Chapter 4: Public Key Cryptography: Diffie-Hellman key-exchange protocol (Week 6)

Chapter 4: Public Key Cryptography: Diffie-Hellman key-exchange protocol (Week 6) 8 The Diffie-Hellman Key Exchange protocol This was invented by Whitfield Diffie and Martin Hellman 8 in 1976. It is a method for creating a shared secret numeric key over an open channel with potential eavesdroppers. The two protagonists don t have any (real) control over what actual number their secret key is. (The key will then be used in a symmetric key 9 algorithm such as DES and AES see next week s lectures). Let G = (Z/pZ) be the multiplicative elements mod p. It is a cyclic group of order p 1. Since it is cyclic, it has a generator g, which means (Z/pZ) = {g, g 2, g 3,..., g p 1 }. Example. A generator for (Z/11Z) is g = 2. We have {2, 2 2, 2 3, 2 4, 2 5, 2 6, 2 7, 2 8, 2 9, 2 10 } = {2, 4, 8, 5, 10, 9, 7, 3, 6, 1} which is all the invertible elements mod 11. Remark. To say a number g is a primitive root modulo p is the same as saying g is a generator for (Z/pZ). The algorithm works as follows: Fix a prime p and a primitive root g. Publish these. Alice secretly chooses an exponent a, and sends A = g a (mod p) to Bob. Bob secretly chooses an exponent b and sends B = g b (mod p) to Alice. Alice and Bob now share a secret, K = g ab (mod p), since Bob can calculate K = A b = g ab and Alice can calculate K = B a = g ab but Eve only knows g a and g b. They use this key to seed a traditional symmetric cipher, like DES or AES etc. The key to this protocol is that exponentiating numbers is easy, whereas taking discrete logarithms is (believed to be) hard at least for certain primes. Definition. Given a generator of g and a number A (Z/pZ), we say that a is the discrete log of A with respect to g modulo p, if A g a (mod p). 8 New directions in cryptography, IEEE Transactions on Information Theory 22 (1976), 644-654 9 A symmetric key algorithm is one where the same key is used to encode and decode. Asymptotic algorithms, such as PKC, are where different keys are needed for encoding and decoding. 29

8 The Diffie-Hellman Key Exchange protocol Diffie-Hellman Example. Let p = 9967 (a prime) and g = 3 (a primitive root modulo 9967). Alice secretly chooses 34 = (100010) 2 = 2 5 + 2 1, and works out so 3 2 = 9 She send 6366 to Bob. 3 4 = 9 2 = 81 3 8 = 81 2 = 6561 3 16 = 6561 2 = 43046721 9215 (mod 9967) 3 32 9215 2 (mod 9967) = 84916225 7352 (mod 9967) 3 34 = 3 32 3 2 7352 9 6366 (mod 9967) Meanwhile, Bob secretely chooses 37 = 2 5 + 2 2 + 1, and, calculating the same table as Alice, works out 3 37 = 3 32 3 4 3 7352 81 3 2443 (mod 9967) and he sends 2443 to Alice. Public Secret Alice 6366 34 Bob 2443 37 Alice now takes the number Bob sent her, 2443, and raises it to her secret number, 34, using the fast exponentiation method. She obtains k = 2443 34 7782 (mod 9967) Bob takes the number Alice sent him, 6366, and raises it to his secret number 37, and obtains The two keys match! k = 6366 37 7782 (mod 9967) Public Secret Shared Alice 6366 34 7782 Bob 2443 37 7782 The reason this works is because Alice knows a and g b (sent to her from Bob). She calculates (g b ) a = g ab. Whereas Bob knows b and g a (sent to him by Alice), and calculates (g a ) b = g ab. Remark. Given p = 9967 and g = 3, and knowing the number 6366, it is hard to find the x such that 3 x 6366 (mod 9967). Such an x is known as the discrete log of 6366 in base 3 modulo 9967. (In this case we know the discrete log equals 34). 30

Diffie-Hellman 8 The Diffie-Hellman Key Exchange protocol Remark. Currently the only way known to decrypt such secrets is to find discrete logarithms, in the sense of seeing Alice s g a find her a. However, that might not be necessary. The Diffie- Hellman-problem or DHP is as follows: If you know g and p (which is public) and you can find g a and g b (from tapping into telephone lines) can you find g ab without first finding a and b? Remark. Note that in this system Alice and Bob have no real control over what the shared key will be. Therefore, this approach cannot be used to send messages. Remark (Historical). Martin Hellman, in An Overview of Public Key Cryptography 50 th Anniversary Commemorative Issue (May 2002) of the IEEE Communications Magazine, said: The system I called the ax1x2 system in this paper has since become known as Diffie-Hellman key exchange. While that system was first described in a paper by Diffie and me, it is a public key distribution system, a concept developed by Merkle, and hence should be called Diffie-Hellman-Merkle key exchange if names are to be associated with it. I hope this small pulpit might help in that endeavor to recognize Merkles equal contribution to the invention of public key cryptography. Space does not permit an explanation of the quirk of fate that seems to have deprived Merkle of the credit he deserves, but a quirk it is. 8.1 ElGamal This was invented in 1985 by Taher Elgamal. (His surname is all lowercase after the first letter, but his cryptosystem traditionally has a capital G in the middle). It uses the same technology as Diffie-Hellman, but allows Alice and Bob to exchange messages, rather then just keys. Assume the prime p and generator g are known. Alice wishes to send a message m to Bob. We will assume that the message is numeric (else convert it to one) and satisfies 0 m < p (else break the message into smaller pieces). Bob secretly chooses an exponent b, finds B g b (mod p) and sends B to Alice. Alice chooses an a and finds A = g a. She also finds t = B a m. She sends (t, A) to Bob. Bob finds t A b g ba m (g a ) b m (mod p), and hence has Alice s message. Remark. Although not essential, it will be good if Bob s b can be chosen coprime to p 1. This is because B = g b will then also be a primitive root mod p, and so B a can then take any and every value in (Z/pZ) with equal probability, and thus all the information in m is lost in t = B a m. If Alice sends two messages m 1 and m 2, say, to Bob using the same a, and if Eve can find the plaintext m 1 somehow, then she can also decode the message to read m 2 too. This is 31

8 The Diffie-Hellman Key Exchange protocol Diffie-Hellman because if Eve knows m 1 then from t 1 = m 1 B a she can find B a. From that, knowing only t 2 = m 2 B a she can find m 2 = t 2 (B a ) 1. Such a scenario isn t as unlikely as it seems. For example, the first message might be a press release still under embargo. Once the embargo has passed, Eve can find out m 1 simply from reading the papers. The conclusion is that to increase the security of messages, Alice should use a different a for each message sent. Therefore a is called an ephemeral key. 8.2 Equivalence between Diffie-Hellman and ElGamal Clearly both these cryptosystems can be broken if one can find discrete logs. However, it might be that a system could still be broken without actually being able to find discrete logs in general. If one has a system that can break either ElGamal or Diffie-Hellman than one can break the other. Let M 1 be a machine that solves the ElGamal problem, in the sense that its input is all the available public data, and its output is the secret message, that is M 1 : (p, g, g a, g b, mg ab ) m then M 1 (p, g, g a, g b, 1) = g ab and inverting this mod p (possible using Euclid s algorithm, for example) solves the Diffie-Hellman problem, since K = g ab. Similarly if M 2 is a device that can solve a Diffie-Hellman problem, then it can be used to solve ElGamal. That is, let M 2 : (p, q, g a, g b ) g ab then given g b (from Bob) and (t, g a ) (from Alice), use the machine to find K = g ab, find its inverse (via Euclid s algorithm) and calculate m = tk 1. 8.3 Bit commitment with Diffie-Hellman Suppose Alice and Bob wish to bet on the outcome of a coin toss, but without actually meeting. Clearly Alice cannot toss the coin and have Bob call, for then Alice has the opportunity to lie and say coin-toss was the opposite of Bob s declaration. But equally, Alice cannot tell Bob the outcome of the coin toss before he has called what he thinks it will be, for then Bob can simply make his call be the result of the toss. There exists a Diffie-Hellman-like approach which solves this problem, and means Alice can toss the coin, and send the result to Bob in such a way that he cannot tell what the outcome was and Alice is committed to the outcome. (This assumes Bob cannot find discrete logarithms). Alice and Bob agree the following protocol. The agree on a prime p and a generator g. Alice will toss the coin, and will then choose a random a whose 7 th bit is 1 if the toss was heads and 0 if it was tails. She sends A g a (mod p) to Bob. Bob then declares to Alice his call 32

Diffie-Hellman 8 The Diffie-Hellman Key Exchange protocol of heads or tails. Alice can then let him know if he has won or lost, and sends him a. Bob can look at the 7 th bit of a and check it really does equal 0 or 1 (depending on the coin toss outcome Alice informed him of) and can check that g a really does equal A, so Alice cannot cheat by changing the result after hearing Bob s call. This works because once A is fixed, Alice is fixed into her choice of a, and so is fixed into the result of the coin toss. This method assumes Bob cannot deduce the 7 th bit of a from knowing g a, but this is a good assumption, because 7 is arbitrary (if you could find any arbitrary bit of a knowing only A, you could find the discrete logarithm of A with respect to g). Remark. Choosing the least-significant bit of a to be the result of the coin toss is a bad idea, because that can be found from knowing A. Note that a is even if and only if g a is the square of ±g a/2, which happens if and only if g a is a quadratic residue mod p. But checking whether A is a quadratic residue mod p can be done easily using Legendre symbols. 8.4 Finding primitive roots modulo p When p is a prime, a primitive root modulo p is a number whose powers yield every non-zero number mod p. Thus we see that g being a generator for (Z/pZ) is equivalent to g being a primitive root modulo p. Primitive roots have two very useful properties: Proposition. Let g be a primitive root mod p, and let n, j and k be integers. Then g n 1 (mod p) if and only if n 0 (mod p 1). g j g k (mod p) if and only if j k (mod p 1). Proof. This was properly covered in Introduction to Number Theory. Here s a sketch of the proof. For the first bullet point assume that n 0 (mod p 1), which means n = a(p 1). Then g n ( g p 1) a 1 a 1 (mod p). by Fermat s Little Theorem. Conversely, assume that g n 1 (mod p) and write n = a(p 1) + r with 0 r < p 1. Note that, by Fermat s Little Theorem again, 1 g n g a(p 1) g r g r (mod p). Hence if r 1 we have { g, g 2, g 3,..., g r, g r+1, g r+2,..., g p 1} = { g, g 2, g 3,..., g r, g 1, g 2,... } (here we used the fact that g r = 1). This is cyclic, repeating after every r terms, and thus the set contains only r elements. This contradicts the assumption that g is a primitive root, since its powers must yield every non-zero number mod p (of which there are p 1 terms) 33

8 The Diffie-Hellman Key Exchange protocol Diffie-Hellman and this set has yielded only r terms. The only way for this not to be a contradiction is if r = 0, which means (p 1) n or n 0 (mod p 1). For the second bullet point, note that g j j k = g j k 1 and by the results of the first bullet point, this happens if and only if j k 0 (mod p 1), so j k (mod p 1). Remark. Primitive roots are not unique. Proposition. If g is a primitive root modulo p, then so is g x for any x coprime to p 1. Proof. A corollary of Fermat s Little Theorem is that exponents work modulo p 1. If x is coprime to p 1 then {x, 2x, 3x,..., (p 1)x} {1, 2, 3,..., p 1} (mod p 1), which says that multiplying by x mod p 1 simply rearranges the set. (It is crucial x has an inverse mod p 1 for this statement to be true). Thus { g x, g 2x, g 3x,..., g (p 1)x} { g, g 2, g 3,..., g p 1} {1, 2, 3,..., p 1} (mod p) and so g x is also a primitive root modulo p. Corollary. For a given prime p, there are φ(p 1) primitive roots modulo p. Example. Assuming 2 is a primitive root modulo 13, find all the primitive roots mod 13. Solution. The numbers coprime to 12 are 1,5,7, and 11. Since 2 is a primitive root mod 13, and we have 2 5 6 2 7 11 2 11 7 we see that the four primitive roots mod 13 are 2, 6, 7 and 11. Now, if the prime factorization of p 1 is known, one can quickly check a number to see if it is a primitive root. I ll demonstrate with an example of finding primitive roots modulo 13. Note that 13 1 = 12 = 2 2 3. Now every element of (Z/13Z) has an order, which is the smallest k such that a k 1 (mod 13). This order divides the order of the group (12 in this case), so the possible orders are 1, 2, 3, 4, 6, and 12. The following tables show which values equal 1. order \ power 1 2 3 4 5 6 7 8 9 10 11 12 12 1 6 1 1 4 1 1 1 3 1 1 1 1 2 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 34

Diffie-Hellman 8 The Diffie-Hellman Key Exchange protocol Note that every element which is not a primitive root (that is, every number which does not have order 12) equals 1 when raised to a power of either 6(= 12/2) or 4(= 12/3). Hence, if you wished to check whether 2 is a primitive root modulo 13, rather than raising it to every power between 1 and 12 and ensuring they yield all possible numbers, one simply needs to show that both 2 6 and 2 4 are not congruent to 1 mod 13 to conclude that its order is 12, and hence 2 is a primitive root mod 13. We have and so 2 is is a primitive root. 2 6 12 1 (mod 13) 2 4 3 1 (mod 13) This method also shows that 3 is not a primitive root. To see this note that 3 6 1 (mod 13). Example. Show that 3 is a primitive root modulo 101. Solution. Note that 100 = 2 2 5 2 and so we only need to check powers equal to 100/2 = 50 and 100/5 = 20. One can check that 3 50 100 (mod 101) 3 20 84 (mod 101) and since neither of these are 1, we conclude that 3 is a primitive root mod 101. The general algorithm is as follows: To find primitive roots modulo p, find the prime factors of p 1. Say it equals p 1 = q a 1 1 q a 2 2 q a k k with q i all primes, and a i 1. For the g you wish to test, simply evaluate g (p 1)/q 1, g (p 1)/q 2,..., g (p 1)/q k, and if they are all not equal to 1, then g is a primitive root. If one of them equals 1, then that g is not a primitive root. Simply chose another value of g to test. 35

8 The Diffie-Hellman Key Exchange protocol Diffie-Hellman 36