a method for obtaining digital signatures and public-key cryptosystems r.l rivest, a. shamir, l....
TRANSCRIPT
A Method for Obtaining Digital Signatures and Public-key
Cryptosystems
R.L Rivest, A. Shamir, L. Adleman
Presented by Wesley Varela
OUTLINE
• Introduction
• The Basic Idea of RSA
• A Small Example (Simple)
• The Big Hairy Math Stuff
• A Better Example
• Known Weaknesses
• Public vs. Private Key Cryptosystems– Private Key
• Encryption and decryption keys can be derived from each other
• The key must be securely delivered to the person(s) who need to decrypt or encrypt messages
• Person(s) receiving the key must be trustworthy• More useable in single-user enviroments
– Public Key• More secure and easier to use• Encryption keys are publicly available • Digital signatures
RSA – The Basic Idea• Properties of RSA
– Encrypting a plaintext message M gives the ciphertext. Deciphering the ciphertext returns M.
D(E(M)) = M– The inverse is also true (digital signatures).
E(D(M)) = M– The encryption key (E) and decryption key (D)
are easily computed– E is publicly available but does not compromise
the cryptosystem.
Basic Definitions you can’t live without
• Trap-door one-way functions: easily computed in one direction but not the other, unless the decryption key is known
• Trap-door one-way permutations: Every message is ciphertext from some message and every ciphertext is a permissible message.
A Small Example
• Assume we have two people– Oliver
• Encryption Key Eo
• Decryption Key Do
– Katie• Encryption Key Ek
• Decryption Key Dk
• Oliver sends a message to Katie– Ek(M) = ciphertext
• Sends the ciphertext to Katie
• Katie receives the message and response– Dk(C) = plaintext– Eo(M2) = ciphertext
• Sends the ciphertext to Oliver
• Oliver receives the return ciphertext– Do(C2) = plaintext
Signatures• Oliver sends a message to Katie
– Do(M) = Signature
• Ek(Signature) = Ciphertext
• Sends the ciphertext to Katie
• Katie receives the message– Dk(C) = Signature
– Eo(Signature) = plaintext
– Has the pair (Signature, Plaintext)
Big Hairy Math Stuff
• Eo = (E(e, m) mod n ) + some algorithm
• Do = (D(d, m) mod n ) + some algorithm
• d and e are exponents.
• m is the message
• n is the product of 2 very large primes
Why Use Primes for p & q?
• They have no non-trivial factors• It makes it even harder to find Ф(n)• No algorithm to easily factor large
numbers• Everything that’s cool has the word prime
attached to it. – Prime rib– Prime time– Optimus Prime
– Prime Directive
Eulers totient function Ф
• Ф(n) - gives the number of positive integers less then n which are relatively prime to n.
Selecting “d”
• d should be relatively prime to Ф(n)
• Select d to be a prime larger than max(p,q)
“since d is relatively prime to Ф(n), it has a multiplicative inverse e in the ring of integers modulo Ф(n)”
Multiplicative Inverse Example
• Two relatively prime numbers 5 and 7 1 * 5 = 5 ≡ 5 (Mod 7)
2 * 5 = 10 ≡ 3 (Mod 7) 3 * 5 = 15 ≡ 1 (Mod 7) 4 * 5 = 20 ≡ 6 (Mod 7) 5 * 5 = 25 ≡ 4 (Mod 7) 6 * 5 = 30 ≡ 2 (Mod 7) 7 * 5 = 35 ≡ 0 (Mod 7)
Z7 is a cyclic group
“since d is relatively prime to Ф(n), it has a multiplicative inverse e in the ring of integers modulo Ф(n)”
e*d ≡ 1 (mod Ф(n))
MФ(n) ≡ 1 (mod n)
(Me)d = Med = MkФ(n) +1
= MkФ(n) * M1
= (MФ(n))k * M≡ 1K * M
= M
ALL about M
• Choosing how to represent your message M is very important.
• One method (ASCII)
• hello world 1101000 1100101 1101100 1101100 1101111 0100000 1110111 1101111 1110010 1101100 1100100
• m < n
Computing Me mod n• Represent e as a binary number
• ekek-1…e1e0 = 5 = 101
C = 1
For(i=k, i>=0; i--){
C = (C*C) mod n
if(ei = 1)
C = (C * M) mod n
}
• At most 2*log2(e) + 2*log2(e)
Primarily Testing
• How to find a really big prime– Randomly generate a large odd number b of
the size you want– Use Solovay and Strassen’s probabilistic
algorithm• Select some number a from {0, …, b-1}• gcd(a,b) = 1 and J(a,b) = a(b-1)/2
– If false b is composite. – If true b is prime with a probability of at least ½
Faster Computers?Pick a bigger prime.
“RSA Laboratories currently recommends key sizes of 1024 bits for corporate use and 2048 bits for extremely valuable keys like the root key pair used by a certifying authority. Several recent standards specify a 1024-bit minimum for corporate use. Less valuable information may well be encrypted using a
768-bit key”
“512-bit number RSA-155 was factored in seven months during 1999 ”
Known Weaknesses
• d<N.5 Lattice Attack
• Low public exponent (Coppersmith)
• Broadcast Attack (Hastad)
• Related message Attack (Franklin-Reiter)