FactHacks: RSA factorization in the real world
|
|
|
- Kerry Ferdinand Bennett
- 10 years ago
- Views:
Transcription
1 FactHacks: RSA factorization in the real world Daniel J. Bernstein University of Illinois at Chicago Technische Universiteit Eindhoven Nadia Heninger Microsoft Research New England Tanja Lange Technische Universiteit Eindhoven
2
3
4
5 Preliminaries: Using Sage We wanted to give you working code examples. We re going to use Sage. Sage is free open source mathematics software. Download from Sage is based on Python sage: 2*3 6
6 Preliminaries: Using Sage We wanted to give you working code examples. We re going to use Sage. Sage is free open source mathematics software. Download from Sage is based on Python, but there are a few differences: sage: 2^3 8 ˆ is exponentiation, not xor
7 Preliminaries: Using Sage We wanted to give you working code examples. We re going to use Sage. Sage is free open source mathematics software. Download from Sage is based on Python, but there are a few differences: sage: 2^3 8 ˆ is exponentiation, not xor It has lots of useful libraries: sage: factor(15) 3 * 5
8 Preliminaries: Using Sage We wanted to give you working code examples. We re going to use Sage. Sage is free open source mathematics software. Download from Sage is based on Python, but there are a few differences: sage: 2^3 8 ˆ is exponentiation, not xor It has lots of useful libraries: sage: factor(15) 3 * 5 sage: factor(x^2-1) (x - 1) * (x + 1)
9 RSA Review p = random_prime(2^512) q = random_prime(2^512)
10 RSA Review p = random_prime(2^512) q = random_prime(2^512) Public Key N = p*q e = 3 or or 35...
11 RSA Review p = random_prime(2^512) q = random_prime(2^512) Public Key N = p*q e = 3 or or Private Key d = inverse_mod(e,(p-1)*(q-1))
12 RSA Review p = random_prime(2^512) q = random_prime(2^512) Public Key N = p*q e = 3 or or Private Key d = inverse_mod(e,(p-1)*(q-1)) message^e % n Decryption message = pow(ciphertext,d,n) Encryption ciphertext = pow(message,e,n)
13 RSA Review p = random_prime(2^512) q = random_prime(2^512) Public Key N = p*q e = 3 or or Private Key d = inverse_mod(e,(p-1)*(q-1)) message^e % n Decryption message = pow(ciphertext,d,n) Encryption ciphertext = pow(message,e,n) Warning: You must use message padding.
14 RSA and factoring Private Key d = inverse_mod(e,(p-1)*(q-1)) Public Key N = p*q e = 3 Fact: If we can factor N, can compute private key from public key. Factoring might not be the only way to break RSA: might be some way to compute message from ciphertext that doesn t reveal d or factorization of N. We don t know. Fact: Factoring not known to be NP-hard. It probably isn t.
15 So how hard is factoring?
16 So how hard is factoring? sage: time factor(random_prime(2^32)*random_prime(2^32))
17 So how hard is factoring? sage: time factor(random_prime(2^32)*random_prime(2^32)) * Time: CPU 0.01 s, Wall: 0.01 s
18 So how hard is factoring? sage: time factor(random_prime(2^32)*random_prime(2^32)) * Time: CPU 0.01 s, Wall: 0.01 s sage: time factor(random_prime(2^64)*random_prime(2^64))
19 So how hard is factoring? sage: time factor(random_prime(2^32)*random_prime(2^32)) * Time: CPU 0.01 s, Wall: 0.01 s sage: time factor(random_prime(2^64)*random_prime(2^64)) * Time: CPU 0.13 s, Wall: 0.15 s
20 So how hard is factoring? sage: time factor(random_prime(2^32)*random_prime(2^32)) * Time: CPU 0.01 s, Wall: 0.01 s sage: time factor(random_prime(2^64)*random_prime(2^64)) * Time: CPU 0.13 s, Wall: 0.15 s sage: time factor(random_prime(2^96)*random_prime(2^96))
21 So how hard is factoring? sage: time factor(random_prime(2^32)*random_prime(2^32)) * Time: CPU 0.01 s, Wall: 0.01 s sage: time factor(random_prime(2^64)*random_prime(2^64)) * Time: CPU 0.13 s, Wall: 0.15 s sage: time factor(random_prime(2^96)*random_prime(2^96)) * Time: CPU 4.64 s, Wall: 4.76 s
22 So how hard is factoring? sage: time factor(random_prime(2^32)*random_prime(2^32)) * Time: CPU 0.01 s, Wall: 0.01 s sage: time factor(random_prime(2^64)*random_prime(2^64)) * Time: CPU 0.13 s, Wall: 0.15 s sage: time factor(random_prime(2^96)*random_prime(2^96)) * Time: CPU 4.64 s, Wall: 4.76 s sage: time factor(random_prime(2^128)*random_prime(2^128))
23 So how hard is factoring? sage: time factor(random_prime(2^32)*random_prime(2^32)) * Time: CPU 0.01 s, Wall: 0.01 s sage: time factor(random_prime(2^64)*random_prime(2^64)) * Time: CPU 0.13 s, Wall: 0.15 s sage: time factor(random_prime(2^96)*random_prime(2^96)) * Time: CPU 4.64 s, Wall: 4.76 s sage: time factor(random_prime(2^128)*random_prime(2^128)) * Time: CPU s, Wall: s
24 Danger: Bad random-number generators Can the attacker get lucky and guess your p? No. There are >2 502 primes between and Each guess has chance <2 501 of matching your p or q.
25 Danger: Bad random-number generators Can the attacker get lucky and guess your p? No. There are >2 502 primes between and Each guess has chance <2 501 of matching your p or q. What if your system s random-number generator is busted? What if it s generating only 2 40 different choices for p?
26 The hard attack Download a target user s public key N = pq. Buy a bunch of devices. Try different software configurations. Generate billions of private keys. Check whether any of these primes divide the target N. Does anyone screw up random-number generation so badly?
27 The hard attack Download a target user s public key N = pq. Buy a bunch of devices. Try different software configurations. Generate billions of private keys. Check whether any of these primes divide the target N. Does anyone screw up random-number generation so badly? Yes!
28 The hard attack Download a target user s public key N = pq. Buy a bunch of devices. Try different software configurations. Generate billions of private keys. Check whether any of these primes divide the target N. Does anyone screw up random-number generation so badly? Yes! 1995 Goldberg Wagner: During any particular second, the Netscape browser generates only 2 47 possible keys.
29 The hard attack Download a target user s public key N = pq. Buy a bunch of devices. Try different software configurations. Generate billions of private keys. Check whether any of these primes divide the target N. Does anyone screw up random-number generation so badly? Yes! 1995 Goldberg Wagner: During any particular second, the Netscape browser generates only 2 47 possible keys Bello: Since 2006, Debian and Ubuntu are generating <2 20 possible keys for SSH, OpenVPN, etc.
30 The easy attack Download two target public keys N 1, N 2. Hope that they share a prime p: i.e., N 1 = pq 1, N 2 = pq 2. Not a surprise if N 1 = N 2, but what if N 1 N 2?
31 The easy attack Download two target public keys N 1, N 2. Hope that they share a prime p: i.e., N 1 = pq 1, N 2 = pq 2. Not a surprise if N 1 = N 2, but what if N 1 N 2? Euclid s algorithm prints the shared prime p given N 1, N 2. def greatestcommondivisor(n1,n2): # Euclid s algorithm while n1!= 0: n1,n2 = n2%n1,n1 return abs(n2) Built into Sage as gcd.
32 A small example of Euclid s algorithm sage: n1,n2 = 4187,5989 sage: n1,n2 = n2%n1,n1; print n sage: n1,n2 = n2%n1,n1; print n1 583 sage: n1,n2 = n2%n1,n1; print n1 53 sage: n1,n2 = n2%n1,n1; print n1 0 sage: 4187/53 # / is exact division, as in Python 3 79 sage: 5989/53 # use // if you want rounding division 113 So gcd{4187, 5989} = 53 and 4187 = and 5989 =
33 Euclid s algorithm is very fast sage: p = random_prime(2^512) sage: q1 = random_prime(2^512) sage: q2 = random_prime(2^512) sage: time g = gcd(p*q1,p*q2) Time: CPU 0.00 s, Wall: 0.00 s sage: g == p True
34 Finding shared factors of many inputs Download millions of public keys N 1, N 2, N 3, N 4,.... There are millions of millions of pairs to try: (N 1, N 2 ); (N 1, N 3 ); (N 2, N 3 ); (N 1, N 4 ); (N 2, N 4 ); etc.
35 Finding shared factors of many inputs Download millions of public keys N 1, N 2, N 3, N 4,.... There are millions of millions of pairs to try: (N 1, N 2 ); (N 1, N 3 ); (N 2, N 3 ); (N 1, N 4 ); (N 2, N 4 ); etc. That s feasible; but batch gcd finds the shared primes much faster. Our real goal is to compute gcd{n 1, N 2 N 3 N 4 } (this gcd is > 1 if N 1 shares a prime); gcd{n 2, N 1 N 3 N 4 } (this gcd is > 1 if N 2 shares a prime); gcd{n 3, N 1 N 2 N 4 } (this gcd is > 1 if N 3 shares a prime); etc.
36 Batch gcd, part 1: product tree First step: Multiply all the keys! Compute R = N 1 N 2 N 3. def producttree(x): result = [X] while len(x) > 1: X = [prod(x[i*2:(i+1)*2]) for i in range((len(x)+1)/2)] result.append(x) return result # for example: print producttree([10,20,30,40]) # output is [[10, 20, 30, 40], [200, 1200], [240000]]
37 Batch gcd, part 2: remainder tree Reduce R = N 1 N 2 N 3 modulo N 2 1 and N2 2 and N2 3 Obtain gcd{n 1, N 2 N 3 } as gcd{n 1, (R mod N 2 1 )/N 1}; obtain gcd{n 2, N 1 N 3 } as gcd{n 2, (R mod N 2 2 )/N 2}; etc. and so on. def batchgcd(x): prods = producttree(x) R = prods.pop() while prods: X = prods.pop() R = [R[floor(i/2)] % X[i]**2 for i in range(len(x))] return [gcd(r/n,n) for r,n in zip(r,x)]
38 Batch gcd is very fast sage: # two-year-old laptop, clocked down to 800MHz sage: def myrand():...: return Integer(randrange(2^1024))...: sage: time g = batchgcd([myrand() for i in range(100)]) Time: CPU 0.05 s, Wall: 0.05 s sage: time g = batchgcd([myrand() for i in range(1000)]) Time: CPU 1.08 s, Wall: 1.08 s sage: time g = batchgcd([myrand() for i in range(10000)]) Time: CPU s, Wall: s sage:
39 Are random-number generators really this bad?
40 Are random-number generators really this bad? 2012 Heninger Durumeric Wustrow Halderman, best-paper award at USENIX Security Symposium: Factored tens of thousands of public keys on the Internet... typically keys for your home router, not for your bank. Why? Many deployed devices are generating guessable p s. Most common problem: horrifyingly bad interactions between OpenSSL key generation, /dev/urandom seeding, entropy sources.
41 Are random-number generators really this bad? 2012 Heninger Durumeric Wustrow Halderman, best-paper award at USENIX Security Symposium: Factored tens of thousands of public keys on the Internet... typically keys for your home router, not for your bank. Why? Many deployed devices are generating guessable p s. Most common problem: horrifyingly bad interactions between OpenSSL key generation, /dev/urandom seeding, entropy sources Lenstra Hughes Augier Bos Kleinjung Wachter, independent Ron was wrong, Whit is right paper, Crypto: Factored tens of thousands of public keys on the Internet. Dunno why, but OMG! Insecure e-commerce! Call the NYTimes!
42
43 This is just the tip of the iceberg Look for more examples of bad randomness!
44 This is just the tip of the iceberg Look for more examples of bad randomness! e.g., followup work by 2012 Chou (slides in Chinese): Factored 103 Taiwan Citizen Digital Certificates (out of 2.26 million): smartcard certificates used for paying taxes etc. Names, addresses, national IDs were public but 103 private keys are now known.
45 This is just the tip of the iceberg Look for more examples of bad randomness! e.g., followup work by 2012 Chou (slides in Chinese): Factored 103 Taiwan Citizen Digital Certificates (out of 2.26 million): smartcard certificates used for paying taxes etc. Names, addresses, national IDs were public but 103 private keys are now known. Smartcard manufacturer: Giesecke & Devrient: Creating Confidence.
46 Danger: Your prime is too small N =
47 Danger: Your prime is too small N = is obviously divisible by 5. Computers can test quickly for divisibility by a precomputed set of primes (using % or gcd with product). Takes time about p/ log(p) to find p.
48 Danger: Your prime is too small N = is obviously divisible by 5. Computers can test quickly for divisibility by a precomputed set of primes (using % or gcd with product). Takes time about p/ log(p) to find p. Pollard rho N= a= ; c=10 # some random values a1=(a^2+c) % N ; a2=(a1^2+c) % N while gcd(n,a2-a1)==1: a1=(a1^2+c) %N a2=(((a2^2+c)%n)^2+c)%n gcd(n,a2-a1)
49 Danger: Your prime is too small N = is obviously divisible by 5. Computers can test quickly for divisibility by a precomputed set of primes (using % or gcd with product). Takes time about p/ log(p) to find p. Pollard rho N= a= ; c=10 # some random values a1=(a^2+c) % N ; a2=(a1^2+c) % N while gcd(n,a2-a1)==1: a1=(a1^2+c) %N a2=(((a2^2+c)%n)^2+c)%n gcd(n,a2-a1) # output is 2053 Pollard s rho method runs till p or q divides a1 a2; typically about p steps, for p the smaller of the primes.
50 Pollard s p 1 method N= y=lcm(range(1,2^22)) #this takes a while... s=integer(pow(2,y,n)) gcd(s-1,n)
51 Pollard s p 1 method N= y=lcm(range(1,2^22)) #this takes a while... s=integer(pow(2,y,n)) gcd(s-1,n) # output is This method finds larger factors than the rho method (in the same time) but only works for special primes.
52 Pollard s p 1 method N= y=lcm(range(1,2^22)) #this takes a while... s=integer(pow(2,y,n)) gcd(s-1,n) # output is This method finds larger factors than the rho method (in the same time) but only works for special primes. Here p 1 = has only small factors (aka. p is smooth). Math ahead:
53 Pollard s p 1 method N= y=lcm(range(1,2^22)) #this takes a while... s=integer(pow(2,y,n)) gcd(s-1,n) # output is This method finds larger factors than the rho method (in the same time) but only works for special primes. Here p 1 = has only small factors (aka. p is smooth). Math ahead: Avoiding such p helps against the p 1 method but does not help against ECM (the elliptic curve method), which works if the number of points on a curve modulo p is smooth. Strong primes are obsolete: fail to defend against ECM.
54 Danger: Generating p and q from a single search Lesson from before: Avoid small prime disaster, choose p and q of same size. Problem if one takes same size too literally: N =
55 Danger: Generating p and q from a single search Lesson from before: Avoid small prime disaster, choose p and q of same size. Problem if one takes same size too literally: N = Yes, this looks like very close to a power of 10, actually close to Square root N is almost an integer, almost
56 Danger: Generating p and q from a single search Lesson from before: Avoid small prime disaster, choose p and q of same size. Problem if one takes same size too literally: N = Yes, this looks like very close to a power of 10, actually close to Square root N is almost an integer, almost Brute-force search N % ( i) finds factor p = and then q = N/p =
57 Danger: Generating p and q from a single search Lesson from before: Avoid small prime disaster, choose p and q of same size. Problem if one takes same size too literally: N = Yes, this looks like very close to a power of 10, actually close to Square root N is almost an integer, almost Brute-force search N % ( i) finds factor p = and then q = N/p = In real life would expect this with power of 2 instead of 10.
58 This problem happens not only for p and q too close to powers of 2 or 10. User starts search for p with some offset c as p = next prime( c). Takes q = next prime(p). sage: N= sage: sqrt(n).numerical_approx(256).str(no_sci=2)
59 This problem happens not only for p and q too close to powers of 2 or 10. User starts search for p with some offset c as p = next prime( c). Takes q = next prime(p). sage: N= sage: sqrt(n).numerical_approx(256).str(no_sci=2) # very close to an integer
60 This problem happens not only for p and q too close to powers of 2 or 10. User starts search for p with some offset c as p = next prime( c). Takes q = next prime(p). sage: N= sage: sqrt(n).numerical_approx(256).str(no_sci=2) # very close to an integer sage: a=ceil(sqrt(n)); a^2-n 4096
61 This problem happens not only for p and q too close to powers of 2 or 10. User starts search for p with some offset c as p = next prime( c). Takes q = next prime(p). sage: N= sage: sqrt(n).numerical_approx(256).str(no_sci=2) # very close to an integer sage: a=ceil(sqrt(n)); a^2-n 4096 # 4096=64^2; this is a square!
62 This problem happens not only for p and q too close to powers of 2 or 10. User starts search for p with some offset c as p = next prime( c). Takes q = next prime(p). sage: N= sage: sqrt(n).numerical_approx(256).str(no_sci=2) # very close to an integer sage: a=ceil(sqrt(n)); a^2-n 4096 # 4096=64^2; this is a square! sage: N/(a-64)
63 This problem happens not only for p and q too close to powers of 2 or 10. User starts search for p with some offset c as p = next prime( c). Takes q = next prime(p). sage: N= sage: sqrt(n).numerical_approx(256).str(no_sci=2) # very close to an integer sage: a=ceil(sqrt(n)); a^2-n 4096 # 4096=64^2; this is a square! sage: N/(a-64) # an integer! sage: N/
64 Fermat factorization We wrote N = a 2 b 2 = (a + b)(a b) and factored it using N/(a b). sage: N= sage: sqrt(n).numerical_approx(256).str(no_sci=2)
65 Fermat factorization We wrote N = a 2 b 2 = (a + b)(a b) and factored it using N/(a b). sage: N= sage: sqrt(n).numerical_approx(256).str(no_sci=2) sage: a=ceil(sqrt(n)); i=0 sage: while not is_square((a+i)^2-n):...: i=i+1
66 Fermat factorization We wrote N = a 2 b 2 = (a + b)(a b) and factored it using N/(a b). sage: N= sage: sqrt(n).numerical_approx(256).str(no_sci=2) sage: a=ceil(sqrt(n)); i=0 sage: while not is_square((a+i)^2-n):...: i=i+1 # gives i=2
67 Fermat factorization We wrote N = a 2 b 2 = (a + b)(a b) and factored it using N/(a b). sage: N= sage: sqrt(n).numerical_approx(256).str(no_sci=2) sage: a=ceil(sqrt(n)); i=0 sage: while not is_square((a+i)^2-n):...: i=i+1 # gives i=2...: # was q=next_prime(p+2^ ) This always works
68 Fermat factorization We wrote N = a 2 b 2 = (a + b)(a b) and factored it using N/(a b). sage: N= sage: sqrt(n).numerical_approx(256).str(no_sci=2) sage: a=ceil(sqrt(n)); i=0 sage: while not is_square((a+i)^2-n):...: i=i+1 # gives i=2...: # was q=next_prime(p+2^ ) This always works eventually: N = ((q + p)/2) 2 ((q p)/2) 2
69 Fermat factorization We wrote N = a 2 b 2 = (a + b)(a b) and factored it using N/(a b). sage: N= sage: sqrt(n).numerical_approx(256).str(no_sci=2) sage: a=ceil(sqrt(n)); i=0 sage: while not is_square((a+i)^2-n):...: i=i+1 # gives i=2...: # was q=next_prime(p+2^ ) This always works eventually: N = ((q + p)/2) 2 ((q p)/2) 2 but searching for (q + p)/2 starting with N will usually run for about N p steps.
70 Danger: Your keys are too small Okay: Generate random p between and Independently generate random q between and Your public key N = pq is between and
71 Danger: Your keys are too small Okay: Generate random p between and Independently generate random q between and Your public key N = pq is between and Conventional wisdom: Any 1024-bit key can be factored in operations by CFRAC (continued-fraction method); or operations by LS (linear sieve); or operations by QS (quadratic sieve); or 2 80 operations by NFS (number-field sieve). Feasible today for botnets and for large organizations. Will become feasible for more attackers as chips become cheaper.
72 An example of the quadratic sieve Let s try Fermat to factor N = Recall idea: if a 2 N is a square b 2 then N = (a b)(a + b) = 50. Not exactly a square: 50 =
73 An example of the quadratic sieve Let s try Fermat to factor N = Recall idea: if a 2 N is a square b 2 then N = (a b)(a + b) = 50. Not exactly a square: 50 = = 157. Ummm, doesn t look like a square.
74 An example of the quadratic sieve Let s try Fermat to factor N = Recall idea: if a 2 N is a square b 2 then N = (a b)(a + b) = 50. Not exactly a square: 50 = = 157. Ummm, doesn t look like a square = 266.
75 An example of the quadratic sieve Let s try Fermat to factor N = Recall idea: if a 2 N is a square b 2 then N = (a b)(a + b) = 50. Not exactly a square: 50 = = 157. Ummm, doesn t look like a square = = 377.
76 An example of the quadratic sieve Let s try Fermat to factor N = Recall idea: if a 2 N is a square b 2 then N = (a b)(a + b) = 50. Not exactly a square: 50 = = 157. Ummm, doesn t look like a square = = = 490. Hey, 49 is a square =
77 An example of the quadratic sieve Let s try Fermat to factor N = Recall idea: if a 2 N is a square b 2 then N = (a b)(a + b) = 50. Not exactly a square: 50 = = 157. Ummm, doesn t look like a square = = = 490. Hey, 49 is a square = = 605. Not exactly a square: 605 =
78 An example of the quadratic sieve Let s try Fermat to factor N = Recall idea: if a 2 N is a square b 2 then N = (a b)(a + b) = 50. Not exactly a square: 50 = = 157. Ummm, doesn t look like a square = = = 490. Hey, 49 is a square = = 605. Not exactly a square: 605 = Fermat doesn t seem to be working very well for this number.
79 An example of the quadratic sieve Let s try Fermat to factor N = Recall idea: if a 2 N is a square b 2 then N = (a b)(a + b) = 50. Not exactly a square: 50 = = 157. Ummm, doesn t look like a square = = = 490. Hey, 49 is a square = = 605. Not exactly a square: 605 = Fermat doesn t seem to be working very well for this number. But the product is a square: QS computes gcd{2759, } = 31. Math exercise: Square product has 50% chance of factoring pq.
80 QS more systematically Try larger N. Easy to generate many differences a 2 N: N = X = [a^2-n for a in range(sqrt(n)+1,sqrt(n) )]
81 QS more systematically Try larger N. Easy to generate many differences a 2 N: N = X = [a^2-n for a in range(sqrt(n)+1,sqrt(n) )] See which differences are easy to factor: P = list(primes(2,1000)) F = easyfactorizations(p,x)
82 QS more systematically Try larger N. Easy to generate many differences a 2 N: N = X = [a^2-n for a in range(sqrt(n)+1,sqrt(n) )] See which differences are easy to factor: P = list(primes(2,1000)) F = easyfactorizations(p,x) Use linear algebra mod 2 to find a square: M = matrix(gf(2),len(f),len(p),lambda i,j:p[j] in F[i][0]) for K in M.left_kernel().basis(): x = product([sqrt(f[2]+n) for f,k in zip(f,k) if k==1]) y = sqrt(product([f[2] for f,k in zip(f,k) if k==1])) print [gcd(n,x - y),gcd(n,x + y)]
83 Many details and speedups Core strategies to implement easyfactorizations: Batch trial division: same as the tree idea from before. Sieving : like the Sieve of Eratosthenes. rho, p 1, ECM: very small memory requirements. Early aborts : optimized combination of everything. Sieving needs tons of memory True, but ECM doesn t.
84 Many details and speedups Core strategies to implement easyfactorizations: Batch trial division: same as the tree idea from before. Sieving : like the Sieve of Eratosthenes. rho, p 1, ECM: very small memory requirements. Early aborts : optimized combination of everything. Sieving needs tons of memory True, but ECM doesn t. Many important improvements outside easyfactorizations: Fast linear algebra. Multiple lattices ( MPQS ): smaller differences. NFS: much smaller differences. Batch NFS: factor many keys at once. The attack is feasible but not worthwhile Batch NFS.
85 So what does it mean? Complicated NFS analysis and optimization. Latest estimates: Scanning 2 70 differences will factor any 1024-bit key. How expensive is this?
86 So what does it mean? Complicated NFS analysis and optimization. Latest estimates: Scanning 2 70 differences will factor any 1024-bit key. How expensive is this? It s free! The Conficker/Downadup botnet broke into 2 23 machines. There are 2 25 seconds in a year. Scanning 2 70 differences in a year means scanning 2 22 differences/second/machine. For comparison, the successful RSA-768 factorization scanned >2 24 differences/second/machine.
87 So what does it mean? Complicated NFS analysis and optimization. Latest estimates: Scanning 2 70 differences will factor any 1024-bit key. How expensive is this? It s free! The Conficker/Downadup botnet broke into 2 23 machines. There are 2 25 seconds in a year. Scanning 2 70 differences in a year means scanning 2 22 differences/second/machine. For comparison, the successful RSA-768 factorization scanned >2 24 differences/second/machine. Linear algebra needs a supercomputer No, can distribute linear algebra across many machines. Linear algebra needs tons of memory No, can trade linear-algebra size for number of differences.
88 On the importance of not being seen A year of botnet computation would be noticed, maybe stopped.
89 On the importance of not being seen A year of botnet computation would be noticed, maybe stopped. Alternate plan: Use a private computer cluster. e.g. NSA is building a watt computer center in Bluffdale. e.g. China has a supercomputer center in Tianjin.
90 On the importance of not being seen A year of botnet computation would be noticed, maybe stopped. Alternate plan: Use a private computer cluster. e.g. NSA is building a watt computer center in Bluffdale. e.g. China has a supercomputer center in Tianjin watts Earth receives from the Sun 2 56 watts Earth s surface receives from the Sun 2 44 watts 2 30 watts 2 26 watts
91 On the importance of not being seen A year of botnet computation would be noticed, maybe stopped. Alternate plan: Use a private computer cluster. e.g. NSA is building a watt computer center in Bluffdale. e.g. China has a supercomputer center in Tianjin watts Earth receives from the Sun 2 56 watts Earth s surface receives from the Sun 2 44 watts Current world power usage 2 30 watts 2 26 watts
92 On the importance of not being seen A year of botnet computation would be noticed, maybe stopped. Alternate plan: Use a private computer cluster. e.g. NSA is building a watt computer center in Bluffdale. e.g. China has a supercomputer center in Tianjin watts Earth receives from the Sun 2 56 watts Earth s surface receives from the Sun 2 44 watts Current world power usage 2 30 watts Botnet running 2 23 typical CPUs 2 26 watts
93 On the importance of not being seen A year of botnet computation would be noticed, maybe stopped. Alternate plan: Use a private computer cluster. e.g. NSA is building a watt computer center in Bluffdale. e.g. China has a supercomputer center in Tianjin watts Earth receives from the Sun 2 56 watts Earth s surface receives from the Sun 2 44 watts Current world power usage 2 30 watts Botnet running 2 23 typical CPUs 2 26 watts One dinky little computer center
94 On the importance of not being seen A year of botnet computation would be noticed, maybe stopped. Alternate plan: Use a private computer cluster. e.g. NSA is building a watt computer center in Bluffdale. e.g. China has a supercomputer center in Tianjin watts Earth receives from the Sun 2 56 watts Earth s surface receives from the Sun 2 44 watts Current world power usage 2 30 watts Botnet running 2 23 typical CPUs 2 26 watts One dinky little computer center 2 26 watts of standard GPUs: 2 84 floating-point mults/year. Current estimates: This is enough to break 1024-bit RSA.... and special-purpose chips should be at least 10 faster.
95 Factoring keys with Google.
96
97 -----BEGIN RSA PRIVATE KEY----- MIICXwIBAAKBpenis1ePqHkVN9IKaGBESjV6zBrIsZc+XQYTtSlVa9R/4SAXoYpI upnrijkcld6dldqfto429xldmyo4ojzox7xincsmlbn8+tqtjf3tqajmiopgqvhj vw9is30tet7l2ynaymyvgqwr0lictomc/loltlhpifixw2akud0m5w76dwidaqab AoGBAKDl8vuA9zUn2lTDddujAzBRp8ZEoJTxw7BVdLpZtgLWLuqPcXroyTkvBJC/ rbfpgyddmgwc/lkpmuffe/-----begin RSA PRIVATE KEY----- FUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A FUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A FUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A FUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A FUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A FUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A FUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A FUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A FUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A... FUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A DUCKFUCK A Psg1RMTRceI/z3d/3BiuDjiUiRICFqOXDscCQQDFea/ocg8VVLvH/6pn7oNTQfbx tkqcssne3xgjam+ea6txbio49d+3gsm3u1mghr9zbmy0o68ijhiqm7/7njtbakea jmkwip2fy0tq9heq4rx90zfmixcwf/h6jldry7kj/qg6udnpvh55mtrugppas044 7sJphlPEY8ofkwJj7K/ZKQJBAIc75HQi/Br1lRC4qPmF2vwYgwpyF9RbZWO56Eo7 ipgts4flfajgogod+jxkkt1cxtev7mqm6ihsxgvbd6uhn7i= -----END RSA PRIVATE KEY-----
98 Unfucking the duck -----BEGIN RSA PRIVATE KEY----- MIICXwIBAAKBpenis1ePqHkVN9IKaGBESjV6zBrIsZc+XQYTtSlVa9R/4SAXoYpI upnrijkcld6dldqfto429xldmyo4ojzox7xincsmlbn8+tqtjf3tqajmiopgqvhj vw9is30tet7l2ynaymyvgqwr0lictomc/loltlhpifixw2akud0m5w76dwidaqab AoGBAKDl8vuA9zUn2lTDddujAzBRp8ZEoJTxw7BVdLpZtgLWLuqPcXroyTkvBJC/ rbfpgyddmgwc/lkpmuffe/ Psg1RMTRceI/z3d/3BiuDjiUiRICFqOXDscCQQDFea/ocg8VVLvH/6pn7oNTQfbx tkqcssne3xgjam+ea6txbio49d+3gsm3u1mghr9zbmy0o68ijhiqm7/7njtbakea jmkwip2fy0tq9heq4rx90zfmixcwf/h6jldry7kj/qg6udnpvh55mtrugppas044 7sJphlPEY8ofkwJj7K/ZKQJBAIc75HQi/Br1lRC4qPmF2vwYgwpyF9RbZWO56Eo7 ipgts4flfajgogod+jxkkt1cxtev7mqm6ihsxgvbd6uhn7i= -----END RSA PRIVATE KEY-----
99 Unfucking the duck -----BEGIN RSA PRIVATE KEY----- MIICXwIBAAKBpenis1ePqHkVN9IKaGBESjV6zBrIsZc+XQYTtSlVa9R/4SAXoYpI upnrijkcld6dldqfto429xldmyo4ojzox7xincsmlbn8+tqtjf3tqajmiopgqvhj vw9is30tet7l2ynaymyvgqwr0lictomc/loltlhpifixw2akud0m5w76dwidaqab AoGBAKDl8vuA9zUn2lTDddujAzBRp8ZEoJTxw7BVdLpZtgLWLuqPcXroyTkvBJC/ rbfpgyddmgwc/lkpmuffe/ <----- oh noes! --> Psg1RMTRceI/z3d/3BiuDjiUiRICFqOXDscCQQDFea/ocg8VVLvH/6pn7oNTQfbx tkqcssne3xgjam+ea6txbio49d+3gsm3u1mghr9zbmy0o68ijhiqm7/7njtbakea jmkwip2fy0tq9heq4rx90zfmixcwf/h6jldry7kj/qg6udnpvh55mtrugppas044 7sJphlPEY8ofkwJj7K/ZKQJBAIc75HQi/Br1lRC4qPmF2vwYgwpyF9RbZWO56Eo7 ipgts4flfajgogod+jxkkt1cxtev7mqm6ihsxgvbd6uhn7i= -----END RSA PRIVATE KEY-----
100 PKCS #1: RSA Cryptography Standard RSAPublicKey ::= SEQUENCE { modulus INTEGER, -- n publicexponent INTEGER -- e } RSAPrivateKey ::= SEQUENCE { version Version, modulus INTEGER, -- n publicexponent INTEGER, -- e privateexponent INTEGER, -- d prime1 INTEGER, -- p prime2 INTEGER, -- q exponent1 INTEGER, -- d mod (p-1) exponent2 INTEGER, -- d mod (q-1) coefficient INTEGER, -- (inverse of q) mod p otherprimeinfos OtherPrimeInfos OPTIONAL }
101 Unfucking the duck q -----BEGIN RSA PRIVATE KEY----- MIICXwIBAAKBpenis1ePqHkVN9IKaGBESjV6zBrIsZc+XQYTtSlVa9R/4SAXoYpI upnrijkcld6dldqfto429xldmyo4ojzox7xincsmlbn8+tqtjf3tqajmiopgqvhj vw9is30tet7l2ynaymyvgqwr0lictomc/loltlhpifixw2akud0m5w76dwidaqab AoGBAKDl8vuA9zUn2lTDddujAzBRp8ZEoJTxw7BVdLpZtgLWLuqPcXroyTkvBJC/ rbfpgyddmgwc/lkpmuffe/ d Psg1RMTRceI/z3d/3BiuDjiUiRICFqOXDscCQQDFea/ocg8VVLvH/6pn7oNTQfbx tkqcssne3xgjam+ea6txbio49d+3gsm3u1mghr9zbmy0o68ijhiqm7/7njtbakea jmkwip2fy0tq9heq4rx90zfmixcwf/h6jldry7kj/qg6udnpvh55mtrugppas044 7sJphlPEY8ofkwJj7K/ZKQJBAIc75HQi/Br1lRC4qPmF2vwYgwpyF9RbZWO56Eo7 ipgts4flfajgogod+jxkkt1cxtev7mqm6ihsxgvbd6uhn7i= -----END RSA PRIVATE KEY----- N e d mod p 1 q 1 mod p d mod q 1
102 Easy-to-compute relations between private key fields q = gcd(int(pow(2,e*dp-1,n))-1,n) p = n/q d = inverse_mod(e,(p-1)*(q-1))... Incomplete portions of a single piece of the key? Possible with Coppersmith/Howgrave-Graham techniques; see example on web.
103 Huzzah! -----BEGIN RSA PRIVATE KEY----- MIICXwIBAAKBgQDET1ePqHkVN9IKaGBESjV6zBrIsZc+XQYTtSlVa9R/4SAXoYpI upnrijkcld6dldqfto429xldmyo4ojzox7xincsmlbn8+tqtjf3tqajmiopgqvhj vw9is30tet7l2ynaymyvgqwr0lictomc/loltlhpifixw2akud0m5w76dwidaqab AoGBAKDl8vuA9zUn2lTDddujAzBRp8ZEoJTxw7BVdLpZtgLWLuqPcXroyTkvBJC/ rbfpgyddmgwc/lkpmuffe/tc+kgidlwo50pm/cwccham9neinbff1dqoa5gvxv6g yuwqnkvkertoh/l3opbiaparfb2aiimxudh0eigev6i6h0shakea/mcm4kwarmp9 gpy2v/9qlj1megzxmjhg4nwbfgpqe+9lq1+e6kmeppufgac5zjc8an4pc0lu5qiv XBUW2uLG0QJBAMbVClSWms3llVT5IjKFNLdz0ShSu0Fh5UzRpMkxtEGYsO5VKnb4 Psg1RMTRceI/z3d/3BiuDjiUiRICFqOXDscCQQDFea/ocg8VVLvH/6pn7oNTQfbx tkqcssne3xgjam+ea6txbio49d+3gsm3u1mghr9zbmy0o68ijhiqm7/7njtbakea jmkwip2fy0tq9heq4rx90zfmixcwf/h6jldry7kj/qg6udnpvh55mtrugppas044 7sJphlPEY8ofkwJj7K/ZKQJBAIc75HQi/Br1lRC4qPmF2vwYgwpyF9RbZWO56Eo7 ipgts4flfajgogod+jxkkt1cxtev7mqm6ihsxgvbd6uhn7i= -----END RSA PRIVATE KEY-----
104 Lessons
105 Lessons Stop using 1024-bit RSA, if you haven t already.
106 Lessons Stop using 1024-bit RSA, if you haven t already. Make sure your primes are big enough.
107 Lessons Stop using 1024-bit RSA, if you haven t already. Make sure your primes are big enough. Make sure your primes are random.
108 Lessons Stop using 1024-bit RSA, if you haven t already. Make sure your primes are big enough. Make sure your primes are random. FUCK A DUCK is not good crypto.
109 Lessons Stop using 1024-bit RSA, if you haven t already. Make sure your primes are big enough. Make sure your primes are random. FUCK A DUCK is not good crypto. Pastebin is not a secure cloud store.
110 Lessons Stop using 1024-bit RSA, if you haven t already. Make sure your primes are big enough. Make sure your primes are random. FUCK A DUCK is not good crypto. Pastebin is not a secure cloud store. Probably shouldn t put your private key in a secure cloud store anyway.
111 Lessons Stop using 1024-bit RSA, if you haven t already. Make sure your primes are big enough. Make sure your primes are random. FUCK A DUCK is not good crypto. Pastebin is not a secure cloud store. Probably shouldn t put your private key in a secure cloud store anyway. Probably shouldn t fuck a duck.
112 Instructions, explanations, examples, and code snippets available online at:
How To Factor In Rsa With A Prime Factor
The state of factoring algorithms and other cryptanalytic threats to RSA Daniel J. Bernstein University of Illinois at Chicago Technische Universiteit Eindhoven Nadia Heninger Microsoft Research New England
Public-Key Cryptanalysis 1: Introduction and Factoring
Public-Key Cryptanalysis 1: Introduction and Factoring Nadia Heninger University of Pennsylvania July 21, 2013 Adventures in Cryptanalysis Part 1: Introduction and Factoring. What is public-key crypto
The Case of the RSA FUCK-A-DUCK certificate. Nadia Heninger Zakir Durumeric Eric Wustrow J. Alex Halderman. N=pq
The Case of the RSA FUCK-A-DUCK certificate Nadia Heninger Zakir Durumeric Eric Wustrow J. Alex Halderman N=pq SSL certificates We scanned the Internet SSL certificates We scanned the Internet (It was
RSA Keys with Common Factors
RSA Keys with Common Factors Joppe W. Bos Cryptography group extreme Computing Group, Microsoft Research 1 / 19 Outline 2 / 19 Public-Key Cryptography 3 / 19 Cryptanalysis of Public-Key Cryptography Popular
Primality Testing and Factorization Methods
Primality Testing and Factorization Methods Eli Howey May 27, 2014 Abstract Since the days of Euclid and Eratosthenes, mathematicians have taken a keen interest in finding the nontrivial factors of integers,
Factoring Algorithms
Factoring Algorithms The p 1 Method and Quadratic Sieve November 17, 2008 () Factoring Algorithms November 17, 2008 1 / 12 Fermat s factoring method Fermat made the observation that if n has two factors
Factoring. Factoring 1
Factoring Factoring 1 Factoring Security of RSA algorithm depends on (presumed) difficulty of factoring o Given N = pq, find p or q and RSA is broken o Rabin cipher also based on factoring Factoring like
Generic attacks and index calculus. D. J. Bernstein University of Illinois at Chicago
Generic attacks and index calculus D. J. Bernstein University of Illinois at Chicago The discrete-logarithm problem Define Ô = 1000003. Easy to prove: Ô is prime. Can we find an integer Ò ¾ 1 2 3 Ô 1 such
RSA Attacks. By Abdulaziz Alrasheed and Fatima
RSA Attacks By Abdulaziz Alrasheed and Fatima 1 Introduction Invented by Ron Rivest, Adi Shamir, and Len Adleman [1], the RSA cryptosystem was first revealed in the August 1977 issue of Scientific American.
RSA Question 2. Bob thinks that p and q are primes but p isn t. Then, Bob thinks Φ Bob :=(p-1)(q-1) = φ(n). Is this true?
RSA Question 2 Bob thinks that p and q are primes but p isn t. Then, Bob thinks Φ Bob :=(p-1)(q-1) = φ(n). Is this true? Bob chooses a random e (1 < e < Φ Bob ) such that gcd(e,φ Bob )=1. Then, d = e -1
Faster deterministic integer factorisation
David Harvey (joint work with Edgar Costa, NYU) University of New South Wales 25th October 2011 The obvious mathematical breakthrough would be the development of an easy way to factor large prime numbers
Factoring and Discrete Log
Factoring and Discrete Log Nadia Heninger University of Pennsylvania June 1, 2015 Textbook RSA [Rivest Shamir Adleman 1977] Public Key N = pq modulus e encryption exponent Private Key p, q primes d decryption
Arithmetic algorithms for cryptology 5 October 2015, Paris. Sieves. Razvan Barbulescu CNRS and IMJ-PRG. R. Barbulescu Sieves 0 / 28
Arithmetic algorithms for cryptology 5 October 2015, Paris Sieves Razvan Barbulescu CNRS and IMJ-PRG R. Barbulescu Sieves 0 / 28 Starting point Notations q prime g a generator of (F q ) X a (secret) integer
MATH 168: FINAL PROJECT Troels Eriksen. 1 Introduction
MATH 168: FINAL PROJECT Troels Eriksen 1 Introduction In the later years cryptosystems using elliptic curves have shown up and are claimed to be just as secure as a system like RSA with much smaller key
QUANTUM COMPUTERS AND CRYPTOGRAPHY. Mark Zhandry Stanford University
QUANTUM COMPUTERS AND CRYPTOGRAPHY Mark Zhandry Stanford University Classical Encryption pk m c = E(pk,m) sk m = D(sk,c) m??? Quantum Computing Attack pk m aka Post-quantum Crypto c = E(pk,m) sk m = D(sk,c)
The Mathematics of the RSA Public-Key Cryptosystem
The Mathematics of the RSA Public-Key Cryptosystem Burt Kaliski RSA Laboratories ABOUT THE AUTHOR: Dr Burt Kaliski is a computer scientist whose involvement with the security industry has been through
Factorization Methods: Very Quick Overview
Factorization Methods: Very Quick Overview Yuval Filmus October 17, 2012 1 Introduction In this lecture we introduce modern factorization methods. We will assume several facts from analytic number theory.
An Overview of Integer Factoring Algorithms. The Problem
An Overview of Integer Factoring Algorithms Manindra Agrawal IITK / NUS The Problem Given an integer n, find all its prime divisors as efficiently as possible. 1 A Difficult Problem No efficient algorithm
U.C. Berkeley CS276: Cryptography Handout 0.1 Luca Trevisan January, 2009. Notes on Algebra
U.C. Berkeley CS276: Cryptography Handout 0.1 Luca Trevisan January, 2009 Notes on Algebra These notes contain as little theory as possible, and most results are stated without proof. Any introductory
Factoring Algorithms
Institutionen för Informationsteknologi Lunds Tekniska Högskola Department of Information Technology Lund University Cryptology - Project 1 Factoring Algorithms The purpose of this project is to understand
Computing exponents modulo a number: Repeated squaring
Computing exponents modulo a number: Repeated squaring How do you compute (1415) 13 mod 2537 = 2182 using just a calculator? Or how do you check that 2 340 mod 341 = 1? You can do this using the method
Elementary factoring algorithms
Math 5330 Spring 013 Elementary factoring algorithms The RSA cryptosystem is founded on the idea that, in general, factoring is hard. Where as with Fermat s Little Theorem and some related ideas, one can
High-speed cryptography and DNSCurve. D. J. Bernstein University of Illinois at Chicago
High-speed cryptography and DNSCurve D. J. Bernstein University of Illinois at Chicago Stealing Internet mail: easy! Given a mail message: Your mail software sends a DNS request, receives a server address,
Integer Factorization using the Quadratic Sieve
Integer Factorization using the Quadratic Sieve Chad Seibert* Division of Science and Mathematics University of Minnesota, Morris Morris, MN 56567 [email protected] March 16, 2011 Abstract We give
ANALYSIS OF RSA ALGORITHM USING GPU PROGRAMMING
ANALYSIS OF RSA ALGORITHM USING GPU PROGRAMMING Sonam Mahajan 1 and Maninder Singh 2 1 Department of Computer Science Engineering, Thapar University, Patiala, India 2 Department of Computer Science Engineering,
Primality - Factorization
Primality - Factorization Christophe Ritzenthaler November 9, 2009 1 Prime and factorization Definition 1.1. An integer p > 1 is called a prime number (nombre premier) if it has only 1 and p as divisors.
Lecture 3: One-Way Encryption, RSA Example
ICS 180: Introduction to Cryptography April 13, 2004 Lecturer: Stanislaw Jarecki Lecture 3: One-Way Encryption, RSA Example 1 LECTURE SUMMARY We look at a different security property one might require
Princeton University Computer Science COS 432: Information Security (Fall 2013)
Princeton University Computer Science COS 432: Information Security (Fall 2013) This test has 13 questions worth a total of 50 points. That s a lot of questions. Work through the ones you re comfortable
Breaking The Code. Ryan Lowe. Ryan Lowe is currently a Ball State senior with a double major in Computer Science and Mathematics and
Breaking The Code Ryan Lowe Ryan Lowe is currently a Ball State senior with a double major in Computer Science and Mathematics and a minor in Applied Physics. As a sophomore, he took an independent study
Overview of Public-Key Cryptography
CS 361S Overview of Public-Key Cryptography Vitaly Shmatikov slide 1 Reading Assignment Kaufman 6.1-6 slide 2 Public-Key Cryptography public key public key? private key Alice Bob Given: Everybody knows
Study of algorithms for factoring integers and computing discrete logarithms
Study of algorithms for factoring integers and computing discrete logarithms First Indo-French Workshop on Cryptography and Related Topics (IFW 2007) June 11 13, 2007 Paris, France Dr. Abhijit Das Department
FACTORING LARGE NUMBERS, A GREAT WAY TO SPEND A BIRTHDAY
FACTORING LARGE NUMBERS, A GREAT WAY TO SPEND A BIRTHDAY LINDSEY R. BOSKO I would like to acknowledge the assistance of Dr. Michael Singer. His guidance and feedback were instrumental in completing this
Cryptography and Network Security Chapter 9
Cryptography and Network Security Chapter 9 Fifth Edition by William Stallings Lecture slides by Lawrie Brown (with edits by RHB) Chapter 9 Public Key Cryptography and RSA Every Egyptian received two names,
1720 - Forward Secrecy: How to Secure SSL from Attacks by Government Agencies
1720 - Forward Secrecy: How to Secure SSL from Attacks by Government Agencies Dave Corbett Technical Product Manager Implementing Forward Secrecy 1 Agenda Part 1: Introduction Why is Forward Secrecy important?
Timing Attacks on software implementation of RSA
Timing Attacks on software implementation of RSA Project Report Harshman Singh 903-40-5260 [email protected] June 07, 2004 Abstract Timing attacks enable an attacker to extract secret information from
FACTORING. n = 2 25 + 1. fall in the arithmetic sequence
FACTORING The claim that factorization is harder than primality testing (or primality certification) is not currently substantiated rigorously. As some sort of backward evidence that factoring is hard,
CSCE 465 Computer & Network Security
CSCE 465 Computer & Network Security Instructor: Dr. Guofei Gu http://courses.cse.tamu.edu/guofei/csce465/ Public Key Cryptogrophy 1 Roadmap Introduction RSA Diffie-Hellman Key Exchange Public key and
Determining the Optimal Combination of Trial Division and Fermat s Factorization Method
Determining the Optimal Combination of Trial Division and Fermat s Factorization Method Joseph C. Woodson Home School P. O. Box 55005 Tulsa, OK 74155 Abstract The process of finding the prime factorization
The Quadratic Sieve Factoring Algorithm
The Quadratic Sieve Factoring Algorithm Eric Landquist MATH 488: Cryptographic Algorithms December 14, 2001 1 Introduction Mathematicians have been attempting to find better and faster ways to factor composite
Cryptography and Network Security Chapter 8
Cryptography and Network Security Chapter 8 Fifth Edition by William Stallings Lecture slides by Lawrie Brown (with edits by RHB) Chapter 8 Introduction to Number Theory The Devil said to Daniel Webster:
Basic Algorithms In Computer Algebra
Basic Algorithms In Computer Algebra Kaiserslautern SS 2011 Prof. Dr. Wolfram Decker 2. Mai 2011 References Cohen, H.: A Course in Computational Algebraic Number Theory. Springer, 1993. Cox, D.; Little,
Runtime and Implementation of Factoring Algorithms: A Comparison
Runtime and Implementation of Factoring Algorithms: A Comparison Justin Moore CSC290 Cryptology December 20, 2003 Abstract Factoring composite numbers is not an easy task. It is classified as a hard algorithm,
CRYPTOGRAPHY IN NETWORK SECURITY
ELE548 Research Essays CRYPTOGRAPHY IN NETWORK SECURITY AUTHOR: SHENGLI LI INSTRUCTOR: DR. JIEN-CHUNG LO Date: March 5, 1999 Computer network brings lots of great benefits and convenience to us. We can
Discrete Mathematics, Chapter 4: Number Theory and Cryptography
Discrete Mathematics, Chapter 4: Number Theory and Cryptography Richard Mayr University of Edinburgh, UK Richard Mayr (University of Edinburgh, UK) Discrete Mathematics. Chapter 4 1 / 35 Outline 1 Divisibility
Efficient and Robust Secure Aggregation of Encrypted Data in Wireless Sensor Networks
Efficient and Robust Secure Aggregation of Encrypted Data in Wireless Sensor Networks J. M. BAHI, C. GUYEUX, and A. MAKHOUL Computer Science Laboratory LIFC University of Franche-Comté Journée thématique
Applied Cryptography Public Key Algorithms
Applied Cryptography Public Key Algorithms Sape J. Mullender Huygens Systems Research Laboratory Universiteit Twente Enschede 1 Public Key Cryptography Independently invented by Whitfield Diffie & Martin
A common weakness in RSA signatures: extracting public keys from communications and embedded devices
A common weakness in RSA signatures: extracting public keys from communications and embedded devices Hackito Ergo Sum 24-26 April 2014 Renaud Lifchitz renaud.lifchitz @ oppida.fr Speaker s bio French computer
Notes on Factoring. MA 206 Kurt Bryan
The General Approach Notes on Factoring MA 26 Kurt Bryan Suppose I hand you n, a 2 digit integer and tell you that n is composite, with smallest prime factor around 5 digits. Finding a nontrivial factor
Advanced Cryptography
Family Name:... First Name:... Section:... Advanced Cryptography Final Exam July 18 th, 2006 Start at 9:15, End at 12:00 This document consists of 12 pages. Instructions Electronic devices are not allowed.
Library (versus Language) Based Parallelism in Factoring: Experiments in MPI. Dr. Michael Alexander Dr. Sonja Sewera.
Library (versus Language) Based Parallelism in Factoring: Experiments in MPI Dr. Michael Alexander Dr. Sonja Sewera Talk 2007-10-19 Slide 1 of 20 Primes Definitions Prime: A whole number n is a prime number
Cryptography and Network Security
Cryptography and Network Security Fifth Edition by William Stallings Chapter 9 Public Key Cryptography and RSA Private-Key Cryptography traditional private/secret/single key cryptography uses one key shared
Evaluation of Digital Signature Process
Evaluation of Digital Signature Process Emil SIMION, Ph. D. email: [email protected] Agenda Evaluation of digital signatures schemes: evaluation criteria; security evaluation; security of hash functions;
Mathematics of Internet Security. Keeping Eve The Eavesdropper Away From Your Credit Card Information
The : Keeping Eve The Eavesdropper Away From Your Credit Card Information Department of Mathematics North Dakota State University 16 September 2010 Science Cafe Introduction Disclaimer: is not an internet
Computer and Network Security
MIT 6.857 Computer and Networ Security Class Notes 1 File: http://theory.lcs.mit.edu/ rivest/notes/notes.pdf Revision: December 2, 2002 Computer and Networ Security MIT 6.857 Class Notes by Ronald L. Rivest
Network Security. Gaurav Naik Gus Anderson. College of Engineering. Drexel University, Philadelphia, PA. Drexel University. College of Engineering
Network Security Gaurav Naik Gus Anderson, Philadelphia, PA Lectures on Network Security Feb 12 (Today!): Public Key Crypto, Hash Functions, Digital Signatures, and the Public Key Infrastructure Feb 14:
Factoring integers, Producing primes and the RSA cryptosystem Harish-Chandra Research Institute
RSA cryptosystem HRI, Allahabad, February, 2005 0 Factoring integers, Producing primes and the RSA cryptosystem Harish-Chandra Research Institute Allahabad (UP), INDIA February, 2005 RSA cryptosystem HRI,
Factoring integers and Producing primes
Factoring integers,..., RSA Erbil, Kurdistan 0 Lecture in Number Theory College of Sciences Department of Mathematics University of Salahaddin Debember 4, 2014 Factoring integers and Producing primes Francesco
Outline. Computer Science 418. Digital Signatures: Observations. Digital Signatures: Definition. Definition 1 (Digital signature) Digital Signatures
Outline Computer Science 418 Digital Signatures Mike Jacobson Department of Computer Science University of Calgary Week 12 1 Digital Signatures 2 Signatures via Public Key Cryptosystems 3 Provable 4 Mike
International Journal of Information Technology, Modeling and Computing (IJITMC) Vol.1, No.3,August 2013
FACTORING CRYPTOSYSTEM MODULI WHEN THE CO-FACTORS DIFFERENCE IS BOUNDED Omar Akchiche 1 and Omar Khadir 2 1,2 Laboratory of Mathematics, Cryptography and Mechanics, Fstm, University of Hassan II Mohammedia-Casablanca,
Cryptography and Network Security Chapter 10
Cryptography and Network Security Chapter 10 Fifth Edition by William Stallings Lecture slides by Lawrie Brown (with edits by RHB) Chapter 10 Other Public Key Cryptosystems Amongst the tribes of Central
Factoring & Primality
Factoring & Primality Lecturer: Dimitris Papadopoulos In this lecture we will discuss the problem of integer factorization and primality testing, two problems that have been the focus of a great amount
Public Key Cryptography. Performance Comparison and Benchmarking
Public Key Cryptography Performance Comparison and Benchmarking Tanja Lange Department of Mathematics Technical University of Denmark [email protected] 28.08.2006 Tanja Lange Benchmarking p. 1 What
Secure Network Communication Part II II Public Key Cryptography. Public Key Cryptography
Kommunikationssysteme (KSy) - Block 8 Secure Network Communication Part II II Public Key Cryptography Dr. Andreas Steffen 2000-2001 A. Steffen, 28.03.2001, KSy_RSA.ppt 1 Secure Key Distribution Problem
Usable Crypto: Introducing minilock. Nadim Kobeissi HOPE X, NYC, 2014
Usable Crypto: Introducing minilock Nadim Kobeissi HOPE X, NYC, 2014 2012 Browsers are an environment that is hostile to cryptography Malleability of the JavaScript runtime. The lack of low-level (system-level)
IMPROVED SECURITY MEASURES FOR DATA IN KEY EXCHANGES IN CLOUD ENVIRONMENT
INTERNATIONAL JOURNAL OF RESEARCH IN COMPUTER APPLICATIONS AND ROBOTICS ISSN 2320-7345 IMPROVED SECURITY MEASURES FOR DATA IN KEY EXCHANGES IN CLOUD ENVIRONMENT Merlin Shirly T 1, Margret Johnson 2 1 PG
Public-key cryptography RSA
Public-key cryptography RSA NGUYEN Tuong Lan LIU Yi Master Informatique University Lyon 1 Objective: Our goal in the study is to understand the algorithm RSA, some existence attacks and implement in Java.
The science of encryption: prime numbers and mod n arithmetic
The science of encryption: prime numbers and mod n arithmetic Go check your e-mail. You ll notice that the webpage address starts with https://. The s at the end stands for secure meaning that a process
SIMS 255 Foundations of Software Design. Complexity and NP-completeness
SIMS 255 Foundations of Software Design Complexity and NP-completeness Matt Welsh November 29, 2001 [email protected] 1 Outline Complexity of algorithms Space and time complexity ``Big O'' notation Complexity
Network Security. Chapter 6 Random Number Generation
Network Security Chapter 6 Random Number Generation 1 Tasks of Key Management (1)! Generation:! It is crucial to security, that keys are generated with a truly random or at least a pseudo-random generation
Lecture 6 - Cryptography
Lecture 6 - Cryptography CSE497b - Spring 2007 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse497b-s07 Question 2 Setup: Assume you and I don t know anything about
A Factoring and Discrete Logarithm based Cryptosystem
Int. J. Contemp. Math. Sciences, Vol. 8, 2013, no. 11, 511-517 HIKARI Ltd, www.m-hikari.com A Factoring and Discrete Logarithm based Cryptosystem Abdoul Aziz Ciss and Ahmed Youssef Ecole doctorale de Mathematiques
ELLIPTIC CURVES AND LENSTRA S FACTORIZATION ALGORITHM
ELLIPTIC CURVES AND LENSTRA S FACTORIZATION ALGORITHM DANIEL PARKER Abstract. This paper provides a foundation for understanding Lenstra s Elliptic Curve Algorithm for factoring large numbers. We give
Number Theory and the RSA Public Key Cryptosystem
Number Theory and the RSA Public Key Cryptosystem Minh Van Nguyen [email protected] 05 November 2008 This tutorial uses to study elementary number theory and the RSA public key cryptosystem. A number
Principles of Public Key Cryptography. Applications of Public Key Cryptography. Security in Public Key Algorithms
Principles of Public Key Cryptography Chapter : Security Techniques Background Secret Key Cryptography Public Key Cryptography Hash Functions Authentication Chapter : Security on Network and Transport
Factoring a semiprime n by estimating φ(n)
Factoring a semiprime n by estimating φ(n) Kyle Kloster May 7, 2010 Abstract A factoring algorithm, called the Phi-Finder algorithm, is presented that factors a product of two primes, n = pq, by determining
Lecture 13 - Basic Number Theory.
Lecture 13 - Basic Number Theory. Boaz Barak March 22, 2010 Divisibility and primes Unless mentioned otherwise throughout this lecture all numbers are non-negative integers. We say that A divides B, denoted
Password Cracking in the Cloud
Password Cracking in the Cloud Gautam Korlam Department of Computer Science, UC Santa Barbara [email protected] Report for CS290G Network Security Professor: Dr. Çetin Kaya Koç ABSTRACT Cloud computing
Elements of Applied Cryptography Public key encryption
Network Security Elements of Applied Cryptography Public key encryption Public key cryptosystem RSA and the factorization problem RSA in practice Other asymmetric ciphers Asymmetric Encryption Scheme Let
A SOFTWARE COMPARISON OF RSA AND ECC
International Journal Of Computer Science And Applications Vol. 2, No. 1, April / May 29 ISSN: 974-13 A SOFTWARE COMPARISON OF RSA AND ECC Vivek B. Kute Lecturer. CSE Department, SVPCET, Nagpur 9975549138
Walter Fumy discusses the importance of IT security standards in today s world and the role that SC 27 plays in this field.
27, IT Security Techniques An Interview with Walter Fumy, Chairman of ISO/IEC JTC 1/SC Walter Fumy discusses the importance of IT security standards in today s world and the role that SC 27 plays in this
Cryptography: Authentication, Blind Signatures, and Digital Cash
Cryptography: Authentication, Blind Signatures, and Digital Cash Rebecca Bellovin 1 Introduction One of the most exciting ideas in cryptography in the past few decades, with the widest array of applications,
2. Cryptography 2.4 Digital Signatures
DI-FCT-UNL Computer and Network Systems Security Segurança de Sistemas e Redes de Computadores 2010-2011 2. Cryptography 2.4 Digital Signatures 2010, Henrique J. Domingos, DI/FCT/UNL 2.4 Digital Signatures
The application of prime numbers to RSA encryption
The application of prime numbers to RSA encryption Prime number definition: Let us begin with the definition of a prime number p The number p, which is a member of the set of natural numbers N, is considered
Table of Contents. Bibliografische Informationen http://d-nb.info/996514864. digitalisiert durch
1 Introduction to Cryptography and Data Security 1 1.1 Overview of Cryptology (and This Book) 2 1.2 Symmetric Cryptography 4 1.2.1 Basics 4 1.2.2 Simple Symmetric Encryption: The Substitution Cipher...
A Comparison Of Integer Factoring Algorithms. Keyur Anilkumar Kanabar
A Comparison Of Integer Factoring Algorithms Keyur Anilkumar Kanabar Batchelor of Science in Computer Science with Honours The University of Bath May 2007 This dissertation may be made available for consultation
COLLEGE ALGEBRA. Paul Dawkins
COLLEGE ALGEBRA Paul Dawkins Table of Contents Preface... iii Outline... iv Preliminaries... Introduction... Integer Exponents... Rational Exponents... 9 Real Exponents...5 Radicals...6 Polynomials...5
A Question of Key Length
A Question of Key Length Does Size Really Matter When It Comes To Cryptography? White Paper December 7, 2015 By Alessio Di Mauro A Question of Key Length 2015 Yubico. All rights reserved. Page 1 of 10
Number Theory and Cryptography using PARI/GP
Number Theory and Cryptography using Minh Van Nguyen [email protected] 25 November 2008 This article uses to study elementary number theory and the RSA public key cryptosystem. Various commands will
159.334 Computer Networks. Network Security 1. Professor Richard Harris School of Engineering and Advanced Technology
Network Security 1 Professor Richard Harris School of Engineering and Advanced Technology Presentation Outline Overview of Identification and Authentication The importance of identification and Authentication
CSC474/574 - Information Systems Security: Homework1 Solutions Sketch
CSC474/574 - Information Systems Security: Homework1 Solutions Sketch February 20, 2005 1. Consider slide 12 in the handout for topic 2.2. Prove that the decryption process of a one-round Feistel cipher
Module: Applied Cryptography. Professor Patrick McDaniel Fall 2010. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Applied Cryptography Professor Patrick McDaniel Fall 2010 Page 1 Key Distribution/Agreement Key Distribution is the process where we assign
Two Integer Factorization Methods
Two Integer Factorization Methods Christopher Koch April 22, 2014 Abstract Integer factorization methods are algorithms that find the prime divisors of any positive integer. Besides studying trial division
Cryptography and Network Security
Cryptography and Network Security Spring 2012 http://users.abo.fi/ipetre/crypto/ Lecture 7: Public-key cryptography and RSA Ion Petre Department of IT, Åbo Akademi University 1 Some unanswered questions
How To Encrypt Data With Encryption
USING ENCRYPTION TO PROTECT SENSITIVE INFORMATION Commonwealth Office of Technology Security Month Seminars Alternate Title? Boy, am I surprised. The Entrust guy who has mentioned PKI during every Security
Notes on Network Security Prof. Hemant K. Soni
Chapter 9 Public Key Cryptography and RSA Private-Key Cryptography traditional private/secret/single key cryptography uses one key shared by both sender and receiver if this key is disclosed communications
Modern Factoring Algorithms
Modern Factoring Algorithms Kostas Bimpikis and Ragesh Jaiswal University of California, San Diego... both Gauss and lesser mathematicians may be justified in rejoicing that there is one science [number
HYPERELLIPTIC CURVE METHOD FOR FACTORING INTEGERS. 1. Thoery and Algorithm
HYPERELLIPTIC CURVE METHOD FOR FACTORING INTEGERS WENHAN WANG 1. Thoery and Algorithm The idea of the method using hyperelliptic curves to factor integers is similar to the elliptic curve factoring method.
CIS 5371 Cryptography. 8. Encryption --
CIS 5371 Cryptography p y 8. Encryption -- Asymmetric Techniques Textbook encryption algorithms In this chapter, security (confidentiality) is considered in the following sense: All-or-nothing secrecy.