Topics in Algebra: Cryptography
Univ.-Prof. Dr. Goulnara ARZHANTSEVA
WS 2019
Cryptography: Overview
Cryptography
I Past: Diffie–Hellman (1976) andRivest-Shamir-Adleman(1977)
II Nowadays: Blockchain ([1991], 2008)
III Future: Quantum ([1927, 1982], 1983) and Post-quantum cryptography (1994,1996)
RSA cryptosystem
Definition: RSA cryptosystem
Letn=pq, wherep,qare primes. LetP =C=Z/nZand K ={(n,p,q,d,e) : de= 1 mod φ(n)}
Fork = (n,p,q,d,e), we define
Ek(x) =xe mod n and Dk(c) =cd modn.
Public-key is (n,e) and private-key is (p,q,d).
Here,x is a plaintext.
Euler’s functionφ(n) = the number of positive integers less thannand relatively prime ton.
RSA cryptosystem
Encryption and decryption are inverse operations.
n=pq ⇒φ(n) = (p−1)(q−1)
We have thatde= 1 mod φ(n), i.e. de=tφ(n) + 1 for somet ∈Z.
(1) Suppose thatx ∈(Z/nZ)×, then
(xe)d =xtφ(n)+1 modn= (xφ(n))tx modn= 1tx mod n=x modn.
(2) Ifx 6∈(Z/nZ)×, thenx = 0 modporx = 0 modq.
Ifx = 0 mod p, then (xe)d = 0 mod pas well. If the same holds for mod qwe are done by the Chinese remainder theorem.
Otherwise,x 6= 0 mod q. Then, byFermat’s little theorem,
(xe)d =xed−1x =xt(p−1)(q−1)x = (xq−1)t(p−1)x=1t(p−1)x modq=x mod q.We conclude by the Chinese remainder theorem.
RSA cryptosystem
Encryption and decryption are inverse operations.
n=pq ⇒φ(n) = (p−1)(q−1)
We have thatde= 1 mod φ(n), i.e. de=tφ(n) + 1 for somet ∈Z. (1) Suppose thatx ∈(Z/nZ)×, then
(xe)d =xtφ(n)+1 modn= (xφ(n))tx modn= 1tx mod n=x modn.
(2) Ifx 6∈(Z/nZ)×, thenx = 0 modporx = 0 modq.
Ifx = 0 mod p, then (xe)d = 0 mod pas well. If the same holds for mod qwe are done by the Chinese remainder theorem.
Otherwise,x 6= 0 mod q. Then, byFermat’s little theorem,
(xe)d =xed−1x =xt(p−1)(q−1)x = (xq−1)t(p−1)x=1t(p−1)x modq=x mod q.We conclude by the Chinese remainder theorem.
RSA cryptosystem
Encryption and decryption are inverse operations.
n=pq ⇒φ(n) = (p−1)(q−1)
We have thatde= 1 mod φ(n), i.e. de=tφ(n) + 1 for somet ∈Z. (1) Suppose thatx ∈(Z/nZ)×, then
(xe)d =xtφ(n)+1 modn= (xφ(n))tx modn= 1tx mod n=x modn.
(2) Ifx 6∈(Z/nZ)×, thenx = 0 modporx = 0 modq.
Ifx = 0 mod p, then (xe)d = 0 modp as well. If the same holds for mod qwe are done by the Chinese remainder theorem.
Otherwise,x 6= 0 mod q. Then, byFermat’s little theorem,
(xe)d =xed−1x =xt(p−1)(q−1)x = (xq−1)t(p−1)x=1t(p−1)x modq=x mod q.We conclude by the Chinese remainder theorem.
RSA cryptosystem
Encryption and decryption are inverse operations.
n=pq ⇒φ(n) = (p−1)(q−1)
We have thatde= 1 mod φ(n), i.e. de=tφ(n) + 1 for somet ∈Z. (1) Suppose thatx ∈(Z/nZ)×, then
(xe)d =xtφ(n)+1 modn= (xφ(n))tx modn= 1tx mod n=x modn.
(2) Ifx 6∈(Z/nZ)×, thenx = 0 modporx = 0 modq.
Ifx = 0 mod p, then (xe)d = 0 modp as well. If the same holds for mod qwe are done by the Chinese remainder theorem.
Otherwise,x 6= 0 mod q. Then, byFermat’s little theorem,
(xe)d =xed−1x =xt(p−1)(q−1)x = (xq−1)t(p−1)x=1t(p−1)x mod q=x mod q.We conclude by the Chinese remainder theorem.
Reminder: Cryptosystem: basic model for secrecy
Definition: Cryptosystem is a 5 -tuple (P,C,K,E,D) satisfying:
P is a finite set of possibleplaintexts;
Cis a finite set of possibleciphertexts;
K, thekeyspace, is a finite set of possiblekeys;
E ={Ek :k ∈ K}consists ofencryption functionsEk:P → C;
D={Dk :k ∈ K}consists ofdecryption functionsDk:C → P;
For alle∈ Kthere existsd ∈ Ksuch that for all plaintextsp∈ P we have:
Dd(Ee(p)) =p Symmetric cryptosystem: d =e
Public-key cryptosystem:d cannot be derived fromein a computationally feasible way
RSA cryptosystem parameters
Algorithm: RSA parameter generation
1. Generate two large primes,pandq, such thatp6=q 2. n←pq andφ(n)←(p−1)(q−1)
3. Choose a randomewith 1<e< φ(n) such thatgcd(e, φ(n)) = 1 4. d ←e−1 mod φ(n)
5. The public key is(n,e)and the private key is(p,q,d).
Reminder: Breaking encryption algorithms
•A practical method of determining thedecryption keyis found.
RSA: Find the private key(p,q,d), knowing the public key(n,e)
•A weakness in the encryption algorithm leads to aplaintext.
RSA: Invert the RSA encryption function
Reminder: Breaking encryption algorithms
•A practical method of determining thedecryption keyis found.
RSA: Find the private key(p,q,d), knowing the public key(n,e)
•A weakness in the encryption algorithm leads to aplaintext.
RSA: Invert the RSA encryption function
One-way function
A function that is easy to compute on every input, butalmost always hard to invert: apolynomial-timeinterceptor will fail to invert the function, except withnegligibleprobability.
Definition: Properties of an algorithm
An algorithm isdeterministicif the output only depends on the input.
Otherwise, it is calledprobabilisticorrandomized.
An algorithm is apolynomialalgorithm if the number of operations when executed by a multitape Turing machine isO(nk) for somek ∈N on input of sizen.
Turing machine Turing (1936)
Atapeis an infinite one-directional line of cells
Definition: thek-tape Turing machineis a tripleM = (A,Q, τ) satisfying:
Ais a finitealphabetthat thek tapes contain:A={,,0,1};
Qis a finite set ofstates:qstart,qhalt ∈Q;
τ:Q×Ak →Q×Ak−1× {L,S,R}k is thetransition functionofM.
1stinputtape,k −1worktapes,kthoutputtape theblanksymbol,thestartsymbol
qstart,qhalt thestartandhaltingstates Aregistercontains a current state
Atape headreads/write symbols, moves Left, Right or Stays
Turing machine
A 3-tape Turing machine [image: Arora & Barak’s book on Complexity]
Computing with Turing machine
Startconfiguration:
Input tape: , the input (afinitenon-blank string), the blank symbs k −1 tapes: , the blank symbols
All heads start at the left
Stepof computation: applyτ:Q×Ak →Q×Ak−1× {L,S,R}k Halting:M halts when it entersqhalt
T:N→Nis the running time
Definition: Mcomputesf:{0,1}∗ → {0,1}∗inT(n)-time
For every inputx ∈ {0,1}∗,Mhalts after at mostT(|x|) steps, with outputf(x).
Computing with Turing machine
Startconfiguration:
Input tape: , the input (afinitenon-blank string), the blank symbs k −1 tapes: , the blank symbols
All heads start at the left
Stepof computation: applyτ:Q×Ak →Q×Ak−1× {L,S,R}k Halting:M halts when it entersqhalt
T:N→Nis the running time
Definition: Mcomputesf:{0,1}∗ → {0,1}∗inT(n)-time
For every inputx ∈ {0,1}∗,Mhalts after at mostT(|x|) steps, with outputf(x).
Example: a Turing machine for the unary addition
Transition function for addition [image: geeksforgeeks.org]
Unary format using 0’s: 4 = 0 0 0 0 , 3= 0 0 0 B =andc,x ∈A,Q0=qstart,Q5=qhalt.
Turing machine: variants
deterministic: see above
non-deterministic: can be>1 move for a given state and tape probabilistic: a non-deterministic Turing machine which choses moves according to a probability distribution
Turing machine: decision
Lis alanguage, i.e. L⊆A∗ for a finite alphabetA
Definition: Mdecideswhether an inputx ∈L There is a deterministic Turing machine computing
χL(x) =
( 1 x ∈L 0 x 6∈L Lisdecidableorrecursive.
Lis computable byMor the decision problem is solvable byM
Turing machine: verification
Definition: Mverifieswhether an inputx ∈L
There is a deterministic Turing machine computingνLsuch that for eachgivencertificatec∈A∗,
νL(x,c) =
( 1 x ∈L
0 x 6∈Lorx ∈Landc is wrong Lisrecognizableorrecursively enumerable.
M verifies whethercis a valid proof ofx ∈L
Complexity classes
A problem instancex lies in the complexity class
P ifx is solvable by a polynomialdeterministicalgorithm.
BPP ifx is solvable by a polynomialprobabilisticalgorithm.
BQPifx is solvable by a polynomial deterministic algorithm on a quantumcomputer.
NP ifx isverifiableby a polynomial deterministic algorithm.
Known:P ⊆NP,P ⊆BPP, Factorisation and Discrete logarithm problem are inNP∩BQP.
Conjectures: P=BPP, Factorisation and Discrete logarithm problem are not inNP∩BPP.
Open Problem: Is therex ∈NP\BQP?
Complexity classes
A problem instancex lies in the complexity class
P ifx is solvable by a polynomialdeterministicalgorithm.
BPP ifx is solvable by a polynomialprobabilisticalgorithm.
BQPifx is solvable by a polynomial deterministic algorithm on a quantumcomputer.
NP ifx isverifiableby a polynomial deterministic algorithm.
Known:P ⊆NP,P ⊆BPP, Factorisation and Discrete logarithm problem are inNP∩BQP.
Conjectures: P=BPP, Factorisation and Discrete logarithm problem are not inNP∩BPP.
Open Problem: Is therex ∈NP\BQP?
One-way function
A function that is easy to compute on every input, butalmost always hard to invert: apolynomial-timeinterceptor will fail to invert the function, except withnegligibleprobability.
Definition: Negligible function
A functionf:N→Risnegligibleif for each positive polynomialp,
∃n0∈Nsuch that|f(n)|< p(n)1 for alln>n0
Example: f = 2−n Non-example: f =n−4
Notation: {0,1}∗ = set of all finite binary strings ({0,1}∗, concatenation) is a semi-group
One-way function
A function that is easy to compute on every input, butalmost always hard to invert: apolynomial-timeinterceptor will fail to invert the function, except withnegligibleprobability.
Definition: Negligible function
A functionf:N→Risnegligibleif for each positive polynomialp,
∃n0∈Nsuch that|f(n)|< p(n)1 for alln>n0
Example: f = 2−n Non-example: f =n−4 Notation: {0,1}∗ = set of all finite binary strings
({0,1}∗, concatenation) is a semi-group
One-way function
Definition: One-way function
A functionf:{0,1}∗ → {0,1}∗is aone-way functionif
1 for all inputx ∈ {0,1}∗there is a polynomial deterministic algorithm that outputsf(x);
2 for all polynomial probabilistic algorithmA:{0,1}∗ → {0,1}∗ there is a negligible function negl such that
Pr[A(f(x))∈f−1(f(x))]6negl(n),
where the probability is over the choice ofx according to the uniform distribution on{0,1}n, and the randomness ofA.
Hard to invert when the input is uniformly distributed. In particular, hard to invert in theaverage-case(not in the worst-case sense =NP-hard). Hard to invert forlong enough inputs.
One-way function
Definition: One-way function
A functionf:{0,1}∗ → {0,1}∗is aone-way functionif
1 for all inputx ∈ {0,1}∗there is a polynomial deterministic algorithm that outputsf(x);
2 for all polynomial probabilistic algorithmA:{0,1}∗ → {0,1}∗ there is a negligible function negl such that
Pr[A(f(x))∈f−1(f(x))]6negl(n),
where the probability is over the choice ofx according to the uniform distribution on{0,1}n, and the randomness ofA.
Hard to invert when the input is uniformly distributed. In particular, hard to invert in theaverage-case(not in the worst-case sense =NP-hard).
Hard to invert forlong enough inputs.
One-way function
We are interested in existence of injectivetrapdoorone-way functions, i.e. those easy to invert with the knowledge of a trapdoor (e.g. with a private-key).
Open problem: Do one-way functions exist?
Open problem: Is breaking RSA as hard as factoring integers?
One-way function
We are interested in existence of injectivetrapdoorone-way functions, i.e. those easy to invert with the knowledge of a trapdoor (e.g. with a private-key).
Open problem: Do one-way functions exist?
Open problem: Is breaking RSA as hard as factoring integers?
One-way function
We are interested in existence of injectivetrapdoorone-way functions, i.e. those easy to invert with the knowledge of a trapdoor (e.g. with a private-key).
Open problem: Do one-way functions exist?
Open problem: Is breaking RSA as hard as factoring integers?
RSA keys vs Factoring
Theorem: RSA keys vs Factoring
If the Factoring is not in BPP, then the Asymmetry of RSA is not in BPP.
Asymmetryproblem = compute the private key from the public key Here: computed (and not, in additionpandq), knowing (n,e).
Theorem: One-way⇔Pseudorandom
The existence of one-way functions is aminimal assumptionthat is both necessary and sufficient for constructions ofpseudorandom generatorsand functions.
RSA keys vs Factoring
Theorem: RSA keys vs Factoring
If the Factoring is not in BPP, then the Asymmetry of RSA is not in BPP.
Asymmetryproblem = compute the private key from the public key Here: computed (and not, in additionpandq), knowing (n,e).
Theorem: One-way⇔Pseudorandom
The existence of one-way functions is aminimal assumptionthat is both necessary and sufficient for constructions ofpseudorandom generatorsand functions.
Cryptanalysis of RSA: Weakness of the RSA primitive
If the interceptor can factor the modulusnin polynomial-time, then the private key can be efficiently calculated.
Integer factorisation methods Trial division
Pollard’sp−1 method
Elliptic curve factoring method
Quadratic sieve and Number field sieve . . .
A 768-bit number factored, two years of computations in 2007-2009.
So, 512-bit keys are ‘sufficient’.
In practice, RSA keys are typically 1024- to2048-bits long.
Cryptanalysis of RSA: Factoring
Ifnis composite, then it has a prime factorp6√ n
Trial division
Exhaustive search over all successive primes until√ n.
Complexity of such attacks allow to derive lower bounds on RSA parameters (key size etc.)
Test questions
Question 6
What is the complexity of the RSA parameter generation?
Question 7
Letf be a one-way function. Isf(f(x)) necessarily a one-way function?
Question 8
What is the worst-case / average-case complexities of trial division?
Question 9
Design an algorithm computing the square root of a positive integer.
What about its complexity? What about its modular variant and its complexity?
Cryptanalysis of RSA: The RSA parameters
Attacks on the RSA function Loweord attack
Partiald exposure attack
Cryptanalysis of RSA: Implementation attacks
Side-channel attacks
Time analysis: a correlation betweeneand the runtime of the cryptographic operation (Solution: delay / blinding)
Power analysis: monitoring power consumption (Solution:
engineering)
Fault analysis: exploiting errors in cryptographic operations (Solution: verify withe)
. . .
Remainder: RSA cryptosystem parameters
Algorithm: RSA parameter generation
1. Generate two large primes,pandq, such thatp6=q 2. n←pq andφ(n)←(p−1)(q−1)
3. Choose arandomewith 1<e< φ(n) such thatgcd(e, φ(n)) = 1 4. d ←e−1 mod φ(n)
5. The public key is(n,e)and the private key is(p,q,d).
Randomness of the encryption key is to resist aninformed exhaustive plaintext search attack. This contrasts the symmetric key encryption.
Cryptanalysis of RSA: practice
Key choice
1024- to 2048-bits long
Strong primes vs Random primes
Multi-prime RSA
More than two primespandq, hence, primes are smaller for a bign, the encryption is faster.
Cryptanalysis of RSA: practice
Encoding of plaintext = Padding schemes
Plaintext is preprocessed using a probabilistic encoding: same plaintext with the sameegives a different ciphertext.
Goal: resist to theinformed exhaustive plaintext search attack.
Definition: Hash function
A one-way functionh:{0,1}∗ → {0,1}k for somek ∈N. Hash: data of arbitrary size is mapped to data of fixed size.
Optimal asymmetric encryption padding (OAEP)
A simplified variant: ignoring the lengths of input / outputs.
Given: x and (n,e), two hashesh1andh2, and arandomnumberr. RSA-OAEP encoding
1. Hashr usingh1and XOR tox:
A=h1(r)⊕x 2. HashAusingh2and XOR tor:
B=h2(A)⊕r 3. Apply RSA to the concatenationAkB:
c= (AkB)e modn XOR = the exclusive disjunction =⊕= + mod 2
Optimal asymmetric encryption padding (OAEP)
Bob can decrypt without knowingr. RSA-OAEP decoding
1. Decryptc usingd, getAkB
2. HashAusingh2and XOR toB, getr:
h2(A)⊕B=h2(A)⊕(h2(A)⊕r) =r 3. Hashr usingh1and XOR toA, getx:
h1(r)⊕A=h1(r)⊕(h1(r)⊕x) =x Hashes: with trapdoor, given by a polynomial algorithm.
Discrete Logarithm problem
LetGbe a finite group,g ∈Gan element,hgi6Ga cyclic subgroup it generates,nits order.
Discrete Logarithm Problem = DLP
Givenn,gandy ∈ hgi, find the unique integerd, 06d 6n−1, such that
gd =y.
d := loggy is called thediscrete logarithm ofy to baseg.
Example: G= (Z/pZ)×,g is a primitive element modp,n=p−1 Aprimitiveelement modpis an element of (Z/pZ)×of orderp−1.
Cryptosystems based on the DLP: ElGamal cryptosystem
ElGamal’1985 cryptosystem is a cryptosystem based on the Discrete Logarithm problem in (Z/pZ)×
DLP assumption
1. The DLP in (Z/pZ)× is not in BPP.
2. The Factoring is not in BPP.
ElGamal cryptosystem: Parameter generation
ElGamal’1985 cryptosystem is a cryptosystem based on the Discrete Logarithm problem in (Z/pZ)×
Algorithm: ElGamal parameter generation 1. Generate a large primep.
2. Choose a primitive elementg ∈(Z/pZ)×. 3. Choose a randomd with 1<d <p−1.
4. y ←gd mod p
5. The public key is(p,g,y)and the private key isd.
ElGamal cryptosystem: informally
The encryption of a plaintextx is randomised using a random valuer chosen by Alice inZ/(p−1)Z:
There arep−1 ciphertextscthat are encryptions of the samex.
Randomization ofx:
the plaintextx is ‘masked’ by multiplying it byyr yieldingc2.
The valuegr is also transmitted giving partc1of the ciphertext (c1,c2). Bob, knowing the private keyd, can computeyr fromgr.
Then he can remove the ‘mask’ by dividingc2byyr to obtainx.
ElGamal cryptosystem: informally
The encryption of a plaintextx is randomised using a random valuer chosen by Alice inZ/(p−1)Z:
There arep−1 ciphertextscthat are encryptions of the samex. Randomization ofx:
the plaintextx is ‘masked’ by multiplying it byyr yieldingc2.
The valuegr is also transmitted giving partc1of the ciphertext (c1,c2). Bob, knowing the private keyd, can computeyr fromgr.
Then he can remove the ‘mask’ by dividingc2byyr to obtainx.
ElGamal cryptosystem: informally
The encryption of a plaintextx is randomised using a random valuer chosen by Alice inZ/(p−1)Z:
There arep−1 ciphertextscthat are encryptions of the samex. Randomization ofx:
the plaintextx is ‘masked’ by multiplying it byyr yieldingc2.
The valuegr is also transmitted giving partc1of the ciphertext (c1,c2).
Bob, knowing the private keyd, can computeyr fromgr. Then he can remove the ‘mask’ by dividingc2byyr to obtainx.
ElGamal cryptosystem: informally
The encryption of a plaintextx is randomised using a random valuer chosen by Alice inZ/(p−1)Z:
There arep−1 ciphertextscthat are encryptions of the samex. Randomization ofx:
the plaintextx is ‘masked’ by multiplying it byyr yieldingc2.
The valuegr is also transmitted giving partc1of the ciphertext (c1,c2).
Bob, knowing the private keyd, can computeyr fromgr. Then he can remove the ‘mask’ by dividingc2byyr to obtainx.
ElGamal cryptosystem
Definition: ElGamal cryptosystem
Letpbe a prime andga primitive element modp.
LetP = (Z/pZ)×,C = (Z/pZ)××(Z/pZ)×and define K={(p,g,d,y) : y =gd modp}.
Fork = (p,g,d,y),and for a secrete random numberr ∈Z/(p−1)Z, define
Ek(x;r) = (c1,c2), where
c1=gr mod p, and c2=xyr modp.
Forc1,c2∈(Z/pZ)×, define
Dk(c1,c2) =c2(c1d)−1 mod p Public key is (p,g,y) and private key isd.
ElGamal cryptosystem
Encryption and decryption are inverse operations
c2(cd1)−1=xyr·((gr)d)−1 mod p=x·(gd)r·((gr)d)−1 mod p=x mod p
Theorem: ElGamal keys vs DLP
If the DLP in (Z/pZ)× is not in BPP, then the Asymmetry of ElGamal is not in BPP.
ElGamal Cryptosystem: finite fields etc.
ElGamal is for an arbitrary finite groupG, we had (Z/pZ)×. Other groups:
1. The multiplicative group of the finite fieldFpk
2. The group of an elliptic curve defined over a finite field.
The group has to satisfy the DLP assumption.
Weierstrass equation
Letkbe a field.
Weierstrass equations
TheaffineWeierstrass equation:
E:y2+a1xy +a3y =x3+a2x2+a4x+a6,ai ∈k.
ThehomogeneousWeierstrass equation:
E∗:y2z+a1xyz+a3yz2=x3+a2x2z+a4xz2+a6z3,ai ∈k.
Thevanishing set:
E(k) ={(x :y :z)∈P2so thatx,y,z ∈kis a solution ofE∗} ⊆P2
Singular points and curves
Thedefining polynomial:
F∗:y2z+a1xyz+a3yz2−(x3+a2x2z+a4xz2+a6z3),ai ∈k.
Definition: Singular points and curves LetP= (x0:y0:z0)∈E(k).
1. Pis asingularpoint ofE if
∂F∗
∂x (x0,y0,z0) = ∂F∗
∂y (x0,y0,z0) = ∂F∗
∂z (x0,y0,z0) = 0.
2. E issingularif there is a singular pointP ∈E(k), otherwiseE is nonsingularorsmooth.
Example: (0 : 1 : 0) is the only point ofE at infinity, i.e. atz = 0. It has multiplicity 3 asE∗(x,y,0) :x3= 0.
It is not singular: ∂F∂z∗(0,1,0) = 16= 0.
Elliptic curves
Definition: Elliptic curve
E isellipticifE is smooth.
Normal forms
1. Ifchark6= 2 then inE substitutey 7→y −a1x+a2 3 obtaining y2=x3+a02x2+a04x+a06
2. Ifchark6= 2,3 then substitutex 7→x− 13a02,a02=a2+a421 obtaining y2=x3+ax +b
chark6= 2,3 :disc(x3+ax+b) =−16(4a3+ 27b2)
chark6= 2,y2=f(x) =x3+a0x2+a0x+a0 is singular⇐⇒discf = 0
Elliptic curves
Elliptic curves in normal form [image: Wikipedia]
Elliptic curve: The group structure (E (k), +)
ka field,kits algebraic closure
Group structure [image: Wikipedia]
Test questions
Question 10
Which of the following statements are true?
1 If the RSA cryptosystem is breakable, then large numbers can be factored.
2 Breaking the ECC cryptosystem is equivalent to solving the discrete logarithm problem.
3 There is no message expansion in the ECC cryptosystem.
Question 11
Why in practice public-key cryptosystems have longer key lengths than symmetric cryptosystems?
