Factoring integers, Producing primes and the RSA cryptosystem Harish-Chandra Research Institute
|
|
|
- Cordelia Horn
- 10 years ago
- Views:
Transcription
1 RSA cryptosystem HRI, Allahabad, February, Factoring integers, Producing primes and the RSA cryptosystem Harish-Chandra Research Institute Allahabad (UP), INDIA February, 2005
2 RSA cryptosystem HRI, Allahabad, February,
3 RSA cryptosystem HRI, Allahabad, February, RSA 2048 =
4 RSA cryptosystem HRI, Allahabad, February, RSA 2048 = RSA 2048 is a 617 (decimal) digit number
5 RSA cryptosystem HRI, Allahabad, February, RSA 2048 = RSA 2048 is a 617 (decimal) digit number
6 RSA cryptosystem HRI, Allahabad, February, RSA 2048 =p q, p, q
7 RSA cryptosystem HRI, Allahabad, February, RSA 2048 =p q, p, q PROBLEM: Compute p and q
8 RSA cryptosystem HRI, Allahabad, February, RSA 2048 =p q, p, q PROBLEM: Compute p and q Price: US$ ( 87, 36, 000 Indian Rupee)!!
9 RSA cryptosystem HRI, Allahabad, February, RSA 2048 =p q, p, q PROBLEM: Compute p and q Price: US$ ( 87, 36, 000 Indian Rupee)!! Theorem. If a N! p 1 < p 2 < < p k primes s.t. a = p α 1 1 pα k k
10 RSA cryptosystem HRI, Allahabad, February, RSA 2048 =p q, p, q PROBLEM: Compute p and q Price: US$ ( 87, 36, 000 Indian Rupee)!! Theorem. If a N! p 1 < p 2 < < p k primes s.t. a = p α 1 1 pα k k Regrettably: RSAlabs believes that factoring in one year requires: number computers memory RSA Tb RSA , 000, Gb RSA ,000 4Gb.
11 RSA cryptosystem HRI, Allahabad, February,
12 RSA cryptosystem HRI, Allahabad, February, Challenge Number Prize ($US) RSA 576 $10,000 RSA 640 $20,000 RSA 704 $30,000 RSA 768 $50,000 RSA 896 $75,000 RSA 1024 $100,000 RSA 1536 $150,000 RSA 2048 $200,000
13 RSA cryptosystem HRI, Allahabad, February, Challenge Number Prize ($US) Status RSA 576 $10,000 Factored December 2003 RSA 640 $20,000 Not Factored RSA 704 $30,000 Not Factored RSA 768 $50,000 Not Factored RSA 896 $75,000 Not Factored RSA 1024 $100,000 Not Factored RSA 1536 $150,000 Not Factored RSA 2048 $200,000 Not Factored
14 RSA cryptosystem HRI, Allahabad, February, History of the Art of Factoring
15 RSA cryptosystem HRI, Allahabad, February, History of the Art of Factoring 220 BC Greeks (Eratosthenes of Cyrene )
16 RSA cryptosystem HRI, Allahabad, February, History of the Art of Factoring 220 BC Greeks (Eratosthenes of Cyrene ) 1730 Euler =
17 RSA cryptosystem HRI, Allahabad, February, History of the Art of Factoring 220 BC Greeks (Eratosthenes of Cyrene ) 1730 Euler = Fermat, Gauss (Sieves - Tables)
18 RSA cryptosystem HRI, Allahabad, February, History of the Art of Factoring 220 BC Greeks (Eratosthenes of Cyrene ) 1730 Euler = Fermat, Gauss (Sieves - Tables) 1880 Landry & Le Lasseur: =
19 RSA cryptosystem HRI, Allahabad, February, History of the Art of Factoring 220 BC Greeks (Eratosthenes of Cyrene ) 1730 Euler = Fermat, Gauss (Sieves - Tables) 1880 Landry & Le Lasseur: = Pierre and Eugène Carissan (Factoring Machine)
20 RSA cryptosystem HRI, Allahabad, February, History of the Art of Factoring 220 BC Greeks (Eratosthenes of Cyrene ) 1730 Euler = Fermat, Gauss (Sieves - Tables) 1880 Landry & Le Lasseur: = Pierre and Eugène Carissan (Factoring Machine) 1970 Morrison & Brillhart =
21 RSA cryptosystem HRI, Allahabad, February, History of the Art of Factoring 220 BC Greeks (Eratosthenes of Cyrene ) 1730 Euler = Fermat, Gauss (Sieves - Tables) 1880 Landry & Le Lasseur: = Pierre and Eugène Carissan (Factoring Machine) 1970 Morrison & Brillhart = Quadratic Sieve QS (Pomerance) Number Fields Sieve NFS
22 RSA cryptosystem HRI, Allahabad, February, History of the Art of Factoring 220 BC Greeks (Eratosthenes of Cyrene ) 1730 Euler = Fermat, Gauss (Sieves - Tables) 1880 Landry & Le Lasseur: = Pierre and Eugène Carissan (Factoring Machine) 1970 Morrison & Brillhart = Quadratic Sieve QS (Pomerance) Number Fields Sieve NFS 1987 Elliptic curves factoring ECF (Lenstra)
23 RSA cryptosystem HRI, Allahabad, February, Carissan s ancient Factoring Machine
24 RSA cryptosystem HRI, Allahabad, February, Carissan s ancient Factoring Machine Figure 1: Conservatoire Nationale des Arts et Métiers in Paris
25 RSA cryptosystem HRI, Allahabad, February, Carissan s ancient Factoring Machine Figure 1: Conservatoire Nationale des Arts et Métiers in Paris shallit/papers/carissan.html
26 RSA cryptosystem HRI, Allahabad, February, Figure 2: Lieutenant Eugène Carissan
27 RSA cryptosystem HRI, Allahabad, February, Figure 2: Lieutenant Eugène Carissan = minutes = minutes = minutes
28 RSA cryptosystem HRI, Allahabad, February, Contemporary Factoring
29 RSA cryptosystem HRI, Allahabad, February, Contemporary Factoring ❶ 1994, Quadratic Sieve (QS): (8 months, 600 voluntaries, 20 countries) D.Atkins, M. Graff, A. Lenstra, P. Leyland RSA 129 = = =
30 RSA cryptosystem HRI, Allahabad, February, Contemporary Factoring ❶ 1994, Quadratic Sieve (QS): (8 months, 600 voluntaries, 20 countries) D.Atkins, M. Graff, A. Lenstra, P. Leyland RSA 129 = = = ❷ (February ), Number Fields Sieve (NFS): (160 Sun, 4 months) RSA 155 = = =
31 RSA cryptosystem HRI, Allahabad, February, Contemporary Factoring ❶ 1994, Quadratic Sieve (QS): (8 months, 600 voluntaries, 20 countries) D.Atkins, M. Graff, A. Lenstra, P. Leyland RSA 129 = = = ❷ (February ), Number Fields Sieve (NFS): (160 Sun, 4 months) RSA 155 = = = ❸ (December 3, 2003) (NFS): J. Franke et al. (174 decimal digits) RSA 576 = = =
32 RSA cryptosystem HRI, Allahabad, February, Contemporary Factoring ❶ 1994, Quadratic Sieve (QS): (8 months, 600 voluntaries, 20 countries) D.Atkins, M. Graff, A. Lenstra, P. Leyland RSA 129 = = = ❷ (February ), Number Fields Sieve (NFS): (160 Sun, 4 months) RSA 155 = = = ❸ (December 3, 2003) (NFS): J. Franke et al. (174 decimal digits) RSA 576 = = = ❹ Elliptic curves factoring: introduced by da H. Lenstra. suitable to find prime factors with 50 digits (small)
33 RSA cryptosystem HRI, Allahabad, February, Contemporary Factoring ❶ 1994, Quadratic Sieve (QS): (8 months, 600 voluntaries, 20 countries) D.Atkins, M. Graff, A. Lenstra, P. Leyland RSA 129 = = = ❷ (February ), Number Fields Sieve (NFS): (160 Sun, 4 months) RSA 155 = = = ❸ (December 3, 2003) (NFS): J. Franke et al. (174 decimal digits) RSA 576 = = = ❹ Elliptic curves factoring: introduced by da H. Lenstra. suitable to find prime factors with 50 digits (small)
34 RSA cryptosystem HRI, Allahabad, February, All: sub exponential running time
35 RSA cryptosystem HRI, Allahabad, February, RSA Adi Shamir, Ron L. Rivest, Leonard Adleman (1978)
36 RSA cryptosystem HRI, Allahabad, February, The RSA cryptosystem
37 RSA cryptosystem HRI, Allahabad, February, The RSA cryptosystem 1978 R. L. Rivest, A. Shamir, L. Adleman (Patent expired in 1998)
38 RSA cryptosystem HRI, Allahabad, February, The RSA cryptosystem 1978 R. L. Rivest, A. Shamir, L. Adleman (Patent expired in 1998) Problem: Alice wants to send the message P to Bob so that Charles cannot read it
39 RSA cryptosystem HRI, Allahabad, February, The RSA cryptosystem 1978 R. L. Rivest, A. Shamir, L. Adleman (Patent expired in 1998) Problem: Alice wants to send the message P to Bob so that Charles cannot read it A (Alice) B (Bob) C (Charles)
40 RSA cryptosystem HRI, Allahabad, February, The RSA cryptosystem 1978 R. L. Rivest, A. Shamir, L. Adleman (Patent expired in 1998) Problem: Alice wants to send the message P to Bob so that Charles cannot read it ❶ ❷ ❸ ❹ A (Alice) B (Bob) C (Charles)
41 RSA cryptosystem HRI, Allahabad, February, The RSA cryptosystem 1978 R. L. Rivest, A. Shamir, L. Adleman (Patent expired in 1998) Problem: Alice wants to send the message P to Bob so that Charles cannot read it A (Alice) B (Bob) C (Charles) ❶ Key generation Bob has to do it ❷ ❸ ❹
42 RSA cryptosystem HRI, Allahabad, February, The RSA cryptosystem 1978 R. L. Rivest, A. Shamir, L. Adleman (Patent expired in 1998) Problem: Alice wants to send the message P to Bob so that Charles cannot read it A (Alice) B (Bob) C (Charles) ❶ Key generation ❷ Encryption Bob has to do it Alice has to do it ❸ ❹
43 RSA cryptosystem HRI, Allahabad, February, The RSA cryptosystem 1978 R. L. Rivest, A. Shamir, L. Adleman (Patent expired in 1998) Problem: Alice wants to send the message P to Bob so that Charles cannot read it A (Alice) B (Bob) C (Charles) ❶ Key generation ❷ Encryption ❸ Decryption Bob has to do it Alice has to do it Bob has to do it ❹
44 RSA cryptosystem HRI, Allahabad, February, The RSA cryptosystem 1978 R. L. Rivest, A. Shamir, L. Adleman (Patent expired in 1998) Problem: Alice wants to send the message P to Bob so that Charles cannot read it A (Alice) B (Bob) C (Charles) ❶ Key generation ❷ Encryption ❸ Decryption ❹ Attack Bob has to do it Alice has to do it Bob has to do it Charles would like to do it
45 RSA cryptosystem HRI, Allahabad, February, Bob: Key generation
46 RSA cryptosystem HRI, Allahabad, February, Bob: Key generation
47 RSA cryptosystem HRI, Allahabad, February, Bob: Key generation He chooses randomly p and q primes (p, q )
48 RSA cryptosystem HRI, Allahabad, February, Bob: Key generation He chooses randomly p and q primes (p, q ) He computes M = p q, ϕ(m) = (p 1) (q 1)
49 RSA cryptosystem HRI, Allahabad, February, Bob: Key generation He chooses randomly p and q primes (p, q ) He computes M = p q, ϕ(m) = (p 1) (q 1) He chooses an integer e s.t.
50 RSA cryptosystem HRI, Allahabad, February, Bob: Key generation He chooses randomly p and q primes (p, q ) He computes M = p q, ϕ(m) = (p 1) (q 1) He chooses an integer e s.t. 0 e ϕ(m) and gcd(e, ϕ(m)) = 1
51 RSA cryptosystem HRI, Allahabad, February, Bob: Key generation He chooses randomly p and q primes (p, q ) He computes M = p q, ϕ(m) = (p 1) (q 1) He chooses an integer e s.t. 0 e ϕ(m) and gcd(e, ϕ(m)) = 1 Note. One could take e = 3 and p q 2 mod 3
52 RSA cryptosystem HRI, Allahabad, February, Bob: Key generation He chooses randomly p and q primes (p, q ) He computes M = p q, ϕ(m) = (p 1) (q 1) He chooses an integer e s.t. 0 e ϕ(m) and gcd(e, ϕ(m)) = 1 Note. One could take e = 3 and p q 2 mod 3 Experts recommend e =
53 RSA cryptosystem HRI, Allahabad, February, Bob: Key generation He chooses randomly p and q primes (p, q ) He computes M = p q, ϕ(m) = (p 1) (q 1) He chooses an integer e s.t. 0 e ϕ(m) and gcd(e, ϕ(m)) = 1 Note. One could take e = 3 and p q 2 mod 3 Experts recommend e = He computes arithmetic inverse d of e modulo ϕ(m)
54 RSA cryptosystem HRI, Allahabad, February, Bob: Key generation He chooses randomly p and q primes (p, q ) He computes M = p q, ϕ(m) = (p 1) (q 1) He chooses an integer e s.t. 0 e ϕ(m) and gcd(e, ϕ(m)) = 1 Note. One could take e = 3 and p q 2 mod 3 Experts recommend e = He computes arithmetic inverse d of e modulo ϕ(m) (i.e. d N (unique ϕ(m)) s.t. e d 1 (mod ϕ(m)))
55 RSA cryptosystem HRI, Allahabad, February, Bob: Key generation He chooses randomly p and q primes (p, q ) He computes M = p q, ϕ(m) = (p 1) (q 1) He chooses an integer e s.t. 0 e ϕ(m) and gcd(e, ϕ(m)) = 1 Note. One could take e = 3 and p q 2 mod 3 Experts recommend e = He computes arithmetic inverse d of e modulo ϕ(m) (i.e. d N (unique ϕ(m)) s.t. e d 1 (mod ϕ(m))) Publishes (M, e) public key and hides secret key d
56 RSA cryptosystem HRI, Allahabad, February, Bob: Key generation He chooses randomly p and q primes (p, q ) He computes M = p q, ϕ(m) = (p 1) (q 1) He chooses an integer e s.t. 0 e ϕ(m) and gcd(e, ϕ(m)) = 1 Note. One could take e = 3 and p q 2 mod 3 Experts recommend e = He computes arithmetic inverse d of e modulo ϕ(m) (i.e. d N (unique ϕ(m)) s.t. e d 1 (mod ϕ(m))) Publishes (M, e) public key and hides secret key d Problem: How does Bob do all this?- We will go came back to it!
57 RSA cryptosystem HRI, Allahabad, February, Alice: Encryption
58 RSA cryptosystem HRI, Allahabad, February, Alice: Encryption Represent the message P as an element of Z/MZ
59 RSA cryptosystem HRI, Allahabad, February, Alice: Encryption Represent the message P as an element of Z/MZ (for example) A 1 B 2 C 3... Z 26 AA 27...
60 RSA cryptosystem HRI, Allahabad, February, Alice: Encryption Represent the message P as an element of Z/MZ (for example) A 1 B 2 C 3... Z 26 AA Sukumar = Note. Better if texts are not too short. Otherwise one performs some padding
61 RSA cryptosystem HRI, Allahabad, February, Alice: Encryption Represent the message P as an element of Z/MZ (for example) A 1 B 2 C 3... Z 26 AA Sukumar = Note. Better if texts are not too short. Otherwise one performs some padding C = E(P) = P e (mod M)
62 RSA cryptosystem HRI, Allahabad, February, Alice: Encryption Represent the message P as an element of Z/MZ (for example) A 1 B 2 C 3... Z 26 AA Sukumar = Note. Better if texts are not too short. Otherwise one performs some padding C = E(P) = P e (mod M) Example: p = , q = , M = , e = = 65537, P = Sukumar:
63 RSA cryptosystem HRI, Allahabad, February, Alice: Encryption Represent the message P as an element of Z/MZ (for example) A 1 B 2 C 3... Z 26 AA Sukumar = Note. Better if texts are not too short. Otherwise one performs some padding C = E(P) = P e (mod M) Example: p = , q = , M = , e = = 65537, P = Sukumar: E(Sukumar) = (mod ) = = C = JGEBNBAUYTCOFJ
64 RSA cryptosystem HRI, Allahabad, February, Bob: Decryption
65 RSA cryptosystem HRI, Allahabad, February, Bob: Decryption P = D(C) = C d (mod M)
66 RSA cryptosystem HRI, Allahabad, February, Bob: Decryption P = D(C) = C d (mod M) Note. Bob decrypts because he is the only one that knows d.
67 RSA cryptosystem HRI, Allahabad, February, Bob: Decryption P = D(C) = C d (mod M) Note. Bob decrypts because he is the only one that knows d. Theorem. (Euler) If a, m N, gcd(a, m) = 1, a ϕ(m) 1 (mod m). If n 1 n 2 mod ϕ(m) then a n 1 a n 2 mod m.
68 RSA cryptosystem HRI, Allahabad, February, Bob: Decryption P = D(C) = C d (mod M) Note. Bob decrypts because he is the only one that knows d. Theorem. (Euler) If a, m N, gcd(a, m) = 1, a ϕ(m) 1 (mod m). If n 1 n 2 mod ϕ(m) then a n 1 a n 2 mod m. Therefore (ed 1 mod ϕ(m)) D(E(P)) = P ed P mod M
69 RSA cryptosystem HRI, Allahabad, February, Bob: Decryption P = D(C) = C d (mod M) Note. Bob decrypts because he is the only one that knows d. Therefore (ed 1 mod ϕ(m)) Theorem. (Euler) If a, m N, gcd(a, m) = 1, a ϕ(m) 1 (mod m). If n 1 n 2 mod ϕ(m) then a n 1 a n 2 mod m. D(E(P)) = P ed P mod M Example(cont.):d = mod ϕ( ) = D(JGEBNBAUYTCOFJ) = (mod ) = Sukumar
70 RSA cryptosystem HRI, Allahabad, February, RSA at work
71 RSA cryptosystem HRI, Allahabad, February, Repeated squaring algorithm
72 RSA cryptosystem HRI, Allahabad, February, Repeated squaring algorithm Problem: How does one compute a b mod c?
73 RSA cryptosystem HRI, Allahabad, February, Repeated squaring algorithm Problem: How does one compute a b mod c? (mod )
74 RSA cryptosystem HRI, Allahabad, February, Repeated squaring algorithm Problem: How does one compute a b mod c? (mod )
75 RSA cryptosystem HRI, Allahabad, February, Repeated squaring algorithm Problem: How does one compute a b mod c? (mod ) Compute the binary expansion b = [log 2 b] j=0 ɛ j 2 j
76 RSA cryptosystem HRI, Allahabad, February, Repeated squaring algorithm Problem: How does one compute a b mod c? (mod ) Compute the binary expansion b = [log 2 b] j=0 ɛ j 2 j =
77 RSA cryptosystem HRI, Allahabad, February, Repeated squaring algorithm Problem: How does one compute a b mod c? (mod ) Compute the binary expansion b = [log 2 b] j=0 ɛ j 2 j = Compute recursively a 2j mod c, j = 1,..., [log 2 b]:
78 RSA cryptosystem HRI, Allahabad, February, Repeated squaring algorithm Problem: How does one compute a b mod c? (mod ) Compute the binary expansion b = [log 2 b] j=0 ɛ j 2 j = Compute recursively a 2j mod c, j = 1,..., [log 2 b]: ( 2 a 2j mod c = a 2j 1 mod c) mod c
79 RSA cryptosystem HRI, Allahabad, February, Repeated squaring algorithm Problem: How does one compute a b mod c? (mod ) Compute the binary expansion b = [log 2 b] j=0 ɛ j 2 j = Compute recursively a 2j mod c, j = 1,..., [log 2 b]: ( 2 a 2j mod c = a 2j 1 mod c) mod c Multiply the a 2j mod c with ɛ j = 1
80 RSA cryptosystem HRI, Allahabad, February, Repeated squaring algorithm Problem: How does one compute a b mod c? (mod ) Compute the binary expansion b = [log 2 b] j=0 ɛ j 2 j = Compute recursively a 2j mod c, j = 1,..., [log 2 b]: ( 2 a 2j mod c = a 2j 1 mod c) mod c Multiply the a 2j mod c with ɛ j = 1 ) a b mod c = mod c ( [log2 b] j=0,ɛ j =1 a2j mod c
81 RSA cryptosystem HRI, Allahabad, February, #{oper. in Z/cZ to compute a b mod c} 2 log 2 b
82 RSA cryptosystem HRI, Allahabad, February, #{oper. in Z/cZ to compute a b mod c} 2 log 2 b JGEBNBAUYTCOFJ is decrypted with 131 operations in Z/ Z
83 RSA cryptosystem HRI, Allahabad, February, #{oper. in Z/cZ to compute a b mod c} 2 log 2 b JGEBNBAUYTCOFJ is decrypted with 131 operations in Z/ Z Pseudo code: e c (a, b) = a b mod c
84 RSA cryptosystem HRI, Allahabad, February, #{oper. in Z/cZ to compute a b mod c} 2 log 2 b JGEBNBAUYTCOFJ is decrypted with 131 operations in Z/ Z Pseudo code: e c (a, b) = a b mod c e c (a, b) = if b = 1 then a mod c if 2 b then e c (a, b 2 )2 mod c else a e c (a, b 1 2 )2 mod c
85 RSA cryptosystem HRI, Allahabad, February, #{oper. in Z/cZ to compute a b mod c} 2 log 2 b JGEBNBAUYTCOFJ is decrypted with 131 operations in Z/ Z Pseudo code: e c (a, b) = a b mod c e c (a, b) = if b = 1 then a mod c if 2 b then e c (a, b 2 )2 mod c else a e c (a, b 1 2 )2 mod c To encrypt with e = , only 17 operations in Z/MZ are enough
86 RSA cryptosystem HRI, Allahabad, February, Key generation
87 RSA cryptosystem HRI, Allahabad, February, Key generation Problem. Produce a random prime p Probabilistic algorithm (type Las Vegas) 1. Let p = Random( ) 2. If isprime(p)=1 then Output=p else goto 1
88 RSA cryptosystem HRI, Allahabad, February, Key generation Problem. Produce a random prime p Probabilistic algorithm (type Las Vegas) 1. Let p = Random( ) 2. If isprime(p)=1 then Output=p else goto 1 subproblems:
89 RSA cryptosystem HRI, Allahabad, February, Key generation Problem. Produce a random prime p Probabilistic algorithm (type Las Vegas) 1. Let p = Random( ) 2. If isprime(p)=1 then Output=p else goto 1 subproblems: A. How many iterations are necessary? (i.e. how are primes distributes?)
90 RSA cryptosystem HRI, Allahabad, February, Key generation Problem. Produce a random prime p Probabilistic algorithm (type Las Vegas) 1. Let p = Random( ) 2. If isprime(p)=1 then Output=p else goto 1 subproblems: A. How many iterations are necessary? (i.e. how are primes distributes?) B. How does one check if p is prime? (i.e. how does one compute isprime(p)?) Primality test
91 RSA cryptosystem HRI, Allahabad, February, Key generation Problem. Produce a random prime p Probabilistic algorithm (type Las Vegas) 1. Let p = Random( ) 2. If isprime(p)=1 then Output=p else goto 1 subproblems: A. How many iterations are necessary? (i.e. how are primes distributes?) B. How does one check if p is prime? (i.e. how does one compute isprime(p)?) Primality test False Metropolitan Legend: Check primality is equivalent to factoring
92 RSA cryptosystem HRI, Allahabad, February, A. Distribution of prime numbers
93 RSA cryptosystem HRI, Allahabad, February, A. Distribution of prime numbers π(x) = #{p x t. c. p is prime}
94 RSA cryptosystem HRI, Allahabad, February, A. Distribution of prime numbers π(x) = #{p x t. c. p is prime} Theorem. (Hadamard - de la vallee Pussen ) π(x) x log x
95 RSA cryptosystem HRI, Allahabad, February, A. Distribution of prime numbers Quantitative version: π(x) = #{p x t. c. p is prime} Theorem. (Hadamard - de la vallee Pussen ) π(x) x log x Theorem. (Rosser - Schoenfeld) if x 67 x log x 1/2 < π(x) < x log x 3/2
96 RSA cryptosystem HRI, Allahabad, February, A. Distribution of prime numbers Quantitative version: Therefore π(x) = #{p x t. c. p is prime} Theorem. (Hadamard - de la vallee Pussen ) π(x) x log x Theorem. (Rosser - Schoenfeld) if x 67 x log x 1/2 < π(x) < x log x 3/ < P rob (Random( ) = prime <
97 RSA cryptosystem HRI, Allahabad, February, If P k is the probability that among k random numbers there is a prime one, then
98 RSA cryptosystem HRI, Allahabad, February, If P k is the probability that among k random numbers there is a prime one, then P k = 1 ( ) k 1 π(10100 )
99 RSA cryptosystem HRI, Allahabad, February, If P k is the probability that among k random numbers there is a prime one, then P k = 1 ( ) k 1 π(10100 ) Therefore < P 250 <
100 RSA cryptosystem HRI, Allahabad, February, If P k is the probability that among k random numbers there is a prime one, then P k = 1 ( ) k 1 π(10100 ) Therefore < P 250 < To speed up the process: One can consider only odd random numbers not divisible by 3 nor by 5.
101 RSA cryptosystem HRI, Allahabad, February, If P k is the probability that among k random numbers there is a prime one, then P k = 1 ( ) k 1 π(10100 ) Therefore < P 250 < To speed up the process: One can consider only odd random numbers not divisible by 3 nor by 5. Let Ψ(x, 30) = # {n x s.t. gcd(n, 30) = 1}
102 RSA cryptosystem HRI, Allahabad, February, To speed up the process: One can consider only odd random numbers not divisible by 3 nor by 5.
103 RSA cryptosystem HRI, Allahabad, February, To speed up the process: One can consider only odd random numbers not divisible by 3 nor by 5. Let Ψ(x, 30) = # {n x s.t. gcd(n, 30) = 1} then
104 RSA cryptosystem HRI, Allahabad, February, To speed up the process: One can consider only odd random numbers not divisible by 3 nor by 5. Let Ψ(x, 30) = # {n x s.t. gcd(n, 30) = 1} then 4 15 x 4 < Ψ(x, 30) < 4 15 x + 4
105 RSA cryptosystem HRI, Allahabad, February, To speed up the process: One can consider only odd random numbers not divisible by 3 nor by 5. Let Ψ(x, 30) = # {n x s.t. gcd(n, 30) = 1} then 4 15 x 4 < Ψ(x, 30) < 4 15 x + 4 Hence, if P k is the probability that among k random numbers coprime with 30, there is a prime one, then
106 RSA cryptosystem HRI, Allahabad, February, To speed up the process: One can consider only odd random numbers not divisible by 3 nor by 5. Let Ψ(x, 30) = # {n x s.t. gcd(n, 30) = 1} then 4 15 x 4 < Ψ(x, 30) < 4 15 x + 4 Hence, if P k is the probability that among k random numbers coprime with 30, there is a prime one, then P k = 1 ( ) k 1 π(10100 ) Ψ(10 100, 30)
107 RSA cryptosystem HRI, Allahabad, February, To speed up the process: One can consider only odd random numbers not divisible by 3 nor by 5. Let Ψ(x, 30) = # {n x s.t. gcd(n, 30) = 1} then 4 15 x 4 < Ψ(x, 30) < 4 15 x + 4 Hence, if P k is the probability that among k random numbers coprime with 30, there is a prime one, then P k = 1 ( ) k 1 π(10100 ) Ψ(10 100, 30)
108 RSA cryptosystem HRI, Allahabad, February, and < P 250 <
109 RSA cryptosystem HRI, Allahabad, February, B. Primality test
110 RSA cryptosystem HRI, Allahabad, February, B. Primality test Fermat Little Theorem. If p is prime, p a N a p 1 1 mod p
111 RSA cryptosystem HRI, Allahabad, February, B. Primality test Fermat Little Theorem. If p is prime, p a N a p 1 1 mod p NON-primality test M Z, 2 M 1 1 mod M => Mcomposite!
112 RSA cryptosystem HRI, Allahabad, February, B. Primality test Fermat Little Theorem. If p is prime, p a N a p 1 1 mod p NON-primality test M Z, 2 M 1 1 mod M => Mcomposite! Example: 2 RSA mod RSA 2048 Therefore RSA 2048 is composite!
113 RSA cryptosystem HRI, Allahabad, February, B. Primality test Fermat Little Theorem. If p is prime, p a N a p 1 1 mod p NON-primality test M Z, 2 M 1 1 mod M => Mcomposite! Example: 2 RSA mod RSA 2048 Therefore RSA 2048 is composite! Fermat little Theorem does not invert. Infact
114 RSA cryptosystem HRI, Allahabad, February, B. Primality test Fermat Little Theorem. If p is prime, p a N a p 1 1 mod p NON-primality test M Z, 2 M 1 1 mod M => Mcomposite! Example: 2 RSA mod RSA 2048 Therefore RSA 2048 is composite! Fermat little Theorem does not invert. Infact (mod 93961) but =
115 RSA cryptosystem HRI, Allahabad, February, Strong pseudo primes
116 RSA cryptosystem HRI, Allahabad, February, Strong pseudo primes From now on m 3 mod 4 (just to simplify the notation)
117 RSA cryptosystem HRI, Allahabad, February, Strong pseudo primes From now on m 3 mod 4 (just to simplify the notation) Definition. m N, m 3 mod 4, composite is said strong pseudo prime (SPSP) in base a if a (m 1)/2 ±1 (mod m).
118 RSA cryptosystem HRI, Allahabad, February, Strong pseudo primes From now on m 3 mod 4 (just to simplify the notation) Definition. m N, m 3 mod 4, composite is said strong pseudo prime (SPSP) in base a if a (m 1)/2 ±1 (mod m). Note. If p > 2 prime => a (p 1)/2 ±1 (mod p) Let S = {a Z/mZ s.t. gcd(m, a) = 1, a (m 1)/2 ±1 (mod m)}
119 RSA cryptosystem HRI, Allahabad, February, Strong pseudo primes From now on m 3 mod 4 (just to simplify the notation) Definition. m N, m 3 mod 4, composite is said strong pseudo prime (SPSP) in base a if a (m 1)/2 ±1 (mod m). Note. If p > 2 prime => a (p 1)/2 ±1 (mod p) Let S = {a Z/mZ s.t. gcd(m, a) = 1, a (m 1)/2 ±1 (mod m)} ➀ ➁ ➂ ➃
120 RSA cryptosystem HRI, Allahabad, February, Strong pseudo primes From now on m 3 mod 4 (just to simplify the notation) Definition. m N, m 3 mod 4, composite is said strong pseudo prime (SPSP) in base a if a (m 1)/2 ±1 (mod m). Note. If p > 2 prime => a (p 1)/2 ±1 (mod p) Let S = {a Z/mZ s.t. gcd(m, a) = 1, a (m 1)/2 ±1 (mod m)} ➀ S (Z/mZ) subgroup ➁ ➂ ➃
121 RSA cryptosystem HRI, Allahabad, February, Strong pseudo primes From now on m 3 mod 4 (just to simplify the notation) Definition. m N, m 3 mod 4, composite is said strong pseudo prime (SPSP) in base a if a (m 1)/2 ±1 (mod m). Note. If p > 2 prime => a (p 1)/2 ±1 (mod p) Let S = {a Z/mZ s.t. gcd(m, a) = 1, a (m 1)/2 ±1 (mod m)} ➀ S (Z/mZ) subgroup ➁ If m is composite => proper subgroup ➂ ➃
122 RSA cryptosystem HRI, Allahabad, February, Strong pseudo primes From now on m 3 mod 4 (just to simplify the notation) Definition. m N, m 3 mod 4, composite is said strong pseudo prime (SPSP) in base a if a (m 1)/2 ±1 (mod m). Note. If p > 2 prime => a (p 1)/2 ±1 (mod p) Let S = {a Z/mZ s.t. gcd(m, a) = 1, a (m 1)/2 ±1 (mod m)} ➀ S (Z/mZ) subgroup ➁ If m is composite => proper subgroup ➂ If m is composite => ➃ #S ϕ(m) 4
123 RSA cryptosystem HRI, Allahabad, February, Strong pseudo primes From now on m 3 mod 4 (just to simplify the notation) Definition. m N, m 3 mod 4, composite is said strong pseudo prime (SPSP) in base a if a (m 1)/2 ±1 (mod m). Note. If p > 2 prime => a (p 1)/2 ±1 (mod p) Let S = {a Z/mZ s.t. gcd(m, a) = 1, a (m 1)/2 ±1 (mod m)} ➀ S (Z/mZ) subgroup ➁ If m is composite => proper subgroup ➂ If m is composite => #S ϕ(m) 4 ➃ If m is composite => P rob(m PSPF in base a) 0, 25
124 RSA cryptosystem HRI, Allahabad, February, Miller Rabin primality test
125 RSA cryptosystem HRI, Allahabad, February, Let m 3 mod 4 Miller Rabin primality test
126 RSA cryptosystem HRI, Allahabad, February, Let m 3 mod 4 Miller Rabin primality test Miller Rabin algorithm with k iterations N = (m 1)/2 for j = 0 to k do a =Random(m) if a N ±1 mod m then OUPUT=(m composite): endfor OUTPUT=(m prime) END
127 RSA cryptosystem HRI, Allahabad, February, Let m 3 mod 4 Miller Rabin primality test Miller Rabin algorithm with k iterations N = (m 1)/2 for j = 0 to k do a =Random(m) if a N ±1 mod m then OUPUT=(m composite): endfor OUTPUT=(m prime) END Monte Carlo primality test
128 RSA cryptosystem HRI, Allahabad, February, Let m 3 mod 4 Miller Rabin primality test Miller Rabin algorithm with k iterations N = (m 1)/2 for j = 0 to k do a =Random(m) if a N ±1 mod m then OUPUT=(m composite): endfor OUTPUT=(m prime) END Monte Carlo primality test P rob(miller Rabin says m prime and m is composite) 1 4 k
129 RSA cryptosystem HRI, Allahabad, February, Let m 3 mod 4 Miller Rabin primality test Miller Rabin algorithm with k iterations N = (m 1)/2 for j = 0 to k do a =Random(m) if a N ±1 mod m then OUPUT=(m composite): endfor OUTPUT=(m prime) END Monte Carlo primality test P rob(miller Rabin says m prime and m is composite) 1 4 k In the real world, software uses Miller Rabin with k = 10
130 RSA cryptosystem HRI, Allahabad, February, Deterministic primality tests
131 RSA cryptosystem HRI, Allahabad, February, Deterministic primality tests Theorem. (Miller, Bach) If m is composite, then GRH => a 2 log 2 m s.t. a (m 1)/2 ±1 (mod m). (i.e. m is not SPSP in base a.)
132 RSA cryptosystem HRI, Allahabad, February, Deterministic primality tests Theorem. (Miller, Bach) If m is composite, then GRH => a 2 log 2 m s.t. a (m 1)/2 ±1 (mod m). (i.e. m is not SPSP in base a.) Consequence: Miller Rabin de randomizes on GRH (m 3 mod 4)
133 RSA cryptosystem HRI, Allahabad, February, Deterministic primality tests Theorem. (Miller, Bach) If m is composite, then GRH => a 2 log 2 m s.t. a (m 1)/2 ±1 (mod m). (i.e. m is not SPSP in base a.) Consequence: Miller Rabin de randomizes on GRH (m 3 mod 4) for a = 2 to 2 log 2 m do if a (m 1)/2 ±1 mod m then OUPUT=(m composite): endfor OUTPUT=(m prime) END
134 RSA cryptosystem HRI, Allahabad, February, Deterministic primality tests Theorem. (Miller, Bach) If m is composite, then GRH => a 2 log 2 m s.t. a (m 1)/2 ±1 (mod m). (i.e. m is not SPSP in base a.) Consequence: Miller Rabin de randomizes on GRH (m 3 mod 4) for a = 2 to 2 log 2 m do if a (m 1)/2 ±1 mod m then OUPUT=(m composite): endfor OUTPUT=(m prime) END Deterministic Polynomial time algorithm
135 RSA cryptosystem HRI, Allahabad, February, Deterministic primality tests Theorem. (Miller, Bach) If m is composite, then GRH => a 2 log 2 m s.t. a (m 1)/2 ±1 (mod m). (i.e. m is not SPSP in base a.) Consequence: Miller Rabin de randomizes on GRH (m 3 mod 4) for a = 2 to 2 log 2 m do if a (m 1)/2 ±1 mod m then OUPUT=(m composite): endfor OUTPUT=(m prime) END Deterministic Polynomial time algorithm It runs in O(log 5 m) operations in Z/mZ.
136 RSA cryptosystem HRI, Allahabad, February, Certified prime records
137 RSA cryptosystem HRI, Allahabad, February, Certified prime records
138 RSA cryptosystem HRI, Allahabad, February, Certified prime records , digits (discovered in 2003)
139 RSA cryptosystem HRI, Allahabad, February, Certified prime records , digits (discovered in 2003) , digits (discovered in 2001)
140 RSA cryptosystem HRI, Allahabad, February, Certified prime records , digits (discovered in 2003) , digits (discovered in 2001) , digits (discovered in 1999)
141 RSA cryptosystem HRI, Allahabad, February, Certified prime records , digits (discovered in 2003) , digits (discovered in 2001) , digits (discovered in 1999) , digits (discovered in 2003)
142 RSA cryptosystem HRI, Allahabad, February, Certified prime records , digits (discovered in 2003) , digits (discovered in 2001) , digits (discovered in 1999) , digits (discovered in 2003) , digits (discovered in 1998)
143 RSA cryptosystem HRI, Allahabad, February, Certified prime records , digits (discovered in 2003) , digits (discovered in 2001) , digits (discovered in 1999) , digits (discovered in 2003) , digits (discovered in 1998) , digits (discovered in 1997)
144 RSA cryptosystem HRI, Allahabad, February, Certified prime records , digits (discovered in 2003) , digits (discovered in 2001) , digits (discovered in 1999) , digits (discovered in 2003) , digits (discovered in 1998) , digits (discovered in 1997) , digits (discovered in 2003)
145 RSA cryptosystem HRI, Allahabad, February, Certified prime records , digits (discovered in 2003) , digits (discovered in 2001) , digits (discovered in 1999) , digits (discovered in 2003) , digits (discovered in 1998) , digits (discovered in 1997) , digits (discovered in 2003) , digits (discovered in 2003)
146 RSA cryptosystem HRI, Allahabad, February, The AKS deterministic primality test
147 RSA cryptosystem HRI, Allahabad, February, The AKS deterministic primality test Department of Computer Science & Engineering, I.I.T. Kanpur, Agost 8, 2002.
148 RSA cryptosystem HRI, Allahabad, February, The AKS deterministic primality test Department of Computer Science & Engineering, I.I.T. Kanpur, Agost 8, Nitin Saxena, Neeraj Kayal and Manindra Agarwal
149 RSA cryptosystem HRI, Allahabad, February, The AKS deterministic primality test Department of Computer Science & Engineering, I.I.T. Kanpur, Agost 8, Nitin Saxena, Neeraj Kayal and Manindra Agarwal New deterministic, polynomial time, primality test.
150 RSA cryptosystem HRI, Allahabad, February, The AKS deterministic primality test Department of Computer Science & Engineering, I.I.T. Kanpur, Agost 8, Nitin Saxena, Neeraj Kayal and Manindra Agarwal New deterministic, polynomial time, primality test. Solves #1 open question in computational number theory
151 RSA cryptosystem HRI, Allahabad, February, The AKS deterministic primality test Department of Computer Science & Engineering, I.I.T. Kanpur, Agost 8, Nitin Saxena, Neeraj Kayal and Manindra Agarwal New deterministic, polynomial time, primality test. Solves #1 open question in computational number theory
152 RSA cryptosystem HRI, Allahabad, February, How does the AKS work?
153 RSA cryptosystem HRI, Allahabad, February, How does the AKS work? Theorem. (AKS) Let n N. Assume q, r primes, S N finite: q r 1; n (r 1)/q mod r {0, 1}; gcd(n, b b ) = 1, b, b S (distinct); ( ) q+#s 1 #S n 2 r ; (x + b) n = x n + b in Z/nZ[x]/(x r 1), b S; Then n is a power of a prime Bernstein formulation
154 RSA cryptosystem HRI, Allahabad, February, How does the AKS work? Theorem. (AKS) Let n N. Assume q, r primes, S N finite: q r 1; n (r 1)/q mod r {0, 1}; gcd(n, b b ) = 1, b, b S (distinct); ( ) q+#s 1 #S n 2 r ; (x + b) n = x n + b in Z/nZ[x]/(x r 1), b S; Then n is a power of a prime Bernstein formulation Fouvry Theorem (1985) => r log 6 n, s log 4 n
155 RSA cryptosystem HRI, Allahabad, February, How does the AKS work? Theorem. (AKS) Let n N. Assume q, r primes, S N finite: q r 1; n (r 1)/q mod r {0, 1}; gcd(n, b b ) = 1, b, b S (distinct); ( ) q+#s 1 #S n 2 r ; (x + b) n = x n + b in Z/nZ[x]/(x r 1), b S; Then n is a power of a prime Bernstein formulation Fouvry Theorem (1985) => r log 6 n, s log 4 n => AKS runs in O(log 17 n) operations in Z/nZ.
156 RSA cryptosystem HRI, Allahabad, February, How does the AKS work? Theorem. (AKS) Let n N. Assume q, r primes, S N finite: q r 1; n (r 1)/q mod r {0, 1}; gcd(n, b b ) = 1, b, b S (distinct); ( ) q+#s 1 #S n 2 r ; (x + b) n = x n + b in Z/nZ[x]/(x r 1), b S; Then n is a power of a prime Bernstein formulation Fouvry Theorem (1985) => r log 6 n, s log 4 n => AKS runs in O(log 17 n) operations in Z/nZ. Many simplifications and improvements: Bernstein, Lenstra, Pomerance...
157 RSA cryptosystem HRI, Allahabad, February, Why is RSA safe?
158 RSA cryptosystem HRI, Allahabad, February, Why is RSA safe?
159 RSA cryptosystem HRI, Allahabad, February, Why is RSA safe? It is clear that if Charles can factor M,
160 RSA cryptosystem HRI, Allahabad, February, Why is RSA safe? It is clear that if Charles can factor M, then he can also compute ϕ(m) and then also d so to decrypt messages
161 RSA cryptosystem HRI, Allahabad, February, Why is RSA safe? It is clear that if Charles can factor M, then he can also compute ϕ(m) and then also d so to decrypt messages Computing ϕ(m) is equivalent to completely factor M. In fact
162 RSA cryptosystem HRI, Allahabad, February, Why is RSA safe? It is clear that if Charles can factor M, then he can also compute ϕ(m) and then also d so to decrypt messages Computing ϕ(m) is equivalent to completely factor M. In fact p, q = M ϕ(m) + 1 ± (M ϕ(m) + 1) 2 4M 2
163 RSA cryptosystem HRI, Allahabad, February, Why is RSA safe? It is clear that if Charles can factor M, then he can also compute ϕ(m) and then also d so to decrypt messages Computing ϕ(m) is equivalent to completely factor M. In fact p, q = M ϕ(m) + 1 ± (M ϕ(m) + 1) 2 4M 2 RSA Hypothesis. The only way to compute efficiently
164 RSA cryptosystem HRI, Allahabad, February, Why is RSA safe? It is clear that if Charles can factor M, then he can also compute ϕ(m) and then also d so to decrypt messages Computing ϕ(m) is equivalent to completely factor M. In fact p, q = M ϕ(m) + 1 ± (M ϕ(m) + 1) 2 4M 2 RSA Hypothesis. The only way to compute efficiently x 1/e mod M, x Z/MZ
165 RSA cryptosystem HRI, Allahabad, February, Why is RSA safe? It is clear that if Charles can factor M, then he can also compute ϕ(m) and then also d so to decrypt messages Computing ϕ(m) is equivalent to completely factor M. In fact p, q = M ϕ(m) + 1 ± (M ϕ(m) + 1) 2 4M 2 RSA Hypothesis. The only way to compute efficiently x 1/e mod M, x Z/MZ (i.e. decrypt messages) is to factor M
166 RSA cryptosystem HRI, Allahabad, February, Why is RSA safe? It is clear that if Charles can factor M, then he can also compute ϕ(m) and then also d so to decrypt messages Computing ϕ(m) is equivalent to completely factor M. In fact p, q = M ϕ(m) + 1 ± (M ϕ(m) + 1) 2 4M 2 RSA Hypothesis. The only way to compute efficiently x 1/e mod M, x Z/MZ (i.e. decrypt messages) is to factor M In other words
167 RSA cryptosystem HRI, Allahabad, February, Why is RSA safe? It is clear that if Charles can factor M, then he can also compute ϕ(m) and then also d so to decrypt messages Computing ϕ(m) is equivalent to completely factor M. In fact p, q = M ϕ(m) + 1 ± (M ϕ(m) + 1) 2 4M 2 RSA Hypothesis. The only way to compute efficiently x 1/e mod M, x Z/MZ (i.e. decrypt messages) is to factor M In other words The two problems are polynomially equivalent
168 RSA cryptosystem HRI, Allahabad, February, Two kinds of Cryptography
169 RSA cryptosystem HRI, Allahabad, February, Two kinds of Cryptography Private key (or symmetric) Lucifer DES AES
170 RSA cryptosystem HRI, Allahabad, February, Two kinds of Cryptography Private key (or symmetric) Lucifer DES AES Public key RSA Diffie Hellmann Knapsack NTRU
How To Factoring
Factoring integers,..., RSA Erbil, Kurdistan 0 Lecture in Number Theory College of Sciences Department of Mathematics University of Salahaddin Debember 1, 2014 Factoring integers, Producing primes and
Factoring integers and Producing primes
Factoring integers,..., RSA Erbil, Kurdistan 0 Lecture in Number Theory College of Sciences Department of Mathematics University of Salahaddin Debember 4, 2014 Factoring integers and Producing primes Francesco
Primality - Factorization
Primality - Factorization Christophe Ritzenthaler November 9, 2009 1 Prime and factorization Definition 1.1. An integer p > 1 is called a prime number (nombre premier) if it has only 1 and p as divisors.
Primality Testing and Factorization Methods
Primality Testing and Factorization Methods Eli Howey May 27, 2014 Abstract Since the days of Euclid and Eratosthenes, mathematicians have taken a keen interest in finding the nontrivial factors of integers,
Is n a Prime Number? Manindra Agrawal. March 27, 2006, Delft. IIT Kanpur
Is n a Prime Number? Manindra Agrawal IIT Kanpur March 27, 2006, Delft Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 1 / 47 Overview 1 The Problem 2 Two Simple, and Slow, Methods
Discrete Mathematics, Chapter 4: Number Theory and Cryptography
Discrete Mathematics, Chapter 4: Number Theory and Cryptography Richard Mayr University of Edinburgh, UK Richard Mayr (University of Edinburgh, UK) Discrete Mathematics. Chapter 4 1 / 35 Outline 1 Divisibility
Elements of Applied Cryptography Public key encryption
Network Security Elements of Applied Cryptography Public key encryption Public key cryptosystem RSA and the factorization problem RSA in practice Other asymmetric ciphers Asymmetric Encryption Scheme Let
Public Key Cryptography and RSA. Review: Number Theory Basics
Public Key Cryptography and RSA Murat Kantarcioglu Based on Prof. Ninghui Li s Slides Review: Number Theory Basics Definition An integer n > 1 is called a prime number if its positive divisors are 1 and
Mathematics of Internet Security. Keeping Eve The Eavesdropper Away From Your Credit Card Information
The : Keeping Eve The Eavesdropper Away From Your Credit Card Information Department of Mathematics North Dakota State University 16 September 2010 Science Cafe Introduction Disclaimer: is not an internet
Shor s algorithm and secret sharing
Shor s algorithm and secret sharing Libor Nentvich: QC 23 April 2007: Shor s algorithm and secret sharing 1/41 Goals: 1 To explain why the factoring is important. 2 To describe the oldest and most successful
Public Key Cryptography: RSA and Lots of Number Theory
Public Key Cryptography: RSA and Lots of Number Theory Public vs. Private-Key Cryptography We have just discussed traditional symmetric cryptography: Uses a single key shared between sender and receiver
Secure Network Communication Part II II Public Key Cryptography. Public Key Cryptography
Kommunikationssysteme (KSy) - Block 8 Secure Network Communication Part II II Public Key Cryptography Dr. Andreas Steffen 2000-2001 A. Steffen, 28.03.2001, KSy_RSA.ppt 1 Secure Key Distribution Problem
Lecture Note 5 PUBLIC-KEY CRYPTOGRAPHY. Sourav Mukhopadhyay
Lecture Note 5 PUBLIC-KEY CRYPTOGRAPHY Sourav Mukhopadhyay Cryptography and Network Security - MA61027 Modern/Public-key cryptography started in 1976 with the publication of the following paper. W. Diffie
Recent Breakthrough in Primality Testing
Nonlinear Analysis: Modelling and Control, 2004, Vol. 9, No. 2, 171 184 Recent Breakthrough in Primality Testing R. Šleževičienė, J. Steuding, S. Turskienė Department of Computer Science, Faculty of Physics
RSA and Primality Testing
and Primality Testing Joan Boyar, IMADA, University of Southern Denmark Studieretningsprojekter 2010 1 / 81 Correctness of cryptography cryptography Introduction to number theory Correctness of with 2
How To Solve The Prime Factorization Of N With A Polynomials
THE MATHEMATICS OF PUBLIC KEY CRYPTOGRAPHY. IAN KIMING 1. Forbemærkning. Det kan forekomme idiotisk, at jeg som dansktalende og skrivende i et danskbaseret tidsskrift med en (formentlig) primært dansktalende
MATH 168: FINAL PROJECT Troels Eriksen. 1 Introduction
MATH 168: FINAL PROJECT Troels Eriksen 1 Introduction In the later years cryptosystems using elliptic curves have shown up and are claimed to be just as secure as a system like RSA with much smaller key
Cryptography and Network Security
Cryptography and Network Security Spring 2012 http://users.abo.fi/ipetre/crypto/ Lecture 7: Public-key cryptography and RSA Ion Petre Department of IT, Åbo Akademi University 1 Some unanswered questions
Lecture 13 - Basic Number Theory.
Lecture 13 - Basic Number Theory. Boaz Barak March 22, 2010 Divisibility and primes Unless mentioned otherwise throughout this lecture all numbers are non-negative integers. We say that A divides B, denoted
Arithmetic algorithms for cryptology 5 October 2015, Paris. Sieves. Razvan Barbulescu CNRS and IMJ-PRG. R. Barbulescu Sieves 0 / 28
Arithmetic algorithms for cryptology 5 October 2015, Paris Sieves Razvan Barbulescu CNRS and IMJ-PRG R. Barbulescu Sieves 0 / 28 Starting point Notations q prime g a generator of (F q ) X a (secret) integer
Faster deterministic integer factorisation
David Harvey (joint work with Edgar Costa, NYU) University of New South Wales 25th October 2011 The obvious mathematical breakthrough would be the development of an easy way to factor large prime numbers
Cryptography and Network Security Chapter 9
Cryptography and Network Security Chapter 9 Fifth Edition by William Stallings Lecture slides by Lawrie Brown (with edits by RHB) Chapter 9 Public Key Cryptography and RSA Every Egyptian received two names,
An Overview of Integer Factoring Algorithms. The Problem
An Overview of Integer Factoring Algorithms Manindra Agrawal IITK / NUS The Problem Given an integer n, find all its prime divisors as efficiently as possible. 1 A Difficult Problem No efficient algorithm
The application of prime numbers to RSA encryption
The application of prime numbers to RSA encryption Prime number definition: Let us begin with the definition of a prime number p The number p, which is a member of the set of natural numbers N, is considered
Basic Algorithms In Computer Algebra
Basic Algorithms In Computer Algebra Kaiserslautern SS 2011 Prof. Dr. Wolfram Decker 2. Mai 2011 References Cohen, H.: A Course in Computational Algebraic Number Theory. Springer, 1993. Cox, D.; Little,
Applied Cryptography Public Key Algorithms
Applied Cryptography Public Key Algorithms Sape J. Mullender Huygens Systems Research Laboratory Universiteit Twente Enschede 1 Public Key Cryptography Independently invented by Whitfield Diffie & Martin
International Journal of Information Technology, Modeling and Computing (IJITMC) Vol.1, No.3,August 2013
FACTORING CRYPTOSYSTEM MODULI WHEN THE CO-FACTORS DIFFERENCE IS BOUNDED Omar Akchiche 1 and Omar Khadir 2 1,2 Laboratory of Mathematics, Cryptography and Mechanics, Fstm, University of Hassan II Mohammedia-Casablanca,
Cryptography and Network Security
Cryptography and Network Security Fifth Edition by William Stallings Chapter 9 Public Key Cryptography and RSA Private-Key Cryptography traditional private/secret/single key cryptography uses one key shared
Notes on Network Security Prof. Hemant K. Soni
Chapter 9 Public Key Cryptography and RSA Private-Key Cryptography traditional private/secret/single key cryptography uses one key shared by both sender and receiver if this key is disclosed communications
The Mathematics of the RSA Public-Key Cryptosystem
The Mathematics of the RSA Public-Key Cryptosystem Burt Kaliski RSA Laboratories ABOUT THE AUTHOR: Dr Burt Kaliski is a computer scientist whose involvement with the security industry has been through
How To Know If A Message Is From A Person Or A Machine
The RSA Algorithm Evgeny Milanov 3 June 2009 In 1978, Ron Rivest, Adi Shamir, and Leonard Adleman introduced a cryptographic algorithm, which was essentially to replace the less secure National Bureau
Overview of Public-Key Cryptography
CS 361S Overview of Public-Key Cryptography Vitaly Shmatikov slide 1 Reading Assignment Kaufman 6.1-6 slide 2 Public-Key Cryptography public key public key? private key Alice Bob Given: Everybody knows
RSA Attacks. By Abdulaziz Alrasheed and Fatima
RSA Attacks By Abdulaziz Alrasheed and Fatima 1 Introduction Invented by Ron Rivest, Adi Shamir, and Len Adleman [1], the RSA cryptosystem was first revealed in the August 1977 issue of Scientific American.
CS549: Cryptography and Network Security
CS549: Cryptography and Network Security by Xiang-Yang Li Department of Computer Science, IIT Cryptography and Network Security 1 Notice This lecture note (Cryptography and Network Security) is prepared
Public-Key Cryptanalysis 1: Introduction and Factoring
Public-Key Cryptanalysis 1: Introduction and Factoring Nadia Heninger University of Pennsylvania July 21, 2013 Adventures in Cryptanalysis Part 1: Introduction and Factoring. What is public-key crypto
Principles of Public Key Cryptography. Applications of Public Key Cryptography. Security in Public Key Algorithms
Principles of Public Key Cryptography Chapter : Security Techniques Background Secret Key Cryptography Public Key Cryptography Hash Functions Authentication Chapter : Security on Network and Transport
U.C. Berkeley CS276: Cryptography Handout 0.1 Luca Trevisan January, 2009. Notes on Algebra
U.C. Berkeley CS276: Cryptography Handout 0.1 Luca Trevisan January, 2009 Notes on Algebra These notes contain as little theory as possible, and most results are stated without proof. Any introductory
Cryptography and Network Security Chapter 8
Cryptography and Network Security Chapter 8 Fifth Edition by William Stallings Lecture slides by Lawrie Brown (with edits by RHB) Chapter 8 Introduction to Number Theory The Devil said to Daniel Webster:
Cryptography and Network Security Number Theory
Cryptography and Network Security Number Theory Xiang-Yang Li Introduction to Number Theory Divisors b a if a=mb for an integer m b a and c b then c a b g and b h then b (mg+nh) for any int. m,n Prime
Integer Factorization
Master Thesis D I K U Department of Computer Science University of Copenhagen Fall 2005 This document is typeset using L A TEX 2ε. ii Abstract Many public key cryptosystems depend on
Factoring & Primality
Factoring & Primality Lecturer: Dimitris Papadopoulos In this lecture we will discuss the problem of integer factorization and primality testing, two problems that have been the focus of a great amount
SECURITY IMPROVMENTS TO THE DIFFIE-HELLMAN SCHEMES
www.arpapress.com/volumes/vol8issue1/ijrras_8_1_10.pdf SECURITY IMPROVMENTS TO THE DIFFIE-HELLMAN SCHEMES Malek Jakob Kakish Amman Arab University, Department of Computer Information Systems, P.O.Box 2234,
CIS 5371 Cryptography. 8. Encryption --
CIS 5371 Cryptography p y 8. Encryption -- Asymmetric Techniques Textbook encryption algorithms In this chapter, security (confidentiality) is considered in the following sense: All-or-nothing secrecy.
Number Theory. Proof. Suppose otherwise. Then there would be a finite number n of primes, which we may
Number Theory Divisibility and Primes Definition. If a and b are integers and there is some integer c such that a = b c, then we say that b divides a or is a factor or divisor of a and write b a. Definition
Communications security
University of Roma Sapienza DIET Communications security Lecturer: Andrea Baiocchi DIET - University of Roma La Sapienza E-mail: [email protected] URL: http://net.infocom.uniroma1.it/corsi/index.htm
Study of algorithms for factoring integers and computing discrete logarithms
Study of algorithms for factoring integers and computing discrete logarithms First Indo-French Workshop on Cryptography and Related Topics (IFW 2007) June 11 13, 2007 Paris, France Dr. Abhijit Das Department
RSA Question 2. Bob thinks that p and q are primes but p isn t. Then, Bob thinks Φ Bob :=(p-1)(q-1) = φ(n). Is this true?
RSA Question 2 Bob thinks that p and q are primes but p isn t. Then, Bob thinks Φ Bob :=(p-1)(q-1) = φ(n). Is this true? Bob chooses a random e (1 < e < Φ Bob ) such that gcd(e,φ Bob )=1. Then, d = e -1
PRIMES is in P. Manindra Agrawal Neeraj Kayal Nitin Saxena
PRIMES is in P Manindra Agrawal Neeraj Kayal Nitin Saxena Department of Computer Science & Engineering Indian Institute of Technology Kanpur Kanpur-208016, INDIA Email: {manindra,kayaln,nitinsa}@iitk.ac.in
A Factoring and Discrete Logarithm based Cryptosystem
Int. J. Contemp. Math. Sciences, Vol. 8, 2013, no. 11, 511-517 HIKARI Ltd, www.m-hikari.com A Factoring and Discrete Logarithm based Cryptosystem Abdoul Aziz Ciss and Ahmed Youssef Ecole doctorale de Mathematiques
A Comparison Of Integer Factoring Algorithms. Keyur Anilkumar Kanabar
A Comparison Of Integer Factoring Algorithms Keyur Anilkumar Kanabar Batchelor of Science in Computer Science with Honours The University of Bath May 2007 This dissertation may be made available for consultation
Public-key cryptography RSA
Public-key cryptography RSA NGUYEN Tuong Lan LIU Yi Master Informatique University Lyon 1 Objective: Our goal in the study is to understand the algorithm RSA, some existence attacks and implement in Java.
3. Computational Complexity.
3. Computational Complexity. (A) Introduction. As we will see, most cryptographic systems derive their supposed security from the presumed inability of any adversary to crack certain (number theoretic)
1 Digital Signatures. 1.1 The RSA Function: The eth Power Map on Z n. Crypto: Primitives and Protocols Lecture 6.
1 Digital Signatures A digital signature is a fundamental cryptographic primitive, technologically equivalent to a handwritten signature. In many applications, digital signatures are used as building blocks
On Factoring Integers and Evaluating Discrete Logarithms
On Factoring Integers and Evaluating Discrete Logarithms A thesis presented by JOHN AARON GREGG to the departments of Mathematics and Computer Science in partial fulfillment of the honors requirements
Number Theory and Cryptography using PARI/GP
Number Theory and Cryptography using Minh Van Nguyen [email protected] 25 November 2008 This article uses to study elementary number theory and the RSA public key cryptosystem. Various commands will
Advanced Cryptography
Family Name:... First Name:... Section:... Advanced Cryptography Final Exam July 18 th, 2006 Start at 9:15, End at 12:00 This document consists of 12 pages. Instructions Electronic devices are not allowed.
Primes in Sequences. Lee 1. By: Jae Young Lee. Project for MA 341 (Number Theory) Boston University Summer Term I 2009 Instructor: Kalin Kostadinov
Lee 1 Primes in Sequences By: Jae Young Lee Project for MA 341 (Number Theory) Boston University Summer Term I 2009 Instructor: Kalin Kostadinov Lee 2 Jae Young Lee MA341 Number Theory PRIMES IN SEQUENCES
An Introduction to the RSA Encryption Method
April 17, 2012 Outline 1 History 2 3 4 5 History RSA stands for Rivest, Shamir, and Adelman, the last names of the designers It was first published in 1978 as one of the first public-key crytographic systems
The Future of Digital Signatures. Johannes Buchmann
The Future of Digital Signatures Johannes Buchmann Digital Signatures Digital signatures document sign signature verify valid / invalid secret public No IT-Security without digital signatures Software
EXAM questions for the course TTM4135 - Information Security June 2010. Part 1
EXAM questions for the course TTM4135 - Information Security June 2010 Part 1 This part consists of 6 questions all from one common topic. The number of maximal points for every correctly answered question
Cryptography: Authentication, Blind Signatures, and Digital Cash
Cryptography: Authentication, Blind Signatures, and Digital Cash Rebecca Bellovin 1 Introduction One of the most exciting ideas in cryptography in the past few decades, with the widest array of applications,
1720 - Forward Secrecy: How to Secure SSL from Attacks by Government Agencies
1720 - Forward Secrecy: How to Secure SSL from Attacks by Government Agencies Dave Corbett Technical Product Manager Implementing Forward Secrecy 1 Agenda Part 1: Introduction Why is Forward Secrecy important?
Determining the Optimal Combination of Trial Division and Fermat s Factorization Method
Determining the Optimal Combination of Trial Division and Fermat s Factorization Method Joseph C. Woodson Home School P. O. Box 55005 Tulsa, OK 74155 Abstract The process of finding the prime factorization
7! Cryptographic Techniques! A Brief Introduction
7! Cryptographic Techniques! A Brief Introduction 7.1! Introduction to Cryptography! 7.2! Symmetric Encryption! 7.3! Asymmetric (Public-Key) Encryption! 7.4! Digital Signatures! 7.5! Public Key Infrastructures
A SOFTWARE COMPARISON OF RSA AND ECC
International Journal Of Computer Science And Applications Vol. 2, No. 1, April / May 29 ISSN: 974-13 A SOFTWARE COMPARISON OF RSA AND ECC Vivek B. Kute Lecturer. CSE Department, SVPCET, Nagpur 9975549138
Integer Factorization using the Quadratic Sieve
Integer Factorization using the Quadratic Sieve Chad Seibert* Division of Science and Mathematics University of Minnesota, Morris Morris, MN 56567 [email protected] March 16, 2011 Abstract We give
Computer and Network Security
MIT 6.857 Computer and Networ Security Class Notes 1 File: http://theory.lcs.mit.edu/ rivest/notes/notes.pdf Revision: December 2, 2002 Computer and Networ Security MIT 6.857 Class Notes by Ronald L. Rivest
Software Implementation of Gong-Harn Public-key Cryptosystem and Analysis
Software Implementation of Gong-Harn Public-key Cryptosystem and Analysis by Susana Sin A thesis presented to the University of Waterloo in fulfilment of the thesis requirement for the degree of Master
Table of Contents. Bibliografische Informationen http://d-nb.info/996514864. digitalisiert durch
1 Introduction to Cryptography and Data Security 1 1.1 Overview of Cryptology (and This Book) 2 1.2 Symmetric Cryptography 4 1.2.1 Basics 4 1.2.2 Simple Symmetric Encryption: The Substitution Cipher...
Factoring. Factoring 1
Factoring Factoring 1 Factoring Security of RSA algorithm depends on (presumed) difficulty of factoring o Given N = pq, find p or q and RSA is broken o Rabin cipher also based on factoring Factoring like
Runtime and Implementation of Factoring Algorithms: A Comparison
Runtime and Implementation of Factoring Algorithms: A Comparison Justin Moore CSC290 Cryptology December 20, 2003 Abstract Factoring composite numbers is not an easy task. It is classified as a hard algorithm,
Computer Security: Principles and Practice
Computer Security: Principles and Practice Chapter 20 Public-Key Cryptography and Message Authentication First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Public-Key Cryptography
Public Key (asymmetric) Cryptography
Public-Key Cryptography UNIVERSITA DEGLI STUDI DI PARMA Dipartimento di Ingegneria dell Informazione Public Key (asymmetric) Cryptography Luca Veltri (mail.to: [email protected]) Course of Network Security,
CRYPTOG NETWORK SECURITY
CRYPTOG NETWORK SECURITY PRINCIPLES AND PRACTICES FOURTH EDITION William Stallings Prentice Hall Upper Saddle River, NJ 07458 'jkfetmhki^^rij^jibwfcmf «MMr""'-^.;
Symmetric Key cryptosystem
SFWR C03: Computer Networks and Computer Security Mar 8-11 200 Lecturer: Kartik Krishnan Lectures 22-2 Symmetric Key cryptosystem Symmetric encryption, also referred to as conventional encryption or single
The science of encryption: prime numbers and mod n arithmetic
The science of encryption: prime numbers and mod n arithmetic Go check your e-mail. You ll notice that the webpage address starts with https://. The s at the end stands for secure meaning that a process
Number Theory and the RSA Public Key Cryptosystem
Number Theory and the RSA Public Key Cryptosystem Minh Van Nguyen [email protected] 05 November 2008 This tutorial uses to study elementary number theory and the RSA public key cryptosystem. A number
Textbooks: Matt Bishop, Introduction to Computer Security, Addison-Wesley, November 5, 2004, ISBN 0-321-24744-2.
CSET 4850 Computer Network Security (4 semester credit hours) CSET Elective IT Elective Current Catalog Description: Theory and practice of network security. Topics include firewalls, Windows, UNIX and
Network Security. Computer Networking Lecture 08. March 19, 2012. HKU SPACE Community College. HKU SPACE CC CN Lecture 08 1/23
Network Security Computer Networking Lecture 08 HKU SPACE Community College March 19, 2012 HKU SPACE CC CN Lecture 08 1/23 Outline Introduction Cryptography Algorithms Secret Key Algorithm Message Digest
Lukasz Pater CMMS Administrator and Developer
Lukasz Pater CMMS Administrator and Developer EDMS 1373428 Agenda Introduction Why do we need asymmetric ciphers? One-way functions RSA Cipher Message Integrity Examples Secure Socket Layer Single Sign
Integer Factorization
Integer Factorization Lecture given at the Joh. Gutenberg-Universität, Mainz, July 23, 1992 by ÖYSTEIN J. RÖDSETH University of Bergen, Department of Mathematics, Allégt. 55, N-5007 Bergen, Norway 1 Introduction
Integer Factorization: Solution via Algorithm for Constrained Discrete Logarithm Problem
Journal of Computer Science 5 (9): 674-679, 009 ISSN 1549-3636 009 Science Publications Integer Factorization: Solution via Algorithm for Constrained Discrete Logarithm Problem Boris S. Verkhovsky Department
CRYPTOGRAPHY IN NETWORK SECURITY
ELE548 Research Essays CRYPTOGRAPHY IN NETWORK SECURITY AUTHOR: SHENGLI LI INSTRUCTOR: DR. JIEN-CHUNG LO Date: March 5, 1999 Computer network brings lots of great benefits and convenience to us. We can
IT IS EASY TO DETERMINE WHETHER A GIVEN INTEGER IS PRIME
BULLETIN (New Series) OF THE AMERICAN MATHEMATICAL SOCIETY Volume 42, Number 1, Pages 3 38 S 0273-0979(04)01037-7 Article electronically published on September 30, 2004 IT IS EASY TO DETERMINE WHETHER
Two Integer Factorization Methods
Two Integer Factorization Methods Christopher Koch April 22, 2014 Abstract Integer factorization methods are algorithms that find the prime divisors of any positive integer. Besides studying trial division
Network Security. Chapter 2 Basics 2.2 Public Key Cryptography. Public Key Cryptography. Public Key Cryptography
Chair for Network Architectures and Services Department of Informatics TU München Prof. Carle Encryption/Decryption using Public Key Cryptography Network Security Chapter 2 Basics 2.2 Public Key Cryptography
Index Calculation Attacks on RSA Signature and Encryption
Index Calculation Attacks on RSA Signature and Encryption Jean-Sébastien Coron 1, Yvo Desmedt 2, David Naccache 1, Andrew Odlyzko 3, and Julien P. Stern 4 1 Gemplus Card International {jean-sebastien.coron,david.naccache}@gemplus.com
CSCE 465 Computer & Network Security
CSCE 465 Computer & Network Security Instructor: Dr. Guofei Gu http://courses.cse.tamu.edu/guofei/csce465/ Public Key Cryptogrophy 1 Roadmap Introduction RSA Diffie-Hellman Key Exchange Public key and
Lecture 13: Factoring Integers
CS 880: Quantum Information Processing 0/4/0 Lecture 3: Factoring Integers Instructor: Dieter van Melkebeek Scribe: Mark Wellons In this lecture, we review order finding and use this to develop a method
Factoring Algorithms
Factoring Algorithms The p 1 Method and Quadratic Sieve November 17, 2008 () Factoring Algorithms November 17, 2008 1 / 12 Fermat s factoring method Fermat made the observation that if n has two factors
2 Primality and Compositeness Tests
Int. J. Contemp. Math. Sciences, Vol. 3, 2008, no. 33, 1635-1642 On Factoring R. A. Mollin Department of Mathematics and Statistics University of Calgary, Calgary, Alberta, Canada, T2N 1N4 http://www.math.ucalgary.ca/
On Generalized Fermat Numbers 3 2n +1
Applied Mathematics & Information Sciences 4(3) (010), 307 313 An International Journal c 010 Dixie W Publishing Corporation, U. S. A. On Generalized Fermat Numbers 3 n +1 Amin Witno Department of Basic
LUC: A New Public Key System
LUC: A New Public Key System Peter J. Smith a and Michael J. J. Lennon b a LUC Partners, Auckland UniServices Ltd, The University of Auckland, Private Bag 92019, Auckland, New Zealand. b Department of
FACTORING LARGE NUMBERS, A GREAT WAY TO SPEND A BIRTHDAY
FACTORING LARGE NUMBERS, A GREAT WAY TO SPEND A BIRTHDAY LINDSEY R. BOSKO I would like to acknowledge the assistance of Dr. Michael Singer. His guidance and feedback were instrumental in completing this
Continued Fractions. Darren C. Collins
Continued Fractions Darren C Collins Abstract In this paper, we discuss continued fractions First, we discuss the definition and notation Second, we discuss the development of the subject throughout history