Post on 21-Dec-2015
1
Cryptography:Proofs and Tools
Gerard TelDept of Computer Science, Utrecht
2
Talk overview
Part 1: Proofs Definition and existence Proofs with numbers Numbers versus “Ad hoc”
Part 2: Tools Signature schemas Zero knowledge proofs Secret Sharing
3
Cryptography:
The art of protection using information
To have or
not to have….
To know or
not to know
4
Two examples
Encryption (DES) Alice sends email
y = Ek(x) Bob computes
x = Dk(y)
Oscar knows no k : which D function?
Identification with One-way function H A gives Bank b =
H(a) Bank pays on seeing
a’ s.t. H (a’ ) = b
O knows no a’
5
Two more examples
Signatures Alice signs M with x
S = Sig (M, x) Bob verifies with y
Ver (M, S, y)
Oscar cannot forge S’ for M’ s.t. Ver (M’ , S’ , y)
Public Key pairs Alice holds secret x Bob holds public y
Relation P (x, y)
Oscar cannotcomputex from y
6
I recognize it when I see it ....
Encryption: k s.t. Dk(y) is text
Identification: a’ s.t. H (a’ ) = b
Signatures: S’ s.t. Ver (M’ , S’ , y)
Key pair: x s.t. P (x, y)
7
…. But I don’t know it
8
Assumption: Factoring
Primes p and q (eg. 512 bits)
n = p . q (1024 bits)
Given n, one recognizes p and q
Assumption:Given n, computing p is impossible
9
Assumption: Discrete Log
Compute modulo large p : 0, 1, …, p -1Element g has order:
1 = g0, g1, g2, g3, … gord = 1Fix g of high order.
From x, power y = gx is computableAssumption:
From y, x s.t. y = gx is not computable
10
Rabin’s encryption
Alice’ secret key: p and qpublic key : product n
Bob encrypts x as y = x2 mod nAlice decrypts as extracting
square rootp and q are needed!
Oscar can not extract roots
11
Square roots modulo n
A square number has 4 rootsn = 77 = 7.11 :
362 = 64 (1296 mod 77) 36, 41, 8, 69 have square 64
Two pairs: 36 = -41 and 8 = -69Combine from two pairs: 41 + 69 =
33gcd(33, 77) = 11
12
Rabin: Provably Secure
If Oscar can find x from x2 = y mod n Select random z Solve x from x2 = z2
Prob. 1/2: x and z differ: find p and q
Contradicts Factoring Assumption
Rabin is cryptographically strong
13
Chosen Cipher text Attack
Procedure for CCA: Oscar sends Alice y, obtains x, computes
Rabin is vulnerable: Oscar sends y = z2
succeeds with Pr = 1/2
Decrypted messages as sensitive as key
Weakness inherent in strength
14
RSA: Alledgedly secure
Similar but use higher order roots.Public key: (n, e)Encryption y = xe
Decryption x = yd (d from p, q)
e th-rooting is believed but not proven to be as hard as factoring
15
RSA Decryption
φ = (p -1)(q -1)All x : x φ = 1 (mod n)From p, q, n, e,
compute d s.t. e.d = k . φ +1
y d = (x e )d = x k . φ +1 = 1k . x = x
Secretly keep d, purge p, q.
16
RSA Keys are secure
Oscar finds φ from n: p +q = n - φ + 1, solve p, q
Oscar finds φ from n and e : Simulate generation of e to do without
Oscar finds d from n and e : n
e, d p, q
Key protection is cryptographically strong
17
Ad hoc versus Numbers:Hash functions
Map H : {0,1}* {0,1}k
One-way: From y = H (x), x cannot be found
Collision-free:
No x1, x2 can be found s.t. H (x1) = H (x2)
Such x1, x2 exist
18
Fair Guessing Games
Linda dates Jon if Jon guesses parity of x L chooses x and gives
y = H (x) J guesses even/odd L reveals x
Cheating y doesn’t reveal x to Jon
one-way y binds Linda
collision-free
19
Bit manipulation: MD5
How does it work XOR, AND, OR
words Combine with sin
bits Four rounds in
Why does it workWhy four rounds
MD4 background
Why this combination Attacks on variants
Why is it secure? We don’t know
20
Discrete Log Hash (Chaum)
How does it work Select g, random h.
:
f (x, x’ ) = gx.hx’
Why does it work log(h ): a s.t. g a =
hwill never be known
f (x, x’ ) = f (y, y’ )
gx . hx’ = gy . hy’
a = (x - y )(y’ - x’ ) -1
Cryptographically strong collision free
21
Trapdoor Hash
Cheat in generation of f. Select h = g a instead of random h.
Collision: g x . h x’ = g x - a.z . h x’ + z
Trapped f remains cryptographically strong one-way.
22
Questions?
23
Gerard Tel, Part 2:
Cryptographic Tools: Signatures Zero knowledge Secret Sharing
24
Digital Signatures
Alice signs message M : S = Sig (M, x)Bob verifies signature S : Ver (M, S, y )Validity: Ver (M, Sig (M, x), y )
Forgery: Oscar finds M, S : Ver (M, S, y )
25
RSA Signatures
Public/Secret key: (n, e) and (n, d ) Functions x x e and y y d are
inverses
Sign M : S = M d (compute)Verify S : S e = M (check)
Forge signature under M : Invert RSA public function
26
Existential Forgery
Oscar: random S, M = S e.
M takes special form ………01010101010101 Hash of longer message
27
Blind Signatures
Alice signs one message without seeing it Bob has M, selects blinder b Bob gives Alice blinded message M’ =
M . b Alice signs for Bob: S’ = M’ d
Bob unblinds: divide by b d.
28
Blind Signatures
Alice signs one message without seeing it Bob has M, selects blinder b = k e
Bob gives Alice blinded message M’ = M . b Alice signs for Bob: S’ = M’ d
Bob unblinds: divide by b d
S = S’ / kSimilar: Blind decryption
29
Zero knowledge proofs
Identification by secret A gives Bank b = H (a) Bank pays on seeing a
If Alice shows a:employee, eavesdropper become as powerful.
Alice proves to know a without showing
30
0KP of a Square Root
Alice holds a, Bob holds b = a 2
Withdrawing of money: Alice selects s = r 2 and gives Bob s Claim: I know roots of s and s.b
This is true namely r and r.a
This implies knowing a as quotient of roots
31
Verify knowing two roots
Bob sees one! Otherwise becomes too smart
Challenge c = 0/1 Alice must give one root:
r of s (c = 0)r.a of s.b (c = 1)
Oscar does not know both Fails with Pr = 1/2.
32
What does Bob learn?
Triple (s, c, y) s is random squarec is random bity solves y 2 = s . b c
To generate such, choosec as random bity as random numbers as y 2 / b c
33
How can it convince?
Compute order s, c, y : needs aCompute order c, y, s : don’t need a
Protocol enforces s, c, y Transcript doesn’t show order.
34
Zero knowledge proofs
20 rounds: 1-in-million false acceptance
Similar: e th root or logarithmAlso: Graph coloring
Use with blind signatures: Bob proves blinded message is legal
35
Secret Sharing
Goal: share holders together know aShares handed out by dealer
Share: related to ak -1 shares reveal nothingk shares reveal all
in reconstruction
36
Concepts in Sharing
Use: Bank, company Nuclear heads Digital money Key escrow
How many shares Veto (split) Threshold (share)
Protection Perfect
(poor!) Verifiable
Actions with secret Reconstruction Use
37
Additive secret splitDealing:
a1 … ak-1 random
ak = a - a1 - … - ak-1
ak is no better
Reconstruction: a = a1 + … + ak
Symmetric!
• Shares cannot be recognized
• Given k - 1 shares, every a is still possible
• “Real Cryptography”: Perfect Split
38
Using shared exponent
Secret is exponent a (e.g., for RSA)Shares: a = a1 + … + ak
To compute y a: Shareholder i submits xi = y ai
Compute x = x1 . … . xk
Use of secret does notcompromise splitting
39
How perfect is perfect?
Shares cannot be recognized Shareholders may cheat
Verifiable reconstruction (hash H ): Compute ai and bi = H (ai )
Give ai to SH i and make bi public
Verified reconstruction: SH i submits ai
Check H (ai ) = bi
40
Dealer verifiable split
Number hash H (a) = g a
The dealer Publish b = g a
Private share ai (sum a)
Public share bi = g ai
Send ai to SH i
Verifiable sharesThe shareholders
b binds dealer! secret is recognizable
Verify product = b Verify g ai = bi
Reconstruction Verify submissions
41
Perfect Secret Shares
Theorem: through k points runs exactly one curve of degree k - 1
Dealing: select a1 through ak-1 , a0 = a f (z) = a0 + a1.z + … + ak-1.zk-1
Share si is f (i )
Reconstruction from k points: polynomial interpolation
42
Verifiable Secret Sharing
Dealer: Private coefficients a0 through ak-1
Private shares si = f (i )
Public coefficients bi = g ai
Public shares pi = g si
Shareholderssi = a0 + a1.i + … + ak-1.i k-1 Global pi = b0 . b1
i. b2i . … . bk-1
i
Internal gsi = pi
k - 12
43
Conclusions
Numbers as basis for cryptographyMost of cryptography is unprovenResults are often counterintuitive
“Elluk voordeel hep se nadele”