Outline

• Diffie-Hellman
• Homework Problem
• Elliptic Curve Cryptography
• Uses for Public Key Crypto

Diffie-Hellman - Discrete Log Problem

• Invented by Williamson (GCHQ) and, independently, by D and H (Stanford)
• A key exchange algorithm
• Used to establish a shared symmetric key
• Not for encrypting or signing
• Based on discrete log problem:
  Given: `g`, `p`, and `g^k mod p`
  Find: exponent `k`

Diffie-Hellman - Key Exchange

• Let `p` be prime, let `g` be a generator (assume both known).
• For any `x in {1,2,...,p-1}` there is `n` such that `x = g^n mod p`
• Alice selects her private value `a`
• Bob selects his private value `b`
• Alice sends `g^a mod p` to Bob
• Bob sends `g^b mod p` to Alice
• Both compute shared secret, `g^(ab) mod p`
• Shared secret can be used as symmetric key.

Diffie-Hellman

• Suppose Bob and Alice use Diffie-Hellman to determine symmetric key `K = g^(ab) mod p`
• Trudy can see `g^a mod p` and `g^b mod p`.
  • But `g^a g^b mod p = g^(a+b) mod p ne g^(ab) mod p`
• If Trudy can find `a` or `b`, she gets key `K`
• If Trudy can solve discrete log problem, she can find `a` or `b`.

Subject to man-in-the-middle (MiM) attack

• Trudy shares secret `g^(at) mod p` with Alice
• Trudy shares secret `g^(bt) mod p` with Bob
• Alice and Bob don't know Trudy exists

DH and MiM

• How to prevent MiM attack?
  • Encrypt DH exchange with symmetric key
  • Encrypt DH exchange with public key
  • Sign DH values with private key
  • Other?
• At this point, DH may look pointless...
• ...but its not (more on this later)
• In any case, you MUST be aware of MiM attack on Diffie-Hellman

HW Problem

Problem 4.5 In class we showed if we encrypt `M` using RSA with the public key and then decrypt with the private key, we get the original message back. Give the analogous proof that RSA signature verification works. That is, if we encrypt with the private key and decrypt with the public key we get `M` back.

Answer:

• Given `S = M^d mod N` we must show:
  `M = S^e mod N = M^(de) mod N = M^(ed) mod N`
• To show the above equality, we again use Euler's Theorem which says:
  If `x` is relatively prime to `n` then `x^(phi(n)) = 1 mod n`.
• Since `ed = 1 mod (p - 1)(q - 1)`, by definition of mod, we have
  `ed = k(p - 1)(q - 1) + 1` for some `k`.
• Then `ed - 1 = k(p - 1)(q - 1) = k phi(N)`.
• So `M^(ed) = M^((ed - 1) + 1) = M times M^(ed - 1) = M times M^(k phi(N))`
  `M times (M^(phi(N)))^k mod N = M times 1^k mod N = M mod N`

Elliptic Curve Crypto (ECC)

• "Elliptic curve" is not a cryptosystem
• Elliptic curves are a different way to do the math in public key system
• There are elliptic curve versions of DH, RSA, etc.
• Elliptic curves may be more efficient
  • Fewer bits needed for same security
  • But the operations are more complex

What is an Elliptic Curve?

• An elliptic curve E is the graph of an equation of the form:
  `y^2 = x^3 + ax + b`
• Also, includes a "point at infinity"
• What do elliptic curves look like?
• See the next slide!

Elliptic Curve Picture

• Consider elliptic curve:
  `E: y^2 = x^3 - x + 1`
• If `P_1` and `P_2` are on `E`, we can define:
  `P_3 = P_1 + P_2`
  as shown in picture
• Point at infinity acts as a "zero" (handles addition for vertical lines)
• Addition is all we need

Points on Elliptic Curve

• We now look at elliptic curves mode some number.
• Consider `y^2 = x^3 + 2x + 3 (mod 5)`.
  `x = 0 => y^2 = 3 => mbox(no solution) (mod 5)`
  `x = 1 => y^2 = 6 = 1 => y = 1,4 (mod 5)`
  `x = 2 => y^2 = 15 = 0 => y = 0 (mod 5)`
  `x = 3 => y^2 = 36 = 1 => y = 1,4 (mod 5)`
  `x = 4 => y^2 = 75 = 0 => y = 0 (mod 5)`
  
• Then points on the elliptic curve are
  `(1,1) (1,4) (2,0) (3,1) (3,4) (4,0)`
  and the point at infinity:`infty`

Elliptic Curve Math

• Addition on `y^2 = x^3 + ax + b (mod p)`
  `P_1=(x_1, y_1), P_2=(x_2,y_2)`
  `P_1 + P_2 = P_3 = (x_3,y_3)` where
  `quad x_3 = m^2 - x_1 - x_2 (mod p)`
  `quad y_3 = m(x_1 - x_3) - y_1 (mod p)`
  And where is the slope of the line so equal to:
  `m = (y_2-y_1) times (x_2-x_1)^(-1) mod p`, if `P_1 ne P_2`
  `m = (3x_1^2+a) times (2y_1)^(-1) mod p, if `P1 = P2`
  Special cases: If `m` is infinite, `P_3 = infty`, and `infty + P = P` for all `P`.

Elliptic Curve Addition

• Consider `y^2 = x^3 + 2x + 3 (mod 5)`. Points on the curve are `(1,1) (1,4) (2,0) (3,1) (3,4) (4,0) and infty`
• What is `(1,4) + (3,1) = P_3 = (x_3,y_3)`?
  `m = (1-4) times (3-1)^(-1) = -3 times 2^(-1)`
  `quad = 2(3) = 6 = 1 (mod 5)`
  `x_3 = 1 - 1 - 3 = 2 (mod 5)`
  `y_3 = 1(1-2) - 4 = 0 (mod 5)`
  
• On this curve, `(1,4) + (3,1) = (2,0)`

ECC Diffie-Hellman

• Public: Elliptic curve, a modulus N, and point `(x,y)` on curve
• Private: Alice's `A` and Bob's `B` where `A` and `B` are numbers mod `N`.
• Alice sends Bob `A(x,y)`, Bob sends Alice `B(x,y)`.
• Alice computes `A(B(x,y))` (multiplying by a scalar is repeated addition of the point)
• Bob computes `B(A(x,y))`
• These are the same since `AB = BA`

ECC Diffie-Hellman

• Public: Curve `y^2 = x^3 + 7x + b (mod 37)` and point `(2,5) => b = 3`
• Alice's private: `A = 4`
• Bob's private: `B = 7`
• Alice sends Bob: `4(2,5) = (2,5) + (2,5) + (2,5) + (2,5) = (7,32)`
• Bob sends Alice: `7(2,5) = (18,35)`
• Alice computes: `4(18,35) = (22,1)`
• Bob computes: `7(7,32) = (22,1)`

Uses for Public Key Crypto

• Confidentiality
  • Transmitting data over insecure channel
  • Secure storage on insecure media
• Authentication (later)
• Digital signature provides integrity and non-repudiation
  • No non-repudiation with symmetric keys

Non-non-repudiation

• Alice orders 100 shares of stock from Bob
• Alice computes MAC using symmetric key
• Stock drops, Alice claims she did not order
• Can Bob prove that Alice placed the order?
• No! Since Bob also knows the symmetric key, he could have forged message
• Problem: Bob knows Alice placed the order, but he can't prove it

Non-repudiation

• Alice orders 100 shares of stock from Bob
• Alice signs order with her private key
• Stock drops, Alice claims she did not order
• Can Bob prove that Alice placed the order?
• Yes! Only someone with Alice's private key could have signed the order
• This assumes Alice's private key is not stolen (revocation problem)

Public Key Notation

• Sign message M with Alice's private key: `[M]_(Alice)`
• Encrypt message M with Alice's public key: `{M}_(Alice)`
• Then
  `{[M]_(Alice)}_(Alice) = M`
  `[{M}_(Alice)]_(Alice) = M`