Public Key Cryptography

We are done for now talking about asymmetric cryptography -- where we encrypt and decrypt using the same key.
We are now going to consider the case where we use two keys -- the sender uses key one to encrypt, and the recipient uses a different one to decrypt.
This is known as public key cryptography.
It was first developed at GCHQ (like the NSA) in Britain by Ellis, Cocks, and Williamson in 1973, but was classified. Independently, and in a non-classified way so that the world knew about it, it was described by Diffie and Hellmann in a 1976 paper.
Public key cryptography is based on having a "trap-door", one-way, function.
- One way means easy to compute in one direction, but hard to compute in other direction
- For example, given `p` and `q`, the product `N = pq` is easy to compute, but given `N`, it's hard to find `p` and `q`.
- A "Trap-door" (i.e., a door which someone on stage may know how to use, but the audience watching a play does not see) is used to create key pairs

Some uses of Public Key Cryptography

We remark here that in the public key setting the plaintext is often referred to as the message, and we will use the variable `M` when talking about messages.

Encryption/Decryption
- Suppose we encrypt `M` with Bob's public key.
- Bob's private key can decrypt to recover `M`
Digital Signature
- Sign by encrypting with your private key
- Anyone can verify signature by decrypting with public key
- Like a handwritten signature, but way better...

Quiz

Which of the following is true?

AES is a Feistel cipher.
DES is a Feistel cipher.
ECB mode is immune to cut-and-paste attacks.

Knapsack

The knapsack problem was one of the first proposals for a trapdoor function suitable for public key cryptography.
It serves as the basis of the Merkle-Hellman crypto system (1978).
It was shown to be insecure by Rivest, however, later systems related to Knapsack and subset-sum based on the shortest lattice vector problem (Ajtai-Dwork, 1997), have average-case to worst-case hardness reductions, and appear to be quite secure.
The knapsack problem is:
Given a set of `n` weights `W_0, W_1,...,W_(n-1)` and a sum `S`, is it possible to find `a_i in {0,1}` so that
`S = a_0W_0 + a_1W_1 +...+ a_(n-1)W_(n-1)`?
(technically, this is subset-sum problem)
As an example...
- Suppose the weights are: `(62,93,26,52,166,48,91,141)` and `S=302.
- The problem is then to find a subset of these numbers such that their sum is `S=302`.
- One solution is: `62+26+166+48=302`.
The (general) knapsack is NP-complete

Variants of Knapsack

The General knapsack (GK) problem is hard to solve
But superincreasing knapsack (SIK) is easy
In SIK, each weight is greater than the sum of all previous weights.
For example, suppose we had
Weights: (2, 3, 7, 14, 30, 57, 120, 251) and S=186.
We could work go from the largest to the smallest and see if we can add that weight without going over. If after reaching the smallest weight, we are less than the sum we know there is no choice that works, if we at some point, we get exactly the sum we are done.
For the above, we find 120+57+7+2=186.

Knapsack Cryptosystem

Generate superincreasing knapsack (SIK)
Convert SIK into general knapsack (GK)
Public Key: GK
Private Key: (SIK, conversion factor, n)

Knapsack Keys

Start with `(2,3,7,14,30,57,120,251)` as the SIK
Choose `m = 41` and `n = 491` (`m`, `n` relatively prime, `n` exceeds sum of elements in SIK)

Compute general knapsack:

2 x 41 mod 491 = 82
3 x 41 mod 491 = 123
7 x 41 mod 491 = 287
14 x 41 mod 491 = 83
30 x 41 mod 491 = 248
57 x 41 mod 491 = 373
120 x 41 mod 491 = 10
251 x 41 mod 491 = 471

General knapsack: `(82,123,287,83,248,373,10,471)`

Knapsack Cryptosystem

The private key is an SIK, the multiplicative inverse of `m mod n`, and `n`.
For example, `(2,3,7,14,30,57,120,251)` and `m^(-1) mod n = 41^(-1) mod 491 = 12`.
The public key is the GK made by the procedure of the last slide.
In this case, `(82,123,287,83,248,373,10,471)`.
To encrypt a binary string, we use a `1` in a bit position to select the corresponding element of the GK.
So encrypting `10010110`, yields `82 + 83 + 373 + 10 = 548`.
To decrypt, `548 times 12 = 193 mod 491`, and we are left to solve the easy SIK with S=193 to obtain the plaintext `10010110`.

Knapsack Weakness

Trapdoor: Convert SIK into general knapsack using modular arithmetic
One-way: General knapsack easy to encrypt, hard to solve; SIK easy to solve.
Unfortunately, this knapsack cryptosystem is insecure
It was broken in 1983 with Apple II computer
The attack uses lattice reduction
The GK produced by our procedure from the SIK was not general enough! i.e., was nowhere near as hard the worst-case NP-complete GK.
In fact, this special knapsack is easy to solve!

RSA

By Clifford Cocks (GCHQ), independently, Rivest, Shamir, and Adleman (MIT).
RSA is the gold standard in public key crypto
Let `p` and `q` be two large prime numbers
Let `N = pq` be the modulus
Choose `e` relatively prime to `(p-1)(q-1)`
Find `d` such that `ed = 1 mod (p-1)(q-1)` (by condition on `e`, `d` exists)
Public key is (N,e)
Private key is d

RSA Encryption/Decryption

The message `M` is treated as a number
To encrypt `M` we compute:
`C = M^e mod N`
To decrypt ciphertext `C` compute
`M = C^d mod N`
Recall that `e` and `N` are public
If Trudy can factor `N=pq`, she can use `e` to easily find `d` since `ed = 1 mod (p-1)(q-1)`
Factoring the modulus breaks RSA
Is factoring the only way to break RSA?

Does RSA Really Work?

Given `C = M^e mod N` we must show:
`M = C^d mod N = M^(ed) mod N`
The totient function `phi(n)` is the number of positive integers less than or equal to `n` that are relatively prime to `n`. So for a prime `p`, `phi(p) = p-1`. The totient function is multiplicative. i.e., `phi(mn) = phi(m)phi(n)`.
To show the above equality, we use Euler's Theorem which says:
If `x` is relatively prime to `n` then `x^(phi(n)) = 1 mod n`.
Since `ed = 1 mod (p - 1)(q - 1)`, by definition of mod, we have
`ed = k(p - 1)(q - 1) + 1` for some `k`.
Then `ed - 1 = k(p - 1)(q - 1) = k phi(N)`.
So `M^(ed) = M^((ed - 1) + 1) = M times M^(ed - 1) = M times M^(k phi(N))`
`M times (M^(phi(N)))^k mod N = M times 1^k mod N = M mod N`

Simple RSA Example

Select large primes `p = 11, q = 3`
Then `N = pq = 33 and (p - 1)(q - 1) = 20`
Choose `e = 3` (relatively prime to `20`)
We find that `d = 7` works for `d`
Public key: `(N, e) = (33, 3)`
Private key: `d = 7`

RSA Example - Encryption/Decryption

Public key: `(N, e) = (33, 3)`
Private key: `d = 7`
Suppose the message was: `M = 8`
Ciphertext `C` is computed as:
`C = M^e mod N = 8^3 = 512 = 17 mod 33`
Decrypt `C` to recover the message `M` by:
`M = C^d mod N = 17^7 = 410,338,673`
`12,434,505 times 33 + 8 = 8 mod 33`.

More Efficient RSA - Repeated Squaring

RSA relies on modular exponentiation by potentially big numbers.
One way to do do this is by repeated multiplication:
`5^20 mod 35 = 5 times mbox(twenty times) times 5 mod 35 = 95367431640625 = 25 mod 35`
If `k` is the power we are raising to, this takes `O(k)` even if do this space efficiently by taking mod at each step.
For RSA people talk about 512 bit, 1024 bit, or 2048 bit keys. So `k` could be of size at least `2^511`, so repeated multiplication would take longer than waiting for the end of the universe.
A better way is to use repeated squaring
This relies on the fact that `x^k mod N = (x^(k/2))^(2) mod N` if `k` is even and `x^k mod N = x(x^(k/2))^(2) mod N` if `k` is odd.
For example,
`20 = 10100 base 2`
`(1, 10, 101, 1010, 10100) = (1, 2, 5, 10, 20)`
Note that `2 = 1 times 2, 5 = 2 times 2 + 1, 10 = 2 times 5, 20 = 2 times 10`. So `5^1= 5 mod 35`
`5^2= (5^1)^2 = 5^2 = 25 mod 35`
`5^5= (5^2)^2 times 5^1 = 25^2 times 5 = 3125 = 10 mod 35`
`5^(10) = (5^5)^2 = 10^2 = 100 = 30 mod 35`
`5^(20) = (5^(10))^2 = 30^2 = 900 = 25 mod 35`
No huge numbers and its efficient! It now takes time `O(log k)`.

More Efficient RSA - Simple `e`

Use `e = 3` for all users (but not same `N` or `d`)
Public key operations only require 2 multiplies
Private key operations remain expensive
If `M < N^(1/3)` then `C = M^e = M^3` and cube root attack
For any `M`, if use `e=3` and encrypt with three different public keys to get `C_1`, `C_2`, `C_3`, cube root attack works (uses Chinese Remainder Theorem)
Can prevent cube root attack by padding message with random bits
Note: `e = 2^16 + 1` also used (better than `e = 3`, as more user's can be sent the same message before Chinese Remaindering kicks in).

Introduction to Public Key Cryptography

Outline

Public Key Cryptography

Some uses of Public Key Cryptography

Quiz

Knapsack

Variants of Knapsack

Knapsack Cryptosystem

Knapsack Keys

Knapsack Cryptosystem

Knapsack Weakness

RSA

RSA Encryption/Decryption

Does RSA Really Work?

Simple RSA Example

RSA Example - Encryption/Decryption

More Efficient RSA - Repeated Squaring

More Efficient RSA - Simple `e`