# Lecture 3: One-Way Encryption, RSA Example

Save this PDF as:

Size: px
Start display at page:

## Transcription

1 ICS 180: Introduction to Cryptography April 13, 2004 Lecturer: Stanislaw Jarecki Lecture 3: One-Way Encryption, RSA Example 1 LECTURE SUMMARY We look at a different security property one might require of encryption, namely one-way security. The notion is natural and seems like a minimal requirement on an encryption scheme. It makes sense for both symmetric and public-key encryption schemes. To make the discussion more concrete, we look at the so-called textbook variant of the RSA encryption, and see how to pick keys in relation to the security parameter so that the best algorithms that invert RSA are either inefficient or have only negligible advantage. We will also see that while the textbook RSA can plausibly be oneway secure, it is definitely not secure in the sense of indistinguishabibility (this security property of encryption schemes was defined in the last class). This shows us that one-wayness is a weaker notion than indistinguishability. 2 One-Way Security for Encryption In the last lecture we developed the computational version (relaxation) of the perfect secrecy security property for encryption schemes, which we called indistinguishability of encryption. This notion is pretty strong, and today we ll look at a weaker notion of security for encryption, namely one-way security. In essence, we say that an encryption scheme is one-way secure if it is infeasible to decrypt ciphertexts of random plaintexts (i.e. randomly chosen from a big-enough message space). Here is the formal definition, first for the case of symmetric encryption schemes: Definition 1 (one-way secure (symmetric) encryption) We call a (symmetric) encryption scheme Σ = (KGen,Enc,Dec) one-way secure for (family of) message spaces {M τ } τ=1,2,... if for all PPT algorithms A, the following holds: Adv A (τ) = Prob[A(c) = m k KGen(1 τ );m M τ ;c Enc(k,m)] negl(τ) And here is the corresponding definition for public-key encryption schemes. The only real difference is that here the adversary sees the public key used to encrypt messages: Definition 2 (one-way secure (public key) encryption) We call a (public-key) encryption scheme Σ = (KGen,Enc,Dec) one-way secure for (family of) message spaces {M τ } τ=1,2,... if for all PPT algorithms A, the following holds: Adv A (τ) = Prob[A(PK,c) = m (SK,PK) KGen(1 τ );m M τ ;c Enc(PK,m)] negl(τ) L3-1

2 Discussion. The one-wayness of encryption seems to be a pretty minimal requirement needed of an encryption scheme. Suppose, on the contrary, that an encryption scheme is not one-way. This would mean that there exists an efficient algorithm A which has a non-negligible chance of success in decrypting an encryption of a random message. Notice that in any application of an encryption scheme, the encryption/decryption keys are going to be picked by a (random) run of the KGen(1 τ ) algorithm, which is just like in the one-wayness game the adversary plays with an encryption scheme in the above definition(s). So if A s advantage in this game is sizable, i.e. larger than negligible (larger than 1/p(τ) for some polynomial p( )), this could mean one of the following things, each of them pretty bad for any application using such encryption: It could be that for every message m M and every c = Enc(k,m), there is about 1/p(τ) chance that A decrypts c as m, where the probability is taken over the random coins of A. This case is the worst, because in this case we could run A over an over on the same input c, and after τ p(τ) trials, the probability that in none of these trials A ends up decrypting c is only Prob[A fails in all τ p(τ) trials] (1 1/p(τ)) τ p(τ) (1/e) τ < (1/2) τ = 2 τ Note also that the time taken by this new attack is τ p(τ) Time A (τ) which is poly(τ) because Time A (τ) is polynomial in τ. So such A leads to an efficient attack which decrypts every message except for a negligible probability 2 τ. However, it could also be that the above is true only for some messages m M. For example, it could be that A decrypts with probability almost 1 on any encryptions of all messages in some subset M M which contains 1/p(τ) fraction of messages, i.e. M / M = 1/p(τ), but on encryptions of messages m M it fails. Why would such an attack be so bad? First of all, for many encryption schemes, an attack which succeeds well on some fraction of messages can be used to succeed on all messages. (We ll see that on the RSA example below!) Second, even if there was no way of transforming such attack into decrypting any message, this is still not good because the application would have to make sure that messages in M are avoided. Whatever message space M = M \ M an application needs to use, it needs to know that the encryption scheme is at least one-way secure for the message space M. The inverter A could work in yet another way. For example, maybe A has a good chance of inverting a particular class of ciphertexts, but fails to invert if the ciphertext does not fall into this class? This type of attack usually leads to an attack against any ciphertext too (similarly to the case above). An example of this in in problem 3 on homework 2. You ll see there that if there is an attack A which inverts ElGamal ciphertext only if they have some special (although common-enough) form, you can use A to construct an attack which actually inverts any ElGamal ciphertext. 3 Example: RSA cryptosystem To understand the RSA cryptosystem, for now all you need to know is that Z n = {0,...,n 1}. To understand it more more deeply, you should read the handouts on modular arithmetics (first the L3-2

3 handout on primes and then the one on composites). You ll see there what Z n is, where did φ(n) = (p 1)(q 1) come from, and why equation (2) below holds for all m Z n if ed = 1 mod φ(n). But at first you can just assume that d = e 1 mod φ(n) is easy to compute and that equation (2) does hold. The scheme below is called a textbook RSA cryptosystem, because it uses the RSA setting in the most basic way possible. KGen(1 τ ) generates two prime numbers p,q of length p = q 1 2c 3 τ 3 where c is a small constant, c 8 (the actual formula for the good prime size is a little more complex but this is a good approximation, and we ll see later today how this is the choice is made!). Then KGen computes a n = p q, picks some small prime number e 3 (in most applications e = 3 is used because the speed of encryption depends on the size of e, so the smallest possible e is picked), then computes number d = e 1 mod φ(n) where φ(n) = (p 1)(q 1) (computing modular inverses is efficient via the Euclidean algorithm), and outputs PK = (n,e) and SK = (p,q,n,e,d). Enc(PK,m) for m {0,1} first divides m into m /( n 1) blocks m = [m (1) m (2)...] of n 1 bits each (the last block can be padded with zeroes to make it n 1 bit long). This way each m (i) is in Z n, and in fact it is almost always an element of Z n too.1 Then for each block m (assumed in Z n ), Enc computes c = (m)e mod n. Then it collects the resulting ciphertext blocks and outputs c = [c (1) c (2)...]. The decryption Dec(SK, c) goes block-by-block as well, where the block m of plaintext is computed from the corresponding ciphertext block c as m = (c) d mod n. The reason that RSA encryption can work at all is the following fact, which holds for any n: m Z n, m φ(n) = 1 mod n (1) From this equation it follows that for any e,d s.t. ed = 1 mod φ(n) we have: m Z n, m e d = m mod n (2) It follows because if m φ(n) = 1 mod n and ed = iφ(n) + 1 for some integer i (because ed = 1 mod φ(n)), then m ed = m iφ(n)+1 = (m φ(n) ) i m 1 = 1 m = m mod n. Equation (2) implies, taking m Z n for notation simplicity, that Dec(SK,Enc(PK,m)) = ((m e mod n) d mod n) = (m e d mod n) = m. 3.1 The RSA Assumption: Textbook RSA is a One-Way Encryption The so-called RSA assumption is basically exactly what the definition (2) states where Σ = (KGen, Enc, Dec) is the above textbook RSA scheme and the message space M is chosen as Z n (equivalently, one can assume RSA one-wayness on message space M τ = {0,1} τ3 /c 3 1 ). In other words: 1 We can treat any element in 1,..., n 1 as most likely an element of Z n because finding elements m in Z n \ Z n actually leads to factoring of n. The reason is that if n Z n then it must be that gcd(n,m) 1, but since n = pq and m < n then gcd(n, m) is either p or q, so you find a prime factor of n if you find m Z n. Therefore finding such m must be unlikely if the factoring problem is hard. L3-3

4 Definition 3 (RSA Assumption) It is infeasible, for large enough τ, to compute m s.t. m e = c mod n on inputs ((n,e),c), where (n,e) are RSA parameters chosen as above, c = m e mod n, and m is picked at random in Z n. First, note that the above assumption indeed states exactly that the textbook RSA is a one-way secure encryption scheme on message space M = Z n. But what rationale do we have to think that the RSA assumption holds, or, equivalently, that the textbook RSA encryption is one-way secure? Let s look at some attempts A to break the one-wayness of the RSA encryption, and see that they all either fail to be polynomial time, e.g. Time A (τ) = 2 τ, or they have only negligigible advantage in breaking the one-wayness property, e.g. Adv A (τ) = 2 τ. Attempt 1. How about a trivial algorithm A which on input ((n,e),c) guesses factor p {0,1} n /2 of n, and if the guess is correct, it computes q = n/p, φ(n) = (p 1)(q 1), d = e 1 mod φ(n), and then decrypts m = c d mod n. While Time A is good because all these operations are efficient, the advantage Adv A of A, i.e. the probability that A decrypts m succesfully is only negligible, because A succeeds if and only if it guesses p correctly, and the chances of that are 2 p = 2 n /2 = 2 τ3 /c 3, which is a negligible function of the security parameter τ. Attempt 2. Alternatively, A could search the whole space of possible p s. Then A would succeed for sure, but since there are 2 n /2 = 2 τ3 /c 3 possible p s, A would be run in exponential time, which is infeasible. Attempt 3. The best known way to invert RSA encryption of random messages is indeed to first factor n and then proceed like the attackers above. However, the best factoring algorithm does it much faster than by searching the space of possible n /2-bit factors of n. The fastest algorithm is called a number-field sieve [NSF], and it takes time Time NSF = O(2 c n 1/3 ). Therefore, since n = (τ/c) 3 and hence c n 1/3 = τ, and the attack time is dominated by the time it takes to factor n, we have Time A (τ) Time NSF = O(2 τ ). Thus again, the time it takes for A to invert an RSA encryption is exponential in τ. This analysis explains why the length of the RSA composite n is chosen in the n = (τ/c) 3 relation to the security parameter τ. It s so that an RSA cryptosystem chosen with security parameter τ indeed takes at least about 2 τ operations to break. 3.2 Textbook RSA is Not an Indistinguishably Secure Encryption It is easy to see that while RSA can be plausibly one-way secure (see the failed attempts 1-3 above to break this assumption), it is not secure in the sense of indistinguishability of encryption. Recall the definition of encryption scheme indistinguishability from lecture 2. To show that the textbook RSA encryption scheme fails this security property, we only need to show two messages m 0 and m 1, and an efficient adversary who distinguishes encryptions of m 0 from encryptions of m 1. But that s easy: Take any m,m Z n s.t. m m, and make m 0 = [m,m] and m 1 = [m,m ]. This way Enc((n,e),m 0 ) = [c,c] for some c while Enc((n,e),m 1 ) = [c,c ] where c c. (This holds because the RSA function y = RSA (n,e) (x) = m e mod n is a permutation in Z n, and hence if x x then y y.) Hence it is trivial to distinguish encryptions of m 0 from encryptions of m 1. L3-4

5 Why is this so bad? Because it means, for example, that in an application in which someone sometimes send the same message twice, which might very well happen with messages like yes, or no, or snafu, the eavesdropper will be able to distinguish, for any two communicated messages, if they are ciphertexts of the same plaintext. This could very well be insecure and is for sure undesirable. Note that the above argument implies something more general, namely that any deterministic encryption scheme cannot be secure in the sense of indistinguishability. How is RSA used in practice to make it secure then? First of all, randomness is introduced so that to make the encryption non-deterministic. Instead of computing c = m e mod n for message block m Z p, the message is divided into smaller blocks m, about 3 4 n -bits each, the encryption procedure picks a random string r {0,1} 1 4 n, and then pads the message m using randomness r in quite an elaborate way, to create a preimage m = pad(m;r). Encryption then outputs c = (m ) e mod n, while decryption reverses this process, extracting (m,r) from m = c d mod n and outputing m. We ll see later in classs how this padding is done and why. L3-5

### CIS 5371 Cryptography. 8. Encryption --

CIS 5371 Cryptography p y 8. Encryption -- Asymmetric Techniques Textbook encryption algorithms In this chapter, security (confidentiality) is considered in the following sense: All-or-nothing secrecy.

Family Name:... First Name:... Section:... Advanced Cryptography Final Exam July 18 th, 2006 Start at 9:15, End at 12:00 This document consists of 12 pages. Instructions Electronic devices are not allowed.

### Overview of Public-Key Cryptography

CS 361S Overview of Public-Key Cryptography Vitaly Shmatikov slide 1 Reading Assignment Kaufman 6.1-6 slide 2 Public-Key Cryptography public key public key? private key Alice Bob Given: Everybody knows

### PUBLIC KEY ENCRYPTION

PUBLIC KEY ENCRYPTION http://www.tutorialspoint.com/cryptography/public_key_encryption.htm Copyright tutorialspoint.com Public Key Cryptography Unlike symmetric key cryptography, we do not find historical

### Introduction. Digital Signature

Introduction Electronic transactions and activities taken place over Internet need to be protected against all kinds of interference, accidental or malicious. The general task of the information technology

### 1 Digital Signatures. 1.1 The RSA Function: The eth Power Map on Z n. Crypto: Primitives and Protocols Lecture 6.

1 Digital Signatures A digital signature is a fundamental cryptographic primitive, technologically equivalent to a handwritten signature. In many applications, digital signatures are used as building blocks

### RSA Attacks. By Abdulaziz Alrasheed and Fatima

RSA Attacks By Abdulaziz Alrasheed and Fatima 1 Introduction Invented by Ron Rivest, Adi Shamir, and Len Adleman [1], the RSA cryptosystem was first revealed in the August 1977 issue of Scientific American.

### 1 Recap: Perfect Secrecy. 2 Limits of Perfect Secrecy. Recall from last time:

Theoretical Foundations of Cryptography Lecture 2 Georgia Tech, Spring 2010 Computational Hardness 1 Recap: Perfect Secrecy Instructor: Chris Peikert Scribe: George P. Burdell Recall from last time: Shannon

### The application of prime numbers to RSA encryption

The application of prime numbers to RSA encryption Prime number definition: Let us begin with the definition of a prime number p The number p, which is a member of the set of natural numbers N, is considered

### 1 Message Authentication

Theoretical Foundations of Cryptography Lecture Georgia Tech, Spring 200 Message Authentication Message Authentication Instructor: Chris Peikert Scribe: Daniel Dadush We start with some simple questions

### U.C. Berkeley CS276: Cryptography Handout 0.1 Luca Trevisan January, 2009. Notes on Algebra

U.C. Berkeley CS276: Cryptography Handout 0.1 Luca Trevisan January, 2009 Notes on Algebra These notes contain as little theory as possible, and most results are stated without proof. Any introductory

### Symmetric Key cryptosystem

SFWR C03: Computer Networks and Computer Security Mar 8-11 200 Lecturer: Kartik Krishnan Lectures 22-2 Symmetric Key cryptosystem Symmetric encryption, also referred to as conventional encryption or single

### Title Goes Here An Introduction to Modern Cryptography. Mike Reiter

Title Goes Here An Introduction to Modern Cryptography Mike Reiter 1 Cryptography Study of techniques to communicate securely in the presence of an adversary Traditional scenario Goal: A dedicated, private

### 1 Signatures vs. MACs

CS 120/ E-177: Introduction to Cryptography Salil Vadhan and Alon Rosen Nov. 22, 2006 Lecture Notes 17: Digital Signatures Recommended Reading. Katz-Lindell 10 1 Signatures vs. MACs Digital signatures

### 1 Construction of CCA-secure encryption

CSCI 5440: Cryptography Lecture 5 The Chinese University of Hong Kong 10 October 2012 1 Construction of -secure encryption We now show how the MAC can be applied to obtain a -secure encryption scheme.

### Chapter 10 Asymmetric-Key Cryptography

Chapter 10 Asymmetric-Key Cryptography Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. 10.1 Chapter 10 Objectives Present asymmetric-key cryptography. Distinguish

### Ch.9 Cryptography. The Graduate Center, CUNY.! CSc 75010 Theoretical Computer Science Konstantinos Vamvourellis

Ch.9 Cryptography The Graduate Center, CUNY! CSc 75010 Theoretical Computer Science Konstantinos Vamvourellis Why is Modern Cryptography part of a Complexity course? Short answer:! Because Modern Cryptography

### Network Security. Computer Networking Lecture 08. March 19, 2012. HKU SPACE Community College. HKU SPACE CC CN Lecture 08 1/23

Network Security Computer Networking Lecture 08 HKU SPACE Community College March 19, 2012 HKU SPACE CC CN Lecture 08 1/23 Outline Introduction Cryptography Algorithms Secret Key Algorithm Message Digest

### Overview of Cryptographic Tools for Data Security. Murat Kantarcioglu

UT DALLAS Erik Jonsson School of Engineering & Computer Science Overview of Cryptographic Tools for Data Security Murat Kantarcioglu Pag. 1 Purdue University Cryptographic Primitives We will discuss the

### Public Key Cryptography. Basic Public Key Cryptography

Public Key Cryptography EJ Jung Basic Public Key Cryptography public key public key? private key Alice Bob Given: Everybody knows Bob s public key - How is this achieved in practice? Only Bob knows the

### An Introduction to the RSA Encryption Method

April 17, 2012 Outline 1 History 2 3 4 5 History RSA stands for Rivest, Shamir, and Adelman, the last names of the designers It was first published in 1978 as one of the first public-key crytographic systems

### Elements of Applied Cryptography Public key encryption

Network Security Elements of Applied Cryptography Public key encryption Public key cryptosystem RSA and the factorization problem RSA in practice Other asymmetric ciphers Asymmetric Encryption Scheme Let

### Applied Cryptography Public Key Algorithms

Applied Cryptography Public Key Algorithms Sape J. Mullender Huygens Systems Research Laboratory Universiteit Twente Enschede 1 Public Key Cryptography Independently invented by Whitfield Diffie & Martin

### The Mathematics of the RSA Public-Key Cryptosystem

The Mathematics of the RSA Public-Key Cryptosystem Burt Kaliski RSA Laboratories ABOUT THE AUTHOR: Dr Burt Kaliski is a computer scientist whose involvement with the security industry has been through

### Lukasz Pater CMMS Administrator and Developer

Lukasz Pater CMMS Administrator and Developer EDMS 1373428 Agenda Introduction Why do we need asymmetric ciphers? One-way functions RSA Cipher Message Integrity Examples Secure Socket Layer Single Sign

### Lecture 9 - Message Authentication Codes

Lecture 9 - Message Authentication Codes Boaz Barak March 1, 2010 Reading: Boneh-Shoup chapter 6, Sections 9.1 9.3. Data integrity Until now we ve only been interested in protecting secrecy of data. However,

### Post-Quantum Cryptography #4

Post-Quantum Cryptography #4 Prof. Claude Crépeau McGill University http://crypto.cs.mcgill.ca/~crepeau/waterloo 185 ( 186 Attack scenarios Ciphertext-only attack: This is the most basic type of attack

### Asymmetric cryptography in the random oracle model. Gregory Neven IBM Zurich Research Laboratory

Asymmetric cryptography in the random oracle model Gregory Neven IBM Zurich Research Laboratory Overview Provable security: the concept Digital signatures and the Random Oracle Model Public-key encryption

### Cryptography and Network Security Chapter 9

Cryptography and Network Security Chapter 9 Fifth Edition by William Stallings Lecture slides by Lawrie Brown (with edits by RHB) Chapter 9 Public Key Cryptography and RSA Every Egyptian received two names,

### MA2C03 Mathematics School of Mathematics, Trinity College Hilary Term 2016 Lecture 59 (April 1, 2016) David R. Wilkins

MA2C03 Mathematics School of Mathematics, Trinity College Hilary Term 2016 Lecture 59 (April 1, 2016) David R. Wilkins The RSA encryption scheme works as follows. In order to establish the necessary public

### 1 Pseudorandom Permutations

Theoretical Foundations of Cryptography Lecture 9 Georgia Tech, Spring 2010 PRPs, Symmetric Encryption 1 Pseudorandom Permutations Instructor: Chris Peikert Scribe: Pushkar Tripathi In the first part of

### COM S 687 Introduction to Cryptography October 19, 2006

COM S 687 Introduction to Cryptography October 19, 2006 Lecture 16: Non-Malleability and Public Key Encryption Lecturer: Rafael Pass Scribe: Michael George 1 Non-Malleability Until this point we have discussed

### Lecture 10: CPA Encryption, MACs, Hash Functions. 2 Recap of last lecture - PRGs for one time pads

CS 7880 Graduate Cryptography October 15, 2015 Lecture 10: CPA Encryption, MACs, Hash Functions Lecturer: Daniel Wichs Scribe: Matthew Dippel 1 Topic Covered Chosen plaintext attack model of security MACs

### Asymmetric Encryption. With material from Jonathan Katz, David Brumley, and Dave Levin

Asymmetric Encryption With material from Jonathan Katz, David Brumley, and Dave Levin Warmup activity Overview of asymmetric-key crypto Intuition for El Gamal and RSA And intuition for attacks Digital

### Cryptographic hash functions and MACs Solved Exercises for Cryptographic Hash Functions and MACs

Cryptographic hash functions and MACs Solved Exercises for Cryptographic Hash Functions and MACs Enes Pasalic University of Primorska Koper, 2014 Contents 1 Preface 3 2 Problems 4 2 1 Preface This is a

### Chapter 10 Asymmetric-Key Cryptography

Chapter 10 Asymmetric-Key Cryptography Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. 10.1 Chapter 10 Objectives To distinguish between two cryptosystems: symmetric-key

### Lecture Note 5 PUBLIC-KEY CRYPTOGRAPHY. Sourav Mukhopadhyay

Lecture Note 5 PUBLIC-KEY CRYPTOGRAPHY Sourav Mukhopadhyay Cryptography and Network Security - MA61027 Modern/Public-key cryptography started in 1976 with the publication of the following paper. W. Diffie

### Universal Hash Proofs and a Paradigm for Adaptive Chosen Ciphertext Secure Public-Key Encryption

Universal Hash Proofs and a Paradigm for Adaptive Chosen Ciphertext Secure Public-Key Encryption Ronald Cramer Victor Shoup December 12, 2001 Abstract We present several new and fairly practical public-key

### Network Security CS 5490/6490 Fall 2015 Lecture Notes 8/26/2015

Network Security CS 5490/6490 Fall 2015 Lecture Notes 8/26/2015 Chapter 2: Introduction to Cryptography What is cryptography? It is a process/art of mangling information in such a way so as to make it

### Talk announcement please consider attending!

Talk announcement please consider attending! Where: Maurer School of Law, Room 335 When: Thursday, Feb 5, 12PM 1:30PM Speaker: Rafael Pass, Associate Professor, Cornell University, Topic: Reasoning Cryptographically

### Outline. Computer Science 418. Digital Signatures: Observations. Digital Signatures: Definition. Definition 1 (Digital signature) Digital Signatures

Outline Computer Science 418 Digital Signatures Mike Jacobson Department of Computer Science University of Calgary Week 12 1 Digital Signatures 2 Signatures via Public Key Cryptosystems 3 Provable 4 Mike

### QUANTUM COMPUTERS AND CRYPTOGRAPHY. Mark Zhandry Stanford University

QUANTUM COMPUTERS AND CRYPTOGRAPHY Mark Zhandry Stanford University Classical Encryption pk m c = E(pk,m) sk m = D(sk,c) m??? Quantum Computing Attack pk m aka Post-quantum Crypto c = E(pk,m) sk m = D(sk,c)

### 9 Modular Exponentiation and Cryptography

9 Modular Exponentiation and Cryptography 9.1 Modular Exponentiation Modular arithmetic is used in cryptography. In particular, modular exponentiation is the cornerstone of what is called the RSA system.

### Improved Online/Offline Signature Schemes

Improved Online/Offline Signature Schemes Adi Shamir and Yael Tauman Applied Math. Dept. The Weizmann Institute of Science Rehovot 76100, Israel {shamir,tauman}@wisdom.weizmann.ac.il Abstract. The notion

### Proofs in Cryptography

Proofs in Cryptography Ananth Raghunathan Abstract We give a brief overview of proofs in cryptography at a beginners level. We briefly cover a general way to look at proofs in cryptography and briefly

### Identity-Based Encryption from the Weil Pairing

Appears in SIAM J. of Computing, Vol. 32, No. 3, pp. 586-615, 2003. An extended abstract of this paper appears in the Proceedings of Crypto 2001, volume 2139 of Lecture Notes in Computer Science, pages

### Introduction to Cryptography CS 355

Introduction to Cryptography CS 355 Lecture 30 Digital Signatures CS 355 Fall 2005 / Lecture 30 1 Announcements Wednesday s lecture cancelled Friday will be guest lecture by Prof. Cristina Nita- Rotaru

### CryptoVerif Tutorial

CryptoVerif Tutorial Bruno Blanchet INRIA Paris-Rocquencourt bruno.blanchet@inria.fr November 2014 Bruno Blanchet (INRIA) CryptoVerif Tutorial November 2014 1 / 14 Exercise 1: preliminary definition SUF-CMA

### SYMMETRIC ENCRYPTION. Mihir Bellare UCSD 1

SYMMETRIC ENCRYPTION Mihir Bellare UCSD 1 Syntax A symmetric encryption scheme SE = (K,E,D) consists of three algorithms: K and E may be randomized, but D must be deterministic. Mihir Bellare UCSD 2 Correct

### RSA Cryptosystem. Yufei Tao. Department of Computer Science and Engineering Chinese University of Hong Kong. RSA Cryptosystem

Yufei Tao Department of Computer Science and Engineering Chinese University of Hong Kong In this lecture, we will discuss the RSA cryptosystem, which is widely adopted as a way to encrypt a message, or

### Modular arithmetic. x ymodn if x = y +mn for some integer m. p. 1/??

p. 1/?? Modular arithmetic Much of modern number theory, and many practical problems (including problems in cryptography and computer science), are concerned with modular arithmetic. While this is probably

### Cryptography. Helmer Aslaksen Department of Mathematics National University of Singapore

Cryptography Helmer Aslaksen Department of Mathematics National University of Singapore aslaksen@math.nus.edu.sg www.math.nus.edu.sg/aslaksen/sfm/ 1 Basic Concepts There are many situations in life where

### Cryptography CS 555. Topic 3: One-time Pad and Perfect Secrecy. CS555 Spring 2012/Topic 3 1

Cryptography CS 555 Topic 3: One-time Pad and Perfect Secrecy CS555 Spring 2012/Topic 3 1 Outline and Readings Outline One-time pad Perfect secrecy Limitation of perfect secrecy Usages of one-time pad

### Chapter 12. Digital signatures. 12.1 Digital signature schemes

Chapter 12 Digital signatures In the public key setting, the primitive used to provide data integrity is a digital signature scheme. In this chapter we look at security notions and constructions for this

### Lecture 13: Factoring Integers

CS 880: Quantum Information Processing 0/4/0 Lecture 3: Factoring Integers Instructor: Dieter van Melkebeek Scribe: Mark Wellons In this lecture, we review order finding and use this to develop a method

### MTAT.07.003 Cryptology II. Digital Signatures. Sven Laur University of Tartu

MTAT.07.003 Cryptology II Digital Signatures Sven Laur University of Tartu Formal Syntax Digital signature scheme pk (sk, pk) Gen (m, s) (m,s) m M 0 s Sign sk (m) Ver pk (m, s)? = 1 To establish electronic

### CIS 6930 Emerging Topics in Network Security. Topic 2. Network Security Primitives

CIS 6930 Emerging Topics in Network Security Topic 2. Network Security Primitives 1 Outline Absolute basics Encryption/Decryption; Digital signatures; D-H key exchange; Hash functions; Application of hash

### SFWR ENG 4C03 - Computer Networks & Computer Security

KEY MANAGEMENT SFWR ENG 4C03 - Computer Networks & Computer Security Researcher: Jayesh Patel Student No. 9909040 Revised: April 4, 2005 Introduction Key management deals with the secure generation, distribution,

### Outline. CSc 466/566. Computer Security. 8 : Cryptography Digital Signatures. Digital Signatures. Digital Signatures... Christian Collberg

Outline CSc 466/566 Computer Security 8 : Cryptography Digital Signatures Version: 2012/02/27 16:07:05 Department of Computer Science University of Arizona collberg@gmail.com Copyright c 2012 Christian

### 3. Applications of Number Theory

3. APPLICATIONS OF NUMBER THEORY 163 3. Applications of Number Theory 3.1. Representation of Integers. Theorem 3.1.1. Given an integer b > 1, every positive integer n can be expresses uniquely as n = a

### CSC474/574 - Information Systems Security: Homework1 Solutions Sketch

CSC474/574 - Information Systems Security: Homework1 Solutions Sketch February 20, 2005 1. Consider slide 12 in the handout for topic 2.2. Prove that the decryption process of a one-round Feistel cipher

### RSA Question 2. Bob thinks that p and q are primes but p isn t. Then, Bob thinks Φ Bob :=(p-1)(q-1) = φ(n). Is this true?

RSA Question 2 Bob thinks that p and q are primes but p isn t. Then, Bob thinks Φ Bob :=(p-1)(q-1) = φ(n). Is this true? Bob chooses a random e (1 < e < Φ Bob ) such that gcd(e,φ Bob )=1. Then, d = e -1

### Digital Signatures. Murat Kantarcioglu. Based on Prof. Li s Slides. Digital Signatures: The Problem

Digital Signatures Murat Kantarcioglu Based on Prof. Li s Slides Digital Signatures: The Problem Consider the real-life example where a person pays by credit card and signs a bill; the seller verifies

### Cryptography and Network Security

Cryptography and Network Security Fifth Edition by William Stallings Chapter 9 Public Key Cryptography and RSA Private-Key Cryptography traditional private/secret/single key cryptography uses one key shared

### Cryptography and Network Security Department of Computer Science and Engineering Indian Institute of Technology Kharagpur

Cryptography and Network Security Department of Computer Science and Engineering Indian Institute of Technology Kharagpur Module No. # 01 Lecture No. # 05 Classic Cryptosystems (Refer Slide Time: 00:42)

### Introduction to Security Proof of Cryptosystems

Introduction to Security Proof of Cryptosystems D. J. Guan November 16, 2007 Abstract Provide proof of security is the most important work in the design of cryptosystems. Problem reduction is a tool to

### Network Security. Abusayeed Saifullah. CS 5600 Computer Networks. These slides are adapted from Kurose and Ross 8-1

Network Security Abusayeed Saifullah CS 5600 Computer Networks These slides are adapted from Kurose and Ross 8-1 Public Key Cryptography symmetric key crypto v requires sender, receiver know shared secret

### Introduction. Chapter 1

Chapter 1 Introduction This is a chapter from version 1.1 of the book Mathematics of Public Key Cryptography by Steven Galbraith, available from http://www.isg.rhul.ac.uk/ sdg/crypto-book/ The copyright

### 1) A very simple example of RSA encryption

Solved Examples 1) A very simple example of RSA encryption This is an extremely simple example using numbers you can work out on a pocket calculator (those of you over the age of 35 45 can probably even

### Primality Testing and Factorization Methods

Primality Testing and Factorization Methods Eli Howey May 27, 2014 Abstract Since the days of Euclid and Eratosthenes, mathematicians have taken a keen interest in finding the nontrivial factors of integers,

### Communications security

University of Roma Sapienza DIET Communications security Lecturer: Andrea Baiocchi DIET - University of Roma La Sapienza E-mail: andrea.baiocchi@uniroma1.it URL: http://net.infocom.uniroma1.it/corsi/index.htm

### DIGITAL SIGNATURES 1/1

DIGITAL SIGNATURES 1/1 Signing by hand COSMO ALICE ALICE Pay Bob \$100 Cosmo Alice Alice Bank =? no Don t yes pay Bob 2/1 Signing electronically Bank Internet SIGFILE } {{ } 101 1 ALICE Pay Bob \$100 scan

### Midterm Exam Solutions CS161 Computer Security, Spring 2008

Midterm Exam Solutions CS161 Computer Security, Spring 2008 1. To encrypt a series of plaintext blocks p 1, p 2,... p n using a block cipher E operating in electronic code book (ECB) mode, each ciphertext

### Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur

Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Lecture No. # 11 Block Cipher Standards (DES) (Refer Slide

### Public Key Cryptography: RSA and Lots of Number Theory

Public Key Cryptography: RSA and Lots of Number Theory Public vs. Private-Key Cryptography We have just discussed traditional symmetric cryptography: Uses a single key shared between sender and receiver

### CSA E0 235: Cryptography (29/03/2015) (Extra) Lecture 3

CSA E0 235: Cryptography (29/03/2015) Instructor: Arpita Patra (Extra) Lecture 3 Submitted by: Mayank Tiwari Review From our discussion of perfect secrecy, we know that the notion of perfect secrecy has

### Public-Key Encryption (Asymmetric Encryption)

Public-Key Encryption (Asymmetric Encryption) Summer School, Romania 2014 Marc Fischlin 13. Oktober 2010 Dr.Marc Fischlin Kryptosicherheit 1 The story so far (Private-Key Crypto) Alice establish secure

### Chosen-Ciphertext Security from Identity-Based Encryption

Chosen-Ciphertext Security from Identity-Based Encryption Dan Boneh Ran Canetti Shai Halevi Jonathan Katz Abstract We propose simple and efficient CCA-secure public-key encryption schemes (i.e., schemes

### Lecture 6 - Cryptography

Lecture 6 - Cryptography CSE497b - Spring 2007 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse497b-s07 Question 2 Setup: Assume you and I don t know anything about

### Cryptography and Network Security Chapter 10

Cryptography and Network Security Chapter 10 Fifth Edition by William Stallings Lecture slides by Lawrie Brown (with edits by RHB) Chapter 10 Other Public Key Cryptosystems Amongst the tribes of Central

### ΕΠΛ 674: Εργαστήριο 3

ΕΠΛ 674: Εργαστήριο 3 Ο αλγόριθμος ασύμμετρης κρυπτογράφησης RSA Παύλος Αντωνίου Department of Computer Science Private-Key Cryptography traditional private/secret/single key cryptography uses one key

### Digital Signatures. Prof. Zeph Grunschlag

Digital Signatures Prof. Zeph Grunschlag (Public Key) Digital Signatures PROBLEM: Alice would like to prove to Bob, Carla, David,... that has really sent them a claimed message. E GOAL: Alice signs each

### Lecture 5 - CPA security, Pseudorandom functions

Lecture 5 - CPA security, Pseudorandom functions Boaz Barak October 2, 2007 Reading Pages 82 93 and 221 225 of KL (sections 3.5, 3.6.1, 3.6.2 and 6.5). See also Goldreich (Vol I) for proof of PRF construction.

### Principles of Public Key Cryptography. Applications of Public Key Cryptography. Security in Public Key Algorithms

Principles of Public Key Cryptography Chapter : Security Techniques Background Secret Key Cryptography Public Key Cryptography Hash Functions Authentication Chapter : Security on Network and Transport

### 1 Domain Extension for MACs

CS 127/CSCI E-127: Introduction to Cryptography Prof. Salil Vadhan Fall 2013 Reading. Lecture Notes 17: MAC Domain Extension & Digital Signatures Katz-Lindell Ÿ4.34.4 (2nd ed) and Ÿ12.0-12.3 (1st ed).

### 3-6 Toward Realizing Privacy-Preserving IP-Traceback

3-6 Toward Realizing Privacy-Preserving IP-Traceback The IP-traceback technology enables us to trace widely spread illegal users on Internet. However, to deploy this attractive technology, some problems

### CMPSCI611: Primality Testing Lecture 14

CMPSCI611: Primality Testing Lecture 14 One of the most important domains for randomized algorithms is number theory, particularly with its applications to cryptography. Today we ll look at one of the

### CS Asymmetric-key Encryption. Prof. Clarkson Spring 2016

CS 5430 Asymmetric-key Encryption Prof. Clarkson Spring 2016 Review: block ciphers Encryption schemes: Enc(m; k): encrypt message m under key k Dec(c; k): decrypt ciphertext c with key k Gen(len): generate

### Lecture 13 - Basic Number Theory.

Lecture 13 - Basic Number Theory. Boaz Barak March 22, 2010 Divisibility and primes Unless mentioned otherwise throughout this lecture all numbers are non-negative integers. We say that A divides B, denoted

### Public-Key Cryptography. Oregon State University

Public-Key Cryptography Çetin Kaya Koç Oregon State University 1 Sender M Receiver Adversary Objective: Secure communication over an insecure channel 2 Solution: Secret-key cryptography Exchange the key

### Signature Schemes. CSG 252 Fall 2006. Riccardo Pucella

Signature Schemes CSG 252 Fall 2006 Riccardo Pucella Signatures Signatures in real life have a number of properties They specify the person responsible for a document E.g. that it has been produced by

### Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur

Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Module No. #01 Lecture No. #10 Symmetric Key Ciphers (Refer

### CS 758: Cryptography / Network Security

CS 758: Cryptography / Network Security offered in the Fall Semester, 2003, by Doug Stinson my office: DC 3122 my email address: dstinson@uwaterloo.ca my web page: http://cacr.math.uwaterloo.ca/~dstinson/index.html

### Network Security: Cryptography CS/SS G513 S.K. Sahay

Network Security: Cryptography CS/SS G513 S.K. Sahay BITS-Pilani, K.K. Birla Goa Campus, Goa S.K. Sahay Network Security: Cryptography 1 Introduction Network security: measure to protect data/information

### Lecture 2: Complexity Theory Review and Interactive Proofs

600.641 Special Topics in Theoretical Cryptography January 23, 2007 Lecture 2: Complexity Theory Review and Interactive Proofs Instructor: Susan Hohenberger Scribe: Karyn Benson 1 Introduction to Cryptography

### Mathematics of Cryptography

Number Theory Modular Arithmetic: Two numbers equivalent mod n if their difference is multiple of n example: 7 and 10 are equivalent mod 3 but not mod 4 7 mod 3 10 mod 3 = 1; 7 mod 4 = 3, 10 mod 4 = 2.

### PRIME NUMBERS & SECRET MESSAGES

PRIME NUMBERS & SECRET MESSAGES I. RSA CODEBREAKER GAME This is a game with two players or teams. The players take turns selecting either prime or composite numbers as outlined on the board below. The