1. Fuw-Yi Yang1 Public Key Cryptography 公開金鑰密碼 Department of Computer Science and Information Engineering, Chaoyang University of Technology 朝陽科技大學資工系 Speaker: Fuw-Yi Yang 楊伏夷 伏夷非征番, 道德經 察政章 (Chapter 58) 伏 者潛藏也 道紀章 (Chapter 14) 道無形象, 視之不可見者曰 夷

2. Fuw-Yi Yang2 問題 兩個素不相識、未曾謀面的個體, 如何經由公 開管道秘密通信 ?

3. Fuw-Yi Yang3 RSA Public Key Cryptosystem 1/3 RSA 公開金鑰密碼系統 ㄚ蜜的 公開金鑰 : n = 77, e = 7 ( 私藏秘密金鑰 d = 43) 任何人寄資料 ( 資料 m = 5) 給ㄚ蜜 : 密文 c = m e mod 77 = 5 7 mod 77 = 5  5  5  5  5  5  5 mod 77 = 125  5  125 mod 77 = 48  5  48 mod 77 = 9  48 mod 77 = 47 將密文 c = 47 經由公開網路傳遞給ㄚ蜜

4. Fuw-Yi Yang4 RSA Public Key Cryptosystem 2/3 RSA 公開金鑰密碼系統 ㄚ蜜的 公開金鑰 : n = 77, e = 7 ( 私藏秘密金鑰 d = 43) 當ㄚ蜜收到密文 c 時, 解密 : 密文 c = 47 資料 m = c d mod 77 = 47 43 mod 77 = 47  47  …  47 mod 77 = 23  53  47 mod 77 = 5 Note: 23 = 47 10 mod 77, 53 =47 32 mod 77

5. Fuw-Yi Yang5 RSA Public Key Cryptosystem 3/3 RSA 公開金鑰密碼系統 破密者知道ㄚ蜜的公開金鑰 : n = 77, e = 7 卻無法解出 其私藏秘密金鑰 d = 43, 因為分解因素是待解的數學難題 之一. 例如 : n 是兩個大質數的乘積且 n 的值約為 2 1024 ( 約為 10 310 ) 若使用 10 G Hz CPU, 分解因素耗時 10 300 秒 或 1.157 * 10 295 天

6. Fuw-Yi Yang6 RSA Public Key Cryptosystem 1/2 RSA 公開金鑰密碼系統 — 簽章 ㄚ蜜的 公開金鑰 : n = 77, e = 7 ( 私藏秘密金鑰 d = 43) ㄚ蜜簽署資料 ( 資料 m = 5): 簽體 s = m d mod 77 = 5 43 mod 77 = 5 ...  5 mod 77 = 23  48 mod 77 = 26 mod 77 (5 3 = 48 mod 77, 5 40 = 23 mod 77)

7. Fuw-Yi Yang7 RSA Public Key Cryptosystem 2/2 RSA 公開金鑰密碼系統 — 簽章 ㄚ蜜的 公開金鑰 : n = 77, e = 7 ( 私藏秘密金鑰 d = 43) 任何人收到 (s = 26 與 m = 5 ) 皆可驗證之 : 計算 v = s e mod 77 = 26 7 mod 77 = 26  26  26  26  26  26  26 mod 77 = 20  20  26 mod 77 = 5 mod 77 (26 3 = 20 mod 77) 驗證 m 與 v 是否相等

8. William Stallings, Fuw-Yi Yang8 The Finite Field – Groups 1/2 Groups: A group G, denoted by {G,  }, is a set of elements with a binary operation  such that: (A1) Closure: a, b  G implies that a  b  G (A2) Associative: a, b, c  G implies that a  (b  c) = (a  b)  c (A3) Identity: For all a in G, there is an element e in G s.t. a = a  e = e  a (A4) Inverse: For all a in G, there exists an element b (a -1 ) in G, s.t. e = a  b Abelian group: (A5 Commutative law: a  b = b  a for all a, b in G

9. William Stallings, Fuw-Yi Yang9 The Finite Field – Groups -2/2 Example: {,  } G = {1, 2, 3, 4,5, 6},  is modular multiplication (mod 7) 5  3 mod 7 = 1, (5 -1 = 3, 3 -1 = 5) 2  6 mod 7 = 5, 6  2 mod 7 = 5, (Abelian group)

10. William Stallings, Fuw-Yi Yang10 The Finite Field – Rings 1/5 Rings: A ring G, denoted by {R, +,  }, is a set of elements with two binary operations, addition + and multiplication  such that: (A1)~(A5): R is an abelian group with respect to addition (M1) Closure under  : a,b  R implies that a  b  R (M2) Associative: a,b,c  R implies that a  (b  c) = (a  b)  c (M3) Distributive: a  (b + c) = a  b + a  c (a + b)  c = a  c + b  c f or all a,b,c in R, (M4) Commutative law: a  b = b  a for all a, b in R

11. William Stallings, Fuw-Yi Yang11 The Finite Field – Rings (integral domain) 2/5 Integral Domain: (M5) Multiplicative identity: there is an element 1 in R s.t. a = a  1 = 1  a (M6) No zero divisors: If a, b in R and a  b = 0, then either a = 0 or b = 0

12. William Stallings, Fuw-Yi Yang12 The Finite Field – Fields 3/5 Fields: A field F, denoted by {F, +,  }, is a set of elements with two binary operations, addition + and multiplication  such that: (A1)~(M6): F is an integral domain (M7): Multiplicative inverse: For each a in F, except 0, there is an element a -1 in F s.t. a  a -1 = a -1  a = 1 Example: Finite field of order p n : Galois field GF(p n )

13. William Stallings, Fuw-Yi Yang13 The Finite Field – GF(7)-addition 4/5 modulo 7 +0123456 00123456 11234560 22345601 33456012 44560123 55601234 66012345

14. William Stallings, Fuw-Yi Yang14 The Finite Field – GF(7)-multiplication 5/5 modulo 7  0123456 0 1123456 2246135 3362514 4415263 5531642 6654321

15. William Stallings, Fuw-Yi Yang15 The Finite Field – GF(7)-multiplication 5/5 modulo 7  0123456 0 1123456 2246135 3362514 4415263 5531642 6654321

16. Fuw-Yi Yang16 Anonymous User Identification 1/15 1. T. S. Wu and C. L. Hsu, “ Efficient user identification scheme with key distribution preserving anonymity for distributed computer networks, ” Computers & Security, Vol. 23(2), pp. 120-125, 2004. 2. K. Mangipudi and R. Katti, “ A secure identification and key agreement protocol with user anonymity (SIKA), ” Computers & Security, Vol. 25, pp. 420-425, 2006. 3. W. B. Lee and C. C. Chang, “ User identification and key distribution maintaining anonymity for distributed computer network, ” Computer Systems Science and Engineering, Vol. 15, No. 4, July 2000, pp. 113-116. 4. Y. Yang, S. Wang, F. Bao, J. Wang and R. H. Deng, “ New efficient user identification and key distribution scheme providing enhanced security, ” Computers & Security, Vol. 23, pp. 697-704, 2004. //5. C. C. yang, Y. L. Tang, R. C. wang and H. L. Yang, “ A secure and efficient authentication protocol for anonymous channel in wireless communications, ” Applied mathematics and computation, Vol. ??, pp. ??, 2005.

17. Fuw-Yi Yang17 Anonymous User Identification 2/15 W. B. Lee and C. C. Chang 1. Key generation: Smart Card Producing Center SCPC chooses large primes p and q, computes N = p  q, g  Z N *, hash function f, and e, d such that e  d = 1 mod  (N). Public key: N, e, g, f; Secret key: p, q, d  (N) denotes the Euler totient function, i.e. the cardinality of Z N * = {a| a  Z N and gcd(a, N) = 1}. ex. Z 15 * = {1, 2, 4, 7, 8, 11, 13, 14}. H is a collision-resistant hash function, H: {0, 1}*  {0, 1} l. ex. Given the pre-image, it is easy to find the image of H; given the image it is difficult to find the its image.

18. Fuw-Yi Yang18 Anonymous User Identification 3/15 W. B. Lee and C. C. Chang 1. Key generation: SCPC In a secure way, SCPC sends each user U i or provider P j (with identity ID i or ID j ) a secret token S i = (ID i ) d mod N. 2. Anonymous user identification:

19. Fuw-Yi Yang19 Anonymous User Identification 4/15 W. B. Lee and C. C. Chang UiUi PjPj  request zz z = g k mod N x = S i z t 1 g f(T)  t 2 mod N y 1 = g e  t 1 mod N y 2 = g e  t 2 mod N  x, y 1, y 2, T Check T, and whether an existing user’s ID satisfies ID i = x e /(y 1 k y 2 f(T) ) mod N

20. Fuw-Yi Yang20 Anonymous User Identification 5/15 W. B. Lee and C. C. Chang UiUi PjPj z = g k mod N x = S i z t 1 g f(T)  t 2 mod N = (ID i ) d g k  t 1 g f(T)  t 2 mod N y 1 = g e  t 1 mod N y 2 = g e  t 2 mod N K ij = z e  t 1 = g e  k  t 1 mod N ID i = x e /y 1 k y 2 f(T) =(ID i ) d  e g e  k  t 1 g e  f(T)  t 2 /g e  k  t 1 g e  f(T)  t 2 = (ID i ) d  e = ID i mod N K ij = y 1 k = g e  k  t 1 mod N

21. Fuw-Yi Yang21 Anonymous User Identification 6/15 Weakness of W. B. Lee and C. C. Chang [1] UiUi PjPj 1. No authentication of P j 2. Assume that compromise of K ij x = S i z t 1 g f(T)  t 2 mod N y 1 = g e  t 1 mod N y 2 = g e  t 2 mod N K ij = z e  t 1 = g e  k  t 1 mod N ID i = x e /y 1 k y 2 f(T) mod N K ij = y 1 k = g e  k  t 1 mod N Known K ij = y 1 k, ID i is computed.

22. Fuw-Yi Yang22 Anonymous User Identification 7/15 T. S. Wu and C. L. Hsu 1. Key generation: SCPC In a secure way, SCPC sends each user U i or provider P j (with identity ID i or ID j ) a secret token S i = (ID i ) d mod N. 2. Anonymous user identification:

23. Fuw-Yi Yang23 Anonymous User Identification 8/15 T. S. Wu and C. L. Hsu UiUi PjPj  request zz z = S j g k mod N a = z e /ID j = g e  k mod N x = S i f(a t || T) mod N y = g e  t mod N  x, y, T Check T, and whether an existing user’s ID satisfies ID i = (x/f(y k || T) e mod N

24. Fuw-Yi Yang24 Anonymous User Identification 9/15 T. S. Wu and C. L. Hsu UiUi PjPj z = S j g k mod N a = z e /ID j = g e  k mod N x = S i f(a t || T) mod N y = g e  t mod N K ij =a t  x = g e  k  t  x mod N Check T, ID i = (x/f(y k || T) e = [(ID i ) d f(a t ||T)/f(y k ||T)] e = [(ID i ) d f(g e  k  t ||T)/f(g e  k  t ||T)] e = (ID i ) d  e = ID i mod N K ij =y k  x = g e  k  t  x mod N

25. Fuw-Yi Yang25 Anonymous User Identification 10/15 Weakness of T. S. Wu and C. L. Hsu [4] UiUi PjPj Disclosure of user’s token S i a = z e /ID j = g e  k mod N x = S i f(a t || T) mod N y = g e  t mod N K ij =a t  x = g e  k  t  x mod N Check T, ID i = (x/f(y k || T) e = [(ID i ) d f(a t ||T)/f(y k ||T)] e = [(ID i ) d f(g e  k  t ||T)/f(g e  k  t ||T)] e = ID i mod N S i = (x/f(y k || T) = [(ID i ) d f(a t ||T)/f(y k ||T)] mod N

26. Fuw-Yi Yang26 Anonymous User Identification 11/15 Y. Yang et al. 1. Key generation: SCPC In a secure way, SCPC sends each user U i or provider P j (with identity ID i or ID j ) a secret token S i = (ID i ) d mod N. 2. Anonymous user identification:

27. Fuw-Yi Yang27 Anonymous User Identification 12/15 Y. Yang et al. UiUi PjPj  request zz z = g k / S j mod N a = z e  ID j = g e  k mod N K ij =a t = g e  k  t mod N x = g e  t mod N s = g t  (S i ) h(x, T) mod N y = E K ij (ID i )  s, x, y, T K ij =x k = g e  k  t mod N ID i = D K ij (y) Check ID i  user list and x  (ID i ) h(x, T) = s e mod N

28. Fuw-Yi Yang28 Anonymous User Identification 13/15 Weakness of Y. Yang et al. [2] UiUi Middle man PjPj My comments: compromise of session key K ij will disclose user’s identity. [2]’s comments: DOS attack Shown below Other attacks: homomorphic attack on secret token.  z' z = g k / S j mod N a' = (z') e  ID j mod N K' ij =(a') t mod N x = g e  t mod N s = g t  (S i ) h(x, T) mod N y' = E K' ij (ID i ) U i believes that a valid session key is derived.  s, x, y', T K ij =x k = g e  k  t mod N ID i = D K ij (y) Check ID i  user list and x  (ID i ) h(x, T) = s e mod N It is easy to see, P j abort. Yangfy: (ID i ) h(x, T) = s e / x mod N test whether ID i ‘s participation

29. Fuw-Yi Yang29 Anonymous User Identification 14/15 K. Mangipudi and R. Katti 1. Key generation: SCPC In a secure way, SCPC sends each user U i or provider P j (with identity ID i or ID j ) a secret token S i = (ID i ) d mod N. Server ’ s public key: N s = p s  q s, e s, g s  Z N s Secret key: d s 2. Anonymous user identification:

30. Fuw-Yi Yang30 Anonymous User Identification 15/15 Y. Yang et al. UiUi PjPj  req  z, T, w z = g k / S j mod N w = (g s ) H(z, T, IDs)  d s mod N s Ck w e s = (g s ) H(z, T, IDs) mod N s a = z e  ID j = g e  k mod N K ij =a t = g e  k  t mod N x = g e  t mod N s = g t  (S i ) H(x, T) mod N y = E K ij (ID i )  s, x, y, T K ij =x k = g e  k  t mod N ID i = D K ij (y) Check ID i  user list and x  (ID i ) h(x, T) = s e mod N

31. Fuw-Yi Yang31 Anonymous User Identification Weakness of K. Mangipudi and R. Katti By yangfy UiUi PjPj My comments: compromise of session key K ij will disclose user’s identity. Server’s public key is not required.  req Other attacks: homomorphic attack on secret token. Check ID i  user list is not required.  z, T, w z = g k / S j mod N w = (g s ) H(z, T, IDs)  d s mod N s a = z e  ID j = g e  k mod N K ij =a t = g e  k  t mod N x = g e  t mod N s = g t  (S i ) H(x, T) mod N y = E K ij (ID i )  s, x, y, T K ij =x k = g e  k  t mod N ID i = D K ij (y) Check ID i  user list and x  (ID i ) h(x, T) = s e mod N

32. Fuw-Yi Yang32 Deniable Authentication protocol 1/15 1. L. Fan, C. X. Xu and J. H. Li, “ Deniable authentication protocol based on Diffie-Hellman algorithm, ” Electronics Letters, Vol. 38(4), pp. 705-706, 2002. 2. C. Dwork, M. Naor and A. Sahai, “ Concurrent zero-knowledge, ” Proceedings of the Thirtieth Annual ACM Symposium on the Theory of Computing STOC ’ 98, pp. 409-418, 1998. 3. Y. Aumann and M. Rabin, “ Efficient deniable authentication of long messages, ” Int. Conf. on Theoretical Computer Science in Honor of Professor Manuel Blum ’ s 60th birthday, 1998. (http://www.cs.cityu.edu.hk/dept/video.html) 4. Y. Aumann and M. Rabin, “ Authentication enhanced security and error correcting codes, ” Advances in Cryptology- CRYPTO ’ 98, LNCS 1462, pp. 299-303, 1998. 5. X. Deng, C. H. Lee and H. Zhu, “ Deniable authentication protocols, ” IEE Proceedings Computers and Digital Techniques, Vol. 148(2), pp. 101-104, 2001.

33. Fuw-Yi Yang33 Deniable Authentication protocol 2/15 Aumann and Rabin 1/2 Features: 1. receiver is able to authenticate the source of a message received. 2. the receiver cannot prove the source of the message to a third party. PD: public known directory, containing a set of public data and encoding rules. N = p  q (no one knows the value of p and q) R: Receiver S: Sender X: x 1 x 2 … x n message sent to R by S C(X): y 1 y 2 … y m encoding of message X. C is a public encoding rule. I: i 1 i 2 … i k k different indices between 1 and m. S select a set of random number: g 1 (0), g 1 (1), …,g m (0), g m (1) S computes square of them: G j (e) = (g j (e) ) 2 … mod N, j = 1, …,m, e = 0, 1 S publishes at G j (e), j = 1, …,m, e = 0, 1 at PD.

34. Fuw-Yi Yang34 Deniable Authentication protocol 2/15 Aumann and Rabin 2/2 S To deniably authenticate one bit of encoded R message C(X). A = a 2 mod N A A  ii i  R I (the ith bit)  i = a  g i (e) mod N e = y i i i  Check that (  i ) 2 = A  G i (e) mod N R simulate S as follows: 1. Choose i 2. Known y i 3.  i  R Z N * 4. A = (  i ) 2 /G i (e) mod N

35. Fuw-Yi Yang35 Deniable Authentication protocol 2/15 Deng et al. 1/2 Like the scheme of Aumann and Rabin, except that C(.) is replaced by a collision resistant hash function. PD: public known directory, containing a set of public data and encoding rules. N = p  q (no one knows the value of p and q) R: Receiver S: Sender X: x 1 x 2 … x n message sent to R by S H(X): z 1 z 2 … z m encoding of message X, | z i | = s (block size ). H is a public hash function. S select a set of random number: g 1, g 2, …,g m S computes square of them: G j = (g j ) 2 … mod N, j = 1, …,m S publishes at G j, j = 1, …,m, at PD. E PKR () denote the public key encryption algorithm, which is secure against CCA.

36. Fuw-Yi Yang36 Deniable Authentication protocol 2/15 Deng et al. 2/2 S To deniably authenticate one block of encoded R message H(X). A = a 2 mod N A A  ii i  R {1,…,m} (the ith block)  i = a g i mod N i = H(  i ) z i (Apply hash function z i times with input  i ) E PKR (  i ), i  Decrypt the ciphertext to obtain the clear message  i, and Check that i = H(  i ) z i and (  i ) 2 = A  G i mod N

37. Fuw-Yi Yang37 Deniable Authentication protocol 2/15 Deng et al. 1/2 Lemma 1: The protocol described in Section 3.1is deniable. Proof: Simulation can be performed by R as follows: 1. Choose i  R {1,…,m} 2.  i  R Z N * 3. E PKR (  i ) 4. A = (  i ) 2 /G i mod N 5. i = H(  i ) z i Thus, (A, i, E PKR (  i ), i ) is a simulation of the message block z i. Note that the simulation is indistinguishable from the actual message authenticator (E PKR (  i ), i ) computed by S.

38. Fuw-Yi Yang38 Deniable Authentication protocol 2/15 Deng et al. 1/2 Lemma 2: The protocol described in Section 3.1authenticates the source of the message. Proof: 1. If a simulator is not the receiver R, then the simulation described in Lemma 1 does not work. 2. If someone sends the square root of A  G i mod N to R, then they either know both square roots of A and G i or two factors of N.

39. Fuw-Yi Yang39 Deniable Authentication protocol 2/15 Deng et al. Based on DLP 1/2 PD: public known directory, containing a set of public data and encoding rules. p = 2  q + 1, g  Z p * is of order q. R: Receiver S: Sender X: x 1 x 2 … x n message sent to R by S H(X): z 1 z 2 … z m encoding of message X, | z i | = s (block size ). H is a public hash function. S select a set of random number: r 1, r 2, …,r m  Z q *. S computes : G j = (g) r j … mod N, j = 1, …,m S publishes at G j, j = 1, …,m at PD. E PKR () denote the public key encryption algorithm, which is secure against CCA.

40. Fuw-Yi Yang40 Deniable Authentication protocol 2/15 Deng et al. Based on DLP 2/2 S To deniably authenticate one block of encoded R message H(X). A = g a mod p A A  ii i  R {1,…,m} (the ith block)  i = a + r i mod q i = H(  i ) z i (Apply hash function z i times with input  i ) E PKR (  i ), i  Decrypt the ciphertext to obtain the clear message  i, and Check that i = H(  i ) z i and g u i = A  G i mod p.

41. Fuw-Yi Yang41 Deniable Authentication protocol 2/15 Fan et al.