Lecture 1: Introduction to Public key cryptography

Thomas Johansson

T. Johansson (Lund University) 1 / 44

Key distribution

Symmetric key cryptography: Alice and Bob share a common secret

key.
Some means of distributing a copy of the secret key
physical distribution.

T. Johansson (Lund University) 2 / 44

Network example

Assume that n users are connected in a network and any two of them
may want to communicate
This would require each user to securely store n 1 different
symmetric keys (one for each other user), resulting in a total of
n(n 1)/2 keys.
If the network is connecting 2000 university students, then there will
be roughly 2 million different keys.
A huge key management problem with questions like; How do you add
add a new user to the system? What if a users key is compromised?
How long should a key be considered valid and how should we refresh
them?

T. Johansson (Lund University) 3 / 44

Key distribution

A better solution to the key distribution problem is obtained if we use

symmetric key distribution protocols.
A trusted third party (TTP). Each user has a unique secret key shared
with the TTP.
When two users would like to communicate, they establish a shared
secret key, usually called a session key, by interacting with the TTP.
There are still drawbacks that can be serious problems in certain
situations. For example, we need access and trust to a TTP and we
still need to distribute one key shared with the TTP for each user.

T. Johansson (Lund University) 4 / 44

Public-key cryptography

an extremely elegant solution...

We assume two different keys, one for encryption of a plaintext

message and another for decryption of a ciphertext message.
Allow the encryption key to be public!
Anyone with access to the public encryption key to send an encrypted
plaintext to the receiver.

T. Johansson (Lund University) 5 / 44

One-way functions and trapdoor one-way functions

Informal definition.
Definition
A one-way function f (x) is a function from a set X to a set Y such that
f (x) is easy to compute for all x X , but for essentially all elements
y Y it is computationally infeasible to find any x X such that
f (x) = y.

easy and computationally infeasible

essentially all elements

T. Johansson (Lund University) 6 / 44

Example

X = Y = Z29 and consider f : X 7 Y described by

f (x) = 2x mod 29.

a) Roughly, how many operations do you need need to calculate f (5) = 25 ?

Calculate 22 = 2 2 = 4, then 24 = 4 4 = 16 and finally multiplying with
2, i.e., 25 = 16 2 = 3. This procedure required 3 multiplications.

T. Johansson (Lund University) 7 / 44

Example

b) Roughly, how many operations do you need need to find an x X such

that f (x) = 5?
One way would be to calculate 21 = 2, 22 = 4, 23 = 8, . . . until we reach
2x = 5. We find . . . , 222 = 5 and this procedure resulted in 21
multiplications.

T. Johansson (Lund University) 8 / 44

 Example 2

A function that looks like a one-way functions is the function f : Zn 7 Zn ,

with
f (x) = x3 mod n,
where n is the number
n = 27997833911221327870829467638722601621070446786955428537560009929326128400107609345671052955360
18223519109513657886371059544820065767750985805576135790987349501441788631789462951872378692218

T. Johansson (Lund University) 9 / 44

Trapdoor one-way function

Definition
A trapdoor one-way function f (x) is a one-way function f : X 7 Y such
that if one knows some specific information T , called the trapdoor
information, then f (x) is computationally easy to invert f , i.e., for any
y Y it is easy to find a x X such that f (x) = y. For anyone without
knowledge of the trapdoor information T , f (x) is a one-way function.

T. Johansson (Lund University) 10 / 44

Example 2 again

The function f (x) = x3 mod n we had before is a trapdoor one-way

function.
We said that the function looked like a one-way function. However,
there is some secret information about this number that can be used.
The number n is in fact the product of two large prime numbers. The
trapdoor information T is in this case these two prime numbers.
Knowing them, you can easily invert the f function.

T. Johansson (Lund University) 11 / 44

Example 2 again

The RSA-200 number n above was factored in 2003 and the factors are
3532461934402770121272604978198464368671197400197625023649303468776121253679423200058547956528088

and
7925869954478333033347085841480059687737975857364219960734330341455767872818152135381409304740185

It took time equivalent to more than 55 years on a single modern PC to

factor this number.

T. Johansson (Lund University) 12 / 44

Public-key encryption scheme

Definition
A public-key encryption scheme is a set of encryption transformations
{Ee : e K} and a set of decryption transformations {Dd : d K}. For
each e K there is a corresponding d K such that Dd (Ee (M )) = M ,
M . Furthermore, after choosing such a pair (e, d), the public key e (or the
public parameter) is made public, while the associated secret key d is kept
secret. For the scheme to be secure, it must be computationally infeasible
to compute d as well as computing Ee1 (C), knowing the public value e.

constructed through a set of trapdoor one-way functions {fi (x)}.

T. Johansson (Lund University) 13 / 44

Complexity

The concepts brought forward in this section can only be realized

under assumptions of computational limitations.
We can never have unconditional security in a public-key cryptosystem.
Some assumption is required to be true for the scheme to be secure.
We assume that the opponent cannot solve a certain (computationally
difficult but solvable) problem. For example, factor a given very large
number.

T. Johansson (Lund University) 14 / 44

he RSA public-key encryption scheme

Definition
The RSA public-key encryption scheme works as follows. Let n = pq,
where p and q are two large primes. Let M = C = Zn . Pick a number e
relatively prime to (n) and calculate a number d such that
ed = 1 mod (n). The public key is the two numbers (n, e) and the
(public) encryption transformation E(M ) is

E(M ) = M e mod n.

The secret key is the number d (as well as p, q and (n)) and the secret
decryption transformation D(C) is

D(C) = C d mod n.

T. Johansson (Lund University) 15 / 44

Verify that decrypting a ciphertext returns the encrypted plaintext.

D(C) = C d = (M e )d = M ed mod n.

Now we note that ed = 1 mod (n), which means that we can write

ed = 1 + t (n),

for some integer t. S we can continue

D(C) = M ed = M (1+t(n)) = M M t(n) mod n.

From Eulers formula we know that x(n) = 1 for any x Zn . So assuming

that M is invertible we have

D(C) = M M t(n) = M 1 mod n.

T. Johansson (Lund University) 16 / 44

Example

Let p = 47 and q = 167 be two primes. Their product is n = pq = 7849.

Compute (n) = (p 1)(q 1) = 7636. Next, we must choose a value e
such that gcd(e, (n)) = 1. We can check that e = 25 is such a value.
When gcd(e, (n)) = 1 we know that e = 25 has a multiplicative inverse in
Z(n) . We use Euclidean algorithm and Bezouts lemma to find the inverse
d = 2749, i.e.,
e d = 25 2749 = 1 mod 7636.

We publish our public key (n, e) = (7849, 25).

T. Johansson (Lund University) 17 / 44

Example

Anyone with access to our public key can now send us an encrypted
message M Z7849 , by calculating

C = M e mod n.

Alice sends message M = 2728. She then computes

C = 272825 = 2401 mod 7849.

When Bob receives the ciphertext C, he computes

M = C d = 24012749 mod n

and, as by magic, M = 24012749 = 2728 mod n so he recover the correct

message.

T. Johansson (Lund University) 18 / 44

Security of the RSA cryptosystem

If we can factor n then we can compute (n) and d.

RSA relies on the factoring problem.
This does not mean that breaking RSA is equivalent to solving a
factorization problem. It is not known whether RSA can be broken without
factoring n.

T. Johansson (Lund University) 19 / 44

Implementation

Examine the implementation of the RSA operation, i.e., computing

M e mod n.

We need L = dlog2 ne bits to store a value in Zn .

A good idea to reduce modulo n as soon as one receives an intermediate
value outside the interval [0, n 1].

T. Johansson (Lund University) 20 / 44

Example

Calculating 27283 mod 7849 is done by first computing

27282 = 7441984,

then computing
7441984 mod 7849 = 1132.
Continuing,
1132 2728 = 3088096
and finally
3088096 mod 7849 = 3439.
So 27283 mod 7849 = 3439.

T. Johansson (Lund University) 21 / 44

Exponentiation

How can we do exponentiation in a fast way, i.e., computing M e mod n.

The square and multiply algorithm:
First rewrite e as a sum of powers of 2, i.e.,

e = e0 + e1 2 + e2 22 + + eL1 2L1 ,

where ei {0, 1}, 0 i L 1. We then perform L 1 squarings of M ,

computing the values

M 2 , M 4 = (M 2 )2 , M 8 = (M 4 )2 , . . . ,

in Zn . Finally we perform at most L 1 multiplications by computing M e

as
L1
M e = M e0 (M 2 )e1 (M 4 )e2 (M 2 )eL1 .

T. Johansson (Lund University) 22 / 44

Example

Compute 272825 in Zn using the square and multiply algorithm.

We rewrite 25 as 25 = 16 + 8 + 1 and get

272825 = 2728 27288 272816 .

Performing a number of squarings we get

27282 = 1132, 27284 = (1132)2 = 2037, 27288 = (2037)2 = 5097,

272816 = (5097)2 = 7068.

Performing the multiplications we get

272825 = 272816+8+1 = 2728 5097 7068 = 2401.

T. Johansson (Lund University) 23 / 44

Primality testing

How to check whether a given number m is a prime or not?

Naive approach: test by trial division, i.e., we check if x|m for all integers

x, where 2 x m.

The problem is that if m is a 1024 bit number then m is of size 512 bits
and 2512 tests is not possible.

T. Johansson (Lund University) 24 / 44

Probabilistic algorithms for testing primality.

Fermats Little Theorem states that

am1 = 1 mod m,

if m is a prime and a such that 1 a m 1.

When m is not a prime we cannot really know what we will receive when
computing am1 .
But if am1 6= 1 mod m we know for certain that m is not a prime number.

T. Johansson (Lund University) 25 / 44

Algorithm

while (k not big enough) {

1. Select a random a and compute A = am1 .
2. If A 6= 1 we know that m is composite and we end.
3. k = k + 1
}
Assume m prime.

T. Johansson (Lund University) 26 / 44

Performance

The error probability after repeating the test k time would then be less
than 1/2k .
A composite m such that am1 = 1 mod m is said to be a pseudo-prime
to the base a.
If a composite m is such that it is a pseudo-prime for every base a with
gcd(a, m) = 1, the the number is called a Carmichael number.
The smallest Carmichael number is 561.

T. Johansson (Lund University) 27 / 44

Miller-Rabin test:

Randomly choose a base a.

Write m 1 = 2b q, where q is odd.
c
If aq = 1 mod m or a2 q = 1 mod m for any c < b then return m
probably prime and go back and choose a new base, otherwise return
m definitely not prime.

One can prove that P (m probably prime|m not prime) < 1/4.

T. Johansson (Lund University) 28 / 44

Factoring

The difficulty of factoring ?

Some algorithms apply to numbers of special form.
Others are general, i.e., that they can factor any number.

T. Johansson (Lund University) 29 / 44

Pollards (p 1)-method
Let n = pq and let p 1 factor as

p 1 = q1 q2 qk ,

where each qi is a prime power.

Condition: each qi < B, where B is a predetermined bound.
Algorithm:
Compute a = 2B! mod n and compute the unknown prime p as

p = gcd(a 1, n).

T. Johansson (Lund University) 30 / 44

Pollards (p 1)-method

Assuming that every unknown prime power qi < B, we have

(p 1)|B!.

We compute a = 2B! mod n. Now let a0 = 2B! mod p. Since p|n we must
have a mod p = a0 . Fermats little theorem states that

2p1 = 1 mod p

and since (p 1)|B! we also have a0 = 1 mod p leading to a = 1 mod p.

So p|(a 1) and since p|n we have p = gcd(a 1, n).

T. Johansson (Lund University) 31 / 44

Pollards: Important conclusion

The primes p and q must then be chosen such that p 1 and q 1 each
contains a large prime in their factorisation.
A usual approach is to generate a random bprime p1 and then test whether
p = 2p1 + 1 is a prime number. If so, we choose p.

T. Johansson (Lund University) 32 / 44

Modern factoring algorithms

Quadratic sieve, Number field sieve, elliptic curve factorization, Pollards

rho algorithm method,...
See project 1.

T. Johansson (Lund University) 33 / 44

The computational complexity of factoring

We often use the function

LN (, ) = exp(( + o(1)(log N ) (log log N )1 .

An algorithm with complexity O(LN (, )) for 0 < < 1 is said to

have sub-exponential behaviour.
Number Field Sieve: This is currently the most successful method for
numbers with more than 100 decimal digits. It can factor numbers of
the size of 2512 and has complexity LN (1/3, 1.923).
It is recommended that one takes N of size around 1024 bits to ensure
medium-term security. For long-term security one would need to take
a size of over 2048 bits.

T. Johansson (Lund University) 34 / 44

Public Key Cryptography

Some basic cryptographic primitives:

Public key encryption: A message is encrypted with a recipients

public key and cannot be decrypted by anyone except the recipient
possessing the private key.
Digital signatures: A message signed with a senders private key can
be verified by anyone who has access to the senders public key,
thereby proving that the sender signed it and that the message has not
been tampered with (authenticity and nonrepudiation).
Key exchange: is a cryptographic protocol that allows two parties
that have no prior knowledge of each other to jointly establish a
shared secret key.

T. Johansson (Lund University) 35 / 44

Public Key Cryptography

A major problem is linking a public key to an entity or principal,

The main tool in use today is the digital certificate. A special trusted
third party, called a certificate authority, or CA, is used to vouch for
the validity of the public keys.

T. Johansson (Lund University) 36 / 44

Public Key Cryptography

A CA based system works as follows:

All users have a trusted copy of the public key of the CA. For example,
embedded in your browser when you buy your computer.
The CA sign data strings containing the following information

(Alice, ..., Alices public key, CAs signature).

This data string, and the associated signature is called a digital

certificate. The CA will only sign this data if it truly believes that the
public key really does belong to Alice.
When Alice now sends you her public key, contained in a digital
certificate, you now trust that the public key is that of Alice, since you
trust the CA and you checked the signature.

T. Johansson (Lund University) 37 / 44

The Discrete Logarithm Problem

Let (G, ) be an abelian group.

Discrete Logarithm Problem: Given g, h G, find an x (if it exists)
such that g x = h.
The difficulty of this problem depends on the group G
Very easy: polynomial time algorithm, e.g. (ZN , +)
Hard: sub-exponential time algorithm, e.g. (Fp ).
Very hard: exponential time algorithm, e.g. elliptic curve groups.

T. Johansson (Lund University) 38 / 44

Diffie Hellman Key Exchange

allows two parties to agree a secret key over an insecure channel without
having met before.
G = Fp and g Fp
The basic message flows for the Diffie Hellman protocol

Alice selects secret a, Bob selects secret b.

Alice sends A = g a to Bob. Bob sends B = g b to Alice.
Alice computes K = B a . Bob computes K = Ab . Note
B a = Ab = g ab = K.

Man in the middle attack

T. Johansson (Lund University) 39 / 44

Example DH key exchange

Domain parameters be given by p = 2147483659 and g = 2.

Alice Bob
a = 12345 b = 654323
A = g a = 428647416 A = 428647416
B = 450904856 B = g b = 450904856
Bob computes Ab = 428647416654323 (modp) = 1333327162, Alice
computes B a = 45090485612345 (modp), = 1333327162.

T. Johansson (Lund University) 40 / 44

Digital Signatures

The basic idea behind public key signatures is as follows:

Message + Alices private key = Signature,
Message + Signature + Alices public key = YES/NO.
(signature scheme with appendix)
three important security properties:
message integrity the message has not been altered in transit,
message origin the message was sent by Alice,
non-repudiation Alice cannot claim she did not send the message.

T. Johansson (Lund University) 41 / 44

Cryptographic hash functions - more later

A cryptographic hash function h is a function which takes arbitrary

length bit strings as input and produces a fixed length bit string as
output, the hash value.
Preimage Resistant: It should be hard to find a message with a given
hash value.
Second Preimage Resistant: Given one message it should be hard to
find another message with the same hash value.
Collision Resistant: It should be hard to find two messages with the
same hash value.

T. Johansson (Lund University) 42 / 44

Signatures with RSA

Message m for signing, we first compute h(m) and then apply the RSA
signing transform to h(m), i.e.

s = h(m)d mod N.

Transmit (m, s).

Verifying: Recover h, i.e.

h0 = se mod N.

Then compute h(m) from m and check whether h0 = h(m).

If they agree accept the signature as valid, otherwise reject.

T. Johansson (Lund University) 43 / 44

Security assumptions for Signatures

Key-only attack: Eve knows the public key and verification

algorithm.
Known message attack: Eve knows also a list of signed messages.
Chosen message attack: Eve gets a list of messages of her choice
signed.

Adversarial goals:

Total break: Find the secret signing key.

Selective forgery: Try to get a valid signature on a given message
not signed before.
Existential forgery: Try to get a valid signature on a any message
not signed before.

T. Johansson (Lund University) 44 / 44