1. 8.6. Knapsack Ciphers

2. The Concept At the core of the Knapsack cipher is the Knapsack problem: At the core of the Knapsack cipher is the Knapsack problem: Given positive integers a 1, a 2,…,a n & S, Given positive integers a 1, a 2,…,a n & S, which of the a i integers add up to S. As an equation, solve for x i either 1 or 0: S = a 1 x 1 + a 2 x 2 + … + a n x n As an equation, solve for x i either 1 or 0: S = a 1 x 1 + a 2 x 2 + … + a n x n Example: a 1 = 2, a 2 =3, a 3 =4, a 4 =7, a 5 =11, a 6 =13, a 7 =16 and S=18 Example: a 1 = 2, a 2 =3, a 3 =4, a 4 =7, a 5 =11, a 6 =13, a 7 =16 and S=18 Solutions: 16+2, 13+3+2, 11+4+3, 11+7, thus Solutions: 16+2, 13+3+2, 11+4+3, 11+7, thus (1,0,0,0,0,0,1); (1,1,0,0,0,1,0); (0,1,1,0,1,0,0); (0,0,0,1,1,0,0) (1,0,0,0,0,0,1); (1,1,0,0,0,1,0); (0,1,1,0,1,0,0); (0,0,0,1,1,0,0)

3. S = a 1 x 1 + a 2 x 2 + … + a n x n complexity  Good vs. Bad Difficult Calculations when n is large: Difficult Calculations when n is large: Trial and Error  2 n possibilities for (x 1,x 2,…,x n ) Trial and Error  2 n possibilities for (x 1,x 2,…,x n )  infeasible to find all the solutions when n=100 or more  infeasible to find all the solutions when n=100 or more Easier to find solution for certain a 1, a 2,…,a n : Easier to find solution for certain a 1, a 2,…,a n : a j =2 J-1  S= a 1 x 1 + a 2 x 2 + … + a n x n a j =2 J-1  S= a 1 x 1 + a 2 x 2 + … + a n x n = 2 0 x 1 + 2 1 x 2 + … + 2 n-1 x n = x n … x 2 x 1 on binary form (base 2) Thus for the solution is: Thus for the solution is: write S in the binary form! write S in the binary form!

4. Super Increasing Sequences A type of sequence a 1, a 2,…,a n for which it is easier but not trivial to solve knapsack problems A type of sequence a 1, a 2,…,a n for which it is easier but not trivial to solve knapsack problems super increasing sequence if super increasing sequence if j th term > sum of the preceding values Σ k (j-1) a k < a j for j = 2,3,…,n Example1: (2, 3, 7, 13, 28) is super increasing Example1: (2, 3, 7, 13, 28) is super increasing (2, 3, 4, 7, 11, 13, 16) is not Example2 (pb 3): a j+1 > 2a j  super increasing sequence Example2 (pb 3): a j+1 > 2a j  super increasing sequence Example3 (pb 2): a j < 2 j-1  NOT super increasing sequence Example3 (pb 2): a j < 2 j-1  NOT super increasing sequence

5. Example of solving Knapsack problem for super increasing sequence (a 1 =2, a 2 =3, a 3 =7, a 4 =13, a 5 =28) and S=40 (a 1 =2, a 2 =3, a 3 =7, a 4 =13, a 5 =28) and S=40 S≥ a 5  x 5 = 1 since a 1 +a 2 +a 3 +a 4 < a 5 =28 S≥ a 5  x 5 = 1 since a 1 +a 2 +a 3 +a 4 < a 5 =28 S- x 5 a 5 = 12 < a 4 =13  x 4 =0 S- x 5 a 5 = 12 < a 4 =13  x 4 =0 S- (x 5 a 5 + x 4 a 4 )=12 ≥ a 3  x 3 = 1 S- (x 5 a 5 + x 4 a 4 )=12 ≥ a 3  x 3 = 1 S- (x 5 a 5 + x 4 a 4+ x 3 a 3 )=5 ≥ a 2  x 2 = 1 S- (x 5 a 5 + x 4 a 4+ x 3 a 3 )=5 ≥ a 2  x 2 = 1 S- (x 5 a 5 + x 4 a 4 +x 3 a 3 + x 3 a 3 )=2 ≥ a 1  x 1 = 1 S- (x 5 a 5 + x 4 a 4 +x 3 a 3 + x 3 a 3 )=2 ≥ a 1  x 1 = 1 Solution: (1,1,1,0,1) Solution: (1,1,1,0,1)

6. Super Increasing Algorithm S= a 1 x 1 + a 2 x 2 + … + a n x n S= a 1 x 1 + a 2 x 2 + … + a n x n

7. Public cryptosystem: Knapsack Ciphers based on super increasing sequences Merkle and Hellman [MeHe78]. Merkle and Hellman [MeHe78]. Based on a transformed not super increasing sequence b 1, b 2,…,b n Based on a transformed not super increasing sequence b 1, b 2,…,b n from a simple super increasing from a simple super increasing a 1, a 2,…,a n a 1, a 2,…,a n Given m> 2 a n and (ω,m)=1 find ώ Given m> 2 a n and (ω,m)=1 find ώ ώ ω ≡1(mod m)  ώ ≡ ω Φ(m)-1 (mod m) ώ ω ≡1(mod m)  ώ ≡ ω Φ(m)-1 (mod m) Then Find b j Then Find b j b j ≡ ω a j (mod m) a j ≡ ώ b j (mod m) b j ≡ ω a j (mod m) a j ≡ ώ b j (mod m)

8. Observations IF S= b 1 x 1 + b 2 x 2 + … + b n x n Then IF S= b 1 x 1 + b 2 x 2 + … + b n x n Then ώ S ≡ ώ b 1 x 1 + …+ ώ b n x n ώ S ≡ ώ b 1 x 1 + …+ ώ b n x n ≡ a 1 x 1 + …+ a n x n (mod m) ≡ a 1 x 1 + …+ a n x n (mod m) b 1, b 2,…,b n is not super increasing  not easy to solve S= b 1 x 1 + b 2 x 2 + … + b n x n b 1, b 2,…,b n is not super increasing  not easy to solve S= b 1 x 1 + b 2 x 2 + … + b n x n a 1, a 2,…,a n is super increasing  easy to solve a 1, a 2,…,a n is super increasing  easy to solve S 0 = a 1 x 1 + a 2 x 2 + … + a n x n where ώ S ≡ S 0 (mod m) where ώ S ≡ S 0 (mod m) One needs to know m, ω & ώ One needs to know m, ω & ώ

9. Knapsack Cipher Method Choose a 1, a 2,…,a N along with values for m with m>2a N, Choose a 1, a 2,…,a N along with values for m with m>2a N, and ω with (ω, m)=1 and ω with (ω, m)=1 (b 1,…, b N ) is made public. (b 1,…, b N ) is made public. Plaintext P is transformed into binary equivalent using the table on the left (page 319). Plaintext P is transformed into binary equivalent using the table on the left (page 319). P in binary is split into segments of length N (if not divisible by N, add 1s) P in binary is split into segments of length N (if not divisible by N, add 1s) Each segment will play the role of (x 1,x 2,…,x N ) Each segment will play the role of (x 1,x 2,…,x N )

10. Knapsack Cipher Method (cont.) For each segment (x 1,x 2,…,x N ) in P, compute For each segment (x 1,x 2,…,x N ) in P, compute S= b 1 x 1 + b 2 x 2 + … + b N x N S= b 1 x 1 + b 2 x 2 + … + b N x N C= Ciphertext C= Ciphertext = the set of S generated from each (x 1,x 2,…,x N ) in P = the set of S generated from each (x 1,x 2,…,x N ) in P = difficult to find (x 1,x 2,…,x N ) from S = difficult to find (x 1,x 2,…,x N ) from S Decryption when m & ω (thus ώ) are known : Decryption when m & ω (thus ώ) are known :  easy to solve for (x 1,x 2,…,x N ) with  easy to solve for (x 1,x 2,…,x N ) with S 0 = a 1 x 1 + a 2 x 2 + … + a n x n where ώ S ≡ S 0 (mod m) where ώ S ≡ S 0 (mod m)

11. Example P=BUY NOW=000011010011000011010111010110 P=BUY NOW=000011010011000011010111010110 A=(3,5,9,20,44); m=89; ω=67 A=(3,5,9,20,44); m=89; ω=67 P= ([0,0,0,0,1],[1,0,1,0,0],[1,1,0,0,0],[0,1,1,0,1],[0,1,1,1,0],[1,0,1,1,0]) P= ([0,0,0,0,1],[1,0,1,0,0],[1,1,0,0,0],[0,1,1,0,1],[0,1,1,1,0],[1,0,1,1,0]) = matrix notation = matrix notation Encryption (B T = transpose of B = Vertical vector B) B≡ ω A (mod 89) = (23,68,69,5,11) B≡ ω A (mod 89) = (23,68,69,5,11) C= PB T = (11, 92,91,148,142,97 ) C= PB T = (11, 92,91,148,142,97 )Decryption: ώ ≡ ω Φ(m)-1 (mod m) =67 87 = 4 (mod 89) ώ ≡ ω Φ(m)-1 (mod m) =67 87 = 4 (mod 89) S 0 ≡ ώ S (mod m) ≡ 4*C = (44, 368, 364, 592, 568, 388) S 0 ≡ ώ S (mod m) ≡ 4*C = (44, 368, 364, 592, 568, 388) ≡ [44, 12, 8, 58, 34, 32] (mod 89) ≡ [44, 12, 8, 58, 34, 32] (mod 89) Use Knapsack algorithm to solve S 0 = a 1 x 1 + a 2 x 2 + … + a n x n Use Knapsack algorithm to solve S 0 = a 1 x 1 + a 2 x 2 + … + a n x n For example: 44= 44(1)  00001  B For example: 44= 44(1)  00001  B 12=9 (1) + 3(1)  10100  U 8= 3(1)+ 5 (1)  11000  Y 8= 3(1)+ 5 (1)  11000  Y

12. Cryptanalysis Knapsack Ciphers were a popular form of public key cryptography. Knapsack Ciphers were a popular form of public key cryptography. In 1982, Shamir (see [Sh84] & [Od 90])  efficient method to solve S= b 1 x 1 + b 2 x 2 + … + b N x N, thus find x 1 x 2 …x N from the transformed public key b 1 b 2 …b N In 1982, Shamir (see [Sh84] & [Od 90])  efficient method to solve S= b 1 x 1 + b 2 x 2 + … + b N x N, thus find x 1 x 2 …x N from the transformed public key b 1 b 2 …b N There exists an algorithmto find the solution using O(P(n)) bit operations where P is a polynomial instead of the exponential time There exists an algorithmto find the solution using O(P(n)) bit operations where P is a polynomial instead of the exponential time Adjustments can be made to protect it from such weaknesses, such as using several successive transformations with (ω i,m i ) to form b 1 b 2 …b N Adjustments can be made to protect it from such weaknesses, such as using several successive transformations with (ω i,m i ) to form b 1 b 2 …b N