The RSA Algorithm

• Based on the idea that factorization of integers into their prime factors is hard.

★ n=p． q, where p and q are distinct primes

• Proposed by Rivest, Shamir, and Adleman

in 1977 and a paper was published in The Communications of ACM in 1978

• A public-key cryptosystem

RSA Algorithm

• Bob chooses two primes p,q and compute n=pq

• Bob chooses e with gcd(e,(p-1)(q-1))= gcd(e, ψ(n))=1• Bob solves de≡1 (mod ψ(n))• Bob makes (e,n) public and (p,q,d) secret• Alice encrypts M as C≡Me (mod n)• Bob decrypts by computing M≡Cd (mod n)

Proof for the RSA Algorithm

• Cd ≡ (Me)d ≡ Med ≡ M1+kφ(n) ≡M (mod n) by Euler’s theorem and Exercise 19 on p.192

• p=885320963, q=238855417,

• n=p． q=211463707796206571

• Let e=9007, d=116402471153538991∴• M=“cat”=30120, C=113535859035722866

Another Example

• n=127x193=24511, φ(n)=24192

• e=1307, d=10643

• Encrypt “box” with M=21524, then

C=?

Encrypt the following message

Formosa means a beautiful island

Selected Problems from P.192-200

(1) n=11413=101x113, so p=101, q=113

ψ(n)=(p-1)x(q-1)=100x112=11200

Choose e=7467, then gcd(e, ψ(n))=1

Solve de≡1 (mod ψ(n)) to get d=3

If the ciphertext C=5859, then the plaintext

M≡Cd ≡58593 ≡1415 (mod 11413)

Fast Computation of xd (mod n)

• 1235 mod 511

• 1235 ≡ 28153056843 mod 511

• 1232 ≡ 310 (mod 511)

• 1234 ≡ 32 (mod 511)

• 1235 ≡ 123101b ≡1234 ×123

≡ 359 (mod 511)

Fast Computation for xd (mod n)

y=1;

while (d != 0) {

if ((d%2) != 0) { y=(y*x)%n; d--; }

d>>1;

x=(x*x)%n; /* x^(2k) */

}

Fast Computation for xd (mod n)

Let t be the number of bits for integer d, e.g.,

If d=5=1012 , then t=3

y=1; for (i=t; i 0; i--) {≧ y=(y*y)%n; if (d[i]==1) y=(y*x)%n;}

Two Claims

• Claim 1: Suppose n=pq is the product of two distinct primes. If we know n and φ(n), then we can quickly find p and q

Hint: n － φ(n)+1=pq-(p-1)(q-1)+1=p+q, then p,q are solutions of x2 － (n － φ(n)+1)x+n=0

• Claim 2: If we know d and e, then we can probably factor n (The method of universal components could be applied)

References for Attacks on RSA

• D. Boneh, Twenty years of attacks on the RSA cryptosystem, American Math. Soc. Notices 46, 203-213, 1999

• D. Boneh, G. Durfee, Y. Frankel,

An attack on RSA given a fraction of the private key bits, Advances in Cryptology –

ASIACRYPT’98, Lecture Notes in Computer Science 1514, 25-34, 1998

Primality Testing

• Trivial Division to test if N is a prime• for (p=2; p<N1/2; p++) { e=0; if (N%p ==0 ) { while (N%p ==0) { e++; N/=p;} printf(“factor %d, power %d\n”,p,e); } }

Basic Principles for Testing n (1)

Suppose x, y satisfy x2≡y2 (mod n) butx≡y (mod n) and x≡-y (mod n) do not hold.Then n is composite. Moreover, gcd(x-y,n)gives a nontrivial factor of n.(Proof) Let d=gcd(x-y,n)If d=1, n|(x-y)(x+y) → n|x+y →contradictionIf d=n, then → n|x-y →contradiction(Example) 122 ≡22 (mod 35)

Basic Principles for Testing n (2)

• Fermat’s little theorem: ap-1 ≡1 (mod p) for a prime p if gcd(a,p)=1

• an-1 !≡ 1 (mod n) → n is composite, in particular, a=2 is used for testing a large n

• 234 ≡9 !≡ 1 (mod 35) → 35 is composite

• 2340 ≡1 (mod 341), but 341=11x31

• 2560 ≡1 (mod 561), but 561=3x11x17

The Miller-Rabin Primality Test

Let n>1 be odd with n-1=2km with an odd m.Choose a random integer a, 1<a<n-1.

Compute b0≡am (mod n), if b0≡±1 (mod n), then stop and

n is probably prime, otherwise let b1≡(b0)2 (mod n). If b1≡1

(mod n), then n is composite and gcd(b0-1,n) is a nontrivial

factor of n else if b1≡-1 (mod n), stop and n is probably

prime, otherwise let b2≡(b1)2 (mod n). If b2≡1 (mod n),

then n is composite, else if b2 ≡-1 (mod n), stop and n isprobably prime. Continue in this way until stopping or

reaching bk-1. If bk-1 !≡-1, then n is composite.

Pseudoprimes

♪ If an-1 ≡1 (mod n), n is said to be a pseudoprime for the base a

♪ If a and n pass the Miller-Rabin test, we say that n is a strong pseudoprime for the base a

♪ 2340 ≡1 (mod 341), 2560 ≡1 (mod 561), so, 341 and 561 are all pseudoprimes

Test if n=341 is a prime

• n=341, n-1=340=22． 85, let k=2, m=85

• b0 = 285 ≡32 (mod 341)

• b1 = (b0)2 ≡ 1 (mod 341)

• bk-1 ≡ 1 (mod 341), so n=341 is composite

• 2340 ≡1 (mod 341), but 341=11x31

Test if n=561 is a prime

• n=561, n-1=560=24． 35, let k=4, m=35• b0 = 235 ≡263 (mod 561)• b1 = (b0)2 ≡166 (mod 561)• b2 = (b1)2 ≡ 67 (mod 561)• b3 = (b2)2 ≡ 1 (mod 561)• bk-1 ≡ 1 (mod 561), so n=561 is composite

• 2560 ≡1 (mod 561), but 561=3x11x17

Miller-Rabin is better than Fermat’s

• Up to 1010, there are 455052511 primes. There are 14884 pseudoprimes for the base 2, and 3291 strong pseudoprimes for the base 2. Therefore, calculating 2n-1 (mod n) will fail to recognize a composite in this range with probability less than 1 out of 30 thousand and using the Miller-Rabin test with a=2 will fail with probability lest than 1 out of 100 thousand

Factoring n into Product of Primes

• Fermat factorization by checking if there exist x, y such that n|(x-y)(x+y), |x-y|>1

Example 1: n=295927 with n+32 =5442 ,

then n= 541． 547Solution: check if n+k2 is a complete square for k=1, 2, …Fermat’s method works well when n is the product that are very close together

Exponent Factorization Method

Suppose there exists r>0 and an a such that ar ≡1 (mod n).

Write r=2km with m odd. Let b0≡am (mod n), and

successively define bu+1 ≡ (bu)2 (mod n) for 0 u k-1.≦ ≦If b0 ≡1 (mod n), then stop; the procedure has failed to factor n.

If for some u, bu≡-1 (mod n), then stop; the procedure has failed to factor n.

If for some u, bu+1≡1 (mod n) but bu !≡±1 (mod n), then

gcd(bu-1,n) gives a nontrivial factor of n.

The Pollard’s p-1 Method (1974)

Choose an integer a>1 (usually a=2) and

choose a bound B. Compute b≡aB! (mod n)

as follows.

Let b1≡a (mod n) and bj ≡(bj-1)j (mod n),

then bB≡b (mod n).

If 1<d=gcd(b-1,n)<n, we have found a nontrivial factor of n

The Quadratic Sieve

• Suppose we want to factor n=3837523

n=1093． 3511

The Public Key Concept

• The RSA Algorithm

• Knapsack problems

• Discrete Logarithms by ElGamal

• Error Correcting Codes by McEliece

• Elliptic Curve Cryptosystem by Diffie-Hellman

The Concept and Criteria

1. Ek(Dk(m))=m and Dk(Ek(m))=m for every message m in M, the set of possible messages, every key k in K, the set of possible keys

2. For every m and every k, then values of Ek(m) and Dk(m) are easy to compute

3. For every k, if someone knows only the function Ek, it is computationally infeasible to find an algorithm to compute Dk

4. Given k, it’s easy to find the functions Ek and Dk