Mathematische Verfahren
Prof. Dr. Eckhard Letsch
Asymmetric Key Cryptography
Assignment
Hochschule Reutlingen
MKI/Master -1
Submitted by:Khushdeep Noheria
16.01.2006
Matriculation No: 052455
Asymmetric Key Cryptography
1
2
3
4
5
6
7
WS-2005/06
Abstract ....................................................................................................................... 2
Introduction to Public-key cryptography .................................................................... 2
2.1
Public-Key Encryption........................................................................................ 3
2.1.1
Ciphers ........................................................................................................ 4
2.2
Digital Signatures................................................................................................ 6
2.2.1
Authenticity................................................................................................. 6
2.2.2
Integrity ....................................................................................................... 7
2.2.3
Non-repudiation .......................................................................................... 7
2.2.4
Implementation ........................................................................................... 7
2.3
Key Agreement Protocol..................................................................................... 8
2.3.1
Exponential key exchange .......................................................................... 8
2.3.2
Authentication ............................................................................................. 8
2.4
One-Way Functions ............................................................................................ 9
2.5
Comparison between Symmetric - Asymmetric Key Algorithms .................... 10
History....................................................................................................................... 11
Security ..................................................................................................................... 13
Applications .............................................................................................................. 13
5.1
Confidentiality .................................................................................................. 13
5.2
Authentication ................................................................................................... 14
Techniques in Asymmetric Key Cryptography ........................................................ 16
6.1
RSA Cryptosystem............................................................................................ 16
6.2
DSA Cryptosystem ........................................................................................... 23
6.2.1
Elliptic Curve DSA ................................................................................... 25
6.3
Elliptic curve cryptosystems ............................................................................. 26
6.4
Diffie-Hellman .................................................................................................. 28
6.4.1
Elliptic Curve Diffie-Hellman .................................................................. 32
6.5
ElGmal .............................................................................................................. 33
6.6
Merkle-Hellman ................................................................................................ 35
Protocols Using Asymmetric Key Algorithm ........................................................... 37
7.1
GPG................................................................................................................... 37
7.2
PGP ................................................................................................................... 39
7.3
Others ................................................................................................................ 43
Appendix A ....................................................................................................................... 44
A.1 Functions ................................................................................................................ 44
A.2 Modular arithmetic ................................................................................................. 45
A.3 Groups .................................................................................................................... 46
A.4 Fields and rings ...................................................................................................... 47
Appendix B Glossary ........................................................................................................ 49
Appendix C References .................................................................................................... 57
Khushdeep Noheria
Page 1
Asymmetric Key Cryptography
WS-2005/06
1 Abstract
This report focuses on the topic Asymmetric key Cryptography (Public–Key
Cryptography). This subject is very wide, but still it is tried to cover many of the topics
related to it. Firstly, a brief introduction about Public–Key Cryptography is given and its
related terms are discussed. Thereafter a brief history of Public Key is described. After
history, comes the security issue related to public key cryptography and it is discussed in
Chapter 4. On next, the applications and techniques of Asymmetric Key Cryptography
like RSA, DSA and an unsuccessful algorithm such as Merkel-Hellman algorithm are
detailed in chapter 5 and 6. In last chapter, protocols such as PGP (Pretty Good Privacy),
GPG (Gnu Privacy Guard) using asymmetric key techniques are mentioned. In Appendix
the basic mathematical concepts are discussed so that the different algorithms in the
report are better understandable. Words are marked in blue colour are explained in the
glossary.
2 Introduction to Public-key cryptography
Public key cryptography is a form of cryptography which generally allows users to
communicate securely without having prior access to a shared secret key, by using a pair
of cryptographic keys, designated as public key and private key, which are related
mathematically.
The term asymmetric key cryptography is a synonym for public key cryptography.
In public key cryptography, the private key is generally kept secret, while the public key
may be widely distributed. In a sense, one key "locks" a lock; while the other is required
to unlock it. It should not be possible to deduce the private key of a pair given the public
key.
In traditional cryptography, the sender and receiver of a message know and use the same
secret key; the sender uses the secret key to encrypt the message, and the receiver uses
the same secret key to decrypt the message. This method is known as secret key or
symmetric cryptography. The main challenge is getting the sender and receiver to agree
on the secret key without anyone else finding out. If they are in separate physical
locations, they must trust a courier, a phone system, or some other transmission medium
to prevent the disclosure of the secret key. Anyone who overhears or intercepts the key in
transit can later read, modify, and forge all messages encrypted or authenticated using
that key. The generation, transmission and storage of keys is called key management. All
cryptosystems must deal with key management issues. Because all keys in a secret-key
cryptosystem must remain secret, secret-key cryptography often has difficulty providing
secure key management, especially in open systems with a large number of users.
Khushdeep Noheria
Page 2
Asymmetric Key Cryptography
WS-2005/06
In order to solve the key management problem, Whitfield Diffie and Martin Hellman
introduced the concept of public-key cryptography in 1976. Public-key cryptosystems
have two primary uses, encryption and digital signatures. In their system, each person
gets a pair of keys, one called the public key and the other called the private key. The
public key is published, while the private key is kept secret. The need for the sender and
receiver to share secret information is eliminated; all communications involve only public
keys, and no private key is ever transmitted or shared. In this system, it is no longer
necessary to trust the security of some means of communications. The only requirement
is that public keys be associated with their users in a trusted (authenticated) manner (for
instance, in a trusted directory). Anyone can send a confidential message by just using
public information, but the message can only be decrypted with a private key, which is in
the sole possession of the intended recipient. Furthermore, public-key cryptography can
be used not only for privacy (encryption), but also for authentication (digital signatures)
and other various techniques.
In a public-key cryptosystem, the private key is always linked mathematically to the
public key. Therefore, it is always possible to attack a public-key system by deriving the
private key from the public key. Typically, the defense against this is to make the
problem of deriving the private key from the public key as difficult as possible. For
instance, some public-key cryptosystems are designed such that deriving the private key
from the public key requires the attacker to factor a large number, it this case it is
computationally infeasible to perform the derivation. This is the idea behind the RSA
public-key cryptosystem.
There are many forms of public key cryptography, including:
public key encryption — keeping a message secret from anyone that does not
possess a specific private key.
public key digital signature — allowing anyone to verify that a message was
created with a specific private key.
key agreement — generally, allowing two parties that may not initially share a
secret key to agree on one.
Typically, public key techniques are much more computationally intensive than purely
symmetric algorithms, but the judicious use of these techniques enables a wide variety of
applications.
2.1 Public-Key Encryption
When Alice wishes to send a secret message to Bob, she looks up Bob's public key in a
directory, uses it to encrypt the message and sends it off. Bob then uses his private key to
decrypt the message and read it. No one listening in can decrypt the message. Anyone
can send an encrypted message to Bob, but only Bob can read it (because only Bob
knows Bob's private key).
Khushdeep Noheria
Page 3
Asymmetric Key Cryptography
WS-2005/06
In a secure asymmetric key encryption scheme, the decryption key should not be
deducible from the encryption key. This is known as public-key encryption, since the
encryption key can be published without compromising the security of encrypted
messages. In the analogy above, Bob might publish instructions on how to make a lock
("public key"), but the lock is such that it is impossible (so far as is known) to deduce
from these instructions how to make a key which will open that lock ("private key").
Those wishing to send messages to Bob use the public key to encrypt the message; Bob
uses his private key to decrypt it.
In cryptography, encryption is the process of obscuring information to make it
unreadable without special knowledge. While encryption has been used to protect
communications for centuries, only organizations and individuals with an extraordinary
need for secrecy have made use of it. In the mid-1970s, strong encryption emerged from
the sole preserve of secretive government agencies into the public domain, and is now
employed in protecting widely-used systems, such as Internet e-commerce, mobile
telephone networks and bank automatic teller machines.
Encryption can be used to ensure secrecy, but other techniques are still needed to make
communications secure, particularly to verify the integrity and authenticity of a message;
for example, a message authentication code (MAC) or digital signatures. Another
consideration is protection against traffic analysis.
2.1.1 Ciphers
A cipher is an algorithm for performing encryption (and the reverse, decryption) — a
series of well-defined steps that can be followed as a procedure. An alternative term is
encipherment.
The original information is known as plaintext, and the encrypted form as ciphertext. The
ciphertext message contains all the information of the plaintext message, but is not in a
format readable by a human or computer without the proper mechanism to decrypt it; it
should resemble random gibberish to those not intended to read it.
The operation of a cipher usually depends on a piece of auxiliary information, called a
key or, in traditional NSA parlance, a cryptovariable. The encrypting procedure is varied
depending on the key, which changes the detailed operation of the algorithm. A key must
be selected before using a cipher to encrypt a message. Without the same key, it should
be difficult, if not impossible, to decrypt the resulting ciphertext into readable plaintext.
"Cipher" is alternatively spelled "cypher"; similarly "ciphertext" and "cyphertext", and so
forth. The word descends from the Arabic word for zero: ṣifr or ‫ر ِفص‬,
ْ like (the Italian)
zero (which remained in use for 0, the crucial innovation in positional Arabic versus
Roman numerals) but soon was used for any decimal digit, even any number. While it
may have come to mean encoding because that often involved numbers, a theory says
conservative Catholic opponents of the Arabic (heathen) numerals equated it with any
'dark secret'.
Khushdeep Noheria
Page 4
Asymmetric Key Cryptography
WS-2005/06
Ciphers versus codes
In non-technical usage, a "(secret) code" is the same thing as a cipher. Within technical
discussions, however, they are distinguished into two concepts. Codes work at the level
of meaning — that is, words or phrases are converted into something else. Ciphers, on the
other hand, work at a lower level: the level of individual letters, small groups of letters,
or, in modern schemes, individual bits. Some systems used both codes and ciphers in one
system, using super-encipherment to increase the security.
Historically, cryptography was split into a dichotomy of codes and ciphers, and coding
had its own terminology, analogous to that for ciphers: "encoding, codetext, decoding"
and so on. However, codes have a variety of drawbacks, including susceptibility to
cryptanalysis and the difficulty of managing a cumbersome codebook. Because of this,
codes have fallen into disuse in modern cryptography, and ciphers are the dominant
technique.
Types of cipher
There are a variety of different types of encryption. Algorithms used earlier in the history
of cryptography are substantially different from modern methods, and modern ciphers
can be classified according to how they operate and whether they use one or two keys.
Historical pen and paper ciphers used in the past are sometimes known as classical
ciphers. They include substitution ciphers and transposition ciphers. During the early
20th century, more sophisticated machines for encryption were used, rotor machines,
which were more complex than previous schemes.
Khushdeep Noheria
Page 5
Asymmetric Key Cryptography
WS-2005/06
Encryption methods can be divided into symmetric key algorithms and asymmetric key
algorithms. In a symmetric key algorithm (e.g., DES and AES), the sender and receiver
must have a shared key set up in advance and kept secret from all other parties; the
sender uses this key for encryption, and the receiver uses the same key for decryption. In
an asymmetric key algorithm (e.g., RSA), there are two separate keys: a public key is
published and enables any sender to perform encryption, while a private key is kept secret
by the receiver and enables him to perform decryption.
Symmetric key ciphers can be distinguished into two types, depending on whether they
work on blocks of symbols usually of a fixed size (block ciphers), or on a continuous
stream of symbols (stream ciphers).
2.2 Digital Signatures
Digital signature (or public-key digital signature) is a type of method for
authenticating digital information analogous to ordinary physical signatures on paper, but
implemented using techniques from the field of public-key cryptography. A digital
signature method generally defines two complementary algorithms, one for signing and
the other for verification, and the output of the signing process is also called a digital
signature.
Digital signature has also been used as a broader term encompassing both public-key
digital signature techniques and message authentication codes.
Digital signatures differ in some respects from their physical counterparts. The term
electronic signature, although sometimes used for the same thing, has a distinct meaning
in common law: it refers to any of several, not necessarily cryptographic, mechanisms for
identifying the originator of an electronic message. Electronic signatures have included
cable and Telex addresses, as well as FAX transmission of handwritten signatures on a
paper document.
There are three common reasons for applying a digital signature to communications:
2.2.1 Authenticity
Public-key cryptosystems allow anybody to send a message using the public key. A
signature allows the recipient of a message to be confident that the sender is indeed who
s/he claims to be. Of course the recipient cannot be 100% sure that the sender is indeed
who s/he claims to be - the recipient can only be confident - since the cryptosystem may
have been broken. The importance of authenticity is especially obvious in a financial
context. For example, suppose a bank sends instructions from its branch offices to the
central office in the form (a,b) where a is the account number and b is the amount to be
credited to the account. A devious customer may deposit £100, observe the resulting
transmission and repeatedly retransmit (a,b). This is known as a replay attack.
Khushdeep Noheria
Page 6
Asymmetric Key Cryptography
WS-2005/06
2.2.2 Integrity
Both parties will always wish to be confident that a message has not been altered during
transmission. The encryption makes it difficult for a third party to read a message, but
that third party may still be able to alter it in a useful way. A popular example to
illustrate this is the homomorphism attack: consider the same bank as above which sends
instructions from its branch offices to the central office in the form (a,b) where a is the
account number and b is the amount to be credited to the account. A devious customer
may deposit £100, intercept the resulting transmission and then transmit (a,b3) to become
an instant millionaire.
2.2.3 Non-repudiation
In a cryptographic context, the word repudiation refers to the act of denying association
with a message (ie claiming it was sent by a third party). The recipient of a message may
insist that the sender attach a signature in order to prevent any later repudiation, since the
recipient may show the message to a third party to prove its origin.
2.2.4 Implementation
Digital signature schemes rely on public-key cryptography. In public-key cryptography,
each user has a pair of keys: one public and one private. The public key is distributed
freely, but the private key is kept secret and confidential; another requirement is that it
should be infeasible to derive the private key from the public key.
A general digital signature scheme consists of three algorithms:
A key generation algorithm
A signing algorithm
A verification algorithm
For example, consider the situation in which Bob sends a message to Alice and wants to
be able to prove it came from him. Bob sends his message to Alice and attaches a digital
signature. The digital signature is generated using Bob's private key, and takes the form
of a simple numerical value (normally represented as a string of binary digits). On
receipt, Alice can then check whether the message really came from Bob by running the
verification algorithm on the message together with the signature and Bob's public key. If
they match, then Alice can be confident that the message really was from Bob, because
the signing algorithm is designed so that it is very difficult to forge a signature to match a
given message (unless one has knowledge of the private key, which Bob has kept secret).
More usually, for efficiency reasons, Bob first applies a cryptographic hash function to
the message before signing. This makes the signature much shorter and thus saves time
since hashing is generally much faster than signing in implementations. However, if the
message digest algorithm is insecure (for example, if it is possible to generate hash
collisions), then it might be feasible to forge digital signatures.
Khushdeep Noheria
Page 7
Asymmetric Key Cryptography
WS-2005/06
2.3 Key Agreement Protocol
In cryptography, a key-agreement protocol is a protocol whereby two or more parties
can agree on a key in such a way that both influence the outcome. If properly done, this
precludes undesired third-parties from forcing a key choice on the agreeing parties.
Protocols which are useful in practice also do not reveal to any eavesdropping party what
key has been agreed upon.
2.3.1 Exponential key exchange
The first publicly known (*) public-key agreement protocol that meets the above criteria
was the Diffie-Hellman exponential key exchange, in which two people jointly
exponentiate a generator with random numbers, in such a way that an eavesdropper has
no way of guessing what the key is.
However, exponential key exchange in and of itself does not specify any prior agreement
or subsequent authentication between the participants. It has thus been described as an
anonymous key agreement protocol.
2.3.2 Authentication
Anonymous key exchange, like Diffie-Hellman, does not provide authentication of the
parties, and is thus vulnerable to man in the middle (MITM) attack.
A wide variety of cryptographic authentication schemes and protocols have been
developed to provide authenticated key agreement to prevent man-in-the-middle and
related attacks. These methods generally mathematically bind the agreed key to other
agreed-upon data, such as:
Public/private key pairs
Shared secret keys
Passwords
Other tricks
Public keys
A widely used mechanism for defeating such attacks is the use of digitally signed keys
that must be integrity-assured: if Bob's key is signed by a trusted third party vouching for
his identity, Alice can have considerable confidence that a signed key she receives is not
an attempt to intercept by Mallory. When Alice and Bob have a public key infrastructure
they may digitally sign an agreed Diffie-Hellman agreed key, or exchanged DiffieHellman public keys. Such signed keys, sometimes signed by a certificate authority, are
one of the primary mechanisms used for secure web traffic (including HTTPS, SSL or
Transport Layer Security protocols). Other specific examples are MQV and the ISAKMP
component of the IPsec protocol suite for securing Internet Protocol communications.
However, these systems require care in endorsing the match between identity information
Khushdeep Noheria
Page 8
Asymmetric Key Cryptography
WS-2005/06
and public keys by certificate authorities in order to properly work. e.g. Hybrid systems
use public keys cryptography to exchange secret keys which are then used in symmetric
key cryptography systems.
Shared secret keys
Secret key (symmetric) cryptograhy requires the initial exchange of a shared key in a
manner that is private and integrity-assured. When done right, MITM attack is prevented.
However, without the use of public key cryptography, one may be left with undesirable
key management problems.
Passwords
Password-authenticated key agreement protocols require the separate establishment of a
password (which may be smaller than a key) in a manner that is both private and
integrity-assured. These are designed to resist MITM and other active attacks on the
password and the established keys. For example, DH-EKE, SPEKE, and SRP are
password-authenticated variations of Diffie-Hellman.
Other tricks
If one has an integrity-assured way to verify a shared-key over a public channel, one may
engage in a Diffie-Hellman key exchange to derive a one-time shared key, and then
subsequently authenticate that the keys match. One way is to use a voice-authenticated
read-out of the key, as in PGPfone. Voice authentication, however, presumes that it is
infeasible for a MITM to spoof one participant's voice to the other in real-time, which
may be an undesirable assumption. Such protocols may be designed to work with even a
small public value, such as a password. Variations on this theme have been proposed for
Bluetooth pairing protocols.
In an attempt to avoid using any additional out-of-band authentication factors, Davies and
Price proposed the use of the Interlock Protocol of Ron Rivest and Adi Shamir, which has
been subject to both attack and subsequent refinement.
2.4 One-Way Functions
A one-way function is a mathematical function that is significantly easier to compute in
one direction (the forward direction) than in the opposite direction (the inverse direction).
It might be possible, for example, to compute the function in the forward direction in
seconds but to compute its inverse could take months or years, if at all possible. A
trapdoor one-way function is a one-way function for which the inverse direction is easy
given a certain piece of information (the trapdoor), but difficult otherwise.
Public-key cryptosystems are based on (presumed) trapdoor one-way functions. The
public key gives information about the particular instance of the function; the private key
gives information about the trapdoor. Whoever knows the trapdoor can compute the
Khushdeep Noheria
Page 9
Asymmetric Key Cryptography
WS-2005/06
function easily in both directions, but anyone lacking the trapdoor can only perform the
function easily in the forward direction. The forward direction is used for encryption and
signature verification; the inverse direction is used for decryption and signature
generation.
In almost all public-key systems, the size of the key corresponds to the size of the inputs
to the one-way function; the larger the key, the greater the difference between the efforts
necessary to compute the function in the forward and inverse directions (for someone
lacking the trapdoor). For a digital signature to be secure for years, for example, it is
necessary to use a trapdoor one-way function with inputs large enough that someone
without the trapdoor would need many years to compute the inverse function (that is, to
generate a legitimate signature).
All practical public-key cryptosystems are based on functions that are believed to be oneway, but no function has been proven to be so. This means it is theoretically possible to
discover algorithms that can compute the inverse direction easily without a trapdoor for
some of the one-way functions; this development would render any cryptosystem based
on these one-way functions insecure and useless. On the other hand, further research in
theoretical computer science may result in concrete lower bounds on the difficulty of
inverting certain functions; this would be a landmark event with significant positive
ramifications for cryptography.
2.5 Comparison between Symmetric - Asymmetric Key
Algorithms
Advantages and disadvantages of public-key cryptography compared with secretkey cryptography
The primary advantage of public-key cryptography is increased security and
convenience: private keys never need to be transmitted or revealed to anyone. In a secretkey system, by contrast, the secret keys must be transmitted (either manually or through a
communication channel) since the same key is used for encryption and decryption. A
serious concern is that there may be a chance that an enemy can discover the secret key
during transmission.
Another major advantage of public-key systems is that they can provide digital signatures
that cannot be repudiated. Authentication via secret-key systems requires the sharing of
some secret and sometimes requires trust of a third party as well. As a result, a sender can
repudiate a previously authenticated message by claiming the shared secret was somehow
compromised by one of the parties sharing the secret. For example, the Kerberos secretkey authentication system involves a central database that keeps copies of the secret keys
of all users; an attack on the database would allow widespread forgery. Public-key
authentication, on the other hand, prevents this type of repudiation; each user has sole
responsibility for protecting his or her private key. This property of public-key
authentication is often called non-repudiation.
Khushdeep Noheria
Page 10
Asymmetric Key Cryptography
WS-2005/06
A disadvantage of using public-key cryptography for encryption is speed. There are many
secret-key encryption methods that are significantly faster than any currently available
public-key encryption method. Nevertheless, public-key cryptography can be used with
secret-key cryptography to get the best of both worlds. For encryption, the best solution is
to combine public- and secret-key systems in order to get both the security advantages of
public-key systems and the speed advantages of secret-key systems. Such a protocol is
called a digital envelope.
Public-key cryptography may be vulnerable to impersonation, even if users' private keys
are not available. A successful attack on a certification authority will allow an adversary
to impersonate whomever he or she chooses by using a public-key certificate from the
compromised authority to bind a key of the adversary's choice to the name of another
user.
In some situations, public-key cryptography is not necessary and secret-key cryptography
alone is sufficient. These include environments where secure secret key distribution can
take place, for example, by users meeting in private. It also includes environments where
a single authority knows and manages all the keys, for example, a closed banking system.
Since the authority knows everyone's keys already, there is not much advantage for some
to be "public" and others to be "private." Note, however, that such a system may become
impractical if the number of users becomes large; there are not necessarily any such
limitations in a public-key system.
Public-key cryptography is usually not necessary in a single-user environment. For
example, if you want to keep your personal files encrypted, you can do so with any secret
key encryption algorithm using, say, your personal password as the secret key. In general,
public-key cryptography is best suited for an open multi-user environment.
Public-key cryptography is not meant to replace secret-key cryptography, but rather to
supplement it, to make it more secure. The first use of public-key techniques was for
secure key establishment in a secret-key system; this is still one of its primary functions.
Secret-key cryptography remains extremely important and is the subject of much ongoing
study and research.
3 History
The history of cryptography dates back thousands of years. Until recent decades, it has
been a history of classic cryptography — of methods of encryption that use pen and
paper, or perhaps simple mechanical aids. In the early 20th century, the invention of
complex mechanical and electromechanical machines, such as the Enigma rotor machine,
provided more sophisticated and efficient means of encryption; and the subsequent
introduction of electronics and computing has allowed elaborate schemes of still greater
complexity.
Khushdeep Noheria
Page 11
Asymmetric Key Cryptography
WS-2005/06
The evolution of cryptography has been paralleled by the evolution of cryptanalysis — of
the "breaking" of codes and ciphers. The discovery and application, early on, of
frequency analysis to the reading of encrypted communications has on occasion altered
the course of history. Thus the Zimmermann Telegram triggered the United States' entry
into World War I; and Allied reading of Nazi Germany's ciphers may have shortened
World War II by as much as two years.
Until the 1970s, secure cryptography was largely the preserve of governments. Two
events have since brought it squarely into the public domain: the creation of a public
encryption standard (DES); and the invention of public-key cryptography.
For most of the history of cryptography, a key had to be kept absolutely secret and would
be agreed upon beforehand using a secure, but non-cryptographic, method; for example, a
face-to-face meeting or a trusted courier. There are a number of significant practical
difficulties in this approach to distributing keys. Public key cryptography was invented to
address these drawbacks — with public key cryptography, users can communicate
securely over an insecure channel without having to agree upon a shared key beforehand.
The first invention of an asymmetric key algorithm was by Clifford Cocks, then a recent
mathematics graduate and a new staff member at GCHQ in the UK, early in the 1970s.
This fact was kept secret until 1997.
An asymmetric key cryptosystem was published in 1976 by Whitfield Diffie and Martin
Hellman, who, influenced by Ralph Merkle's work on public key distribution, disclosed a
method of public key agreement. This method of exponential key exchange, which came
to be known as Diffie-Hellman key exchange, was the first published practical method
for establishing a shared secret key over an unprotected communications channel without
using a prior shared secret. Merkle's public key agreement technique known as Merkle's
Puzzles was published in 1978.
The Cocks method was reinvented in 1977 by Rivest, Shamir and Adleman all then at
MIT. The latter authors published their work in 1978, and the algorithm appropriately
came to be known as RSA. RSA uses exponentiation modulo a product of two large
primes to encrypt and decrypt, performing both public key encryption and public key
digital signature, and its security is based on the presumed difficulty of factoring large
integers.
Since the 1970s, a large number and variety of encryption, digital signature, key
agreement, and other techniques have been developed in the field of public key
cryptography. The ElGamal cryptosystem (invented by Taher ElGamal then of Netscape)
relies on the (similar, and related) difficulty of the discrete logarithm problem, as does the
closely related DSA developed by the NSA and NIST. The introduction of elliptic curve
cryptography by Neal Koblitz in the mid '80s has yielded a new family of analogous
public key algorithms. Although mathematically more complex, elliptic curves appear to
provide a more efficient way to leverage the discrete logarithm problem, particularly with
respect to key size.
Khushdeep Noheria
Page 12
Asymmetric Key Cryptography
WS-2005/06
4 Security
There is nothing especially more secure about asymmetric key algorithms than symmetric
key algorithms. There are popular ones and unpopular ones. There are broken ones and
ones that are, for now, not broken. Unfortunately, popularity is not a reliable indicator of
security. Some algorithms have security proofs with various properties, and of varying
quality. Many proofs claim that breaking an algorithm, with respect to some well-defined
security goals, is equivalent to solving one of the more popular mathematical problems
that are presumed to be intractable, like factoring large integers or finding discrete
logarithms. And some proofs have been shown to be broken too. In general, none of these
algorithms has been proved secure in as absolute a sense as the one-time pad has. As with
all cryptographic algorithms, these algorithms must be chosen and used with care.
In cryptography, the one-time pad (OTP) is the only theoretically unbreakable method
of encryption: the plaintext is combined with a random "pad" the same length as the
plaintext. The "pad" part of the name comes from early implementations of the key
material as a pad of gummed paper (for easy concealment, the pad was often physically
very small.
5 Applications
The most known application of a public key encryption system is confidentiality; a
message which a sender encrypts using the recipient's public key can only be decrypted
by the recipient's paired private key.
Public-key digital signature algorithms can be used for sender authentication. For
instance, a user can encrypt a message with his own private key and send it. If another
user can successfully decrypt it using the corresponding public key, this provides
assurance that the first user (and no other) sent it.
These characteristics are useful for many other, sometimes surprising, applications, like
digital cash (Electronic money (also known as digital money, electronic currency,
digital currency or internet money) refers to money which is only exchanged
electronically. ), password authenticated key agreement, multi-party key agreement, etc.
5.1 Confidentiality
Confidentiality has been defined by the International Organization for Standardization
(ISO) as "ensuring that information is accessible only to those authorized to have access"
and is one of the cornerstones of Information security. Confidentiality is one of the
design goals for many cryptosystems, made possible in practice by the techniques of
modern cryptography.
Khushdeep Noheria
Page 13
Asymmetric Key Cryptography
WS-2005/06
Confidentiality also refers to an ethical principle associated with several professions (eg,
medicine, law, religion, journalism). In ethics, and (in some places) in law, some types of
communication between a person and one of these professionals are "privileged" and may
not be discussed or divulged to third parties. In those jurisdictions in which the law
makes provision for such confidentiality, there are usually penalties for its violation.
Confidentiality of information, enforced in an adaptation of military's classic "need-toknow" principle, forms the cornerstone of information security in today's corporates.
5.2 Authentication
In computer security, authentication (Greek: αυθεντικός, from 'authentes'='author') is the
process by which a computer, computer program, or another user attempts to confirm that
the computer, computer program, or user from whom the second party has received some
communication is, or is not, the claimed first party. A blind credential, in contrast, does
not establish identity at all, but only a narrow right or status of the user or program.
In a Web of trust "authentication" is a way to ensure users are who they say they are--that
the user who attempts to perform functions in a system is in fact the user who is
authorized to do so.
To distinguish authentication from the closely related term authorization, the short-hand
notations A1 (authentication) and A2 (authorization) are occasionally used.
The problem of authorization is often thought to be identical to that of authentication;
many widely adopted standard security protocols, obligatory regulations, and even
statutes are based on this assumption. However, there are many cases in which these two
problems are distinct.
One familiar example is access control. A computer system supposed to be used only by
those authorized must attempt to detect and exclude the unauthorized. Access to it is
therefore usually controlled by insisting on an authentication procedure to establish with
some established degree of confidence the identity of the user, thence granting those
privileges as may be authorized to that identity. Common examples of access control
involving authentication include:
Withdrawing cash from an ATM.
Controlling a remote computer over the Internet.
Using an Internet banking system.
However, note that much of the discussion on these topics is misleading because terms
are used without precision. Part of this confusion may be due to the 'law enforcement'
tone of much of the discussion. No computer, computer program, or computer user can
'confirm the identity' of another party. It is not possible to 'establish' or 'prove' an identity,
either. There are tricky issues lurking under what appears to be a straightforward surface.
Khushdeep Noheria
Page 14
Asymmetric Key Cryptography
WS-2005/06
It is only possible to apply one or more tests which, if passed, have been previously
declared to be sufficient to proceed. The problem is to determine which tests are
sufficient, and many such are inadequate. There have been many instances of such tests
having been spoofed successfully; they have by their failure shown themselves,
inescapably, to be inadequate. Many people continue to regard the test(s) -- and the
decision to regard success in passing them -- as acceptable, and blame their failure on
'sloppiness' or 'incompetence' on the part of someone. The problem is that the test was
supposed to work in practice -- not under ideal conditions of no sloppiness or
incompetence -- and did not. It is the test which has failed in such cases. Consider the
very common case of a confirmation email which must be replied to in order to activate
an online account of some kind. Since email can easily be arranged to go to or come from
bogus and untraceable addresses, this is just about the least authentication possible.
Success in passing this test means little, without regard to sloppiness or incompetence.
Multifactor authentication
The methods by which a human can authenticate themselves are generally classified into
three cases:
Something about the user is (e.g., fingerprint or retinal pattern, DNA sequence
(there are assorted definitions of what is sufficient), voice pattern (again several
definitions), signature recognition or other biometric identifier)
Something the user has (e.g., ID card, security token, software token or cell
phone)
Something the user knows (e.g., a password, a pass phrase or a personal
identification number (PIN))
Sometimes a combination of methods is used, e.g., a bank card and a PIN, in which case
the term 'two-factor authentication' is used.
Historically, fingerprints have been used as the most authoritative method of
authentication, but recent court cases in the US and elsewhere have raised fundamental
doubts about fingerprint reliability. Other biometric methods are promising (retinal and
fingerprint scans are an example), but have shown themselves to be easily spoofable in
practice.
In a computer data context, cryptographic methods have been developed (digital
signature and challenge-response authentication) which are currently not spoofable if
(and only if) the originator's key has not been compromised. That the originator (or
anyone other than an attacker) knows (or doesn't know) about a compromise is irrelevant.
It is not known whether these cryptographically based authentication methods are
provably secure since unanticipated mathematical developments may make them
vulnerable to attack in future. If that were to occur, it may call into question much of the
authentication in the past. In particular, a digitally signed contract may be questioned
when a new attack on the cryptography underlying the signature is discovered.
Khushdeep Noheria
Page 15
Asymmetric Key Cryptography
WS-2005/06
6 Techniques in Asymmetric Key Cryptography
Cryptographic algorithms are the basic building blocks of cryptographic applications and
protocols. This chapter presents most of the important encryption algorithms and a
unsuccessful Algorithm.
6.1 RSA Cryptosystem
In cryptography, RSA is an algorithm for public-key encryption. It was the first
algorithm known to be suitable for signing as well as encryption, and one of the first
great advances in public key cryptography. RSA is still widely used in electronic
commerce protocols, and is believed to be secure given sufficiently long keys.
History of RSA
The algorithm was described in 1977 by Ron Rivest, Adi Shamir and Len Adleman at
MIT; the letters RSA are the initials of their surnames.
Clifford Cocks, a British mathematician working for GCHQ, described an equivalent
system in an internal document in 1973. Given the relatively expensive computers needed
to implement it at the time it was mostly considered a curiosity and, as far as is publicly
known, was never deployed. His discovery, however, was not revealed until 1997 due to
its top-secret classification.
The algorithm was patented by MIT in 1983 in the United States of America as U.S.
Patent 4,405,829. It expired on 21 September 2000. Since the algorithm had been
published prior to patent application, regulations in much of the rest of the world
precluded patents elsewhere. Had Cocks' work been publicly known, a patent in the US
would not have been possible either.
RSA Algorithm
The RSA algorithm works as follows:
Take two large primes, p and q, and compute their product n = pq; n is called the
modulus. Choose a number, e, less than n and relatively prime to (p-1)(q-1), which means
e and (p-1)(q-1) have no common factors except 1. Find another number d such that (ed 1) is divisible by (p-1)(q-1). The values e and d are called the public and private
exponents, respectively. The public key is the pair (n, e); the private key is (n, d). The
factors p and q may be destroyed or kept with the private key.
It is currently difficult to obtain the private key d from the public key (n, e). However if
one could factor n into p and q, then one could obtain the private key d. Thus the security
Khushdeep Noheria
Page 16
Asymmetric Key Cryptography
WS-2005/06
of the RSA system is based on the assumption that factoring is difficult. The discovery of
an easy method of factoring would "break" RSA.
Here is how the RSA system can be used for encryption and digital signatures (in
practice, the actual use is slightly different;):
Encryption
Suppose Alice wants to send a message m to Bob. Alice creates the ciphertext c by
exponentiating: c = me mod n, where e and n are Bob's public key. She sends c to Bob. To
decrypt, Bob also exponentiates: m = cd mod n; the relationship between e and d ensures
that Bob correctly recovers m. Since only Bob knows d, only Bob can decrypt this
message.
Digital Signature
Suppose Alice wants to send a message m to Bob in such a way that Bob is assured the
message is both authentic, has not been tampered with, and from Alice. Alice creates a
digital signature s by exponentiating: s = md mod n, where d and n are Alice's private key.
She sends m and s to Bob. To verify the signature, Bob exponentiates and checks that the
message m is recovered: m = se mod n, where e and n are Alice's public key.
Thus encryption and authentication take place without any sharing of private keys: each
person uses only another's public key or their own private key. Anyone can send an
encrypted message or verify a signed message, but only someone in possession of the
correct private key can decrypt or sign a message.
A working example of RSA
Here is an example of RSA encryption and decryption. The parameters used here are
artificially small, but you can also use OpenSSL to generate and examine a keypair.
We let
p = 61
— first prime number (to be kept secret or deleted securely)
q = 53
— second prime number (to be kept secret or deleted securely)
n = pq =
— modulus (to be made public)
3233
e = 17
— public exponent (to be made public)
d = 2753
— private exponent (to be kept secret)
The public key is (e, n). The private key is d. The encryption function is:
encrypt(m) = me mod n = m17 mod 3233 where m is the plaintext. The decryption function
is: decrypt(c) = cd mod n = c2753 mod 3233 where c is the ciphertext.
Khushdeep Noheria
Page 17
Asymmetric Key Cryptography
WS-2005/06
To encrypt the plaintext value 123, we calculate encrypt(123) = 12317 mod 3233 = 855
To decrypt the ciphertext value 855, we calculate decrypt(855) = 8552753 mod 3233 = 123
Both of these computations can be done efficiently using the square-and-multiply
algorithm for modular exponentiation.
Padding schemes
When used in practice, RSA must be combined with some form of padding scheme, so
that no values of M result in insecure ciphertexts. RSA used without padding may suffer
from a number of potential problems:
The values m = 0 or m = 1 always produce ciphertexts equal to 0 or 1
respectively, due to the properties of exponentiation.
When encrypting with low encryption exponents (e.g., e = 3) and small values of
the m, the (non-modular) result of me may be strictly less than the modulus n. In
this case, ciphertexts may be easily decrypted by taking the eth root of the
ciphertext with no regard to the modulus.
Because RSA encryption is a deterministic encryption algorithm-- i.e., has no
random component-- an attacker can successfully launch a chosen plaintext attack
against the cryptosystem, building a dictionary by encrypting likely plaintexts
under the public key, and storing the resulting ciphertexts. When matching
ciphertexts are observed on a communication channel, the attacker can use this
dictionary in order to learn the content of the message.
In practice, the first two problems might arise when sending short ASCII messages,
where m is the concatenation of one or more ASCII-encoded character(s). A message
consisting of a single ASCII NUL character (whose numeric value is 0) would be encoded
as m = 0, which produces a ciphertext of 0 regardless of what e and N are used. Likewise,
a single ASCII SOH (whose numeric value is 1) would always produce a ciphertext of 1.
For systems which conventionally use small values of e, such as 3, all single character
ASCII messages encoded using this scheme would be insecure, since the largest m would
have a value of 255, and 2553 is less than any reasonable modulus. Such plaintexts could
be recovered by simply taking the cube root of the ciphertext.
To avoid these problems, practical RSA implementations typically embed some form of
structured, randomized padding into the value m before encrypting it. This padding
ensures that m does not fall into the range of insecure plaintexts, and that a given
message, once padded, will encrypt to one of a large number of different possible
ciphertexts. The latter property can increase the cost of a dictionary attack beyond the
capabilities of a reasonable attacker.
Standards such as PKCS have been carefully designed to securely pad messages prior to
RSA encryption. Because these schemes pad the plaintext m with some number of
additional bits, the size of the un-padded message M must be somewhat smaller. RSA
Khushdeep Noheria
Page 18
Asymmetric Key Cryptography
WS-2005/06
padding schemes must be carefully designed so as to prevent sophisticated attacks which
may be facilitated by a predictable message structure. Early versions of the PKCS
standard used ad-hoc constructions, which were later found vulnerable to a practical
adaptive chosen ciphertext attack. Modern constructions use secure techniques such as
Optimal Asymmetric Encryption Padding (OAEP) to protect messages while preventing
these attacks. The PKCS standard also incorporates processing schemes designed to
provide additional security for RSA signatures, e.g., the Probabilistic Signature Scheme
for RSA (RSA-PSS).
Signing messages
RSA can also be used to sign a message. Suppose Alice wishes to send a signed message
to Bob. She produces a hash value of the message, raises it to the power of d mod n (as
she does when decrypting a message), and attaches it as a "signature" to the message.
When Bob receives the signed message, he raises the signature to the power of e mod n
(as he does when encrypting a message), and compares the resulting hash value with the
message's actual hash value. If the two agree, he knows that the author of the message
was in possession of Alice's secret key, and that the message has not been tampered with
since.
Note that secure padding schemes such as RSA-PSS are as essential for the security of
message signing as they are for message encryption, and that the same key should never
be used for both encryption and signing purposes.
Security
The security of the RSA cryptosystem is based on two mathematical problems: the
problem of factoring very large numbers, and the RSA problem. Full decryption of an
RSA ciphertext is thought to be infeasible on the assumption that both of these problems
are hard, i.e., no efficient algorithm exists for solving them. Providing security against
partial decryption may require the addition of a secure padding scheme.
The RSA problem is defined as the task of taking eth roots modulo a composite n:
recovering a value m such that me=c mod n, where (e, n) is an RSA public key and c is an
RSA ciphertext. Currently the most promising approach to solving the RSA problem is to
factor the modulus n. With the ability to recover prime factors, an attacker can compute
the secret exponent d from a public key (e, n), then decrypt c using the standard
procedure. To accomplish this, an attacker factors n into p and q, and computes (p-1)(q-1)
which allows the determination of d from e. No polynomial-time method for factoring
large integers on a classical computer has yet been found, but it has not been proven that
none exists. See integer factorization for a discussion of this problem.
As of 2005, the largest number factored by general-purpose methods was 663 bits long,
using state-of-the-art distributed methods. RSA keys are typically 1024–2048 bits long.
Some experts believe that 1024-bit keys may become breakable in the near term (though
this is disputed); few see any way that 4096-bit keys could be broken in the foreseeable
Khushdeep Noheria
Page 19
Asymmetric Key Cryptography
WS-2005/06
future. Therefore, it is generally presumed that RSA is secure if n is sufficiently large. If
n is 256 bits or shorter, it can be factored in a few hours on a personal computer, using
software already freely available. If n is 512 bits or shorter, it can be factored by several
hundred computers as of 1999. A theoretical hardware device named TWIRL and
described by Shamir and Tromer in 2003 called into question the security of 1024 bit
keys. It is currently recommended that n be at least 2048 bits long.
In 1993, Peter Shor published Shor's algorithm, showing that a quantum computer could
in principle perform the factorization in polynomial time, rendering RSA and related
algorithms obsolete. However, quantum computation is not expected to be developed to
such a level until at least 2015 or beyond.
Practical considerations of RSA
How to generate the Key:
Finding the large primes p and q is usually done by testing random numbers of the right
size with probabilistic primality tests which quickly eliminate virtually all non-primes.
p and q should not be 'too close', lest the Fermat factorization for n be successful.
Furthermore, if either p-1 or q-1 has only small prime factors, n can be factored quickly
and these values of p or q should therefore be discarded as well.
One should not employ a prime search method which gives any information whatsoever
about the primes to the attacker. In particular, a good random number generator for the
start value needs to be employed. Note that the requirement here is both 'random' and
'unpredictable'. These are not the same criteria; a number may have been chosen by a
random process (ie, no pattern in the results), but if it is predictable in any manner (or
even partially predicatable), the method used will result in loss of security. For example,
the random number table published by the Rand Corp in the 1950s might very well be
truly random, but it has been published and thus can serve an attacker as well. If the
attacker can guess half of the digits of p or q, they can quickly compute the other half
(shown by Coppersmith in 1997).
It is important that the secret key d be large enough. Wiener showed in 1990 that if p is
between q and 2q (which is quite typical) and d < n1/4/3, then d can be computed
efficiently from n and e. Although values of e as low as 3 have been used in the past, low
exponent RSA is also presently deprecated, for reasons including the unpadded plaintext
vulnerability listed above. 65537 is a commonly used value for e, as it is considered large
enough to avoid small exponent attacks, yet has a low enough hamming weight to
facilitate efficient exponentiation.
Speed Comparison with symmetric crptosystems:
RSA is much slower than DES (The Data Encryption Standard) and other symmetric
cryptosystems. In practice, Bob typically encrypts a secret message with a symmetric
Khushdeep Noheria
Page 20
Asymmetric Key Cryptography
WS-2005/06
algorithm, encrypts the (comparatively short) symmetric key with RSA, and transmits
both the RSA-encrypted symmetric key and the symmetrically-encrypted message to
Alice.
This procedure raises additional security issues. For instance, it is of utmost importance
to use a strong random number generator for the symmetric key, because otherwise Eve
could bypass RSA by guessing the symmetric key.
How to distribute key:
As with all ciphers, how RSA public keys are distributed is important to security. Key
distribution must be secured against a man-in-the-middle attack. Suppose Eve has some
way to give Bob arbitrary keys and make him believe they belong to Alice. Suppose
further that Eve can intercept transmissions between Alice and Bob. Eve sends Bob her
own public key, which Bob believes to be Alice's. Eve can then intercept any ciphertext
sent by Bob, decrypt it with her own secret key, keep a copy of the message, encrypt the
message with Alice's public key, and send the new ciphertext to Alice. In principle,
neither Alice nor Bob would be able to detect Eve's presence. Defenses against such
attacks are often based on digital certificates or other components of a public key
infrastructure.
Timing attacks:
Kocher described an ingenious new attack on RSA in 1995: if the attacker Eve knows
Alice's hardware in sufficient detail and is able to measure the decryption times for
several known ciphertexts, she can deduce the decryption key d quickly. This attack can
also be applied against the RSA signature scheme. In 2003, Boneh and Brumley
demonstrated a more practical attack capable of recovering RSA factorizations over a
network connection (e.g., from a Secure Socket Layer (SSL)-enabled webserver). This
attack takes advantage of information leaked by the Chinese Remainder Theorem
optimization used by many RSA implementations.
One way to thwart these attacks is to ensure that the decryption operation takes a constant
amount of time for every ciphertext. However, this approach can significantly reduce
performance. Instead, most RSA implementations use an alternate technique known as
cryptographic blinding. RSA blinding makes use of the multiplicative property of RSA.
Instead of computing cd mod n, Alice first chooses a secret random value r and computes
(rec)d mod n. The result of this computation is rm mod n and so the effect of r can be
removed by multiplying by its inverse. A new value of r is chosen for each ciphertext.
With blinding applied, the decryption time is no longer correlated to the value of the
input ciphertext and so the timing attack fails.
Adaptive chosen ciphertext attacks:
In 1998, Daniel Bleichenbacher described the first practical adaptive chosen ciphertext
attack, against RSA-encrypted messages using the PKCS #1 v1 padding scheme (a
Khushdeep Noheria
Page 21
Asymmetric Key Cryptography
WS-2005/06
padding scheme randomizes and adds structure to an RSA-encrypted message, so it is
possible to determine whether a decrypted message is valid.) Due to flaws with the PKCS
#1 scheme, Bleichenbacher was able to mount a practical attack against RSA
implementations of the Secure Socket Layer protocol, and to recover session keys. As a
result of this work, cryptographers now recommend the use of provably secure padding
schemes such as Optimal Asymmetric Encryption Padding, and RSA Laboratories has
released new versions of PKCS #1 that are not vulnerable to these attacks.
In End of the theory of RSA, following question arises:
Is the RSA cryptosystem currently in use?
The RSA system is currently used in a wide variety of products, platforms, and industries
around the world. It is found in many commercial software products and is planned to be
in many more. The RSA algorithm is built into current operating systems by Microsoft,
Apple, Sun, and Novell. In hardware, the RSA algorithm can be found in secure
telephones, on Ethernet network cards, and on smart cards. In addition, the algorithm is
incorporated into all of the major protocols for secure Internet communications, including
S/MIME, SSL, and S/WAN. It is also used internally in many institutions, including
branches of the U.S. government, major corporations, national laboratories, and
universities.
At the time of this publication, technology using the RSA algorithm is licensed by over
700 companies. The estimated installed base of RSA BSAFE encryption technologies is
around 500 million. The majority of these implementations include use of the RSA
algorithm, making it by far the most widely used public-key cryptosystem in the world.
Is the RSA system an official standard today?
The RSA cryptosystem is part of many official standards worldwide. The ISO
(International Standards Organization) 9796 standard lists RSA as a compatible
cryptographic algorithm, as does the ITU-T X.509 security standard. The RSA system is
part of the Society for Worldwide Interbank Financial Telecommunications (SWIFT)
standard, the French financial industry's ETEBAC 5 standard, the ANSI X9.31 rDSA
standard and the X9.44 draft standard for the U.S. banking industry. The Australian key
management standard, AS2805.6.5.3, also specifies the RSA system.
The RSA algorithm is found in Internet standards and proposed protocols including
S/MIME, IPSec, and TLS (the Internet standards-track successor to SSL; as well as in the
PKCS standard for the software industry. The OSI Implementers' Workshop (OIW) has
issued implementers' agreements referring to PKCS, which includes RSA.
A number of other standards are currently being developed and will be announced over
the next few years; many are expected to include the RSA algorithm as either an
endorsed or a recommended system for privacy and/or authentication. For example, IEEE
P1363 and WAP WTLS includes the RSA system.
Khushdeep Noheria
Page 22
Asymmetric Key Cryptography
WS-2005/06
Is the RSA system a de facto standard?
The RSA system is the most widely used public-key cryptosystem today and has often
been called a de facto standard. Regardless of the official standards, the existence of a de
facto standard is extremely important for the development of a digital economy. If one
public-key system is used everywhere for authentication, then signed digital documents
can be exchanged between users in different nations using different software on different
platforms; this interoperability is necessary for a true digital economy to develop.
Adoption of the RSA system has grown to the extent that standards are being written to
accommodate it. When the leading vendors of U.S. financial industry were developing
standards for digital signatures, they first developed ANSI X9.30 in 1997 to support the
federal requirement of using the Digital Signature Standard. One year later they added
ANSI X9.31, whose emphasis is on RSA digital signatures to support the de facto
standard of financial institutions.
The lack of secure authentication has been a major obstacle in achieving the promise that
computers would replace paper; paper is still necessary almost everywhere for contracts,
checks, official letters, legal documents, and identification. With this core of necessary
paper transaction, it has not been feasible to evolve completely into a society based on
electronic transactions. A digital signature is the exact tool necessary to convert the most
essential paper-based documents to digital electronic media. Digital signatures make it
possible for passports, college transcripts, wills, leases, checks and voter registration
forms to exist in the electronic form; any paper version would just be a "copy" of the
electronic original. The accepted standard for digital signatures has enabled all of this to
happen.
6.2 DSA Cryptosystem
The National Institute of Standards and Technology (NIST) published the Digital
Signature Algorithm (DSA) in the Digital Signature Standard (DSS), which is a part of
the U.S. government's Capstone project. DSS was selected by NIST, in cooperation with
the NSA, to be the digital authentication standard of the U.S. government. The standard
was issued in May 1994.
DSA is based on the discrete logarithm problem and is related to signature schemes that
were proposed by Schnorr and ElGamal. While the RSA system can be used for both
encryption and digital signatures the DSA can only be used to provide digital signatures.
In DSA, signature generation is faster than signature verification, whereas with the RSA
algorithm, signature verification is very much faster than signature generation (if the
public and private exponents, respectively, are chosen for this property, which is the
usual case). It might be claimed that it is advantageous for signing to be the faster
operation, but since in many applications a piece of digital information is signed once,
but verified often, it may well be more advantageous to have faster verification. The
Khushdeep Noheria
Page 23
Asymmetric Key Cryptography
WS-2005/06
tradeoffs and issues involved have been explored by Wiener. There has been work by
many authors including Naccache et al. on developing techniques to improve the
efficiency of DSA, both for signing and verification.
Although several aspects of DSA have been criticized since its announcement, it is being
incorporated into a number of systems and specifications. Initial criticism focused on a
few main issues: it lacked the flexibility of the RSA cryptosystem; verification of
signatures with DSA was too slow; the existence of a second authentication mechanism
was likely to cause hardship to computer hardware and software vendors, who had
already standardized on the RSA algorithm; and that the process by which NIST chose
DSA was too secretive and arbitrary, with too much influence wielded by the NSA. Other
criticisms more related to the security of the scheme were addressed by NIST by
modifying the original proposal.
Key generation
Choose a 160-bit prime q.
Choose an L-bit prime p, such that p=qz+1 for some integer z and such that 512 ≤ L ≤
1024 and L is divisible by 64.
Note: FIPS-182-2, change notice 1 specifies that L should only assume the value 1024,
and the forthcoming FIPS 186-3 (described, e.g., in SP 800-57) uses SHA-224, SHA-256,
SHA-384, and SHA-512 as a hash function, q of size 224, 256, 384, and 512 bits, with L
equal to 2048, 3072, 7680, and 15360, respectively.
Choose h, where 1 < h < p − 1 such that g = hz mod p > 1.
Choose x by some random method, where 0 < x < q.
Calculate y = gx mod p.
Public key is (p, q, g, y). Private key is x.
Note that (p, q, g) can be shared between different users of the system, if desired.
Signing
Generate a random per message value k where 1 < k < q (this is known as a
nonce)
Calculate r = (gk mod p) mod q
Calculate s = (k-1(SHA-1(m) + x*r)) mod q, where SHA-1(m) is the SHA-1 hash
function applied to the message m
The signature is (r,s)
Verifying
Calculate w = (s)-1 mod q
Calculate u1 = (SHA-1(m)*w) mod q
Khushdeep Noheria
Page 24
Asymmetric Key Cryptography
WS-2005/06
Calculate u2 = (r*w) mod q
Calculate v = ((gu1*yu2) mod p) mod q
The signature is valid if v = r
DSA is similar to the ElGamal signature scheme.
Correctness of the algorithm
The signature scheme is correct in the sense that the verifier will always accept genuine
signatures. This can be shown as follows:
From g = hz mod p follows gq ≡ hqz ≡ hp-1 ≡ 1 (mod p) by Fermat's little theorem. Since
g>1 and q is prime it follows that g has order q.
The signer computes
Thus
Since g has order q we have
Finally, the correctness of DSA follows from
6.2.1 Elliptic Curve DSA
Elliptic Curve DSA (ECDSA) is a variant of the Digital Signature Algorithm (DSA)
which operates on elliptic curve groups. The EC variant provides smaller key sizes for
the same security level. On the other hand, the execution time is roughly the same and the
signature size is exactly the same: 4t, where t is the security parameter. For example,
DSA with 1024-bit p and 160-bit q and ECDSA over the 160-bit prime field both
produce 320-bits signatures and need only few milliseconds for execution on a 2 GHz
Pentium.
Khushdeep Noheria
Page 25
Asymmetric Key Cryptography
WS-2005/06
Signature generation algorithm
Suppose Alice wants to send a signed message to Bob. Initially, the curve parameters
(q,FR,a,b,G,n,h) must be agreed upon. Also, Alice must have a key pair suitable for
elliptic curve cryptography, consisting of a private key dA (a randomly selected integer in
the interval [1,n − 1]) and a public key QA (where QA = dAG).
For Alice to sign a message m, she follows these steps:
Calculate e = HASH(m), where HASH is a cryptographic hash function, such as
SHA-1.
Select a random integer k from [1,n − 1].
Calculate r = x1(mod n), where (x1,y1) = kG. If r = 0, go back to step 2.
Calculate s = k − 1(e + dAr)(mod n). If s = 0, go back to step 2.
The signature is the pair (r,s).
Signature verification algorithm
For Bob to authenticate Alice's signature, he must have a copy of her public key QA. He
follows these steps:
Verify that r and s are integers in [1,n − 1]. If not, the signature is invalid.
Calculate e = HASH(m), where HASH is the same function used in the signature
generation.
Calculate w = s − 1(mod n).
Calculate u1 = ew(mod n) and u2 = rw(mod n).
Calculate (x1,y1) = u1G + u2QA.
The signature is valid if x1 = r(mod n), invalid otherwise.
Note that using Straus's algorithm (aka. Shamir's trick) a sum of two scalar
multiplications u1G + u2QA can be calculated faster than with two scalar multiplications.
6.3 Elliptic curve cryptosystems
Elliptic curve cryptography (ECC) is an approach to public-key cryptography based on
the mathematics of elliptic curves. The use of elliptic curves in cryptography was
suggested independently by Neal Koblitz and Victor Miller in 1985.
The main benefit of ECC is that under certain situations it uses smaller keys than other
methods — such as RSA — while providing an equivalent or higher level of security.
Another benefit of ECC is that a bilinear map between groups can be defined, based on
the Weil pairing or the Tate pairing; bilinear maps have recently found numerous
applications in cryptography, for example identity-based encryption. One drawback,
however, is that the implementation of encryption and decryption operations may take
longer than in other schemes.
Khushdeep Noheria
Page 26
Asymmetric Key Cryptography
WS-2005/06
Key exchange
There are several slightly different versions of elliptic curve cryptography, all of which
rely on the widely believed difficulty of solving the discrete logarithm problem for the
group of an elliptic curve over some finite field.
Finite field
The most popular finite fields for this are the integers modulo a prime number (see
modular arithmetic) GF(p), or a Galois field of characteristic two GF(2m). The latter is
more computationally efficient on dedicated hardware implementations, whereas the
former is usually more efficient on general-purpose processors. Patent issues are also
relevant. Galois fields of size of power of some other prime have also been proposed, but
are considered a bit dubious among cryptanalysts.
Given an elliptic curve E, and a field GF(q), we consider the abelian group of rational
points E(q) of the form (x, y), where both x and y are in GF(q), and where the group
operation "+" is defined on this curve based on the elliptic curves. We then define a
second operation "*" | Z×E(q) → E(q): if P is some point in E(q), then we define 2*P = P
+ P, 3*P = 2*P + P = P + P + P, and so on. Note that given integers j and k, j*(k*P) =
(j*k)*P = k*(j*P). The elliptic curve discrete logarithm problem (ECDLP) is then to
determine the integer k, given points P and Q, and given that k*P = Q.
It is believed that the usual discrete logarithm problem over the multiplicative group of a
finite field (DLP) and ECDLP are not equivalent problems; and that ECDLP is
significantly more difficult than DLP.
In cryptographic use, a specific base point G is selected and published for use with the
curve E(q). A private key k is selected as a random integer; and then the value P = k*G is
published as the public key (note that the purported difficulty of ECDLP implies that k is
hard to determine from P). If Alice and Bob have private keys kA and kB, and public keys
PA and PB, then Alice can calculate kA*PB = (kA*kB)*G; and Bob can compute the same
value as kB*PA = (kB*kA)*G.
This allows the establishment of a "secret" value that both Alice and Bob can easily
compute, but which is difficult for any third party to derive. In addition, Bob does not
gain any new knowledge about kA during this transaction, so that Alice's private key
remains private.
Encryption
The actual methods used to then encrypt messages between Alice and Bob based on this
secret value are adaptations of older discrete logarithm cryptosystems originally
described for use on other groups. These include:
Diffie-Hellman — ECDH
Khushdeep Noheria
Page 27
Asymmetric Key Cryptography
WS-2005/06
MQV — ECMQV,
ElGamal discrete log cryptosystem — ECElGamal
DSA — ECDSA.
Doing the group operations needed to run the system is slower for an ECC system than
for a factorization system or modulo integer discrete log system of the same size.
However, proponents of ECC systems believe that the ECDLP problem is significantly
harder than the DLP or factorisation problems, and so equal security can be provided by
much smaller key lengths using ECC, to the extent that it can actually be faster than, for
instance, RSA. Published results to date tend to support this belief, but some experts are
skeptical. ECC is widely regarded as the strongest asymmetric algorithm at a given key
length, so may become useful over links that have very tight bandwidth requirements.
6.4 Diffie-Hellman
Diffie-Hellman key exchange is a cryptographic protocol which allows two parties that
have no prior knowledge of each other to jointly establish a shared secret key over an
insecure communications channel. This key can then be used to encrypt subsequent
communications using a symmetric key cipher.
Synonyms of Diffie-Hellman key exchange include:
Diffie-Hellman key agreement
Diffie-Hellman key establishment
Diffie-Hellman key negotiation
exponential key exchange
The scheme was first published publicly by Whitfield Diffie and Martin Hellman in 1976,
although it later emerged that it had been discovered a few years earlier within GCHQ,
the British signals intelligence agency, by Malcolm J. Williamson but was kept classified.
In 2002, Hellman suggested the algorithm be called Diffie-Hellman-Merkle key
exchange in recognition of Ralph Merkle's contribution to the invention of public-key
cryptography (Hellman, 2002).
Although Diffie-Hellman key agreement itself is an anonymous (non-authenticated) key
agreement protocol, it provides the basis for a variety of authenticated protocols, and is
used to provide perfect forward secrecy in TLS's ephemeral modes
History
Diffie-Hellman key agreement was invented in 1976 during a collaboration between
Whitfield Diffie and Martin Hellman and was the first practical method for establishing a
shared secret over an unprotected communications channel. Ralph Merkle's work on
public key distribution was an influence. John Gill suggested application of the discrete
logarithm problem. It had been discovered by Malcolm Williamson of GCHQ in the UK
Khushdeep Noheria
Page 28
Asymmetric Key Cryptography
WS-2005/06
some years previously, but GCHQ chose not make it public until 1997, by which time it
had no influence on research in academia.
The method was followed shortly afterwards by RSA, another implementation of public
key cryptography using asymmetric algorithms.
In 2002, Martin Hellman wrote:"The system...has since become known as Diffie-Hellman
key exchange. While that system was first described in a paper by Diffie and me, it is a
public key distribution system, a concept developed by Merkle, and hence should be
called 'Diffie-Hellman-Merkle key exchange' if names are to be associated with it. I hope
this small pulpit might help in that endeavor to recognize Merkle's equal contribution to
the invention of public key cryptography."
U.S. Patent 4,200,770, now expired, describes the algorithm and credits Hellman, Diffie,
and Merkle as inventors
Diffie-Hellman Algorithm
The simplest, and original, implementation of the protocol uses the multiplicative group
of integers modulo p, where p is prime and g is primitive mod p. Modulo (or mod) simply
means that the integers between 1 and p − 1 are used with normal multiplication,
exponentiation and division, except that after each operation the result keeps only the
remainder after dividing by p. Here is an example of the protocol:
Alice and Bob agree to use a prime number p=23 and base g=5.
Alice chooses a secret integer a=6, then sends Bob (ga mod p)
56 mod 23 = 8.
Bob chooses a secret integer b=15, then sends Alice (gb mod p)
515 mod 23 = 19.
Alice computes (gb mod p)a mod p
196 mod 23 = 2.
Bob computes (ga mod p)b mod p
815 mod 23 = 2.
Both Alice and Bob have arrived at the same value, because gab and gba are equal. Note
that only a, b, gab and gba are kept secret. All the other values are sent in the clear. Once
Alice and Bob compute the shared secret they can use it as an encryption key, known
only to them, for sending messages across the same open communications channel. Of
course, much larger values of a,b, and p would be needed to make this example secure,
since it is easy to try all the possible values of gab mod 23 (there will be, at most, 22 such
values, even if a and b are large). If p was a prime of more than 300 digits, and a and b
were at least 100 digits long, then even the best known algorithms for finding a given
only g, p, and ga mod p (known as the discrete logarithm problem) would take longer
than the lifetime of the universe to run. g need not be large at all, and in practice is
usually either 2 or 5.
Khushdeep Noheria
Page 29
Asymmetric Key Cryptography
WS-2005/06
Here's a more general description of the protocol:
Alice and Bob agree on a finite cyclic group G and a generating element g in G.
(This is usually done long before the rest of the protocol; g is assumed to be
known by all attackers.) We will write the group G multiplicatively.
Alice picks a random natural number a and sends ga to Bob.
Bob picks a random natural number b and sends gb to Alice.
Alice computes (gb)a.
Bob computes (ga)b.
Both Alice and Bob are now in possession of the group element gab which can serve as
the shared secret key. The values of (gb)a and (ga)b are the same because groups are
power associative.
chart
Here is a chart to help simplify who knows what.
Let s = shared secret key. s = 2
let a = Alice's private key. a = 6
let b = Bob's private key. b = 15
let g = public base. g=5
let p = public (prime) number. p = 23
Alice knows:
p = 23 base g = 5 a = 6
5^6 mod 23 = 8
5^b mod 23 = 19
19^6 mod 23 = 2
8^b mod 23 = 2
19^6 mod 23 = 8^b mod 23
s=2
Doesn't Know: b = 15
Khushdeep Noheria
Page 30
Asymmetric Key Cryptography
WS-2005/06
Bob Knows:
p = 23 base g = 5 b = 15
5^15 mod 23 = 19
5^a mod 23 = 8
8^15 mod 23 = 2
19^a mod 23 = 2
8^15 mod 23 = 19^a mod 23
s=2
doesn't know: a = 6
Eve Knows:
p = 23 base g = 5
5^a mod 23 = 8
5^b mod 23 = 19
19^a mod 23 = s
8^b mod 23 = s
19^a mod 23 = 8^b mod 23
Doesn't Know: a = 6, b = 15, s = 2
Note: It should be difficult for Alice to solve for Bob's private key or for Bob to solve for
Alice's private key. If it isn't difficult for Alice to solve for Bob's private key (or vice
versa), Eve may simply substitute her own private / public key pair, plug Bob's public
key into her private key, produce a fake shared secret key, and solve for Bob's private key
(and use that to solve for the shared secret key. Eve may attempt to choose a public /
private key pair that will make it easy for her to solve for Bob's private key).
Security
The protocol is considered secure against eavesdroppers if G and g are chosen properly.
The eavesdropper ("Eve") must solve the Diffie-Hellman problem to obtain gab. This is
Khushdeep Noheria
Page 31
Asymmetric Key Cryptography
WS-2005/06
currently considered difficult. An efficient algorithm to solve the discrete logarithm
problem would make it easy to compute a or b and solve the Diffie-Hellman problem,
making this protocol insecure.
The order of G should be prime or have a large prime factor to prevent use of the PohligHellman algorithm to obtain a or b. For this reason, a Sophie Germain prime q is
sometimes used to calculate p=2q+1, called a safe prime, since the order of G is then
only divisible by 2 and q. g is then sometimes chosen to generate the order q subgroup of
G, rather than G, so that the Legendre symbol of ga never reveals the low order bit of a.
If Alice and Bob use random number generators whose outputs are not completely
random but can be predicted to some extent, then Eve's task is much easier.
The secret integers a and b are discarded at the end of the session. Therefore, DiffieHellman key exchange by itself trivially achieves perfect forward secrecy because no
long-term private keying material exists to be disclosed.
Authentication
In the original description, the Diffie-Hellman exchange by itself does not provide
authentication of the parties, and is thus vulnerable to man in the middle attack. The manin-the-middle may establish two distinct Diffie-Hellman keys, one with Alice and the
other with Bob, and then try to masquerade as Alice to Bob and/or vice-versa, perhaps by
decrypting and re-encrypting messages passed between them. Some method to
authenticate these parties to each other is generally needed.
A variety of cryptographic authentication solutions incorporate a Diffie-Hellman
exchange. When Alice and Bob have a public key infrastructure they may digitally sign
the agreed key, or ga and gb, as in MQV, STS and the IKE component of the IPsec
protocol suite for securing Internet Protocol communications. When Alice and Bob share
a password, they may use a password-authenticated key agreement form of DiffieHellman.
6.4.1 Elliptic Curve Diffie-Hellman
Elliptic Curve Diffie-Hellman (ECDH) is a key agreement protocol that allows two
parties to estabilish a shared secret key over an insecure channel. This key can then be
used to encrypt subsequent communications using a symmetric key cipher. It is a variant
of the Diffie-Hellman protocol using elliptic curve cryptography.
Key establishment protocol
Suppose Alice wants to establish a shared key with Bob, but the only channel available
for them might be eavesdropped. Initially, the curve parameters (q,FR,a,b,G,n,h) must be
agreed upon. Also, each party must have a key pair suitable for elliptic curve
cryptography, consisting of a private key d (a randomly selected integer in the interval
Khushdeep Noheria
Page 32
Asymmetric Key Cryptography
WS-2005/06
[1,n − 1]) and a public key Q (where Q = dG). Let Alice's key pair be (dA,QA) and Bob's
key pair be (dB,QB). Each party must have the other party's public key. Alice computes
(xk,yk) = dAQB. Bob computes k = dBQA. The shared key is xk (the x coordinate of the
point).
The number calculated by both parties is equal, because dAQB = dAdBG = dBdAG = dBQA.
The protocol is secure because nothing is disclosed (except for the public keys, which are
not secret), and no party can derive the private key of the other unless it can solve the
Elliptic Curve Discrete Logarithm Problem.
The public keys are either static (and trusted, say via a certificate) or ephemeral.
Ephemeral keys are not necessarily authenticated, so if authentication is wanted, it has to
be obtained by other means. Static public keys provide neither forward secrecy nor keycompromise impersonation resilience, among other advanced security properties. Holders
of static private keys should validate the other public key, and should apply a secure key
derivation function to the raw Diffie-Hellman shared secret to avoid leaking information
about the static private key.
6.5 ElGmal
The ElGamal algorithm is an asymmetric key encryption algorithm for public key
cryptography which is based on Diffie-Hellman key agreement. It was described by
Taher Elgamal in 1984. The ElGamal algorithm is used in the free GNU Privacy Guard
software, recent versions of PGP, and other cryptosystems. The Digital Signature
Algorithm is a variant of the ElGamal signature scheme, which should not be confused
with the ElGamal algorithm.
ElGamal can be defined over any cyclic group G. Its security depends upon the difficulty
of a certain problem in G related to computing discrete logarithms.
The algorithm
ElGamal consists of three components: the key generator, the encryption algorithm, and
the decryption algorithm.
The key generator works as follows:
Alice generates an efficient description of a cyclic group G of order q with
generator g. See below for specific examples of how this can be done.
Alice chooses a random x from
.
Alice computes h = gx.
Alice publishes h, along with the description of G,q,g, as her public key. Alice
retains x as her secret key.
Khushdeep Noheria
Page 33
Asymmetric Key Cryptography
WS-2005/06
The encryption algorithm works as follows: to encrypt a message m to Alice under her
public key (G,q,g,h),
Bob converts m into an element of G.
Bob chooses a random y from
.
Bob sends the ciphertext (c1,c2) to Alice.
, then calculates c1 = gy and
The decryption algorithm works as follows: to decrypt a ciphertext (c1,c2) with her secret
key x,
Alice computes
as the plaintext message.
The decryption algorithm produces the intended message, since
If the space of possible messages is larger than the size of G, then the message can be
split into several pieces and each piece can be encrypted independently. Typically,
however, a short key to a symmetric-key cipher is first encrypted under ElGamal, and the
(much longer) intended message is encrypted more efficiently using the symmetric-key
cipher — this is termed hybrid encryption.
Security
ElGamal is a simple example of a semantically secure asymmetric key encryption
algorithm (under reasonable assumptions). It is probabilistic, meaning that a single
plaintext can be encrypted to many possible ciphertexts, with the consequence that a
general ElGamal encryption produces a 2:1 expansion in size from plaintext to ciphertext.
ElGamal's security rests, in part, on the difficulty of solving the discrete logarithm
problem in G. Specifically, if the discrete logarithm problem could be solved efficiently,
then ElGamal would be broken. However, the security of ElGamal actually relies on the
so-called Decisional Diffie-Hellman (DDH) assumption. This assumption is often
stronger than the discrete log assumption, but is still believed to be true for many classes
of groups.
Generating the group G
As described above, ElGamal can be defined over any cyclic group G, and is secure if a
certain computational assumption (the "DDH Assumption") about that group is true.
Unfortunately, the straightforward use of G = Zp for a prime p is insecure, because the
Khushdeep Noheria
Page 34
Asymmetric Key Cryptography
WS-2005/06
DDH Assumption is false in this group. In contrast, computing discrete logs is believed to
be hard in Zp, but this is not enough for the security of ElGamal.
The two most popular types of groups used in ElGamal are subgroups of Zp and groups
defined over certain elliptic curves. Here is one popular way of choosing an appropriate
subgroup of Zp which is believed to be secure:
Choose a random large prime p such that p − 1 = kq for some small integer k and
large prime q. This can be done, for example with k = 2, by first choosing a
random large prime q and checking if p = 2q + 1 is prime.
Choose a random element
such that
and gq = 1mod p, i.e. such
that g is of order q.
The group G is the subgroup of Zp generated by g, i.e. the set of kth residues mod
p.
When encrypting, care must be taken to properly encode the message m as an element of
G, and not, say, as just an arbitrary element of Zp.
Efficiency
Encryption under ElGamal requires two exponentiations; however, these exponentiations
are independent of the message and can be computed ahead of time if need be.
Decryption only requires one exponentiation (plus one division, which is typically much
faster). Unlike in the RSA and Rabin systems, ElGamal decryption cannot be sped up via
the Chinese remainder theorem.
Miscellaneous
ElGamal is malleable in an extreme way: for example, given an encryption (c1,c2) of
some (possibly unknown) message m, one can easily construct an encryption
of the message 2m. Therefore ElGamal is not secure under chosen ciphertext
attack. On the other hand, the Cramer-Shoup system (which is based on ElGamal) is
secure under chosen ciphertext attack.
6.6 Merkle-Hellman
Merkle-Hellman (MH) was one of the earliest public key cryptosystems invented by
Ralph Merkle and Martin Hellman in 1978. Although its ideas are elegant, and far
simpler than RSA, it has been broken. The Merkle-Hellman system is based on the subset
sum problem (a special case of the knapsack problem): given a list of numbers and a third
number, which is the sum of a subset of these numbers, determine the subset. In general,
this problem is known to be NP-complete; however, there are some 'easy' instances which
can be solved efficiently. The Merkle-Hellman scheme is based on transforming an easy
instance into a difficult instance, and back again. However, the scheme was broken by
Khushdeep Noheria
Page 35
Asymmetric Key Cryptography
WS-2005/06
Adi Shamir, not by attacking the knapsack problem, but rather by breaking the conversion
from an easy knapsack to a hard one.
Merkle-Hellman Algorithm
Key generation
To encrypt n-bit messages, choose a superincreasing sequence
w = (w1, w2, ..., wn)
of n natural numbers (excluding zero). (A superincreasing sequence is a sequence in
which every element is greater than the sum of all previous elements, eg {1, 2, 4, 8, 16} )
Pick a random integer q, such that
q≥
,
and a random integer, r, such that gcd(r,q) == 1.
q must be chosen as such to ensure the uniqueness of the encrypted message, after
modular arithmetic. If it is any smaller, more than one message (in plaintext) will encrypt
to the same cryptotext, making decoding functionally impossible. r must be coprime to q
or else it will not have an inverse mod q. The existence of the inverse of r is necessary so
that decryption is possible.
Now calculate the sequence
β = (β1, β2, ..., βn)
where βi = rwi (mod q). The public key is β, while the private key is (w, q, r).
Encryption
To encrypt an n-bit message
α = (α1, α2, ..., αn),
where αi is the i-th bit of the message and αi
{0, 1}, calculate
.
The cryptogram then is c.
Khushdeep Noheria
Page 36
Asymmetric Key Cryptography
WS-2005/06
Decryption
The key to decryption lies in somehow determining s = r-1 (mod q). s is the private key in
this cryptosystem. You can now convert the NP-hard problem, extrapolating α from c
(using an essentially randomly-filled knapsack), into the easy problem of extrapolating α
using a super-increasing knapsack, which is solvable in linear time.
The steps of decryption require that you calculate c' = c*s (mod q) and w = β*s (mod q).
c' is still an encrypted form of α, but the knapsack which encrypts it is simply the superincreasing sequence, w. The super-increasing knapsack problem is easy to solve because
of the structure of a super-increasing sequence. Take the largest element in w, say wk. If
wk > c', then αk = 0, if wk≤c', then αk = 1. Then, subtract wk * αk from c', and repeat these
steps until you have figured out α.
When q is very large, it is very difficult to calculate s (it can take a long time, but the
algorithm merely makes use of simple modular multiplication). The difficulty of
determining s is why this was thought to be such an impossible cryptosystem to break.
7 Protocols Using Asymmetric Key Algorithm
7.1 GPG
The GNU Privacy Guard (GnuPG or GPG) is a free software replacement for the PGP
suite of cryptographic software, released under the GNU General Public License. It is a
part of the Free Software Foundation's GNU software project, and has received major
funding from the German Government. GPG is completely compliant with the IETF
standard for OpenPGP. Current versions of PGP (and Veridis' Filecrypt) are interoperable
with GPG and other OpenPGP-compliant systems. Although some older versions of PGP
are also interoperable, not all features of newer software are supported by the older
software. It is necessary for users to understand those incompatibilities and work around
them.
History
GPG was initially developed by Werner Koch. Version 1.0.0 was released on September
7th, 1999. The German Federal Ministry of Economics and Technology has funded the
documentation and the port to Microsoft Windows in 2000.
Because GPG is an OpenPGP standard compliant system, the history of OpenPGP is of
importance.Version 1.4.2 of the stable branch was announced on 27 July 2005, and
version 1.9.19 of the development branch (with S/MIME support) was released on 12
September 2005.
Khushdeep Noheria
Page 37
Asymmetric Key Cryptography
WS-2005/06
Uses of GnuPG
GPG is stable, production-quality software. It is frequently included in free operating
systems, such as FreeBSD, OpenBSD, and NetBSD and nearly all distributions of
GNU/Linux.
Although the basic GPG program has a command line interface, there exist various frontends that provide it with a graphical user interface; for example, it has been integrated
into EMail and Evolution, the graphical email clients found in the most popular Linux
desktops KDE and GNOME. For GNOME, there is a graphical GPG front-end called
Seahorse. A plugin known as Enigmail allows GPG to be integrated with Mozilla and
Thunderbird, which works on Microsoft Windows as well as Linux and other operating
systems. Web-based software such as Horde also makes use of it. Note that, because the
plugin mechanism is not part of GPG itself and not specified by the Open PGP standard,
and because neither the GPG nor Open PGP developers were involved in their
development, it is possible that GPG's security benefits could be compromised or even
lost as a result of using such auxiliaries.
GPG can also be compiled for other platforms like Mac OS X and Windows. For Mac OS
X, there is a free port called MacGPG which has been adapted to use the OS X user
interface and its native class definitions. Cross compilation is not a trivial exercise, at
least in part because security provisions vary with operating system and adapting to them
is often tricky, but high quality compilers should routinely produce executables which
will interoperate correctly with other GPG implementations.
How GPG works
GPG encrypts messages using asymmetric keypairs individually generated by GPG users.
The resulting public keys can be exchanged with other users in a variety of ways, such as
Internet key servers. They must always be exchanged carefully to prevent identity
spoofing by corrupting public key ↔ 'owner' identity correspondences. It is also possible
to add a cryptographic digital signature to a message, so the message integrity and sender
can be verified, if a particular correspondence relied upon has not been corrupted.
GPG does not use patented or otherwise restricted software or algorithms, including the
IDEA encryption algorithm which has been present in PGP almost from the beginning.
Instead, it uses a variety of other, non-patented algorithms such as ElGamal, CAST5,
Triple DES, AES, Blowfish and Twofish. It is still possible to use IDEA in GPG by
downloading a plugin for it, however this may require getting a license for some uses in
some countries in which IDEA is patented.
GPG is a hybrid encryption software program in that it uses a combination of
conventional symmetric-key cryptography for speed, and public-key cryptography for
ease of secure key exchange, typically by using the recipient's public key to encrypt a
session key which is only used once. This mode of operation is part of the Open PGP
standard and has been part of PGP from its first version.
Khushdeep Noheria
Page 38
Asymmetric Key Cryptography
WS-2005/06
Problems
The OpenPGP standard specifies several methods of digitally signing messages. Due to
an error in a change to GPG intended to make one of those methods more efficient, a
security vulnerability was introduced (Nguyen, 2004). It affects only one method of
digitally signing messages, only for some releases of GPG (1.0.2 through 1.2.3), and
there were less than 1000 such keys listed on the key servers. Most people did not use
this method, and were in any case discouraged from doing so, so the damage caused (if
any, and none has been publicly reported) would appear to have been minimal. Support
for this method has been removed from GPG versions released after this discovery (1.2.4
and later).
GPG is a command-line based system, that is not written as an API which can be
incorporated into other software. GPGME is an API wrapper around GPG which parses
the output of GPG, and various graphical front-ends based on GPGME have been
created. This requires an out-of-process call to the GPG executable for each GPGME API
call. The approach is less than satisfactory because GPGME ends up parsing text output
originally intended for human eyes. In general, GUI systems based on GPGME do not
offer the robustness of software that calls true APIs (e.g. contrast WinPT with GnuPG to
the PGP GUI: the latter uses API calls into its encryption routines).
Other software wraps the command line in a Perl script (e.g. gpg-dialog) that is menu
based and more user friendly.
7.2 PGP
When it comes to Asymmetric cryptography the most popular and widely used
application that comes to anyone's mind is PGP. PGP stands for “Pretty Good Privacy”
and is the standard public key cryptography application used today.
PGP is a computer program which provides cryptographic privacy and authentication.
The first released version of PGP, by designer and developer Phil Zimmermann, became
available in 1991. Subsequent versions have been developed by both Zimmerman and
others.
PGP has been sufficiently influential that its operating protocols and data formats have
been standardised for interoperability among different versions of PGP and related
software. Eventually, the PGP design was adopted as an Internet standards-track
specification known as OpenPGP. OpenPGP is now an open standard followed by PGP,
GNU Privacy Guard (GnuPG), Hushmail, Veridis, Authora, EasyByte Cryptocx, and
others.
Khushdeep Noheria
Page 39
Asymmetric Key Cryptography
WS-2005/06
PGP and email
While PGP can encrypt the content of any data (e.g., any computer file or message text),
it is most commonly used for e-mail, which has no built-in security as originally
implemented. PGP and S/MIME are two (incompatible) official email security systems
which are currently NIST specified standards.
PGP was originally used for email by converting an encrypted message into a special
formatting (ASCII armor) to prevent changes during transmission. A more
comprehensive integration of PGP with the MIME email standard is specified by RFC
3156.
Plugins implementing PGP functionality are available for many popular e-mail
applications (such as Outlook, Outlook Express, Eudora, Evolution, Mutt, Mozilla
Thunderbird, Apple Mail, and many others). Several are included with many PGP
distributions.
From a security viewpoint, every such plugin is independent of PGP itself. Each might
have implementation errors or interact insecurely with PGP or with other software. Using
such plugins does not necessarily provide the same level of security as would standalone
(and correct) use of PGP itself. Such add-ons can, at best, be equivalent to PGP in
security; at worst, a plugin may reduce your actual security to nothing. Distinguishing
amongst these cases is non-trivial even for the most cryptographically skilled and
informed. The best advice for the ordinary user is always be careful and to regularly test
the whole system by sending test messages to oneself or, better, to a partner who uses an
independently installed and configured copy of PGP or compatible software. This will
assure that there is at least end to end functionality, though more subtle bugs or damage
may nevertheless still be present. This sort of check is especially important after any
software change or upgrade. The safest use pattern is to manually encrypt and sign
messages and email them manually; this evades such problems as automatic hidden
transmission of message text copies unintended place via a network connection. As with
all security considerations, however, ensuring the best possible security must necessarily
be balanced against other system constraints and user needs. For instance, those who
must use Microsoft Windows or Outlook or Internet Explorer will have a different
security situation than those who use OpenBSD or FreeBSD and Firefox. Each must take
different measures to maximize security. Whatever risks there may be in a quality
security system such as PGP or its relatives, not using it is always riskier.
How PGP works
PGP uses both public-key cryptography and symmetric key cryptography, and includes a
system which binds the public keys to user identities. The first version of this system is
generally known as a web of trust and continues in use. Later versions of PGP have
included something more akin to a public key infrastructure (PKI).
Khushdeep Noheria
Page 40
Asymmetric Key Cryptography
WS-2005/06
PGP uses asymmetric key encryption algorithms. In these, the recipient must have
previously generated a linked key pair, a public key and a private key. The sender uses
the recipient's public key to encrypt a shared key (a secret key or conventional key) for a
symmetric cipher algorithm. That key is used, finally, to encrypt the plaintext of a
message. Many PGP users' public keys are available to all from the many PGP key
servers around the world which act as mirror sites for each other.
The recipient of a PGP-protected message decrypts it using the session key for a
symmetric algorithm. That session key was, of course, included in the message in
encrypted form and was itself decrypted using the recipient's private key. Use of two
ciphers in this way is sensible because of the very considerable difference in operating
speed between asymmetric key and symmetric key ciphers (the differences are often
1000+ times). There are also cryptographic vulnerabilities in when using asymmetric key
algorithms when they are used to directly encrypt messages.
A similar strategy is (by default) used to detect whether a message has been altered since
it was completed, or (also by default) whether it was actually sent by the person/entity
claimed to be the sender.
To do both at once, the sender uses PGP to 'sign' the message with either the RSA or
DSA signature algorithms. To do so, PGP computes a hash (also called a message digest)
from the plaintext, and then creates the digital signature from that hash using the sender's
private key. The message recipient computes a message digest over the recovered
plaintext, and then uses the sender's public key and the signed message digest value with
the signature algorithm. If the signature matches the received plaintext's message digest,
it must be presumed (to a very high degree of confidence) that the message received has
not been tampered with, either deliberately or accidentally, since it was properly signed.
Both when encrypting messages and when verifying signatures, it is critical that the
public key one uses to send messages to some person or entity actually does 'belong' to
the intended recipient. Simply downloading a public key from somewhere is not
overwhelming assurance of that association; deliberate (or accidental) spoofing is
possible. PGP has always included provisions for distributing users' public keys in
'identity certificates' which are constructed cryptographically so that any tampering (or
accidental garble) is readily detectable. But merely making a certificate effectively
impossible to modify undetectably is also insufficient. It can prevent corruption only after
the certificate has been created, not before. Users must also verify by some means that
the public key in a certificate actually does belong to the person/entity claiming it. From
its first release, PGP has included an internal certificate 'vetting scheme' to assist with
this; it has been called a web of trust. A given public key (or more specifically,
information binding a person to a key) may be digitally signed by a third party to attest
the association between the person and the key. There are several levels of confidence
that can be expressed in this signature; although many programs read and write this
information, few (if any) incorporate the level of certification when calculating whether
to trust a key.
Khushdeep Noheria
Page 41
Asymmetric Key Cryptography
WS-2005/06
In the (more recent) OpenPGP specification, trust signatures can be used to support
creation of certificate authorities. A trust signature indicates both that the key belongs to
its claimed owner and that the owner of the key is trustworthy to sign other keys at one
level below their own. A level 0 signature is comparable to a web of trust signature, since
only the validity of the key is certified. A level 1 signature is similar to the trust one has
in a certificate authority because a key signed to level 1 is able to issue an unlimited
number of level 0 signatures. A level 2 signature is highly analogous to the trust
assumption users must rely on whenever they use the default certificate authority list in
Internet Explorer; it allows the owner of the key to make other keys certificate
authorities.
PGP has also always included a way to cancel ('revoke') identity certificates which may
have become invalid; this is, more or less, equivalent to the certificate revocation lists of
more centralized PKI schemes. More recent PGP versions have also supported certificate
expiration dates.
The problem of correctly identifing a public key as belonging to some other user is not
unique to PGP. All public key and private key cryptosystems have the same problem, if
in slightly different guise, and no fully satisfactory solution is known. PGP's original
scheme, at least, leaves the decision whether or not to use its endorsement/vetting system
to the user, while most other PKI schemes do not, requiring instead that every certificate
attested to by a central certificate authority be accepted as correct.
Security
When used properly, PGP is believed to be capable of very high security. It is widely
believed, within the cryptographic community, that -- if anyone -- only government
agencies such as NSA might be capable of directly breaking properly produced, PGPprotected, messages. However, to the best of publicly available information, there is no
known method for any entity to break PGP by cryptographic, computational means
regardless of the version being employed. In 1996, cryptographer Bruce Schneier
characterized an early version as being "the closest you're likely to get to military-grade
encryption" (Applied Cryptography, 2nd ed., p587).
In contrast to security systems/protocols like SSL which only protect data in transit over a
network, PGP can also be used to protect data in long-term data storage such as disk files.
Some products derived from PGP have been developed which streamlined such uses of
the PGP security design, largely by Network Associates while it controlled PGP.
Like all cryptography systems and software, the security of PGP can be lost by misuse or
by indirect attacks which avoid hard cryptanalysis. In one case, the FBI obtained a court
order permitting secret installation of keystroke logger software on a suspect's computer;
when they harvested the information, they recovered his PGP passphrase and thereby
gained access, by way of his PGP private key, to all his protected files and emails. He
was subsequently tried and convicted.
Khushdeep Noheria
Page 42
Asymmetric Key Cryptography
WS-2005/06
Leaving aside such attacks, the cryptographic security of PGP depends on the assumption
that the algorithms it uses are unbreakable by direct cryptanalysis with current equipment
and techniques. For instance, in the original version of PGP the RSA algorithm was used
to encrypt session keys; RSA's security depends upon the (generally presumed) one-way
function nature of mathematical integer factoring. Now unknown integer factorization
techniques have the potential, therefore, to make breaking RSA easier than now, or
perhaps even trivially easy. Likewise the secret key algorithm originally used in PGP was
IDEA, which might at some future time be found to have a previously unsuspected
cryptanalytic flaw. Specific instances of PGP or IDEA insecurities -- if they exist -- are
not publicly known. As current versions of PGP have added additional encryption
algorithms, the degree of their cryptographic vulnerabilty varies.
Clearly, since NSA, GCHQ and similar organizations do not discuss the state of their
cryptanalytic knowledge, there exists a publicly unknown chance that one or more of
them have discovered something which allows them to decrypt some PGP messages
without access to the relevant private key. But this is, of course, true of every
cryptographic system of any design and from any source, not just PGP.
Since PGP now permits the use of several algorithms, current PGP messages are not
equally susceptible to any potential breakthroughs against the original algorithms.
However, there has been some speculation that the first released PGP version (using the
RSA and IDEA algorithms) might have been broken. PGP's author, Phil Zimmerman,
was criminally investigated for three years by the U.S. Government for having violated
munitions control regulations in connection with the availability outside the US and
Canada of PGP. The investigation was abruptly dropped. Zimmerman has publicly stated
that the investigation might have been dropped because the U.S. government had found a
way to break PGP messages of that period.
On balance, it should be understood from the above discussion that the only currently
credible entities with any credible chance of breaking PGP messages have access to
government-level resources. The security of PGP encryption from direct cryptanalytic
attack by anyone else is almost certainly quite strong.
For more details please visit www.pgp.com
7.3 Others
Examples of other protocols using asymmetric key algorithms include:
IKE
SSH
Secure Socket Layer now implemented as an IETF standard -- TLS
SILC
Khushdeep Noheria
Page 43
Asymmetric Key Cryptography
WS-2005/06
Appendix A Mathematical concepts
The purpose of this Appendix is to give a brief description of some of the mathematical
concepts mentioned in this document. For a more thorough treatment of modular
arithmetic and basic number theory, consider any undergraduate textbook in elementary
algebra. For more details on analysis and the theory of limits, consult any undergraduate
textbook in analysis.
A.1 Functions
A function f from a set A to a set B assigns to each element a in A a unique element b in
B. For each element a Î A, the corresponding element in B assigned to a by f is denoted
f(a); we say that a is mapped to f(a). The notation f :A ® B means that f is a function from
A to B.
Example
Consider the set Z of integers. We may define a function f : Z ® Z such that f(x) = x2 for
each x Î Z. For example, f(5) = 25.
Let f : A ® B and g : B ® C be functions. The composition g °f of g and f is the function h
: A® C defined as h(a) = g(f(a)) for each a Î A. Note, however, that ``f °g'' does not make
sense unless A = C.
Example
Let N be the set of nonnegative numbers. With f : Z ® N defined as f(x) = x2 and g : N ®
Z defined as g(y) = y-y2, we obtain that g °f : Z ®Z is the function h defined as
h(x) = g(x2) = x2 - x4.
A function f : A ® B is one-to-one or injective if f(a) = f(a¢) implies that a = a¢, that is,
no two elements in A are mapped to the same element in B. The function f is onto or
surjective if, for each b Î B, there exists an element a Î A such that f(a) = b. Finally, f is
bijective if f is one-to-one and onto. Given a bijective function f : A ® B, the inverse f-1 of
f is the unique function g : B ® A with the property that g °f(a) = a for all a Î A. A
bijective function f : A ® A is a permutation of the set A.
For any subset S of A, f(S) is the set of elements b such that f(a) = b for some a Î S. Note
that f being surjective means that f(A) = B. The restriction of f to a subset S of A is the
function fS : S ® B defined as fS(s) = f(s) for all s Î S.
Khushdeep Noheria
Page 44
Asymmetric Key Cryptography
WS-2005/06
Examples.
The function f : Z ® Z defined as f(x) = x3 is injective, because x3 = y3 implies that
x = y. However, f is not surjective; for example, there is no x such that f(x) = 2.
Let |x| be the absolute value of x Î Z (for example, |-5| = |5| = 5). The function g :
Z ®N defined as g(x) = |x| is surjective but not injective. Namely, for all x, the
elements x and -x are mapped to the same element |x|. However, the restriction of
g to N is injective and surjective, hence bijective.
If A and B are finite sets of the same size, then a function f : A ® B is injective if
and only if f is surjective.
A.2 Modular arithmetic
Given integers a, b, and n with n > 0, we say that a and b are congruent modulo n if a-b is
divisible by n, that is, if [(a-b)/( n)] is an integer. We write
a ºb (mod n)
if a and b are congruent modulo n>. Let a, b, c, and d be integers such that a ºc (mod n)
and b ºd (mod n). It is not difficult to prove that
a +b º c+d (mod n)
-(1)
a b º c d (mod n).
-(2)
and
Given a fixed integer n > 0, called the modulus, we may form congruence classes of
integers modulo n. Each congruence class is formally a set of the form
[a]: = a + n Z = { ¼, a-2n, a-n, a, a+n, a+2n, ¼}.
By (1) and (2), addition and multiplication of congruence classes is well-defined. More
precisely, we define [a]+[b] = [a+b] and [a] ·[b] = [ab]. It is convenient to identify the
element [a] with the smallest nonnegative number a¢ such that a º a¢ (mod n) . This
number a¢ will be denoted a mod n . For example, 13 mod 5 = 3. Let Zn denote the set
of congruence classes modulo n. For example, Z5 = {0,1,2,3,4}.
The greatest common divisor (gcd) of two integers m and n is the greatest positive integer
d such that d divides both m and n. For example, gcd(91,52) = 13.
The Euclid algorithm states that if gcd(m,n) = d, then there are integers r and s such that
mr + ns = d. In particular, the equation
Khushdeep Noheria
Page 45
Asymmetric Key Cryptography
mx º b (mod n) Û mx = b (in Zn)
WS-2005/06
-(3)
has a solution x if and only if b is divisible by d.
Let Zn* be the set of integers (congruence classes modulo n) k Î {1, ¼, n-1} with the
property that gcd(k,n) = 1. For example, Z12* = {1,5,7,11}.
A.3 Groups
Consider a prime number p. The procedures of adding elements in Zp and multiplying
elements in Z*p share certain properties:
Both operations are associative, that is, a + (b + c) = (a +b) + c and a (b c) = (a b)
c.
There is an additive identity 0 with the property that 0+a = a+0 = a for all a. The
corresponding multiplicative identity is the element 1; 1 ·a = a ·1 = a.
For each a Î Zp, there is a b such that a+b = 0; namely, b = -a has this property.
By (3) in Section A.2, the equation ax = 1 has an integer solution x : = a-1 for each
a Î Zp*. Namely, since p is a prime, gcd(a,p) = 1. The elements -a and a-1 are the
additive and multiplicative inverses of a, respectively.
Structures with these three properties have turned out to be of such a great importance
that they have a name; they are called groups.
Formally, a group consists of a set G (finite or infinite) together with a binary operation *
: G ×G ® G called (group) multiplication. Note that ``* : G ×G ® G'' means that G is
closed under multiplication, that is, the product a*b is in G for any two elements a, b in
G. A group must satisfy the following axioms:
The operation * is associative, that is, a*(b*c) = (a*b)*c for any a, b, c Î G.
There exists an identity element e Î G such that a*e = e*a = a for each element a Î
G.
Each element a Î G has an inverse b Î G satisfying a*b = b*a = e = the identity.
If, in addition, multiplication in G is commutative, that is, a*b = b*a for any two
elements a,b Î G, then the group is abelian.
A group is usually identified with its underlying set, unless the group operation is not
clear from context. From now on, we will suppress the group operation * and simply
write ab instead of a*b. For n ³ 1, gn means multiplication of g with itself n times (for
example, g3 = ggg), while g-n is the inverse of gn. g0 is the identity element. Note that ga
gb = ga+b for all integers a, b.
A subgroup H of a group G is a group such that the set H is a subset of G. Any subset S
of G generates a subgroup áS ñ of G consisting of all elements of the form
Khushdeep Noheria
Page 46
Asymmetric Key Cryptography
WS-2005/06
s1a1 ¼snan,
where s1, ¼, sn are (not necessarily distinct) elements in S and a1, ¼, an are (not
necessarily positive) integers. If G = ág ñ for some g Î G, then G is cyclic with generator
g. This means that every element in G is of the form gk for some integer k. All cyclic
groups are abelian.
Examples
The set Z of integers is a cyclic group under addition with generator 1. However,
the set of nonzero integers is not a group under multiplication. Namely, for a ¹ ±1,
there is no integer b such that ab = 1.
The sets Q, R, and C of rational, real, and complex numbers are all abelian
groups under addition. Moreover, Q*, R*, and C* (the above sets with 0 removed)
are all abelian groups under multiplication. Namely, the inverse of a number x is
1/x.
The set Zn is a cyclic group under addition. If n = ab is a composite number with
a, b > 1, then the set {1, ¼,n-1} is not a group under multiplication modulo n.
Namely, the product of a and b is equal to 0 modulo n, which implies that the set
is not even closed under multiplication. However, the subset Zn* is a group under
multiplication. If n is a prime, then Zp* is a cyclic group of order p-1.
The set Z under subtraction is not a group. Namely, subtraction is not associative;
a - (b-c) ¹ (a-b)-c unless c = 0.
For a given set A, the set SA of permutations (bijective functions) p: A ® A is a
group under composition °. For example, composition is associative, because
p°(r°s) (a) = p(r(s(a))) = (p°r) °s(a).
However, unless A consists of at most two elements, SA is not abelian. For
example, with A = Z3, p(a) = a +1, and s(a) = 2 a, we have
p°s(0) = p(s(0)) = p(0) = 1 ¹ 2 = s(1) = s(p(0)) = s°p(0).
A.4 Fields and rings
One interesting observation from the examples in the previous section is that each of the
sets Zp, R, Q, and C contains two different abelian group structures: the set itself under
addition and the set of nonzero elements under multiplication. Structures satisfying this
property together with an axiom about multiplication ``distributing'' over addition are
called fields.
Formally, a field consists of a set F together with two operations + : F ×F ® F and ·: F
×F ® F called addition and multiplication, respectively, such that the following axioms
are satisfied.
Khushdeep Noheria
Page 47
Asymmetric Key Cryptography
WS-2005/06
F forms an abelian group under addition.
F \{0} forms an abelian group under multiplication, where 0 is the identity in the
additive abelian group áF, + ñ.
Multiplication distributes over addition, that is, a ·(b+c) = a ·b + a ·c.
For an integer n and a field element x, n ·x denotes the element obtained by adding x to
itself n times; for example, 3·x = x+x+x. The characteristic of a field is the smallest
positive integer p such that p ·1 = 0. If no such p exists, then the characteristic of the field
is defined to be 0. The characteristic of a field is either a prime number or 0. If the
characteristic of a field is 0, then the field is infinite. However, a field with nonzero
characteristic might be either finite or infinite.
Examples.
The fields Q, R, and C of rational, real, and complex numbers, respectively, are fields of
characteristic 0. The finite field Zp is a field of characteristic p.
The number of elements in a finite field must be a power of a prime number. A
classification theorem of the finite fields states that there is exactly one finite field (up to
isomorphism; of size q for each prime power number q. Thus it makes sense talking about
the field with q elements, which is traditionally denoted GF(q) (GF = Galois Field) or Fq.
A ring R satisfies axioms (1) and (3), but instead of (2), multiplication in R is only
required to be associative. If multiplication is commutative, then the ring is commutative.
A nonzero element a in a ring is a zero divisor if there is a nonzero element b such that ab
= 0. There are two main classes of commutative rings: Rings with no zero divisors. All
fields and the ring Z of integers are of this kind. Rings with zero divisors. The ring Zn
contains zero divisors if and only if n is composite. A polynomial in a ring R is a function
f : R ® R of the form
f(x) = a0 + a1 x + a2 x2 + ¼+ an xn,
here a0, ¼, an are elements in the ring. A root of a polynomial is an element r such that
f(r) = 0.
Khushdeep Noheria
Page 48
Asymmetric Key Cryptography
WS-2005/06
Appendix B Glossary
Sr.No.
1
2
3
4
Keyword
Description
ATM
automatic teller machines
abelian group
An abstract group with a commutative binary operation
adaptive chosen ciphertext attack A version of the chosen-ciphertext attack where the cryptanalyst can
choose ciphertexts dynamically. A cryptanalyst can mount an attack of
this type in a scenario in which he or she has free use of a piece of
decryption hardware, but is unable to extract the decryption key from it.
AES
The Advanced Encryption Standard that will replace DES (The Data
Encryption Standard) around the turn of the century.
5
6
7
8
API
Apple Mail
ASCII
ASCII armor
Application Programming Interface.
is an email program made by Apple Computer included in Mac OS X.
American Standard Code for Information Interchange
is a term used to describe an encoding process, in which data in a
binary format is transformed into a textual format.
9
10
asymmetric key algorithms
attacker
Public key cryptography algorithms like RSA,DSA etc.
is a malicious entity whose aim is to prevent the users of the
cryptosystem from achieving their goal.
11
Authentication
The action of verifying information such as identity, ownership or
authorization.
12
bilinear map
is a mathematical function of several vector variables that is linear in
each variable.
13
Biometric
The science of using biological properties to identify individuals; for
example, finger prints, a retina scan, and voice recognition.
14
blind credential
is a token asserting that someone qualifies under some criteria or has
some status or right, without revealing "who" that person is — without
including their name or address, for instance. It is used in maintaining
medical privacy and increasingly for consumer privacy.
15
Blind signature scheme
Allows one party to have a second party sign a message without
revealing any (or very little) information about the message to the
second party
16
block ciphers
A symmetric cipher which encrypts a message by breaking it down into
blocks and encrypting each block.
17
18
Blowfish
Bluetooth
is a keyed, symmetric block cipher.
is an industrial specification for wireless personal area networks
(PANs).
19
20
21
22
Bogus
CAST5
certificate authority
challenge-response authentication
is something that is useless, bad or fake.
is a block cipher used in a number of products.
A person or organization that creates certificates.
is a family of protocols in which one party presents a question
("challenge") and another party must provide a valid answer
("response") to be authenticated.
23
Chinese Remainder Theorem
is a theorem related to abstract algebra and number theory. More
details: see any mathbook.
Khushdeep Noheria
Page 49
Asymmetric Key Cryptography
WS-2005/06
24
chosen plaintext attack
A form of cryptanalysis where the cryptanalyst may choose the
plaintext to be encrypted.
25
ciphers
An encryption-decryption algorithm.
26
27
28
ciphertext
classic cryptography
classical ciphers
Encrypted data.
classical ciphers were used in this cryptography.
is a type of cipher used historically but which now have fallen, for the
most part, into disuse.
29
Clifford Cocks
is a British mathematician and cryptographer at GCHQ who invented
the widely-used encryption algorithm now commonly known as RSA
30
31
32
Code
codebook
computer security
is a method used to transform a message into an obscured form
is a document used for implementing a code.
is a field of computer science concerned with the control of risks
related to computer use.
33
coprime
34
35
Cramer-Shoup system
cryptanalysis
the integers a and b are said to be coprime or relatively prime if they
have no common factor other than 1 and -1, or equivalently, if their
greatest common divisor is 1.
is an asymmetric key encryption algorithm for public key cryptography.
The art and science of breaking encryption or any form of
cryptography. See attack.
36
cryptographic hash function
is a hash function with certain additional security properties to make it
suitable for use as a primitive in various information security.
37
cryptographic keys
A key is a piece of information that controls the operation of a
cryptography algorithm.
38
39
cryptographic privacy
cryptographic protocol
Privacy can be seen as an aspect of security
is an abstract or concrete protocol that performs a security-related
function and applies cryptographic methods.
40
Cryptography
The art and science of using mathematics to secure information and
create a high degree of trust in the electronic realm.
41
cyclic group
42
is a group that can be generated by a single element, in the sense that
the group has an element a (called a "generator" of the group) such
that, when written multiplicatively, every element of the group is a
power of a (or na when the notation is additive).
Decisional Diffie-Hellman (DDH) is the assumption that a certain computational problem within a cyclic
assumption
group is hard.
43
DES
Data Encryption Standard, a block cipher developed by IBM and the
U.S. government in the 1970's as an official standard.
44
45
46
deterministic encryption
DH-EKE
Diffie-Hellman key exchange
a deterministic algorithm
Diffie-Hellman Encrypted Key Exchange
A key exchange protocol allowing the participants to agree on a key
over an insecure channel.
47
Diffie-Hellman problem
an open problem in number theory developed by Whitfield Diffie and
Martin Hellman with implications for modern cryptography.
48
49
50
digital cash
digital certificates
digital envelope
electronic money
is a certificate which uses a digital signature.
A key exchange protocol that uses a public-key cryptosystem to
encrypt a secret key for a secret-key cryptosystem.
51
52
digital signatures
digitally signed
The encryption of a message digest with a private key.
See digital signatures
Khushdeep Noheria
Page 50
Asymmetric Key Cryptography
WS-2005/06
53
54
digitally signed contract
discrete logarithm
A contract that is digitally signed.
Given two elements d, g in a group such that there is an integer r
satisfying gr = d, r is called the discrete logarithm of d in the ``base'' g.
55
discrete logarithm problem
The problem of finding r such that gr = d, where d and g are elements
in a given group. For some groups, the discrete logarithm problem is a
hard problem used in public-key cryptography.
56
distributing keys
A key that is split up into many parts and shared (distributed) among
different participants. See also secret sharing.
57
DNA
58
59
60
61
62
63
EasyByteCryptocx
ECDSA
ECElGamal
ECMQV
e-commerce
electronic signature
Deoxyribonucleic acid (DNA) is a nucleic acid that contains the genetic
instructions specifying the biological development of all cellular forms
of life
Cryptocx v6 is a fully OpenPGP compatible encryption component.
Elliptic curve digital signature algorithm
Elliptic curve EIGamal
elliptic curve MQV
Business transactions conducted over the Internet.
is often used to mean either a signature imputed to a text via one or
more of several electronic means, or cryptographic means to add nonrepudiation and message integrity features to a document.
64
ElGamal cryptosystem
65
ElGamal
cryptosystem
66
ElGamal signature scheme
is a digital signature scheme which is based on the difficulty of
computing discrete logarithms
67
elliptic curve cryptography (ECC)
is an approach to public-key cryptography based on the mathematics
of elliptic curves.
68
Elliptic Curve Discrete Logarithm The problem of finding m such that m ·P = Q, where P and Q are two
Problem
points on an elliptic curve.
69
group
a group is a set, together with a binary operation, such as multiplication
or addition.
70
71
72
elliptic curves
email clients
encryption
is a plane curve defined by an equation of the form y2 = x3 + a x + b.
is a computer program that is used to read and send e-mail.
The transformation of plaintext into an apparently less readable form
(called ciphertext) through a mathematical process. The ciphertext may
be read by anyone who has the key that decrypts (undoes the
encryption) the ciphertext.
73
Enigma
was a portable cipher machine used to encrypt and decrypt secret
messages.
74
Enigmail
is a public key encryption extension for versions of the Mozilla
Application Suite and Mozilla Thunderbird running on Microsoft
Windows or Unix-like operating systems
75
Eudora
is an email client that was once used widely on the Microsoft Windows
and Macintosh operating systems.
76
77
Evolution
exponentiate
Its user interface and functionality are similar to Microsoft Outlook.
is a process generalized from repeated (or iterated) multiplication, in
much the same way that multiplication is a process generalized from
repeated addition.
Khushdeep Noheria
discrete
is an asymmetric key encryption algorithm for public key cryptography
which is based on Diffie-Hellman key agreement.
log is an asymmetric key encryption algorithm for public key cryptography.
Page 51
Asymmetric Key Cryptography
WS-2005/06
78
FBI
Federal Bureau of Investigation, a U.S. government law enforcement
agency.
79
80
Fermat factorization
Fermat's little theorem
Based on Fermat's little theorem
states that if p is a prime number, then for any integer a, such that
81
finite field
82
83
FIPS-182-2, change notice 1
Firefox
84
free software
as defined by the Free Software Foundation, is software which can be
used, copied, studied, modified and redistributed without restriction.
85
86
FreeBSD
frequency analysis
is a Unix-like free software operating system.
is the study of the frequency of letters or groups of letters in a
ciphertext.
87
Galois field
A field with a finite number of elements. The size of a finite field must
be a power of prime number.
88
GCHQ
The Government Communications Headquarters (GCHQ) is a British
intelligence agency
89
generating element
In abstract algebra, a generating set of a group G is a subset S such
that every element of G can be expressed as the product of finitely
many elements of S and their inverses.
90
91
92
GNOME
GNU General Public License
GNU Privacy Guard
GNOME is the official desktop of the GNU Project
is a free software license.
is a free software replacement for the PGP suite of cryptographic
software
93
hamming weight
Is of a string is its Hamming distance from the zero string (string
consisting of all zeros) of the same length.
94
hash collisions
is a situation that occurs when two distinct inputs into a hash function
produce identical outputs.
95
96
hash function
hash value
A function that takes a variable sized input and has a fixed size output.
A hash value (or simply hash), also called a message digest, is a
number generated from a string of text.
97
98
Horde
HTTPS
is a PHP-based Web application framework.
HyperText Transfer Protocol (HTTP) is the primary method used to
convey information on the World Wide Web.
99
100
101
Hushmail
IDEA
identity-based encryption
is a free webmail service which offers PGP-encrypted email
International Data Encryption Algorithm (IDEA) is a block cipher.
is a key authentication system in which the public key of a user is some
unique information about the identity of the user (e.g. a user's email
address).
102
IETF standard
Internet Engineering Task Force (IETF) is charged with developing and
promoting Internet standards, in particular, those of the TCP/IP
protocol suite.
Khushdeep Noheria
ap = a*(mod p)
A mathematical structure consisting of a finite or infinite set F together
with two binary operations called addition and multiplication. Typical
examples include the set of real numbers, the set of rational numbers,
and the set of integers modulo p.
Fedral Information Processing Standard
is a free, cross-platform, graphical web browser developed by the
Mozilla Corporation.
Page 52
Asymmetric Key Cryptography
WS-2005/06
103
integer factorization
integer factorization problem is the problem of finding a non-trivial
divisor of a composite number.
104
Interlock Protocol
as a method to expose a middle-man who might try to compromise two
parties that use anonymous key agreement to secure their
conversation.
105
Internet Protocol
is a data-oriented protocol used by source and destination hosts for
communicating data across a packet-switched internetwork.
106
Internet standards-track
Internet standards evolve through a series of three maturation stages:
proposed standard, draft standard, and standard. Collectively, these
stages of evolution are known as the standards track.
107
Ipsec
IP security) is a standard for securing Internet Protocol (IP)
communications by encrypting and/or authenticating all IP packets.
108
109
110
ISAKMP
KDE
Key
Internet Security Association and Key Management Protocol.
K Desktop Environment
A string of bits used widely in cryptography, allowing people to encrypt
and decrypt data; a key can be used to perform other mathematical
operations as well. Given a cipher, a key determines the mapping of
the plaintext to the ciphertext.
111
112
key lengths
key management
Also known as key size.
The various processes that deal with the creation, distribution,
authentication, and storage of keys.
113
key server
is a computer — typically running special software — which provides
cryptographic keys to users or other programs.
114
key size
the key size (alternatively key length) is a measure of the number of
possible keys which can be used in a cipher
115
Key pair
The full key information in a public-key cryptosystem, consisting of the
public key and private key.
116
keystroke logger
is a diagnostic used in software development that captures the user's
keystrokes
117
118
Kmail
knapsack problem
is the email client of the KDE Desktop Environment.
A problem that involves selecting a number of objects with given
weights from a set, such that the sum of the weights is maximal but
less than a pre-specified weight.
119
120
121
Legendre symbol
Malleable
man in the middle (MITM) attack
is used in connection with factorization and quadratic residues.
is a term used in the analyses of cryptographic algorithms.
is an attack in which an attacker is able to read, insert and modify at
will, messages between two parties without either party knowing that
the link between them has been compromised.
122
123
Merkle's Puzzles
message authentication code
Merkle's Puzzles is an early construction for a public-key cryptosystem
A MAC is a function that takes a variable length input and a key to
produce a fixed-length output. See also hash-based MAC, streamcipher based MAC, and block-cipher based MAC.
124
message digest
A hash function takes a long string (or message) of any length as input
and produces a fixed length string as output, sometimes termed a
message digest or a digital fingerprint.
125
126
MIME
MIT
Multipurpose Internet Mail Extensions.
Massachusetts Institute of Technology
Khushdeep Noheria
Page 53
Asymmetric Key Cryptography
WS-2005/06
127
mobile telephone networks
The mobile phone communicates via a network of base stations which
are in turn linked to the conventional telephone network.
128
129
modular exponentiation
Mozilla
is a type of exponentiation performed over a modulus.
is a trademark of the Mozilla Foundation and historically had been
used internally as a codename for the Netscape Navigator web
browser from its beginning.
130
MQV
Menezes-Qu-Vanstone) is an authenticated protocol for key agreement
based on the Diffie-Hellman scheme.
131
multiplicative group
a group is a set, together with a binary operation, such as multiplication
or addition.
132
133
Mutt
need-to-know" principle
is a text-based email client for Unix-like systems.
Classified information, which access is restricted by law or regulation to
particular classes of people.
134
NetBSD
NetBSD was the second freely redistributable, open source version of
the BSD
135
NIST
National Institute of Standards and Technology, a United States
agency that produces security and cryptography related standards (as
well as others); these standards are published as FIPS documents.
136
137
Nonce
non-repudiation
means 'for the present time' or 'for a single occasion or purpose'.
A property of a cryptosystem. Non-repudiation cryptosystems are those
in which the users cannot deny actions they performed.
138
NP-complete
An NP problem is NP-complete if any other NP problem can be
reduced to it in polynomial time.
139
NSA
140
one-time pad
National Security Agency. A security-conscious U. S. government
agency whose mission is to decipher and monitor foreign
communications.
A secret-key cipher in which the key is a truly random sequence of bits
that is as long as the message itself, and encryption is performed by
XORing the message with the key. This is theoretically unbreakable.
141
142
open standard
OpenBSD
are publicly available specifications for achieving a specific task
OpenBSD is a freely available, BSD-based Unix-like operating system.
143
OpenPGP
the PGP design was adopted as an Internet standards-track
specification known as OpenPGP
144
145
OpenSSL
open source implementation of the SSL and TLS protocols.
Optimal Asymmetric Encryption is a padding scheme often used together with RSA encryption.
Padding
146
147
padding
Parses
Extra bits concatenated with a key, password, or plaintext.
parsing is the process of analyzing an input sequence (read from a file
or a keyboard, for example) in order to determine its grammatical
structure with respect to a given formal grammar.
148
pass phrase
is a sequence of words or other text used to control access to a
computer system, program or data.
149
Password-authenticated
agreement
150
PGP
Khushdeep Noheria
key is an interactive method for two or more parties to establish
cryptographic keys based on one or more party's knowledge of a
password.
is a computer program which provides cryptographic privacy and
authentication
Page 54
Asymmetric Key Cryptography
WS-2005/06
151
PGPfone
is a secure voice system based on the popular PGP encryption
package.
152
153
154
PKCS
plaintext
Plugin
Public Key Cryptography Standards
The data to be encrypted.
is a computer program that can, or must, interact with another program
to provide a certain, usually very specific, function.
155
Pohlig-Hellman algorithm
is an algorithm for the computation of discrete logarithms in a
multiplicative group whose order is a smooth integer.
156
157
power associative
primality tests
is a weak form of associativity.
is a probabilistic test to determine if a number is composite or probably
prime.
158
prime number
Any integer greater than 1 that is divisible only by 1 and itself. The first
twelve primes are 2,3,5,7,11,13,17,19,23,29,31, and 37.
159
primitive
primitive root modulo n is a concept from modular arithmetic in number
theory.
160
private key
In public-key cryptography, this key is the secret key. It is primarily
used for decryption but is also used for encryption with digital
signatures.
161
162
163
probabilistic
Probabilistic Signature Scheme
protocol
is an algorithm which is allowed to flip a truly random coin.
A provably secure way of creating signatures using the RSA algorithm.
A series of steps that two or more parties agree upon to complete a
task.
164
public key
In public-key cryptography this key is made public to all, it is primarily
used for encryption but can be used for verifying signatures.
165
public key infrastructure
is an arrangement which provides for third-party vetting of, and
vouching for, user identities.
166
public-key (asymmetric key)
Cryptography based on methods involving a public key and a private
key cryptography.
167
quantum computer
A theoretical computer based on ideas from quantum theory;
theoretically it is capable of operating nondeterministically.
168
Rabin systems
is a primality test: an algorithm which determines whether a given
number is prime.
169
random number generator
is a computational or physical device designed to generate a sequence
of numbers that does not have any easily discernable pattern, so that
the sequence can be treated as being random.
170
171
Repudiation
Retinal
Is a inverse of non-repudiation.
is a thin layer of cells at the back of the eyeball of vertebrates and
some cephalopods.
172
RFC 3156
Request for Comments(RFC), a series of notes about the Internet,
started in 1969 each RFC is designated by an RFC number.
173
rotor machines
is a electro-mechanical device used for encrypting and decrypting
secret messages.
174
RSA algorithm
175
RSA-PSS
A public-key cryptosystem based on the factoring problem. RSA stands
for Rivest, Shamir and Adleman, the developers of the RSA public-key
cryptosystem and the founders of RSA Data Security (now RSA
Security).
is a signature scheme based on the RSA cryptosystem and provides
increased security assurance.
Khushdeep Noheria
Page 55
Asymmetric Key Cryptography
WS-2005/06
176
177
178
S/MIME
S/WAN
safe prime
Secure Multipurpose Internet Mail Extensions.
Secure Wide Area Network.
A safe prime is a prime number of the form 2p + 1, where p is also a
prime.
179
Seahorse
is a GNOME front-end application for managing PGP keys, written by
Jacob Perkins.
180
secret key
In secret-key cryptography, this is the key used both for encryption and
decryption.
181
security token
a hardware token or cryptographic token is a physical device that an
authorized user of computer services is given to aid in authentication.
182
semantically secure
is a widely-used definition for security in an asymmetric key encryption
algorithm.
183
session key
A key for symmetric-key cryptosystems which is used for the duration
of one message or communication session
184
185
SHA-1 hash functions
Shor's algorithm
is a set of related cryptographic hash functions
is a quantum algorithm for factoring a number N in O((log N)3) time
and O(log N) space
186
SILC
SILC (protocol) which provides secure conferencing services over the
Internet.
187
software token
Unlike hardware tokens, software tokens run on you PC or on a
separate multi-purpose device.
188
Sophie Germain prime
A prime number p is called a Sophie Germain prime if 2p + 1 is also
prime.
189
190
SPEKE
spoofing
Simple Password Exponential Key Exchange
is also sometimes used to refer to header forgery, the insertion of false
or misleading information in email or netnews headers.
191
square-and-multiply algorithm
is an algorithm used for the fast computation of large integer powers of
a number x.
192
193
SRP
SSL
Secure Remote Password Protocol
Secure Socket Layer. A protocol used for secure Internet
communications.
194
standard security protocols
is an abstract or concrete protocol that performs a security-related
function and applies cryptographic methods.
195
196
197
stream ciphers
STS
Subgroups
A secret-key encryption algorithm that operates on a bit at a time.
Station-to-Station (STS) protocol is a cryptographic key agreement.
A subset H of a group (G,*) which remains a group when the operation
* is restricted to H is called a subgroup of G.
198
subset sum problem
A problem where one is given a set of numbers and needs to find a
subset that sums to a particular value.
199
substitution ciphers
is a method of encryption by which units of plaintext are substituted
with ciphertext.
200
super-encipherment
refers to a situation where an encrypted message is then encrypted
again using the same encryption system or a different system. This is
also called cascading encryption.
201
symmetric key algorithms
are a class of algorithms for cryptography that use trivially related
cryptographic keys for both decryption and encryption.
202
symmetric key cipher
An encryption algorithm that uses the same key is used for encryption
as decryption.
Khushdeep Noheria
Page 56
Asymmetric Key Cryptography
WS-2005/06
203
symmetric(secret-key)
cryptography
symmetric-key encryption are single-key and private-key encryption.
204
205
Telex
Thunderbird
A global teleprinter network, called the Telex network,
Thunderbird is a free, cross-platform email and news client developed
by the Mozilla Foundation.
206
207
TLS
traffic analysis
Transport Layer Security Protocol.
Traffic analysis is the process of intercepting and examining messages
in order to deduce information from patterns in communication
208
transposition ciphers
changes one character from the plaintext to another (to decrypt the
reverse is done).
209
Trapdoor
210
Triple DES
A one-way function that has an easy-to-compute inverse if you know
certain secret information. This secret information is called the
trapdoor.
is a block cipher formed from the Data Encryption Standard (DES)
cipher by using it three times.
jj211
trusted third party
is an entity which facilitates interactions between two parties who both
trust the third party
212
TWIRL
is a hypothetical hardware device designed to speed up the sieving
step of the general number field sieve integer factorization algorithm.
213
two-factor authentication
is any authentication protocol that requires two independent ways to
establish identity and privileges.
214
Twofish
is a symmetric key block cipher with a block size of 128 bits and key
sizes up to 256 bits.
215
Web of trust
is a concept used in PGP, GnuPG, and other OpenPGP-compatible
systems to establish the authenticity of the binding between a public
key and a user.
216
217
web traffic
Weil pairing
is the amount of data sent and received by visitors to a web site.
is a construction of roots of unity by means of functions on an elliptic
curve.
218
Zimmermann Telegram
was a telegram dispatched by the Foreign Secretary of the German
Empire, Arthur Zimmermann.
Appendix C References
Kryptografie in Theorie und Praxis by Albrecht Beutelspacher, Heike B.
Neumann and Thomas Schwarzpaul
Public-key cryptography From Wikipedia, the free encyclopedia
RSA Laboratories www.RSAsecurity.com
Cryptography Theory and Practice by Douglas R. Stinson
About PGP www.PGP.com
Khushdeep Noheria
Page 57