Improved PKC Provably Secure against Chosen Cipher text Attack

Transcription

1 Intrntonl Journl on Computtonl Scncs & Applctons (IJCSA) Vo3, No, Frury 203 Improv PKC Provly Scur gnst Chosn Cphr txt Attck Sushm Prhn Brnr Kumr Shrm 2 School of Stus n Mthmtcs, Pt Rv Shnkr Shukl Unvrsty, Rpur, Chhttsgrh sushprhn@gmlcom 2 School of Stus n Mthmtcs, Pt Rv Shnkr Shukl Unvrsty, Rpur, Chhttsgrh Shrmk07@gmlcom ABSTRACT A nw pulc ky cryptosystm s prsnt whch s s on Equvlnt-RSA tht s provly scur gnst ptv chosn cphr txt ttck (s fn y Rckoff [22]) KEYWORDS RSA Cryptosystm; Smntc scurty; Chosn cphr txt ttck; Aptv chosn cphr txt ttck; Mprm RSA; D-RSA; Equvlnt RSA prolm INTRODUCTION Pulc ky cryptosystms, n th sns of Dff-Hllmn [], prov pulc ccss to th ncrypton ky whl th crypton ky s kpt scrt y th rcpnt of th cphr txt Th lgrc structur n th form of morn mthmtcl tools provs consrl scurty n pulc ky cryptosystm, ut such systm s not yon th rch of ttckr Th clsscl vrson of most populr pulc ky cryptosystm RSA [23] s nthr smntclly scurs nor s t scur gnst ptv chosn chppr txt ttck Chosn Cphrtxt Scurty- To ssst th scurty of pulc ky cryptosystm gnst th Chosn Cphr txt Attck (CCA), th ssumpton s tht th cryptnlyst lso hs ccss to th crypton orcl Th cryptnlyst cn slct ny cphr txt, osrv th corrsponng plntxt Th cryptnlyst ms to fn out th scrt ky or ncrypt trgt cphrtxt A cryptosystm s s to scur gnst CCA f th cryptnlyst fls n ths ttck Nturl xtnson of CCA s, howvr th ptv chosn cphrtxt ttck It s fn y Rckoff Smon [22] A cryptosystm s s to scur gnst th Aptv Chosn Cphrtxt Attck (ACCA) f th cryptnlyst fls vn to otn ny prtl nformton out th plntxt rlvnt to th trgt cphrtxt On wy of mmunzng cryptosystm gnst ACCA s tht th ncrypton lgorthm shoul stroy th mthmtcl rltonshp twn th plntxt ts cphrtxt Morovr, th crypton lgorthm must sgn n such wy such tht t os not output th rsult, f th rsult os not stsfy prtrmn structur Ths wy, vry cphrtxt os not com goo/ccptl nput to th crypton orcl In othr wors, fnng n ccptl cphrtxt mpls tht th mssg s known to th vrsry (ths s known s th Plntxt-Awrnss []) Howvr, f th vrsry knows th mssg, h lrns nothng from cphrng th cphrtxt (, th chosn cphrtxt ttck mks no sns)snc, fnton of ACCA, svrl sgns of pkc r ntrouc wth clm to scur from ACCA Ths ppr rvws most of DOI : 052/jcs

2 Intrntonl Journl on Computtonl Scncs & Applctons (IJCSA) Vo3, No, Frury 203 thm uss most rcnt ncrypton schm gvn y Hossn Ghoos [8], n orr to propos ncrypton schm scur from ACC ACCA oth hvng mor _ctvly s compr to othrs To chv our gol w orgnz ths ppr s follows In scton 2, w frst gv rf rvw of prvous works W thn rvw th rsults chv y Pontchvl [3], snc th propos schm follows smlr structur In scton 3, w xpln th Equvlnt RSA (ERSA) [8] In scton 4, w scr th MPrm RSA mtho In scton 5, w show how to construct scur systms ccorng to sc schm of ERSA schm Fnlly, n scton 6 7, w conclu wth th scurty th ffcncy prformnc of th propos schms 2 RELATED WORK Nor Yung [20] hv construct pulc ky cryptosystm scur gnst CCA Ltr, Dolv Dwork Nor [2], Rckoff Smon [22] hv whch construct cryptosystms ws scur gnst ACCA Although ths schms wr provly scur ut ths wr vry nffcnt thrfor foun mprctcl Nxt, ttmpt to sgn n ffcnt pulc-ky cryptosystm scur gnst CCA ws m y Dmgr [0] In ths work two constructons, on s on ny trmnstc pulc ky systm th othr s on th ElGml pulc ky systm, hv n prsnt Howvr, thr s no proof of scurty n ths systm (n fct, th work ns wth n opn prolm; skng th rr to prov or sprov th ssumpton m n th ppr) Ths schm s scur gnst th lunchtm t-tck, ut s not scur gnst ACCA [25, 26] Zhng Srry [26] prsnt thr mthos for mmunzng pulc ky cryptosystms gnst ACCA In [9], Lm L hv shown tht, n som cryptosystms, Zhng-Srys mtho fls unr known plntxt ttcks Thy thn prsnt two schms tht r clm to scur gnst ACCA Howvr, oth schms wr susquntly rokn y Frnkl Yung [5] Bllr Rogwy [] prsnt th OAEP concpt, whch s hurstclly scur unr th rom orcl mol ( hsh functon plys th rol of rom orcl) Crmr Shoup [9] who pont out tht, lthough th scurty unr th rom orcl mol s vlul, t s not rll Thy prsnt nw pulc ky cryptosystm, whch s scur gnst ACCA unr str ntrctlty ssumptons Thr work ws th st sgn of pulc ky cryptosystms scur gnst ACCA Howvr, Pontchvl [3] rgu tht Crmr Shoups schm [9] rqurs mor thn four xponnttons for n ncrypton, prsnt nw schm s on th pnnt-rsa prolm Informlly, th pnnt-rsa prolm of [3] stts tht gvn m n n RSA systm, fn ( m +) Thr conjctur s tht, ths prolm s hr In orr to chv smntc scurty, thy hv fn nothr prolm cll th Dcsonl Dpnnt-RSA prolm Ths prolms stts tht, for romly chosn r, two prs ( m, r) ( m,( m + ) ) r nstngushl Thr conjctur s tht ths prolm s ntrctl whn s grtr thn 260 Bs on ths conjcturs, thy hv thn prsnt th followng schms: 8

3 Intrntonl Journl on Computtonl Scncs & Applctons (IJCSA) Vo3, No, Frury Th DRSA- Encrypton Schm Ths s strngthn vrson of th DRSA ncrypton schm for ttnng scurty gnst l ACCA Lt l scurty prmtr, h : Z n Z n {0, } hsh functon Th cphrtxt of mssg m s trpl (A, B, H), such tht: A = k ; B = m ( k + ) H = h(m, k) Hr, k s rom vlu To crypt th cphrtxt, th rcvr computs: k = A (mo n) m = B /( k + ) (mon) thn chcks for qulty H = h (m, k) If th qulty s sts f, thn m s ccpt to th mssg; othrws, th cphrtxt s rjct Ths schm s to scur gnst ACCA, snc th prolty of gnrtng n ccptl cphrtxt, wthout knowng th mssg, s nglgl 22 Th DRSA-2 Encrypton Schm Ths s smlr to DRSA-, ut th rsultng schm s quvlnt to th computtonl prolm rthr thn to th csonl on Lt k th sz of th plntxt, k2 scurty prmtr, lt k : Z {0,} k k2 h n h :{0,} {0, } 2 Zn two hsh functons Th cphrtxt of mssg m s trpl (A, B, H), such tht: A = k ; B = m h (( k + ) mo n) H = h2 ( m, k) To crypt th cphrtxt, th rcvr computs: k = A (mo n) m = B / h (( k + ) mon) thn chcks for qulty H = h2 ( m, k) Thy hv shown tht ths schm s lso non-mlll, thus scur gnst ACCA 3 ERSA Encrypton Schm Hossn Ghoos [8] sgn pulc ky cryptosystms whch ws scur gnst chosn cphrtxt ttcks Th mn vntg of gvn schms s tht h mploy prolm quvlnt to th wll-stu RSA prolm, thus thr schm o not rly on conjcturs or unprovn clms Thrfor, th rsultng schms r s scur s th RSA systm Th Schm s s follows: Ky Gnrton An RSA systm wth pulc prmtrs n,, whr n s th RSA moulus s th ncrypton ky Lt th ncrypton ky h th propr hsh functon Encrypton To ncrypt mssg 0 m < n, slct = h( k + ) m(mon) th cphrtxt s (, ) Dcrypton Th rcpnt of th cphrtxt (, ) frst computs mssg, usng m = (mo n) h( k + ) k Z n comput = k (mo n) k = (mo n), thn rtrvs th 9

4 Intrntonl Journl on Computtonl Scncs & Applctons (IJCSA) Vo3, No, Frury 203 It s not ffcult to show tht cphrtxt n ERSA systm looks lk romly chosn pr, snc th frst ntry s cphrtxt of rom vlu n th orgnl RSA thus s nstngushl from rom vlu Th scon ntry s th multplcton of th mssg, m, n th output of hsh functon, thrfor s rom Not tht n rom pr, on cnnot fn ny logcl rltonshp twn two ntrs Whl n ERSA systm, thr s strong rltonshp twn two ntrs of cphrtxt Ths rltonshp, howvr, cnnot utlz n orr to stngush cphrtxt from rom pr, xcpt on cn solv th RSA prolm Tht s, shown y th followng thorm Thorm If RSA prolm s ntrctl, thn cphrtxt n th ERSA systm s nstngushl from rom pr 3 ERSA- Encrypton Schm In orr to chv scurty gnst ACCA, common tchnqu s to ttch tg to th cphrtxt Intlzton: Consr n RSA systm wth pulc prmtrs (n, ) th scrt ky Lt h propr hsh functon Encrypton To ncrypt mssg 0 m < n k Z, slct n, comput, = k, = h( k + ) m c = h( m // k) whr m//k nots th conctnton of m k Th cphrtxt s (,, c) Dcrypton For ths schm w ssum tht th ncrypton lgorthm s n orcl tht works n th followng wy ) It computs k = (mo n), thn rtrvs th mssg m, usng = h( k +) 2) It outputs th mssg m f c = h(m//k) As t cn sn, ny mofcton to th scon ntry of th cphrtxt mpls som mofcton of th thr ntry; othrws th ncrypton orcl wll tct th mofcton Howvr, th thr ntry s hsh functon Bcus of th on-wynss proprty of th unrlyng hsh functon, t s ntrctl to know th output wthout knowlg of th nput But th nput to ths hsh functon s conctnton of m k Hnc, gnrtng goo/ccptl cphrtxt mpls knowlg of th mssg Tht s, th plntxt wrnss proprty, whch s quvlnt to non-mlllty, s chv Thorm2 Th ERSA- ncrypton schm s smntclly scur gnst ACCA 32 ERSA-2 Encrypton Schm Intlzton Consr n RSA systm wth pulc prmtrs (n; ) Lt l th sz of th plntxt h (), h2() h : {0,} two hsh functons, such tht Z n Encrypton To ncrypt mssg 0 m < n, th snr choos k Z n 0

5 Intrntonl Journl on Computtonl Scncs & Applctons (IJCSA) Vo3, No, Frury 203 computs = k (mon), = m h (( k + )mo n) thn s trpl (,, c) c = h2 ( m // k) Th cphrtxt Dcrypton Th rcpnt of th cphrtxt frst computs, k = (mo n) An m = = h (( k + )mo If c = h ( m // 2 k n ) thn t outputs th mssg m; othrws, t outputs? ) Thorm3 Th ERSA-2 ncrypton schm s smntclly scur gnst ptv chosn cphrtxt ttck 4 Mprm RSA-(Mult-prm RSA) Mprm RSA ws ntrouc y Collns [7], who mof th RSA moulus so tht t conssts of N = p, p2, pk k prms nst of th trtonl two prm s p q Th ky gnrton, ncrypton crypton lgorthms r s follows: Ky gnrton Th ky gnrton lgorthm rcvs s prmtr th ntgr k, nctng th numr of prms to us Th ky prs pulc prvt r gnrt ccorng to th followng stps: log n p, p, p () Comput k stnct prms 2 k, ch on k N = p ts n lngth (2) Comput such tht = mo(n), whr gc(, ( N)) = ( N) ( ), = p = (3) For k, comput = mo( p ) Encrypton Gvn pulc ky N, thus c = M mo N mssg m Z n, ncrypts M xctly s n th orgnl RSA, Dcrypton M To crypt cphrtxt C, frst clcult = C mo p for ch, k Nxt, pply th CRT to th M s to gt M = C mo N 5 Propos Schms Scur Agnst CCA ACCA Now w propos nw schm whch s scur gnst th ACC ACCA n orr to chv n stngush lty of cphrtxt wth rom pr, w mploy propr hsh functon to h + K s follows:

6 Intrntonl Journl on Computtonl Scncs & Applctons (IJCSA) Vo3, No, Frury Schm Ths schm s smlr to ERSA sc schm, ut t utlzs hsh functon lso th ky gnrton s smlr to MPrm RSA Th schm works s follows: Ky Gnrton Lt th ky wll gnrt y usng th ky gnrton of Multprm RSA schm: Th ky gnrton lgorthm rcvs s prmtr th ntgr k, nctng th numr of prms to us Th ky prs pulc prvt r gnrt ccorng to th followng stps: logn p, p, p () Comput k stnct prms 2 k ch on k N = p ts n lngth (2) Comput such tht = mo(n), whr gc(, ( N)) = ( N) ( ), = p = (3) For k, comput = mo( p ) Encrypton l To ncrypt mssg 0 m < n h : Z, Lt L scurty prmtr, n Z n {0, } hsh k Z functon slct n C k (mo n) comput = C h( k ) m(mo n) = + th ( C, ) cphrtxt s C Dcrypton (, ) Th rcpnt of th cphrttx C C C m = (mon) mssg, usng h( k + ) frst computs k = (mo n), thn rtrvs th 52 Schm2 Ky Gnrton Th ky gnrton s sm s schm Encrypton To ncrypt mssg 0 m < n k Z, slct n C k C h k m, comput, =, = ( + ) C c = h( m // k) ( C,, ) whr m//k nots th conctnton of m k Th cphrtxt s C Cc Dcrypton For ths schm w ssum tht th ncrypton lgorthm s n orcl tht works n th followng wy k = C (mo n) ) It computs C = ( +), thn rtrvs th mssg m, usng h k 2) It outputs th mssg m f c = h (m//k) 2

7 Intrntonl Journl on Computtonl Scncs & Applctons (IJCSA) Vo3, No, Frury Schm3 Ky Gnrton Th ky gnrton s sm s schm Encrypton To ncrypt mssg 0 m < n k Z, th snr choos n c k (mon), C m h (( )mo ) An computs = = k + n ( C,, ) thn s trpl C Cc C ( m // c = h 2 k ) Th cphrtxt Dcrypton Th rcpnt of th cphrtxt frst computs, k = C (mo n) m = C h (( k )mo An = + n ) If C c = h2 ( m // k) thn t outputs th mssg m; othrws, t outputs? 6 Scurty of th Propos Schm () Smntc Scur- Scurty of ERSA, ERSA-, ERSA-2 ncrypton schms (from th pont of vw of smntcl scurty scurty gnst chosn cphrtxt ttcks) cn monstrt n th wy of Pontchvls work [3], snc ths schms r smlr to DRSA, DRSA-, DRSA-2 In our sc schm, th cphrtxt (k;m_ k+) os not hlp n opponnt to lrn ny usful nformton out th mssg Tht s, vng th scon ntry y th frst ntry /or computng th grtst common vsors of ths two tms gvs solutly no usful nformton to th opponnt (2) Prtl Ky Exposur Attck- W know tht such prvt xponnt s lrg nough to com nffctv for th ttcks of th smll prvt xponnts [3] Th ttck on th smll pulc xponnts s lso not prolm, u to th sz of th pulc xponnt whch s gnrt y th gnrton lgorthm MJson Hnk [6] m n nlyss of th prtl ky xposur ttck on th MPrm RSA vrf tht for thr four prms th ttck coms nffctv Thus t woul sm n our schm lso (3) Rom Orcl Mol- If w consr th scurty n th rom orcl mol, th schm- rchs th scurty gnst ptv chosn-cphrtxt ttcks wth n sm our ffcncy (4) ACC-Attck- Howvr, th most ntrstng schm s th Schm-2 cryptosystm tht rchs smntc scurty oth gnst ptv chosn-cphrtxt ttcks, n stuton whr t s prctclly quvlnt to th RSA prolm In, smllr xponnt, such s = (or vn 3), cn us, hnc n mprov ffcncy s otn wth N = 024, ths schm s lry fstr thn OAEP, for oth ncrypton crypton Ths schm cn gn hghr rts, com much fstr thn th orgnl RSA ncrypton schm 7 Effcncy Prformnc Pontchvl [3] hs clm tht hs schm s th most ffcnt schm to t n ths fl Hr, f w compr th ffcncy of our schms wth hs work, thus w fn tht oth schms 3

8 Intrntonl Journl on Computtonl Scncs & Applctons (IJCSA) Vo3, No, Frury 203 hv smlr structurs thrfor t s sy to compr thr ffcncy In [3], th snr th rcvr ch ns to prform two xponnttons Ths s u to clculton of k ( k +) whch must on y oth, th snr th rcvr In our schm, lthough th snr th rcvr comput k ( k +), th clculton of ( k +) ns just on multplcton ( k + ) = k k Anothr ffcncy fctor n our schms s tht our schms o not rqur ny constrnt on th sz of th pulc-ky Howvr, n orr to chv rsonl lvl of scurty n [3], t hs n conjctur tht th chosn must lrgr thn 260 Altogthr, th ffcncy of our schm s comprl to th clsscl RSA systm Th snr ns to prform on xponntton (to th sz of th pulc ky), th rcvr lso ns to prform on xponntton (to th sz of th scrt ky) wth on or two xtr multplctons /or computng hsh functons 8 Concluson W hv prsnt thr nw schms wth scurty proofs Th propos cryptosystm s smntclly scur gnst \chosn cphrtxt ttcks n th str mol, rltv to nw ffcult prolm (th nvrson prolm s quvlnt to RSA n mny css), wth n ncrypton rt 6 tms fstr thn El-Gml (wth smlr scurty lvls: RSA-024 ts vs El-Gml-52 ts) In ths wy, w conclu tht th propos schm s computtonlly lss xpnsv wth comprson to th ERSA schm Hnc our propos schm s mor ffcnt thn tht of th ERSA schm REFERENCES [] M Bllr, P Rogwy, (994) Optml Asymmtrc Encrypton How to Encrypt wth RSA,, Avncs n Cryptology EUROCRYPT 94, Vol 950, LNCS, pp 92- [2] D Blchnchr, (998) Chosn Cphrtxt Attcks Agnst Protocols Bs on th RSA Encrypton Str PKCS-, Avncs n Cryptology CRYPTO 98, Vol 462 LNCS, pp -2 [3] D Bonh, (999) Twnty Yrs of Attcks on th RSA Cryptosystm, Notcs of th Amrcn Mthmtcl Socty, Vol46 (2), pp [4] DBonh, G Durf Y Frnkl, (998) Exposng n RSA prvt ky gvn smll frcton of ts ts Avncs n cryptology- ASIACRYPT' 98, Vol 54, LNCS, pp [5] R Cntt, O Golrch, S Hlv, (998) Th Rom Orcl Mol, Rvst, 30th Symposum on th Thory of Computng (STOC) [6] Csr Alson Montcro Pxo, (2003) An ff cnt vrnt of th RSA cryptosystm, Cryptology Prnt Archv, pp 59 [7] T Collns, D Hopkn, Lngfor S Sn M,(997) Pulc ky cryptogrphc pprtus mtho US ptnt 5 [8] J Coron, D Nccch, Y Dsmt, A Olyzko, JP Strn, (2006) Inx Clculton Attcks on RSA Sgntur Encrypton Dsgn ", Cos Cryptogrphy, Vol 38, pp 4-53 [9] R Crmr V Shoup, (998) A Prctcl Pulc Ky Cryptosystm Provly Scur gnst Aptv Chosn Cphrtxt Attck ", Avncs n Cryptology CRYPTO 98, vol 462, LNCS, pp3-25 4

9 Intrntonl Journl on Computtonl Scncs & Applctons (IJCSA) Vo3, No, Frury 203 [0] I Dmgr, (992) Towrs Prctcl Pulc Ky Systms Scur Agnst Chosn Cphrtxt ttcks ", Avncs n Cryptology CRYPTO 9, Vol 576, LNCS, pp , [] W Dff M Hllmn, (976) Nw Drctons n Cryptogrphy", IEEE Trns On Inform Thory, vol IT-22, pp [2] D Dolv, C Dwork, M Nor, (99) Non-Mlll Cryptogrphy", 23r Annul Symposum on th Thory of Computng (STOC), pp [3] D Pontchvl, (999) "Nw Pulc Ky Cryptosystms Bs on th Dpnnt-RSA Prolm ", Avncs n Cryptology EUROCRYPT 99, Vol 592, LNCS, pp [4] T ElGml, (985) A Pulc Ky Cryptosystm Sgntur Schm Bs on Dscrt Logrthms ", IEEE Trns on Inform Thory, Vol IT-3, pp [5] Y Frnkl M Yung, (995) Cryptnlyss of th Immunz LL Pulc Ky Systms ", Avncs n Cryptology CRYPTO 95, Vol 963, LNCS, pp [6] M J Hnk, (2004) Nw prtl ky xposur ttcks on RSA rvst", Tchncl Rport CACR , Cntr for Appl Cryptogrphc Rsrch, Unvrsty of Wtrloo [7] S Golwssr, S Mcl, (984) Prolstc Encrypton ", Journl of Computr Systm Scncs, Vol 28, pp [8] Hossn Ghoos, (2007) An ffcnt pulc ky cryptosystm scur gnst chosn cphrtxt ttck ",Informton systm scurty, Vol-4332 (LNCS), pp [9] C Lm, P L, (994) Anothr Mtho for Attnng Scurty Agnst Aptvly Chosn Cphrtxt Attcks", Avncs n Cryptology CRYPTO 93, Vol 773, LNCS, pp [20] M Nor, MYung, (990) Pulc-ky Cryptosystms Provly Scur gnst Chosn Cphrtxt Attcks, 22n Annul ACM Symp on Thory of Computng, pp [2] T Okmoto D Pontchvl, (200) RSA-REACT: An Altrntv to RSA-OAEP", Procngs of Scon NESSIE Workshop, Eghm, UK [22] C Rcko_, D Smon, (992) Nonntrctv Zro-knowlg Proof of Knowlg Chosn Cphrtxt Attck ", Avncs n Cryptology CRYPTO 9, vol 576, LNCS, pp [23] R Rvst, A Shmr, L Almn, (978) A Mtho for Otnng Dgtl Sgnturs Pulc- Ky Cryptosystms", Communctons of th ACM, Vol 2, pp [24] V Shoup, R Gnnro, (998) Scurng Thrshol Cryptosystms gnst Chosn Cphrtxt Attck, n Avncs n Cryptology - Procngs of EUROCRYPT98 (K Nyrg, ), V ol 403 of Lctur Nots n Computr Scnc, pp 6 [25] Y Tsouns, M Yung, (998) On th Scurty of ElGml s Encrypton, Procngs of th Frst Intrntonl Workshop on Prctc Thory n Pulc Ky cryptogrphy (PKC 98), V ol 43, LNCS, pp 7-34 [26] Y Zhng, J Srry, (993) Prctcl Approchs to Attnng Scurty gnst Aptv Chosn Cphrtxt Attcks, Avncs n Cryptology CRYPTO 92, Vol 740, LNCS, pp

10 Intrntonl Journl on Computtonl Scncs & Applctons (IJCSA) Vo3, No, Frury 203 Authors Sushm Prhn rcv th BSc, MSc MPhll gr n Mthmtcs Pt Rv Shnkr Shukl Unvrsty, Rpur, Chttgrh, In n 2002, Sh jon School of Stus n Mthmtcs, Pt Rv Shnkr Shukl Unvrsty, Rpur, In for hr Rsrch work Sh s lf tm mmr of Cryptology Rsrch Socty of In (CRSI) Hr r of ntrst s Pulc Ky Cryptogrphy Intgr fctorzton Prolm Brnr Kumr Shrm Profssor, School of Stus n Mthmtcs, Pt Rvshnkr Shukl Unvrsty Rpur (C G) In H hs n workng for long tm n th fl of Non Lnr Oprtor Thory currntly n Cryptogrphy H hs rsrch scholrs work on mny rnchs of pulc ky cryptogrphy H s lf mmr of Inn Mthmtcl Socty th Rmnujn Mthmtcl Socty 6