Cryptosystem. RSA. Key Generation key gen. Input: Security parameter n. Output: secret key sk and public key pk.

Transcription

1 Cryptosystem. RSA. Key Generation key gen. Input: Security parameter n. Output: secret key sk and public key pk. 1. Choose two distinct primes p and q at random with 2 (n 1)/2 < p, q < 2 n/2. 2. N p q, L (p 1)(q 1). [N is an n-bit number, and L = φ(n) is the value of Euler s φ function.] 3. Choose e {2,...,L 2} at random, coprime to L. 4. Calculate the inverse d of einz L. 5. Publish the public key pk = (N,e) and keep sk = (N,d) as the secret key.

2 Cryptosystem. RSA. Encryption enc. Input: x Z N, pk = (N,e). Output: enc pk (x) Z N. 1. y x e in Z N. 2. Return enc pk (x) = y. Decryption dec. Input: y Z N, sk = (N,d). Output: dec sk (y) Z N. 3. x y d in Z N. 4. Return dec sk (y) = x. 26/28

3 security parameter n, distinct random primes p and q of n/2 bits, N = pq of n bits, L = φ(n) = (p 1)(q 1), e,d Z L \±1 with ed = 1 in Z L, plaintext x, ciphertext y, decryption x, all in Z N, y = x e, x = y d. Figure : The RSA notation. 25/28

4 Theorem There are infinitely many primes. Fermat s Theorem Let N be prime and x Z N with x 0. Then x N 1 = 1 in Z N. 24/28

5 Algorithm. Fermat test. Input: A number N Z with N 2. Output: Either N is composite, or N is possibly prime. 1. x {1,...,N 1}. 2. g gcd(x,n). If g 1, then Return N is composite. 3. y x N 1 inz N. 4. If y 1, then Return N is composite. 5. Return N is possibly prime. 23/28

6 Algorithm. Strong pseudoprimality test. Input: A number N Z with N 2. Output: Either N is composite, or N is probably prime. 1. x {1,...,N 1}. 2. If gcd(x,n) 1 then Return N is composite. 3. Write N 1 = 2 e m, where m is odd. 4. y x m in Z N. 5. If y = 1 then Return N is probably prime. 6. For i from 0 to e 1 do steps If y = 1 then Return N is probably prime, 8. otherwise y y 2 in Z N. 9. Return N is composite. 22/28

7 N N 1 = 2 e m y 0 y 1 y 2 y 3 y = Table : Testing 553,557, and /28

8 The strong pseudoprimality test has the following properties. (i) If N is prime, the test returns N is probably prime. (ii) If N is composite and not a Carmichael number, the test returns N is composite with probability at least 1/2. (iii) If N is a Carmichael number, the test returns a proper factor of N with probability at least 1/2. (iv) For an n-bit input N, the test uses O(n 3 ) bit operations. 20/28

9 The strong pseudoprimality test, repeated t times independently, has the following properties on input N. (i) If it outputs N is composite, then N is composite. (ii) If it outputs N is probably prime, then N is prime with probability at least 1 2 t. 19/28

10 Algorithm. Finding a pseudoprime. Input: An integer n and a confidence parameter t. Output: A number N in the range [2 (n 1)/2,2 n/2 ]. 1. x 2 (n 1)/2. 2. Repeat steps 3 and 4 Until some N is accepted. 3. N { x,..., 2x }. 4. Call the strong pseudoprimality test with input N for t independently chosen x {1,...,N 1}. Accept N if and only if all these tests return N is probably prime. Goto step 3 if at least one of the tests answers N is composite. 5. Return N. 18/28

11 Prime Number Theorem We have approximately and more precisely π(x) x lnx, ϑ(x) x, p n nlnn, x ( 1 ) x ( 3 ) 1+ < π(x) < 1+ for x 59, lnx 2lnx lnx 2lnx 3x 7x < π(2x) π(x) < for x 21, 5lnx 5lnx n ( lnn+lnlnn 3 ) < pn < n ( lnn+lnlnn 1 ) for n 20, 2 2 x ( 1 1 ) ( 1 ) < ϑ(x) < x 1+ for x lnx 2lnx 17/28

12 Theorem On input n 11 and t, the output of the Algorithm Finding a pseudoprime is prime with probability at least 1 2 t+1 n. It uses an expected number of O(tn 4 ) bit operations. 16/28

13 N c N /N Table : The probabilities that two random positive integers below N are coprime. 15/28

14 Find n/2-bit pseudoprimes at random O(n 4 logn), Find e O(n 2 logn), Calculate N and d O(n 2 ), Calculate powers modulo N O(n 3 ). 14/28

15 We consider as an attacker a (random) polynomial-time computer A. A knows pk = (N,e) and y = enc pk (x). There are several notions of breaking RSA. A might be able to compute from its knowledge one of the following data. B 1 : the plaintext x, B 2 : the hidden part d of the secret key S = (N,d) B 3 : the value φ(n) of Euler s totient function, B 4 : a factor p (and q) of N. 13/28

16 1. If A and B are two computational problems (given by an input/output specification), then a random polynomial-time reduction from A to B is a random polynomial-time algorithm for A which is allowed to make calls to an (unspecified) subroutine for B. The cost of such a call is the combined input plus output length in the call. If such a reduction exists, then A is random polynomial-time reducible to B, and we write A p B. If such a reduction exists that does not make use of randomization, then A is polynomial-time reducible to B. 2. If also B p A, we call A and B random polynomial-time equivalent and write A p B. 12/28

17 Wiener s attack In the RSA notation, suppose that p < q < 2p, 1 e < φ(n), and 1 d N 1/4 / 12. Then d can be computed from the public data in time O(n 2 ). 11/28

18 method year time trial division O (2 n/2 ) Pollard s p 1 method 1974 O (2 n/4 ) Pollard s ρ method 1975 O (2 n/4 ) Pollard s and Strassen s method 1976 O (2 n/4 ) Morrison s and Brillhart s continued fractions 1975 exp(o (n 1/2 )) Dixon s random squares, quadratic sieve 1981 exp(o (n 1/2 )) Lenstra s elliptic curves 1987 exp(o (n 1/2 )) number field sieve 1990 exp(o (n 1/3 )) 10/28

19 Birthday paradox We consider random choices, with replacement, among m labeled balls. The expected number of choices until a collision occurs is O( m). 9/28

20 We want to factor N = Starting with x 0 = 631, we find the following sequence: i x i mod N x i mod i x i mod N x i mod /28

21 x 4 x 5 x6 x 3 = x 10 x 7 x 9 x 8 x 2 x 1 x 0 Figure : Pollard s ρ method. 7/28

22 Algorithm. Pollard s ρ algorithm. Input: N N 3, neither a prime nor a perfect power. Output: Either a proper divisor of N, or failure. 1. Pick x 0 Z N at random, y 0 x 0, i 0 2. Repeat 3. i i+1, x i x 2 i 1 +1 in Z N, y i (y 2 i 1 +1)2 +1 in Z N 4. g gcd(x i y i,n) If 1 < g < N then Return g If g = N then Return failure 6/28

23 Theorem Let N N be a composite n-bit integer, p its smallest prime factor, and f(x) = x Under the assumption that the sequence (f i (x 0 )) i N behaves modulo p like a random sequence, the expected number of iterations in Pollard s algorithm for returning a proper factor of N is O( p), using an expected number of O(N 1/4 n 2 ) bit operations. 5/28

24 The algorithm calculates in tandem x i and y i = x 2i and performs the gcd test each time. We have t = 3, l = 7, j = 3/7, and i = 7. In fact, after seven 2-steps the algorithm catches up with the 1-steps: i x i mod N x i mod 41 y i mod N y i mod 41 gcd(x i y i,n) The factorization N = is found as gcd(x 7 y 7,N) = 41. 4/28

25 Let N = Suppose that we have found the equations = 7, = = 21. Then we obtain ( ) 2 = 21 2 in Z N, or = 21 2 in Z N. This yields the factors 37 = gcd(687 21,N) and 59 = gcd(687+21,n); in fact, N = is the prime factorization of N. 3/28

26 Algorithm. Dixon s random squares method. Input: An integer N 3, and B N 2. Output: Either a proper divisor of N, or failure. 1. Compute all primes p 1,p 2,...,p h up to B. 2. If p i divides N for some i {1,...,h} then Return p i. 3. A. 4. Repeat 5-11 Until #A = h Choose a uniform random number b Z N \{0}. 6. g gcd(b,n), If g > 1 then Return g. 7. a b 2 Z N. 8. For i = 1,...,h do α i While p i divides a do a a p i, α i α i If a = 1, then α (α 1,...,α h ), A A {(b,α)}. 12. Find distinct pairs (b 1,α (1) ),...,(b l,α (l) ) A with α (1) + +α (l) = 0 in Z h 2, for some l (δ 1,...,δ h ) 1 2 (α(1) + +α (l) ). 14. x 1 i l b i, y 1 j h pδj j, g gcd(x+y,n). 15. If 1 < g < N then Return g Else Return failure. 2/28

27 Example We have B = 7, factor base (2,3,5,7), b 1 = 453,b 2 = 1014,b 3 = 209, α (1) = (0,0,0,1),α (2) = (0,1,0,0),α (3) = (0,1,0,1), α (1) +α (2) +α (3) = (0,2,0,2) = (0,0,0,0) in Z 4 2, δ 1 = δ 3 = 0,δ 2 = δ 4 = 1, x = 687,y = 21, and gcd(687 21,N) = 37. In fact, there are exactly 71 7-numbers in Z N, excluding 0, 1, and N 1. Thus we expect 2182/71 31 random choices of b in order to find one 7-number. We have u = ln2183/ln7? and u u?. 1/28

28 Example We have B = 7, factor base (2,3,5,7), b 1 = 453,b 2 = 1014,b 3 = 209, α (1) = (0,0,0,1),α (2) = (0,1,0,0),α (3) = (0,1,0,1), α (1) +α (2) +α (3) = (0,2,0,2) = (0,0,0,0) in Z 4 2, δ 1 = δ 3 = 0,δ 2 = δ 4 = 1, x = 687,y = 21, and gcd(687 21,N) = 37. In fact, there are exactly 71 7-numbers in Z N, excluding 0, 1, and N 1. Thus we expect 2182/71 31 random choices of b in order to find one 7-number. We have u = ln2183/ln and u u /28