CS250: Discrete Math for Computer Science

Transcription

1 CS250: Discrete Math for Computer Science L8: Cryptography

2 Recall:Fermat s Little Theorem Thm: [Fermat, 1640] Let p be prime, and a Z p. Then: a p 1 1(modp). proof: f a : Z p 1:1 onto Z p ; f a(x) = (a x) Z p = {1,2,...,p 1} = {f a (1),f a (2),...,f a (p 1)} {1,2,...,p 1} = {a 1,a 2,...,a (p 1)} i a i (mod p) i Z p i Z p i a p 1 i (mod p) i Z p i Z p 1 a p 1 (mod p)

3 Euler s phi function, ϕ(n) Recall: Z n = { a 0 < a < n gcd(a,n) = 1 } Def: [Euler 1760] (pronounced Oiler ) ϕ(n) def = Z n iclicker: What s ϕ(2)? A: 0, B: 1, C: 2 iclicker: What s ϕ(3)? A: 1, B: 2, C: 3 iclicker: What s ϕ(4)? A: 1, B: 2, C: 3, D: 4 iclicker: What s ϕ(17)? A: 7, B: 10, C: 16, D: 17

4 Euler s phi function, ϕ(n) Prop: For p prime, ϕ(p) = p 1. Euler s Thm: For any m > 1, a Z m, aϕ(m) 1(modm). Note: this is a generalization of Fermat s Little Theorem. proof: Similar to the proof of Fermat s Little Theorem.

5 Euler s Thm: For m > 1, a Z m, a ϕ(m) 1(modm). proof: For a Z m, f a : Z m 1:1 onto Z m, f a(x) = (a x)%m Z m = {b 1,...,b ϕ(m) } = {f a (b 1 ),...,f a (b ϕ(m) )} {b 1...,b ϕ(m) } = {a b 1,...,a b ϕ(m) } b a b (mod m) b Z m b Z m b a ϕ(m) b (mod m) b Z m b Z p 1 a ϕ(m) (mod m)

6 Euler s phi function, ϕ(n) n ϕ(n) n ϕ(n) n ϕ(n) What s the pattern? For p prime, ϕ(p) = p 1 ϕ(p k+1 ) = (p 1)p k If gcd(a,b) = 1, ϕ(ab) = ϕ(a)ϕ(b) Why? CRT,... For primes, p q, ϕ(pq) = (p 1)(q 1)

7 Cryptography A B E One-Time Pad: a perfectly secure cryptosystem p Σ n b m Σ n b E(p,x) = p x D(p,x) = p x D(p,E(p,m)) = p (p m) = m Encryption and decryption functions are the same: bitwise exclusive or with random, secret one-time pad, p.

8 One-Time Pad, Continued p m E(p, m) D(p, E(p, m)) Thm: If p is chosen at random and known only to A and B, Then E(p,m) provides no information to E about m except perhaps its length. Better not use p more than once!

9 Public-Key Cryptography Idea: [Diffie, Hellman, 1976] Using computational complexity, I may be able to publish a key for sending secret messages to me, that are intractable for anyone but me to decode. Diffie-Hellman key exchange: uses discrete logs; but requires interaction. Realization of PKC: [Rivest, Shamir, Adleman, 1976] For slightly over 3 weeks, each day Rivest and Shamir came up with a new scheme to do public-key cryptography,..., and by the next morning Adleman had broken it. The 23rd scheme, Adleman couldn t break. This is the RSA Public-Key Algorithm that is used today in the SSL algorithm that lets your browser generate a key to send an order to Amazon.com without, we believe, divulging any useful information about your credit card number, or what you bought.

10 RSA B chooses p, q n-bit primes, and e, s.t. gcd(e, ϕ(pq)) = 1 B publishes: pq, e; keeps p, q secret. Using Euclid s algorithm, B computes d, k, s.t. ed +kϕ(pq) = 1 [ϕ(pq) = (p 1)(q 1)]. [Break message into pieces shorter than 2n bits] E B (x) x e (mod pq) D B (x) x d (mod pq) D B (E B (m)) (m e ) d (mod pq) m 1 kϕ(pq) (mod pq) m (m ϕ(pq) ) k (mod pq) m (mod pq) by Euler s Thm E B (D B (m)) (mod pq)

11 For sufficiently large n, [n 1000 bits is currently fine], It is widely believed that: E B (m) divulges no useful information about m to anyone not knowing p,q, or d. Message signing: Let m = B promises to give A $10 by 12/17/13. Let m = m,r where r is nonce or current date and time. It is widely believed that: D B (m ) could be produced only by B. Thus it can be used as a contract signed by B. Useful for proving authenticity.

12 To generate an RSA key, we need two large primes, p,q. Factoring large numbers seems to be hard. But primality testing is easy.

13 Primality Testing a Z m is a quadratic residue mod m iff, b(b2 a(modm)) For p prime let, ( ) a = p { 1 if a is a quadratic residue mod p 1 otherwise Generalize to ( a m) when m is not prime, ( a ) mn ( a m) = = ( a )( a m n) ( ) (a mod m) m

14 Quadratic Reciprocity Thm: [Gauss] For odd a, m, ( a m) ( ) 2 m = = { ( m ) a if a 1(mod4) or m 1(mod4) ( ) m a if a 3(mod4) and m 3(mod4) { 1 if m 1(mod8) or m 7(mod8) 1 if m 3(mod8) or m 5(mod8) Thus, we can calculate ( a m) efficiently.

15 ( ) ( ) ( ) = = ( )( ) ( ) = = ( ) 2 = = (mod 4); 107 3(mod8); 15 7(mod8) ( a m) = { ( m ) a ( ) m a if a 1(mod4) or m 1(mod4) if a 3(mod4) and m 3(mod4) ( ) 2 m = { 1 if m 1(mod8) or m 7(mod8) 1 if m 3(mod8) or m 5(mod8)

16 Fact:[Gauss] For p prime, a Z p, Fact: If m not prime then, { a Z m ( a p) a p 1 2 (modp). ( a ) a m 1 2 (modm) } m 1 < m 2 Solovay-Strassen Primality Algorithm: 1. Input is odd number m 2. For i := 1 to k do { 3. choose a < m at random 4. if GCD(a, m) 1 return( not prime ) 5. if ( ) m 1 a m a 2 (mod m) return( not prime ) 6. } 7. return( probably prime )

17 Thm: If m is prime then Solovay-Strassen(m) returns probably prime. If m is not prime, then the probability that Solovay-Strassen(m) returns probably prime is less than 1/2 k. Cor: We can test primality easily via the above randomized algorithm. Since primes are plentiful, we can efficiently find random primes and thus construct RSA keys. Fact: [Agrawal, Kayal, and Saxena, 2002] Primality P

18 First Test: 7:15 to 8:45 p.m. on Feb 21 in Goessmann 64. Go over the homeworks, 1 to 3. Go over all of the lecture slides, through L7. Go over all of the discussion problems, through D3. D4: Review: Tuesday, Feb. 19 (a UMass Monday). closed book, closed notes, no computers or calculators. Numerical problems simple enough to do by hand. My office hour today is cancelled; extra office hour: Wed. 2/20: 12:30-1:30 pm.