Unit 4

1. 18CSE381E- Cryptography
UNIT IV
PUBLIC KEY CRYPTOGRAPHY

2. Private-Key Cryptography
• traditional private/secret/single key
cryptography uses one key
• shared by both sender and receiver
• if this key is disclosed communications are
compromised
• also is symmetric, parties are equal
• hence does not protect sender from receiver
forging a message & claiming is sent by sender

3. Private-Key Vs Public-Key
• It is asymmetric, involving the use of two separate keys, in
contrast to symmetric encryption, which uses only one key.
• Anyone knowing the public key can encrypt messages or
verify signatures, but cannot decrypt messages or create
signatures
• It works by the clever use of number theory problems that
are easy one way but hard the other.
• public key schemes are neither more nor less secure than
private key ,nor do they replace private key schemes, rather
they complement them.
• Both also have issues with key distribution, requiring the
use of some suitable protocol.

4. Why Public-Key Cryptography?
• evolved from two of the most difficult
problems associated with symmetric
encryption:
– key distribution and digital signatures.
• first practical scheme, which was for key
distribution only, was published in 1977 by
Diffie & Hellman.

5. Public-Key Cryptography
• public-key/two-key/asymmetric cryptography
involves the use of two keys:
– a public-key, which may be known by anybody,
and can be used to encrypt messages, and verify
signatures
– a private-key, known only to the recipient, used to
decrypt messages, and sign (create) signatures
• is asymmetric because
– those who encrypt messages or verify signatures
cannot decrypt messages or create signatures

6. Public-Key Cryptography

7. Public-Key Characteristics
• Asymmetric algorithms rely on one key for
encryption and a different but related key for
decryption.
• It is computationally infeasible to determine the
decryption key given only knowledge of the
cryptographic algorithm and the encryption key.
• utilise problems that are easy (P type) one way
but hard (NP type) the other way
– eg exponentiation vs logs, multiplication vs factoring.

8. Public-Key Cryptosystems

9. Public-Key Cryptosystems
• public-key schemes can be used for either
secrecy or authentication, or both
• In this case, separate key pairs are used for
each of these purposes. The receiver owns
and creates secrecy keys, sender owns and
creates authentication keys.

10. Public-Key Applications
• can classify uses into 3 categories:
– encryption/decryption (provide secrecy)
– digital signatures (provide authentication)
– key exchange (of session keys)
• some algorithms are suitable for all uses,
others are specific to one

11. RSA
• by Rivest, Shamir & Adleman of MIT in 1977
• best known & widely used public-key scheme
• based on exponentiation in a finite (Galois) field over
integers modulo a prime
– exponentiation takes O((log n)3) operations (easy)
• uses large integers (eg. 1024 bits)
• security due to cost of factoring large numbers
– factorization takes O(e log n log log n) operations
(hard)

12. RSA Key Setup
• each user generates a public/private key pair by:
• selecting two large primes at random - p, q
• computing their system modulus n=p.q
– note ø(n)=(p-1)(q-1)
• selecting at random the encryption key e
• where 1<e<ø(n), gcd(e,ø(n))=1
• solve following equation to find decryption key d
– e.d=1 mod ø(n) and 0≤d≤n
• publish their public encryption key: PU={e,n}
• keep secret private decryption key: PR={d,n}

13. RSA Use
• to encrypt a message M the sender:
– obtains public key of recipient PU={e,n}
– computes: C = Me mod n, where 0≤M<n
• to decrypt the ciphertext C the owner:
– uses their private key PR={d,n}
– computes: M = Cd mod n
• note that the message M must be smaller
than the modulus n (block if needed)

14. Why RSA Works
• because of Euler's Theorem:
– aø(n)mod n = 1 where gcd(a,n)=1
• in RSA have:
– n=p.q
– ø(n)=(p-1)(q-1)
– carefully chose e & d to be inverses mod ø(n)
– hence e.d=1+k.ø(n) for some k
• hence :
Cd = Me.d = M1+k.ø(n) = M1.(Mø(n))k
= M1.(1)k = M1 = M mod n

15. RSA Example - Key Setup
1. Select primes: p=17 & q=11
2. Compute n = pq =17 x 11=187
3. Compute ø(n)=(p–1)(q-1)=16 x 10=160
4. Select e: gcd(e,160)=1; choose e=7
5. Determine d: de=1 mod 160 and d < 160 Value is
d=23 since 23x7=161= 10x160+1
6. Publish public key PU={7,187}
7. Keep secret private key PR={23,187}

16. RSA Security
• possible approaches to attacking RSA are:
– brute force key search (infeasible given size of
numbers)
– mathematical attacks (based on difficulty of
computing ø(n), by factoring modulus n)
– timing attacks (on running of decryption)
– chosen ciphertext attacks (given properties of
RSA)

17. Key Management
• public-key encryption helps address key
distribution problems
• have two aspects of this:
– distribution of public keys
– use of public-key encryption to distribute secret
keys

18. Distribution of Public Keys
• Techniques proposed for the distribution of
public keys,
– public announcement
– publicly available directory
– public-key authority
– public-key certificates

19. Public Announcement
• Any participant can send his or her public key
to any other participant,
• or broadcast the key to the community at
large.
• Its major weakness is forgery, anyone can
create a key claiming to be someone else and
broadcast it, and until the forgery is
discovered they can masquerade as the
claimed user.

20. Publicly Available Directory
• can obtain greater security by registering keys
with a public directory
• directory must be trusted with properties:
– contains {name,public-key} entries
– participants register securely with directory
– participants can replace key at any time
– directory is periodically published
– directory can be accessed electronically
• still vulnerable to tampering or forgery

21. Public-Key Authority
• improve security by tightening control over
distribution of keys from directory
• has properties of directory
• and requires users to know public key for the
directory
• then users interact with directory to obtain
any desired public key securely
– does require real-time access to directory when
keys are needed

22. Public-Key Authority

23. Public-Key Certificates
• certificates allow key exchange without real-
time access to public-key authority
• a certificate binds identity to public key
– usually with other info such as period of validity,
rights of use etc
• with all contents signed by a trusted Public-
Key or Certificate Authority (CA)
• can be verified by anyone who knows the
public-key authorities public-key

24. Public-Key Certificates

25. Public-Key
Distribution of Secret
Keys
• use previous methods to obtain public-key
• can use for secrecy or authentication
• but public-key algorithms are slow
• so usually want to use private-key encryption
to protect message contents
• hence need a session key
• have several alternatives for negotiating a
suitable session

26. Simple Secret Key Distribution
• proposed by Merkle in 1979
– A generates a new temporary public key pair
– A sends B the public key and their identity
– B generates a session key K sends it to A
encrypted using the supplied public key
– A decrypts the session key and both use
• problem is that an opponent can intercept and
impersonate both halves of protocol

27. Simple Secret Key Distribution

28. Hybrid Key Distribution
• A hybrid approach in use on IBM mainframes .
• Retains the use of a key distribution center
(KDC) that shares a secret master key with
each user and distributes secret session keys
encrypted with the master key.
• A public key scheme is used to distribute the
master keys.
• The addition of a public-key layer provides a
secure, efficient means of distributing master
keys.
• This is an advantage in a configuration in

29. Diffie-Hellman Key Exchange
• Enable two users to securely exchange a
key that can then be used for subsequent
encryption of messages.
• The Diffie-Hellman algorithm uses
exponentiation in a finite (Galois) field
(modulo prime or a polynomial),
• Its effectiveness lies on the difficulty of
computing discrete logarithms.

30. Diffie-Hellman Setup
• all users agree on global parameters:
– large prime integer or polynomial q
– a being a primitive root mod q
• each user (eg. A) generates their key
– chooses a secret key (number): xA < q
– compute their public key: yA = a
xA
mod q
• Similarly user B generates yB
• Each side keeps the X value private and makes
the Y value available publicly to the other side

31. Diffie-Hellman Key Exchange
• User A computes the key as K = yB
xA
mod q
• User B computes the key as K = yA
xB
mod q
• These two calculations produce identical
results
– K= yB
xA
mod q
= (a
xB
mod q)
xA
mod q
= (a
xB
)
xA
mod q
= a
xBxA
mod q
= (a
xA
)
xB
mod q
= (a
xA
mod q)
xB
mod q
= y
xB
mod q

32. Example
• Find YA and YB and compute the common secret
key
• q=23, a= 7, xA = 3, xB = 6
• q=353, a= 3, xA = 97, xB = 233

33. Man in Middle Attack
• Suppose Alice and Bob wish to exchange keys, and Darth is
the adversary
• The attack proceeds as follows:
1. Darth prepares for the attack by generating two random
private keys XD1 and XD2 and then computing the
corresponding public keys YD1 and YD2.
2. Alice transmits YA to Bob.
3. Darth intercepts YA and transmits YD1 to Bob. Darth also
calculates K2=(YA)X
D2 mod q.
4. Bob receives YD1 and calculates K1=(YD1)X
E mod q
5. Bob transmits XA to Alice.
6. Darth intercepts XA and transmitsYD2 to Alice. Darth
calculates K1=(YB)X
D1 mod q.
7. Alice receives YD2 and calculates K2=(YD2)X
A mod q.
8. At this point, Bob and Alice think that they share a secret

34. ELLIPTIC CURVE CRYPTOGRAPHY
• majority of public-key crypto (RSA, D-H) use
either integer or polynomial arithmetic with
very large numbers/polynomials
• imposes a significant load in storing and
processing keys and messages
• an alternative is to use elliptic curves
• offers same security with smaller bit sizes
• newer, but not as well analysed

35. Real Elliptic Curves
• an elliptic curve is defined by an equation in
two variables x & y, with coefficients
• consider a cubic elliptic curve of form
– y2 = x3 + ax + b
– where x, y, a, b are all real numbers
– Zero point O – If three points on an elliptic curve
lie on a straight line, their sum is O

36. Example

37. Finite Elliptic Curves
• Elliptic curve cryptography uses curves whose
variables & coefficients are finite
• have two families commonly used:
– prime curves Ep(a,b) defined over Zp
• use integers modulo a prime
• best in software
– binary curves E2m(a,b) defined over GF(2n)
• use polynomials with binary coefficients
• best in hardware

38. ECC Diffie-Hellman
• can do key exchange analogous to D-H
• users select a suitable curve Ep(a,b)
• select base point G=(x1,y1)
– with large order n s.t. nG=O
• A & B select private keys nA<n, nB<n
• compute public keys: PA=nAG, PB=nBG
• compute shared key: K=nAPB, K=nBPA
– same since K=nAnBG

39. ECC Encryption/Decryption
• several alternatives, will consider simplest
• must first encode any message M as a point on the
elliptic curve Pm
• select suitable curve & point G as in D-H
• each user chooses private key nA<n
• and computes public key PA=nAG
• to encrypt Pm : Cm={kG, Pm+kPb}, k random
• decrypt Cm compute:
Pm+kPb–nB(kG) = Pm+k(nBG)–nB(kG) = Pm