15-349 introduction to computer and network security
DESCRIPTION
15-349 Introduction to Computer and Network Security. Iliano Cervesato 2 September 2008 – Public-key Encryption. Where we are. Course intro Cryptography Intro to crypto Modern crypto Symmetric encryption Asymmetric encryption Beyond encryption Cryptographic protocols - PowerPoint PPT PresentationTRANSCRIPT
15-349
Introduction to Computer and Network Security
Iliano Cervesato
2 September 2008 – Public-key Encryption
2
Where we are
Course intro Cryptography
Intro to crypto Modern crypto Symmetric encryption Asymmetric encryption Beyond encryption Cryptographic protocols Attacking protocols
Program/OS security & trust Networks security Beyond technology
3
Outline
Public-key cryptography – motivations The Merkle-Hellman encryption algorithm
The knapsack problem How Merkle-Hellman works Cryptoanalysis
Basic number theory Modular arithmetic Primality and inverses
The El Gamal encryption scheme The discrete logarithm problem
RSA The factorization problem RSA cryptographic challenges
4
Asymmetric Encryption – Review
Dk (Ek(m)) = m
ED
MM
XX
kCleartext
Cleartext
CiphertextCiphertext
Public key
Decryption
box
Encryption
box
k-1
Private key
-1
Public data
k
5
Motivations
Can 2 keys be better than 1? How do we make data public?
Why bother?Key management problemAdded flexibility
E.g., digital signatures
6
Naïve Key Management
Principals A1, …, An want to talk
Each pair needs a key n(n-1)/2 keys
Keys must be established Physical exchange Secure channel …
A1
A2
A3A4
A5
7
Improved Solution
Centralized key-distribution center
n key pairs needed However
KDC must be trusted
KDC is single point of failure
Still n direct exchanges
KDC
A1
A2
A3A4
A5
k1
k2
k3
k4
k5
… if Ai wants to talk to Aj …
Ai KDC: “connect me to Aj”
KDC generates new key kij
KDC Ai: Eki(kij)
KDC Aj: Ekj(kij, “Ai wants to talk”)
Still naïve KDC online all the time
8
Public-Key Solution
Pair (ki, ki-1) for each Ai
ki’s are published Phonebook
Simple setup Ai generates (ki, ki
-1)
Ai publishes ki
… details later
Secure web sites would be impossible without https
A1
k-11
Ai
k-1i
Public data
A1 k1
…Ai ki
…
9
The Knapsack problem
Given objects of size s1, s2, … sn, is it possible to completely fill a knapsack of size s?
Is there binary vector v such that
i visi = s ? NP-complete
What if si+1 > j<i sj ? Easy: O(n) Super-increasing knapsack
Hmm, this feels like encryption material …
for (i=n; i > 0; i--) { if (s > si) s = s – si
}return (s == 0)
10
Merkle-Hellman Encryption
Pick a super-increasing sequence S = (s1,s2,…,sn) a prime p > sn 100-200 digits long a multiplier w
(S, w) is the private key
Compute hi = wsi mod p
H = (h1, h2, …, hn) is the public key
Encryption of binary m x = i himi
Attacker has to solve general knapsack in H – hard Decryption of x
Multiply x by w-1
Solve super-increasing knapsack problem in S – easy
11
Cryptanalysis of Merkel-Hellman
Scheme based on a special instance of knapsack problem modular knapsack generated from super-
increasing sequence Not as hard as general knapsack
If p is known If s1 can be found, all si can be found
Can deduce w and p from H Try successive values of w and observe where
whi rolls over Right w is where they all roll over at the same
time
12
Number Theory – Divisors
ZZ = {…, -1, 0, 1, …} + is commutative, associative and invertible w.r.t. 0 * is commutative, associative with identity 1
a|b if c. ac = b E.g., 3|6 E.g., 3|10
gcd(a, b) = largest d ZZs.t. d|a and d|b E.g. gcd(18,15) = 3
Modular arithmetic a = b mod n if c. an + c = b Zn = {0, …, n-1}
All operations modulo n Also a ring
Euclid’s algorithm
Given a > b r0 = b, r1 = a
ri-2 = qiri-1 + ri
When rn+1 = 0, set gcd(a,b) = rn
u,v. gcd(a,b) = ua + vb
ZZ is a ring
13
Number Theory – Prime numbers
p>1 prime if 1 and p are its only divisors E.g. 3, 5, 7, …
p and q are relatively prime if gcd(p,q) = 1 E.g. 4 and 5 are relative primes
There are infinitely many primes
14
Arithmetic Modulo a Prime
p prime number For us, at least 1024 bits (~ 300 digits)
ZZp = {0, 1, …, p-1} Addition and multiplication are modulo p Exponentiation is iterated multiplication x is the inverse of y 0 if xy = 1 mod p
All non-null elements of ZZp are invertible x-1 = xp-2 mod p We can solve linear
equations in ZZ*p
If ax = b mod p, then x = bap-2 mod p
ZZ*p = {1, …, p-1}
Contains all invertible elements of ZZp
ZZp = ZZ*p U {0}
Fermat’s little theorem
If a 0, then ap-1 = 1 mod p
ZZp is aGalois field
15
Computing in ZZp
Let n be the length of p Usually around 1024 bits
Addition in ZZp done in O(n) Multiplication is O(n2)
Clever (and practical) algorithms achieve O(n1.7) Same for inverse
xr mod p computed in O((log r) n2) Repeated squares
E.g.: g23 = g10111 = g . g2 . g4 . g16 (7 multiplications)
Addition chains Saves 20% in average (but shortest chain is NP-complete) g, g2, g3, g5, g10, g20, g23 (6 multiplications)
16
Complexity in ZZp
Easy problems Generating p Addition, multiplication, exponentiation Inversion, solving linear equations
Problems believed to be hard DL: Discrete logarithm
Given g and x ZZp, find r s.t. x = gr mod p DH: Diffie-Hellman
Given g, gr, gs ZZp, find grs mod p Note
DL implies DH Unknown if DH implies DL Best known attack on DL requires space and O(2n) time
17
Diffie-Hellman Key ExchangePublic data
p, gA B
•Choose random a1 a p-1
•send ga mod p
•Receive gb mod p
•(gb)a = gab mod p
•k = f(gab)
•Receive ga mod p
•Choose random b1 b p-1
•Send gb mod p
•(ga)b = gab mod p
•k = f(gab)
ga mod p
gb mod p
18
Diffie-Hellman Key Exchange [2]
Allows 2 principals to produce a shared secret Without secure channel or physical
exchange Without a key distribution center f is typically a hash function
Agreed upon in advance
However, no authentication Can be fixed with some infrastructure
Security relies on hardness of DH
19
El Gamal Encryption Scheme
Security rests on hardness of DL Criticisms
Transmitted message double of m Public data has to be managed Very slow (~10Kb/sec vs. 250Kb/s of DES)
Public data
A1 p1 ,g1,g11
…
Ai pi ,gi,gii
…
A B•Choose random a
•Send gBa,
gBBa m mod pB
•Receive gBa,
gBBa m mod pB
•(gBa)B = gB
Ba mod pB
•Compute gB-Ba mod pB
•gB-Ba gB
Ba m mod pB
= m
gBa, gB
Ba m mod pB
A wants to send
A B
secret m ZZpB to B
20
Arithmetic Modulo a Composite
n natural number For us, typically 1024 bits or ~ 300 digits Typically n = pq, with p and q primes
ZZn = {0, 1, …, n-1} x is inverse of y 0 if xy = 1 mod n x has inverse iff gcd(x,n) = 1
ux + vn = 1 by Euclid’s algorithm so x-1 = u Works also in ZZp where more efficient than x-1 = xp-2
We can solve linear equations in ZZn
ZZ*n = {x : gcd(x,n) = 1}
Contains all invertible elements of ZZn
21
Euler’s Totient Function
(n) is the number of positive integers relatively prime to n
(n) is the size of ZZ*n
If n = ipiei,
then (n) = ipiei-1(pi-1)
If n=pq,then (n) = (p-1)(q-1) = n – p – q – 1
a is invertible with inverse a(n)-1
Euler’s theorem
If a ZZ*n, then a(n) = 1 mod n
23
Computing in ZZn
Easy problemsGenerating pAddition, multiplication,
exponentiation Inversion, solving linear equations
Hard problemsFactoring
Given n, find p,q s.t. n = pq
24
The set-up of RSA
n = pq n is the product of 2 (large) primes
By Euler’s theorem, (n) = (p – 1)(q – 1)
Select e and d such that (me)d = m How? Pick e relative prime to (n)
E.g., a prime greater than (n) By Fermat’s theorem, compute d = e(n)-1
ed = 1 mod (n) ed = k(n) + 1 = k(p-1)(q-1) + 1 = k’(p-1) + 1
Now: mp-1 = 1 mod p mk’(n) = 1 mod p mk’(n)+1 = m mod p med = m mod p
25
RSA [Rivest,Shamir,Adelman ’76]
Security of RSA rests on Hard to factorize n = pq
Hard to compute (n) from n
Factoring implies RSA Unknown if RSA implies factoring
Public data
A1 n1 ,e1
…
Ai ni ,ei
…A B
•Send meB mod nB •Receive meB mod nB
•(meB)dB mod nB
= meBdB mod nB = mk(nB)+1 mod nB = (m(nB))k m mod nB
= (1)k m mod nB
= m mod nB
meB mod nB
A wants to sendsecret m ZZnB
to BpA,qA,dA pB,qB,dB
ni = piqi
eidi = 1 mod (ni)
26
Attacks on RSA
Small d for fast decryption But easy to crack if d < (n1/4)/3 [Wiener]
d should be at least 1080
Small e for fast encryption If m sent to more than e recipients, then m easily
extracted Popular e = 216 + 1
Same message should not be sent more than 216 + 1 times
Modify message (still dangerous)
Timing attacks Time to compute md mod n for many m can reveal d
Homomorphic properties of RSA If ci = mi
e mod n (i=1,2), then c1c2 = (m1m2)e mod n Easy chosen plaintext attack
Eliminated in standards based on RSA
27
RSA Cryptographic Challenges
Factoring given primes set as challenge by RSA Labs
http://www.rsa.com/rsalabs/– RSA-ddd: challenge in digits– RSA-bbb: challenge in bits
RSA-140: 1999 in 1 month RSA-155: 1999 in 4 months RSA-160: 2003 in 20 days RSA-200: 2005 in 18 months
Challenges no longer active
28
Key length
Public-key crypto has very long keys 1024, 2048, 4096 are common
Is it more secure than symmetric crypto? 56, 128, 192, 256
Key lengths don’t compare! 1024 80 bit 2048 112 bit 3072 128 bit 7680 192 bit 15,360 256 bit