by an
equation in two variables x & y, with
equation in two variables x & y, with
coefficients
coefficients
 consider a cubic elliptic curve of form
consider a cubic elliptic curve of form

y
y2
2
=
= x
x3
3
+
+ ax
ax +
+ b
b

where x,y,a,b are all real numbers
where x,y,a,b are all real numbers

also define zero point O
also define zero point O
 consider set of points E(a,b) that satisfy
consider set of points E(a,b) that satisfy
 have addition operation for elliptic curve
have addition operation for elliptic curve

geometrically sum of P+Q is reflection of the
geometrically sum of P+Q is reflection of the
intersection R
intersection R

15. Real Elliptic Curve Example
Real Elliptic Curve Example

16. Finite Elliptic Curves
Finite Elliptic Curves
 Elliptic curve cryptography uses curves
Elliptic curve cryptography uses curves
whose variables & coefficients are finite
whose variables & coefficients are finite
 have two families commonly used:
have two families commonly used:
 prime curves
prime curves E
Ep
p(a,b)
(a,b) defined over Z
defined over Zp
p
• use integers modulo a prime
use integers modulo a prime
• best in software
best in software
 binary curves
binary curves E
E2
2m
m(a,b)
(a,b) defined over GF(2
defined over GF(2n
n
)
)
• use polynomials with binary coefficients
use polynomials with binary coefficients
• best in hardware
best in hardware

17. Elliptic Curve Cryptography
Elliptic Curve Cryptography
 ECC addition is analog of modulo multiply
ECC addition is analog of modulo multiply
 ECC repeated addition is analog of
ECC repeated addition is analog of
modulo exponentiation
modulo exponentiation
 need “hard” problem equiv to discrete log
need “hard” problem equiv to discrete log

Q=kP
Q=kP, where Q,P belong to a prime curve
, where Q,P belong to a prime curve

is “easy” to compute Q given k,P
is “easy” to compute Q given k,P

but “hard” to find k given Q,P
but “hard” to find k given Q,P

known as the elliptic curve logarithm problem
known as the elliptic curve logarithm problem
 Certicom example:
Certicom example: E
E23
23(9,17)
(9,17)

18. ECC Diffie-Hellman
ECC Diffie-Hellman
 can do key exchange analogous to D-H
can do key exchange analogous to D-H
 users select a suitable curve
users select a suitable curve E
Eq
q(a,b)
(a,b)
 select base point
select base point G=(x
G=(x1
1,y
,y1
1)
)

with large order
with large order n
n s.t.
s.t. nG=O
nG=O
 A & B select private keys
A & B select private keys n
nA
A<n, n
<n, nB
B<n
<n
 compute public keys:
compute public keys: P
PA
A=n
=nA
AG,
G, P
PB
B=n
=nB
BG
G
 compute shared key:
compute shared key: K
K=n
=nA
AP
PB
B,
, K
K=n
=nB
BP
PA
A

same since
same since K
K=n
=nA
An
nB
BG
G
 attacker would need to find
attacker would need to find k
k, hard
, hard

19. ECC Encryption/Decryption
ECC Encryption/Decryption
 several alternatives, will consider simplest
several alternatives, will consider simplest
 must first encode any message M as a point on
must first encode any message M as a point on
the elliptic curve P
the elliptic curve Pm
m
 select suitable curve & point G as in D-H
select suitable curve & point G as in D-H
 each user chooses private key
each user chooses private key n
nA
A<n
<n
 and computes public key
and computes public key P
PA
A=n
=nA
AG
G
 to encrypt P
to encrypt Pm
m :
: C
Cm
m={kG, P
={kG, Pm
m+kP
+kPb
b}
},
, k
k random
random
 decrypt C
decrypt Cm
m compute:
compute:
P
Pm
m+
+k
kP
Pb
b–
–n
nB
B(
(kG
kG) =
) = P
Pm
m+
+k
k(
(n
nB
BG
G)–
)–n
nB
B(
(kG
kG) =
) = P
Pm
m

20. ECC Security
ECC Security
 relies on elliptic curve logarithm problem
relies on elliptic curve logarithm problem
 fastest method is “Pollard rho method”
fastest method is “Pollard rho method”
 compared to factoring, can use much
compared to factoring, can use much
smaller key sizes than with RSA etc
smaller key sizes than with RSA etc
 for equivalent key lengths computations
for equivalent key lengths computations
are roughly equivalent
are roughly equivalent
 hence for similar security ECC offers
hence for similar security ECC offers
significant computational advantages
significant computational advantages

21. Comparable Key Sizes for
Comparable Key Sizes for
Equivalent Security
Equivalent Security
Symmetric
scheme
(key size in bits)
ECC-based
scheme
(size of n in bits)
RSA/DSA
(modulus size in
bits)
56 112 512
80 160 1024
112 224 2048
128 256 3072
192 384 7680
256 512 15360

22. Pseudorandom Number
Pseudorandom Number
Generation (PRNG) based on
Generation (PRNG) based on
Asymmetric Ciphers
Asymmetric Ciphers
 asymmetric encryption algorithm produce
asymmetric encryption algorithm produce
apparently random output
apparently random output
 hence can be used to build a
hence can be used to build a
pseudorandom number generator (PRNG)
pseudorandom number generator (PRNG)
 much slower than symmetric algorithms
much slower than symmetric algorithms
 hence only use to generate a short
hence only use to generate a short
pseudorandom bit sequence (eg. key)
pseudorandom bit sequence (eg. key)

23. PRNG based on RSA
PRNG based on RSA
 have Micali-Schnorr PRNG using RSA
have Micali-Schnorr PRNG using RSA

in ANSI X9.82 and ISO 18031
in ANSI X9.82 and ISO 18031

24. Summary
Summary
 have considered:
have considered:

Diffie-Hellman key exchange
Diffie-Hellman key exchange

ElGamal cryptography
ElGamal cryptography

Elliptic Curve cryptography
Elliptic Curve cryptography

Pseudorandom Number Generation (PRNG)
Pseudorandom Number Generation (PRNG)
based on Asymmetric Ciphers (RSA & ECC)
based on Asymmetric Ciphers (RSA & ECC)