1. Cryptography Lecture 9

2. 民间传说着一则故事 ——“ 韩信点兵 ” 。 秦朝末年，楚汉相争。一次，韩信将 1500 名将士与楚王大将李锋交战。 苦战一场，楚军不敌，败退回营，汉军也死伤四五百人，于是韩信整顿 兵马也返回大本 营。当行至一山坡，忽有后军来报，说有楚军骑兵追来。 只见远方尘土飞扬，杀声震天。汉军本来已十分疲惫，这时队伍大哗。 韩信兵马到坡顶，见来敌不足五百 骑，便急速点兵迎敌。他命令士兵 3 人一排，结果多出 2 名；接着命令士兵 5 人一排，结果多出 3 名；他又命 令士兵 7 人一排，结果又多出 2 名。韩信马上向将士们 宣布：我军有 1073 名勇士，敌人不足五百，我们居高临下，以众击寡，一定能打败敌人。 汉军本来就信服自己的统帅，这一来更相信韩信是 “ 神仙下凡 ” 、 “ 神 机妙算 ” 。 于是士气大振。一时间旌旗摇动，鼓声喧天，汉军步步进逼，楚军乱作一团。 交战不久，楚军大败而逃。 Ancient Application of Number Theory (from http://yangwen.blog.51cto.com/337928/98089)

3. Ancient Application of Number Theory

4. Cryptography AliceBob Cryptography is the study of methods for sending and receiving secret messages. adversary Goal: Even though an adversary can listen to your conversation, the adversary can not learn what the message was. message

5. Cryptography AliceBob adversary Goal: Even though an adversary can listen to your conversation, the adversary can not learn what the message was. message -> f(message) f(message) encrypt the messagedecrypt the message f(message) -> message But the adversary has no clue how to obtain message from f(message) A difficult goal!

6. Key AliceBob adversary Goal: Even though an adversary can listen to your conversation, the adversary can not learn what the message was. message -> f(message,key) f(message, key) encrypt the message using the keydecrypt the message using the key f(message,key) -> message But the adversary can not decrypt f(message,key) without the key Use number theory!

7. Turing’s Code (Version 1.0) The first step is to translate a message into a number “v i c t o r y” -> 22 09 03 20 15 18 25 Beforehand The sender and receiver agree on a secret key, which is a large number k. Encryption The sender encrypts the message m by computing: m* = m · k Decryption The receiver decrypts m by computing: m*/k = m · k/k = m

8. Turing’s Code (Version 1.0) AliceBob adversary mk m = message k = key encrypted message = mk Why the adversary cannot figure out m? mk = received message k = key decrypted message = mk/k=m The adversary doesn’t have the key k, and so can only factor mk to figure out m, but factoring is a difficult task to do.

9. Turing’s Code (Version 1.0) AliceBob adversary mk m = message k = key encrypted message = mk mk = received message k = key decrypted message = mk/k=m So why don’t we use this Turing’s code today? Major flaw: if you use the same key to send two messages m and m’, then from mk and m’k, we can use gcd(mk,m’k) to figure out k, and then decrypt every message.

10. Turing’s Code (Version 2.0) Beforehand The sender and receiver agree on a large prime p, which may be made public. (This will be the modulus for all our arithmetic.) They also agree on a secret key k in {1, 2,..., p − 1}. Encryption The message m can be any integer in the set {0, 1, 2,..., p − 1}. The sender encrypts the message m to produce m* by computing: m* = rem(mk, p) Decryption Let k’ be the multiplicative inverse of k under modulo p. m*  mk (mod p) m*k’  m (mod p) m*k’ = m

11. Turing’s Code (Version 2.0) AliceBob adversary m* = rem(mk,p) m = message k = key encrypted message = rem(mk,p) Why the adversary cannot figure out m? m* = received message k = key decrypted message = m*k’ =m Many m and k can produce m* as output, just impossible to determine m without k. Public information p

12. Turing’s Code (Version 2.0) AliceBob adversary m* = rem(mk,p) m = message k = key encrypted message = rem(mk,p) m* = received message k = key decrypted message = m*k’ =m If the adversary somehow knows m, then first compute m’ := multiplicative inverse of m m*  mk (mod p) m*m’  k (mod p) So the adversary can figure out k. Public information p So why don’t we use this Turing’s code today? plain-text attack

13. Private Key Cryptosystem AliceBob adversary message -> f(message,key) f(message, key) encrypt the message using the keydecrypt the message using the key f(message,key) -> message But the adversary can not decrypt f(message,key) without the key Two parties have to agree on a secret key, which may be difficult in practice. If we buy books from Amazon, we don’t need to exchange a secret code. Why is it secure?

14. Public Key Cryptosystem AliceBob adversary message -> f(message,Bob’s key) f(message, Bob’s key) encrypt the message using Bob’s keydecrypt the message f(message,Bob’s key) -> message But the adversary can not decrypt f(message, Bob’s key)! Public information: Key for AlicePublic information: Key for Bob Only Bob can decrypt the message sent to him! How is it possible??? There is no need to have a secret key between Alice and Bob.

15. RSA Cryptosystem RSA are the initials of three Computer Scientists, Ron Rivest, Adi Shamir and Len Adleman, who discovered their algorithm when they were working together at MIT in 1977.

16. How to Choose Public Key? (The following slides are from HKUST COMP170.)

17. How to Encrypt and Decrypt?

18. Decryption

21. Easy Case

23. Interesting Case

25. Decryption

27. Prime Factors

28. Decryption

30. Correctness of RSA Cryptosystem

31. Why is this Secret?

32. RSA Example

34. Exponentiation mod n

37. Repeated Squaring