Preface

My objective in writing this book was to produce a general, comprehensive textbook that treats all the essential core areas of cryptography. Although many books and monographs on cryptography have been written in recent years, the majority of them tend to address specialized areas of cryptography. On the other hand, many of the existing general textbooks have become out-of-date due to the rapid expansion of research in cryptography in the past 15 years.

I have taught a graduate level cryptography course at the University of Nebraska-Lincoln to computer science students, but I am aware that cryptography courses are offered at both the undergraduate and graduate levels in mathematics, computer science and electrical engineering departments. Thus, I tried to design the book to be flexible enough to be useful in a wide variety of approaches to the subject.

Of course there are difficulties in trying to appeal to such a wide audience. But basically, I tried to do things in moderation. I have provided a reasonable amount of mathematical background where it is needed. I have attempted to give informal descriptions of the various cryptosystems, along with more precise pseudo-code descriptions, since I feel that the two approaches reinforce each other. As well, there are many examples to illustrate the workings of the algorithms. And in every case I try to explain the mathematical underpinnings; I believe that it is impossible to really understand how a cryptosystem works without understanding the underlying mathematical theory.

The book is organized into three parts. The first part, Chapters 1-3, covers private-key cryptography. Chapters 4–9 concern the main topics in public-key cryptography. The remaining four chapters provide introductions to four active research areas in cryptography.

The first part consists of the following material: Chapter 1 is a fairly elementary introduction to simple “classical” cryptosystems. Chapter 2 covers the main elements of Shannon’s approach to cryptography, including the concept of perfect secrecy and the use of information theory in cryptography. Chapter 3 is a lengthy discussion of the Data Encryption Standard; it includes a treatment of differential cryptanalysis.

The second part contains the following material: Chapter 4 concerns the RSA Public-key Cryptosystem, together with a considerable amount of background on number-theoretic topics such as primality testing and factoring. Chapter 5 discusses some other public-key systems, the most important being the ElGamal System based on discrete logarithms. Chapter 6 deals with signature schemes, such as the Digital Signature Standard, and includes treatment of special types of signature schemes such as undeniable and fail-stop signature schemes. The subject of Chapter 7 is hash functions. Chapter 8 provides an overview of the numerous approaches to key distribution and key agreement protocols. Finally, Chapter 9 describes identification schemes.

The third part contains chapters on selected research-oriented topics, namely, authentication codes, secret sharing schemes, pseudo-random number generation, and zero-knowledge proofs.

Thus, I have attempted to be quite comprehensive in the “core” areas of cryptography, as well as to provide some more advanced chapters on specific research areas. Within any given area, however, I try to pick a few representative systems and discuss them in a reasonable amount of depth. Thus my coverage of cryptography is in no way encyclopedic.

Certainly there is much more material in this book than can be covered in one (or even two) semesters. But I hope that it should be possible to base several different types of courses on this book. An introductory course could cover Chapter 1, together with selected sections of Chapters 2–5. A second or graduate course could cover these chapters in a more complete fashion, as well as material from Chapters 6–9. Further, I think that any of the chapters would be a suitable basis for a “topics” course that might delve into specific areas more deeply.

But aside from its primary purpose as a textbook, I hope that researchers and practitioners in cryptography will find it useful in providing an introduction to specific areas with which they might not be familiar. With this in mind, I have tried to provide references to the literature for further reading on many of the topics discussed.

One of the most difficult things about writing this book was deciding how much mathematical background to include. Cryptography is a broad subject, and it requires knowledge of several areas of mathematics, including number theory, groups, rings and fields, linear algebra, probability and information theory. As well, some familiarity with computational complexity, algorithms and NP-completeness theory is useful. I have tried not to assume too much mathematical background, and thus I develop mathematical tools as they are needed, for the most part. But it would certainly be helpful for the reader to have some familiarity with basic linear algebra and modular arithmetic. On the other hand, a more specialized topic, such as the concept of entropy from information theory, is introduced from scratch.

I should also apologize to anyone who does not agree with the phrase “Theory and Practice” in the title. I admit that the book is more theory than practice. What I mean by this phrase is that I have tried to select the material to be included in the book both on the basis of theoretical interest and practical importance. So, I may include systems that are not of practical use if they are mathematically elegant or illustrate an important concept or technique. But, on the other hand, I do describe the most important systems that are used in practice, e.g., DES and other U. S. cryptographic standards.

I would like to thank the many people who provided encouragement while I wrote this book, pointed out typos and errors, and gave me useful suggestions on material to include and how various topics should be treated. In particular, I would like to convey my thanks to Mustafa Atici, Mihir Bellare, Bob Blakley, Carlo Blundo, Gilles Brassard, Daniel Ducharme, Mike Dvorsky, Luiz Frota-Mattos, David Klarner, Don Kreher, Keith Martin, Vaclav Matyas, Alfred Menezes, Luke O'Connor, William Read, Phil Rogaway, Paul Van Oorschot, Scott Vanstone, Johan van Tilburg, Marc Vauclair and Mike Wiener. Thanks also to Mike Dvorsky for helping me prepare the index.

Douglas R. Stinson

The CRC Press Series on Discrete Mathematics and Its Applications

Discrete mathematics is becoming increasingly applied to computer science, engineering, the physical sciences, the natural sciences, and the social sciences. Moreover, there has also been an explosion of research in discrete mathematics in the past two decades. Both trends have produced a need for many types of information for people who use or study this part of the mathematical sciences. The CRC Press Series on Discrete Mathematics and Its Applications is designed to meet the needs of practitioners, students, and researchers for information in discrete mathematics. The series includes handbooks and other reference books, advanced textbooks, and selected monographs. Among the areas of discrete mathematics addressed by the series are logic, set theory, number theory, combinatorics, discrete probability theory, graph theory, algebra, linear algebra, coding theory, cryptology, discrete optimization, theoretical computer science, algorithmics, and computational geometry.

Kenneth H. Rosen, Series Editor
Distinguished Member of Technical Staff
AT&T Bell Laboratories
Holmdel, New Jersey
e-mail:krosen@arch4.ho.att.com

Advisory Board

Charles Colbourn
Department of Combinatorics and Optimization, University of Waterloo
Jonathan Gross
Department of Computer Science, Columbia University
Andrew Odlyzko
AT&T Bell Laboratories


Chapter 1 1.1 Introduction: Some Simple Cryptosystems

Chapter 1
Classical Cryptography

1.1 Introduction: Some Simple Cryptosystems

The fundamental objective of cryptography is to enable two people, usually referred to as Alice and Bob, to communicate over an insecure channel in such a way that an opponent, Oscar, cannot understand what is being said. This channel could be a telephone line or computer network, for example. The information that Alice wants to send to Bob, which we call “plaintext,” can be English text, numerical data, or anything at all — its structure is completely arbitrary. Alice encrypts the plaintext, using a predetermined key, and sends the resulting ciphertext over the channel. Oscar, upon seeing the ciphertext in the channel by eavesdropping, cannot determine what the plaintext was; but Bob, who knows the encryption key, can decrypt the ciphertext and reconstruct the plaintext.

This concept is described more formally using the following mathematical notation.

DEFINITION 1.1 A cryptosystem is a five-tuple [image], where the following conditions are satisfied:

1. is a finite set of possible plaintexts
2. is a finite set of possible ciphertexts
3. , the keyspace, is a finite set of possible keys
4. For each [image], there is an encryption rule eK [image] and a corresponding decryption rule [image]. Each [image] and [image] are functions such that dK(eK(x)) = x for every plaintext

The main property is property 4. It says that if a plaintext x is encrypted using eK, and the resulting ciphertext is subsequently decrypted using dK, then the original plaintext x results.

Alice and Bob will employ the following protocol to use a specific cryptosystem. First, they choose a random key [image] This is done when they are in the same place and are not being observed by Oscar, or, alternatively, when they do have access to a secure channel, in which case they can be in different places. At a later time, suppose Alice wants to communicate a message to Bob over an insecure channel. We suppose that this message is a string

for some integer n ? 1, where each plaintext symbol [image], 1 ? i ? n. Each xi is encrypted using the encryption rule eK specified by the predetermined key K. Hence, Alice computes yi = eK(xi), 1 ? i ? n, and the resulting ciphertext string

is sent over the channel. When Bob receives y1y2 . . . yn, he decrypts it using the decryption function dK, obtaining the original plaintext string, x1x2. . .xn. See Figure 1.1 for an illustration of the communication channel.

Figure 1.1 The Communication Channel

Clearly, it must be the case that each encryption function eK is an injective function (i.e., one-to-one), otherwise, decryption could not be accomplished in an unambiguous manner. For example, if

where x1 ? x2, then Bob has no way of knowing whether y should decrypt to x1 or x2. Note that if [image], it follows that each encryption function is a permutation. That is, if the set of plaintexts and ciphertexts are identical, then each encryption function just rearranges (or permutes) the elements of this set.


1.1.1 The Shift Cipher

In this section, we will describe the Shift Cipher, which is based on modular arithmetic. But first we review some basic definitions of modular arithmetic.

DEFINITION 1.2 Suppose a and b are integers, and m is a positive integer. Then we write a ? b (mod m) if m divides b - a. The phrase a ? b (mod m) is read as “a is congruent to b modulo m.” The integer m is called the modulus.

Suppose we divide a and b by m, obtaining integer quotients and remainders, where the remainders are between 0 and m - 1. That is, a = q1m + r1 and b = q2m + r2, where 0 ? r1 ? m - 1 and 0 ? r2 ? m - 1. Then it is not difficult to see that a ? b (mod m) if and only if r1 = r2. We will use the notation a mod m (without parentheses) to denote the remainder when a is divided by m, i.e., the value r1 above. Thus a ? b (mod m) if and only if a mod m = b mod m. If we replace a by a mod m, we say that a is reduced modulo m.

REMARK Many computer programming languages define a mod m to be the remainder in the range -m + 1, . . . , m - 1 having the same sign as a. For example, -18 mod 7 would be -4, rather than 3 as we defined it above. But for our purposes, it is much more convenient to define a mod m always to be nonnegative.

We can now define arithmetic modulo m: is defined to be the set {0, . . . , m-1}, equipped with two operations, + and ?. Addition and multiplication in [image] work exactly like real addition and multiplication, except that the results are reduced modulo m.

For example, suppose we want to compute 11 ? 13 in [image]. As integers, we have 11 ? 13 = 143. To reduce 143 modulo 16, we just perform ordinary long division: 143 = 8 ? 16 + 15, so 143 mod 16 = 15, and hence 11 ? 13 = 15 in [image].

These definitions of addition and multiplication in [image] satisfy most of the familiar rules of arithmetic. We will list these properties now, without proof:

1. addition is closed, i.e., for any
2. addition is commutative, i.e., for any [image], a + b = b + a
3. addition is associative, i.e., for any [image], (a + b) + c = a + (b + c)
4. 0 is an additive identity, i.e., for any [image], a + 0 = 0 + a = a
5. the additive inverse of any [image] is m-a, i.e., a+(m-a) = (m-a)+a = 0 for any
6. multiplication is closed, i.e., for any
7. multiplication is commutative, i.e., for any [image], ab = ba

Figure 1.2 Shift Cipher

8. multiplication is associative, i.e., for any [image], (ab)c = a(bc)
9. 1 is a multiplicative identity, i.e., for any [image], a ? 1 = 1 ? a = a
10. multiplication distributes over addition, i.e., for any [image], (a+b)c = (ac) + (bc) and a(b + c) (ab) + (ac).

Properties 1, 3-5 say that [image] forms an algebraic structure called a group with respect to the addition operation. Since property 2 also holds, the group is said to be abelian.

Properties 1-10 establish that [image] is, in fact, a ring. We will see many other examples of groups and rings in this book. Some familiar examples of rings include the integers, [image]; the real numbers, [image]; and the complex numbers, [image]. However, these are all infinite rings, and our attention will be confined almost exclusively to finite rings.

Since additive inverses exist in [image], we can also subtract elements in [image]. We define a - b in [image] to be a + m - b mod m. Equivalently, we can compute the integer a - b and then reduce it modulo m.

For example, to compute 11 - 18 in [image], we can evaluate 11 + 13 mod 31 = 24. Alternatively, we can first subtract 18 from 11, obtaining -7 and then compute -7 mod 31 = 24.

We present the Shift Cipher in Figure 1.2. It is defined over [image] since there are 26 letters in the English alphabet, though it could be defined over [image] for any modulus m. It is easy to see that the Shift Cipher forms a cryptosystem as defined above, i.e., dK(eK(x)) = x for every

REMARK For the particular key K = 3, the cryptosystem is often called the Caesar Cipher, which was purportedly used by Julius Caesar.

We would use the Shift Cipher (with a modulus of 26) to encrypt ordinary English text by setting up a correspondence between alphabetic characters and residues modulo 26 as follows: A - 0, B - 1, . . . , Z - 25. Since we will be using this correspondence in several examples, let’s record it for future use:

A small example will illustrate.

Example 1.1

Suppose the key for a Shift Cipher is K = 11, and the plaintext is

                         wewillmeetatmidnight.

We first convert the plaintext to a sequence of integers using the specified correspondence, obtaining the following:

22 | 4 | 22 | 8 | 11 | 11 | 12 | 4 | 4 | 19
0 | 19 | 12 | 8 | 3 | 13 | 8 | 6 | 7 | 19

Next, we add 11 to each value, reducing each sum modulo 26:

7 | 15 | 7 | 19 | 22 | 22 | 23 | 15 | 15 | 4
11 | 4 | 23 | 19 | 14 | 24 | 19 | 17 | 18 | 4

Finally, we convert the sequence of integers to alphabetic characters, obtaining the ciphertext:

                         HPHTWWXPPELEXTOYTRSE

To decrypt the ciphertext, Bob will first convert the ciphertext to a sequence of integers, then subtract 11 from each value (reducing modulo 26), and finally convert the sequence of integers to alphabetic characters.

REMARK In the above example we are using upper case letters for ciphertext and lower case letters for plaintext, in order to improve readability. We will do this elsewhere as well.

If a cryptosystem is to be of practical use, it should satisfy certain properties. We informally enumerate two of these properties now.

1. Each encryption function eK and each decryption function dK should be efficiently computable.
2. An opponent, upon seeing a ciphertext string y, should be unable to determine the key K that was used, or the plaintext string x.

The second property is defining, in a very vague way, the idea of “security.” The process of attempting to compute the key K, given a string of ciphertext y, is called cryptanalysis. (We will make these concepts more precise as we proceed.) Note that, if Oscar can determine K, then he can decrypt y just as Bob would, using dK. Hence, determining K is at least as difficult as determining the plaintext string x.

We observe that the Shift Cipher (modulo 26) is not secure, since it can be cryptanalyzed by the obvious method of exhaustive key search. Since there are only 26 possible keys, it is easy to try every possible decryption rule dK until a “meaningful” plaintext string is obtained. This is illustrated in the following example.

Example 1.2

Given the ciphertext string

                         JBCRCLQRWCRVNBJENBWRWN,

we successively try the decryption keys d0, d1, etc. The following is obtained:

                         jbcrclqrwcrvnbjenbwrwn
                         iabqbkpqvbqumaidmavqvm
                         hzapajopuaptlzhclzupul
                         gyzozinotzoskygbkytotk
                         fxynyhmnsynrjxfajxsnsj
                         ewxmxglmrxmqiweziwrmri
                         dvwlwfklqwlphvdyhvqlqh
                         cuvkvejkpvkogucxgupkpg
                         btujudijoujnftbwftojof
                         astitchintimesavesnine

At this point, we have determined the plaintext and we can stop. The key is K = 9.

On average, a plaintext will be computed after trying 26/2 = 13 decryption rules.

Figure 1.3 Substitution Cipher

As the above example indicates, a necessary condition for a cryptosystem to be secure is that an exhaustive key search should be infeasible; i.e., the keyspace should be very large. As might be expected, a large keyspace is not sufficient to guarantee security.


1.1.2 The Substitution Cipher

Another well-known cryptosystem is the Substitution Cipher. This cryptosystem has been used for hundreds of years. Puzzle “cryptograms” in newspapers are examples of Substitution Ciphers. This cipher is defined in Figure 1.3.

Actually, in the case of the Substitution Cipher, we might as well take [image] and [image] both to be the 26-letter English alphabet. We used [image] in the Shift Cipher because encryption and decryption were algebraic operations. But in the Substitution Cipher, it is more convenient to think of encryption and decryption as permutations of alphabetic characters.

Here is an example of a “random” permutation, ?, which could comprise an encryption function. (As before, plaintext characters are written in lower case and ciphertext characters are written in upper case.)

Thus, e?(a) = X, e?(b) = N, etc. The decryption function is the inverse permutation. This is formed by writing the second lines first, and then sorting in alphabetical order. The following is obtained:

Hence, d?(A) = d, d?(B) = l, etc.

As an exercise, the reader might decrypt the following ciphertext using this decryption function:

                  MGZVYZLGHCMHJMYXSSFMNHAHYCDLMHA.

A key for the Substitution Cipher just consists of a permutation of the 26 alphabetic characters. The


1.1.3 The Affine Cipher

The Shift Cipher is a special case of the Substitution Cipher which includes only 26 of the 26! possible permutations of 26 elements. Another special case of the Substitution Cipher is the Affine Cipher, which we describe now. In the Affine Cipher, we restrict the encryption functions to functions of the form

These functions are called affine functions, hence the name Affine Cipher. (Observe that when a = 1, we have a Shift Cipher.)

In order that decryption is possible, it is necessary to ask when an affine function is injective. In other words, for any [image], we want the congruence

to have a unique solution for x. This congruence is equivalent to

Now, as y varies over [image], so, too, does y - b vary over [image]. Hence, it suffices to study the congruence ax ? y (mod 26) [image].

We claim that this congruence has a unique solution for every y if and only if gcd(a, 26) = 1 (where the gcd function denotes the greatest common divisor of its arguments). First, suppose that gcd(a, 26) = d > 1. Then the congruence ax ? 0 (mod 26) has (at least) two distinct solutions in [image], namely x = 0 and x = 26/d. In this case e(x) = ax + b mod 26 is not an injective function and hence not a valid encryption function.

For example, since gcd(4, 26) = 2, it follows that 4x + 7 is not a valid encryption function: x and x + 13 will encrypt to the same value, for any

Let’s next suppose that gcd(a, 26) = 1. Suppose for some x1 and x2 that

Then

and thus

We now make use of a property of division: if gcd(a, b) = 1 and a | bc, then a | c. Since 26| a(x1 - x2) and gcd(a, 26) = 1, we must therefore have that

i.e., x1 ? x2 (mod 26).

At this point we have shown that, if gcd(a, 26) = 1, then a congruence of the form ax ? y (mod 26) has, at most, one solution in [image]. Hence, if we let x vary over [image], then ax mod 26 takes on 26 distinct values modulo. 26. That is, it takes on every value exactly once. It follows that, for any [image], the congruence ax ? y (mod 26) has a unique solution for y.

There is nothing special about the number 26 in this argument. The following result can be proved in an analogous fashion.

THEOREM 1.1

The congruence ax ? b (mod m) has a unique solution [image] for every [image] if and only if gcd(a, m) = 1.

Since 26 = 2 ? 13, the values of [image] such that gcd(a, 26) = 1 are a = 1, 3, 5, 7, 9, 11, 15, 17, 19, 21, 23, and 25. The parameter b can be any element in [image]. Hence the Affine Cipher has 12 ? 26 = 312 possible keys. (Of course, this is much too small to be secure.)

Let’s now consider the general setting where the modulus is m. We need another definition from number theory.

DEFINITION 1.3 Suppose a ? 1 and m ? 2 are integers. If gcd(a, m) = 1, then we say that a and m are relatively prime. The number of integers in [image] that are relatively prime to m is often denoted by ?(m) (function is called the Euler phi-function).

A well-known result from number theory gives the value of ?(m) in terms of the prime power factorization of m. (An integer p > 1 is prime if it has no positive divisors other than 1 and p. Every integer m > 1 can be factored as a product of powers of primes in a unique way. For example, 60 = 22 ? 3 ? 5 and 98 = 2 ? 72.) We record the formula for ?(m) in the following theorem.

THEOREM 1.2

Suppose

where the pi?s are distinct primes and ei > 0, 1 ? i ? n. Then

It follows that the number of keys in the Affine Cipher over [image] is m?(m), where ?(m) is given by the formula above. (The number of choices for b is m, and the number of choices for a is ?(m), where the encryption function is e(x) = ax + b.) For example, when m = 60, ?(60) = 2 ? 2 ? 4 = 16 and the number of keys in the Affine Cipher is 960.

Let’s now consider the decryption operation in the Affine Cipher with modulus m = 26. Suppose that gcd(a, 26) = 1. To decrypt, we need to solve the congruence y ? ax + b (mod 26) for x. The discussion above establishes that the congruence will have a unique solution in [image], but it does not give us an efficient method of finding the solution. What we require is an efficient algorithm to do this. Fortunately, some further results on modular arithmetic will provide us with the efficient decryption algorithm we seek.

We require the idea of a multiplicative inverse.

DEFINITION 1.4 Suppose [image]. The multiplicative inverse of a is an element [image] such that aa-1 ? a-1 a ? 1 (mod m).

By similar arguments to those used above, it can be shown that a has a multiplicative inverse modulo m if and only if gcd(a, m) = 1; and if a multiplicative inverse exists, it is unique. Also, observe that if b = a-1, then a = b-1. If p is prime, then every non-zero element of [image] has a multiplicative inverse. A ring in which this is true is called a field.

In a later section, we will describe an efficient algorithm for computing multiplicative inverses in [image] for any m. However, in [image], trial and error suffices to find the multiplicative inverses of the elements relatively prime to 26: 1-1 = 1, 3-1 = 9, 5-1 = 21, 7-1 = 15, 11-1 = 19, 17-1 = 23, and 25-1 = 25. (All of these can be verified easily. For example, 7 ? 15 = 105 ? 1 mod 26, so 7-1 = 15.)

Consider our congruence y ? ax + b (mod 26). This is equivalent to

Since gcd(a, 26) = 1, a has a multiplicative inverse modulo 26. Multiplying both sides of the congruence by a-1, we obtain

Figure 1.4 Affine Cipher

By associativity of multiplication modulo 26,

Consequently, x ? a-1(y - b) (mod 26). This is an explicit formula for x, that is, the decryption function is

So, finally, the complete description of the Affine Cipher is given in Figure 1.4. Let’s do a small example.

Example 1.3

Suppose that K = (7, 3). As noted above, 7-1 mod 26 = 15. The encryption function is

and the corresponding decryption function is

where all operations are performed in [image]. It is good check to verify that dK(eK(x)) = x for all [image] Computing in [image], we get

Figure 1.5 Vigenere Cipher

To illustrate, let’s encrypt the plaintext hot. We first convert the letters h, o, t to residues modulo 26. These are respectively 7, 14, and 19. Now, we encrypt:

7 ? 7 + 3 mod 26 | = | 52 mod 26 | = 0
7 ? 14 + 3 mod 26 | = | 101 mod 26 | = 23
7 ? 19 + 3 mod 26 | = | 136 mod 26 | = 6.

So the three ciphertext characters are 0, 23, and 6, which corresponds to the alphabetic string AXG. We leave the decryption as an exercise for the reader


1.1.4 The Vigenere Cipher

In both the Shift Cipher and the Substitution Cipher, once a key is chosen, each alphabetic character is mapped to a unique alphabetic character. For this reason, these cryptosystems are called monoalphabetic. We now present in Figure 1.5 a cryptosystem which is not monoalphabetic, the well-known Vigenere Cipher. This cipher is named after Blaise de Vigenere, who lived in the sixteenth century.

Using the correspondence A - 0, B - 1, . . ., Z - 25 described earlier, we can associate each key K with an alphabetic string of length m, called a keyword. The Vigenere Cipher encrypts m alphabetic characters at a time: each plaintext element is equivalent to m alphabetic characters.

Let’s do a small example.

Example 1.4

Suppose m = 6 and the keyword is CIPHER. This corresponds to the numerical equivalent K = (2, 8, 15, 7, 4, 17). Suppose the plaintext is the string

                     thiscryptosystemisnotsecure.

We convert the plaintext elements to residues modulo 26, write them in groups of six, and then “add” the keyword modulo 26, as follows:

In this section, we describe The alphabetic equivalent of the ciphertext string would thus be:

VPXZGIAXIVWPUBTTMJPWIZITWZT.

To decrypt, we can use the same keyword, but we would subtract it modulo 26 instead of adding.

Observe that the number of possible keywords of length m in a Vigenere Cipher is 26m, so even for relatively small values of m, an exhaustive key search would require a long time. For example, if we take m = 5, then the keyspace has size exceeding 1.1 ? 107. This is already large enough to preclude exhaustive key search by hand (but not by computer).

In a Vigenere Cipher having keyword length m, an alphabetic character can be mapped to one of m possible alphabetic characters (assuming that the keyword contains m distinct characters). Such a cryptosystem is called polyalphabetic. In general, cryptanalysis is more difficult for polyalphabetic than for monoalphabetic cryptosystems.


1.1.5 The Hill Cipher

In this section, we describe another polyalphabetic cryptosystem called the Hill Cipher. This cipher was invented in 1929 by Lester S. Hill. Let m be a positive integer, and define [image]. The idea is to take m linear combinations of the m alphabetic characters in one plaintext element, thus producing the m alphabetic characters in one ciphertext element.

For example, if m = 2, we could write a plaintext element as x = (x2, x2) and a ciphertext element as y = (y1, y2). Here, y1 would be a linear combination of x1 and x2, as would y2. We might take

Of course, this can be written more succinctly in matrix notation as follows:

In general, we will take an m ? m matrix K as our key. If the entry in row i and column j of K is ki,j, then we write K = (ki,j). For x = (x1, . . . , xm) [image] and [image], we compute y = eK(x) = (y1, . . . , ym) as follows:

In other words, y = xK.

We say that the ciphertext is obtained from the plaintext by means of a linear transformation. We have to consider how decryption will work, that is, how x can be computed from y. Readers familiar with linear algebra will realize that we use the inverse matrix K-1 to decrypt. The ciphertext is decrypted using the formula x = yK-1.

Here are the definitions of necessary concepts from linear algabra. If A = (ai,j) is an [image] matrix and B = (bj,k) is an m ? n matrix, then we define the matrix product AB = (ci,k) by the formula

for [image] and 1 ? k ? n. That is, the entry in row i and column k of AB is formed by taking the ith row of A and the kth column of B, multiplying corresponding entries together, and summing. Note that AB is an [image] matrix.

This definition of matrix multiplication is associative (that is, (AB)C = A(BC) but not, in general, commutative (it is not always the case that AB = BA, even for square matrices A and B).

The m ? m identity matrix, denoted by Im, is the m ? m matrix with 1?s on the main diagonal and 0?s elsewhere. Thus, the 2 ? 2 identity matrix is

Im is termed an identity matrix since AIm = A for any [image] matrix A and ImB = B for any m ? n matrix B. Now, the inverse matrix to an m ? m matrix A (if it exists) is the matrix A-1 such that AA-1 = A-1 A = Im. Not all matrices have inverses, but if an inverse exists, it is unique.

With these facts at hand, it is easy to derive the decryption formula given above: since y = xK, we can multiply both sides of the formula by K-1, obtaining

(Note the use of the associativity property.)

We can verify that the encryption matrix above has an inverse in

since

Remember that all arithmetic operations are done modulo 26.)

Let’s now do an example to illustrate encryption and decryption in the Hill Cipher.

Example 1.5

Suppose the key is

From the computations above, we have that

Suppose we want to encrypt the plaintext july. We have two elements of plaintext to encrypt: (9, 20) (corresponding to ju) and (11, 24) (corresponding to ly). We compute as follows:

and

Hence, the encryption of july is DELW. To decrypt, Bob would compute:

and

Hence, the correct plaintext is obtained.

At this point, we have shown that decryption is possible if K has an inverse. In fact, for decryption to be possible, it is necessary that K has an inverse. (This follows fairly easily from elementary linear algebra, but we will not give a proof here.) So we are interested precisely in those matrices K that are invertible.

The invertibility of a (square) matrix depends on the value of its determinant. To avoid unnecessary generality, we will confine our attention to the 2 ? 2 case.

DEFINITION 1.5 The determinant of the 2 ? 2 matrix A = (ai,j) is the value

REMARK The determinant of an m ? m square matrix can be computed by elementary row operations: see any text on linear algebra.

Two important properties of determinants are that det Im = 1; and the multiplication rule det(AB) = det A ? det B.

A real matrix K has an inverse if and only if its determinant is non-zero. However, it is important to remember that we are working over [image]. The relevant result for our purposes is that a matrix K has an inverse modulo 26 if and only if gcd (det K, 26) = 1.

We briefly sketch the proof of this fact. First suppose that gcd(det K, 26) = 1. Then det K has an inverse in [image] Now, for ? i ? m, 1 ? j ? m, define Kij to be the matrix obtained from K by deleting the ith row and the jth column. Define a matrix K* to have as its (i, j)-entry the value (-1)i+j det Kji. (K* is called the adjoint matrix of K.) Then it can be shown that

Hence, K is invertible.

Conversely, suppose K has an inverse, K-1. By the multiplication rule for determinants, we have

Hence, det K is invertible in

REMARK The above formula for K-1 is not very efficient computationally, except for small values of m (say m = 2, 3). For larger m, the preferred method of computing inverse matrices would involve elementary row operations.

In the 2 ? 2 case, we have the following formula:

THEOREM 1.3

Suppose A = (ai,j) is a 2 ? 2 matrix over [image] such that det A = a1,1a2,2 - a1,2a2,1 is invertible. Then

Let’s look again at the example considered earlier. First, we have

Now, 1-1 mod 26 = 1, so the inverse matrix is

as we verified earlier.

We now give a precise description of the Hill Cipher over [image] in Figure 1.6.


1.1.6 The Permutation Cipher

All of the cryptosystems we have discussed so far involve substitution: plaintext characters are replaced by different ciphertext characters. The idea of a permutation cipher is to keep the plaintext characters unchanged, but to alter their positions by rearranging them. The Permutation Cipher (also known as the Transposition Cipher) has been in use for hundreds of years. In fact, the distinction between the Permutation Cipher and the Substitution Cipher was pointed out as early as 1563 by Giovanni Porta. A formal definition is given in Figure 1.7.

As with the Substitution Cipher, it is more convenient to use alphabetic characters as opposed to residues modulo 26, since there are no algebraic operations being performed in encryption or decryption.

Here is an example to illustrate:

Figure 1.6 Hill Cipher

Figure 1.7 Permutation Cipher

Example 1.6

Suppose m = 6 and the key is the following permutation ?:

Then the inverse permutation ?-1 is the following:

Now, suppose we are given the plaintext

                      shesellsseashellsbytheseashore.

We first group the plaintext into groups of six letters:

                 shesel | lsseas | hellsb | ythese | ashore

Now each group of six letters is rearranged according to the permutation ?, yielding the following:

                 EESLSH | SALSES | LSHBLE | HSYEET | HRAEOS

So, the ciphertext is:

                       EESLSHSALSESLSHBLEHSYEETHRAEOS.

The ciphertext can be decrypted in a similar fashion, using the inverse permutation ?-1.

In fact, the Permutation Cipher is a special case of the Hill Cipher. Given a permutation of ? of the set {1, . . . , m}, we can define an associated m ? m permutation matrix K? = (ki,j) according to the formula

(A permutation matrix is a matrix in which every row and column contains exactly one “1,” and all other values are “0.” A permutation matrix can be obtained from an identity matrix by permuting rows or columns.)

It is not difficult to see that Hill encryption using the matrix K? is, in fact, equivalent to permutation encryption using the permutation ?. Moreover, [image], i.e., the inverse matrix to K? is the permutation matrix defined by the permutation ?-1. Thus, Hill decryption is equivalent to permutation decryption.

For the permutation ? used in the example above, the associated permutation matrices are

and

The reader can verify that the product of these two matrices is the identity.


1.1.7 Stream Ciphers

In the cryptosystems we have studied to this point, successive plaintext elements are encrypted using the same key, K. That is, the ciphertext string y is obtained as follows:

Cryptosystems of this type are often called block ciphers.

An alternative approach is to use what are called stream ciphers. The basic idea is to generate a keystream z = z1z2 . . . , and use it to encrypt a plaintext string x = x1x2 . . . according to the rule

A stream cipher operates as follows. Suppose [image] is the key and x1x2 . . . is the plaintext string. The function fi is used to generate zi (the ith element of the keystream), where fi is a function of the key, K, and the first i - 1 plaintext characters:

The keystream element zi is used to encrypt xi, yielding [image]. So, to encrypt the plaintext string x1x2, . . . , we would successively compute

Decrypting the ciphertext string y1y2 . . . can be accomplished by successively computing

Here is a formal mathematical definition:

DEFINITION 1.6 A Stream Cipher is a tuple [image], where the following conditions are satisfied:

1. is a finite set of possible plaintexts
2. is a finite set of possible ciphertexts
3. , the keyspace, is a finite set of possible keys
4. is a finite set called the keystream alphabet
5. is the keystream generator. For i ? 1,

6. For each [image], there is an encryption rule [image] and a corresponding decryption rule [image] and [image] are functions such that dz(ez(x)) = x for every plaintext [image].

We can think of a block cipher as a special case of a stream cipher where the keystream is constant: zi = K for all i ? 1.

Here are some special types of stream ciphers together with illustrative examples. A stream cipher is synchronous if the keystream is independent of the plaintext string, that is, if the keystream is generated as a function only of the key K. In this situation, we think of K as a “seed” that is expanded into a keystream z1z2 . . ..

A stream cipher is periodic with period d if Zi+d = zi for all integers i ? 1. The Vigenere Cipher with keyword length m can be thought of as a periodic stream cipher with period m. In this case, the key is K = (k1, . . . , km). K itself provides the first m elements of the keystream: zi = ki, 1 ? i ? m. Then the keystream just repeats itself from that point on. Observe that in this stream cipher setting for the Vigenere Cipher, the encryption and decryption functions are identical to those used in the Shift Cipher: ez(x) = x + z and dz (y) = y - z.

Stream ciphers are often described in terms of binary alphabets, i.e., [image]. In this situation, the encryption and decryption operation are just addition modulo 2:

and

If we think of “0” as representing the boolean value “false” and “1” as representing “true,” then addition modulo 2 corresponds to the exclusive-or operation. Hence, encryption (and decryption) can be implemented very efficiently in hardware.

Let’s look at another method of generating a (synchronous) keystream. Suppose we start with (k1, . . . , km) and let zi = ki, 1 ? i ? m (as before), but we now generate the keystream using a linear recurrence relation of degree m:

where c0, . . . , [image] are predetermined constants.

REMARK This recurrence is said to have degree m since each term depends on the previous m terms. It is linear because zi+m is a linear function of previous terms. Note that we can take c0 = 1 without loss of generality, for otherwise the recurrence will be of degree m - 1.

Here, the key K consists of the 2m values k1, . . . , km, c0, . . . , cm-1. If

then the keystream consists entirely of 0’s. Of course, this should be avoided, as the ciphertext will then be identical to the plaintext. However, if the constants c0, . . . , cm-1 are chosen in a suitable way, then any other initialization vector (k1, . . . , km) will give rise to a periodic keystream having period 2m - 1. So a “short” key can give rise to a keystream having a very long period. This is certainly a desirable property: we will see in a later section how the Vigenere Cipher can be cryptanalyzed by exploiting the fact that the keystream has short period.

Here is an example to illustrate.

Example 1.7

Suppose m = 4 and the keystream is generated using the rule

(i ? 1). If the keystream is initialized with any vector other than (0, 0, 0, 0), then we obtain a keystream of period 15. For example, starting with (1, 0, 0, 0), the keystream is

Any other non-zero initialization vector will give rise to a cyclic permutation of the same keystream.

Another appealing aspect of this method of keystream generation is that the keystream can be produced efficiently in hardware using a linear feedback shift register, or LFSR. We would use a shift register with m stages. The vector (k1, . . . , km) would be used to initialize the shift register. At each time unit, the following operations would be performed concurrently:

1. k1 would be tapped as the next keystream bit
2. k2, . . . , km would each be shifted one stage to the left
3. the “new” value of km would be computed to be

(this is the “linear feedback”).

Figure 1.8 A Linear Feedback Shift Register

Figure 1.9 Autokey Cipher

Observe that the linear feedback is carried out by tapping certain stages of the register (as specified by the constants cj having the value “1”) and computing a sum modulo 2 (which is an exclusive-or). This is illustrated in Figure 1.8, where we depict the LFSR that will generate the keystream of Example 1.7.

An example of a non-synchronous stream cipher that is known as the Autokey Cipher is given in Figure 1.9. It is apparently due to Vigenere.

The reason for the terminology “autokey” is that the plaintext is used as the key (aside from the initial “priming key” K). Here is an example to illustrate:

Example 1.8

Suppose the key is K = 8, and the plaintext is

                             rendezvous.

We first convert the plaintext to a sequence of integers:

17 4 13 3 4 25 21 14 20 18

The keystream is as follows:

8 17 4 13 3 4 25 21 14 20

Now we add corresponding elements, reducing modulo 26:

25 21 17 16 7 3 20 9 8 12

In alphabetic form, the ciphertext is:

                            ZVRQHDUJIM.

Now let’s look at how Alice decrypts the ciphertext. She will first convert the alphabetic string to the numeric string

25 21 17 16 7 3 20 9 8 12

Then she can compute

Next,

and so on. Each time she obtains another plaintext character, she also uses it as the next keystream element.

Of course, the Autokey Cipher is insecure since there are only 26 possible keys.

In the next section, we discuss methods that can be used to cryptanalyze the various cryptosystems we have presented.


1.2 Cryptanalysis

In this section, we discuss some techniques of cryptanalysis. The general assumption that is usually made is that the opponent, Oscar, knows the cryptosystem being used. This is usually referred to as Kerckhoff’s principle. Of course, if Oscar does not know the cryptosystem being used, that will make his task more difficult. But we do not want to base the security of a cryptosystem on the (possibly shaky) premise that Oscar does not know what system is being employed. Hence, our goal in designing a cryptosystem will be to obtain security under Kerckhoff’s principle.

First, we want to differentiate between different levels of attacks on cryptosystems. The most common types are enumerated as follows.

Ciphertext-only

The opponent possesses a string of ciphertext, y.

Known plaintext

The opponent possesses a string of plaintext, x, and the corresponding ciphertext, y.

Chosen plaintext

The opponent has obtained temporary access to the encryption machinery.
Hence he can choose a plaintext string, x, and construct the corresponding ciphertext string, y.

Chosen ciphertext

The opponent has obtained temporary access to the decryption machinery. Hence he can choose a ciphertext string, y, and construct the corresponding plaintext string, x.

In each case, the object is to determine the key that was used. We note that a chosen ciphertext attack is relevant to public-key cryptosystems, which we discuss in the later chapters.

We first consider the weakest type of attack, namely a ciphertext-only attack. We also assume that the plaintext string is ordinary English text, without punctuation or “spaces.” (This makes cryptanalysis more difficult than if punctuation and spaces were encrypted.)

Many techniques of cryptanalysis use statistical properties of the English language. Various people have estimated the relative frequencies of the 26 letters by compiling statistics from numerous novels, magazines, and newspapers. The estimates in Table 1.1 were obtained by Beker and Piper.

On the basis of the above probabilities, Beker and Piper partition the 26 letters into five groups as follows:

1. E, having probability about 0.120
2. T, A, O, I, N, S, H, R, each having probabilities between 0.06 and 0.09
3. D, L, each having probabilities around 0.04
4. C, U, M, W, F, G, Y, P, B, each having probabilities between 0.015 and 0.028
5. V, K, J, X, Q, Z, each having probabilities less than 0.01.

It may also be useful to consider sequences of two or three consecutive letters called digrams and trigrams, respectively. The 30 most common digrams are (in decreasing order) TH, HE, IN, ER, AN, RE, ED, ON, ES, ST, EN, AT, TO, NT, HA, ND, OU, EA, NG, AS, OR, TI, IS, ET, IT, AR, TE, SE, HI, and OF. The twelve most common trigrams are (in decreasing order) THE ING, AND, HER, ERE, ENT, THA, NTH, WAS, ETH, FOR, and DTH.

Table 1.1 Probabilities of Occurrence of the 26 Letters
letter | probability | letter | probability
A | .082 | N | .067
B | .015 | O | .075
C | .028 | P | .019
D | .043 | Q | .001
E | .127 | R | .060
F | .022 | S | .063
G | .020 | T | .091
H | .061 | U | .028
I | .070 | V | .010
J | .002 | W | .023
K | .008 | X | .001
L | .040 | Y | .020
M | .024 | Z | .001


1.2.1 Cryptanalysis of the Affine Cipher

As a simple illustration of how cryptanalysis can be performed using statistical data, let’s look first at the Affine Cipher. Suppose Oscar has intercepted the following ciphertext:

Example 1.9

Ciphertext obtained from an Affine Cipher

         FMXVEDKAPHFERBNDKRXRSREFMORUDSDKDVSHVUFEDK
         APRKDLYEVLRHHRH

The frequency analysis of this ciphertext is given in Table 1.2.

There are only 57 characters of ciphertext, but this is sufficient to cryptanalyze an Affine Cipher. The most frequent ciphertext characters are: R (8 occurrences), D (7 occurrences), E, H, K (5 occurrences each), and F, S, V (4 occurrences each). As a first guess, we might hypothesize that R is the encryption of e and D is the encryption of t, since e and t are (respectively) the two most common letters. Expressed numerically, we have eK(4) = 17 and eK(19) = 3. Recall that eK(x) = ax + b, where a and b are unknowns. So we get two linear equations in two unknowns:

Table 1.2 Frequency of Occurrence of the 26 Ciphertext Letters
letter | frequency | letter | frequency
A | 2 | N | 1
B | 1 | O | 1
C | 0 | P | 2
D | 7 | Q | 0
E | 5 | R | 8
F | 4 | S | 3
G | 0 | T | 0
H | 5 | U | 2
I | 0 | V | 4
J | 0 | W | 0
K | 5 | X | 2
L | 2 | Y | 1
M | 2 | Z | 0

This system has the unique solution a = 6, b = 19 (in [image]). But this is an illegal key, since gcd(a, 26) = 2 > 1. So our hypothesis must be incorrect.

Our next guess might be that R is the encryption of e and E is the encryption of t. Proceeding as above, we obtain a = 13, which is again illegal. So we try the next possibility, that R is the encryption of e and H is the encryption of t. This yields a = 8, again impossible. Continuing, we suppose that R is the encryption of e and K is the encryption of t. This produces a = 3, b = 5, which is at least a legal key. It remains to compute the decryption function corresponding to K = (3, 5), and then to decrypt the ciphertext to see if we get a meaningful string of English, or nonsense. This will confirm the validity of (3, 5).

If we perform these operations, we have dK(y) = 9y - 19 and the given ciphertext decrypts to yield:

           algorithmsarequitegeneraldefinitionsofarit
           hmeticprocesses

We conclude that we have determined the correct key.


1.2.2 Cryptanalysis of the Substitution Cipher

Here, we look at the more complicated situation, the Substitution Cipher. Consider the following ciphertext:

Table 1.3 Frequency of Occurrence of the 26 Ciphertext Letters
letter | frequency | letter | frequency
A | 0 | N | 9
B | 1 | O | 0
C | 15 | P | 1
D | 13 | Q | 4
E | 7 | R | 10
F | 11 | S | 3
G | 1 | T | 2
H | 4 | U | 5
I | 5 | V | 5
J | 11 | W | 8
K | 1 | X | 6
L | 0 | Y | 10
M | 16 | Z | 20

Example 1.10

Ciphertext obtained from a Substitution Cipher

           YIFQFMZRWQFYVECFMDZPCVMRZWNMDZVEJBTXCDDUMJ
           NDIFEFMDZCDMQZKCEYFCJMYRNCWJCSZREXCHZUNMXZ
           NZUCDRJXYYSMRTMEYIFZWDYVZVYFZUMRZCRWNZDZJJ
           XZWGCHSMRNMDHNCMFQCHZJMXJZWIEJYUCFWDJNZDIR

The frequency analysis of this ciphertext is given in Table 1.3.

Since Z occurs significantly more often than any other ciphertext character, we might conjecture that dK(Z) = e. The remaining ciphertext characters that occur at least ten times (each) are C, D, F, J, M, R, Y. We might expect that these letters are encryptions of (a subset of) t, a, o, i, n, s, h, r, but the frequencies really do not vary enough to tell us what the correspondence might be.

At this stage we might look at digrams, especially those of the form -Z or Z-since we conjecture that Z decrypts to e. We find that the most common digrams of this type are DZ and ZW (four times each); NZ and ZU (three times each); and RZ, HZ, YZ, FZ, ZR, ZV, ZC, ZD, and ZJ (twice each). Since ZW occurs four times and WZ not at all, and W occurs less often than many other characters, we might guess that dK(W) = d. Since DZ occurs four times and ZD occurs twice, we would think that DK(D) ? {r, s, t}, but it is not clear which of the three possibilities is the correct one.

If we proceed on the assumption that dK(Z) = e and dK(W) = d, we might look back at the ciphertext and notice that we have ZRW and RZW both occurring near the beginning of the ciphertext, and RW occurs again later on. Since R occurs frequently in the ciphertext and nd is a common digram, we might try dK(R) = n as the most likely possibility.

At this point, we have the following:

              ------end---------e----ned---e------------
              YIFQFMZRWQFYVECFMDZPCVMRZWNMDZVEJBTXCDDUMJ

              --------e----e---------n--d---en----e----e
              NDIFEFMDZCDMQZKCEYFCJMYRNCWJCSZREXCHZUNMXZ

              -e---n------n------ed---e---e--ne-nd-e-e--
              NZUCDRJXYYSMRTMEYIFZWDYVZVYFZUMRZCRWNZDZJJ

              -ed-----n-----------e----ed-------d---e--n
              XZWGCHSMRNMDHNCMFQCHZJMXJZWIEJYUCFWDJNZDIR

Our next step might be to try dK(N) = h, since NZ is a common digram and ZN is not. If this is correct, then the segment of plaintext ne - ndhe suggests that dK(C) = a. Incorporating these guesses, we have:

              ------end-----a---e-a--nedh--e------a-----
              YIFQFMZRWQFYVECFMDZPCVMRZWNMDZVEJBTXCDDUMJ

              h-------ea---e-a---a---nhad-a-en--a-e-h--e
              NDIFEFMDZCDMQZKCEYFCJMYRNCWJCSZREXCHZUNMXZ

              he-a-n------n------ed---e---e--neandhe-e--
              NZUCDRJXYYSMRTMEYIFZWDYVZVYFZUMRZCRWNZDZJJ

              -ed-a---nh---ha---a-e----ed-----a-d--he--n
              XZWGCHSMRNMDHNCMFQCHZJMXJZWIEJYUCFWDJNZDIR

Now, we might consider M, the second most common ciphertext character. The ciphertext segment RNM, which we believe decrypts to nh-, suggests that h- begins a word, so M probably represents a vowel. We have already accounted for a and e, so we expect that dK(M) = i or o. Since ai is a much more likely digram than ao, the ciphertext digram CM suggests that we try dK(M) = i first. Then we have:

              -----iend-----a-i-e-a-inedhi-e------a---i-
              YIFQFMZRWQFYVECFMDZPCVMRZWNMDZVEJBTXCDDUMJ

              h-----i-ea-i-e-a---a-i-nhad-a-en--a-e-hi-e
              NDIFEFMDZCDMQZKCEYFCJMYRNCWJCSZREXCHZUNMXZ

              he-a-n-----in-i----ed---e---e-ineandhe-e--
              NZUCDRJXYYSMRTMEYIFZWDYVZVYFZUMRZCRWNZDZJJ

              -ed-a--inhi--hai--a-e-i--ed-----a-d--he--n
              XZWGCHSMRNMDHNCMFQCHZJMXJZWIEJYUCFWDJNZDIR

Next, we might try to determine which letter is encrypted to o. Since o is a common letter, we guess that the corresponding ciphertext letter is one of D, F, J, Y. Y seem to be the most likely possibility, otherwise, we would get long strings of vowels, namely aoi from CFM or CJM. Hence, let’s suppose dE(Y) = o.

The three most frequent remaining ciphertext letters are D, F, J, which we conjecture could decrypt to r, s, t in some order. Two occurrences of the trigram NMD suggest that dE(D) = s, giving the trigram his in the plaintext (this is consistent with our earlier hypothesis that dE(D) ? {r, s, t}). The segment HNCMF could be an encryption of chair, which would give dE(F) = r (and dE(H) = c) and so we would then have dE(J) = t by process of elimination. Now, we have:

              o-r-riend-ro--arise-a-inedhise--t---ass-it
              YIFQFMZRWQFYVECFMDZPCVMRZWNMDZVEJBTXCDDUMJ

              hs-r-riseasi-e-a-orationhadta-en--ace-hi-e
              NDIFEFMDZCDMQZKCEYFCJMYRNCWJCSZREXCHZUNMXZ

              he-asnt-oo-in-i-o-redso-e-ore-ineandhesett
              NZUCDRJXYYSMRTMEYIFZWDYVZVYFZUMRZCRWNZDZJJ

              -ed-ac-inhischair-aceti-ted--to-ardsthes-n
              XZWGCHSMRNMDHNCMFQCHZJMXJZWIEJYUCFWDJNZDIR

It is now very easy to determine the plaintext and the key for Example 1.10. The complete decryption is the following:

Our friend from Paris examined his empty glass with surprise, as if evaporation had taken place while he wasn’t looking. I poured some more wine and he settled back in his chair, face tilted up towards the sun.1

1P. Mayle, A Year in Provence. A. Knopf, Inc., 1989.


1.2.3 Cryptanalysis of the Vigenere Cipher

In this section we describe some methods for cryptanalyzing the Vigenere Cipher. The first step is to determine the keyword length, which we denote by m. There are a couple of techniques that can be employed. The first of these is the so-called Kasiski test and the second uses the index of coincidence.

The Kasiski test was first described by Friedrich Kasiski in 1863. It is based on the observation that two identical segments of plaintext will be encrypted to the same ciphertext whenever their occurrence in the plaintext is x positions apart, where x ? 0 mod m. Conversely, if we observe two identical segments of ciphertext, each of length at least three, say, then there is a good chance that they do correspond to identical segments of plaintext.

The Kasiski test works as follows. We search the ciphertext for pairs of identical segments of length at least three, and record the distance between the starting positions of the two segments. If we obtain several such distances d1, d2, . . . , then we would conjecture that m divides the greatest common divisor of the di?s.

Further evidence for the value of m can be obtained by the index of coincidence. This concept was defined by Wolfe Friedman in 1920, as follows.

DEFINITION 1.7 Suppose x = x1x2 . . . xn is a string of n alphabetic characters. The index of coincidence of x, denoted Ic(x), is defined to be the probability that two random elements of x are identical. Suppose we denote the frequencies of A, B, C, . . . , Z in x by f0, f1, . . . , f25 (respectively). We can choose two elements of x in [image] ways.2 For each i, 0 ? i ? 25, there are [image] ways of choosing both elements to be i. Hence, we have the formula

2The binomial coefficient [image] = n!/(k!(n - k)!) denotes the number of ways of choosing a subset of k objects from a set of n objects.

Now, suppose x is a string of English language text. Denote the expected probabilities of occurrence of the letters A, B, . . . , Z in Table 1.1 by p0, . . . , p25.

Then, we would expect that

since the probability that two random elements both are A is p02, the probability that both are B is p12, etc. The same reasoning applies if x is a ciphertext obtained by means of any monoalphabetic cipher. In this case, the individual probabilities will be permuted, but the quantity

will be unchanged.

Now, suppose we start with a ciphertext y = y1y2 . . . yn that has been constructed by using a Vigenere Cipher. Define m substrings y1, y2, . . . , y m of y by writing out the ciphertext, by columns, in a rectangular array of dimensions m ? (n/m). The rows of this matrix are the substrings y i, 1 ? i ? m. If this is done, and m is indeed the keyword length, then each Ic(y i) should be roughly equal to 0.065. On the other hand, if m is not the keyword length, then the substrings y i will look much more random, since they will have been obtained by shift encryption with different keys. Observe that a completely random string will have

The two values 0.065 and 0.038 are sufficiently far apart that we will often be able to determine the correct keyword length (or confirm a guess that has already been made using the Kasiski test).

Let us illustrate these two techniques with an example.

Example 1.11

Ciphertext obtained from a Vigenere Cipher

              CHREEVOAHMAERATBIAXXWTNXBEEOPHBSBQMQEQERBW
              RVXUOAKXAOSXXWEAHBWGJMMQMNKGRFVGXWTRZXWIAK
              LXFPSKAUTEMNDCMGTSXMXBTUIADNGMGPSRELXNJELX
              VRVPRTULHDNQWTWDTYGBPHXTFALJHASVBFXNGLLCHR
              ZBWELEKMSJIKNBHWRJGNMGJSGLXFEYPHAGNRBIEQJT
              AMRVLCRREMNDGLXRRIMGNSNRWCHRQHAEYEVTAQEBBI
              PEEWEVKAKOEWADREMXMTBHHCHRTKDNVRZCHRCLQOHP
              WQAIIWXNRMGWOIIFKEE

First, let’s try the Kasiski test. The ciphertext string CHR occurs in five places in the ciphertext, beginning at positions 1, 166, 236, 276 and 286. The distances from the first occurrence to the other three occurrences are (respectively) 165, 235, 275 and 285. The gcd of these four integers is 5, so that is very likely the keyword length.

Let’s see if computation of indices of coincidence gives the same conclusion. With m = 1, the index of coincidence is 0.045. With m = 2, the two indices are 0.046 and 0.041. With m = 3, we get 0.043, 0.050, 0.047. With m = 4, we have indices 0.042, 0.039, 0.046, 0.040. Then trying m = 5, we obtain the values 0.063, 0.068, 0.069, 0.061 and 0.072. This also provides strong evidence that the keyword length is five.

Proceeding under this assumption, how do we determine the keyword? It is useful to consider the mutual index of coincidence of two strings.

DEFINITION 1.8 Suppose x = x1x2 . . . xn? and y = y1y2 . . . yn? are strings of n and n? alphabetic characters, respectively. The mutual index of coincidence of x and y, denoted MIc(x, y), is defined to be the probability that a random element of x is identical to a random element of y. If we denote the frequencies of A, B, C, . . . , Z in x and y by f0, f1, f25 and f?0, . . . , f?1, . . . , f?25, respectively, then MIc(x, y) is seen to be

Now, given that we have determined the value of m, the substrings y i are obtained by shift encryption of the plaintext. Suppose K = (k1, k2, . . . , km) is the keyword. Let us see if we can estimate MIc(yi, yj). Consider a random character in yi and a random character in yj. The probability that both characters are A is [image], the probability that both are B is [image], etc. (Note that all subscripts are reduced modulo 26.) Hence, we estimate that

Observe that the value of this estimate depends only on the difference ki - kj mod 26, which we call the relative shift of y i and yj. Also, notice that

so a relative shift of [image] yields the same estimate of MIc as does a relative shift of 26 - [image].

We tabulate these estimates, for relative shifts ranging between 0 to 13, in Table 1.4.

Table 1.4 Expected Mutual Indices of Coincidence
relative shift | expected value of MIc
0 | 0.065
1 | 0.039
2 | 0.032
3 | 0.034
4 | 0.044
5 | 0.033
6 | 0.036
7 | 0.039
8 | 0.034
9 | 0.034
10 | 0.038
11 | 0.045
12 | 0.039
13 | 0.043

The important observation is that, if the relative shift is not zero, these estimates vary between 0.031 and 0.045; whereas, a relative shift of zero yields an estimate of 0.065. We can use this observation to formulate a likely guess for [image], the relative shift of y i and y j, as follows. Suppose we fix y i, and consider the effect of encrypting y j by e0, e1, e2, . . .. Denote the resulting strings by [image], etc. It is easy to compute the indices [image], 0 ? g ? 25. This can be done using the formula

When g = [image], the MIc should be close to 0.065, since the relative shift of yi and [image] is zero. However, for values of g ? , the MIc should vary between 0.031 and 0.045.

By using this technique, we can obtain the relative shifts of any two of the substrings yi. This leaves only 26 possible keywords, which can easily be obtained by exhaustive key search, for example.

Let us illustrate by returning to Example 1.11.

Example 1.11 (Cont.)

We have hypothesized that the keyword length is 5. We now try to compute the relative shifts. By computer, it is not difficult to compute the 260 values [image], where 1 ? i ? j ? 5, 0 ? g 25. These values are tabulated in Table 1.5. For each (i, j) pair, we look for values [image] that are close to 0.065. If there is a unique such value (for a given (i, j) pair), we conjecture that

Table 1.5 Observed Mutual Indices of Coincidence

it is the value of the relative shift.

Six such values in Table 1.5 are boxed. They provide strong evidence that the relative shift of y1 and y2 is 9; the relative shift of y1 and y5 is 16; the relative shift of y2 and y3 is 13; the relative shift of y2 and y5 is 7; the relative shift of y3 and y5 is 20; and the relative shift of y4 and y5 is 11. This gives us the following equations in the five unknowns k1, k2, k3, k4, k5:

This allows us to express the five ki?s in terms of k1:

So the key is likely to be (k1, k1 + 17, k1 + 4, k1 + 21, k1 + 10) for some [image] Hence, we suspect that the keyword is some cyclic shift of AREVK. It now does not take long to determine that the keyword is JANET. The complete decryption is the following:

The almond tree was in tentative blossom. The days were longer, often ending with magnificent evenings of corrugated pink skies. The hunting season was over, with hounds and guns put away for six months. The vineyards were busy again as the well-organized farmers treated their vines and the more lackadaisical neighbors hurried to do the pruning they should have done in November.3

3P. Mayle, A Year in Provence, A. Knopf, Inc., 1989.


1.2.4 A Known Plaintext Attack on the Hill Cipher

The Hill Cipher is more difficult to break with a ciphertext-only attack, but it succumbs easily to a known plaintext attack. Let us first assume that the opponent has determined the value of m being used. Suppose he has at least m distinct pairs of m-tuples, xj = (x1,j, x2,j, . . . , xm,j) and yj = (y1,j, y2,j, . . . , ym,j) (1 ? j ? m), such that yj = eK(xj), 1 ? j ? m. If we define two m ? m matrices X = (xi,j) and Y = (yi,j), then we have the matrix equation Y = XK, where the m ? m matrix K is the unknown key. Provided that the matrix X is invertible, Oscar can compute K = X-1Y and thereby break the system. (If Y is not invertible, then it will be necessary to try other sets of m plaintext-ciphertext pairs.)

Let’s look at a simple example.

Example 1.12

Suppose the plaintext friday is encrypted using a Hill Cipher with m = 2, to give the ciphertext PQCFKU.

We have that eK (5, 17) = (15, 16), eK (8, 3) = (2, 5) and eK (0, 24) = (10, 20). From the first two plaintext-ciphertext pairs, we get the matrix equation

Using Theorem 1.3, it is easy to compute

so

This can be verified by using the third plaintext-ciphertext pair.

What would the opponent do if he does not know m? Assuming that m is not too big, he could simply try m = 2, 3, . . . , until the key is found. If a guessed value of m is incorrect, then an m ? m matrix found by using the algorithm described above will not agree with further plaintext-ciphertext pairs. In this way, the value of m can be determined if it is not already known.


1.2.5 Cryptanalysis of the LFSR-based Stream Cipher

Recall that the ciphertext is the sum modulo 2 of the plaintext and the keystream, i.e., yi = xi + zi mod 2. The keystream is produced from z1, . . . , zm using the linear recurrence relation

where [image] (and c0 = 1).

Since all operations in this cryptosystem are linear, we might suspect that the cryptosystem is vulnerable to a known-plaintext attack, as is the case with the Hill Cipher. Suppose Oscar has a plaintext string x1x2 . . . xn and the corresponding ciphertext string y1y2 . . . yn. Then he can compute the keystream bits zi = xi + yi mod 2, 1 ? i ? n. Let us also suppose that Oscar knows the value m. Then Oscar needs only to compute c0, . . . , cm-1 in order to be able to reconstruct the entire keystream. In other words, he needs to be able to determine the values of m unknowns.

Now, for any i ? 1, we have

which is a linear equation in the m unknowns. If n ? 2m, then there are m linear equations in m unknowns, which can subsequently be solved.

The system of m linear equations can be written in matrix form as follows:

If the coefficient matrix has an inverse (modulo 2), we obtain the solution

In fact, the matrix will have an inverse if m is the degree of the recurrence used to generate the keystream (see the exercises for a proof). Let’s illustrate with an example.

Example 1.13

Suppose Oscar obtains the ciphertext string

101101011110010

corresponding to the plaintext string

011001111111000.

Then he can compute the keystream bits:

110100100001010.

Suppose also that Oscar knows that the keystream was generated using a 5-stage LFSR. Then he would solve the following matrix equation, which is obtained from the first 10 keystream bits:

It can be checked that

This yields

= (1, 0, 1, 1, 0).

Thus the recurrence used to generate the keystream is


1.3 Notes

Much of the material on classical cryptography is covered in textbooks, for example Beker and Piper [BP82] and Denning [DE82]. The probability estimates for the 26 alphabetic characters are taken from Beker and Piper. As well, the cryptanalysis of the Vigenere Cipher is a modification of the description given in Beker and Piper.

A good reference for elementary number theory is Rosen [Ro93]. Background in elementary linear algebra can be found in Anton [AN91].

Kahn’s book “The Codebreakers” [KA67] is an entertaining and informative history of cryptography up to 1967. In it, Kahn states that the Vigenere Cipher is incorrectly attributed to Vigenere.

The Hill Cipher was first described in [HI29]. Much information on stream ciphers can be found in the book by Rueppel [RU86].


Chapter 1 Exercises

Exercises

1.1 Below are given four examples of ciphertext, one obtained from a Substitution Cipher, one from a Vigenere Cipher, one from an Affine Cipher, and one unspecified. In each case, the task is to determine the plaintext.

Give a clearly written description of the steps you followed to decrypt each ciphertext. This should include all statistical analysis and computations you performed.

The first two plaintexts were taken from “The Diary of Samuel Marchbanks,” by Robertson Davies, Clarke Irwin, 1947; the fourth was taken from “Lake Wobegon Days,” by Garrison Keillor, Viking Penguin, Inc., 1985.

(a) Substitution Cipher:
      EMGLOSUDCGDNCUSWYSFHNSFCYKDPUMLWGYICOXYSIPJCK
      QPKUGKMGOLICGINCGACKSNISACYKZSCKXECJCKSHYSXCG
      OIDPKZCNKSHICGIWYGKKGKGOLDSILKGOIUSIGLEDSPWZU
      GFZCCNDGYYSFUSZCNXEOJNCGYEOWEUPXEZGACGNFGLKNS
      ACIGOIYCKXCJUCIUZCFZCCNDGYYSFEUEKUZCSOCFZCCNC
      IACZEJNCSHFZEJZEGMXCYHCJUMGKUCY

HINT F decrypts to w.

(b) Vigenere Cipher:
      KCCPKBGUFDPHQTYAVINRRTMVGRKDNBVFDETDGILTXRGUD
      DKOTFMBPVGEGLTGCKQRACQCWDNAWCRXIZAKFTLEWRPTYC
      QKYVXCHKFTPONCQQRHJVAJUWETMCMSPKQDYHJVDAHCTRL
      SVSKCGCZQQDZXGSFRLSWCWSJTBHAFSIASPRJAHKJRJUMV
      GKMITZHFPDISPZLVLGWTFPLKKEBDPGCEBSHCTJRWXBAFS
      PEZQNRWXCVYCGAONWDDKACKAWBBIKFTIOVKCGGHJVLNHI
      FFSQESVYCLACNVRWBBIREPBBVFEXOSCDYGZWPFDTKFQIY
      CWHJVLNHIQIBTKHJVNPIST
(c) Affine Cipher:
      KQEREJEBCPPCJCRKIEACUZBKRVPKRBCIBQCARBJCVFCUP
      KRIOFKPACUZQEPBKRXPEIIEABDKPBCPFCDCCAFIEABDKP
      BCPFEQPKAZBKRHAIBKAPCCIBURCCDKDCCJCIDFUIXPAFF
      ERBICZDFKABICBBENEFCUPJCVKABPCYDCCDPKBCOCPERK
      IVKSCPICBRKIJPKABI
(d) unspecified cipher:
      BNVSNSIHQCEELSSKKYERIFJKXUMBGYKAMQLJTYAVFBKVT
      DVBPVVRJYYLAOKYMPQSCGDLFSRLLPROYGESEBUUALRWXM
      MASAZLGLEDFJBZAVVPXWICGJXASCBYEHOSNMULKCEAHTQ
      OKMFLEBKFXLRRFDTZXCIWBJSICBGAWDVYDHAVFJXZIBKC
      GJIWEAHTTOEWTUHKRQVVRGZBXYIREMMASCSPBNLHJMBLR
      FFJELHWEYLWISTFVVYFJCMHYUYRUFSFMGESIGRLWALSWM
      NUHSIMYYITCCQPZSICEHBCCMZFEGVJYOCDEMMPGHVAAUM
      ELCMOEHVLTIPSUYILVGFLMVWDVYDBTHFRAYISYSGKVSUU
      HYHGGCKTMBLRX

1.2

(a) How many 2 ? 2 matrices are there that are invertible over [image]?
(b) Let p be prime. Show that the number of 2 ? 2 matrices that are invertible over [image] is (p2 - 1)(p2 - p).

HINT Since p is prime, [image] is a field. Use the fact that a matrix over a field is invertible if and only if its rows are linearly independent vectors (i.e., there does not exist a non-zero linear combination of the rows whose sum is the vector of all 0?s).

(c) For p prime, and m ? 2 an integer, find a formula for the number of m ? m matrices that are invertible over [image].

1.3 Sometimes it is useful to choose a key such that the encryption operation is identical to the decryption operation. In the case of the Hill Cipher, we would be looking for matrices K such that K = K-1 (such a matrix is called involutory). In fact, Hill recommended the use of involutory matrices as keys in his cipher. Determine the number of involutory matrices (over [image]) in the case m = 2.

HINT Use the formula given in Theorem 1.3 and observe that det A = ±1 for an involutory matrix over [image].

1.4 Suppose we are told that the plaintext
                            breathtaking

yields the ciphertext

                            RUPOTENTOSUP

where the Hill Cipher is used (but m is not specified). Determine the encryption matrix.

1.5 An Affine-Hill Cipher is the following modification of a Hill Cipher: Let m be a positive integer, and define [image]. In this cryptosystem, a key K consists of a pair (L, b), where L is an m ? m invertible matrix over [image], and [image]. For x = (x1, . . . , xm) [image] and K = (L, b) [image], we compute y = eK(x) = (y1, . . . , ym) by means of the formula y = xL + b. Hence, if [image] and b = (b1, . . . , bm), then

Suppose Oscar has learned that the plaintext

                            adisplayedequation

is encrypted to give the ciphertext

                            DSRMSSIOPLXLJBZULLM

and Oscar also knows that m = 3. Compute the key, showing all computations.

1.6 Here is how we might cryptanalyze the Hill Cipher using a ciphertext-only attack. Suppose that we know that m = 2. Break the ciphertext into blocks of length two letters (digrams). Each such digram is the encryption of a plaintext digram using the unknown encryption matrix. Pick out the most frequent ciphertext digram and assume it is the encryption of a common digram in the list following Table 1.1 (for example, TH or ST). For each such guess, proceed as in the known-plaintext attack, until the correct encryption matrix is found.

Here is a sample of ciphertext for you to decrypt using this method:

        LMQETXYEAGTXCTUIEWNCTXLZEWUAISPZYVAPEWLMGQWYA
        XFTCJMSQCADAGTXLMDXNXSNPJQSYVAPRIQSMHNOCVAXFV

1.7 We describe a special case of a Permutation Cipher. Let m, n be positive integers. Write out the plaintext, by rows, in m ? n rectangles. Then form the ciphertext by taking the columns of these rectangles. For example, if m = 4, n = 3, then we would encrypt the plaintext “cryptography” by forming the following rectangle:
                               cryp
                               togr
                               aphy

The ciphertext would be “CTAROPYGHPRY.”

(a) Describe how Bob would decrypt a ciphertext (given values for m and n).
(b) Decrypt the following ciphertext, which was obtained by using this method of encryption:
       MYAMRARUYIQTENCTORAHROYWDSOYEOUARRGDERNOGW

1.8 There are eight different linear recurrences over [image] of degree four having c0 = 1. Determine which of these recurrences give rise to a keystream of period 15 (given a non-zero initialization vector).
1.9 The purpose of this exercise is to prove the statement made in Section 1.2.5 that the m ? m coefficient matrix is invertible. This is equivalent to saying that the rows of this matrix are linearly independent vectors over [image].

As before, we suppose that the recurrence has the form

(z1, . . . , zm) comprises the initialization vector. For i ? 1, define

Note that the coefficient matrix has the vectors v1, . . . , vm as its rows, so our objective is to prove that these m vectors are linearly independent.

Prove the following assertions:

(a) For any i ? 1,

(b) Choose h to be the minimum integer such that there exists a non-trivial linear combination of the vectors v1, . . . , vh which sums to the vector (0, . . . , 0) modulo 2. Then

and not all the ?j?s are zero. Observe that h ? m + 1, since any m + 1 vectors in an m-dimensional vector space are dependent.

(c) Prove that the keystream must satisfy the recurrence

for any i ? 1.

(d) Observe that if h ? m, then the keystream satisfies a linear recurrence of degree less than m, a contradiction. Hence, h = m + 1, and the matrix must be invertible.

1.10 Decrypt the following ciphertext, obtained from the Autokey Cipher, by using exhaustive key search:
                       MALVVMAFBHBUQPTSOXALTGVWWRG
1.11 We describe a stream cipher that is a modification of the Vigenere Cipher. Given a keyword (K1, . . . , Km) of length m, construct a keystream by the rule zi = Ki (1 ? i ? m), zi + m = zi + 1 mod 26 (i ? m + 1). In other words, each time we use the keyword, we replace each letter by its successor modulo 26. For example, if SUMMER is the keyword, we use SUMMER to encrypt the first six letters, we use TVNNFS for the next six letters, and so on.

Describe how you can use the concept of index of coincidence to first determine the length of the keyword, and then actually find the keyword.

Test your method by cryptanalyzing the following ciphertext:

          IYMYSILONRFNCQXQJEDSHBUIBCJUZBOLFQYSCHATPEQGQ
          JEJNGNXZWHHGWFSUKULJQACZKKJOAAHGKEMTAFGMKVRDO
          PXNEHEKZNKFSKIFRQVHHOVXINPHMRTJPYWQGJWPUUVKFP
          OAWPMRKKQZWLQDYAZDRMLPBJKJOBWIWPSEPVVQMBCRYVC
          RUZAAOUMBCHDAGDIEMSZFZHALIGKEMJJFPCIWKRMLMPIN
          AYOFIREAOLDTHITDVRMSE

The plaintext was taken from “The Codebreakers,” by D. Kahn, Macmillan, 1967.


Chapter 2 Shannon’s Theory

Chapter 2
Shannon’s Theory

In 1949, Claude Shannon published a paper entitled “Communication Theory of Secrecy Systems” in the Bell Systems Technical Journal. This paper had a great influence on the scientific study of cryptography. In this chapter, we discuss several of Shannon’s ideas.

2.1 Perfect Secrecy

There are two basic approaches to discussing the security of a cryptosystem.

computational security

This measure concerns the computational effort required to break a cryptosystem. We might define a cryptosystem to be computationally secure if the best algorithm for breaking it requires at least N operations, where N is some specified, very large number. The problem is that no known practical cryptosystem can be proved to be secure under this definition. In practice, people will call a cryptosystem “computationally secure” if the best known method of breaking the system requires an unreasonably large amount of computer time (but this is of course very different from a proof of security). Another approach is to provide evidence of computational security by reducing the security of the cryptosystem to some well-studied problem that is thought to be difficult. For example, it may be able to prove a statement of the type “a given cryptosystem is secure if a given integer n cannot be factored.” Cryptosystems of this type are sometimes termed “provably secure,” but it must be understood that this approach only provides a proof of security relative to some other problem, not an absolute proof of security.1
1This is a similar situation to proving that a problem is NP-complete: it proves that the given problem is at least as difficult as any other NP-complete problem, but it does not provide an absolute proof of the computational difficulty of the problem.

unconditional security

This measure concerns the security of cryptosystems when there is no bound placed on the amount of computation that Oscar is allowed to do. A cryptosystem is defined to be unconditionally secure if it cannot be broken, even with infinite computational resources.

When we discuss the security of a cryptosystem, we should also specify the type of attack that is being considered. In Chapter 1, we saw that neither the Shift Cipher, the Substitution Cipher nor the Vigenere Cipher is computationally secure against a ciphertext-only attack (given a sufficient amount of ciphertext).

What we will do in this section is to develop the theory of cryptosystems that are unconditionally secure against a ciphertext-only attack. It turns out that all three of the above ciphers are unconditionally secure if only one element of plaintext is encrypted with a given key!

The unconditional security of a cryptosystem obviously cannot be studied from the point of view of computational complexity, since we allow computation time to be infinite. The appropriate framework in which to study unconditional security is probability theory. We need only elementary facts concerning probability; the main definitions are reviewed now.

DEFINITION 2.1 Suppose X and Y are random variables. We denote the probability that X takes on the value x by p(x), and the probability that Y takes on the value y by p(y). The joint probability p(x, y) is the probability that X takes on the value x and Y takes on the value y. The conditional probability p(x|y) denotes the probability that X takes on the value x given that Y takes on the value y. The random variables X and Y are said to be independent if p(x, y) = p(x)p(y) for all possible values x of X and y of Y.

Joint probability can be related to conditional probability by the formula

Interchanging x and y, we have that

From these two expressions, we immediately obtain the following result, which is known as Bayes’ Theorem.

THEOREM 2.1 (Bayes’ Theorem)

If p(y) > 0, then

COROLLARY 2.2

X and Y are independent variables if and only if p(x|y) = p(x) for all x, y.

Throughout this section, we assume that a particular key is used for only one encrypion. Let us suppose that there is a probability distribution on the plaintext space, [image]. We denote the a priori probability that plaintext x occurs by [image]. We also assume that the key K is chosen (by Alice and Bob) using some fixed probability distribution (often a key is chosen at random, so all keys will be equiprobable, but this need not be the case). Denote the probability that key K is chosen by [image]. Recall that the key is chosen before Alice knows what the plaintext will be. Hence, we make the reasonable assumption that the key K and the plaintext x are independent events.

The two probability distributions on [image] and [image] induce a probability distribution on [image]. Indeed, it is not hard to compute the probability [image] that y is the ciphertext that is transmitted. For a key [image], define

That is, C(K) represents the set of possible ciphertexts if K is the key. Then, for every [image], we have that

We also observe that, for any [image] and [image], we can compute the conditional probability, [image] (i.e., the probability that y is the ciphertext, given that x is the plaintext) to be

It is now possible to compute the conditional probability [image] (i.e., the probability that x is the plaintext, given that y is the ciphertext) using Bayes’ Theorem. The following formula is obtained:

Observe that all these calculations can be performed by anyone who knows the probability distributions.

We present a toy example to illustrate the computation of these probability distributions.

Example 2.1

Let [image] with [image]. Let [image] with [image]. Let [image], and suppose the encryption functions are defined to be [image]; [image]; and [image]. This cryptosystem can be represented by the following encryption matrix:

We now compute the probability distribution [image]. We obtain

Now we can compute the conditional probability distributions on the plaintext, given that a certain ciphertext has been observed. We have:

We are now ready to define the concept of perfect secrecy. Informally, perfect secrecy means that Oscar can obtain no information about plaintext by observing the ciphertext. This idea is made precise by formulating it in terms of the probability distributions we have defined, as follows.

DEFINITION 2.2 A cryptosystem has perfect secrecy if [image] for all [image]. That is, the a posteriori probability that the plaintext is x, given that the ciphertext y is observed, is identical to the a priori probability that the plaintext is x.

In Example 2.1, the perfect secrecy property is satisfied for the ciphertext 3, but not for the other three ciphertexts.

We next prove that the Shift Cipher provides perfect secrecy. This seems quite obvious intuitively. For, if we are given any ciphertext element [image], then any plaintext element [image] is a possible decryption of y, depending on the value of the key. The following theorem gives the formal statement and proof using probability distributions.

THEOREM 2.3

Suppose the 26 keys in the Shift Cipher are used with equal probability 1/26. Then for any plaintext probability distribution, the Shift Cipher has perfect secrecy.

PROOF Recall that [image], and for 0 ? K ? 25, the encryption rule eK is eK (x) = x + K mod 26 [image]. First, we compute the distribution [image]. Let [image]; then

Now, for fixed y, the values y - K mod 26 comprise a permutation of [image], and [image] is a probability distribution. Hence we have that

Consequently,

for any [image].

Next, we have that

for every x, y, since for every x, y the unique key K such that eK(x) = y is K = y - x mod 26. Now, using Bayes’ Theorem, it is trivial to compute

so we have perfect secrecy.

So, the Shift Cipher is “unbreakable” provided that a new random key is used to encrypt every plaintext character.

Let us next investigate perfect secrecy in general. First, we observe that, using Bayes’ Theorem, the condition that [image] for all [image] is equivalent to [image] for all [image]. Now, let us make the reasonable assumption that [image] for all [image], then ciphertext y is never used and can be omitted from [image]). Fix any [image]. For each [image], we have [image]. Hence, for each [image], there must be at least one key K such that eK(x) = y. It follows that [image]. In any cryptosystem, we must have [image] since each encoding rule is an injection. In the boundary case [image], we can give a nice characterization of when perfect secrecy can be obtained. This characterization is originally due to Shannon.

THEOREM 2.4

Suppose [image] is a cryptosystem where [image]. Then the cryptosystem provides perfect secrecy if and only if every key is used with equal probability [image], every [image], and every [image], there is a unique key K such that eK(x) = y.

PROOF Suppose the given cryptosystem provides perfect secrecy. As observed above, for each [image] and [image] there must be at least one key K such that eK(x) = y. So we have the inequalities:

But we are assuming that [image]. Hence, it must be the case that

That is, there do not exist two distinct keys K1 and K2 such that [image]. Hence, we have shown that for any [image] and [image], there is exactly one key K such that eK(x) = y.

Figure 2.1 One-time Pad

Denote [image]. Let [image] and fix a [image]. We can name the keys K1, K2,..., Kn, in such a way that [image]. Using Bayes’ theorem, we have

Consider the perfect secrecy condition [image]. From this, it follows that [image], for 1 ? i ? n. This says that the keys are used with equal probability (namely, [image]). But since the number of keys is [image], we must have that [image] for every [image].

Conversely, suppose the two hypothesized conditions are satisfied. Then the cryptosystem is easily seen to provide perfect secrecy for any plaintext probability distribution, in a similar manner as the proof of Theorem 2.3. We leave the details for the reader.

One well-known realization of perfect secrecy is the Vernam One-time Pad, which was first described by Gilbert Vernam in 1917 for use in automatic encryption and decryption of telegraph messages. It is interesting that the One-time Pad was thought for many years to be an “unbreakable” cryptosystem, but there was no proof of this until Shannon developed the concept of perfect secrecy over 30 years later.

The description of the One-time Pad is given in Figure 2.1.

Using Theorem 2.4, it is easily seen that the One-time Pad provides perfect secrecy. The system is also attractive because of the ease of encryption and decryption.

Vernam patented his idea in the hope that it would have widespread commercial use. Unfortunately, there are major disadvantages to unconditionally secure cryptosystems such as the One-time Pad. The fact that [image] means that the amount of key that must be communicated securely is at least as big as the amount of plaintext. For example, in the case of the One-time Pad, we require n bits of key to encrypt n bits of plaintext. This would not be a major problem if the same key could be used to encrypt different messages; however, the security of unconditionally secure cryptosystems depends on the fact that each key is used for only one encryption. (This is the reason for the term “one-time” in the One-time Pad.)

For example, the One-time Pad is vulnerable to a known-plaintext attack, since K can be computed as the exclusive-or of the bitstrings x and eK(x). Hence, a new key needs to be generated and communicated over a secure channel for every message that is going to be sent. This creates severe key management problems, which has limited the use of the One-time Pad in commercial applications. However, the One-time Pad has seen application in military and diplomatic contexts, where unconditional security may be of great importance.

The historical development of cryptography has been to try to design cryptosystems where one key can be used to encrypt a relatively long string of plaintext (i.e., one key can be used to encrypt many messages) and still maintain (at least) computational security. One such system is the Data Encryption Standard, which we will study in Chapter 3.


2.2 Entropy

In the previous section, we discussed the concept of perfect secrecy. We restricted our attention to the special situation where a key is used for only one encryption. We now want to look at what happens as more and more plaintexts are encrypted using the same key, and how likely a cryptanalyst will be able to carry out a successful ciphertext-only attack, given sufficient time.

The basic tool in studying this question is the idea of entropy, a concept from information theory introduced by Shannon in 1948. Entropy can be thought of as a mathematical measure of information or uncertainty, and is computed as a function of a probability distribution.

Suppose we have a random variable X which takes on a finite set of values according to a probability distribution p(X). What is the information gained by an event which takes place according to distribution p(X)? Equivalently, if the event has not (yet) taken place, what is the uncertainty about the outcome? This quantity is called the entropy of X and is denoted by H(X).

These ideas may seem rather abstract, so let’s look at a more concrete example. Suppose our random variable X represents the toss of a coin. The probability distribution is p(heads) = p(tails) = 1/2. It would seem reasonable to say that the information, or entropy, of a coin toss is one bit, since we could encode heads by 1 and tails by 0, for example. In a similar fashion, the entropy of n independent coin tosses is n, since the n coin tosses can be encoded by a bit string of length n.

As a slightly more complicated example, suppose we have a random variable X that takes on three possible values x1, x2, x3 with probabilities 1/2, 1/4, 1/4 respectively. The most efficient “encoding” of the three possible outcomes is to encode x1, as 0, to encode x2 as 10 and to encode x3 as 11. Then the average number of bits in an encoding of X is

The above examples suggest that an event which occurs with probability 2-n can be encoded as a bit string of length n. More generally, we could imagine that an event occurring with probability p might be encoded by a bit string of length approximately - log2 p. Given an arbitrary probability distribution p1, p2, ..., pn for a random variable X, we take the weighted average of the quatities - log2 pi to be our measure of information. This motivates the following formal definition.

DEFINITION 2.3 Suppose X is a random variable which takes on a finite set of values according to a probability distribution p(X). Then, the entropy of this probability distribution is defined to be the quantity

If the possible values of X are xi, 1 ? i ? n, then we have

REMARK Observe that log2 pi is undefined if pi = 0. Hence, entropy is sometimes defined to be the relevant sum over all the non-zero probabilities. Since limx >0 x log2 x = 0, there is no real difficulty with allowing pi = 0 for some i. However, we will implicitly assume that, when computing the entropy of a probability distribution pi, the sum is taken over the indices i such that pi ? 0. Also, we note that the choice of two as the base of the logarithms is arbitrary: another base would only change the value of the entropy by a constant factor.

Note that if pi = 1/n for 1 ? i ? n, then H(X) = log2 n. Also, it is easy to see that H(X) ? 0, and H(X) = 0 if and only if pi = 1 for some i and pj = 0 for all j ? i.

Let us look at the entropy of the various components of a cryptosystem. We can think of the key as being a random variable K that takes on values according to the probability distribution [image], and hence we can compute the entropy H(K). Similarly, we can compute entropies H(P) and H(C) associated with plaintext and ciphertext probability distributions, respectively.

To illustrate, we compute the entropies of the cryptosystem of Example 2.1.

Example 2.1 (Cont.)

We compute as follows:

Similar calculations yield H(K) = 1.5 and [image].


2.2.1 Huffman Encodings and Entropy

In this section, we discuss briefly the connection between entropy and Huffman encodings. As the results in this section are not relevant to the cryptographic applications of entropy, it may be skipped without loss of continuity. However, this discussion may serve to further motivate the concept of entropy.

We introduced entropy in the context of encodings of random events which occur according to a specified probability distribution. We first make these ideas more precise. As before, X is a random variable which takes on a finite set of values, and p(X) is the associated probability distribution.

An encoding of X is any mapping

where {0, 1}* denotes the set of all finite strings of 0’s and 1’s. Given a finite list (or string) of events x1 ... xn, we can extend the encoding f in an obvious way by defining

where || denotes concatenation. In this way, we can think of f as a mapping

Now, suppose a string x1 ... xn is produced by a memoryless source such that each xi occurs according to the probability distribution on X. This means that the probability of any string x1 ... xn is computed to be p(x1) ? . . . ? p(xn). (Notice that this string need not consist of distinct values, since the source is memoryless. As a simple example, consider a sequence of n tosses of a fair coin.)

Now, given that we are going to encode strings using the mapping f, it is important that we are able to decode in an unambiguous fashion. Thus it should be the case that the encoding f is injective.

Example 2.2

Suppose X = {a, b, c, d}, and consider the following three encodings:

It can be seen that f and g are injective encodings, but h is not. Any encoding using f can be decoded by starting at the end and working backwards: every time a 1 is encountered, it signals the end of the current element.

An encoding using g can be decoded by starting at the beginning and proceeding sequentially. At any point where we have a substring that is an encoding of a, b, c, or d, we decode it and chop off the substring. For example, given the string 10101110, we decode 10 to b, then 10 to b, then 111 to d, and finally 0 to a. So the decoded string is bbda.

To see that h is not injective, it suffices to give an example:

From the point of view of ease of decoding, we would prefer the encoding g to f. This is because decoding can be done sequentially from beginning to end if g is used, so no memory is required. The property that allows the simple sequential decoding of g is called the prefix-free property. (An encoding g is prefix-free if there do not exist two elements x, y ? X, and a string z ? {0, 1}* such that g(x) = g(y) || z.)

The discussion this point has not involved entropy. Not surprisingly, entropy is related to the efficiency of an encoding. We will measure the efficiency of an encoding f as we did before: it is the weighted average length (denoted by [image]) of an encoding of an element of X. So we have the following definition:

where |y| denotes the length of a string y.

Now, our fundamental problem is to find an injective encoding, f, that minimizes [image]. There is a well-known algorithm, known as Huffman’s algorithm, that accomplishes this goal. Moreover, the encoding f produced by Huffman’s algorithm is prefix-free, and

Thus, the value of the entropy provides a close estimate to the average length of the optimal injective encoding.

We will not prove the results stated above, but we will give a short, informal description of Huffman’s algorithm. Huffman’s algorithm begins with the probability distribution on the set X, and the code of each element is initially empty. In each iteration, the two elements having lowest probability are combined into one element having as its probability the sum of the two smaller probabilities. The smaller of the two elements is assigned the value “0” and the larger of the two elements is assigned the value “1.” When only one element remains, the coding for each x ? X can be constructed by following the sequence of elements “backwards” from the final element to the initial element x.

This is easily illustrated with an example.

Example 2.3

Suppose X = {a, b, c, d, e} has the following probability distribution: p(a) = .05, p(b) = .10, p(c) = .12, p(d) = .13 and p(e) = .60. Huffman’s algorithm would proceed as indicated in the following table:

This leads to the following encodings:

x | f(x)
a | 000
b | 001
c | 010
d | 011
e | 1

Thus, the average length encoding is

Compare this to the entropy:


2.3 Properties of Entropy

In this section, we prove some fundamental results concerning entropy. First, we state a fundamental result, known as Jensen’s Inequality, that will be very useful to us. Jensen’s Inequality involves concave functions, which we now define.

DEFINITION 2.4 A real-valued function f is concave on an interval I if

for all x, y ? I. f is strictly concave on an interval I if

for all x, y ? I, x ? y.

Here is Jensen’s Inequality, which we state without proof.

THEOREM 2.5 (Jensen’s Inequality)

Suppose f is a continuous strictly concave function on the interval I,

and ai > 0, 1 ? i ? n. Then

where xi ? I, 1 ? i ? n. Further, equality occurs if and only if x1 = ... = xn.

We now proceed to derive several results on entropy. In the next theorem, we make use of the fact that the function log2 x is strictly concave on the interval (0, ?). (In fact, this follows easily from elementary calculus since the second deriviative of the logarithm function is negative on the interval (0, ?).)

THEOREM 2.6

Suppose X is a random variable having probability distribution p1, p2, pn, where pi > 0, 1 ? i ? n. Then H(X) ? log2 n, with equality if and only if pi = 1/n, 1 ? i ? n.

PROOF Applying Jensen’s Inequality, we have the following:

Further, equality occurs if and only if pi = 1/n, 1 ? i ? n.

THEOREM 2.7

H (X, Y) ? H(X) + H(Y), with equality if and only if X and Y are independent events.

PROOF Suppose X takes on values xi, 1 ? i ? m, and Y takes on values yj, 1 ? j ? n. Denote pi = p(X = xi), 1 ? i ? m, and qj = p(Y = yj), 1 ? j ? n. Denote rij = p(X = xi, Y = yj), 1 ? i ? m, 1 ? j ? n (this is the joint probability distribution).

Observe that

(1 ? i ? m) and

(1 ? j ? n). We compute as follows:

On the other hand,

Combining, we obtain the following:

(Here, we apply Jensen’s Inequality, using the fact that the rij’s form a probability distribution.)

We can also say when equality occurs: it must be the case that there is a constant c such that piqj/rij = c for all i, j. Using the fact that

it follows that c = 1. Hence, equality occurs if and only if rij = piqj, i.e., if and only if

1 ? i ? m, 1 ? j ? n. But this says that X and Y are independent.

We next define the idea of conditional entropy.

DEFINITION 2.5 Suppose X and Y are two random variables. Then for any fixed value y of Y, we get a (conditional) probability distribution p(X|y). Clearly,

We define the conditional entropy H(X|Y) to be the weighted average (with respect to the probabilities p(y)) of the entropies H(X|y) over all possible values y. It is computed to be

The conditional entropy measures the average amount of information about X that is revealed by Y.

The next two results are straightforward; we leave the proofs as exercises.

THEOREM 2.8

H(X, Y) = H(Y) + H(X|Y).

COROLLARY 2.9

H(X|Y) ? H(X), with equality if and only if X and Y are independent.


2.4 Spurious Keys and Unicity Distance

In this section, we apply the entropy results we have proved to cryptosystems. First, we show a fundamental relationship exists among the entropies of the components of a cryptosystem. The conditional entropy H(K|C) is called the key equivocation, and is a measure of how much information about the key is revealed by the ciphertext.

THEOREM 2.10

Let [image] be a cryptosystem. Then

PROOF  First, observe that H(K,
P, C) = H(C|K, P) + H(K,
P). Now, the key and plaintext determine the ciphertext uniquely, since
y = eK(x). This implies that
H(C|K, P) = 0. Hence, H(K, P,
C) = H(K, P). But K and P are
independent, so H(K, P) = H(K) +
H(P). Hence,

In a similar fashion, since the key and ciphertext determine the plaintext uniquely (i.e., x = dK(y)), we have that H(P|K, C) = 0 and hence H(K, P, C) = H(K, C).

Now, we compute as follows:

giving the desired formula.

Let us return to Example 2.1 to illustrate this result.

Example 2.1 (Cont.)

We have already computed [image] and [image]. Theorem 2.10 tells us that [image]. This can be verified directly by applying the definition of conditional entropy, as follows. First, we need to compute the probabilities p(Ki|j), 1 ? i ? 3, 1 ? j ? 4. This can be done using Bayes’ Theorem, and the following values result:

Now we compute

agreeing with the value predicted by Theorem 2.10.

Suppose [image] the cryptosystem being used, and a string of plaintext

is encrypted with one key, producing a string of ciphertext

Recall that the basic goal of the cryptanalyst is to determine the key. We are looking at ciphertext-only attacks, and we assume that Oscar has infinite computational resources. We also assume that Oscar knows that the plaintext is a “natural” language, such as English. In general, Oscar will be able to rule out certain keys, but many “possible” keys may remain, only one of which is the correct key. The remaining possible, but incorrect, keys are called spurious keys.

For example, suppose Oscar obtains the ciphertext string WNAJW, which has been obtained by encryption using a shift cipher. It is easy to see that there are only two “meaningful” plaintext strings, namely river and arena, corresponding respectively to the possible encryption keys F (= 5) and W (= 22). Of these two keys, one will be the correct key and the other will be spurious. (Actually, it is moderately difficult to find a ciphertext of length 5 for the Shift Cipher that has two meaningful decryptions; the reader might search for other examples.)

Our goal is to prove a bound on the expected number of spurious keys. First, we have to define what we mean by the entropy (per letter) of a natural language L, which we denote HL. HL should be a measure of the average information per letter in a “meaningful” string of plaintext. (Note that a random string of alphabetic characters would have entropy (per letter) equal to log2 [image].) As a “first-order” approximation to HL, we could take H(P). In the case where L is the English language, we get [image] by using the probability distribution given in Table 1.1.

Of course, successive letters in a language are not independent, and correlations among successive letters reduce the entropy. For example, in English, the letter “Q” is always followed by the letter “U.” For a “second-order” approximation, we would compute the entropy of the probability distribution of all digrams and then divide by 2. In general, define Pn to be the random variable that has as its probability distribution that of all n-grams of plaintext. We make use of the following definitions.

DEFINITION 2.6 Suppose L is a natural language. The entropy of L is defined to be the quantity

and the redundancy of L is defined to be

REMARK HL measures the entropy letter of the language L. A random language would have entropy log2 [image]. So the quantity RL measures the fraction of “excess characters,” which we think of as redundancy.

In the case of the English language, a tabulation of a large number of digrams and their frequencies would produce an estimate for H(P2). is one estimate obtained in this way. One could continue, tabulating trigrams, etc. and thus obtain an estimate for HL. In fact, various experiments have yielded the

empirical result that 1.0 ? HL ? 1.5. That is, the average information content in English is something like one to one and a half bits per letter!

Using 1.25 as our estimate of HL gives a redundancy of about 0.75. This means that the English language is 75% redundant! (This is not to say that one can arbitrarily remove three out of every four letters from English text and hope to still be able to read it. What it does mean is that it is possible to find a Huffman encoding of n-grams, for a large enough value of n, which will compress English text to about one quarter of its original length.)

Given probability distributions on [image] and [image], we can define the induced probability distribution on [image], the set of n-grams of ciphertext (we already did this in the case n = 1). We have defined Pn to be a random variable representing an n-gram of plaintext. Similarly, define Cn to be a random variable representing an n-gram of ciphertext.

Given y ? Cn, define

That is, K(y) is the set of keys K for which y is the encryption of a meaningful string of plaintext of length n, i.e., the set of “possible” keys, given that y is the ciphertext. If y is the observed sequence of ciphertext, then the number of spurious keys is |K(y)| - 1, since only one of the “possible” keys is the correct key. The average number of spurious keys (over all possible ciphertext strings of length n) is denoted by [image]. Its value is computed to be

From Theorem 2.10, we have that

Also, we can use the estimate

provided n is reasonably large. Certainly,

Then, if [image], it follows that

Next, we relate the quantity H(K|Cn) to the number of spurious keys, [image]. We compute as follows:

where we apply Jensen’s Inequality (Theorem 2.5) with f(x) = log2 x. Thus we obtain the inequality

Combining the two inequalities (2.1) and (2.2), we get that

In the case where keys are chosen equiprobably (which maximizes H(K)), we have the following result.

THEOREM 2.11

Suppose [image] is a cryptosystem where [image] and keys are chosen equiprobably. Let RL denote the redundancy of the underlying language. Then given a string of ciphertext of length n, where n is sufficiently large, the expected number of spurious keys, [image], satisfies

The quantity [image] approaches 0 exponentially quickly as n increases. Also, note that the estimate may not be accurate for small values of n, especially since H(Pn)/n may not be a good estimate for HL if n is small.

We have one more concept to define.

DEFINITION 2.7 The unicity distance of a cryptosystem is defined to be the value of n, denoted by n0, at which the expected number of spurious keys becomes zero; i.e., the average amount of ciphertext required for an opponent to be able to uniquely compute the key, given enough computing time.

If we set [image] in Theorem 2.11 and solve for n, we get an estimate for the unicity distance, namely

As an example, consider the Substitution Cipher. In this cryptosystem, [image] and [image]!. If we take RL = 0.75, then we get an estimate for the unicity distance of

This suggests that, given a ciphertext string of length at least 25, (usually) a unique decryption is possible.


2.5 Product Cryptosystems

Another innovation introduced by Shannon in his 1949 paper was the idea of combining cryptosystems by forming their “product.” This idea has been of fundamental importance in the design of present-day cryptosystems such as the Data Encryption Standard, which we study in the next chapter.

For simplicity, we will confine our attention in this section to cryptosystems in which [image]: cryptosystems of this type are called endomorphic. Suppose [image] and [image] are two endomorphic cryptosystems which have the same plaintext (and ciphertext) spaces. Then the product of S1 and S2, denoted by S1 ? S2, is defined to be the cryptosystem

A key of the product cryptosystem has the form K = (K1, K2), where [image] and [image]. The encryption and decryption rules of the product cryptosystem are defined as follows: For each K = (K1, K2), we have an encryption rule eK defined by the formula

and a decryption rule defined by the formula

That is, we first encrypt x with [image], and then “re-encrypt” the resulting ciphertext with [image]. Decrypting is similar, but it must be done in the reverse order:

Recall also that cryptosystems have probability distributions associated with their keyspaces. Thus we need to define the probability distribution for the keyspace [image] of the product cryptosystem. We do this in a very natural way:

Figure 2.2 Multiplicative Cipher

In other words, choose K1 using the distribution [image], and then independently choose K2 using the distribution [image].

Here is a simple example to illustrate the definition of a product cryptosystem. Suppose we define the Multiplicative Cipher as in Figure 2.2.

Suppose M is the Multiplicative Cipher (with keys chosen equiprobably) and S is the Shift Cipher (with keys chosen equiprobably). Then it is very easy to see that M ? S is nothing more than the Affine Cipher (again, with keys chosen equiprobably). It is slightly more difficult to show that S ? M is also the Affine Cipher with equiprobable keys.

Let’s prove these assertions. A key in the Shift Cipher is an element [image], and the corresponding encryption rule is eK(x) = x + K mod 26. A key in the Multiplicative Cipher is an element [image] such that gcd(a, 26) = 1; the corresponding encryption rule is ea(x) = ax mod 26. Hence, a key in the product cipher M ? S has the form (a, K), where

But this is precisely the definition of a key in the Affine Cipher. Further, the probability of a key in the Affine Cipher is 1/312 = 1/12 ? 1/26, which is the product of the probabilities of the keys a and K, respectively. Thus M ? S is the Affine Cipher.

Now let’s consider S ? M. A key in this cipher has the form (K, a), where

Thus the key (K, a) of the product cipher S ? M is identical to the key (a, aK) of the Affine Cipher. It remains to show that each key of the Affine Cipher arises with the same probability 1/312 in the product cipher S ? M. Observe that aK = K1 if and only if K = a-1K1 (recall that gcd(a, 26) = 1, so a has a multiplicative inverse). In other words, the key (a, K1) of the Affine Cipher is equivalent to the key (a-1K1, a) of the product cipher S ? M. We thus have a bijection between the two key spaces. Since each key is equiprobable, we conclude that S ? M is indeed the Affine Cipher.

We have shown that M ? S = S ? M. Thus we would say that the two cryptosystems commute. But not all pairs of cryptosystems commute; it is easy to find counterexamples. On the other hand, the product operation is always associative: (S1 ? S2) ? S3 = S1 ? (S2 ? S3).

If we take the product of an (endomorphic) cryptosystem S with itself, we obtain the cryptosystem S ? S, which we denote by S2. If we take the n-fold product, the resulting cryptosystem is denoted by Sn. We call Sn an iterated cryptosystem.

A cryptosystem S is defined to be idempotent if S2 = S. Many of the cryptosystems we studied in Chapter 1 are idempotent. For example, the Shift, Substitution, Affine, Hill, Vigenere and Permutation Ciphers are all idempotent. Of course, if a cryptosystem S is idempotent, then there is no point in using the product system S2, as it requires an extra key but provides no more security.

If a cryptosystem is not idempotent, then there is a potential increase in security by iterating several times. This idea is used in the Data Encryption Standard, which consists of 16 iterations. But, of course, this approach requires a non-idempotent cryptosystem to start with. One way in which simple non-idempotent cryptosystems can sometimes be constructed is to take the product of two different (simple) cryptosystems.

REMARK It is not hard to show that if S1 and S2 are both idempotent and they commute, then S1 ? S2 will also be idempotent. This follows from the following algebraic manipulations:

(Note the use of the associative property in this proof.)

So, if S1 and S2 are both idempotent, and we want S1 ? S2 to be non-idempotent, then it is necessary that S1 and S2 not commute.

Fortunately, many simple cryptosystems are suitable building blocks in this type of approach. Taking the product of substitution-type ciphers with permutation-type ciphers is a commonly used technique. We will see a realization of this in the next chapter.


2.6 Notes

The idea of perfect secrecy and the use of entropy techniques in cryptography was pioneered by Shannon [SH49]. Product cryptosystems are also discussed in this paper. The concept of entropy was defined by Shannon in [SH48]. Good introductions to entropy, Huffman coding and related topics can be found in the books by Welsh [WE88] and Goldie and Pinch [GP91].

The results of Section 2.4 are due to Beauchemin and Brassard [BB88], who generalized earlier results of Shannon.


Chapter 2 Exercises

Exercises

2.1 Let n be a positive integer. A Latin square of order n is an n ? n array L of the integers 1, ..., n such that every one of the n integers occurs exactly once in each row and each column of L. An example of a Latin square of order 3 is as follows:
1 | 2 | 3
3 | 1 | 2
2 | 3 | 1

Given any Latin square L of order n, we can define a related cryptosystem. Take [image]. For 1 ? i ? n, the encryption rule ei is defined to be ei(j) = L(i, j). (Hence each row of L gives rise to one encryption rule.)

Give a complete proof that this Latin square cryptosystem achieves perfect secrecy.

2.2 Prove that the Affine Cipher achieves perfect secrecy.
2.3 Suppose a cryptosystem achieves perfect secrecy for a particular plaintext probability distribution p0. Prove that perfect secrecy is maintained for any plaintext probability distribution.
2.4 Prove that if a cryptosystem has perfect secrecy and [image], then every ciphertext is equally probable.
2.5 Suppose X is a set of cardinality n, where 2k ? n < 2k+1, and p(x) = 1/n for all x ? X.

(a) Find a prefix-free encoding of X, say f, such that [image].

HINT Encode 2k+1 - n elements of X as strings of length k, and encode the remaining elements as strings of length k + 1.

(b) Illustrate your construction for n = 6. Compute [image] and H(X) in this case.

2.6 Suppose X = {a, b, c, d, e} has the following probability distribution: p(a) = .32, p(b) = .23, p(q) = .20, p(d) = .15 and p(e) = .10. Use Huffman’s algorithm to find the optimal prefix-free encoding of X. Compare the length of this encoding to H(X).
2.7 Prove that H(X, Y) = H(Y) + H(X|Y). Then show as a corollary that H(X|Y) ? H(X), with equality if and only if X and Y are independent.
2.8 Prove that a cryptosystem has perfect secrecy if and only if H(P|C) = H(P).
2.9 Prove that, in any cryptosystem, H(K|C) ? H(P|C). (Intuitively, this result says that, given a ciphertext, the opponent’s uncertainty about the key is at least as great as his uncertainty about the plaintext.)
2.10 Consider a cryptosystem in which [image]. Suppose the encryption matrix is as follows:

Given that keys are chosen equiprobably, and the plaintext probability distribution is [image], compute H(P), H(C), H(K), H(K|C) and H(P|C).

2.11 Compute H(K|C) and H(K|P, C) for the Affine Cipher.
2.12 Consider a Vigenere Cipher with keyword length m. Show that the unicity distance is 1/RL, where RL is the redundancy of the underlying language. (This result is interpreted as follows. If n0 denotes the number of alphabetic characters being encrypted, then the “length” of the plaintext is n0/m, since each plaintext element consists of m alphabetic characters. So, a unicity distance of 1/RL corresponds to a plaintext consisting of m/RL alphabetic characters.)
2.13 Show that the unicity distance of the Hill Cipher (with an m ? m encryption matrix) is less than m/RL (Note that the number of alphabetic characters in a plaintext of this length is m2/RL.)
2.14 A Substitution Cipher over a plaintext space of size n has [image] Stirling’s formula gives the following estimate for n!:

(a) Using Stirling’s formula, derive an estimate of the unicity distance of the Substitution Cipher.
(b) Let m ? 1 be an integer. The m-gram Substitution Cipher is the Substitution Cipher where the plaintext (and ciphertext) spaces consist of all 26m m-grams. Estimate the unicity distance of the m-gram Substitution Cipher if RL = 0.75.

2.15 Prove that the Shift Cipher is idempotent.
2.16 Suppose S1 is the Shift Cipher (with equiprobable keys, as usual) and S2 is the Shift Cipher where keys are chosen with respect to some probability distribution [image] (which need not be equiprobable). Prove that S1 ? S2 = S1.
2.17 Suppose S1 and S2 are Vigenere Ciphers with keyword lengths m1, m2 respectively, where m1 > m2.

(a) If m2 | m1, then show that S2 ? S1 = S1.
(b) One might try to generalize the previous result by conjecturing that S2 ? S1 = S3, where S3 is the Vigenere Cipher with keyword length lcm(m1, m2). Prove that this conjecture is false.

HINT If [image] mod m2, then the number of keys in the product cryptosystem S2 ? S1 is than the number of keys in S3.


Chapter 3 The Data Encryption Standard

Chapter 3
The Data Encryption Standard

3.1 Introduction

On May 15, 1973, the National Bureau of Standards published a solicitation for cryptosystems in the Federal Register. This lead ultimately to the development of the Data Encryption Standard, or DES, which has become the most widely used cryptosystem in the world. DES was developed at IBM, as a modification of an earlier system known as LUCIFER. DES was first published in the Federal Register of March 17, 1975. After a considerable amount of public discussion, DES was adopted as a standard for “unclassified” applications on January 15, 1977. DES has been reviewed by the National Bureau of Standards (approximately) every five years since its adoption. Its most recent renewal was in January 1994, when it was renewed until 1998. It is anticipated that it will not remain a standard past 1998.


3.2 Description of DES

A complete description of DES is given in the Federal Information Processing Standards Publication 46, dated January 15, 1977. DES encrypts a plaintext bitstring x of length 64 using a key K which is a bitstring of length 56, obtaining a ciphertext bitstring which is again a bitstring of length 64. We first give a “high-level” description of the system.

The algorithm proceeds in three stages:

1. Given a plaintext x, a bitstring x0 is constructed by permuting the bits of x according to a (fixed) initial permutation IP. We write x0 = IP (x) = L0R0, where L0 comprises the first 32 bits of x0 and R0 the last 32 bits.
2. 16 iterations of a certain function are then computed. We compute LiRi,

Figure 3.1 One round of DES encryption

1 ? i ? 16, according to the following rule:

where ? denotes the exclusive-or of two bitstrings. f is a function that we will describe later, and K1, K2, . . . , K16 are each bitstrings of length 48 computed as a function of the key K. (Actually, each Ki is a permuted selection of bits from K.) K1, K2, . . . , K16 comprises the key schedule. One round of encryption is depicted in Figure 3.1

3. Apply the inverse permutation IP-1 to the bitstring R16L16, obtaining the ciphertext y. That is, y = IP-1(R16L16). Note the inverted order of L16 and R16.

The function f takes as input a first argument A, which is a bitstring of length 32, and a second argument J that is a bitstring of length 48, and produces as output a bitstring of length 32. The following steps are executed.

1. The first argument A is “expanded” to a bitstring of length 48 according to a fixed expansion function E. E(A) consists of the 32 bits from A, permuted in a certain way, with 16 of the bits appearing twice.

Figure 3.2 The DES f function

2. Compute E(A) ? J and write the result as the concatenation of eight 6-bit strings B = B1B2B3B4B5B6B7B8.
3. The next step uses eight S-boxes S1, . . . , S8. Each Si is a fixed 4 ? 16 array whose entries come from the integers 0 - 15. Given a bitstring of length six, say Bj = b1b2b3b4b5b6, we compute Sj(Bj) as follows. The two bits b1b6 determine the binary representation of a row r of Sj (0 ? r ? 3), and the four bits b2b3b4b5 determine the binary representation of a column c of Sj (0 ? c ? 15). Then Sj(Bj) is defined to be the entry Sj(r, c), written in binary as a bitstring of length four. (Hence, each Sj can be thought of as a function that accepts as input a bitstring of length two and one of length four, and produces as output a bitstring of length four.) In this fashion, we compute Cj = Sj(Bj), 1 ? j ? 8.
4. The bitstring C = C1C2C3C4C5C6C7C8 of length 32 is permuted according to a fixed permutation P. The resulting bitstring P(C) is defined to be f(A, J).

The f function is depicted in Figure 3.2. Basically, it consists of a substitution (using an S-box) followed by the (fixed) permutation P. The 16 iterations of f comprise a product cryptosystem, as described in Section 2.5.

In the remainder of this section, we present the specific functions used in DES.

The initial permutation IP is as follows:

IP
58 | 50 | 42 | 34 | 26 | 18 | 10 | 2
60 | 52 | 44 | 36 | 28 | 20 | 12 | 4
62 | 54 | 46 | 38 | 30 | 22 | 14 | 6
64 | 56 | 48 | 40 | 32 | 24 | 16 | 8
57 | 49 | 41 | 33 | 25 | 17 | 9 | 1
59 | 51 | 43 | 35 | 27 | 19 | 11 | 3
61 | 53 | 45 | 37 | 29 | 21 | 13 | 5
63 | 55 | 47 | 39 | 31 | 23 | 15 | 7

This means that the 58th bit of x is the first bit of IP(x); the 50th bit of x is the second bit of IP(x), etc.

The inverse permutation IP-1 is:

IP-1
40 | 8 | 48 | 16 | 56 | 24 | 64 | 32
39 | 7 | 47 | 15 | 55 | 23 | 63 | 31
38 | 6 | 46 | 14 | 54 | 22 | 62 | 30
37 | 5 | 45 | 13 | 53 | 21 | 61 | 29
36 | 4 | 44 | 12 | 52 | 20 | 60 | 28
35 | 3 | 43 | 11 | 51 | 19 | 59 | 27
34 | 2 | 42 | 10 | 50 | 18 | 58 | 26
33 | 1 | 41 | 9 | 49 | 17 | 57 | 25

The expansion function E is specified by the following table:

E bit-selection table
32 | 1 | 2 | 3 | 4 | 5
4 | 5 | 6 | 7 | 8 | 9
8 | 9 | 10 | 11 | 12 | 13
12 | 13 | 14 | 15 | 16 | 17
16 | 17 | 18 | 19 | 20 | 21
20 | 21 | 22 | 23 | 24 | 25
24 | 25 | 26 | 27 | 28 | 29
28 | 29 | 30 | 31 | 32 | 1

The eight S-boxes and the permutation P are now presented:

S1
14 | 4 | 13 | 1 | 2 | 15 | 11 | 8 | 3 | 10 | 6 | 12 | 5 | 9 | 0 | 7
0 | 15 | 7 | 4 | 14 | 2 | 13 | 1 | 10 | 6 | 12 | 11 | 9 | 5 | 3 | 8
4 | 1 | 14 | 8 | 13 | 6 | 2 | 11 | 15 | 12 | 9 | 7 | 3 | 10 | 5 | 0
15 | 12 | 8 | 2 | 4 | 9 | 1 | 7 | 5 | 11 | 3 | 14 | 10 | 0 | 6 | 13

S2
15 | 1 | 8 | 14 | 6 | 11 | 3 | 4 | 9 | 7 | 2 | 13 | 12 | 0 | 5 | 10
3 | 13 | 4 | 7 | 15 | 2 | 8 | 14 | 12 | 0 | 1 | 10 | 6 | 9 | 11 | 5
0 | 14 | 7 | 11 | 10 | 4 | 13 | 1 | 5 | 8 | 12 | 6 | 9 | 3 | 2 | 15
13 | 8 | 10 | 1 | 3 | 15 | 4 | 2 | 11 | 6 | 7 | 12 | 0 | 5 | 14 | 9

S3
10 | 0 | 9 | 14 | 6 | 3 | 15 | 5 | 1 | 13 | 12 | 7 | 11 | 4 | 2 | 8
13 | 7 | 0 | 9 | 3 | 4 | 6 | 10 | 2 | 8 | 5 | 14 | 12 | 11 | 15 | 1
13 | 6 | 4 | 9 | 8 | 15 | 3 | 0 | 11 | 1 | 2 | 12 | 5 | 10 | 14 | 7
1 | 10 | 13 | 0 | 6 | 9 | 8 | 7 | 4 | 15 | 14 | 3 | 11 | 5 | 2 | 12

S4
7 | 13 | 14 | 3 | 0 | 6 | 9 | 10 | 1 | 2 | 8 | 5 | 11 | 12 | 4 | 15
13 | 8 | 11 | 5 | 6 | 15 | 0 | 3 | 4 | 7 | 2 | 12 | 1 | 10 | 14 | 9
10 | 6 | 9 | 0 | 12 | 11 | 7 | 13 | 15 | 1 | 3 | 14 | 5 | 2 | 8 | 4
3 | 15 | 0 | 6 | 10 | 1 | 13 | 8 | 9 | 4 | 5 | 11 | 12 | 7 | 2 | 14

S5
2 | 12 | 4 | 1 | 7 | 10 | 11 | 6 | 8 | 5 | 3 | 15 | 13 | 0 | 14 | 9
14 | 11 | 2 | 12 | 4 | 7 | 13 | 1 | 5 | 0 | 15 | 10 | 3 | 9 | 8 | 6
4 | 2 | 1 | 11 | 10 | 13 | 7 | 8 | 15 | 9 | 12 | 5 | 6 | 3 | 0 | 14
11 | 8 | 12 | 7 | 1 | 14 | 2 | 13 | 6 | 15 | 0 | 9 | 10 | 4 | 5 | 3

S6
12 | 1 | 10 | 15 | 9 | 2 | 6 | 8 | 0 | 13 | 3 | 4 | 14 | 7 | 5 | 11
10 | 15 | 4 | 2 | 7 | 12 | 9 | 5 | 6 | 1 | 13 | 14 | 0 | 11 | 3 | 8
9 | 14 | 15 | 5 | 2 | 8 | 12 | 3 | 7 | 0 | 4 | 10 | 1 | 13 | 11 | 6
4 | 3 | 2 | 12 | 9 | 5 | 15 | 10 | 11 | 14 | 1 | 7 | 6 | 0 | 8 | 13

S7
4 | 11 | 2 | 14 | 15 | 0 | 8 | 13 | 3 | 12 | 9 | 7 | 5 | 10 | 6 | 1
13 | 0 | 11 | 7 | 4 | 9 | 1 | 10 | 14 | 3 | 5 | 12 | 2 | 15 | 8 | 6
1 | 4 | 11 | 13 | 12 | 3 | 7 | 14 | 10 | 15 | 6 | 8 | 0 | 5 | 9 | 2
6 | 11 | 13 | 8 | 1 | 4 | 10 | 7 | 9 | 5 | 0 | 15 | 14 | 2 | 3 | 12

S8
13 | 2 | 8 | 4 | 6 | 15 | 11 | 1 | 10 | 9 | 3 | 14 | 5 | 0 | 12 | 7
1 | 15 | 13 | 8 | 10 | 3 | 7 | 4 | 12 | 5 | 6 | 11 | 0 | 14 | 9 | 2
7 | 11 | 4 | 1 | 9 | 12 | 14 | 2 | 0 | 6 | 10 | 13 | 15 | 3 | 5 | 8
2 | 1 | 14 | 7 | 4 | 10 | 8 | 13 | 15 | 12 | 9 | 0 | 3 | 5 | 6 | 11

P
16 | 7 | 20 | 21
29 | 12 | 28 | 17
1 | 15 | 23 | 26
5 | 18 | 31 | 10
2 | 8 | 24 | 14
32 | 27 | 3 | 9
19 | 13 | 30 | 6
22 | 11 | 4 | 25

Finally, we need to describe the computation of the key schedule from the key K. Actually, K is a bitstring of length 64, of which 56 bits comprise the key and 8 bits are parity-check bits (for error-detection). The bits in positions 8, 16, . . . , 64 are defined so that each byte contains an odd number of 1’s. Hence, a single error can be detected within each group of 8 bits. The parity-check bits are ignored in the computation of the key schedule.

1. Given a 64-bit key K, discard the parity-check bits and permute the remaining bits of K according to a (fixed) permutation PC-1. We will write PC-1 (K) = C0D0, where C0 comprises the first 28 bits of PC-1(K) and D0 the last 28 bits.
2. For i ranging from 1 to 16, compute

and Ki = PC-2(CiDi). LSi represents a cyclic shift (to the left) of either one or two positions, depending on the value of i: shift one position if i = 1, 2, 9 or 16, and shift two positions otherwise. PC-2 is another fixed permutation.

The key schedule computation is depicted in Figure 3.3.

The permutations PC-1 and PC-2 used in the key schedule computation are as follows:

PC-1
57 | 49 | 41 | 33 | 25 | 17 | 9
1 | 58 | 50 | 42 | 34 | 26 | 18
10 | 2 | 59 | 51 | 43 | 35 | 27
19 | 11 | 3 | 60 | 52 | 44 | 36
63 | 55 | 47 | 39 | 31 | 23 | 15
7 | 62 | 54 | 46 | 38 | 30 | 22
14 | 6 | 61 | 53 | 45 | 37 | 29
21 | 13 | 5 | 28 | 20 | 12 | 4

Figure 3.3 Computation of DES key schedule

PC-2
14 | 17 | 11 | 24 | 1 | 5
3 | 28 | 15 | 6 | 21 | 10
23 | 19 | 12 | 4 | 26 | 8
16 | 7 | 27 | 20 | 13 | 2
41 | 52 | 31 | 37 | 47 | 55
30 | 40 | 51 | 45 | 33 | 48
44 | 49 | 39 | 56 | 34 | 53
46 | 42 | 50 | 36 | 29 | 32

We now display the resulting key schedule. As mentioned above, each round uses a 48-bit key comprised of 48 of the bits in K. The entries in the tables below refer to the bits in K that are used in the various rounds.

Round 1
10 | 51 | 34 | 60 | 49 | 17 | 33 | 57 | 2 | 9 | 19 | 42
3 | 35 | 26 | 25 | 44 | 58 | 59 | 1 | 36 | 27 | 18 | 41
22 | 28 | 39 | 54 | 37 | 4 | 47 | 30 | 5 | 53 | 23 | 29
61 | 21 | 38 | 63 | 15 | 20 | 45 | 14 | 13 | 62 | 55 | 31

Round 2
2 | 43 | 26 | 52 | 41 | 9 | 25 | 49 | 59 | 1 | 11 | 34
60 | 27 | 18 | 17 | 36 | 50 | 51 | 58 | 57 | 19 | 10 | 33
14 | 20 | 31 | 46 | 29 | 63 | 39 | 22 | 28 | 45 | 15 | 21
53 | 13 | 30 | 55 | 7 | 12 | 37 | 6 | 5 | 54 | 47 | 23

Round 3
51 | 27 | 10 | 36 | 25 | 58 | 9 | 33 | 43 | 50 | 60 | 18
44 | 11 | 2 | 1 | 49 | 34 | 35 | 42 | 41 | 3 | 59 | 17
61 | 4 | 15 | 30 | 13 | 47 | 23 | 6 | 12 | 29 | 62 | 5
37 | 28 | 14 | 39 | 54 | 63 | 21 | 53 | 20 | 38 | 31 | 7

Round 4
35 | 11 | 59 | 49 | 9 | 42 | 58 | 17 | 27 | 34 | 44 | 2
57 | 60 | 51 | 50 | 33 | 18 | 19 | 26 | 25 | 52 | 43 | 1
45 | 55 | 62 | 14 | 28 | 31 | 7 | 53 | 63 | 13 | 46 | 20
21 | 12 | 61 | 23 | 38 | 47 | 5 | 37 | 4 | 22 | 15 | 54

Round 5
19 | 60 | 43 | 33 | 58 | 26 | 42 | 1 | 11 | 18 | 57 | 51
41 | 44 | 35 | 34 | 17 | 2 | 3 | 10 | 9 | 36 | 27 | 50
29 | 39 | 46 | 61 | 12 | 15 | 54 | 37 | 47 | 28 | 30 | 4
5 | 63 | 45 | 7 | 22 | 31 | 20 | 21 | 55 | 6 | 62 | 38

Round 6
3 | 44 | 27 | 17 | 42 | 10 | 26 | 50 | 60 | 2 | 41 | 35
25 | 57 | 19 | 18 | 1 | 51 | 52 | 59 | 58 | 49 | 11 | 34
13 | 23 | 30 | 45 | 63 | 62 | 38 | 21 | 31 | 12 | 14 | 55
20 | 47 | 29 | 54 | 6 | 15 | 4 | 5 | 39 | 53 | 46 | 22

Round 7
52 | 57 | 11 | 1 | 26 | 59 | 10 | 34 | 44 | 51 | 25 | 19
9 | 41 | 3 | 2 | 50 | 35 | 36 | 43 | 42 | 33 | 60 | 18
28 | 7 | 14 | 29 | 47 | 46 | 22 | 5 | 15 | 63 | 61 | 39
4 | 31 | 13 | 38 | 53 | 62 | 55 | 20 | 23 | 37 | 30 | 6

Round 8
36 | 41 | 60 | 50 | 10 | 43 | 59 | 18 | 57 | 35 | 9 | 3
58 | 25 | 52 | 51 | 34 | 19 | 49 | 27 | 26 | 17 | 44 | 2
12 | 54 | 61 | 13 | 31 | 30 | 6 | 20 | 62 | 47 | 45 | 23
55 | 15 | 28 | 22 | 37 | 46 | 39 | 4 | 7 | 21 | 14 | 53

Round 9
57 | 33 | 52 | 42 | 2 | 35 | 51 | 10 | 49 | 27 | 1 | 60
50 | 17 | 44 | 43 | 26 | 11 | 41 | 19 | 18 | 9 | 36 | 59
4 | 46 | 53 | 5 | 23 | 22 | 61 | 12 | 54 | 39 | 37 | 15
47 | 7 | 20 | 14 | 29 | 38 | 31 | 63 | 62 | 13 | 6 | 45

Round 10
41 | 17 | 36 | 26 | 51 | 19 | 35 | 59 | 33 | 11 | 50 | 44
34 | 1 | 57 | 27 | 10 | 60 | 25 | 3 | 2 | 58 | 49 | 43
55 | 30 | 37 | 20 | 7 | 6 | 45 | 63 | 38 | 23 | 21 | 62
31 | 54 | 4 | 61 | 13 | 22 | 15 | 47 | 46 | 28 | 53 | 29

Round 11
25 | 1 | 49 | 10 | 35 | 3 | 19 | 43 | 17 | 60 | 34 | 57
18 | 50 | 41 | 11 | 59 | 44 | 9 | 52 | 51 | 42 | 33 | 27
39 | 14 | 21 | 4 | 54 | 53 | 29 | 47 | 22 | 7 | 5 | 46
15 | 38 | 55 | 45 | 28 | 6 | 62 | 31 | 30 | 12 | 37 | 13

Round 12
9 | 50 | 33 | 59 | 19 | 52 | 3 | 27 | 1 | 44 | 18 | 41
2 | 34 | 25 | 60 | 43 | 57 | 58 | 36 | 35 | 26 | 17 | 11
23 | 61 | 5 | 55 | 38 | 37 | 13 | 31 | 6 | 54 | 20 | 30
62 | 22 | 39 | 29 | 12 | 53 | 46 | 15 | 14 | 63 | 21 | 28

Round 13
58 | 34 | 17 | 43 | 3 | 36 | 52 | 11 | 50 | 57 | 2 | 25
51 | 18 | 9 | 44 | 27 | 41 | 42 | 49 | 19 | 10 | 1 | 60
7 | 45 | 20 | 39 | 22 | 21 | 28 | 15 | 53 | 38 | 4 | 14
46 | 6 | 23 | 13 | 63 | 37 | 30 | 62 | 61 | 47 | 5 | 12

Round 14
42 | 18 | 1 | 27 | 52 | 49 | 36 | 60 | 34 | 41 | 51 | 9
35 | 2 | 58 | 57 | 11 | 25 | 26 | 33 | 3 | 59 | 50 | 44
54 | 29 | 4 | 23 | 6 | 5 | 12 | 62 | 37 | 22 | 55 | 61
30 | 53 | 7 | 28 | 47 | 21 | 14 | 46 | 45 | 31 | 20 | 63

Round 15
26 | 2 | 50 | 11 | 36 | 33 | 49 | 44 | 18 | 25 | 35 | 58
19 | 51 | 42 | 41 | 60 | 9 | 10 | 17 | 52 | 43 | 34 | 57
38 | 13 | 55 | 7 | 53 | 20 | 63 | 46 | 21 | 6 | 39 | 45
14 | 37 | 54 | 12 | 31 | 5 | 61 | 30 | 29 | 15 | 4 | 47

Round 16
18 | 59 | 42 | 3 | 57 | 25 | 41 | 36 | 10 | 17 | 27 | 50
11 | 43 | 34 | 33 | 52 | 1 | 2 | 9 | 44 | 35 | 26 | 49
30 | 5 | 47 | 62 | 45 | 12 | 55 | 38 | 13 | 61 | 31 | 37
6 | 29 | 46 | 4 | 23 | 28 | 53 | 22 | 21 | 7 | 63 | 39

Decryption is done using the same algorithm as encryption, starting with y as the input, but using the key schedule K16, . . . , K1 in reverse order. The output will be the plaintext x.


3.2.1 An Example of DES Encryption

Here is an example of encryption using the DES. Suppose we encrypt the (hexadecimal) plaintext

0123456789ABCDEF

using the (hexadecimal) key

133457799BBCDFF1.

The key, in binary, without parity-check bits, is

00010010011010010101101111001001101101111011011111111000.

Applying IP, we obtain L0 and R0 (in binary):

The 16 rounds of encryption are then performed, as indicated.

Finally, applying IP-1 to R16L16, we obtain the ciphertext, which (in hexadecimal form) is:

85E813540F0AB405.


3.3 The DES Controversy

When DES was proposed as a standard, there was considerable criticism. One objection to DES concerned the S-boxes. All computations in DES, with the exception of the S-boxes, are linear, e.g., computing the exclusive-or of two outputs is the same as forming the exclusive-or of two inputs and then computing the output. The S-boxes, being the non-linear component of the cryptosystem, are vital to its security (We saw in Chapter 1 how linear cryptosystems, such as the Hill Cipher, could easily be cryptanalyzed by a known plaintext attack.) However, the design criteria of the S-boxes are not completely known. Several people have suggested that the S-boxes might contain hidden “trapdoors” which would allow the National Security Agency to decrypt messages while maintaining that DES is “secure.” It is, of course, impossible to disprove such an assertion, but no evidence has come to light that indicates that trap-doors in DES do in fact exist.

In 1976, the National Security Agency (NSA) asserted that the following properties of the S-boxes are design criteria:

P0 Each row of each S-box is a permutation of the integers 0, . . . , 15.
P1 No S-box is a linear or affine function of its inputs.
P2 Changing one input bit to an S-box causes at least two output bits to change.
P3 For any S-box and any input x, S(x) and S(x ? 001100) differ in at least two bits (here x is a bitstring of length 6).

Two other properties of the S-boxes were designated as “caused by design criteria” by NSA.

P4 For any S-box, for any input x, and for e, f ? {0, 1}, S(x) ? S(x ? 11ef00).
P5 For any S-box, if one input bit is fixed, and we look at the value of one fixed output bit, the number of inputs for which this output bit equals 0 will be “close to” the number of inputs for which the output bit equals 1. (Note that if we fix the value of either the first or sixth input bit, then 16 inputs will cause a particular output bit to equal 0 and 16 inputs will cause the output to equal 1. For the second through fifth input bits, this will not be true, but the resulting distribution will be “close to” uniform. More precisely, for any S-box, if the value of any input bit is fixed, then the number of inputs for which any fixed output bit has the value 0 (or 1) is always between 13 and 19.)

It is not publicly known if further design criteria were used in the construction of the S-boxes.

The most pertinent criticism of DES is that the size of the keyspace, 256, is too small to be really secure. Various special-purpose machines have been proposed for a known plaintext attack, which would essentially perform an exhaustive search for the key. That is given a 64-bit plaintext x and corresponding ciphertext y, every possible key would be tested until a key K such that eK (x) = y is found (and note that there may be more than one such key K).

As early as 1977, Diffie and Hellman suggested that one could build a VLSI chip which could test 106 keys per second. A machine with 106 chips could search the entire key space in about a day. They estimated that such a machine could be built for about $20,000,000.

At the CRYPTO ’93 Rump Session, Michael Wiener gave a very detailed design of a key search machine. The machine is based on a key search chip which is pipelined, so that 16 encryptions take place simultaneously. This chip can test 5 ? 107 keys per second, and can be built using current technology for $10.50 per chip. A frame consisting of 5760 chips can be built for $100,000. This would allow a DES key to be found in about 1.5 days on average. A machine using 10 frames would cost $1,000,000, but would reduce the average search time to about 3.5 hours.


3.4 DES in Practice

Even though the description of DES is quite lengthy, it can be implemented very efficiently, either in hardware or in software. The only arithmetic operations to be performed are exclusive-ors of bitstrings. The expansion function E, the S-boxes, the permutations IP and P, and the computation of K1, K2, . . . , K16 can all be done in constant time by table look-up (in software) or by hard-wiring them into a circuit.

Current hardware implementations can attain extremely fast encryption rates. Digital Equipment Corporation announced at CRYPTO ’92 that they have fabricated a chip with 50K transistors that can encrypt at the rate of 1 Gbit/second using a clock rate of 250 MHz! The cost of this chip is about $300. As of 1991, there were 45 hardware and firmware implementations of DES that had been validated by the National Bureau of Standards.

One very important application of DES is in banking transactions, using standards developed by the American Bankers Association. DES is used to encrypt personal identification numbers (PINs) and account transactions carried out by automated teller machines (ATMs). DES is also used by the Clearing House Interbank Payments System (CHIPS) to authenticate transactions involving over $1.5 ? 1012 per week.

DES is also widely used in government organizations, such as the Department of Energy, the Justice Department, and the Federal Reserve System.


3.4.1 DES Modes of Operation

Four modes of operation have been developed for DES: electronic codebook mode (ECB), cipher feedback mode (CFB), cipher block chaining mode (CBC) and output feedback mode (OFB).

ECB mode corresponds to the usual use of a block cipher: given a sequence x1x2 . . . of 64-bit plaintext blocks, each xi is encrypted with the same key K, producing a string of ciphertext blocks, y1y2 . . ..

In CBC mode, each ciphertext block yi is x-ored with the next plaintext block xi+1 before being encrypted with the key K. More formally, we start with a 64-bit initialization vector IV, and define y0 = IV. Then we construct y1, y2, . . . from the rule yi = eK(yi-1 ? xi), i ? 1. The use of CBC mode is depicted in Figure 3.4.

Figure 3.4 CBC mode

Figure 3.5 CFB mode

In OFB and CFB modes, a keystream is generated which is then x-ored with the plaintext (i.e., it operates as a stream cipher, cf. Section 1.1.7). OFB is actually a synchronous stream cipher: the keystream is produced by repeatedly encrypting a 64-bit initialization vector, IV. We define z0 = IV, and then compute the keystream z1z2 . . . from the rule zi = eK(zi-1), i ? 1. The plaintext sequence x1x2 . . . is then encrypted by computing yi = xi ? zi, i ? 1.

In CFB mode, we start with y0 = IV (a 64-bit initialization vector) and we produce the keystream element zi by encrypting the previous ciphertext block. That is, zi = eK (yi-1), i? 1. As in OFB mode, yi = xi ? zi, i ? 1. The use of CFB is depicted in Figure 3.5 (note that the DES encryption function eK is used for both encryption and decryption in CFB and OFB modes).

There are also variations of OFB and CFB mode called k-bit feedback modes (1 ? k ? 64). We have described the 64-bit feedback modes here. 1-bit and 8-bit feedback modes are often used in practice for encrypting data one bit (or byte) at a time.

The four modes of operation have different advantages and disadvantages. In ECB and OFB modes, changing one 64-bit plaintext block, xi, causes the corresponding ciphertext block, yi, to be altered, but other ciphertext blocks are not affected. In some situations this might be a desirable property. For example, OFB mode is often used to encrypt satellite transmissions.

On the other hand, if a plaintext block xi is changed in CBC and CFB modes, then yi and all subsequent ciphertext blocks will be affected. This property means that CBC and CFB modes are useful for purposes of authentication. More specifically, these modes can be used to produce a message authentication code, or MAC. The MAC is appended to a sequence of plaintext blocks, and is used to convince Bob that the given sequence of plaintext originated with Alice and was not tampered with by Oscar. Thus the MAC guarantees the integrity (or authenticity) of a message (but it does not provide secrecy, of course).

We will describe how CBC mode is used to produce a MAC. We begin with the initialization vector IV consisting of all zeroes. Then construct the ciphertext blocks y1, . . . , yn with key K, using CBC mode. Finally, define the MAC to be yn. Then Alice transmits the sequence of plaintext blocks, x1 . . . xn, along with the MAC. When Bob receives x1, . . . xn, he can reconstruct y1, . . . , yn using the (secret) key K, and verify that yn is the same as the MAC that he received.

Note that Oscar cannot produce a valid MAC since he does not know the key K being used by Alice and Bob. Further, if Oscar intercepts a sequence of plaintext blocks x1 . . . xn, and changes one or more of them, then it is highly unlikely that Oscar can change the MAC so that it will be accepted by Bob.

It is often desirable to combine authenticity and secrecy. This could be done as follows: Alice first uses key K1 to produce a MAC for x1 . . . xn. Then she defines xn+1 to be the MAC, and she encrypts the sequence x1 . . . xn+1 using a second key, K2, yielding y1 . . . yn+1. When Bob receives y1 . . . yn+1, he first decrypts (using K2) and then checks that xn+1 is the MAC for x1 . . . xn using K1.

Alternatively, Alice could use K1 to encrypt x1 . . . xn, obtaining y1 . . . yn, and then use K2 to produce a MAC yn+1 for y1 . . . yn. Bob would use K2 to verify the MAC, and then use K1 to decrypt y1 . . . yn.


3.5 A Time-memory Trade-off

In this section, we describe an interesting time-memory tradeoff for a chosen plaintext attack. Recall that in a chosen plaintext attack, Oscar obtains a plaintext-ciphertext pair produced using the (unknown) key K. So Oscar has x and y, where y = eK(x), and he wants to determine K.

A feature of this time-memory trade-off is that it does not depend on the “structure” of DES in any way. The only aspects of DES that are relevant to the attack are that plaintexts and ciphertexts have 64 bits, while keys have 56 bits.

Figure 3.6 Computation of X (i, j)

We have already discussed the idea of exhaustive search: given a plaintext-ciphertext pair, try all 256 possible keys. This requires no memory but, on average, 255 keys will be tried before the correct one is found. On the other hand, for a given plaintext x, Oscar could precompute yK = eK(x) for all 256 keys K, and construct a table of ordered pairs (yK, K), sorted by their first coordinates. At a later time, when Oscar obtains the ciphertext y which is an encryption of plaintext x, he looks up the value y in the table, immediately obtaining the key K. Now the actual determination of the key requires only constant time, but we have a large memory requirement and a large precomputation time. (Note that this approach would yield no advantage in total computation time if only one key is to be found, since constructing the table takes at least as much time as an exhaustive search. The advantage occurs when several keys are to be found over a period of time, since the same table can be used in each case.)

The time-memory trade-off combines a smaller computation time than exhaustive search with a smaller memory requirement than table look-up. The algorithm can be described in terms of two parameters m and t, which are positive integers. The algorithm requires a reduction function R which reduces a bitstring of length 64 to one of length 56. (R might just discard eight of the 64 bits, for example.) Let x be a fixed plaintext string of length 64. Define the function [image] for a bitstring K0 of length 56. Note that g is a function that maps 56 bits to 56 bits.

In the pre-processing stage, Oscar chooses m random bitstrings of length 56, denoted X (i, 0), 1 ? i ? m. Oscar computes X(i, j) for 1 ? j ? t according to the recurrence relation X(i, j) = g (X(i, j - 1)), 1 ? i ? m, 1 ? j ? t, as indicated in Figure 3.6.

Then Oscar constructs a table of ordered pairs T = (X(i, t), X(i, 0)), sorted by their first coordinate (i.e., only the first and last columns of X are stored).

At a later time, Oscar obtains a ciphertext y which is an encryption of the chosen plaintext x (as before). He again wants to determine K. He is going to determine if K is in the first t columns of the array X, but he will do this by looking only at the table T.

Figure 3.7 DES time-memory trade-off

Suppose that K = X (i, t -j) for some j, 1 ? j ? t (i.e., suppose that K is in the first t columns of X). Then it is clear that gj (K) = X (i, t), where gj denotes the function obtained by iterating g, j times. Now, observe that

Suppose we compute yj, 1 ? j ? t, from the recurrence relation

Then it follows that yj = X(i, t) if K = X(i, t - j). However, note that yj = X(i, t) is not sufficient to ensure that K = X(i, t - j). This is because the reduction function R is not an injection: The domain of R has cardinality 264 and the range of R has cardinality 256, so, on average, there are 28 = 256 pre-images of any given bitstring of length 56. So we need to check whether y = eX(i,t - j) (x), to see if X(i, t - j) is indeed the key. We did not store the value X(i, t - j), but we can easily re-compute it from X(i, 0) by iterating the g function t - j times.

Oscar proceeds according to the algorithm presented in Figure 3.7.

By analyzing the probability of success for the algorithm, it can be shown that if [image], then the probability that K = X(i,t - j) for some i, j is about 0.8mt/N. The factor 0.8 accounts for the fact that the numbers X(i,t) may not all be distinct. It is suggested that one should take [image] and construct about N1/3 tables, each using a different reduction function R. If this is done, the memory requirement is 112 ? N2/3 bits (since we need to store 2 ? N2/3 integers, each of which has 56 bits). The precomputation time is easily seen to be O(N).

The running time is a bit more dificult to analyze. First, note that step 3 can be implemented to run in (expected) constant time (using hash coding) or (worst-case) time O(log m) using a binary search. If step 3 is never satisfied (i.e., the search fails), then the running time is O(N2/3). A more detailed analysis shows that even when the running time of steps 4 and 5 is taken into account, the expected running time increases by only a constant factor.


3.6 Differential Cryptanalysis

One very well-known attack on DES is the method of “differential cryptanalysis” introduced by Biham and Shamir. This is a chosen-plaintext attack. Although it does not provide a practical method of breaking the usual 16-round DES, it does succeed in breaking DES if the number of rounds of encryption is reduced. For instance, 8-round DES can be broken in only a couple of minutes on a small personal computer.

We will now describe the basic ideas used in this technique. For the purposes of this attack, we can ignore the initial permutation IP and its inverse (it has no effect on cryptanalysis). As mentioned above, we consider DES restricted to n rounds, for various values of n ? 16. So, in this setting, we will regard L0R0 as the plaintext, and LnRn as the ciphertext, in an n-round DES. (Note also that we are not inverting LnRn.)

Differential cryptanalysis involves comparing the x-or (exclusive-or) of two plaintexts to the x-or of the corresponding two ciphertexts. In general, we will be looking at two plaintexts L0R0 and [image] with a specified x-or value [image]. Throughout this discussion, we will use prime markings (?) to indicate the x-or of two bitstrings.

DEFINITION 3.1 Let Sj be a particular S-box (1 ? j ? 8). Consider an (ordered) pair of bitstrings of length six, say [image]. We say that the input x-or (of Sj) is [image] and the output x-or (of Sj) is [image].

Note that an input x-or is a bitstring of length six and an output x-or is a bitstring of length four.

DEFINITION 3.2 For any [image], define the set [image] to consist of the ordered pairs [image] having input x-or [image].

It is easy to see that any set [image] contains 26 = 64 pairs, and that

For each pair in [image], we can compute the output x-or of Sj and tabulate the resulting distribution. There are 64 output x-ors, which are distributed among 24 = 16 possible values. The non-uniformity of these distributions will be the basis for the attack.

Example 3.1

Suppose we consider the first S-box, S1, and the input x-or 110100. Then

For each ordered pair in the set ?(110100), we compute output x-or of S1. For example, S1(000000) = E16 = 1110 and S1(110100) = 916 = 1001, so the output x-or for the pair (000000, 110100) is 0111.

If this is done for all 64 pairs in ?(110100), then the following distribution of output x-ors is obtained:

In Example 3.1, only eight of the 16 possible output x-ors actually occur. This particular example has a very non-uniform distribution. In general, if we fix an S-box Sj and an input x-or [image], then on average, it turns out that about 75 - 80% of the possible output x-ors actually occur.

It will be convenient to have some notation to describe these distributions and how they arise, so we make the following definitions.

DEFINITION 3.3 For 1 ? j ? 8, and for bitstrings [image] of length six and [image] of length four, define

and

Figure 3.8 Possible inputs with input x-or 110100

counts the number of pairs with input x-or equal to [image] which have output x-or equal to [image] for the S-box Sj. The actual pairs having the specified input x-ors and giving rise to the specified output x-ors can be obtained from the set [image]. Observe that this set can be partitioned into [image] pairs, each of which has (input) x-or equal to [image].

Observe that the distribution tabulated in Example 3.1 consists of the values [image]. The sets [image] are listed in Figure 3.8.

For each of the eight S-boxes, there are 64 possible input x-ors. Thus, there are 512 distributions which can be computed. These could easily be tabulated by computer.

Recall that the input to the S-boxes in round i is formed as B = E ? J, where E = E(Ri-1) is the expansion of Ri-1 and J = Ki consists of the key bits for round i. Now, the input x-or (for all eight S-boxes) can be computed as follows:

It is very important to observe that the input x-or does not depend on the key bits J. (However, the output x-or certainly does depend on these key bits.)

We will write each of B, E and J as the concatenation of eight 6-bit strings:

and we write B* and E* in a similar way. Let us suppose for the moment that we know the values Ej and [image] for some j, 1 ? j ? 8, and the value of the output x-or for [image]. Then it must be the case that

where [image].

Suppose we define a set testj as follows:

DEFINITION 3.4 Suppose Ej and [image] are bitstrings of length six, and [image] is a bitstring of length four. Define

where [image].

That is, we take the x-or of Ej with every element of the set [image].

The following result is an immediate consequence of the discussion above.

THEOREM 3.1

Suppose Ej and [image] are two inputs to the S-box Sj, and the output x-or for Sj is [image]. Denote [image]. Then the key bits Jj occur in the set testj [image].

Observe that there will be exactly [image] bitstrings of length six in the set testj [image]; the correct value of Jj must be one of these possibilities.

Example 3.2

Suppose [image]. Since N1 (110100, 1101) = 8, there will be exactly eight bitstrings in the set test1 (000001, 110101, 1101). From Figure 3.8, we see that

Hence,

If we have a second such triple [image], then we can obtain a second set test1 of possible values for the keybits in J1. The true value of J1 must be in the intersection of both sets. If we have several such triples, then we can quickly determine the key bits in J1. One straightforward way to do this is to maintain an array of 64 counters, representing the 64 possibilities for the six key bits in J1. A counter is incremented every time the corresponding key bits occur in a set test1 for a particular triple. Given t triples, we hope to find a unique counter which has the value t; this will correspond to the true value of the keybits in J1.


3.6.1 An Attack on a 3-round DES

Let’s now see how the ideas of the previous section can be applied in a chosen plaintext attack of a 3-round DES. We will begin with a pair of plaintexts and corresponding ciphertexts: and [image]. We can express R3 as follows:

can be expressed in a similar way, and hence

Now, suppose we have chosen the plaintexts so that [image], i.e., so that

Figure 3.9 Differential attack on 3-round DES

Then [image] and so

At this point, [image] is known since it can be computed from the two ciphertexts, and [image] is known since it can be computed from the two plaintexts. This means that we can compute [image] from the equation

Now, f(R2, K3) = P(C) and [image], where C and C*, respectively, denote the two outputs of the eight S-boxes (recall that P is a fixed, publicly known permutation). Hence,

and consequently

This is the output x-or for the eight S-boxes in round three.

Now, R2 = L3 and [image] are also known (they are part of the ciphertexts). Hence, we can compute

and

using the publicly known expansion function E. These are the inputs to the S-boxes for round three. So, we now know E, E*, and C? for the third round, and we can proceed, as in the previous section, to construct the sets test1, . . ., test8 of possible values for the key bits in J1, . . . , J8.

A pseudo-code description of this algorithm is given in Figure 3.9. The attack will use several such triples E, E*, C?. We set up eight arrays of counters, and thereby determine the 48 bits in K3, the key for the third round. The 56 bits in the key can then be computed by an exhaustive search of the 28 = 256 possibilities for the remaining eight key bits.

Let’s look at an example to illustrate.

Example 3.3

Suppose we have the following three pairs of plaintexts and ciphertexts, where the plaintexts have the specified x-ors, that are encrypted using the same key. We use a hexadecimal representation, for brevity:

plaintext | ciphertxt
748502CD38451097 | 03C70306D8A09F10
3874756438451097 | 78560A0960E6D4CB
486911026ACDFF31 | 45FA285BE5ADC730
375BD31F6ACDFF31 | 134F7915AC253457
357418DA013FEC86 | D8A31B2F28BBC5CF
12549847013FEC86 | 0F317AC2B23CB944

From the first pair, we compute the S-box inputs (for round 3) from Equations (3.2) and (3.3). They are:

The S-box output x-or is calculated using Equation (3.1) to be:

From the second pair, we compute the S-box inputs to be

and the S-box output x-or is

From the third pair, the S-box inputs are

and the S-box output x-or is

Next, we tabulate the values in the eight counter arrays for each of the three pairs. We illustrate the procedure with the counter array for J1 from the first pair. In this pair, we have [image] and [image]. The set

Since E1 = 000000, we have that

Hence, we increment the values 0, 7, 40, and 47 in the counter array for J1.

The final tabulations are now presented. If we think of a bit-string of length six as being the binary representation of an integer between 0 and 63, then the 64 values correspond to the counts of 0, 1, . . . , 63. The counter arrays are as follows:

J1
1 | 0 | 0 | 0 | 0 | 1 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0
0 | 0 | 0 | 0 | 0 | 1 | 1 | 0 | 0 | 0 | 0 | 1 | 1 | 0 | 0 | 0
0 | 1 | 0 | 0 | 0 | 1 | 0 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 3
0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1

J2
0 | 0 | 0 | 1 | 0 | 3 | 0 | 0 | 1 | 0 | 0 | 1 | 0 | 0 | 0 | 0
0 | 1 | 0 | 0 | 0 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 | 0 | 0
0 | 0 | 0 | 0 | 0 | 1 | 0 | 0 | 1 | 0 | 1 | 0 | 0 | 0 | 1 | 0
0 | 0 | 1 | 1 | 0 | 0 | 0 | 0 | 1 | 0 | 1 | 0 | 2 | 0 | 0 | 0

J3
0 | 0 | 0 | 0 | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0
0 | 0 | 0 | 3 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 1
0 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 1 | 0 | 0
0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 1 | 0 | 0 | 0

J4
3 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 2 | 2 | 0 | 0 | 0 | 0
0 | 0 | 0 | 0 | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 | 1 | 1
1 | 1 | 1 | 0 | 1 | 0 | 0 | 0 | 0 | 1 | 1 | 1 | 0 | 0 | 1 | 0
0 | 0 | 0 | 0 | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 2 | 1

J5
0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 | 0 | 0 | 1 | 0 | 0 | 0 | 0 | 0
0 | 0 | 0 | 0 | 2 | 0 | 0 | 0 | 3 | 0 | 0 | 0 | 0 | 0 | 0 | 0
0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0
0 | 0 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 | 0 | 0 | 0 | 2 | 0

J6
1 | 0 | 0 | 1 | 1 | 0 | 0 | 3 | 0 | 0 | 0 | 0 | 1 | 0 | 0 | 1
0 | 0 | 0 | 0 | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0
0 | 0 | 0 | 0 | 1 | 1 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0
1 | 0 | 0 | 1 | 1 | 0 | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0

J7
0 | 0 | 2 | 1 | 0 | 1 | 0 | 3 | 0 | 0 | 0 | 1 | 1 | 0 | 0 | 0
0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 | 0 | 0 | 1
0 | 0 | 2 | 0 | 0 | 0 | 2 | 0 | 0 | 0 | 0 | 1 | 2 | 1 | 1 | 0
0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 | 0 | 0 | 1 | 1

J8
0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0
0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0
0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 | 1 | 0 | 0 | 1 | 0 | 1
0 | 3 | 0 | 0 | 0 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0

In each of the eight counter arrays, there is a unique counter having the value 3. The positions of these counters determine the key bits in J1, . . . , J8. These positions are (respectively): 47, 5, 19, 0, 24, 7, 7, 49. Converting these integers to binary, we obtain J1, . . . , J8:

J1 = 101111
J2 = 000101
J3 = 010011
J4 = 000000
J5 = 011000
J6 = 000111
J7 = 000111
J8 = 110001.

We can now construct 48 bits of the key, by looking at the key schedule for round 3. It follows that K has the form

0001101 | 0110001 | 01?01?0 | 1?00100
0101001 | 0000??0 | 111?11? | ?100011

where parity bits are omitted and “?” denotes an unknown key bit. The complete key (in hexadecimal, including parity bits), is:

1A624C89520DEC46.


3.6.2 An Attack on a 6-round DES

We now describe an extension of these ideas to a probabilistic attack on a 6-round DES. The idea is to carefully choose a pair of plaintexts with a specified x-or, and then to determine the probabilities of a specified sequence of x-ors through the rounds of encryption. We need to define an important concept now.

DEFINITION 3.5 Let n ? 1 be an integer. An n-round characteristic is a list of the form

which satisfies the following properties:

1. .
2. Let 1 ? i ? n, and let Li-1, Ri-1 and [image] be chosen such that [image] and [image]. Suppose Li, Ri and [image] are computed by applying one round of DES encryption. Then the probability that [image] and [image] is precisely pi. (Note that this probability is computed over all possible 48-tuples J = J1 . . . J8.)

The probability of the characteristic is defined to be the product p = p1 ? . . . ? pn.

REMARK Suppose we choose L0, R0 and [image] so that [image] and [image] and we apply n rounds of DES encryption, obtaining L1, . . . , Ln and R1, . . . ,Rn. Then we cannot claim that the probability that [image] and [image] for all i (1 ? i ? n) is p1 ? . . . ? pn. This is because the 48-tuples in the key schedule K1, . . . . , Kn, are not mutually independent. (If these n 48-tuples were chosen independently at random, then the assertion would be true.) But we nevertheless expect p1 ? . . . ? pn to be a fairly accurate estimate of this probability.

We also need to recognize that the probabilities pi in a characteristic are defined with respect to an arbitrary (but fixed) pair of plaintexts having a specified x-or, where the 48 key bits for one round of DES encryption vary over all 248 possibilities. However, a cryptanalyst is attempting to determine a fixed (but unknown) key. He is going to choose plaintexts at random (such that they have specified x-ors), hoping that the probabilities that the x-ors during the n rounds of encryption agree with the x-ors specified in the characteristic are fairly close to p1, . . . pn, respectively.

As a simple example, we present in Figure 3.10 a 1-round characteristic which was the basis of the attack on the 3-round DES (as before, we use hexadecimal representations). We depict another 1-round characteristic in Figure 3.11.

Let’s look at the characteristic in Figure 3.11 in more detail. When f (R0, K1) and [image] are computed, the first step is to expand R0 and [image]. The resulting x-or of the two expansions is

Figure 3.10 A 1-round characteristic

Figure 3.11 Another 1-round characteristic

So the input x-or to S1 is 001100 and the input x-ors for the other seven S-boxes are all 000000. The output x-ors for S2 through S8 will all be 0000. The output x-or for S1 will be 1110 with probability 14/64 (since it can be computed that N1 (001100, 1110) = 14). So we obtain

with probability 14/64. Applying P, we get

which in hexadecimal is 0080820016. When this is x-ored with [image], we get the specified [image] with probability 14/64. Of course [image] always.

The attack on the 6-round DES is based on the 3-round characteristic given in Figure 3.12. In the 6-round attack, we will start with [image], L6R6 and [image], where we have chosen the plaintexts so that [image] and [image]. We can express R6 as follows:

Figure 3.12 A 3-round characteristic

can be expressed in a similar way, and hence we get

(Note the similarity with the 3-round attack.)

is known. From the characteristic, we estimate that [image] and [image] with probability 1/16. If this is in fact the case, then the input x-or for the S-boxes in round 4 can be computed by the expansion function to be:

The input x-ors for S2, S5, S6, S7 and S8 are all 000000, and hence the output x-ors are 0000 for these five S-boxes in round 4. This means that we can compute the output x-ors of these five S-boxes in round 6 from Equation (3.4). So, suppose we compute

where each Ci is a bitstring of length four. Then with probability 1/16, it will be the case that [image] and [image] are respectively the output x-ors of S2, S5, S6, S7 and S8 in round 6. The inputs to these S-boxes in round 6 can be computed to be E2, E5, E6, E7 and E8, and [image] and [image], where

and

can be computed from the ciphertexts, as indicated in Figure 3.13.

We would like to determine the 30 key bits in J2, J5, J6, J7 and J8 as we did in the 3-round attack. The problem is that the hypothesized output x-or for round 6 is correct only with probability 1/16. So 15/16 of the time we will obtain random garbage rather than possible key bits. We somehow need to be able to determine the correct key from the given data, 15/16 of which is incorrect. This might not seem very promising, but fortunately our prospects are not as bleak as they initially appear.

DEFINITION 3.6 Suppose [image] and [image]. We say that the pair of plaintexts L0R0 and [image] is right pair with respect to a characteristic if [image] and [image] for all i, 1 ? i ? n. The pair is defined to be a wrong pair, otherwise.

Figure 3.13 Differential attack on 6-round DES

We expect that about 1/16 of our pairs are right pairs and the rest are wrong pairs with respect to our 3-round characteristic.

Our strategy is to compute Ej, [image], and [image], as described above, and then to determine [image], for j = 2, 5, 6, 7, 8. If we start with a right pair, then the correct key bits for each Jj will be included in the set testj. If the pair is a wrong pair, then the value of [image] will be incorrect, and it seems reasonable to hypothesize that each set testj will be essentially random.

We can often identify a wrong pair by this method: If |testj| = 0, for any j ? {2, 5, 6, 7, 8}, then we necessarily have a wrong pair. Now, given a wrong pair, we might expect that the probability that |testj| = 0 for a particular j is approximately 1/5. This is a reasonable assumption since [image] and, as mentioned earlier, the probability that [image] is approximately 1/5. The probability that all five testj’s have positive cardinality is estimated to be [image], so the probability that at least one testj has zero cardinality is about .67. So we expect to eliminate about 2/3 of the wrong pairs by this simple observation, which we call the filtering operation. The proportion of right pairs that remain after filtering is approximately

Example 3.4

Suppose we have the following plaintext-ciphertext pair:

plaintext | ciphertext
86FA1C2B1F51D3BE | 1E23ED7F2F553971
C6F21C2B1B51D3BE | 296DE2B687AC6340

Observe that [image] and [image]. The S-box inputs and outputs for round 6 are computed to be the following:

Then, the sets testj are as follows:

We see that both test5 and test7 are empty sets, so this pair is a wrong pair and is discarded by the filtering operation.

Now suppose that we have a pair such that |testj| > 0 for j = 2, 5, 6, 7, 8, so that it survives the filtering operation. (Of course, we do not know if the pair is a right pair or a wrong pair.) We say that the bitstring J2J5J6J7J8 of length 30 is suggested by the pair if Jj ? testj for j = 2, 5, 6, 7, 8. The number of suggested bitstrings is

It is not unusual for the number of suggested bitstrings to be quite large (for example, greater than 80000).

Suppose we were to tabulate all the suggested bitstrings obtained from the N pairs that were not discarded by the filtering operation. For every right pair, the correct bitstring J2J5J6J7J8 will be a suggested bitstring. This correct bitstring will be counted about 3N/16 times. Incorrect bitstrings should occur much less often, since they will occur essentially at random and there are 230 possibilities (a very large number).

It would get extremely unwieldy to tabulate all the suggested bitstrings, so we use an algorithm that requires less space and time. We can encode any testj as a vector Tj of length 64, where the ith coordinate of Tj is set to 1 (for 0 ? i ? 63) if the bitstring of length six that is the binary representation of i is in the set testj; and the ith coordinate is set to 0 otherwise (this is essentially the same as the counter array representation that we used in the 3-round attack).

For each remaining pair, construct these vectors as described above, and name them [image], j = 2, 5, 6, 7, 8, 1 ? i ? N. For I ? {1, . . . , N}, we say that I is allowable if for each j ? {2, 5, 6, 7, 8}, there is at least one coordinate equal to |I| in the vector

If the ith pair is a right pair for every i ? I, then the set I is allowable. Hence, we expect there to be an allowable set of size (approximately) 3N/16, which we hope will suggest the correct key bits and no other. It is a simple matter to construct all the allowable sets I by means of a recursive algorithm.

Example 3.5

We did some computer runs to test this approach. A random sample of 120 pairs of plaintexts with the specified x-ors was generated, and these were encrypted using the same (random) key. We present the 120 pairs of ciphertexts and corresponding plaintexts in hexadecimal form in Table 3.1.

When we compute the allowable sets, we obtain ni allowable sets of cardinality i, for the following values:

The unique allowable set of size 10 is

In fact, it does arise from the 10 right pairs. This allowable set suggests the correct key bits for J2, J5, J6, J7 and J8 and no others. They are as follows:

Figure 3.14 Another 3-round characteristic

Note that all the allowable sets of cardinality at least 6, and all but three of the allowable sets of cardinality 5, arise from right pairs, since [image] and [image] for 6 ? i ? 10.

This method yields 30 of the 56 key bits. By means of a different 3-round characteristic, presented in Figure 3.14, it is possible to compute 12 further key bits, namely those in J1 and J4. Now only 14 key bits remain unknown. Since 214 = 16384 is quite small, an exhaustive search can be used to determine the remaining 14 key bits.

The entire key (in hexadecimal, including parity-check bits) is:

34E9F71A20756231.

As mentioned above, the 120 pairs are given in Table 3.1. In the second column, a * denotes that a pair is a right pair, while a ** denotes that the pair is an identifiable wrong pair and is discarded by the filtering operation. Of the 120 pairs, 73 are identified as being wrong pairs by the filtering process, so 47 pairs remain as “possible” right pairs.


3.6.3 Other examples of Differential Cryptanalysis

Differential cryptanalysis techniques can be used to attack DES with more than six rounds. An 8-round DES requires 214 chosen plaintexts, and 10-, 12-, 14- and 16-round DESs can be broken with 224, 231, 239 and 247 chosen plaintexts, respectively. The attacks on more than 10 rounds are probably not practical at this time.

Several substitution-permutation product ciphers other than DES are also susceptible (to varying degrees) to differential cryptanalysis. These cryptosystems include several substitution-premutation cryptosystems that have been proposed in recent years, such as FEAL, REDOC-II, and LOKI.

Table 3.1 Cryptanalysis of 6-round DES
pair right pair? plaintext ciphertext
1 ** 86FA1C2B1F51D3BE
C6F21C2B1B51D3BE 		1E23ED7F2F553971
296DE2B687AC6340
2 ** EDC439EC935E1ACD
ADCC39EC975E1ACD 		0F847EFE90466588
93E84839F374440B
3 ** 9468A0BE00166155
D460A0BE04166155 		3D6A906A6566D0BF
3BC3B236398379E1
4 ** D4FF2B18A5A8AAC8
94F72B18A1A8AAC8 		26B14738C2556BA4
15753FDE86575A8F
5 09D0F2CF277AF54F
49D8F2CF237AF54F 		15751F4F11308114
6046A7C863F066AF
6 CBC7157240D415DF
8BCF157244D415DF 		7FCDC300FB9698E5
522185DD7E47D43A
7 0D4A1E84890981C1
4D421E848D0981C1 		E7C0B01E32557558
912C6341A69DF295
8 ** 6CE6B2A9B8194835
2CEEB2A9BC194835 		75D52E028A5C48A3
6C88603B48E5A8CE
9 ** 799F63C3C9322C1A
399763C3CD322C1A 		A6DA322B8F2444B5
6634AA9DF18307F4
10 ** 1B36645E381EDF48
5B3E645E3C1EDF48 		1F91E295D559091B
D094FC12C02C17CA
11 85CA13F50B4ADBB9
C5C213F50F4ADBB9 		ED108EE7397DDE0A
3F405F4A3E254714
12 ** 7963A8EFD15BC4A1
396BA8EFD55BC4A1 		8C714399715A33BA
C344C73CC97E4AC4
13 7BCFF7BCA455E65E
3BC7F7BCA055E65E 		475A2D0459BCCE62
8E94334AEF359EF8
14 0C505CEDB499218C
4C585CEDB099218C 		D3C66239E89CC076
9A316E801EE18EB1
15 6C5EA056CDC91A14
2C56A056C9C91A14 		BC7EBA159BCA94E6
67DB935C21FF1A8D
16 ** 6622A441A0D32415
262AA441A4D32415 		35F8616FEBA62883
4313E1925F5B64BC
17 C0333C994AFF1C99
803B3C994EFF1C99 		D46A4CF1C0221B11
D22B42DB150E2CE8
18 9E7B2974F00E1A6E
DE732974F40E1A6E 		172D286D9606E6FE
2217A91F8C427D27
19 ** CF592897BFD70C7E
8F512897BBD70C7E 		FB892B59E7DCE7EC
C328B765E1CC6653
20 E976CF19124A9FA1
A97ECF19164A9FA1 		905BF24188509FA6
9ADDBA0C23DD724F
21 ** 5C09696E7363675D
1C01696E7763675D 		92D60E5C71801A99
DD90908A4FE8168F
22 ** A8145AB3C1B2C7DE
E81C5AB3C5B2C7DE 		F68FC9F80564847B
51C041B5711B8132
23 47DF6A0BB1787159
07D76A0BB5787159 		52E36C4CA22EA5A2
373EAFD503F68DE4
24 * 7CE65464329B4E6D
3CEE5464369B4E6D 		832A9D7032015D9F
85E2CE665571E99C
25 ** 421FB6AD95791BA7
0217B6AD91791BA7 		D1E730BA1DB565E7
188E61735FA4F3CE
26 ** C58E9A361368FFD6
85869A361768FFD6 		795EB9D30CAE6879
26D37AC4867ACC61
27 ** DD86B6C74C8EA4E2
9D8EB6C7488EA4E2 		CC3B6915C9A348DF
104C2394555645F0
28 ** 43DB9D2F483CA585
03D39D2F4C3CA585 		E3E4DA503D1B9396
4EA02C0061332443
29 * 855A309F96FEA5EA
C552309F92FEA5EA 		85AD6E9E352AFAFA
929D22370ACAB80D
30 * AB3CA25B02BD18C8
EB34A25B06BD18C8 		0F7D768E9203F786
A1313BC26A99D353
31 ** A9F7A6F4A7C00E06
E9FFA6F4A3C00E06 		F26B385E6BA057FD
203D8384F8F54D19
32 ** 688B9ACD856D1312
28839ACD816D1312 		C41D99C107B4EF76
6CC817CA025A7DAC
33 ** 76BF0621C03D4CD9
36B70621C43D4CD9 		BBE1F95AFC1E052A
561F4801F2EB0C63
34 ** 014CF8D1F981B8EE
4144F8D1FD81B8EE 		D27091C4314CBFE8
B7976D6A80E3DB61
35 ** 487D66EDE0405F8C
087566EDE4405F8C 		8136325C0AEB84CE
8C638BC4495B69A0
36 ** DDCA47093A362521
9DC247093E362521 		51040CF16B600FAA
7FC75515AC3CAAF9
37 ** 45A9D34A3996F6D9
05A1D34A3D96F6D9 		F2004B854AE6C46C
546825016B03D193
38 ** 295D2FBFB00875EA
69552FBFB40875EA 		A309DF027E69C265
4F633FFB95A0C11E
39 964C8B98D590D524
D6448B98D190D524 		1FF1D0271D6F6C18
8CF2D8D401EBFC0F
40 60383D2BAF0836BC
20303D2BAB0836BC 		10A82D55FC480640
602346173581EF79
41 ** 5CF8D539A22A1CAD
1CF0D539A62A1CAD 		92685D806FBE8738
17006DAB2D28081C
42 F95167CAB6565609
B95967CAB2565609 		C52E2EB27446054E
0C219F686840E57A
43 49F1C83615874122
09F9C83611874122 		2680C8ECDF5E51CD
5022A7B69B4E75EF
44 ** ACB2EC1941B03765
ECBAEC1945B03765 		D6B593460098DEC5
D3190A0200FC6B9B
45 CCCC129D5CB55EC0
8CC4129D58B55EC0 		3AD22B7EF59E0D5E
A48C92CBEC17E430
46 ** 917FF8E2EE6B78D5
D177F8E2EA6B78D5 		EF847E058DB71724
F243F0554A00E4C5
47 ** 51DBCF028E96DE00
11D3CF028A96DE00 		574897CA1EE73885
9F0FD0A5B2C2B5FD
48 * 2094942E093463CE
609C942E0D3463CE 		59F6A018C6A0D820
799FE001432346C0
49 ** 50FB0723D7CD1081
10F30723D3CD1081 		16AF758395EA3A7D
CDCB23392D144BED
50 * 740815A4F6CDCABB
340015A4F2CDCABB 		4A84D2ED4D9351AB
5923D04CE94D6111
51 ** EDA46A1AE93735DC
ADAC6A1AED3735DC 		0B302A51B7E5476A
5F817F0ABC770E75
52 * 08BC39B766B2C128
48B439B762B2C128 		DFB5F3F500BC0100
B7B9FED8AC93EBFA
53 ** A74E29BBA98F2312
E74629BBAD8F2312 		A2B352B7F922E8DA
D6BC4B89CED2DEAC
54 ** D6F50D31EE4E68AB
96FD0D31EA4E68AB 		4D464847065C0938
7554D87AEDCE5634
55 * 06191AA594891CF5
46111AA590891CF5 		649C1D084F920F9E
BE12A10384365E19
56 5EA7EFD557946962
1EAFEFD553946962 		15E664293F4D77EE
E23396A758DC9CE6
57 ** 41FB7704781CC88A
01F377047C1CC88A 		8ABD385C441FD6CE
06DE8D55777AB65C
58 ** 9689B9123F7C5431
D681B9123B7C5431 		E1E63120742099BB
1AF88A2CF6649A4A
59 6F25032B4A309BFE
2F2D032B4E309BFE 		48FE50DE774288D7
47950691260D5E10
60 ** D8C4B02D8E8BF1E9
98CCB02D8A8BF1E9 		F34D565E6AE85683
A4D2DB548622A8E8
61 ** F663E8CCEE86805B
B66BE8CCEA86805B 		51BD62C9D5D0F0BB
D2ABB03CF9D26C0A
62 ** 428B29BFDFA838DB
028329BFDBA838DB 		006D62A65761089F
9FD73EF6124B0C11
63 ** 04BE2D22D81EDC66
44B62D22DC1EDC66 		26D99536D99B5707
94144EBDA0CDEB55
64 ** 667B779123A3EF80
2673779127A3EF80 		5D09CBF2CE7E5A69
5EFF8BFCA7BAA152
65 ** BC86D401D6572438
FC8ED401D2572438 		E05572AAA5F6C377
3C670BC455144F61
66 ** 6FE5E9547659E401
2FEDE9547259E401 		2C465BF6F52F864C
B71D106444F95F31
67 ** 27D3BAC6453BE3DE
67DBBAC6413BE3DE 		8F160E29000461CD
2A6660F46487F885
68 ** 1D864E7642A7023A
5D8E4E7646A7023A 		65F91EEBFD8A9C05
84761791B3C36661
69 ** 5256CA6894707CBA
125ECA6890707CBA 		91527F9349ABCF15
30F28F06A7B0A35A
70 ** C05383B8EFCD2BD7
805B83B8EBCD2BD7 		710B6EC61BF63E9C
53AC029D8E0179D5
71 50EB21CA13F9A96E
10E321CA17F9A96E 		26D95BA4DE4C85CF
8F01A90F638AFFF6
72 ** 60EB1229ACD90EDC
20E31229A8D90EDC 		3890EE8567782F96
EE404DF7BE537589
73 8E9A17D17B173B99
CE9217D17F173B99 		885C3933627EDEF0
B7ABB6DF5835E962
74 6EC8CD0802C98817
2ECDCD0806C98817 		A985ADFB1FEE013C
0428DE024B7E4604
75 ** 1E81712FF1145C06
5E89712FF5145C06 		417E667A99B3CFA5
5C24AA056EB1ADBA
76 ** DF3C5C13311AEC7C
9F345C13351AEC7C 		BF01675096F1C48A
243D99BCE12DB864
77 ** 7C34472994127C2D
3C3C472990127C2D 		713915DA311A7CF4
E9733D11D787E20B
78 ** 37304DABA75EAFB3
77384DABA35EAFB3 		EFB5C37FA0238ADF
A728F7407AF958B3
79 D03A16E4C2D8B54B
903216E4C6D8B54B 		423FC0AC24CEFEDD
047D8595DB4D372E
80 ** 8CED882B5D91832E
CCE5882B5991832E 		0006E2DE3AF5C2B5
00F6AA9ED614001B
81 ** 1BB0E6C79EFBEC41
5BB8E6C79AFBEC41 		E9AED4363915775A
655BC48F1FFB5165
82 D41B8346DA9E2252
94138346DE9E2252 		34F5E0BCC5B042EA
702D2C48CDBE5173
83 * 02A9D0A0A91F6304
42A1D0A0AD1F6304 		E2F1C10E59AF07C5
BDEE6AA00F25F840
84 ** 841B3E27C8F0A561
C4133E27CCF0A561 		2B288E554D712C92
FF8609C9E7301162
85 ** CDF0A8D6EE909185
8DF8A8D6EA909185 		5D661834D1C76324
22034D57D21FFB56
86 ** 4C31AC854F44EA34
0C39AC854B44EA34 		BD016309AEDB9BB1
C72EEDC4FA1D9312
87 DB3FC0703C972930
9B37C07038972930 		296ABCFBF01DF991
CA4700686F9F83A2
88 E4B362BFD6A7CFD1
A4BB62BFD2A7CFD1 		20FDAF335F25B1DA
008C24D75E14ACBD
89 F234232A0E0A4A28
B23C232A0A0A4A28 		90CFD699F2DEC5BD
2918D3DE0C1B689C
90 ** 71265345A5874004
312E5345A1874004 		3052CE3CE88710AE
38F0FC685DF30564
91 ** 3E6364548C857110
7E6B645488857110 		0E8581E42C9FEC6F
4DD1751861EC5529
92 * 464FBEDBD78900A7
0647BEDBD38900A7 		90F5F9ADEDED627A
2EF4C540425E339B
93 ** 373B75F847480BB0
773375F843480BB0 		5408B964F8442D16
805287D52599E9F0
94 ** D714E87810DE97AC
971CE87814DE97AC 		4EC4D623108FA909
0AA0725CED10D6A3
95 B9B5932EF54B2C60
F9BD932EF14B2C60 		4B438B3CCF36DEC9
054C6A337709280D
96 ** 2F283C38D2E4E1DD
6F203C38D6E4E1DD 		83515FB6DFEA90B8
09BCC4FF38C78C23
97 ** 1EB8ADAA43BBD575
5EB0ADAA47BBD575 		21A1E04813616E42
D044BA3F25DFD02A
98 ** 3164AA5454D9F991
716CAA5450D9F991 		9382C6C1883F1038
5CDFED4FF2117DEC
99 D78C1C5C6F2243D2
97841C5C6B2243D2 		1CCEB091E030E6A6
4DA2CD67CC449B21
100 BBE212A7D3CE3D14
FBEA12A7D7CE3D14 		2917C207B4D93E0D
A01D50E5A2B902D8
101 ** 104917795E98D0FB
504117795A98D0FB 		40916A71385C2803
413FD26EF671F46D
102 ** 4DDA114D6EFEEEB4
0DD2114D6AFEEEB4 		2E2C65E1D5CBAC31
A16FF03BC0913ED6
103 E0BED7B285BF0A77
A0B6D7B281BF0A77 		5D9EFEFF0AD10490
4C6CA1FAC36A8E5B
104 ** 0AE1555FA1716214
4AE9555FA5716214 		378400BCED39EB81
A1E0C758BD8912C2
105 ** 4657C26790FCB354
065FC26794FCB354 		588BA079B2E7ED20
DA90827AEED7A41F
106 ** 32BD719B0DC1B091
72B5719B09C1B091 		F3477C7552BCB05D
EFF444449D66BE9E
107 ** 0992F8C8C73A9BFE
499AF8C8C33A9BFE 		9F3FFD0F158295F6
C138358DCECC8FC7
108 02C3F061A237BBEB
42CBF061A637BBEB 		AC28B0307127EA7C
3FF1DAED9E0FCBC5
109 ** 80E529E69EDE6827
C0ED29E69ADE6827 		1DF1DB7B66BA1AF1
15700151A5804549
110 B55E84630067B8D5
F55684630467B8D5 		88321611FF9DA421
90649DTEACF91F9A
111 2749C2EBC603BFF2
6741C2EBC203BFF2 		A62B23A7348E2C3A
EB760A09C7FF5153
112 ** C4C5E14D4C5D9FF5
84CDE14D485D9FF5 		ABC2312FBFD94DF5
D2BB5954E5062D53
113 ** 1566BA21F2647E18
556EBA21F6647E18 		A247ED988457CB78
5E99F231005F5249
114 ** 2D093D426D922F92
6D013D4269922F92 		5DF62030B9F23AE9
5D92DA1FA3D07BA1
115 004518468E0C96C3
404D18468A0C96C3 		F28D85FF7E84F38F
52541B0443053C57
116 ** 437B70A98AE03344
037370A98EE03344 		04B3FBF9823B4CF7
14EBEC79DAD3093E
117 2D01F1073D3E375B
6D09F107393E375B 		F10B3E1EE356226C
6FF26DA5E3525B62
118 * 66573DD7E0D7F110
265F3DD7E4D7F110 		F2F26204C29FE51E
083A4ECE57E429AC
119 0846DB9538155201
484EDB953C155201 		F120D0D2AE788057
00CC914A33034782
120 ABB34FC195C820D1
EBBB4FC191C820D1 		5F17AE066B50FC81
2858DD63A2FA4B53


3.7 Notes and References

A nice article on the history DES is by Smid and Branstad [SB92]. Federal Information Processing Standards (FIPS) publications concerning DES include the following: description of DES [NBS77]; implementing and using DES [NBS81]; modes of operation of DES [NBS80]; and authentication using DES [NBS85].

Some properties of the S-boxes are studied by Brickell, Moore, and Purtill [BMP87].

The DEC DES chip is described in [EB93]. Wiener’s key search machine was described at CRYPTO ’93 [WI94].

The time-memory trade-off for DES is due to Hellman [HE80]. A more general time-memory trade-off is presented by Fiat and Naor in [FN91].

The technique of differential cryptanalysis was developed by Biham and Shamir [BS91] (see also [BS93A] and their book [BS93], where cryptanalysis of other cryptosystems is also discussed). Our treatment of differential cryptanalysis is based largely on [BS93].

Another new method of cryptanalysis that can be used to attack DES and other similar cryptosystems is the linear cryptanalysis of Matsui [MA94, MA94A].

Descriptions of other substitution-permutation cryptosystems can be found in the following sources: LUCIFER [FE73]; FEAL [MI9 1]; REDOC-II [CW91]; and LOKI [BKPS90].


Chapter 3 Exercises

Exercises

3.1 Prove that DES decryption can be done by applying the DES encryption algorithm to the ciphertext with the key schedule reversed.
3.2 Let DES(x, K) represent the encryption of plaintext x with key K using the DES cryptosystem. Suppose y = DES (x, K) and y? = DES (c(x), c(K)), where c(·) denotes the bitwise complement of its argument. Prove that y? = c(y) (i.e., if we complement the plaintext and the key, then the ciphertext is also complemented). Note that this can be proved using only the “high-level” description of DES — the actual structure of S-boxes and other components of the system are irrelevant.
3.3 One way to strengthen DES is by double encryption: Given two keys, K1 and K2, define [image] (of course, this is just the product of DES with itself). If it happened that the encryption function [image] was the same as the decryption function [image], then K1 and K2 are said to be dual keys. (This is very undesirable for double encryption, since the resulting ciphertext is identical to the plaintext.) A key is self-dual if it is its own dual key.

(a) Prove that if C0 is either all 0’s or all 1’s and D0 is either all 0’s or all 1’s, then K is self-dual.
(b) Prove that the following keys (given in hexadecimal notation) are self-dual:
0101010101010101
FEFEFEFEFEFEFEFE
1F1F1F1F0E0E0E0E
E0E0E0E0F1F1F1F1
(c) Prove that if C0 = 0101 . . . 01 or 1010 . . . 10 (in binary), then the x-or of the bitstrings Ci and C17-i is 1111 . . . 11, for 1 ? i ? 16 (a similar statement holds for the Di’s).
(d) Prove that the following pairs of keys (given in hexadecimal notation) are dual:
E001E001F101F101
FE1FFE1FFE0EFE0E
E01FE01FF10EF10E 		01E001E001F101F1
1FFE1FFE0EFE0EFE
1FE01FE00EF10EF1

3.4 A message authentication code (MAC) can be produced by using CFB mode, as well as by using CBC mode. Given a sequence of plaintext blocks x1 . . . xn, suppose we define the initialization vector IV to be x1. Then encrypt x2 . . . xn using key K in CFB mode, obtaining y1 . . . yn-1 (note that there are only n - 1 ciphertext blocks). Finally, define the MAC to be eK(yn-1). Prove that this MAC is identical to the MAC produced in Section 3.4.1 using CBC mode.
3.5 Suppose a sequence of plaintext blocks, x1, . . . xn, is encrypted using DES, producing ciphertext blocks y1 . . . yn. Suppose that one ciphertext block, say yi, is transmitted incorrectly (i.e., some 1’s are changed to 0’s and vice versa). Show that the number of plaintext blocks that will be decrypted incorrectly is equal to one if ECB or OFB modes were used for encryption; and equal to two if CBC or CFB modes were used.
3.6 The purpose of this question is to investigate a simplified time-memory trade-off for a chosen plaintext attack. Suppose we have a cryptosystem in which [image], which attains perfect secrecy. Then it must be the case that [image] implies K = K1. Denote [image]. Let x be a fixed plaintext. Define the function g : Y > Y by the rule g(y) = ey(x). Define a directed graph G having vertex set Y, in which the edge set consists of all the directed edges of the form (yi, g(yi)), 1 ? i ? N.

(a) Prove that G consists of the union of disjoint directed cycles.
(b) Let T be a desired time parameter. Suppose we have a set of elements Z = {z1, . . . , zm} ? Y such that, for every element yi ? Y, either yi is contained in a cycle of length at most T, or there exists an element zj ? yi such that the distance from yi to zj (in G) is at most T. Prove that there exists such a set Z such that

so |Z| is O(N/T)

(c) For each zj ? Z, define g-T (zj) to be the element yi such that gT (yi) = zj, where gT is the function that consists of T iterations of g. Construct a table X consisting of the ordered pairs (zj, g-T (zj)), sorted with respect to their first coordinates.

A pseudo-code description of an algorithm to find K, given y = eK (x), is presented in Figure 3.15. Prove that this algorithm finds K in at most T steps. (Hence the time-memory trade-off is O(N).)

Figure 3.15 Time-memory trade-off

Figure 3.16 Differential attack on 4-round DES

(d) Describe a pseudo-code algorithm to construct the desired set Z in time O(NT) without using an array of size N.

3.7 Compute the probabilities of the following 3-round characteristic:

3.8 Here is a differential attack on a 4-round DES. It uses the following characteristic, which is a special case of the characteristic presented in Figure 3.10:

(a) Suppose that the following algorithm presented in Figure 3.16 is used to compute sets test2, . . . test8. Show that Jj ? testj for 2 ? j ? 8.
(b) Given the following plaintext-ciphertext pairs, find the key bits J2, . . . , J8.
plaintext | ciphertext
18493AC485B8D9A0 | E332151312A18B4F
38493AC485B8D9A0 | 87391C27E5282161
482765DDD7009123 | B5DDD8339D82D1D1
682765DDD7009123 | 81F4B92BD94B6FD8
ABCD098733731FF1 | 93A4B42F62EA59E4
8BCD098733731FF1 | ABA494072BF411E5
13578642AAFFEDCB | FDEB526275FB9D94
33578642AAFFEDCB | CC8F72AAE685FDB1
(c) Compute the entire key (14 key bits remain to be determined, which can be done by exhaustive search).


Chapter 4 The RSA System and Factoring

Chapter 4
The RSA System and Factoring

4.1 Introduction to Public-key Cryptography

In the classical model of cryptography that we have been studying up until now, Alice and Bob secretly choose the key K. K then gives rise to an encryption rule eK and a decryption rule dK. In the cryptosystems we have seen so far, dK is either the same as eK, or easily derived from it (for example, DES decryption is identical to encryption, but the key schedule is reversed). Cryptosystems of this type are known as private-key systems, since exposure of eK renders the system insecure.

One drawback of a private-key system is that it requires the prior communication of the key K between Alice and Bob, using a secure channel, before any ciphertext is transmitted. In practice, this may be very difficult to achieve. For example, suppose Alice and Bob live far away from each other and they decide that they want to communicate electronically, using e-mail. In a situation such as this, Alice and Bob may not have access to a reasonable secure channel.

The idea behind a public-key system is that it might be possible to find a cryptosystem where it is computationally infeasible to determine dK given eK. If so, then the encryption rule eK could be made public by publishing it in a directory (hence the term public-key system). The advantage of a public-key system is that Alice (or anyone else) can send an encrypted message to Bob (without the prior communication of a secret key) by using the public encryption rule eK. Bob will be the only person that can decrypt the ciphertext, using his secret decryption rule dK.

Consider the following analogy: Alice places an object in a metal box, and then locks it with a combination lock left there by Bob. Bob is the only person who can open the box since only he knows the combination.

The idea of a public-key system was due to Diffie and Hellman in 1976. The first realization of a public-key system came in 1977 by Rivest, Shamir, and Adleman, who invented the well-known RSA Cryptosystem which we study in this chapter. Since then, several public-key systems have been proposed, whose security rests on different computational problems. Of these, the most important are the following:

RSA
The security of RSA is based on the difficulty of factoring large integers. This system is described in Section 4.3.
Merkle-Hellman Knapsack
This and related systems are based on the difficulty of the subset sum problem (which is NP-complete1); however, all of the various knapsack systems have been shown to be insecure (with the exception of the Chor-Rivest Cryptosystem mentioned below). See Chapter 5 for a discussion of this cryptosystem.
1The NP-complete problems are a large class of problems for which no polynomial-time algorithms are known.
McEliece
The McEliece Cryptosystem is based on algebraic coding theory and is still regarded as being secure. It is based on the problem of decoding a linear code (which is also NP-complete). (See Chapter 5.)
ElGamal
The ElGamal Cryptosystem is based on the difficulty of the discrete logarithm problem for finite fields. (See Chapter 5.)
Chor-Rivest
This is also referred to as a “knapsack” type system, but it is still regarded as being secure.
Elliptic Curve
The Elliptic Curve Cryptosystems are modifications of other systems (such as the ElGamal Cryptosystem, for example) that work in the domain of elliptic curves rather than finite fields. The Elliptic Curve Cryptosystems appear to remain secure for smaller keys than other public-key cryptosystems. (See Chapter 5.)

One very important observation is that a public-key cryptosystem can never provide unconditional security. This is because an opponent, on observing a ciphertext y, can encrypt each possible plaintext in turn using the public encryption rule eK until he finds the unique x such that y = eK(x). This x is the decryption of y. Consequently, we study the computational security of public-key systems.

It is helpful conceptually to think of a public-key system in terms of an abstraction called a trapdoor one-way function. We informally define this notion now.

Bob’s public encryption function, eK, should be easy to compute. We have just noted that computing the inverse function (i.e., decrypting) should be hard (for anyone other than Bob). This property of being easy to compute but hard to invert is often called the one-way property. Thus, we desire that eK be an (injective) one-way function.

One-way functions play a central role in cryptography; they are important for constructing public-key cryptosystems and in various other contexts. Unfortunately, although there are many functions that are believed to be one-way, there currently do not exist functions that can be proved to be one-way.

Here is an example of a function which is believed to be one-way. Suppose n is the product of two large primes p and q, and let b be a positive integer. Then define [image] to be

(For a suitable choice of b and n, this is in fact the RSA encryption function; we will have much more to say about it later.)

If we are to construct a public-key cryptosystem, then it is not sufficient to find a one-way function. We do not want eK to be a one-way function from Bob’s point of view, since he wants to be able to decrypt messages that he receives in an efficient way. Thus, it is necessary that Bob possesses a trapdoor, which consists of secret information that permits easy inversion of eK. That is, Bob can decrypt efficiently because he has some extra secret knowledge about K. So, we say that a function is a trapdoor one-way function if it is a one-way function, but it becomes easy to invert with the knowledge of a certain trapdoor.

We will see in Section 4.3 how to find a trapdoor for the function f defined above. This will lead to the RSA Cryptosystem.


4.2 More Number Theory

Before describing how RSA works, we need to discuss some more facts concerning modular arithmetic and number theory. Two fundamental results that we require are the Euclidean algorithm and the Chinese remainder theorem.


4.2.1 The Euclidean Algorithm

We already observed in Chapter 1 that [image] is a ring for any positive integer n. We also proved there that [image] has a multiplicative inverse if and only if gcd(b, n) = 1, and that the number of positive integers less than n and relatively prime to n is ?(n).

The set of residues modulo n that are relatively prime to n is denoted [image]. It is not hard to see that [image] forms an abelian group under multiplication. We already have stated that multiplication modulo n is associative and commutative, and that 1 is the multiplicative identity. Any element in [image] will have a multiplicative inverse (which is also in [image]). Finally, [image] is closed under multiplication since xy is relatively prime to n whenever x and y are relatively prime to n (prove this!).

At this point, we know that any [image] has a multiplicative inverse, b-1, but we do not yet have an efficient algorithm to compute b-1. Such an algorithm exists; it is called the extended Euclidean algorithm.

First, we describe the Euclidean algorithm, in its basic form, which is used to compute the greatest common divisor of two positive integers, say r0 and r1, where r0 > r1. The Euclidean algorithm consists of performing the following sequence of divisions:

Then it is not hard to show that

Hence, it follows that gcd(r0, r1) = rm.

Since the Euclidean algorithm computes greatest common divisors, it can be used to determine if a positive integer b < n has a multiplicative inverse modulo n, by starting with r0 = n and r1 = b. However, it does not compute the value of the multiplicative inverse (if it exists).

Now, suppose we define a sequence of numbers t0, t1, . . ., tm according to the following recurrence (where the qj’s are defined as above):

Then we have the following useful result.

THEOREM 4.1

For 0 ? j ? m, we have that rj ? tjr1 (mod r0), where the qj’s and rj’s are defined as in the Euclidean algorithm, and the tj’s are defined in the above recurrence.

PROOF The proof is by induction on j. The assertion is trivially true for j = 0 and j = 1. Assume the assertion is true for j = i - 1 and i - 2, where i ? 2; we will prove the assertion is true for j = i. By induction, we have that

and

Now, we compute:

Hence, the result is true by induction.

The next corollary is an immediate consequence.

COROLLARY 4.2

Suppose gcd(r0, r1) = 1. Then tm = r1-1 mod r0.

Now, the sequence of numbers t0 , t1, . . . tm can be calculated in the Euclidean algorithm at the same time as the qj’s and the rj’s. In Figure 4.1, we present the extended Euclidean algorithm to compute the inverse of b modulo n, if it exists. In this version of the algorithm, we do not use an array to keep track of the qj’s, rj’s and tj’s, since it suffices to remember only the “last” two terms in each of these sequences at any point in the algorithm.

In step 10 of the algorithm, we have written the expression for temp in such a way that the reduction modulo n is done with a positive argument. (We mentioned earlier that modular reductions of negative numbers yield negative results in many computer languages; of course, we want to end up with a positive result here.) We also mention that at step 12, it is always the case that tb ? r (mod n) (this is the result proved in Theorem 4.1).

Here is a small example to illustrate:

Example 4.1

Suppose we wish to compute 28-1 mod 75. The Extended Euclidean algorithm proceeds as follows:

Hence, 28-1 mod 75 = 67.

Figure 4.1 Extended Euclidean algorithm


4.2.2 The Chinese Remainder Theorem

The Chinese remainder theorem is really a method of solving certain systems of congruences. Suppose m1, . . . , mr are pairwise relatively prime positive integers (that is, gcd (mi, mj) = 1 if i ? j). Suppose a1, . . ., ar are integers, and consider the following system of congruences:

The Chinese remainder theorem asserts that this system has a unique solution modulo M = m1 ? m2 ? . . . ? mr. We will prove this result in this section, and also describe an efficient algorithm for solving systems of congruences of this type.

It is convenient to study the function [image], which we define as follows:

Example 4.2

Suppose r = 2, m1 = 5 and m2 = 3, so M = 15. Then the function ? has the following values:

Proving the Chinese remainder theorem amounts to proving that this function ? we have defined is a bijection. In Example 4.2 this is easily seen to be the case. In fact, we will be able to give an explicit general formula for the inverse function ?-1.

For 1 ? i ? r, define

Then it is not difficult to see that

for 1 ? i ? r. Next, for 1 ? i ? r, define

(This inverse exists since gcd(Mi, mi) = 1, and it can be found using the Euclidean algorithm.) Note that

for i ? i ? r.

Now, define a function [image] follows:

We will show that the function ? = ?-1, i.e., it provides an explicit formula for solving the original system of congruences.

Denote X = ?(a1, . . ., ar), and let 1 ? j ? r. Consider a term aiMiyi in the above summation, reduced modulo mj: If i = j, then

since

On the other hand, if i ? j, then

since mj | Mi in this case. Thus, we have that

Since this is true for all j, 1 ? j ? r, X is a solution to the system of congruences.

At this point, we need to show that the solution X is unique modulo M. But this can be done by simple counting. The function ? is a function from a domain of cardinality M to a range of cardinality M. We have just proved that ? is a surjective (i.e., onto) function. Hence, ? must also be injective (i.e., one-to-one), since the domain and range have the same cardinality. It follows that ? is a bijection and ?-1 = ?. Note also that ?-1 is a linear function of its arguments a1, . . . , ar.

Here is a bigger example to illustrate.

Example 4.3

Suppose r = 3, m1 = 7, m2 = 11 and m3 = 13. Then M = 1001. We compute M1 = 143, M2 = 91 and M3 = 77, and then y1 = 5, y2 = 4 and y3 = 12. Then the function [image] is the following:

For example, if x ? 5 (mod 7), x ? 3 (mod 11) and x ? 10 (mod 13), then this formula tells us that

This can be verified by reducing 894 modulo 7, 11 and 13.

For future reference, we record the results of this section as a theorem.

THEOREM 4.3 (Chinese Remainder Theorem)

Suppose m1, . . ., mr are pairwise relatively prime positive integers, and suppose a1, . . ., ar are integers. Then, the system of r congruences x ? ai (mod mi) (1 ? i ? r) has a unique solution modulo M = m1 ? . . . ? mr, which is given by

where Mi = M/mi and yi = Mi-1 mod mi, for 1 ? i ? r.


4.2.3 Other Useful Facts

We next mention another result from elementary group theory, called Lagrange’s Theorem, that will be relevant in our treatment of the RSA Cryptosystem. For a (finite) multiplicative group G, define the order of an element g ? G to be the smallest positive integer m such that gm = 1. The following result is fairly simple, but we will not prove it here.

THEOREM 4.4 (Lagrange)

Suppose G is a multiplicative group of order n, and g? G. Then the order of g divides n.

For our purposes, the following corollaries are essential.

COROLLARY 4.5

If [image], then b?(n) ? 1 (mod n).

PROOF [image] is a multiplicative group of order ?(n).

COROLLARY 4.6 (Fermat)

Suppose p is prime and [image]. Then bp ? b (mod p).

PROOF If p is prime, then ?(p) = p - 1. So, for [image] (mod p), the result follows from Corollary 4.5. For b ? 0 (mod p), the result is also true since 0p ? 0 (mod p).

At this point, we know that if p is prime, then [image] is a group of order p - 1, and any element in [image] has order dividing p - 1. However, if p is prime, then the group [image] is in fact cyclic: there exists an element [image] having order equal to p - 1. We will not prove this very important fact, but we do record it for future reference:

THEOREM 4.7

If p is prime, then [image] is a cyclic group.

An element ? having order p - 1 is called a primitive element modulo p. Observe that ? is a primitive element if and only if

Now, suppose p is prime and ? is a primitive element modulo p. Any element [image] can be written as ? = ?i, where 0 ? i ? p - 2, in a unique way. It is not difficult to prove that the order of ? = ?i is

Thus ? is itself a primitive element if and only if gcd(p - 1, i) = 1. It follows that the number of primitive elements modulo p is ?(p - 1).

Example 4.4

Suppose p = 13. By computing successive powers of 2, we can verify that 2 is a primitive element modulo 13:

The element 2i is primitive if and only if gcd(i, 12) = 1; i.e., if and only if i = 1, 5, 7 or 11. Hence, the primitive elements modulo 13 are 2, 6, 7 and 11.

Figure 4.2 RSA Cryptosystem


4.3 The RSA Cryptosystem

We can now describe the RSA Cryptosystem. This cryptosystem uses computations in [image], where n is the product of two distinct odd primes p and q. For such n, note that ?(n) = (p - 1) (q - 1).

The formal description of the cryptosystem is given in Figure 4.2. Let’s verify that encryption and decryption are inverse operations. Since

we have that

for some integer t ? 1. Suppose that [image]; then we have

as desired. We leave it as an exercise for the reader to show that (xb)a ? x (mod n) if

Here is a small (insecure) example of the RSA Cryptosystem.

Example 4.5

Suppose Bob chooses p = 101 and q = 113. Then n = 11413 and ?(n) = 100 ? 112 = 11200. Since 11200 = 26527, an integer b can be used as an encryption exponent if and only if b is not divisible by 2, 5 or 7. (In practice, however, Bob will not factor ?(n). He will verify that gcd(?(n), b) = 1 using the Euclidean algorithm.) Suppose Bob chooses b = 3533. Then the Extended Euclidean algorithm will yield

Hence, Bob’s secret decryption exponent is a = 6597.

Bob publishes n = 11413 and b = 3533 in a directory. Now, suppose Alice wants to send the plaintext 9726 to Bob. She will compute

and send the ciphertext 5761 over the channel. When Bob receives the ciphertext 5761, he uses his secret decryption exponent to compute

(At this point, the encryption and decryption operations might appear to be very complicated, but we will discuss efficient algorithms for these operations in the next section.)

The security of RSA is based on the hope that the encryption function eK (x) = xb mod n is one-way, so it will be computationally infeasible for an opponent to decrypt a ciphertext. The trapdoor that allows Bob to decrypt is the knowledge of the factorization n = pq. Since Bob knows this factorization, he can compute ?(n) = (p - 1)(q - 1) and then compute the decryption exponent a using the Extended Euclidean algorithm. We will say more about the security of RSA later on.


4.4 Implementing RSA

There are many aspects of the RSA Cryptosystem to discuss, including the details of setting up the cryptosystem, the efficiency of encrypting and decrypting, and security issues. In order to set up the system, Bob follows the steps indicated in Figure 4.3. How Bob carries out these steps will be discussed later in this chapter.

One obvious attack on the cryptosystem is for a cryptanalyst to attempt to factor n. If this can be done, it is a simple manner to compute ?(n) = (p - 1)(q - 1) and then compute the decryption exponent a from b exactly as Bob did. (It has been conjectured that breaking RSA is polynomially equivalent2to factoring n, but this remains unproved.)

2Two problems are said to be polynomially equivalent if the existence of a polynomial-time algorithm for either problem implies the existence of a polynomial-time algorithm for the other problem.

Figure 4.3 Setting up RSA

Hence, if the RSA Cryptosystem is to be secure, it is certainly necessary that n = pq must be large enough that factoring it will be computationally infeasible. Current factoring algorithms are able to factor numbers having up to 130 decimal digits (for more information on factoring, see Section 4.8). Hence, it is recommended that, to be on the safe side, one should choose p and q to each be primes having about 100 digits; then n will have 200 digits. Several hardware implementations of RSA use a modulus which is 512 bits in length. However, a 512-bit modulus corresponds to about 154 decimal digits (since the number of bits in the binary representation of an integer is log2 10 times the number of decimal digits), and hence it does not offer good long-term security.

Leaving aside for the moment the question of how to find 100 digit primes, let us look now at the arithmetic operations of encryption and decryption. An encryption (or decryption) involves performing one exponentiation modulo n. Since n is very large, we must use multiprecision arithmetic to perform computations in [image], and the time required will depend on the number of bits in the binary representation of n.

Suppose n has k bits in its binary representation; i.e., k = [log2 n] + 1. Using standard “grade-school” arithmetic techniques, it is not difficult to see that an addition of two k-bit integers can be done in time O(k), and a multiplication can be done in time O(k2). Also, a reduction modulo n of an integer having at most 2k bits can be performed in time O(k2) (this amounts to doing long division and retaining the remainder). Now, suppose that [image] (where we are assuming that 0 ? x, y ? n - 1). Then xy mod n can be computed by first calculating the product xy (which is a 2k-bit integer), and then reducing it modulo n. These two steps can be peformed in time O(k2). We call this computation modular multiplication.

Figure 4.4 The square-and-multiply algorithm to compute xb mod n

We now consider modular exponentiation, i.e., computation of a function of the form xc mod n. As noted above, both the encryption and the decryption operations in RSA are modular exponentiations. Computation of xc mod n can be done using c - 1 modular multiplications; however, this is very inefficient if c is large. Note that c might be as big as ?(n) - 1, which is exponentially large compared to k.

The well-known “square-and-multiply” approach reduces the number of modular multiplications required to compute xc mod n to at most [image], where [image] is the number of bits in the binary representation of c. Since [image], it follows that xc mod n can be computed in time O(k3). Hence, RSA, encryption and decryption can both be done in polynomial time (as a function of k, which is the number of bits in one plaintext (or ciphertext) character).

Square-and-multiply assumes that the exponent, b say, is represented in binary notation, say

where [image]. The algorithm to compute z = xb mod n is presented in Figure 4.4. It is easy to count the number of modular multiplications performed by the square-and-multiply algorithm. There are always [image] squarings performed (step 3). The number of modular multiplications in step 4 is equal to the number of 1’s in the binary representation of b, which is an integer between 0 and [image]. Thus, the total number of modular multiplications is at least [image] and at most [image].

We will illustrate the use of square-and-multiply by returning to Example 4.5.

Example 4.5 (Cont.)

Recall that n = 11413, and the public encryption exponent is b = 3533. Alice encrypts the plaintext 9726 by computing 97263533 mod 11413, using the square-and multiply algorithm, as follows:

i | bi | z
11 | 1 | 12 ? 9726 = 9726
10 | 1 | 97262 ? 9726 = 2659
9 | 0 | 26592 = 5634
8 | 1 | 56342 ? 9726 = 9167
7 | 1 | 91672 ? 9726 = 4958
6 | 1 | 49582 ? 9726 = 7783
5 | 0 | 77832 = 6298
4 | 0 | 62982 = 4629
3 | 1 | 46292 ? 9726 = 10185
2 | 1 | 101852 ? 9726 = 105
1 | 0 | 1052 = 11025
0 | 1 | 110252 ? 9726 = 5761

Hence, as stated earlier, the ciphertext is 5761.

It should be emphasized that the most efficient current hardware implementations of RSA achieve encryption rates of about 600 Kbits per second (using a 512 bit modulus n), as compared to 1 Gbit per second for DES. Stated another way, RSA, is roughly 1500 times slower than DES.

At this point we have discussed the encryption and decryption operations for RSA. In terms of setting up RSA, the generation of the primes p and q (Step 1) will be discussed in the next section. Step 2 is straightforward and can be done in time O((log n)2). Steps 3 and 4 involve the Euclidean algorithm, so let’s briefly consider its complexity.

Suppose we compute the greatest common divisor of r0 and r1, where r0 > r1. In each iteration of the algorithm, we compute a quotient and remainder, which can be done in time O((log r0)2). If we can obtain an upper bound on the number of iterations, then we will have a bound on the complexity of the algorithm. There is a well-known result, known as Lame’s Theorem, that provides such a bound. It asserts that if s is the number of iterations, then fs+2 ? r0, where fi denotes the ith Fibonacci number. Since

it follows that s is O(log r0).

This shows that the running time of the Euclidean algorithm is O((log n)3). (Actually, a more careful analysis can be used to show that the running time is, in fact, O((log n)2).)


4.5 Probabilistic Primality Testing

In setting up the RSA Cryptosystem, it is necessary to generate large (e.g., 80 digit) “random primes.” In practice, the way this is done is to generate large random numbers, and then test them for primality using a probabilistic polynomialtime Monte Carlo algorithm such as the Solovay-Strassen or Miller-Rabin algorithm, both of which we will present in this section. These algorithms are fast (i.e., an integer n can be tested in time that is polynomial in log2 n, the number of bits in the binary representation of n), but there is a possibility that the algorithm may claim that n is prime when it is not. However, by running the algorithm enough times, the error probability can be reduced below any desired threshold. (We will discuss this in more detail a bit later.)

The other pertinent question is how many random integers (of a specified size) will need to be tested until we find one that is prime. A famous result in number theory, called the Prime number theorem, states that the number of primes not exceeding N is approximately N/ln N. Hence, if p is chosen at random, the probability that it is prime is about 1/ln p. For a 512 bit modulus, we have [image]. That is, on average, of 177 random integers p of the appropriate size, one will be prime (of course, if we restrict our attention to odd integers, the probability doubles, to about 2/177). So it is indeed practical to generate sufficiently large random numbers that are “probably prime,” and hence it is practical to set up the RSA Cryptosystem. We proceed to describe how this is done.

A decision problem is a problem in which a question is to be answered “yes” or “no.” A probabilistic algorithm is any algorithm that uses random numbers (in contrast, an algorithm that does not use random numbers is called a deterministic algorithm). The following definitions pertain to probabilistic algorithms for decision problems.

DEFINITION 4.1 A yes-biased Monte Carlo algorithm is a probabilistic algorithm for a decision problem in which a “yes” answer is (always) correct, but a “no” answer may be incorrect. A no-biased Monte Carlo algorithm is defined in the obvious way. We say that a yes-biased Monte Carlo algorithm has error probability equal to ? if, for any instance in which the answer is “yes,” the algorithm will give the (incorrect) answer “no” with probability at most ?. (This probability is computed over all possible random choices made by the algorithm when it is run with a given input.)

The decision problem called Composites is described in Figure 4.5.

Note that an algorithm for a decision problem only has to answer “yes” or “no.” In particular, in the case of the problem Composites, we do not require the algorithm to find a factorization in the case that n is composite.

We will first describe the Solovay-Strassen algorithm, which is a yes-biased Monte Carlo algorithm for Composites with error probability 1/2. Hence, if the algorithm answers “yes,” then n is composite; conversely, if n is composite, then the algorithm answers “yes” with probability at least 1/2.

Figure 4.5 Composites

Figure 4.6 Quadratic Residues

Although the Miller-Rabin algorithm (which we will discuss later) is faster than Solovay-Strassen, we begin by looking at the Solovay-Strassen algorithm because it is easier to understand conceptually and because it involves some number-theoretic concepts that will be useful in later chapters of the book. We begin by developing some further background from number theory before describing the algorithm.

DEFINITION 4.2 Suppose p is an odd prime and x is an integer, 1 ? x ? p - 1. x is defined to be a quadratic residue modulo p if the congruence y2 ?? x (mod p) has a solution [image]. x is defined to be a quadratic non-residue modulo p if [image] (mod p) and x is not a quadratic residue modulo p.

Example 4.6

The quadratic residues modulo 11 are 1, 3, 4, 5 and 9. Note that (±1)2 = 1, (±5)2 = 3, (±2)2 = 4, (±4)2 = 5 and (±3)2 = 9 (where all arithmetic is in [image]).

The decision problem Quadratic Residues is defined in Figure 4.6 in the obvious way.

We prove a result, known as Euler’s criterion, that will give rise to a polynomialtime deterministic algorithm for Quadratic Residues.

THEOREM 4.8 (Euler’s Criterion)

Let p be an odd prime. Then x is a quadratic residue modulo p if and only if

PROOF First, suppose x ? y2 (mod p). Recall from Corollary 4.6 that if p is prime, then xp-1 ? 1 (mod p) for any [image] (mod p). Thus we have

Conversely, suppose x(p-1)/2 ? 1 (mod p). Let b be a primitive element modulo p. Then x ? bi (mod p) for some i. Then we have

Since b has order p - 1, it must be the case that p - 1 divides i(p - 1)/2. Hence, i is even, and then the square roots of x are ±bi/2.

Theorem 4.8 yields a polynomial-time algorithm for Quadratic Residues, by using the “square-and-multiply” technique for exponentiation modulo p. The complexity of the algorithm will be O((log p)3).

We now need to give some further definitions from number theory.

DEFINITION 4.3 Suppose p is an odd prime. For any integer a ? 0, we define the Legendre symbol [image] as follows:

We have already seen that a(p-1)/2 ? 1 (mod p) if and only if a is a quadratic residue modulo p. If a is a multiple of p, then it is clear that a(p-1)/2 ? 0 (mod p). Finally, if a is a quadratic non-residue modulo p, then a(p-1)/2 ? -1 (mod p) since ap-1 ? 1 (mod p). Hence, we have the following result, which provides an efficient algorithm to evaluate Legendre symbols:

THEOREM 4.9

Suppose p is an odd prime. Then

Next, we define a generalization of the Legendre symbol.

DEFINITION 4.4 Suppose n is an odd positive integer, and the prime power factorization of n is [image]. Let a ? 0 be an integer. The Jacobi symbol [image] is defined to be

Example 4.7

Consider the Jacobi symbol [image]. The prime power factorization of 9975 is 9975 = 3 ? 52 ? 7 ? 19. Thus we have

Suppose n > 1 is odd. If n is prime then [image] (mod n) for any a. On the other hand, if n is composite, it may or may not be the case that [image] (mod n). If this equation holds, then n is called an Euler pseudo-prime to the base a. For example, 91 is an Euler pseudo-prime to the base 10, since

However, it can be shown that, for any odd composite n, n is an Euler pseudo-prime to the base a for at most half of the integers a such that 1 ? a ? n - 1 (see the exercises). This fact shows that the Solovay-Strassen primality test, which we present in Figure 4.7, is a yes-biased Monte Carlo algorithm with error probability at most 1/2. At this point it is not clear that the algorithm is a polynomial-time algorithm. We already know how to evaluate a(n-1)/2 mod n in time O((log n)3), but how do we compute Jacobi symbols efficiently? It might appear to be necessary to first factor n, since the Jacobi symbol [image] is defined in terms of the factorization of n. But, if we could factor n, we would already know if it is prime, so this approach ends up in a vicious circle.

Fortunately, we can evaluate a Jacobi symbol without factoring n by using some results from number theory, the most important of which is a generalization of the law of quadratic reciprocity (property 4 below). We now enumerate these properties without proof:

Figure 4.7 The Solovay-Strassen primality test for an odd integer n

1. If n is an odd integer and m1 ? m2 (mod n), then

2. If n is an odd integer, then

3. If n is an odd integer then

In particular, if m = 2kt, where t is odd, then

4. Suppose m and n are odd integers. Then

Example 4.8

As an illustration of the application of these properties, we evaluate the Jacobi symbol [image] as follows:

Notice that we successively apply properties 4, 1, 3, and 2 in this computation.

In general, by applying these four properties, it is possible to compute a Jacobi symbol [image] in polynomial time. The only arithmetic operations that are required are modular reductions and factoring out powers of two. Note that if an integer is represented in binary notation, then factoring out powers of two amounts to determining the number of trailing zeroes. So, the complexity of the algorithm is determined by the number of modular reductions that must be done. It is not difficult to show that at most O(log n) modular reductions are performed, each of which can be done in time O((log n)2). This shows that the complexity is O((log n)3), which is polynomial in log n. (In fact, the complexity can be shown to be O((log n)2) by more precise analysis.)

Suppose that we have generated a random number n and tested it for primality using the Solovay-Strassen algorithm. If we have run the algorithm m times, what is our confidence that n is prime? It is tempting to conclude that the probability that such an integer n is prime is 1 - 2-m. This conclusion is often stated in both textbooks and technical articles, but it cannot be inferred from the given data.

We need to be careful about our use of probabilities. We will define the following random variables: a denotes the event

“a random odd integer n of a specified size is composite,”

and b denotes the event

“the algorithm answers ‘n is prime’ m times in succession.”

It is certainly the case that prob(b|a) ? 2-m. However, the probability that we are really interested is prob(a|b), which is usually not the same as prob(b|a).

We can compute prob(a|b) using Bayes’ theorem (Theorem 2.1). In order to do this, we need to know prob(a). Suppose N ? n ? 2N. Applying the Prime number theorem, the number of (odd) primes between N and 2N is approximately

Since there are [image] odd integers between N and 2N, we will use the estimate

Then we can compute as follows:

Note that in this computation, [image] denotes the event

Figure 4.8 Error probabilities for the Solovay-Strassen test

“a random odd integer n is prime.”

It is interesting to compare the two quantities (ln n - 2)/(ln n - 2 + 2m+1) and 2-m as a function of m. Suppose that [image], since these are the sizes of primes that we seek for use in RSA. Then the first function is roughly 175/(175 + 2m+1). We tabulate the two functions for some values of m in Figure 4.8.

Although 175/(175+2m+1) approaches zero exponentially quickly, it does not do so as quickly as 2-m. In practice, however, one would take m to be something like 50 or 100, which will reduce the probability of error to a very small quantity.

We conclude this section with another Monte Carlo algorithm for Composites which is known as the Miller-Rabin algorithm (it is also known as the “strong pseudo-prime test”). This algorithm is presented in Figure 4.9. It is clearly a polynomial-time algorithm: an elementary analysis shows that its complexity is O((log n)3), as in the case of the Solovay-Strassen test. In fact, the Miller-Rabin algorithm performs better in practice than the Solovay-Strassen algorithm.

We show now that this algorithm cannot answer “n is composite” if n is prime, i.e., the algorithm is yes-biased.

THEOREM 4.10

The Miller-Rabin algorithm for Composites is a yes-biased Monte Carlo algorithm.

PROOF We will prove this by assuming the algorithm answers “n is composite” for some prime integer n, and obtain a contradiction. Since the algorithm answers “n is composite,” it must be the case that [image] (mod n). Now consider the sequence of values b tested in the algorithm. Since b is squared in each iteration of the for loop, we are testing the values [image]. Since the algorithm answers “n is composite,” we conclude that

for 0 ? i ? k - 1.

Figure 4.9 The Miller-Rabin primality test for an odd integer n

Now, using the assumption that n is prime, Fermat’s theorem (Corollary 4.6) tells us that

since n - 1 = 2km. Then [image] is a square root of 1 modulo n. Since n is prime, there are only two square roots of 1 modulo n, namely, ±1 mod n. This can be seen as follows: x is a square root of 1 modulo n if and only if

Since n is prime, either n | (x - 1) (i.e., x ? 1 (mod n)) or n | (x + 1) (i.e., x ± 1 (mod n)).

We have that

so it follows that

Then [image] must be a square root of 1. By the same argument,

Repeating this argument, we eventually obtain

which is a contradiction, since the algorithm would have answered “n is prime” in this case.

It remains to consider the error probability of the Miller-Rabin algorithm. Although we will not prove it here, the error probability can be shown to be, at most, 1/4.


4.6 Attacks On RSA

In this section, we address the question: are there possible attacks on RSA other than factoring n? Let us first observe that it is sufficient for the cryptanalyst to compute ?(n). For, if n and ?(n) are known, and n is the product of two primes p, q, then n can be easily factored, by solving the two equations

for the two “unknowns” p and q. If we substitute q = n/p into the second equation, we obtain a quadratic equation in the unknown value p:

The two roots of this equation will be p and q, the factors of n. Hence, if a cryptanalyst can learn the value of ?(n), then he can factor n and break the system. In other words, computing ?(n) is no easier than factoring n.

Here is an example to illustrate.

Example 4.9

Suppose the cryptanalyst has learned that n = 84773093 and ?(n) = 84754668. This information gives rise to the following quadratic equation:

This can be solved by the quadratic formula, yielding the two roots 9539 and 8887. These are the two factors of n.


4.6.1 The Decryption Exponent

We will now prove the very interesting result that any algorithm which computes the decryption exponent a can be used as a subroutine (or oracle) in a probabilistic algorithm that factors n. So we can say that computing a is no easier than factoring n. However, this does not rule out the possibility of breaking the cryptosystem without computing a.

Notice that this result is of much more than theoretical interest. It tells us that if a is revealed, then the value n is also compromised. If this happens, it is not sufficient for Bob to choose a new encryption exponent; he must also choose a new modulus n.

The algorithm we are going to describe is a probabilistic algorithm of the Las Vegas type. Here is the definition:

DEFINITION 4.5 Suppose 0 ? ? < 1 is a real number. A Las Vegas algorithm is a probabilistic algorithm such that, for any problem instance I, the algorithm may fail to give an answer with some probability ? (i.e., it can terminate with the message “no answer”). However, if the algorithm does return an answer, then the answer must be correct.

REMARK Las Vegas algorithm may not give an answer, but any answer it gives is correct. In contrast, a Monte Carlo algorithm always gives an answer, but the answer may be incorrect.

If we have a Las Vegas algorithm to solve a problem, then we simply run the algorithm over and over again until it finds an answer. The probability that the algorithm will return “no answer” m times in succession is ?m. The average (i.e., expected) number of times the algorithm must be run in order to obtain an answer is in fact 1/(1 - ?) (see the exercises).

Suppose that A is a hypothetical algorithm that computes the decryption exponent a from b and n. We will describe a Las Vegas algorithm that uses A as an oracle. This algorithm will factor n with probability at least 1/2. Hence, if the algorithm is run m times, then n will be factored with probability at least 1 - 1/2m.

The algorithm is based on certain facts concerning square roots of 1 modulo n, where n = pq is the product of two distinct odd primes. Recall that the congruence x2 ? 1 (mod p) has two solutions modulo p, namely x = ±1 mod p. Similarly, the congruence x2 ? 1 (mod q) has two solutions, namely x = ±1 mod q.

Now, since x2 ? 1 (mod n) if and only if x2 ? 1 (mod p) and x2 ? 1 (mod q), it follows that x2 ? 1 (mod n) if and only if x2 ? 1 mod p and x = ±1 mod q. Hence, there are four square roots of 1 modulo n, and they can be found using the Chinese remainder theorem. Two of these solutions are x = ±1 mod n; these are called the trivial square roots of 1 modulo p. The other two square roots are called non-trivial, and they are negatives of each other modulo n.

Here is a small example to illustrate.

Example 4.10

Suppose n = 403 = 13 ? 31. The four square roots of 1 modulo 403 are 1, 92, 311 and 402. The square root 92 is obtained by solving the system x ? 1 (mod 13), x ? -1 (mod 31) using the Chinese remainder theorem. Having found this non-trivial square root, the other non-trivial square root must be 403 - 92 = 311. It is the solution to the system x ? -1 (mod 13), x ? 1 (mod 31).

Suppose x is a non-trivial square root of 1 modulo n. Then we have

but n divides neither factor on the right side. It follows that gcd(x + 1, n) = p or q (and similarly, gcd(x - 1, n) = p or q). Of course, a greatest common divisor can be computed using the Euclidean algorithm, without knowing the factorization of n. Hence, knowledge of a non-trivial square root of 1 modulo n yields the factorization of n with only a polynomial amount of computation. This important fact is the basis of many results in cryptography.

In Example 4.10 above, gcd(93,403) = 31 and gcd(312,403) = 13.

In Figure 4.10, we present an algorithm which, using the hypothetical algorithm A as a subroutine, attempts to factor n by finding a non-trivial square root of 1 modulo n. (Recall that A computes the decryption exponent a corresponding to the encryption exponent b.) We first do an example to illustrate the application of this algorithm.

Example 4.11

Suppose n = 89855713, b = 34986517 and a = 82330933, and the random value w = 5. We have

In step 6, v = 85877701, and in step 10, v = 1. In step 12, we compute

This is one factor of n; the other is n/9103 = 9871.

Let’s now proceed to the analysis of the algorithm. First, observe that if we are lucky enough to choose w to be a multiple of p or q, then we can factor n

Figure 4.10 Factoring algorithm, given the decryption exponent a

immediately. This is detected in step 2. If w is relatively prime to n, then we compute wr, w2r, w4r, . . . , by successive squaring, until

for some t. Since

we know that [image] (mod n). Hence, the while loop terminates after at most s iterations. At the end of the while loop, we have found a value v0 such that [image] (mod n) but [image] (mod n). If v0 ? -1 (mod n), then the algorithm fails; otherwise, v0 is a non-trivial square root of 1 modulo n and we are able to factor n (step 12).

The main task facing us now is to prove that the algorithm succeeds with probability at least 1/2. There are two ways in which the algorithm can fail to factor n:

1. wr ? 1 (mod n) (step 7)
2. (mod n) for some t, 0 ? t ? s - 1 (step 11)

We have s + 1 congruences to consider. If a random value w is a solution to at least one of these s + 1 congruences, then it is a “bad” choice, and the algorithm fails. So we proceed by counting the number of solutions to each of these congruences.

First, consider the congruence wr ? 1 (mod n). The way to analyze a congruence such as this is to consider solutions modulo p and modulo q separately, and then combine them using the Chinese remainder theorem. Observe that x ? 1 (mod n) if and only if x ? 1 (mod p) and x ? 1 (mod q).

So, we first consider wr ? 1 (mod p). Since p is prime, [image] is a cyclic group by Theorem 4.7. Let g be a primitive element modulo p. We can write w = gu for a unique integer u, 0 ? u ? p - 2. Then we have

Let us write

where p1 is odd, and

where q1 is odd. Since

we have that

Hence

and

Now, the condition (p - 1) | [ur becomes 2ip1 | ur. Since p1 | r and r is odd, it is necessary and sufficient that 2i | u. Hence, u = k2i, 0 ? k ? p1 - 1, and the number of solutions to the congruence wr ? 1 (mod p) is p1.

By an identical argument, the congruence wr ? 1 (mod q) has exactly q1 solutions. We can combine any solution modulo p with any solution modulo q to obtain a unique solution modulo n, using the Chinese remainder theorem. Consequently, the number of solutions to the congruence wr ? (mod n) is p1q1.

The next step is to consider a congruence [image] (mod n) for a fixed value t (where 0 ? t ? s - 1). Again, we first look at the congruence modulo p and then modulo q (note that [image] (mod n) if and only if [image] (mod p) and [image] (mod q). First, consider [image] (mod p). Writing w = gu, as above, we get

Since g(p-1)/2 ? -1 (mod p), we have that

Since p - 1 = 2ip1, we get

Taking out a common factor of p1, this becomes

Now, if t ? i, then there can be no solutions since 2i+1 | 2t+1 but [image]. On the other hand, if t ? i - 1, then u is a solution if and only if u is an odd multiple of 2i-t-1 (note that r/p1 is an odd integer). So, the number of solutions in this case is

By similar reasoning, the congruence [image] (mod q) has no solutions if t ? j, and 2tq1 solutions if t ? j - 1. Using the Chinese remainder theorem, we see that the number of solutions of [image] (mod n) is

Now, t can range from 0 to s - 1. Without loss of generality, suppose i ? j; then the number of solutions is 0 if t ? i. The total number of “bad” choices for w is at most

Recall that p - 1 = 2ip1 and q - 1 = 2jq1. Now, j ? i ? 1 so p1q1 < n/4. We also have that

Hence, we obtain

Since at most (n - 1)/2 choices for w are “bad,” it follows that at least (n - 1)/2 choices are “good” and hence the probability of success of the algorithm is at least 1/2.


4.6.2 Partial Information Concerning Plaintext Bits

The other result we will discuss concerns partial information about the plaintext that might be “leaked” by an RSA encryption. Two examples of partial information that we consider are the following:

1. given y = eK(x), compute parity(y), where parity(y) denotes the low-order bit of x
2. given y = eK(x), compute half(y), where half(y) = 0 if 0 ? x < n/2 and half(y) = 1 if n/2 < x ? n - 1.

We will prove that, given y = eK(x), any algorithm that computes parity(y) or half(y) can be used as an oracle to construct an algorithm that computes the plaintext x. What this means is that, given a ciphertext, computing the low-order bit of the plaintext is polynomially equivalent to determining the whole plaintext!

First, we prove that computing parity(y) is polynomially equivalent to computing half(y). This follows from the following two easily proved identities (see the exercises):

and from the multiplicative rule eK(x1)eK(x2) = eK (x1x2).

We will show how to compute x = dK(y), given a hypothetical algorithm (oracle) which computes half(y). The algorithm is presented in Figure 4.11. In steps 2-4, we compute

for 0 ? i ? log2 n. We observe that

and so on. Hence, we can find x by a binary search technique, which is done in steps 7-11. Here is a small example to illustrate.

Figure 4.11 Decrypting RSA ciphertext, given an oracle for computing half(y)

Example 4.12

Suppose n = 1457, b = 779, and we have a ciphertext y = 722. eK(2) is computed to be 946. Suppose, using our oracle for half, that we obtain the following values yi in step 3 of the algorithm:

Then the binary search proceeds as shown in Figure 4.12. Hence, the plaintext is x = [999.55] = 999.


4.7 The Rabin Cryptosystem

In this section, we describe the Rabin Cryptosystem, which is computationally secure against a chosen-plaintext attack provided that the modulus n = pq cannot be factored. The system is described in Figure 4.13.

Figure 4.12 Binary search for RSA decryption

We will show that the encryption function eK is not an injection, so decryption cannot be done in an unambiguous fashion. In fact, there are four possible plaintexts that could be the encryption of any given ciphertext. More precisely, let w be one of the four square roots of 1 modulo n. Let [image]. Then, we can verify the following equations:

(Note that all arithmetic is being done in [image], and division by 2 and 4 is the same as multiplication by 2-1 and 4-1 modulo n, respectively.)

The four plaintexts that encrypt to eK(x) are x, -x - B, ?(x + B/2) - B/2 and -?(x + B/2) - B/2, where ? is a non-trivial square root of 1 modulo n. In general, there will be no way for Bob to distinguish which of these four possible plaintexts is the “right” plaintext, unless the plaintext contains sufficient redundancy to eliminate three of these four possible values.

Figure 4.13 Rabin Cryptosystem

Let us look at the decryption problem from Bob’s point of view. He is given a ciphertext y and wants to determine x such that

This is a quadratic equation in the unknown x. We can eliminate the linear term by making the substitution x1 = x + B/2, or equivalently, x = x1 - B/2. Then the equation becomes

or

If we define C == B2 /4 + y, then we can rewrite the congruence as

So, decryption reduces to extracting square roots modulo n. This is equivalent to solving the two congruences

and

(There are two square roots of C modulo p and two square roots modulo q. Using the Chinese remainder theorem, these can be combined to yield four solutions modulo n.) We can use Euler’s criterion to determine if C is a quadratic residue modulo p (and modulo q). In fact, C will be a quadratic residue modulo p and modulo q if encryption was performed correctly. But Euler’s criterion does not help us find the square roots of C; it yields only an answer “yes” or “no.”

When p ? 3 (mod 4), there is a simple formula to compute square roots of quadratic residues modulo p. Suppose C is a quadratic residue and p ? 3 (mod 4). Then we have that

Here we again make use of Euler’s criterion, which says that if C is a quadratic residue modulo p, then C(p-1)/2 ? 1 (mod p). Hence, the two square roots of 7 modulo P are ±C(p+1)/4 mod p. In a similar fashion, the two square roots of 7 modulo q are ±C(q+1)/4 mod q. It is then straightforward to obtain the four square roots x1, of C modulo n using the Chinese remainder theorem.

REMARK It is interesting that for p ? 1 (mod 4) there is no known polynomial-time deterministic algorithm to compute square roots of quadratic residues modulo p. There is a polynomial-time Las Vegas algorithm, however.

Once we have determined the four possible values for x1, we compute x from the equation x = x1 - B/2 to get the four possible plaintexts. This yields the decryption formula

Example 4.13

Let’s illustrate the encryption and decryption procedures for the Rabin Cryptosystem with a toy example. Suppose n = 77 = 7 ? 11 and B = 9. Then the encryption function is

and the decryption function is

Suppose Bob wants to decrypt the ciphertext y = 22. It is first necessary to find the square roots of 23 modulo 7 and modulo 11. Since 7 and 11 are both congruent to 3 modulo 4, we use our formula:

Figure 4.14 Factoring a Rabin modulus, given a decryption oracle

and

Using the Chinese remainder theorem, we compute the four square roots of 23 modulo 77 to be ±10, ±32 mod 77. Finally, the four possible plaintexts are:

It can be verified that each of these plaintexts encrypts to the ciphertext 22.

We now discuss the security of the Rabin Cryptosystem. We will prove that any hypothetical decryption algorithm A can be used as an oracle in a Las Vegas algorithm that factors the modulus n with probability at least 1/2. This algorithm is depicted in Figure 4.14.

There are several points of explanation needed. First, observe that

so a value x will be returned in step 3. Next, we look at step 4 and note that [image] (mod n). It follows that x1 ? ±r (mod n) or x1 ? ±?r (mod n), where ? is one of the non-trivial square roots of 1 modulo n. In the second case, we have

but n does not divide either factor on the right side. Hence, computation of gcd(x1 + r, n) (or gcd(x1 - r, n)) must yield either p or q, and the factorization of n is accomplished.

Let’s compute the probability of success of this algorithm, over all n - 1 choices for the random value r. For two non-zero residues r1 and r2, define

It is easy to see that r ~ r for all r; r1 ~ r2 implies r2 ~ r1; and r1 ~ r2 and r2 ~ r3 together imply r1 ~ r3. This says that the relation ~ is an equivalence relation. The equivalence classes of [image] all have cardinality four: the equivalence class containing r is the set

where ? is a non-trivial square root of 1 modulo n.

In the algorithm presented in Figure 4.14, any two values r in the same equivalence class will yield the same value y. Now consider the value x returned by the oracle A when given y. We have

If r = ±y, then the algorithm fails; while it succeeds if r = ±?y. Since r is chosen at random, it is equally likely to be any of these four possible values. We conclude that the probability of success of the algorithm is 1/2.

It is interesting that the Rabin Cryptosystem is provably secure against a chosen plaintext attack. However, the system is completely insecure against a chosen ciphertext attack. In fact the algorithm in Figure 4.14, that we used to prove security against a chosen plaintext attack, also can be used to break the Rabin Cryptosystem in a chosen ciphertext attack! In the chosen ciphertext attack, the oracle A is replaced by Bob’s decryption algorithm.


4.8 Factoring Algorithms

There is a huge amount of literature on factoring algorithms, and a careful treatment would require more pages than we have in this book. We will just try to give a brief overview here, including an informal discussion of the best current factoring algorithms and their use in practice. The three algorithms that are most effective on very large numbers are the quadratic sieve, the elliptic curve algorithm and the number field sieve. Other well-known algorithms that were precursors include Pollard’s rho-method and p - 1 algorithm, Williams’ p + 1 algorithm, the continued fraction algorithm, and of course, trial division.

Throughout this section, we suppose that the integer n that we wish to factor is odd. Trial division consists of dividing n by every odd integer up to [image]. If n < 1012, say, this is a perfectly reasonable factorization method, but for larger n we generally need to use more sophisticated techniques.

Figure 4.15 The p - 1 factoring algorithm


4.8.1 The p - 1 Method

As an example of a simple algorithm that can sometimes be applied to larger integers, we describe Pollard’s p - 1 algorithm, which dates from 1974. This algorithm, presented in Figure 4.15, has two inputs: the (odd) integer n to be factored, and a “bound” B. Here is what is taking place in the p - 1 algorithm: Suppose p is a prime divisor of n, and q ? B for every prime power q | (p - 1). Then it must be the case that

At the end of the for loop (step 2),

so

since p | n. Now,

by Fermat’s theorem. Since (p - 1) | [B!, we have that

(in step 3). Thus, in step 4,

and

so

The integer d will be a non-trivial divisor of n (unless a = 1 in step 3). Having found a non-trivial factor d, we would then proceed to attempt to factor d and n/d if they are composite.

Here is an example to illustrate.

Example 4.14

Suppose n = 15770708441. If we apply the p - 1 algorithm with B = 180, then we find that a = 11620221425 in step 3, and d is computed to be 135979. In fact, the complete factorization of n into primes is

in this case, the factorization succeeds because 135978 has only “small” prime factors:

Hence, by taking B ? 173, it will be the case that 135978 | B!, as desired.

In the algorithm, there are B - 1 modular exponentiations, each requring at most 2log2 B modular multiplications using square-and-multiply. The gcd computation can be done in time O((log n)3) using the Euclidean algorithm. Hence, the complexity of the algorithm is O(B log B(log n)2 + (log n)3). If the integer B is O((log n)i) for some fixed integer i, then the algorithm is indeed a polynomial-time algorithm; however, for such a choice of B the probability of success will be very small. On the other hand, if we increase the size of B drastically, say to [image], then the algorithm will be successful, but it will be no faster than trial division.

Thus, the drawback of this method is that it requires n to have a prime factor p such that p - 1 has only “small” prime factors. It would be very easy to construct an RSA modulus n = pq which would resist factorization by this method. One would start by finding a large prime p1 such that p = 2p1 + 1 is also prime, and a large prime q1 such that q = 2q1 + 1 is also prime (using one of the Monte Carlo primality testing algorithms discussed in Section 4.5). Then the RSA modulus n = pq will be resistant to factorization using the p - 1 method.

The more powerful elliptic curve algorithm, developed by Lenstra in the mid-1980’s, is in fact a generalization of the p - 1 method. We will not discuss the theory at all here, but we do mention that the success of the elliptic curve method depends on the more likely situation that an integer “close to” p has only “small” prime factors. Whereas the p - 1 method depends on a relation that holds in the group [image], the elliptic curve method involves groups defined on elliptic curves modulo p.


4.8.2 Dixon’s Algorithm and the Quadratic Sieve

Dixon’s algorithm is based on a very simple idea that we already saw in connection with the Rabin Cryptosystem. Namely, if we can find [image] (mod n) such that x2 ? y2 (mod n), then gcd(x - y, n) is a non-trivial factor of n.

The method uses a factor base, which is a set [image] “small” primes. We first obtain several integers x such that all the prime factors of x2 mod n occur in the factor base [image]. (How this is done will be discussed a bit later.) The idea is to then take the product of several of these x’s in such a way that every prime in the factor base is used an even number of times. This then gives us a congruence of the desired type x2 ? y2 (mod n), which (we hope) will lead to a factorization of n.

We illustrate with a carefully contrived example.

Example 4.15

Suppose n = 15770708441 (this was the same n that we used in Example 4.14). Let [image]. Consider the three congruences:

If we take the product of these three congruences, then we have

Reducing the expressions inside the parentheses modulo n, we have

Then we compute

finding the factor 115759 of n.

Suppose [image] is the factor base. Let C be slightly larger than B (say C = B + 10), and suppose we have obtained C congruences:

for 1 ? j ? C. For each j, consider the vector

If we can find a subset of the aj’s that sum modulo 2 to the vector (0, . . . , 0), then the product of the corresponding xj’s will use each factor in [image] an even number of times.

We illustrate by returning to Example 4.15, where there exists a dependence even though C < B in this case.

Example 4.15 (Cont.)

The three vectors a1, a2, a3 are as follows:

It is easy to see that

This gives rise to the congruence we saw earlier that successfully factored n.

Observe that finding a subset of the C vectors a1, . . . , aC that sums modulo 2 to the all-zero vector is nothing more than finding a linear dependence (over [image]) of these vectors. Provided C > B, such a linear dependence must exist, and it can be found easily using the standard method of Gaussian elimination. The reason why we take C > B + 1 is that there is no guarantee that any given congruence will yield the factorization of n. Approximately 50% of the time it will turn out that x ? ±y (mod n). But if C > B + 1, then we can obtain several such congruences (arising from different linear dependencies among the aj’s). Hopefully, at least one of the resulting congruences will yield the factorization.

It remains to discuss how we obtain integers xj such that the values xj2 mod n factor completely over the factor base [image]. There are several methods of doing this. One common approach is the Quadratic Sieve due to Pomerance, which uses integers of the form [image] The name “quadratic sieve” comes from a sieving procedure (which we will not describe here) that is used to determine those xj’s that factor over [image]:

There is, of course, a trade-off here: if [image] is large, then it is more likely that an integer xj factors over [image]. But the larger B is, the more congruences we need to accumulate before we are able to find a dependence relation. The optimal choice for B is approximately

and this leads to an expected running time of

The number field sieve is a more recent factoring algorithm from the late 1980’s. It also factors n by constructing a congruence x2 ? y2 (mod n), but it does so by means of computations in rings of algebraic integers.


4.8.3 Factoring Algorithms in Practice

The asymptotic running times of the quadratic sieve, elliptic curve and number field sieve are as follows:

The notation o(1) denotes a function of n that approaches 0 as n > ?, and p denotes the smallest prime factor of n.

In the worst case, [image] and the asymptotic running times of the quadratic sieve and elliptic curve algorithms are essentially the same. But in such a situation, quadratic sieve generally outperforms elliptic curve. The elliptic curve method is more useful if the prime factors of n are of differing size. One very large number that was factored using the elliptic curve method was the Fermat number [image] in 1988 by Brent.

For factoring RSA moduli (where n = pq, p, q are prime, and p and q are roughly the same size), the quadratic sieve is currently the most successful algorithm. Some notable milestones have included the following factorizations. In 1983, the quadratic sieve successfully factored a 69-digit number that was a (composite) factor of 2251 - 1 (this computation was done by Davis, Holdridge, and Simmons). Progress continued throughout the 1980’s, and by 1989, numbers having up to 106 digits were factored by this method by Lenstra and Manasse, by distributing the computations to hundreds of widely separated workstations (they called this approach “factoring by electronic mail”).

More recently, in April 1994, a 129-digit number known as RSA-129 was factored by Atkins, Graff, Lenstra, and Leyland using the quadratic sieve. (The numbers RSA-100, RSA-110, . . . , RSA-500 are a list of RSA moduli publicized on the Internet as “challenge” numbers for factoring algorithms. Each number RSA-d is a d-digit number that is the product of two primes of approximately the same length.) The factorization of RSA-129 required 5000 MIPS-years of computing time donated by over 600 researchers around the world.

The number field sieve is the most recent of the three algorithms. It seems to have great potential since its asymptotic running time is faster than either quadratic sieve or the elliptic curve. It is still in developmental stages, but people have speculated that number field sieve might prove to be faster for numbers having more than about 125-130 digits. In 1990, the number field sieve was used by Lenstra, Lenstra, Manasse, and Pollard to factor [image] into three primes having 7, 49 and 99 digits.


4.9 Notes and References

The idea of public-key cryptography was introduced by Diffie and Hellman in 1976. Although [DH76A] is the most cited reference, the conference paper [DH76] actually appeared a bit earlier. The RSA Cryptosystem was discovered by Rivest, Shamir and Adleman [RSA78]. The Rabin Cryptosystem was described in Rabin [RA79]; a similar provably secure system in which decryption is unambiguous was found by Williams [WI80]. For a general survey article on public-key cryptography, we recommend Diffie [DI92].

The Solovay-Strassen test was first described in [SS77]. The Miller-Rabin test was given in [MI76] and [RA80]. Our discussion of error probabilities is motivated by observations of Brassard and Bratley [BB88A, §8.6] (see also [BBCGP88]). The best current bounds on the error probability of the Miller-Rabin algorithm can be found in [DLP93].

The material in Section 4.6 is based on the treatment by Salomaa [SA90, pp. 143-154]. The factorization of n given the decryption exponent was proved in [DE84]; the results on partial information revealed by RSA is from [GMT82].

As mentioned earlier, there are many sources of information on factoring algorithms. Pomerance [PO90] is a good survey on factoring, and Lenstra and Lenstra [LL90] is a good article on number-theoretic algorithms in general. Bressoud [BR89] is an elementary textbook devoted to factoring and primality testing. Cryptography textbooks that emphasize number theory include Koblitz [KO94] and Kranakis [KR86]. Lenstra and Lenstra [LL93] is a monograph on the number field sieve.

Exercises 4.7-4.9 give some examples of protocol failures. For a nice article on this subject, see Moore [MO92].


Chapter 4 Exercises

Exercises

4.1 Use the Extended Euclidean algorithm to compute the following multiplicative inverses:

(a) 17-1 mod 101
(b) 357-1 mod 1234
(c) 3125-1 mod 9987.

4.2 Solve the following system of congruences:

4.3 Solve the following system of congruences:

HINT First use the Extended Euclidean algorithm, and then apply the Chinese remainder theorem.

4.4 Here we investigate some properties of primitive roots.

(a) The integer 97 is prime. Prove that x ± 0 is a primitive root modulo 97 if and only if [image] (mod 97) and [image] (mod 97).
(b) Use this method to find the smallest primitive root modulo 97.
(c) Suppose p is prime, and p - 1 has prime power factorization

where the pi’s are distinct primes. Prove that x ± 0 is a primitive root modulo p if and only if [image] (mod p) for 1 ? i ? n.

4.5 Suppose that n = pq, where p and q are distinct odd primes and ab ? 1 (mod (p -1)(q - 1)). The RSA encryption operation is e(x) = xb mod n and the decryption operation is d(y) = ya mod n. We proved that d(e(x)) = x if [image]. Prove that the same statement is true for any [image].

HINT Use thr fact that x1 ? x2 (mod pq) if and only if x1 ? x2 (mod p) and x1 ? x2 (mod q). This follows from the Chinese remainder theorem.

4.6 Two samples of RSA ciphertext are presented in Tables 4.1 and 4.2. Your task is to decrypt them. The public parameters of the system are n = 18923 and b = 1261 (for Table 4.1) and n = 31313 and b = 4913 (for Table 4.2). This can be accomplished as follows. First, factor n (which is easy because it is so small). Then compute the exponent a from ?(n), and, finally, decrypt the ciphertext. Use the square-and-multiply algorithm to exponentiate modulo n.

In order to translate the plaintext back into ordinary English text, you need to know how alphabetic characters are “encoded” as elements in [image]. Each element of

Table 4.1 RSA Ciphertext
12423 | 11524 | 7243 | 7459 | 14303 | 6127 | 10964 | 16399
9792 | 13629 | 14407 | 18817 | 18830 | 13556 | 3159 | 16647
5300 | 13951 | 81 | 8986 | 8007 | 13167 | 10022 | 17213
2264 | 961 | 17459 | 4101 | 2999 | 14569 | 17183 | 15827
12693 | 9553 | 18194 | 3830 | 2664 | 13998 | 12501 | 18873
12161 | 13071 | 16900 | 7233 | 8270 | 17086 | 9792 | 14266
13236 | 5300 | 13951 | 8850 | 12129 | 6091 | 18110 | 3332
15061 | 12347 | 7817 | 7946 | 11675 | 13924 | 13892 | 18031
2620 | 6276 | 8500 | 201 | 8850 | 11178 | 16477 | 10161
3533 | 13842 | 7537 | 12259 | 18110 | 44 | 2364 | 15570
3460 | 9886 | 8687 | 4481 | 11231 | 7547 | 11383 | 17910
12867 | 13203 | 5102 | 4742 | 5053 | 15407 | 2976 | 9330
12192 | 56 | 2471 | 15334 | 841 | 13995 | 17592 | 13297
2430 | 9741 | 11675 | 424 | 6686 | 738 | 13874 | 8168
7913 | 6246 | 14301 | 1144 | 9056 | 15967 | 7328 | 13203
796 | 195 | 9872 | 16979 | 15404 | 14130 | 9105 | 2001
9792 | 14251 | 1498 | 11296 | 1105 | 4502 | 16979 | 1105
56 | 4118 | 11302 | 5988 | 3363 | 15827 | 6928 | 4191
4277 | 10617 | 874 | 13211 | 11821 | 3090 | 18110 | 44
2364 | 15570 | 3460 | 9886 | 9988 | 3798 | 1158 | 9872
16979 | 15404 | 6127 | 9872 | 3652 | 14838 | 7437 | 2540
1367 | 2512 | 14407 | 5053 | 1521 | 297 | 10935 | 17137
2186 | 9433 | 13293 | 7555 | 13618 | 13000 | 6490 | 5310
18676 | 4782 | 11374 | 446 | 4165 | 11634 | 3846 | 14611
2364 | 6789 | 11634 | 4493 | 4063 | 4576 | 17955 | 7965
11748 | 14616 | 11453 | 17666 | 925 | 56 | 4118 | 18031
9522 | 14838 | 7437 | 3880 | 11476 | 8305 | 5102 | 2999
18628 | 14326 | 9175 | 9061 | 650 | 18110 | 8720 | 15404
2951 | 722 | 15334 | 841 | 15610 | 2443 | 11056 | 2186

represents three alphabetic characters as in the following examples:

You will have to invert this process as the final step in your program.

The first plaintext was taken from “The Diary of Samuel Marchbanks,” by Robertson Davies, 1947, and the second was taken from “Lake Wobegon Days,” by Garrison Keillor, 1985.

4.7 This exercise exhibits what is called a protocol failure. It provides an example where ciphertext can be decrypted by an opponent, without determining the key, if a cryptosystem is used in a careless way. (Since the opponent does not determine the key, it is not accurate to call it cryptanalysis.) The moral is that it is not sufficient to use a “secure” cryptosystem in order to guarantee “secure” communication.

Suppose Bob has an RSA Cryptosystem with a large modulus n for which the factorization cannot be found in a reasonable amount of time. Suppose Alice sends

Table 4.2 RSA Ciphertext
6340 | 8309 | 14010 | 8936 | 27358 | 25023 | 16481 | 25809
23614 | 7135 | 24996 | 30590 | 27570 | 26486 | 30388 | 9395
27584 | 14999 | 4517 | 12146 | 29421 | 26439 | 1606 | 17881
25774 | 7647 | 23901 | 7372 | 25774 | 18436 | 12056 | 13547
7908 | 8635 | 2149 | 1908 | 22076 | 7372 | 8686 | 1304
4082 | 11803 | 5314 | 107 | 7359 | 22470 | 7372 | 22827
15698 | 30317 | 4685 | 14696 | 30388 | 8671 | 29956 | 15705
1417 | 26905 | 25809 | 28347 | 26277 | 7897 | 20240 | 21519
12437 | 1108 | 27106 | 18743 | 24144 | 10685 | 25234 | 30155
23005 | 8267 | 9917 | 7994 | 9694 | 2149 | 10042 | 27705
15930 | 29748 | 8635 | 23645 | 11738 | 24591 | 20240 | 27212
27486 | 9741 | 2149 | 29329 | 2149 | 5501 | 14015 | 30155
18154 | 22319 | 27705 | 20321 | 23254 | 13624 | 3249 | 5443
2149 | 16975 | 16087 | 14600 | 27705 | 19386 | 7325 | 26277
19554 | 23614 | 7553 | 4734 | 8091 | 23973 | 14015 | 107
3183 | 17347 | 25234 | 4595 | 21498 | 6360 | 19837 | 8463
6000 | 31280 | 29413 | 2066 | 369 | 23204 | 8425 | 7792
25973 | 4477 | 30989

a message to Bob by representing each alphabetic character as an integer between 0 and 25 (i.e., A - 0, B - 1, etc.), and then encrypting each residue modulo 26 as a separate plaintext character.

(a) Describe how Oscar can easily decrypt a message which is encrypted in this way.
(b) Illustrate this attack by decrypting the following ciphertext (which was encrypted using an RSA Cryptosystem with n = 18721 and b = 25) without factoring the modulus:

4.8 This exercise illustrates another example of a protocol failure (due to Simmons) involving RSA; it is called the common modulus protocol failure. Suppose Bob has an RSA Cryptosystem with modulus n and decryption exponent b1, and Charlie has an RSA Cryptosystem with (the same) modulus n and decryption exponent b2. Suppose also that gcd(b1, b2) = 1. Now, consider the situation that arises if Alice encrypts the same plaintext x to send to both Bob and Charlie. Thus, she computes [image] mod n and [image] mod n, and then she sends y1 to Bob and y2 to Charlie. Suppose Oscar intercepts y1 and y2, and performs the computations indicated in Figure 4.16.

(a) Prove that the value x1 computed in step 3 of Figure 4.16 is in fact Alice’s plaintext, x. Thus, Oscar can decrypt the message Alice sent, even though the cryptosystem may be “secure.”
(b) Illustrate the attack by computing x by this method if
    n = 18721, b1 = 43,
    b2 = 7717,
    y1 = 12677 and
    y2 = 14702.

4.9 We give yet another protocol failure involving RSA. Suppose that three users in a network, say Bob, Bart and Bert, all have public encryption exponents b = 3.

Figure 4.16 RSA common modulus protocol failure

Let their moduli be denoted by n1, n2, n3. Now suppose Alice encrypts the same plaintext x to send to Bob, Bart and Bert. That is, Alice computes yi = x3 mod ni, 1 ? i ? 3. Describe how Oscar can compute x, given y1, y2 and y3, without factoring any of the moduli.

4.10 A plaintext x is said to be fixed if eK(x) = x. Show that, for the RSA Cryptosystem, the number of fixed plaintexts [image] is equal to gcd(b - 1, p - 1) ? gcd(b -1, q - 1).

HINT Consider the system of two congruences eK(x) ? x (mod p), eK(x) ? x (mod q).

4.11 Suppose A is a deterministic algorithm which is given as input an RSA modulus n, an encryption exponent b, and a ciphertext y. A will either decrypt y or return no answer. Supposing that there are ?(n - 1) ciphertexts which A is able to decrypt, show how to use A as an oracle in a Las Vegas decryption algorithm having success probability ?.

HINT Use the multiplicative property of RSA that eK(x1)eK(x2) = eK(x1x2), where all arithmetic operations are modulo n.

4.12 Write a program to evaluate Jacobi symbols using the four properties presented in Section 4.5. The program should not do any factoring, other than dividing out powers of two. Test your program by computing the following Jacobi symbols:

4.13 For n = 837, 851 and 1189, find the number of bases 6 such that n, is an Euler pseudo-prime to the base b.
4.14 The purpose of this question is to prove that the error probability of the Solovay-Strassen primality test is at most 1/2. Let [image] denote the group of units modulo n. Define

(a) Prove that G(n) is a subgroup of [image]. Hence, by Lagranges theorem, if [image], then

(b) Suppose n = pk q, where p and q are odd, p is prime, k ? 2, and gcd(p, q) = 1. Let a = 1 + pk-1 q. Prove that

HINT Use the binomial theorem to compute a(n-1)/2.

(c) Suppose n = p1, . . . ps, where the pi’s are distinct odd primes. Suppose a ? u (mod p1) and a ? 1 (mod p2p3 . . . ps), where u is a quadratic non-residue modulo p1 (note that such an a exists by the Chinese remainder theorem). Prove that

but

so

(d) If n is odd and composite, prove that |G(n)| ? (n - 1)/2.
(e) Summarize the above: prove that the error probability of the Solovay-Strassen primality test is at most 1/2.

4.15 Suppose we have a Las Vegas algorithm with failure probability ?.

(a) Prove that the probability of first achieving success on the nth trial is pn = ?n-1(1 - ?).
(b) The average (expected) number of trials to achieve success is

Show that this average is equal to 1/(1 - ?).

(c) Let ? be a positive real number less than 1. Show that the number of iterations required in order to reduce the probaility of failure to at most ? is

4.16 Suppose Bob has carelessly revealed his decryption exponent to be a = 14039 in an RSA Cryptosystem with public key n = 36581 and b = 4679. Implement the probablistic algorithm to factor n given this information. Test your algorithm with the “random” choices w = 9983 and w = 13461. Show all computations.
4.17 Prove Equations 4.1 and 4.2 relating the functions half and parity.
4.18 Suppose p = 199, q = 211 and B = 1357 in the Rabin Cryptosystem. Perform following computations.

(a) Determine the four square roots of 1 modulo n, where n = pq.
(b) Compute the encryption y = eK (32767).
(c) Determine the four possible decryptions of this given ciphertext y.

4.19 Factor 262063 and 9420457 using the p - 1 method. How big does B have to be in each case to be successful?


Chapter 5 Other Public-key Cryptosystems

Chapter 5
Other Public-key Cryptosystems

In this chapter, we look at several other public-key cryptosystems. The ElGamal Cryptosystem is based on the Discrete Logarithm problem, which we will have occasion to use in numerous cryptographic protocols throughout the rest of the text. Thus we devote a considerable amount of time to discussion of this important problem. In later sections, we give relatively brief treatments of some other well-known public-key cryptosystems. These include ElGamal-type systems based on finite fields and elliptic curves, the (broken) Merkle-Hellman Knapsack Cryptosystem and the McEliece Cryptosystem.

5.1 The ElGamal Cryptosystem and Discrete Logs

The ElGamal Cryptosystem is based on the Discrete Logarithm problem. We begin by describing this problem in the setting of a finite field [image], where p is prime, in Figure 5.1. (Recall that the multiplicative group [image] is cyclic, and a generator of [image] is called a primitive element.)

The Discrete Logarithm problem in [image] has been the object of much study. The problem is generally regarded as being difficult if p is carefully chosen. In particular, there is no known polynomial-time algorithm for the Discrete Logarithm problem. To thwart known attacks, p should have at least 150 digits, and p - 1 should have at least one “large” prime factor. The utility of the Discrete Logarithm problem in a cryptographic setting is that finding discrete logs is (probably) difficult, but the inverse operation of exponentiation can be computed efficiently by using the square-and-multiply method described earlier. Stated another way, exponentiation modulo p is a one-way function for suitable primes p.

ElGamal has developed a public-key cryptosystem based on the Discrete Logarithm problem. This system is presented in Figure 5.2.

The ElGamal Cryptosystem is non-deterministic, since the ciphertext depends on both the plaintext x and on the random value k chosen by Alice. So there will be many ciphertexts that are encryptions of the same plaintext.

Figure 5.1 The discrete logarithm problem in

Figure 5.2 ElGamal Public-key Cryptosystem in

Informally, this is how the ElGamal Cryptosystem works. The plaintext x is “masked” by multiplying it by ?k, yielding y2. The value ?k is also transmitted as part of the ciphertext. Bob, who knows the secret exponent a, can compute ?k from ?k. Then he can “remove the mask” by dividing y2 by ?k to obtain x.

A small example will illustrate.

Example 5.I

Suppose p = 2579, ? = 2, a = 765, and hence

Now, suppose that Alice wishes to send the message x = 1299 to Bob. Say k = 853 is the random integer she chooses. Then she computes

and

When Bob receives the ciphertext y = (435, 2396), he computes

which was the plaintext that Alice encrypted.


5.1.1 Algorithms for the Discrete Log Problem

Throughout this section, we assume that p is prime and a is a primitive element modulo p. We take p and ? to be fixed. Hence the Discrete Logarithm problem can be phrased in the following form: Given [image], find the unique exponent a, 0 ? a ? p - 2, such that ?a ? ? (mod p).

Clearly, the Discrete Logarithm problem can be solved by exhaustive search in O(p) time and O(1) space (neglecting logarithmic factors). By precomputing all possible values ?a, and sorting the ordered pairs (a, ?a mood p) with respect to their second coordinates, we can solve the discrete log problem in O(1) time with O(p) precomputation and O(p) memory (again, neglecting logarithmic factors). The first non-trivial algorithm we describe is a time-memory trade-off due to Shanks.

Figure 5.3 Shanks’ algorithm for the discrete logarithm problem

Shanks’ Algorithm

Denote [image]. Shanks’ algorithm is presented in Figure 5.3. Some comments are in order. First, steps 1 and 2 can be precomputed, if desired (this will not affect the asymptotic running time, however). Next, observe that if (j, y) ? L1 and (i, y) ? L2, then

so

as desired. Conversely, for any ?, we can write

where 0 ? j,i ? m - 1. Hence, the search in step 5 will be successful.

It is not difficult to implement the algorithm to run in O(m) time with O(m) memory (neglecting logarithmic factors). Note that step 5 can be done with one (simultaneous) pass through each of the two lists L1 and L2.

Here is a small example to illustrate.

Example 5.2

Suppose p = 809, and we wish to find log3 525. So we have ? = 3, ? = 525 and [image]. Then

First, we compute the ordered pairs (j, 99j mod 809) for 0 ? j ? 28. We obtain the list

(0, 1) | (1, 99) | (2, 93) | (3, 308) | (4, 559)
(5, 329) | (6, 211) | (7, 664) | (8, 207) | (9, 268)
(10, 644) | (11, 654) | (12, 26) | (13, 147) | (14, 800)
(15, 727) | (16, 781) | (17, 464) | (18, 632) | (19, 275)
(20, 528) | (21, 496) | (22, 564) | (23, 15) | (24, 676)
(25, 586) | (26, 575) | (27, 295) | (28, 81)

which is then sorted to produce L1.

The second list contains the ordered pairs (i, 525 ? (3i)-1 mod 809), 0 ? j ? 28. It is as follows:

(0, 525) | (1, 175) | (2, 328) | (3, 379) | (4, 396)
(5, 132) | (6, 44) | (7, 554) | (8, 724) | (9, 511)
(10, 440) | (11, 686) | (12, 768) | (13, 256) | (14, 355)
(15, 388) | (16, 399) | (17, 133) | (18, 314) | (19, 644)
(20, 754) | (21, 521) | (22, 713) | (23, 777) | (24, 259)
(25, 356) | (26, 658) | (27, 489) | (28, 163)

After sorting this list, we get L2.

Now, if we proceed simultaneously through the two sorted lists, we find that (10, 644) is in L1 and (19, 644) is in L2. Hence, we can compute

As a check, it can be verified that indeed 3309 ? 525 (mod 809).

The Pohlig-Hellman Algorithm

The next algorithm we study is the Pohlig-Hellman algorithm. Suppose

where the Pi’s are distinct primes. The value a = log? ? is determined (uniquely) modulo p - 1. We first observe that if we can compute a mod [image] for each i, 1 ? i ? k, then we can compute a mod (p - 1) by the Chinese remainder theorem. So, let’s suppose that q is prime,

and

We will show how to compute the value

where 0 ? x ? qc - 1. We can express x in radix q representation as

where 0 ? ai ? q - 1 for 0 ? i ? c - 1. Also, observe that we can express a as

for some integer s.

The first step of the algorithm is to compute a0. The main observation is that

To see this, note that

so it suffices to show that

This will be true if and only if

However, we have

which was what we wanted to prove.

Hence, we begin by computing ?(p-1)/q mod p. If

then a0 = 0. Otherwise, we successively compute

until

for some i. When this happens, we have a0 = i.

Now, if c = 1, we’re done. Otherwise c > 1, and we proceed to determine a1. To do this, we define

and denote

It is not hard to see that

Hence, it follows that

So, we will compute ?1(p-1)/q2 mod p, and then find i such that

Then we have a1 = i.

If c = 2, we are now finished; otherwise, we repeat this process c - 2 more times, obtaining a2,..., ac-1.

A pseudo-code description of the Pohlig-Hellman algorithm is given in Figure 5.4. In this algorithm, ? is a primitive element modulo p, q is prime,

and

The algorithm calculates a0,..., ac-1, where

We illustrate the Pohlig-Hellman algorithm with a small example.

Figure 5.4 Pohlig-Hellman algorithm to compute log?? mod qc

Example 5.3

Suppose p = 29; then

Suppose ? = 2 and ? = 18, so we want to determine a = log2 18. We proceed by first computing a mod 4 and then computing a mood 7.

We start by setting q = 2 and c = 2. First,

and

Next,

Hence, a0 = 1. Next, we compute

and

Since

we have a1 = 1. Hence, a ? 3 (mod 4).

Next, we set q = 7 and c = 1. We have

and

Then we would compute

Hence, a0 = 4 and a ? 4 (mod 7).

Finally, solving the system

using the Chinese remainder theorem, we get a ? 11 (mod 28). That is, we have computed log2 18 in [image] to be 11.

The Index Calculus Method

The index calculus method for computing discrete logs bears considerable resemblence to many of the best factoring algorithms. We give a very brief overview in this section. The method uses a factor base, which, as before, is a set [image] of “small” primes. Suppose [image]. The first step (a preprocessing step) is to find the logarithms of the B primes in the factor base. The second step is to compute a discrete log of a desired element ?, using the knowledge of the discrete logs of the elements in the factor base.

In the precomputation, we construct C = B + 10 congruences modulo p, as follows:

1 ? j ? C. Notice these congruences can be written equivalently as

1 ? j ? C. Given C congruences in the B “unknowns” log? pi (1 ? i ? B), we hope that there is a unique solution modulo p - 1. If this is the case, then we can compute the logarithms of the elements in the factor base.

How do we generate congruences of the desired form? One elementary way is to take a random value x, compute ax mod p, and then determine if ax mod p has all its factors in [image] (using trial division, for example).

Now, given that we have already successfully carried out the precomputation step, we compute a desired logarithm log? ? by means of a Las Vegas type probabilistic algorithm. Choose a random integer s (1 ? s ? p - 2) and compute

Now attempt to factor ? over the factor base [image]. If this can be done, then we obtain a congruence of the form

This can be written equivalently as

Since everything is now known except log??, we can easily solve for log??.

Here is a small, very artificial, example to illustrate the two steps in the algorithm.

Example 5.4

Suppose p = 10007 and ? = 5 is the primitive element used as the base of logarithms modulo p. Suppose we take [image] as the factor base. Of course log5 5 = 1, so there are three logs of factor base elements to be determined.

Some examples of “lucky” exponents that might be chosen are 4063, 5136 and 9865.

With x = 4063, we compute

This yields the congruence

Similarly, since

and

we obtain two more congruences:

and

We now have three congruences in three unknowns, and there happens to be a unique solution modulo 10006, namely log5 2 = 6578, log5 3 = 6190 and log5 7 = 1301.

Now, let’s suppose that we wish to find log5 9451. Suppose we choose the “random” exponent s = 7736, and compute

Since 8400 = 24315271 factors over [image], we obtain

To verify, we can check that 56087 = 9451 (mod 10007).

Heuristic analyses of various versions of the algorithm have been done. Under reasonable assumptions, the asymptotic running time of the precomputation is [image], and the time to find an individual discrete phase log is


5.1.2 Bit Security of Discrete Logs

We now look at the question of partial information about discrete logs. In particular, we consider whether individual bits of a discrete logarithm are easy or hard to compute. To be precise, consider the problem presented in Figure 5.5, which we call the i th Bit problem.

Figure 5.5 ith bit of discrete logarithm

We will first show that computing the least significant bit of a discrete logarithm is easy. In other words, if i = 1, the i th Bit problem can be solved efficiently. This follows from Euler’s criterion concerning quadratic residues modulo p, where p is prime.

Consider the mapping [image] defined by

Denote by QR(p) the set of quadratic residues modulo p; then

First, observe that f(x) = f(p - x). Next note that

if and only if

which happens if and only if

It follows that

for every y ? QR(p), and hence

That is, exactly half the residues in [image] are quadratic residues and half are not.

Now, suppose a is a primitive element of [image]. Then ?a ? QR(p) if a is even. Since the (p - 1)/2 elements ?0 mod p, ?2 mod p,..., ?p-3 mod p are all distinct, it follows that

Hence, ? is a quadratic residue if and only if log? ? is even, that is, if and only it L1(?) = 0. But we already know, by Euler’s criterion, that ? is a quadratic residue if and only if

So we have the following efficient formula to calculate L1 (?):

Let’s now consider the computation of Li(?) for values of i exceeding 1. Suppose

where t is odd. Then it can be shown that it is easy to compute Li(?) if i ? s. On the other hand, computing Ls+1 (?) is (probably) difficult, in the sense that any hypothetical algorithm (or oracle) to compute Ls+1 (?) could be used to find discrete logarithms in [image].

We shall prove this result in the case s = 1. More precisely, if p ? 3 (mod 4) is prime, then we show how any oracle for computing L2(?) can be used to solve the Discrete Log problem in [image].

Recall that, if ? is a quadratic residue in [image] and p ? 3 (mod 4), then the two square roots of ? modulo p are ± ?(p+1)/4 mod p. It is also important that, for any ? ? 0,

if p ? 3 (mod 4). We see this as follows. Suppose

then

Since p ? 3 (mod 4), the integer (p - 1)/2 is odd, and the result follows.

Now, suppose that ? = ?a for some (unknown) even exponent a. Then either

or

We can determine which of these two possibilities is correct if we know the value L2 (?), since

This fact is exploited in our algorithm, which we present in Figure 5.6.

At the end of the algorithm, the xi’s comprise the bits in the binary representation of log? ?; that is,

We will work out a small example to illustrate the algorithm.

Figure 5.6 Computing discrete logs in [image] for p ? 3 (mod 4), given an oracle for L2(?)

Example 5.5

Suppose p = 19, ? = 2 and ? = 6. Since the example is so small, we can tabulate the values of L1 (?) and L2 (?) for all [image]. (In general, L1 can be computed efficiently using Euler’s criterion and L2 is an oracle.) These values are given in Table 5.1. The algorithm now proceeds as shown in Figure 5.7.

Hence, log2 6 = 11102 = 14, as can easily be verified.

It is possible to give formal proof of the algorithm’s correctness using mathematical induction. Denote

For i ? 0, define

Also, define ?0 to be the value of ? in step 2 of the algorithm; and, for i ? 1, define ?i to be the value of ? in step 11 during the ith iteration of the while loop. It can be proved by induction that

Table 5.1 Values of L1 and L2 for p = 19, ? = 2
? | L1(?) | L2(?) | ? | L1(?) | L2(?) | ? | L1(?) | L2(?)
1 | 0 | 0 | 7 | 0 | 1 | 13 | 1 | 0
2 | 1 | 0 | 8 | 1 | 1 | 14 | 1 | 1
3 | 1 | 0 | 9 | 0 | 0 | 15 | 1 | 1
4 | 0 | 1 | 10 | 1 | 0 | 16 | 0 | 0
5 | 0 | 0 | 11 | 0 | 0 | 17 | 0 | 1
6 | 0 | 1 | 12 | 1 | 1 | 18 | 1 | 0

Figure 5.7 Computation of log2 6 in

Figure 5.8 The discrete logarithm problem in

for all i ? 0. Now, with the observation that

it follows that

i ? 0. Since

the algorithm is correct. The details are left to the reader.


5.2 Finite Field and Elliptic Curve Systems

We have spent a considerable amount of time looking at the Discrete Logarithm problem and the factoring. We will see these two problems again and again, underlying various types of cryptosystems and cryptographic protocols. So far, we have considered the Discrete Logarithm problem in the finite field [image], but it is also useful to consider the problem in other settings. This is the theme of this section.

The ElGamal Cryptosystem can be implemented in any group where the Discrete Log problem is intractible. We used the multiplicative group [image], but other groups are also suitable candidates. First, we phrase the Discrete Logarithm problem in a general (finite) group G, where we will denote the group operation by [image]. This generalized version of the problem is presented in Figure 5.8.

It is easy to define an ElGamal Cryptosystem in the subgroup H in a similar fashion as it was originally described in [image]. This is done in Figure 5.9. Note that encryption requires the use of a random integer k such that 0 ? k ? |H| - 1. However, if Alice does not know the order of the subgroup H, she can generate an integer k such that 0 ? k ? |G| - 1, and encryption and decryption will work without any changes. Also note that the group G need not be an abelian group (of course H is abelian since it is cyclic).

Figure 5.9 Generalized ElGamal Public-key Cryptosystem

Let’s now turn to the “generalized” Discrete Log problem. The subgroup H generated by any ? ? G is of course a cyclic group of order |H|. So any version of the problem is equivalent, in some sense, to the Discrete Log problem in a cyclic group. However, the difficulty of the Discrete Log problem seems to depend in an essential way on the representation of the group that is used.

As an example to illustrate a representation where the problem is easy to solve, consider the additive cyclic group [image], and suppose gcd(?, n) = 1, so ? is a generato, of [image]. Since the group operation is addition modulo n, an “exponentiation” operation, ?a, corresponds to multiplication by a modulo n. Hence, in this setting, the Discrete Log problem is to find the integer a such that

Since gcd(?, n) = 1, ? has a multiplicative inverse modulo n, and we can compute ?-1 mod n easily using the Euclidean algorithm. Then we can solve for a, obtaining

We previously discussed the Discrete Log problem in the multiplicative group [image], where p is prime. This group is a cyclic group of order p - 1, and hence it is isomorphic to the additive group [image]. By the discussion above, we know how to compute discrete logs efficiently in this additive group. This suggests that we could solve the Discrete Log problem in [image] by “reducing” the problem to the the easily solved formulation in [image].

Let us think about how this could be done. The statement that [image] is isomorphic to [image] means that there is a bijection

such that

It follows easily that

so we have that

Hence, solving for a as described above, we have that

Consequently, if we have an efficient method of computing the isomorphism ?, then we would have an efficient algorithm to compute discrete logs in [image]. The catch is that there is no known general method to efficiently compute the isomorphism ? for an arbitrary prime p. Even though we know the two groups in question are isomorphic, we do not know an efficient algorithm to explicitly describe the isomorphism.

This method can be applied to the Discrete Log problem in any group G. If there is an efficient method of computing the isomorphism between H and [image], then the discrete log problem in G described above can be solved efficiently. Conversely, it is not hard to see that an efficient method of computing discrete logs yields an efficient algorithm to compute the isomorphism between the two groups.

This discussion has shown that the Discrete Log problem may be easy or (apparently) difficult, depending on the representation of the (cyclic) group that is used. So it may be useful to look at other groups in the hope of finding other settings where the Discrete Log problem seems to be intractible.

Two such classes of groups are

1. the multiplicative group of the Galois field GF(pn)
2. the group of an elliptic curve defined over a finite field.

We will discuss these two classes of groups in the next subsections.


5.2.1 Galois Fields

We have already discussed the fact that [image] is a field if p is prime. However, there are other examples of finite fields not of this form. In fact, there is a finite field with q elements if q = pn where p is prime and n ? 1 is an integer. We will now describe very briefly how to construct such a field. First, we need several definitions.

DEFINITION 5.1 Suppose p is prime. Define [image] to be the set of all polynomials in the indeterminate x. By defining addition and multiplication of polynomials in the usual way (and reducing coefficients modulo p), we construct a ring.

For [image], we say that f(x) divides g(x) (notation: f(x) | g(x)) if there exists [image] such that

For [image], define deg(f), the degree of f, to be the highest exponent in a term of f.

Suppose f(x), g(x), [image], and deg(f) = n ? 1. We define

if

Notice the resemblance of the definition of congruence of polynomials to that of congruence of integers.

We are now going to define a ring of polynomials “modulo f(x)” which we denote by [image]. The construction of [image] from [image] is based on the idea of congruences modulo f(x) and is analogous to the construction of [image] from [image].

Suppose deg(f) = n. If we divide g(x) by f(x), we obtain a (unique) quotient q(x) and remainder r(x), where

and

This can be done by usual long division of polynomials. Hence any polynomial in [image] is congruent modulo f(x) to a unique polynomial of degree at most n - 1.

Now we define the elements of [image] to be the pn polynomials in [image] of degree at most n - 1. Addition and multiplication in [image] is defined as in [image], followed by a reduction modulo f(x). Equipped with these operations, [image] is a ring.

Recall that [image] is a field if and only if m is prime, and multiplicative inverses can be found using the Euclidean algorithm. A similar situation holds for [image]. The analog of primality for polynomials is irreducibility, which we define as follows:

DEFINITION 5.2 A polynomial [image] is said to be irreducible if there do not exist polynomials [image] such that

where deg(f1) > 0 and deg (f2) > 0.

A very important fact is that [image] is a field if and only if f(x) is irreducible. Further, multiplicative inverses in [image] can be computed using a straightforward modification of the (extended) Euclidean algorithm.

Here is an example to illustrate the concepts described above.

Example 5.6

Let’s attempt to construct a field having eight elements. This can be done by finding an irreducible polynomial of degree three in [image]. It is sufficient to consider the polynomials having constant term equal to 1, since any polynomial with constant term 0 is divisible by x and hence is reducible. There are four such polynomials:

Now, f1 (x) is reducible, since

(remember that all coefficients are to be reduced modulo 2). Also, f4 is reducible since

However, f2(x) and f3(x) are both irreducible, and either one can be used to construct a field having eight elements.

Let us use f2(x), and thus construct the field [image]. The eight field elements are the eight polynomials 0, 1, x, x + 1, x2, x2 + 1, x2 + x and x2 + x + 1.

To compute a product of two field elements, we multiple the two polynomials together, and reduce modulo x3 + x + 1 (i.e., divide by x3 + x + 1 and find the remainder polynomial). Since we are dividing by a polynomial of degree three, the remainder will have degree at most two and hence is an element of the field.

For example, to compute (x2 + 1)(x2 + x + 1) in [image], we first compute the product in [image], which is x4 + x3 + x + 1. Then we divide by x3 + x + 1, obtaining the expression

Hence, in the field [image], we have that

Below, we present a complete multiplication table for the non-zero field elements. To save space, we write a polynomial a2x2 + a1 x + a0 as the ordered triple a2a1 a0.

Computation of inverses can be done by using a straightforward adaptation of the extended Euclidean algorithm.

Finally, the multiplicative group of the non-zero polynomials in the field is a cyclic group of order seven. Since 7 is prime, it follows that any non-zero field element is a generator of this group, i.e., a primitive element of the field.

For example, if we compute the powers of x, we obtain

which comprise all the non-zero field elements.

It remains to discuss existence and uniqueness of fields of this type. It can be shown that there is at least one irreducible polynomial of any given degree n ? 1 in [image]. Hence, there is a finite field with pn elements for all primes p and all integers n ? 1. There are usually many irreducible polynomials of degree n in [image]. But the finite fields constructed from any two irreducible polynomials of degree n can be shown to be isomorphic. Thus there is a unique finite field of any size pn (p prime, n ? 1), which is denoted by GF(pn). In the case n = 1, the resulting field GF(p) is the same thing as [image]. Finally, it can be shown that there does not exist a finite field with r elements unless r = pn for some prime p and some integer n ? 1.

We have already noted that the multiplicative group [image] (p prime) is a cyclic group of order p - 1. In fact, the multiplicative group of any finite field is cyclic: GF(pn)\{0} is a cyclic group of order pn - 1. This provides further examples of cyclic groups in which the discrete log problem can be studied.

In practice, the finite fields GF(2n) have been most studied. Both the Shanks and Pohlig-Hellman discrete logarithm algorithms work for fields GF(2n). The index calculus method can be modified to work in these fields. The precomputation time of the index calculus algorithm turns out to be

and the time to find an individual discrete log is

However, for large values of n (say n > 800), the discrete log problem in GF(2n) is thought to be intractible provided 2n - 1 has at least one “large” prime factor (in order to thwart a Pohlig-Hellman attack).


5.2.2 Elliptic Curves

We begin by defining the concept of an elliptic curve.

DEFINITION 5.3 Let p > 3 be prime. The elliptic curve y2 = x3 + ax + b over [image], is the set of solutions [image] to the congruence

where a, [image] are constants such that 4a3 + 27b2 ? 0 (mod p), together with a special point O called the point at infinity.1

1Equation 5.1 can be used to define an elliptic curve over any field GF(pn), for p > 3 prime. An elliptic curve over GF(2n) or GF(3n) is defined by a slightly different equation.

An elliptic curve E can be made into an abelian group by defining a suitable operation on its points. The operation is written additively, and is defined as follows (where all arithmetic operations are performed in [image]: Suppose

and

are points on E. If x2 = x1 and y2 = -y1, then [image]; otherwise P + Q = (x3, y3), where

and

Finally, define

for all P ? E. With this definition of addition, it can be shown that E is an abelian group with identity element [image] (most of the verifications are tedious but straightforward, but proving associativity is quite difficult).

Note that inverses are very easy to compute. The inverse of (x, y) (which we write as -(x, y) since the group operation is additive) is (x, -y), for all (x, y) ? E.

Let us look at a small example.

Example 5.7

Let E be the elliptic curve y2 = x3 + x + 6 over [image]. Let’s first determine the points on E. This can be done by looking at each possible [image], computing x3 + x + 6 mod 11, and then trying to solve Equation 5.1 for y. For a given x we can test to see if z = x3 + x + 6 mod 11 is a quadratic residue by applying Euler’s criterion. Recall that there is an explicit formula to compute square roots of quadratic residues modulo p for primes p ? 3 (mod 4). Applying this formula, we have that the square roots of a quadratic residue z are

The results of these computations are tabulated in Table 5.2.

Thus E has 13 points on it. Since any group of prime order is cyclic, it follows that E is isomorphic to [image], and any point other than the point at infinity is a generator of E. Suppose we take the generator ? = (2, 7). Then we can compute the

Table 5.2 Points on the elliptic curve y2 = x3 + x + 6 over
x | x3+x+6 mod 11 | in QR(11)? | y
0 1 2 3 4 5 6 7 8 9 10 | 6 8 5 3 8 4 8 4 9 7 4 | no no yes yes no yes no yes yes no yes | 4,7 5,6 2,9 2,9 3,8 2, 9

“powers” of ? (which we will write as multiples of ?, since the group operation is additive). To compute 2? = (2, 7) + (2, 7), we first compute

Then we have

and

so 2? (5, 2).

The next multiple would be 3? = 2? + ? = (5, 2) + (2, 7). Again, we begin by computing ?, which in this situation is done as follows:

Then we have

and

so 3? = (8, 3).

Continuing in this fashion, the remaining multiples can be computed to be the following:

? | = | (2,7) | 2? | = | (5,2) | 3? | = | (8,3)
4? | = | (10,2) | 5? | = | (3,6) | 6? | = | (7,9)
7? | = | (7,2) | 8? | = | (3,5) | 9? | = | (10,9)
10? | = | (8,8) | 11? | = | (5,9) | 12? | = | (2, 4)

Hence ? = (2.7) is indeed a primitive element.

An elliptic curve E defined over [image] (p prime, p > 3) will have roughly p points on it. More precisely, a well-known theorem due to Hasse asserts that the number of points on E, which we denote by #E, satisfies the following inequality

Computing the exact value of #E is more difficult, but there is an efficient algorithm to do this, due to Schoof. (By “efficient” we mean that it has a running time that is polynomial in log p. School’s algorithm has a running time of O((log p)8) bit operations and is practical for primes p having several hundred digits.)

Now, given that we can compute #E, we further want to find a cyclic subgroup of E in which the discrete log problem is intractible. So we would like to know something about the structure of the group E. The following theorem gives a considerable amount of information on the group structure of E.

THEOREM 5.1

Let E be an elliptic curve defined over [image], where p is prime, p > 3. Then there exist integers n1 and n2 such that E is isomorphic to [image]. Further, n2 | n1 and n2 | (p - 1).

Hence, if the integers n1 and n2 can be computed, then we know that E has a cyclic subgroup isomorphic to [image] that can potentially be used as a setting tot an ElGamal Cryptosystem.

Note that if n2 = 1, then E is a cyclic group. Also, if #E is a prime, or the product of distinct primes, then E must be a cyclic group.

The Shanks and Pohlig-Hellman algorithms apply to the elliptic curve logarithm problem, but there is no known adaptation of the index calculus method to elliptic curves. However, there is a method of exploiting an explicit isomorphism between elliptic curves and finite fields that leads to efficient algorithms for certain classes of elliptic curves. This technique, due to Menezes, Okamoto and Vanstone, can be applied to some particular examples within a special class of elliptic curves called supersingular curves that were suggested for use in cryptosystems. If the supersingular curves are avoided, however, then it appears that an elliptic curve having a cyclic subgroup of size about 2160 will provide a secure setting for a cryptosystem, provided that the order of the subgroup is divisible by at least one large prime factor (again, to guard against a Pohlig-Hellman attack).

Let’s now look at an example of ElGamal encryption using the elliptic curve of Example 5.7.

Example 5.8

Suppose that ? = (2, 7) and Bob’s secret “exponent” is a = 7, so

Thus the encryption operaton is

where x ? E and 0 ? k ? 12, and the decryption operation is

Suppose that Alice wishes to encrypt the message x = (10, 9) (which is a point on E). If she chooses the random value k = 3, then she will compute

and

Hence, y = ((8, 3), (10, 2)). Now, if Bob receives the ciphertext y, he decrypts it as follows:

Hence, the decryption yields the correct plaintext.

There are some practical difficulties in implementing an ElGamal Cryptosystem on an elliptic curve. This system, when implemented in [image] (or in GF(pn) with n > 1) has a message expansion factor of two. An elliptic curve implementation has a message expansion factor of (about) four. This happens since there are approximately p plaintexts, but each ciphertext consists of four field elements. A more serious problem is that the plaintext space consists of the points on the curve E, and there is no convenient method known of deterministically generating points on E.

A more efficient variation has been found by Menezes and Vanstone. In this variation, the elliptic curve is used for “masking,” and plaintexts and ciphertexts are allowed to be arbitrary ordered pairs of (nonzero) field elements (i.e., they are not required to be points on E). This yields a message expansion factor of two, the same as in the original ElGamal Cryptosystem. The Menezes-Vanstone Cryptosystem is presented in Figure 5.10.

If we return to the curve y2 = x3 + x + 6 over [image], we see that the Menezes-Vanstone Cryptosystem allows 10 ? 10 = 100 plaintexts, as compared to 13 in the original system. We illustrate encryption and decryption in this system using this same curve.

Example 5.9

As in the previous example, suppose that ? = (2, 7) and Bob’s secret “exponent” is a = 7, so

Suppose Alice wants to encrypt the plaintext

(note that x is not a point on E), and she chooses the random value k = 6. First, she computes

and

so c1 = 8 and c2 =3.

Next, she calculates

and

Figure 5.10 Menezes-Vanstone Elliptic Curve Cryptosystem

The ciphertext she sends to Bob is

When Bob receives the ciphertext y, he first computes

and then

Figure 5.11 Subset summ problem

Hence, the decryption yields thee correct plaintext


5.3 The Merkle-Hellman Knapsack System

The well-known Merkle-Hellman Knapsack Cryptosytem was first described by Merkle and Hellman in 1978. Although this cryptosystem, and several variants of it, were broken in the early 1980’s, it is still worth studying for its conceptual elegance and for the underlying design technique.

The term “knapsack” is actually a misnomer2.; the system is based on the Subset Sum problem which is presented in Figure 5.11.

2The Knapsack problem, as it is usually defined, is a problem involving selecting objects with given weights and profits in such a way that a specified capacity is not exceeded and a specified target profit is attained

The Subset Sum problem, as phrased in Figure 5.11, is a decision problem (i.e., we are required only to answer “yes” or “no”). If we rephrase the problem slightly, so that in any instance where the answer is "yes" we are required to find the desired vector x (which may not be unique), then we have a search problem.

Figure 5.12 Algorithm for solving a superincreasing instance of the subset sum problem

The Subset Sum (decision) problem is one of the so-called NP-complete problems. Among other things, this means that there is no known polynomial-time algorithm that solves it. This is also the case for the Subset Sum search problem. But even if a problem has no polynomial-time algorithm to solve it in general, this does not rule out the possibility that certain special cases can be solved in polynomial time. This is indeed the situation with the Subset Sum problem.

We define a list of sizes, (s1, . . . , sn) to be superincreasing if

for 2 ? j ? n. If the list of sizes is superincreasing, then the search version of the Subset Sum problem can be solved very easily in time O(n), and a solution x (if it exists) must be unique. The algorithm to do this is presented in Figure 5.12.

Suppose s = (s1, . . . , sn) is superincreasing, and consider the function

defined by the rule

Is es a possible candidate for an encryption rule? Since s is superincreasing, es is an injection, and the algorithm presented in Figure 5.12 would be the corresponding decryption algorithm. However, such a system would be completely insecure since anyone (including Oscar) can decrypt a message that is encrypted in this way.

The strategy therefore is to transform the list of sizes in such a way that it is no longer superincreasing. Bob will be able to apply an inverse transformation to restore the superincreasing list of sizes. On the other hand Oscar, who does not know the transformation that was applied, is faced with what looks like a general, apparently difficult, instance of the subset sum problem when he tries to decrypt a ciphertext.

One suitable type of transformation is a modular transformation. That is, a prime modulus p is chosen such that

as well as a multiplier a, where 1 ? a ? p - 1. Then we define

1 ? i ? n. The list of sizes t = (t1,...,tn) will be the public key used for encryption. The values a, p used to define the modular transformation are secret. The complete description of the Merkle-Hellman Knapsack Cryptosystem is given in Figure 5.13.

The following small example illustrates the encryption and decryption operations in the Merkle-Hellman Cryptosystem.

Example 5.10

Suppose

is the secret superincreasing list of sizes. Suppose p = 2003 and a = 1289. Then the public list of sizes is

Now, if Alice wants to encrypt the plaintext x = (1, 0, 1, 1, 0, 0, 1, 1, 1), she computes

When Bob receives the ciphertext y, he first computes

Then Bob solves the instance I = (s, z) of the Subset Sum problem using the algorithm presented in Figure 5.12. The plaintext (1, 0, 1, 1, 0, 0, 1, 1, 1) is obtained.

Figure 5.13 Merkle-Hellman Knapsack Cryptosystem

By the early 1980’s, the Merkle-Hellman Knapsack Cryptosystem had been broken by Shamir. Shamir was able to use an integer programming algorithm of Lenstra to break the system. This allows Bob’s trapdoor (or an equivalent trapdoor) to be discovered by Oscar, the cryptanalyst. Then Oscar can decrypt messages exactly as Bob does.


5.4 The McEliece System

The McEliece Cryptosystem uses the same design principle as the MerkleHellman Cryptosystem: decryption is an easy special case of an NP-complete problem, disguised so that it looks like a general instance of the problem. In this system, the NP-complete problem that is employed is decoding a general linear (binary) error-correcting code. However, for many special classes of codes, polynomial-time algorithms are known to exist. One such class of codes, the Goppa codes, are used as the basis of the McEliece Cryptosystem.

We begin with some essential definitions.

DEFINITION 5.4 Let k, n be positive integers, k ? n. An [n, k] code, C, is a k-dimensional subspace of [image], the vector space of all binary n-tuples.

A generating matrix for an [n, k] code, C, is a k ? n binary matrix whose rows form a basis for C.

Let x, [image], where x = (x1, . . . , xn) and y = (y1 , . . . , yn). Define the Hamming distance

i.e., the number of coordinates in which x and y differ.

Let C be an [n, k] code. Define the distance of C to be the quantity

An [n, k] code with distance d is denoted as an [n, k, d] code.

The purpose of an error-correcting code is to correct random errors that occur in the transmission of (binary) data through a noisy channel. Briefly, this is done as follows. Let G be a generating matrix for an [n, k, d] code. Suppose x is the binary k-tuple we wish to transmit. Then Alice encodes x as the n-tuple y = x G, and transmits y through the channel.

Now, suppose Bob receives the n-tuple r, which may not be the same as y. He will decode r using the strategy of nearest neighbor decoding. In nearest neighbor decoding, Bob finds the codeword y? that has minimum distance to r. Then he decodes r to y?, and, finally, determines the k-tuple x? such that y? = x?G. Bob is hoping that y? = y, so x? = x (i.e., he is hoping that any transmission errors have been corrected).

It is fairly easy to show that if at most (d - 1)/2 errors occurred during transmission, then nearest neighbor decoding does in fact correct all the errors.

Let us think about how nearest neighbor decoding would be done in practice. |C| = 2k, so if Bob compares r to every codeword, he will have to examine 2k vectors, which is an exponentially large number compared to k. In other words, this obvious algorithm is not a polynomial-time algorithm.

Another approach, which forms the basis for many practical decoding algorithms, is based on the idea of a syndrome. A parity-check matrix for an [n, k, d] code C having generating matrix G is an (n - k) ? n 0 - 1 matrix, denoted by H, whose rows form a basis for the orthogonal complement of C, which is denoted by C? and called the dual code to C. Stated another way, the rows of H are linearly independent vectors, and GHT is a k ? (n - k) matrix of zeroes.

Given a vector [image], we define the syndrome of r to be HrT. A syndrome is a column vector with n - k components.

The following basic results follow immediately from linear algebra.

THEOREM 5.2

Suppose C is an [n, k] code with generating matrix G and parity-check matrix H. Then [image] is a codeword if and only if

Further; if [image], and r = x + e, then H r T = H e T.

Think of e as being the vector of errors that occur during transmission of a codeword x. Then r represents the vector that is received. The above theorem is saying that the syndrome depends only on the errors, and not on the particular codeword that was transmitted.

This suggests the following approach to decoding, known as syndrome decoding: First, compute s = H r T. If s is a vector of zeroes, then decode r as r. If not, then generate all possible error vectors or weight 1 in turn. For each such e, compute H e T. If, for any of these vectors e, it happens that H e T = s, then decode r to r - e. Otherwise, continue on to generate all error vectors of weight 2, . . . , ?(d - 1)/2?. If at any time H e T = s, then we decode r to r - e and quit. If this equation is never satisfied, then we conclude that more than ?(d - 1)/2? errors have occurred during transmission.

By this approach, we can decode a received vector in at most

steps.

This method will work on any linear code. For certain specific types of codes, the decoding procedure can be speeded up. However, a decision version of nearest neighbor decoding is in fact an NP-complete problem. Thus no polynomial-time algorithm is known for the general problem of nearest neighbor decoding (when the number of errors is not bounded by ?(d - 1)/2?).

As was the case with the subset sum problem, we can identify an “easy” special case, and then disguise it so that it looks like a “difficult” general case of the problem. It would take us too long to go into the theory here, so we will just summarize the results. The “easy” special case that was suggested by McEliece is to use a code from a class of codes known as the Goppa codes. These codes do in fact have efficient decoding algorithms. Also, they are easy to generate, and there are a large number of inequivalent Goppa codes with the same parameters.

The parameters of the Goppa codes have the form n = 2m, d = 2t + 1 and k = n - mt. For a practical implementation of the public-key cryptosystem, McEliece suggested taking m = 10 and t = 50. This gives rise to a Goppa code that is a [1024, 524, 101] code. Each plaintext is a binary 524-tuple, and each ciphertext is a binary 1024-tuple. The public key is a 524 ? 1024 binary matrix.

Figure 5.14 McEliece Cryptosystem

A description of the McEliece Cryptosystem is given in Figure 5.14.

We present a ridiculously small example to illustrate the encoding and decoding procedures.

Example 5.11

The matrix

is a generating matrix for a [7, 4, 3] code, known as a Hamming code. Suppose Bob chooses the matrices

and

Then, the public generating matrix is

Now, suppose Alice encrypts the plaintext x = (1, 1, 0, 1) using as the random error vector of weight 1 the vector e = (0, 0, 0, 0, 1, 0, 0). The ciphertext is computed to be

When Bob receives the ciphertext y, he first computes

Next, he decrypts y1 to get x1 = (1, 0, 0, 0, 1, 1, 0) (note that e1 ? e due to the multiplication by P-1).

Next, Bob forms x0 = (1, 0, 0, 0) (the first four components of x1).

Finally, Bob calculates

This is indeed the plaintext that Alice encrypted.


5.5 Notes and References

The ElGamal Cryptosystem was presented in [EL85]. The Pohlig-Hellman algorithm was published in [PH78], and the material concerning individual bits of the Discrete Logarithm problem is based on Peralta [PE86]. For further information on the Discrete Logarithm problem, we recommend the articles by LaMacchia and Odlyzko [LO91] and McCurley [MC90].

The main reference book for finite fields is Lidl and Niederreiter [LN83]. McEliece [MC87] is a good textbook on the subject, and a research monograph on applications of finite fields was published by Menezes et al. [MBGMVY93]. A recent article on the Discrete Logarithm problem in GF(2n) is Gordon and McCurley [GM93].

The idea of using elliptic curves for public-key cryptosystems is due to Koblitz [KO87] and Miller [MI86]. Menezes [ME93] is a monograph on elliptic curve cryptosystems. See also Menezes and Vanstone [MV93] and Koblitz [KO94]. For an elementary treatment of elliptic curves, see Silverman and Tate [ST92]. The Menezes-Okamoto-Vanstone reduction of discrete logarithms from elliptic curves to finite fields is given in [MOV94] (see also [ME93]).

The Merkle-Hellman Cryptosystem was presented in [MH78]. This system was broken by Shamir [SH84], and the “iterated” version of the system was broken by Brickell [BR85]. A different knapsack-type system, due to Chor and Rivest [CR88], has not been broken. For more information, see the survey article by Brickell and Odlyzko [BO92].

The most important reference book for coding theory is MacWilliams and Sloane [MS77] There are many good textbooks on coding theory, e.g., Hoffman et al. [HLLPRW91] and Vanstone and van Oorschot [VV89]. The McEliece Cryptosystem was first described in [MC78]. A recent article discussing the security of this cryptosystem is by Chabaud [CH95].


Chapter 5 Exercises

Exercises

5.1 Implement Shanks’ algorithm for finding discrete logarithms in [image], where p is prime and ? is a primitive element. Use your program to find log106 12375 in [image] and log6 248388 in [image].
5.2 Implement the Pohlig-Hellman algorithm for finding discrete logarithms in [image], where p is prime and ? is a primitive element. Use your program to find log5 8563 in [image] and log10 12611 in [image].
5.3 Find log5 896 in [image] using the algorithm presented in Figure 5.6, given that L2(?) = 1 for ? = 25, 219 and 841, and L2(?) = 0 for ? = 163, 532, 625 and 656.
5.4 Decrypt the ElGamal ciphertext presented in Table 5.3. The parameters of the system arc p = 31847, ? = 5, a = 7899 and ? = 18074. Each element of [image] represents three alphabetic characters as in Exercise 4.6.

The plaintext was taken from “The English Patient,” by Michael Ondaatje, Alfred A. Knopf, Inc., New York, 1992.

5.5 Determine which of the following polynomials are irreducible over [image].
5.6 The field GF(25) can be constructed as [image]. Perform the following computations in this field.

(a) Compute (x4 + x2) ? (x3 + x + 1).
(b) Using the extended Euclidean algorithm, compute (x3 + x2)-1
(c) Using the square-and-multiply algorithm, compute x25.

5.7 We give an example of the ElGamal Cryptosystem implemented in GF(33). The polynomial x3+2x2+1 is irreducible over [image] and hence [image] is the field GF(33). We can associate the 26 letters of the alphabet with the 26 nonzero field elements, and thus encrypt ordinary text in a convenient way. We will use a lexicographic ordering of the (nonzero) polynomials to set up the correspondence. This correspondence is as follows:

Suppose Bob uses ? = x and a = 11 in an ElGamal system; then ? = x + 2. Show how Bob will decrypt the following string of ciphertext:

(K, H) (P X) (N, K) (H,R) (T,F) (V, Y) (E, H) (F, A) (T, W) (J, D)(U, J)

Table 5.3 ElGamal Ciphertext
(3781, 14409) | (31552, 3930) | (27214, 15442) | (5809, 30274)
(54000, 31486) | (19936, 721) | (27765, 29284) | (29820, 7710)
(31590, 26470) | (3781, 14409) | (15898, 30844) | (19048, 12914)
(16160, 3129) | (301, 17252) | (24689, 7776) | (28856, 15720)
(30555, 24611) | (20501, 2922) | (13659, 5015) | (5740, 31233)
(1616, 14170) | (4294, 2307) | (2320, 29174) | (3036, 20132)
(14130, 22010) | (25910, 19663) | (19557, 10145) | (18899, 27609)
(26004, 25056) | (5400, 31486) | (9526, 3019) | (12962, 15189)
(29538, 5408) | (3149, 7400) | (9396, 3058) | (27149, 20535)
(1777, 8737) | (26117, 14251) | (7129, 18195) | (25302, 10248)
(23258, 3468) | (26052, 20545) | (21958, 5713) | (346, 31194)
(8836, 25898) | (8794, 17358) | (1777, 8737) | (25038, 12483)
(10422, 5552) | (1777, 8737) | (3780, 16360) | (11685, 133)
(25115, 10840) | (14130, 22010) | (16081, 16414) | (28580, 20845)
(23418, 22058) | (24139, 9580) | (173, 17075) | (2016, 18131)
(198886, 22344) | (21600, 25505) | (27119, 19921) | (23312, 16906)
(21563, 7891) | (28250, 21321) | (28327, 19237) | (15313, 28649)
(24271, 8480) | (26592, 25457) | (9660, 7939) | (10267, 20623)
(30499, 14423) | (5839, 24179) | (12846, 6598) | (9284, 27858)
(24875, 17641) | (1777, 8737) | (18825, 19671) | (31306, 11929)
(3576, 4630) | (26664, 27572) | (27011, 29164) | (22763, 8992)
(3149, 7400) | (8951, 29435) | (2059, 3977) | (16258, 30341)
(21541, 19004) | (5865, 29526) | (10536, 6941) | (1777, 8737)
(17561, 11884) | (2209, 6107) | (10422, 5552) | (19371, 21005)
(26521, 5803) | (14884, 14280) | (4328, 8635) | (28250, 21321)
(28327, 19237) | (15313, 28649)
5.8 Let E be the elliptic curve y2 = x3 + x + 28 defined over [image].

(a) Determine the number of points on E.
(b) Show that E is not a cyclic group.
(c) What is the maximum order of an element in E? Find an element having this order.

5.9 Let E be the elliptic curve y2 = x3 + x + 13 defined over [image]. It can be shown that #E = 34 and (9, 10) is an element of order 34 in E. The Menezes-Vanstone Cryptosystem defined on E will have as its plaintext space [image]. Suppose Bob’s secret exponent is a = 25.

(a) Compute ? = a?.
(b) Decrypt the following string of ciphertext:

((4, 9), 28, 7), ((19, 28), 9, 13), ((5,22), 20, 17), ((25, 16), 12, 27).

(c) Assuming that each plaintext represents two alphabetic characters, convert the plaintext into an English word. (Here we will use the correspondence A - 1, . . . , Z - 26, since 0 is not allowed in a (plaintext) ordered pair.)

5.10 Suppose the Merkle-Hellman Cryptosystem has as its public list of sizes the vector

Suppose Oscar discovers that p = 2503.

(a) By trial and error, determine the value a such that the list a-1t mod p is a permutation of a superincreasing list.
(b) Show how the ciphertext 5746 would be decrypted.

5.11 It can be shown that the matrix H shown below is a parity-check matrix for a [15, 7, 5] code called a BCH code.

Decode, it possible, each of the following received vectors r using the syndrome decoding method.

(a) r = (1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0).
(b) r = (1, 1, 0, 1, 1, 1, 1, 0, 1, 0, 1, 1, 0, 0, 0).
(c) r = (1, 0, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0, 0, 0, 0).


Chapter 6 Signature Schemes

Chapter 6
Signature Schemes

6.1 Introduction

In this chapter, we study signature schemes, which are also called digital signatures. A “conventional” handwritten signature attached to a document is used to specify the person responsible for it. A signature is used in everyday situations such as writing a letter, withdrawing money from a bank, signing a contract, etc.

A signature scheme is a method of signing a message stored in electronic form. As such, a signed message can be transmitted over a computer network. In this chapter, we will study several signature schemes, but first we discuss some fundamental differences between conventional and digital signatures.

First is the question of signing a document. With a conventional signature, a signature is physically part of the document being signed. However, a digital signature is not attached physically to the message that is signed, so the algorithm that is used must somehow “bind” the signature to the message.

Second is the question of verification. A conventional signature is verified by comparing it to other, authentic signatures. For example, when someone signs a credit card purchase, the salesperson is supposed to compare the signature on the sales slip to the signature on the back of the credit card in order to verify the signature. Of course, this is not a very secure method as it is relatively easy to forge someone else’s signature. Digital signatures, on the other hand, can be verified using a publicly known verification algorithm. Thus, “anyone” can verify a digital signature. The use of a secure signature scheme will prevent the possibility of forgeries.

Another fundamental difference between conventional and digital signatures is that a “copy” of a signed digital message is identical to the original. On the other hand, a copy of a signed paper document can usually be distinguished from an original. This feature means that care must be taken to prevent a signed digital message from being reused. For example, if Bob signs a digital message authorizing Alice to withdraw $100 from his bank account (i.e., a check), he only wants Alice to be able to do so once. So the message itself should contain information, such as a date, that prevents it from being reused.

A signature scheme consists of two components: a signing algorithm and a verification algorithm. Bob can sign a message x using a (secret) signing algorithm sig. The resulting signature sig(x) can subsequently be verified using a public verification algorithm ver. Given a pair (x, y), the verification algorithm returns an answer “true” or “false” depending on whether the signature is authentic.

Here is a formal defintion of a signature scheme.

DEFINITION 6.1 A signature scheme is a five-tuple [image], where the following conditions are satisfied:

1. is a finite set of possible messages
2. is a finite set of possible signatures
3. , the keyspace, is a finite set of possible keys
4. For each [image], there is a signing algorithm [image] and a corresponding verification algorithm [image]. Each sigK : and verK : > {true, false} are functions such that the following equation is satisfied for every message [image] and for every signature [image] :

For every [image], the functions sigK and verK should be polynomial-time functions. verK will be a public function and sigK will be secret. It should be computationally infeasible for Oscar to “forge” Bob’s signature on a message x. That is, given x, only Bob should be able to compute the signature y such that ver(x, y) = true. A signature scheme cannot be unconditionally secure, since Oscar can test all possible signatures y for a message x using the public algorithm ver, until he finds the right signature. So, given sufficient time, Oscar can always forge Bob’s signature. Thus, as was the case with public-key cryptosystems, our goal is to find signature schemes that are computationally secure.

As our first example of a signature scheme, we observe that the RSA public-key cryptosystem can be used to provide digital signatures. See Figure 6.1.

Thus, Bob signs a message x using the RSA decryption rule dK. Bob is the only person that can create the signature since dK = sigK is secret. The verification algorithm uses the RSA encryption rule eK. Anyone can verify a signature since eK is public.

Note that anyone can forge Bob’s signature on a “random” message x by computing x = eK(y) for some y; then y = sigK(x). One way around this difficulty is to require that messages contain sufficient redundancy that a forged signature of this type does not correspond to a “meaningful” message x except with a very small probability. Alternatively, the use of hash functions in conjunction with signature schemes will eliminate this method of forging (cryptographic hash functions will be discussed in Chapter 7).

Figure 6.1 RSA Signature Scheme

Finally, let’s look briefly at how we would combine signing and public-key encryption. Suppose Alice wishes to send a signed, encrypted message to Bob. Given a plaintext x, Alice would compute her signature y = sig Alice(x), and then encrypt both x and y using Bob’s public encryption function eBob, obtaining z = eBob (x, y). The ciphertext z would be transmitted to Bob. When Bob receives z, he first decrypts it with his decryption function dBob to get (x, y). Then he uses Alice’s public verification function to check that ver Alice(x, y) = true.

What if Alice first encrypted x, and then signed the result? Then she would compute

Alice would transmit the pair (z, y) to Bob. Bob would decrypt z, obtaining x, and then verify the signature y on x using ver Alice. One potential problem with this approach is that if Oscar obtains a pair (z, y) of this type, he could replace Alice’s signature y by his own signature

(Note that Oscar can sign the ciphertext z = eBob(x) even though he doesn’t know the plaintext x.) Then, if Oscar transmits (z, y?) to Bob, Oscar’s signature will be verified by Bob using verOscar, and Bob may infer that the plaintext x originated with Oscar. Because of this potential difficulty, most people recommend signing before encrypting.

Figure 6.2 ElGamal Signature Scheme


6.2 The ElGamal Signature Scheme

We now describe the ElGamal Signature Scheme, which was described in a 1985 paper. A modification of this scheme has been adopted as a digital signature standard by the National Institute of Standards and Technology (NIST). The ElGamal Scheme is designed specifically for the purpose of signatures, as opposed to RSA, which can be used both as a public-key cryptosystem and a signature scheme.

The ElGamal Signature Scheme is non-deterministic, as was the ElGamal Public-key Cryptosystem. This means that there are many valid signatures for any given message. The verification algorithm must be able to accept any of the valid signatures as authentic. The description of the ElGamal Signature Scheme is given in Figure 6.2.

If the signature was constructed correctly, then the verification will succeed, since

where we use the fact that

Bob computes a signature using both the secret value a (which is part of the key) and the secret random number k (which is used to sign one message, x). The verification can be accomplished using only public information.

Let’s do a small example to illustrate the arithmetic.

Example 6.1

Suppose we take p = 467, ? = 2, a = 127; then

Suppose Bob wants to sign the message x = 100 and he chooses the random value k = 213 (note that gcd(213, 466) = 1 and 213-1 mod 466 = 431). Then

and

Anyone can verify this signature by checking that

and

Hence, the signature is valid.

Let’s look at the security of the ElGamal Signature Scheme. Suppose Oscar tries to forge a signature for a given message x, without knowing a. If Oscar chooses a value ? and then tries to find the corresponding ?, he must compute the discrete logarithm log? ?x?-?. On the other hand, if he first chooses ? and then tries to find ?, he is trying to “solve” the equation

for the “unknown” ?. This is a problem for which no feasible solution is known; however, it does not seem to be related to any well-studied problem such as the Discrete Logarithm problem. There also remains the possibility that there might be some way to compute ? and ? simultaneously in such a way that (?, ?) will be a signature. No one has discovered a way to do this, but conversely, no one has proved that it cannot be done.

If Oscar chooses ? and ? and then tries to solve for x, he is again faced with an instance of the Discrete Logarithm problem, namely the computation of log? ????. Hence, Oscar cannot sign a “random” message using this approach. However, there is a method by which Oscar can sign a random message by choosing ?, ? and x simultaneously: Suppose i and j are integers, 0 ? i ? p -2, 0 ? j ? p - 2, and gcd(j, p - 1) = 1. Then perform the following computations:

where j-1 is computed modulo (p - 1) (this is where we require that j be relatively prime to p - 1).

We claim that (?, ?) is a valid signature for the message x. This is proved by checking the verification condition:

We illustrate with an example.

Example 6.2

As in the previous example, suppose p = 467, ? = 2 and ? = 132. Suppose Oscar chooses i = 99 and j = 179; then j-1 mod (p - 1) = 151. He would compute the following:

Then (117, 41) is a valid signature for the message 331, as may be verified by checking that

and

Hence, the signature is valid.

Here is a second type of forgery, in which Oscar begins with a message previously signed by Bob. Suppose (?, ?) is a valid signature for a message x. Then it is possible for Oscar to sign various other messages. Suppose h, i and j are integers, 0 ? h, i, j ? p - 2, and gcd(h? - j?, p - 1) = 1. Compute the following:

where (h? - j?)-1 is computed modulo (p - 1). Then, it is tedious but straight-forward to check the verification condition:

Hence (?, ?) is a valid signature for x?.

Both of these methods produce valid forged signatures, but they do not appear to enable an opponent to forge a signature on a message of his own choosing without first solving a discrete logarithm problem. Hence, they do not seem to represent a threat to the security of the ElGamal Signature Scheme.

Finally, we mention a couple of ways in which the ElGamal Scheme can be broken if it is used carelessly (these are further examples of protocol failures, some of which were discussed in the exercises of Chapter 4). First, the random value k used in computing a signature should not be revealed. For, if k is known, it is a simple matter to compute

Of course, once a is known, then the system is broken and Oscar can forge signatures at will.

Another misuse of the system is to use the same value k in signing two different messages. This also makes it easy for Oscar to compute a and hence break the system. This can be done as follows. Suppose (?, ?1) is a signature on x1 and (?, ?2) is a signature on x2. Then we have

and

Thus

Writing ? = ?k, we obtain the following equation in the unknown k:

which is equivalent to

Now let d = gcd (?1 - ?2, p - 1). Since d | (p - 1) and d | (?1 - ?2), it follows that d | (x1 - x2). Define

Then the congruence becomes:

Since gcd(??, p?) = 1, we can compute

Then value of k is determined modulo p? to be

This yields d candidate values for k:

for some i, 0 ? i ? d - 1. Of these d candidate values, the (unique) correct one can be determined by testing the condition


6.3 The Digital Signature Standard

The Digital Signature Standard (or DSS) is a modification of the ElGamal Signature Scheme. It was published in the Federal Register on May 19, 1994 and adopted as a standard on December 1, 1994 (however, it was first proposed in August, 1991). First, we want to motivate the changes that are made to ElGamal, and then we will describe how they are accomplished.

In many situations, a message might be encrypted and decrypted only once, so it suffices to use any cryptosystem which is known to be secure at the time the message is encrypted. On the other hand, a signed message could function as a legal document such as a contract or will, so it is very likely that it would be necessary to verify a signature many years after the message is signed. So it is important to take even more precautions regarding the security of a signature scheme as opposed to a cryptosystem. Since the ElGamal Scheme is no more secure than the Discrete Logarithm problem, this necessitates the use of a large modulus p. Certainly p should have at least 512 bits, and many people would argue that the length of p should be 1024 bits in order to provide security into the foreseeable future.

However, even a 512 bit modulus leads to a signature having 1024 bits. For potential applications, many of which involve the use of smart cards, a shorter signature is desirable. DSS modifies the ElGamal Scheme in an ingenious way so that a 160-bit message is signed using a 320-bit signature, but the computations are done using a 512-bit modulus p. The way that this done is to work in a subgroup of [image] of size 2160. The assumed security of the scheme is based on the belief that finding discrete logarithms in this specified subgroup of [image] is secure.

The first change we make is to change the “-” to a “+” in the definition of ?, so

This changes the verification condition to the following:

If gcd(x + a?,p - 1) = 1, then ?-1 mod (p - 1) exists, and we can modify condition (6.1), producing the following:

Now here is the major innovation in the DSS. We suppose that q is a 160-bit prime such that q | (p - 1), and ? is a qth root of 1 modulo p. (It is easy to construct such an ?: Let ?0 be a primitive element of [image], and define ? = ?0(p-1)/q mod p.) Then ? and ? will also be qth roots of 1. Hence, any exponents of ?, ? and ? can be reduced modulo q without affecting verification condition (6.2). The tricky point is that ? appears as an exponent on the left side of (6.2), and again — but not as an exponent — on the right side of (6.2). So if ? is reduced modulo q, then we must also reduce the entire left side of (6.2) modulo q in order to perform the verification. Observe that (6.1) will not work if the extra reductions modulo q are done. The complete description of the DSS is given in Figure 6.3.

Notice that is necessary that [image] (mod q) since the value ?-1 mod q is needed to verify the signature (this is analogous to the requirement that gcd(?, p-1) = 1 when we modified (6.1) to obtain (6.2)). If Bob computes a value ? ? 0 (mod q) in the signing algorithm, he should reject it and construct a new signature with a new random k. We should point out that this is not likely to cause a problem in practice: the probability that ? ? 0 (mod q) is likely to be on the order of 2-160, so for all intents and purposes it will almost never happen.

Figure 6.3 Digital Signature Standard

Here is a small example to illustrate.

Example 6.3

Suppose we take q = 101 and p = 78q + 1 = 7879. 3 is a primitive element in [image], so we can take

Suppose a = 75; then

Now, suppose Bob wants to sign the message x = 22 and he chooses the random value k = 50, so

Then

and

The signature (94, 97) on the message 22 is verified by the following computations:

Hence, the signature is valid.

When the DSS was proposed in 1991, there were several criticisms put forward. One complaint was that the selection process by NIST was not public. The standard was developed by the National Security Agency (NSA) without the input of U. S. industry. Regardless of the merits of the resulting scheme, many people resented the “closed-door” approach.

Of the technical criticisms put forward, the most serious was that the size of the modulus p was fixed at 512 bits. Many people would prefer that the modulus size not be fixed, so that larger modulus sizes could be used if desired. In reponse to these comments, NIST altered the description of the standard so that a variety of modulus sizes are allowed, namely, any modulus size divisible by 64, in the range from 512 to 1024 bits.

Another complaint about the DSS was that signatures can be generated considerably faster than they can be verified. In contrast, if RSA is used as a signature scheme and the public verification exponent is very small (say 3, for example), then verification can be performed much more quickly than signing. This leads to a couple of considerations concerning the potential applications of the signature scheme:

1. A message will only be signed once. On the other hand, it might be necessary to verify the signature many times over a period of years. This suggests that a faster verification algorithm would be desirable.

Figure 6.4 Lamport Signature Scheme

2. What types of computers are likely to be doing the signing and verifying? Many potential applications involve smart cards, with limited processing power, communicating with a more powerful computer. So one might try to design a scheme so that fewer computations are likely to be done by a card. But one can imagine situations where a smart card would generate a signature, and other situations where a smart card would verify a signature, so it is difficult to give a definitive answer here.

The response of NIST to the question of signature generation/verification times is that it does not really matter which is faster, provided that both can be done sufficiently quickly


6.4 One-time Signatures

In this section, we describe a conceptually simple way to construct a one-time signature scheme from any one-way function. The term “one-time” means that only one message can be signed. (The signature can be verified an arbitrary number of times, of course.) The description of the scheme, known as the Lamport Signature Scheme, is given in Figure 6.4.

Informally, this is how the system works. A message to be signed is a binary k-tuple. Each bit is signed individually: the value zi,j corresponds to the ith bit of the message having the value j (j = 0, 1). Each zi,j is the image of yi,j under the one-way function f. The ith bit of the message is signed using the preimage yi,j of the zi,j corresponding to the ith bit of the message. The verification consists simply of checking that each element in the signature is the preimage of the appropriate public key element.

We illustrate the scheme by considering one possible implementation using the exponentiation function f(x) = ?x mod p, where ? is a primitive element modulo p.

Example 6.4

7879 is prime and 3 is a primitive element in [image]. Define

Suppose Bob wishes to sign a message of three bits, and he chooses the six (secret) random numbers

Then he computes the images of the y’s under the function f:

These z’s are published. Now, suppose Bob wants to sign the message

The signature for x is

To verify this signature, it suffices to compute the following:

Hence, the signature is valid.

Oscar cannot forge a signature because he is unable to invert the one-way function f to obtain the secret y’s. However, the signature scheme can be used to sign only one message. For, given signatures for two different messages, it is (usually) an easy matter for Oscar to construct signatures for further messages (different from the first two).

For example, suppose the messages (0, 1, 1) and (1, 0, 1) are both signed using the same scheme. The message (0, 1, 1) would have as its signature the triple (y1,0, y2,1, y3,1), and the message (1, 0, 1) would be signed with (y1,1, y2,0, y3,1). Given these two signatures, Oscar can manufacture signatures for the messages (1, 1, 1) (namely, (y1,1, y2,1, y3,1)) and (0, 0, 1) (namely, (y1,0, y2,0, y3,1)).

Even though this scheme is quite elegant, it is not of great practical use due to the size of the signatures it produces. For example, if we use the modular exponentiation function, as in the example above, then a secure implementation would require that p be at least 512 bits in length. This means that each bit of the message is signed using 512 bits. Consequently, the signature is 512 times as long as the message!

We now look at a modification due to Bos and Chaum that allows the signatures to be made somewhat shorter, with no loss of security. In the Lamport Scheme, the reason that Oscar cannot forge a signature on a (second) message, given a signature on one message, is that the y’s corresponding to one message are never a subset of the y’s corresponding to another (distinct) message.

Suppose we have a set [image] of subsets of a set B such that [image] only if B1 = B2, for all B1, [image]. Then [image] is said to satisfy the Sperner property. Given a set B of even cardinality 2n, it is known that the maximum size of a set [image] of subsets of B having the Sperner property is [image]. This can easily be obtained by taking all the n-subsets of B: clearly no n-subset is contained in another n-subset.

Now suppose we want to sign a k-bit message, as before, and we choose n large enough so that

Let |B| = 2n and let [image] denote the set of n-subsets of B. Let [image] be a publicly known injection. Then we can associate each possible message with an n-subset in [image]. We will have 2n y’s and 2n z’s, and each message will be signed with n y’s. The complete description of the Bos-Chaum Scheme is given in Figure 6.5.

The advantage of the Bos-Chaum Scheme is that signatures are shorter than with the Lamport Scheme. For example, suppose we wish to sign a message of six bits (i.e., k = 6). Since 26 = 64 and [image], we can take n = 4. This allows a six-bit message to be signed with four y’s, as opposed to six with Lamport. As well, the key is shorter, consisting of eight z’s as opposed to twelve with Lamport.

Figure 6.5 Bos-Chaum Signature Scheme

The Bos-Chaum Scheme requires an injective function ? that associates an n-subset of a 2n-set with each possible binary k-tuple x = (x1, ..., xk). We present one simple algorithm to do this in Figure 6.6. Applying this algorithm with x = (0, 1, 0, 0, 1, 1), for example, yields

In general, how big is n in the Bos-Chaum Scheme as compared to k? We need to satisfy the inequality [image]. If we estimate the binomial coefficient

using Stirling’s formula, we obtain the quantity [image]. After some simplification, the inequality becomes

Figure 6.6 Computation of ? in the Bos-Chaum Scheme

Asymptotically, n is about k/2, so we obtain an almost 50% reduction in signature size by using the Bos-Chaum Scheme.


6.5 Undeniable Signatures

Undeniable signatures were introduced by Chaum and van Antwerpen in 1989. They have several novel features. Primary among these is that a signature cannot be verified without the cooperation of the signer, Bob. This protects Bob against the possibility that documents signed by him are duplicated and distributed electronically without his approval. The verification will be accomplished by means of a challenge-and-response protocol.

But if Bob’s cooperation is required to verify a signature, what is to prevent Bob from disavowing a signature he made at an earlier time? Bob might claim that a valid signature is a forgery, and either refuse to verify it, or carry out the protocol in such a way that the signature will not be verified. To prevent this from happening, an undeniable signature scheme incorporates a disavowal protocol by which Bob can prove that a signature is a forgery. Thus, Bob will be able to prove in court that a given forged signature is in fact a forgery. (If he refuses to take part in the disavowal protocol, this would be regarded as evidence that the signature is, in fact, genuine.)

Thus, an undeniable signature scheme consists of three components: a signing algorithm, a verification protocol, and a disavowal protocol. First, we present the signing algorithm and verification protocol of the Chaum-van Antwerpen Undeniable Signature Scheme in Figure 6.7.

Figure 6.7 Chaum-van Antwerpen Undeniable Signature Scheme

We should explain the roles of p and q in this scheme. The scheme lives in [image]; however, we need to be able to do computations in a multiplicative subgroup G of [image] of prime order. In particular, we need to be able to compute inverses modulo |G|, which is why |G| should be prime. It is convenient to take p = 2q + 1 where q is prime. In this way, the subgroup G is as large as possible, which is desirable since messages and signatures are both elements of G.

We first prove that Alice will accept a valid signature. In the following computations, all exponents are to be reduced modulo q. First, observe that

Since

we have that

Similarly,

implies that

Hence,

as desired.

Here is a small example.

Example 6.5

Suppose we take p = 467. Since 2 is a primitive element, 22 = 4 is a generator of G, the quadratic residues modulo 467. So we can take ? = 4. Suppose a = 101; then

Bob will sign the message x = 119 with the signature

Now, suppose Alice wants to verify the signature y. Suppose she chooses the random values e1 = 38, e2 = 397. She will compute c = 13, whereupon Bob will respond with d = 9. Alice checks the response by verifying that

Hence, Alice accepts the signature as valid.

We next prove that Bob cannot fool Alice into accepting a fradulent signature as valid, except with a very small probability. This result does not depend on any computational assumptions, i.e., the security is unconditional.

THEOREM 6.1

If [image] (mod p), then Alice will accept y as a valid signature for x with probability 1/q.

PROOF First, we observe that each possible challenge c corresponds to exactly q ordered pairs (e1, e2) (this is because y and ? are both elements of the multiplicative group G of prime order q). Now, when Bob receives the challenge c, he has no way of knowing which of the q possible ordered pairs (e1, e2) Alice used to construct c. We claim that, if [image] (mod p), then any possible response d ? G that Bob might make is consistent with exactly one of the q possible ordered pairs (e1, e2).

Since ? generates G, we can write any element of G as a power of ?, where the exponent is defined uniquely modulo q. So write c = ?i, d = ?j, x = ?k, and [image], where [image] and all arithmetic is modulo p. Consider the following two congruences:

This system is equivalent to the following system:

Now, we are assuming that

so it follows that

Hence, the coefficient matrix of this system of congruences modulo q has non-zero determinant, and thus there is a unique solution to the system. That is, every d ? G is the correct response for exactly one of the q possible ordered pairs (e1, e2), Consequently, the probability that Bob gives Alice a response d that will be verified is exactly 1/q, and the theorem is proved.

We now turn to the disavowal protocol. This protocol consists of two runs of the verification protocol and is presented in Figure 6.8.

Steps 1-4 and steps 5-8 comprise two unsuccessful runs of the verification protocol. Step 9 is a “consistency check” that enables Alice to determine if Bob is forming his responses in the manner specified by the protocol.

The following example illustrates the disavowal protocol.

Example 6.6

As before, suppose p = 467, ? = 4, a = 101 and ? = 449. Suppose the message x = 286 is signed with the (bogus) signature y = 83, and Bob wants to convince Alice that the signature is invalid.

Figure 6.8 Disavowal protocol

Suppose Alice begins by choosing the random values e1 = 45, e2 = 237. Alice computes c = 305 and Bob responds with d = 109. Then Alice computes

Since 149 ? 109, Alice proceeds to step 5 of the protocol.

Now suppose Alice chooses the random values f1 = 125, f2 = 9. Alice computes C = 270 and Bob responds with D = 68. Alice computes

Since 25 ? 68, Alice proceeds to step 9 of the protocol and performs the consistency check. This check succeeds, since

and

Hence, Alice is convinced that the signature is invalid.

We have to prove two things at this point:

1. Bob can convince Alice that an invalid signature is a forgery.
2. Bob cannot make Alice believe that a valid signature is a forgery except with a very small probability.

THEOREM 6.2

If [image] (mod p), and Alice and Bob follow the disavowal protocol, then

PROOF Using the facts that

and

we have that

A similar computation, using the facts that [image] (mod p) and ? ? ?a (mod p), establishes that

so the consistency check in step 9 succeeds.

Now we look at the possibility that Bob might attempt to disavow a valid signature. In this situation, we do not assume that Bob follows the protocol. That is, Bob might not construct d and D as specified by the protocol. Hence, in the following theorem, we assume only that Bob is able to produce values d and D which satisfy the conditions in steps 4, 8, and 9 of the protocol presented in Figure 6.8.

THEOREM 6.3

Suppose y ? xa (mod p) and Alice follows the disavowal protocol. If

and

then the probability that

is 1 - 1/q.

PROOF Suppose that the following congruences are satisfied:

We will derive a contradiction.

The consistency check (step 9) can be rewritten in the following form:

where

is a value that depends only on steps 1-4 of the protocol.

Applying Theorem 6.1, we conclude that y is a valid signature for d0 with probability 1 - 1/q. But we are assuming that y is a valid signature for x. That is, with high probability we have

which implies that x = d0.

However, the fact that

means that

Since

we conclude that x ? d0 and we have a contradiction.

Hence, Bob can fool Alice in this way with probability 1/q.


6.6 Fail-stop Signatures

A fail-stop signature scheme provides enhanced security against the possibility that a very powerful adversary might be able to forge a signature. In the event that Oscar is able to forge Bob’s signature on a message, Bob will (with high probability) subsequently be able to prove that Oscar’s signature is a forgery.

In this section, we describe a fail-stop signature scheme constructed by van Heyst and Pedersen in 1992. This is a one-time scheme (only one message can be signed with a given key). The system consists of signing and verification algorithms, as well as a “proof of forgery” algorithm. The description of the signing and verification algorithms of the van Heyst and Pedersen Fail-stop Signature Scheme is presented in Figure 6.9.

It is straightforward to see that a signature produced by Bob will satisfy the verification condition, so let’s turn to the security aspects of this scheme and how the fail-stop property works. First we establish some important facts relating to the keys of the scheme. We begin with a definition. Two keys (?1, ?2, a1, a2, b1, b2) and [image] are said to be equivalent if [image] and [image]. It is easy to see that there are exactly q2 keys in any equivalence class.

We establish several lemmas.

LEMMA 6.4

Suppose K and K? are equivalent keys and suppose that verK (x, y) = true. Then verK? (x, y) = true.

PROOF Suppose K = (?1, ?2, a1, a2, b1, b2) and K? = ( [image]), where

and

Suppose x is signed using K, producing the signature y = (y1, y2), where

Now suppose that we verify y using K?:

Thus, y will also be verified using K?.

Figure 6.9 van Heyst and Pedersen Fail-stop Signature Scheme

LEMMA 6.5

Suppose K is a key and y = sigK(x). Then there are exactly q keys K? equivalent to K such that y = sigK? (x).

PROOF Suppose ?1 and ?2 are the public components of K. We want to determine the number of 4-tuples (a1, a2, b1, b2) such that the following congruences are satisfied:

Since ? generates G, there exist unique exponents [image] such that

and

Hence, it is necessary and sufficient that the following system of congruences be satisfied:

This system can, in turn, be written as a matrix equation in [image], as follows:

Now, the coefficient matrix of this system can be seen to have rank 1 three: Clearly, the rank is at least three since rows 1, 2 and 4 are linearly independent over [image]. And the rank is at most three since

1the rank of a matrix is the maximum number of linearly independent rows it contains

where ri denotes ith row of the matrix.

Now, this system of equations has at least one solution, obtained by using the key K. Since the rank of the coefficient matrix is three, it follows that the dimension of the solution space is 4 - 3 = 1, and there are exactly q solutions. The result follows.

By similar reasoning, the following result can be proved. We omit the proof.

LEMMA 6.6

Suppose K is a key, y = sigK(x), and verK (x?, y?) = true, where x? ? x. Then there is at most one key K? equivalent to K such that y = sigK?(x) and y? = sigK?(x?).

Let’s interpret what the preceding two lemmas say about the security of the scheme. Given that y is a valid signature for message x, there are q possible keys that would have signed x with y. But for any message x? ? x, these q keys will produce q different signatures on x?. Thus, the following theorem results.

THEOREM 6.7

Given that sigK(x) = y and x? ? x, Oscar can compute sigK(x?) with probablity 1/q.

Note that this theorem does not depend on the computational power of Oscar: the stated level of security is obtained because Oscar cannot tell which of q possible keys is being used by Bob. So the security is unconditional.

We now go on to look at the fail-stop concept. What we have said so far is that, given a signature y on message x, Oscar cannot compute Bob’s signature y? on a different message x?. It is still conceivable that Oscar can compute a forged signature y? ? sigK(x?) which will still be verified. However, if Bob is given a valid forged signature, then with probability 1 - 1/q he can produce a “proof of forgery.” The proof of forgery is the value a0 = log? ?, which is known only to the central authority.

So we assume that Bob possesses a pair (x?, y?) such that verK(x?, y?) = true and y? ? sigK(x?). That is,

where y? = ( [image]). Now, Bob can compute his own signature on x?, namely y? = ( [image]), and it will be the case that

Hence,

Writing [image] mod p, we have that

or

This simplifies to give

Now, [image] (mod q) since y? is a forgery. Hence, ( [image])-1 mod q exists, and

Of course, by accepting such a proof of forgery, we assume that Bob cannot compute the discrete logarithm log? ? by himself. This is a computational assumption.

Finally, we remark that the scheme is a one-time scheme since Bob’s key K can easily be computed if two messages are signed using K.

We close with an example illustrating how Bob can produce a proof of forgery.

Example 6.7

Suppose p = 3467 = 2 ? 1733 + 1. The element ? = 4 has order 1733 in [image]. Suppose that a0 = 1567, so

(Recall that Bob knows the values of ? and ?, but not a0.) Suppose Bob forms his key using a1 = 888, a2 = 1024, b1 = 786 and b2 = 999, so

and

Now, suppose Bob is presented with the forged signature (822, 55) on the message 3383. This is a valid signature since the verification condition is satisfied:

and

On the other hand, this is not the signature Bob would have constructed. Bob can compute his own signature to be

Then, he proceeds to calculate the secret discrete log

This is the proof of forgery.


Chapter 6 Exercises

Exercises

6.1 Suppose Bob is using the ElGamal Signature Scheme, and he signs two messages x1 and x2 with signatures (?, ?1) and (?, ?2), respectively. (The same value for ? occurs in both signatures.) Suppose also that gcd(?1 - ?2, p - 1) = 1.

(a) Describe how k can be computed efficiently given this information.
(b) Describe how the signature scheme can then be broken.
(c) Suppose p = 31847, ? = 5 and ? = 25703. Perform the computation of k and a, given the signature (23972, 31396) for the message x = 8990 and the signature (23972, 20481) for the message x = 31415.

6.2 Suppose I implement the ElGamal Signature Scheme with p = 31847, ? = 5 and ? = 26379. Write a computer program which does the following.

(a) Verify the signature (20679, 11082) on the message x = 20543.
(b) Determine my secret exponent, a, using the Shanks time-memory tradeoff. Then determine the random value k used in signing the message x.

6.3 Suppose Bob is using the ElGamal Signature Scheme as implemented in Example 6.1: p = 467, ? = 2 and ? = 132. Suppose Bob has signed the message x = 100 with the signature (29, 51). Compute the forged signature that Oscar can then form by using h = 102, i = 45 and j = 293. Check that the resulting signature satisfies the verification condition.
6.4 Prove that the second method of forgery on the ElGamal Signature Scheme, described in Section 6.2, also yields a signature that satisfies the verification condition.
6.5 Here is a variation of the ElGamal Signature Scheme. The key is constructed in a similar manner as before: Bob chooses [image] to be a primitive element, a is a secret exponent (0 ? a ? p - 2) such that gcd (a, p - 1) = 1, and ? = ?a mod p. The key K = (?, a, ?), where ? and ? are public and a is secret. Let [image] be a message to be signed. Bob computes the signature sig(x) = (?, ?), where

and

The only difference from the original ElGamal Scheme is in the computation of ?. Answer the following questions concerning this modified scheme.

(a) Describe how a signature (?, ?) on a message x would be verified using Bob’s public key.
(b) Describe a computational advantage of the modified scheme over the original scheme.
(c) Briefly compare the security of the original and modified scheme.

6.6 Suppose Bob uses the DSS with q = 101, p = 7879, ? = 170, a = 75 and ? = 4567, as in Example 6.3. Determine Bob’s signature on the message x = 52 using the random value k = 49, and show how the resulting signature is verified.
6.7 In the Lamport Scheme, suppose that two k-tuples, x and x?, are signed by Bob. Let [image] denote the number of coordinates in which x and x? differ. Show at Oscar can now sign [image] new messages.
6.8 In the Bos-Chaum Scheme with k = 6 and n = 4, suppose that the messages x = (0, 1, 0, 0, 1, 1) and x? = (1, 1, 0, 1, 1, 1) are signed. Determine the new messages that be signed by Oscar, knowing the signatures on x and x?.
6.9 In the Bos-Chaum Scheme, suppose that two k-tuples x and x? are signed by Bob. Let [image] Show that Oscar can now sign [image] new messages.
6.10 Suppose Bob is using the Chaum-van Antwerpen Undeniable Signature Scheme as in Example 6.5. That is, p = 467, ? = 4, a = 101 and ? = 449. Suppose Bob is presented with a signature y = 25 on the message x = 157 and he wishes to prove it is a forgery. Suppose Alice’s random numbers are e1 = 46, e2 = 123, f1 = 198 and f2 = 11 in the disavowal protocol. Compute Alice’s challenges, c and d, and Bob’s responses, C and D, and show that Alice’s consistency check will succeed.
6.11 Prove that each equivalence class of keys in the Pedersen-van Heyst Fail-stop Signature Scheme contains q2 keys.
6.12 Suppose Bob is using the Pedersen-van Heyst Fail-stop Signature Scheme, where p = 3467, ? = 4, a0 = 1567 and ? = 514 (of course, the value of a0 is not known to Bob).

(a) Using the fact that a0 = 1567, determine all possible keys

such that sigK(42) = (1118, 1449).

(b) Suppose that sigK(42) = (1118, 1449) and sigK(969) = (899, 471). Without using the fact that a0 = 1567, determine the value of K (this shows that the scheme is a one-time scheme).

6.13 Suppose Bob is using the Pedersen-van Heyst Fail-Stop Signature Scheme with p = 5087, ? = 25 and ? = 1866. Suppose the key is

Now, suppose Bob finds the signature (2219, 458) has been forged on the message 4785.

(a) Prove that this forgery satisfies the verification condition, so it is a valid signature.
(b) Show how Bob will compute the proof of forgery, a0, given this forged signature.


Chapter 7 Hash Functions

Chapter 7
Hash Functions

7.1 Signatures and Hash Functions

The reader might have noticed that the signature schemes described in Chapter 6 allow only “small” messages to be signed. For example, when using the DSS, a 160-bit message is signed with a 320-bit signature. In general, we will want to sign much longer messages. A legal document, for example, might be many megabytes in size.

A naive attempt to solve this problem would be to break a long message into 160-bit chunks, and then to sign each chunk independently. This is analogous to encrypting a long string of plaintext by encrypting each plaintext character independently using the same key (e.g., ECB mode in the DES).

But there are several problems with this approach in creating digital signatures. First of all, for a long message, we will end up with an enormous signature (twice as long as the original message in the case of the DSS). Another disadvantage is that most “secure” signature schemes are slow since they typically use complicated arithmetic operations such as modular exponentiation. But an even more serious problem with this approach is that the various chunks of a signed message could be rearranged, or some of them removed, and the resulting message would still be verified. We need to protect the integrity of the entire message, and this cannot be accomplished by independently signing little pieces of it.

The solution to all of these problems is to use a very fast public cryptographic hash function, which will take a message of arbitrary length and produce a message digest of a specified size (160 bits if the DSS is to be used). The message digest will then be signed. For the DSS, the use of a hash function h is depicted diagramatically in Figure 7.1

When Bob wants to sign a message x, he first constructs the message digest z = h(x), and then computes the signature y = sigK(z). He transmits the ordered pair (x, y) over the channel. Now the verification can be performed (by anyone) by first reconstructing the message digest z = h(x) using the public hash function h, and then checking that verK(z, y) = true.

Figure 7.1 Signing a message digest


7.2 Collision-free Hash Functions

We have to be careful that the use of a hash function h does not weaken the security of the signature scheme, for it is the message digest that is signed, not the message. It will be necessary for h to satisfy certain properties in order to prevent various forgeries.

The most obvious type of attack is for an opponent, Oscar, to start with a valid signed message (x, y), where y = sigK(h(x)). (The pair (x, y) could be any message previously signed by Bob.) Then he computes z = h(x) and attempts to find x? ? x such that h(x?) = h(x). If Oscar can do this, (x?, y) would be a valid signed message, i.e., a forgery. In order to prevent this type of attack, we require that h satisfy the following collision-free property:

DEFINITION 7.1 Let x be a message. A hash function h is weakly collision-free for x if it is computationally infeasible to find a message x? ? x such that h(x?) = h(x).

Another possible attack is the following: Oscar first finds two messages x ? x? such that h(x) = h(x?). Oscar then gives x to Bob and persuades him to sign the message digest h(x), obtaining y. Then (x?, y) is a valid forgery.

This motivates a different collision-free property:

DEFINITION 7.2 A hash function h is strongly collision-free if it is computationally infeasible to find messages x and x? such that x? ? x and h(x?) = h(x).

Observe that a hash function h is strongly collision-free if and only if it in computationally infeasible to find a message x such that h is not weakly collision-free for x.

Here is a third variety of attack. As we mentioned in Section 6.2, it is often possible with certain signature schemes to forge signatures on random message digests z. Suppose Oscar computes a signature on such a random z, and then he finds a message x such that z = h(x). If he can do this, then (x, y) is a valid forgery. To prevent this attack, we desire that h satisfy the same one-way property that was mentioned previously in the context of public-key cryptosystems and the Lamport Signature Scheme:

DEFINITION 7.3 A hash function h is one-way if, given a message digest z, it is computationally infeasible to find a message x such that h(x) = z.

We are now going to prove that the strongly collision-free property implies the one-way property. This is done by proving the contrapositive statement. More specifically, we will prove that an arbitrary inversion algorithm for a hash function can be used as an oracle in a Las Vegas probabilistic algorithm that finds collisions.

This reduction can be accomplished with a fairly weak assumption on the relative sizes of the domain and range of the hash function. We will assume for the time being that the hash function h : X > Z, where X and Z are finite sets and |X| ? 2|Z|. This is a reasonable assumption: If we think of an element of X as being encoded as a bitstring of length log2 |X| and an element of Z as being encoded as a bitstring of length log2 |Z|, then the message digest z = h(x) is at least one bit shorter than the message x. (Eventually, we will be interested in the situation where the message domain X is infinite, since we want to be able to deal with messages of arbitrary length. Our argument also applies in this situation.)

We are assuming that we have an inversion algorithm for h. That is, we have an algorithm A which accepts as input a message digest z ? Z, and finds an element A(z) ? X such that h(A(z)) = z.

We prove the following theorem.

THEOREM 7.1

Suppose h : X > Z is a hash function where |X| and |Z| are finite and |X| ? 2|Z|. Suppose A is an inversion algorithm for h. Then there exists a probabilistic Las Vegas algorithm which finds a collision for h with probability at least 1/2.

PROOF Consider the algorithm B presented in Figure 7.2. Clearly B is a probabilistic algorithm of the Las Vegas type, since it either finds a collision or returns no answer. Thus our main task is to compute the probability of success. For any x ? X, define x ~ x1 if h(x) = h(x1). It is easy to see that ~ is an equivalence relation. Define

Each equivalence class [x] consists of the inverse image of an element of Z, so the number of equivalence classes is at most |Z|. Denote the set of equivalence classes by C.

Now, suppose x is the element of X chosen in step 1. For this x, there are |[x]| possible x1’s that could be returned in step 3. |[x]| - 1 of these x1’s are different from x and thus lead to success in step 4. (Note that the algorithm A does not know the representative of the equivalence class [x] that was chosen in step 1.) So, given a particular choice x ? X, the probability of success is (|[x]| - 1)/|[x]|.

Figure 7.2 Using an inversion algorithm A to find collisions for a hash function h

The probability of success of the algorithm B is computed by averaging over all possible choices for x:

Hence we have constructed a Las Vegas algorithm with success probability at least 1/2.

Hence, it is sufficient that a hash function satisfy the strongly collision-free property, since it implies the other two properties. So in the remainder of this chapter we restrict our attention to strongly collision-free hash functions.


7.3 The Birthday Attack

In this section, we determine a necessary security condition for hash functions that depends only on the cardinality of the set Z (equivalently, on the size of the message digest). This necessary condition results from a simple method of finding collisions which is informally known as the birthday attack. This terminology arises from the so-called birthday paradox, which says that in a group of 23 random people, at least two will share a birthday with probability at least 1/2. (Of course this is not a paradox, but it is probably counter-intuitive). The reason for the terminology “birthday attack” will become clear as we progress.

As before, let us suppose that h : X > Z is a hash function, X and Z are finite, and |X| ? 2|Z|. Denote |X| = m and |Z| = n. It is not hard to see that there are at least n collisions — the question is how to find them. A very naive approach is to choose k random distinct elements x1,...,xk ? X, compute zi = h(xi), 1 ? i ? k, and then determine if a collision has taken place (by sorting the zi’s, for example).

This process is analogous to throwing k balls randomly into n bins and then checking to see if some bin contains at least two balls. (The k balls correspond to the k random xi’s, and the n bins correspond to the n possible elements of Z.)

We will compute a lower bound on the probability of finding a collision by this method. This lower bound will depend on k and n, but not on m. Since we are interested in a lower bound on the collision probability, we will make the assumption that [image] for all z ? Z. (This is a reasonable assumption: if the inverse images are not approximately equal, then the probability of finding a collision will increase.)

Since the inverse images are all (roughly) the same size and the xi’s are chosen at random, the resulting zi’s can be thought of as random (not necessarily distinct) elements of Z. But it is a simple matter to compute the probability that k random elements z1,...,zk ? Z are distinct. Consider the zi’s in the order z1,...,zk. The first choice z1 is arbitrary; the probability that z2 ? z1 is 1 - 1/n; the probability that z3 is distinct from z1 and z2 is 1 - 2/n, etc.

Hence, we estimate the probability of no collisions to be

If x is a small real number, then [image]. This estimate is derived by taking the first two terms of the series expansion

Then our estimated probability of no collisions is

So we estimate the probability of at least one collision to be

If we denote this probability by ?, then we can solve for k as a function of n and ?.

If we ignore the term -k, then we estimate

If we take ? = .5, then our estimate is

So this says that hashing just over [image] random elements of X yields a collision with a probability of 50%. Note that a different choice of ? leads to a different constant factor, but k will still be proportional to

If X is the set of all human beings, Y is the set of 365 days in a non-leap year (i.e., excluding February 29), and h(x) denotes the birthday of person x, then we are dealing with the birthday paradox. Taking n = 365 in our estimate, we get [image] Hence, as mentioned earlier, there will be at least one duplicated birthday among 23 random people with probability at least 1/2.

This birthday attack imposes a lower bound on the sizes of message digests. A 40-bit message digest would be very insecure, since a collision could be found with probability 1/2 with just over 220 (about a million) random hashes. It is usually suggested that the minimum acceptable size of a message digest is 128 bits (the birthday attack will require over 264 hashes in this case). The choice of a 160-bit message digest for use in the DSS was undoubtedly motivated by these considerations.

Figure 7.3 Chaum-van Heijst-Pfitzmann Hash Function


7.4 A Discrete Log Hash Function

In this section, we describe a hash function, due to Chaum, van Heijst, and Pfitzmann, that will be secure provided a particular discrete logarithm cannot be computed. This hash function is not fast enough to be of practical use, but it is conceptually simple and provides a nice example of a hash function that can be proved secure under a reasonable computational assumption. The Chaum-van Heijst-Pfitzmann Hash Function is presented in Figure 7.3. We now prove a theorem concerning the security of this hash function.

THEOREM 7.2

Given one collision for the Chaum-van Heijst-Pfitzmann Hash Function h, the discrete logarithm log? ? can be computed efficiently.

PROOF Suppose we are given a collision

where (x1, x2) ? (x3, x4). So we have the following congruence:

or

Denote

Since p - 1 = 2q and q is prime, it must be the case that d ? {1,2,q,p - 1}. Hence, we have four possibilities for d, which we will consider in turn.

First, suppose that d = 1. Then let

We have that

so we can compute the discrete logarithm log? ? as follows:

Next, suppose that d = 2. Since p - 1 = 2q where q is odd, we must have gcd(x4 - x2, q) = 1. Let

Now

for some integer k, so we have

since

So we have

It follows that

or

We can easily test which of these two possibilities is the correct one. Hence, as in the case d = 1, we have calculated the discrete logarithm log? ?.

The next possibility is that d = q. But

and

so

So it is impossible that gcd(x4 - x2,p - 1) = q; in other words, this case does not arise.

The final possibility is that d = p - 1. This happens only if x2 = x4. But then we have

so

and x1 = x3. Thus (x2, x2) = (x3, x4), a contradiction. So this case is not possible, either.

Since we have considered all possible values for d, we conclude that the hash function h is strongly collision-free provided that it is infeasible to compute the discrete logarithm log? ? in [image].

We illustrate the result of the above theorem with an example.

Example 7.1

Suppose p = 12347 (so q = 6173), ? = 2 and ? = 8461. Suppose we are given the collision

Thus x1 = 5692, x2 = 144, x3 = 212 and x4 = 4214. Now, gcd (x4 - x2, p -1) = 2, so we begin by computing

Next, we compute

Now it is the case that log? ? ? {y?, y? + q mod (p - 1)}. Since

we conclude that

As a check, we can verify that

Hence, we have determined log? ?.


7.5 Extending Hash Functions

So far, we have considered hash functions with a finite domain. We now study how a strongly collision-free hash function with a finite domain can be extended to a strongly collision-free hash function with an infinite domain. This will enable us to sign messages of arbitrary length.

Suppose h : is a strongly collision-free hash function, where m ? t + 1. We will use h to construct a strongly collision-free hash function h* : , where

We first consider the situation where m ? t + 2.

We will think of elements of X as bit-strings. |x| denotes the length of x (i.e., the number of bits in x), and x || y denotes the concatenation of the bit-strings x and y. Suppose |x| = n > m. We can express x as the concatenation

where

and

where 0 ? d ? m - t - 2. Hence, we have that

We define h* (x) by the algorithm presented in Figure 7.4.

Figure 7.4 Extending a hash function h to h* (m ? t + 2)

Denote

Observe that yk is formed from xk by padding on the right with d zeroes, so that all the blocks yi (1 ? i ? k) are of length m - t - 1. Also, in step 3, yk+1 should be padded on the left with zeroes so that |yk+1| = m - t - 1.

In order to hash x, we first construct y(x), and then “process” the blocks y1, y2,...,yk+1 in a particular fashion. It is important that y(x) ? y(x?) whenever x ? x?. In fact, yk+1 is defined in such a way that the mapping [image] will be an injection.

The following theorem proves that h* is secure provided that h is secure.

THEOREM 7.3

Suppose h : is a strongly collision-free hash function, where m ? t + 2. Then the function h* : , as constructed in Figure 7.4, is a strongly collision-free hash function.

PROOF Suppose that we can find x ? x? such that h*(x) = h*(x?). Given such a pair, we will show how we can find a collision for h in polynomial time. Since h is assumed to be strongly collision-free, we will obtain a contradiction, and thus h* will be proved to be strongly collision-free.

Denote

and

where x and x? are padded with d and d? 0’s, respectively, in step 2. Denote the values computed in steps 4 and 5 by g1,...,gk+1 and [image], respectively.

We identify two cases, depending on whether or not |x| ? |x?| (mod m-t-1).

case 1: (mod m - t - 1).

Here d ? d? and [image]. We have

which is a collision for h since [image].

case 2: |x| ? |x?| (mod m - t - 1).

It is convenient to split this into two subcases:

case 2a: |x| = |x?|.

Here we have [image] and [image]. We begin as in case 1:

If [image], then we find a collision for h, so assume [image]. Then we have

Either we find a collision for h, or [image] and [image]. Assuming we do not find a collision, we continue working backwards, until finally we obtain

If [image], then we find a collision for h, so we assume [image]. But then [image] for 1 ? i ? k + 1, so y(x) = y(x?). But this implies x = x? since the mapping [image] is an injection. Since we assumed x ? x?, we have a contradiction.

Figure 7.5 Extending a hash function h to h* (m = t + 1)

case 2b: |x| ? |x?|.

Without loss of generality, assume |x?| > |x|, so [image]. This case proceeds in a similar fashion as case 2a. Assuming we find no collisions for h, we eventually reach the situation where

But the (t + 1)st bit of 0t+1 || y1 is a 0 and the (t + 1)st bit of [image] is a 1. So we find a collision for h.

Since we have considered all possible cases, we have the desired conclusion.

The construction of Figure 7.4 can be used only when m ? t + 2. Let’s now look at the situation where m = t + 1. We need to use a different construction for h*. As before, suppose |x| = n > m. We first encode x in a special way. This will be done using the function f defined as follows:

The algorithm to construct h* (x) is presented in Figure 7.5.

The encoding [image], defined in step 1, satisfies two important properties:

1. If x ? x?, then y(x) ? y(x?) (i.e., [image] is an injection).
2. There do not exist two strings x ? x? and a string z such that y(x) = z || y(x?). (In other words, no encoding is a postfix of another encoding. This is easily seen because each string y(x) begins with 11, and there do not exist two consecutive 1’s in the remainder of the string.)

THEOREM 7.4

Suppose h : is a strongly collision-free hash function. Then the function h* : , as constructed in Figure 7.5, is a strongly collision-free hash function.

PROOF Suppose that we can find x ? x? such that h* (x) = h* (x?). Denote

and

We consider two cases.

case 1: .

As in Theorem 7.3, either we find a collision for h, or we obtain y = y?. But this implies x = x?, a contradiction.

case 2: .

Without loss of generality, assume [image]. This case proceeds in a similar fashion. Assuming we find no collisions for h, we have the following sequence of equalities:

But this contradicts the “postfix-free” property stated above.

We conclude that h* is collision-free.

We summarize the two constructions of in this section, and the number of applications of h needed to compute h*, in the following theorem.

THEOREM 7.5

Suppose h : is a strongly collision-free hash function, where m ? t + 1. Then there exists a strongly collision-free hash function

The number of times h is computed in the evaluation of h* is at most

where |x| = n.


7.6 Hash Functions from Cryptosystems

So far, the methods we have described lead to hash functions that are probably too slow to be useful in practice. Another approach is to use an existing private-key cryptosystem to construct a hash function. Let us suppose that [image] is a computationally secure cryptosystem. For convenience, let us assume also that [image]. Here we should have n ? 128, say, in order to prevent birthday attacks. This precludes using DES (as does the fact that the key length of DES is different from the plaintext length).

Suppose we are given a bitstring

where [image]. (If the number of bits in x is not a multiple of n, then it will be necessary to pad x in some way, such as was done in Section 7.5. For simplicity, we will ignore this now.)

The basic idea is to begin with a fixed “initial value” g0 = IV, and then construct g1,...,gk in order by a rule of the form

where f is a function that incorporates the encryption function of our cryptosystem. Finally, define the message digest h(x) = gk.

Several hash functions of this type have been proposed, and many of them have been shown to be insecure (independent of whether or not the underlying cryptosystem is secure). However, four variations of this theme that appear to be secure are as follows:

Figure 7.6 Constructing M in MD4


7.7 The MD4 Hash Function

The MD4 Hash Function was proposed in 1990 by Rivest, and a strengthened version, called MD5, was presented in 1991. The Secure Hash Standard (or SHS) is more complicated, but it is based on the same underlying methods. It was published in the Federal Register on January 31, 1992, and adopted as a standard on May 11, 1993. (A proposed revision was put forward on July 11, 1994, to correct a “technical flaw” in the SHS.) All of the above hash functions are very fast, so they are practical for signing very long messages.

In this section, we will describe MD4 in detail, and discuss some of the modifications that are employed in MD5 and the SHS.

Given a bitstring x, we will first produce an array

where each M[i] is a bitstring of length 32 and N ? 0 mod 16. We will call each M[i] a word. M is constructed from x using the algorithm presented in Figure 7.6.

In the construction of M, we append a single 1 to x, then we concatenate enough 0’s so that the length becomes congruent to 448 modulo 512, and finally we concatenate 64 bits that contain the binary representation of the (original) length of x (reduced modulo 264, if necessary). The resulting string M has length divisible by 512. So when we break M up into 32-bit words, the resulting number of words, denoted by N, will be divisible by 16.

Now we proceed to construct a 128-bit message digest. A high-level description of the algorithm is presented in Figure 7.7. The message digest is constructed as the concatenation of the four words A, B, C and D, which we refer to as registers. The four registers are initialized in step 1. Now we process the array M 16 words at a time. In each iteration of the loop in step 2, we first take the “next” 16 words of M and store them in an array X (step 3). The values of the four registers are then stored (step 4). Then we perform three “rounds” of hashing. Each round consists of one operation on each of the 16 words in X (we will describe these operations in more detail shortly). The operations done in the three rounds produce new values in the four registers. Finally, the four registers are updated in step 8 by adding back the values that were stored in step 4. This addition is defined to be addition of positive integers, reduced modulo 232.

Figure 7.7 The MD4 hash function

The three rounds in MD4 are different (unlike DES, say, where the 16 rounds are identical). We first describe several different operations that are employed in these three rounds. In the following description, X and Y denote input words, and each operation produces a word as output. Here are the operations employed:

Note that all of these operations are very fast, and the only arithmetic operation that is used is addition modulo 232. If MD4 is actually implemented, it will be necessary to take into account the underlying architecture of the computer it is run on in order to perform addition correctly. Suppose a1a2a3a4 are the four bytes in a word. We think of each ai as being an integer in the range 0,...,255, represented in binary. In a big-endian architecture (such as a Sun SPARCstation), this word represents the integer

In a little-endian architecture (such as the Intel 80xxx line), this word represents the integer

MD4 assumes a little-endian architecture. It is important that the message digest is independent of the underlying architecture. So if we wish to run MD4 on a big-endian computer, it will be necessary to perform the addition operation X + Y as follows:

1. Interchange x1 and x4; x2 and x3; y1 and y4; and y2 and y3.
2. Compute Z = X + Y mod 232
3. Interchange z1 and z4; and z2 and z3.

Rounds 1, 2, and 3 of MD4 respectively use three functions f, g and h. Each of f, g and h is a bitwise boolean function that takes three words as input and produces a word as output. They are defined as follows:

The complete description of Rounds 1, 2 and 3 of MD4 are presented in Figures 7.8-7.10.

MD4 was designed to be very fast, and indeed, software implementations on Sun SPARCstations attain speeds of 1.4 Mbytes/sec. On the other hand, it is difficult to say something concrete about the security of a hash function such as MD4 since it is not “based” on a well-studied problem such as factoring or the Discrete Log problem. So, as is the case with DES, confidence in the security of the system can only be attained over time, as the system is studied and (one hopes) not found to be insecure.

Figure 7.8 Round 1 of MD4

Although MD4 has not been broken, weakened versions that omit either the first or the third round can be broken without much difficulty. That is, it is easy to find collisions for these two-round versions of MD4. A strengthened version of MD4, called MD5, was proposed in 1991. MD5 uses four rounds instead of three, and runs about 30% slower than MD4 (about .9 Mbytes/sec on a SPARCstation).

The Secure Hash Standard is yet more complicated, and slower (about .2 Mbytes/sec on a SPARCstation). We will not give a complete description, but we will indicate a few of the modifications employed in the SHS.

1. SHS is designed to run on a big-endian architecture, rather than a little-endian architecture.
2. SHS produces a 5-register (160-bit) message digest.

Figure 7.9 Round 2 of MD4

3. SHS processes the message 16 words at a time, as does MD4. However, the 16 words are first “expanded” into 80 words. Then a sequence of 80 operations is performed, one on each word.

The following “expansion function” is used. Given the 16 words X[0],..., X[15], we compute 64 more words by the recurrence relation

The result of Equation 7.1 is that each of the words X[16],..., X[79] is formed as the exclusive-or of a predetermined subset of the words X[0],...,X[15].

For example, we have

Figure 7.10 Round 3 of MD4

The proposed revision of the SHS concerns the expansion function. It is proposed that Equation 7.1 be replaced by the following:

As before, the operation “ [image] ” means a circular left shift of one position.


7.8 Timestamping

One difficulty with signature schemes is that a signing algorithm may be compromised. For example, suppose that Oscar is able to determine Bob’s secret exponent a in the DSS. Then, of course, Oscar can forge Bob’s signature on any message he likes. But another (perhaps even more serious) problem is that the compromise of a signing algorithm calls in to question the authenticity of all messages signed by Bob, including those he signed before Oscar stole the signing algorithm.

Figure 7.11 Timestamping a signature on a message x

Here is yet another undesirable situation that could arise: Suppose Bob signs a message and later wishes to disavow it. Bob might publish his signing algorithm and then claim that his signature on the message in question is a forgery.

The reason these types of events can occur is that there is no way to determine when a message was signed. This suggests that we consider ways of timestamping a (signed) message. A timestamp should provide proof that a message was signed at a particular time. Then, if Bob’s signing algorithm is compromised, it would not invalidate any signatures he made previously. This is similar conceptually to the way credit cards work: if someone loses a credit card and notifies the bank that isssued it, it becomes invalid. But purchases made prior to the loss of the card are not affected.

In this section, we will describe a few methods of timestamping. First, we observe that Bob can produce a convincing timestamp on his own. First, Bob obtains some “current” publicly available information which could not have been predicted before it happened. For example, such information might consist of all the major league baseball scores from the previous day, or the values of all the stocks listed on the New York Stock Exchange. Denote this information by pub.

Now, suppose Bob wants to timestamp his signature on a message x. We assume that h is a publicly known hash function. Bob will proceed according to the algorithm presented in Figure 7.11. Here is how the scheme works: The presence of the information pub means that Bob could not have produced y before the date in question. And the fact that y is published in the next day’s newspaper proves that Bob did not compute y after the date in question. So Bob’s signature y is bounded within a period of one day. Also observe that Bob does not reveal the message x in this scheme since only z is published. If necessary, Bob can prove that x was the message he signed and timestamped simply by revealing it.

Figure 7.12 Timestamping (zn, yn, IDn)

It is also straightforward to produce timestamps if there is a trusted timestamping service available (i.e., an electronic notary public). Bob can compute z = h(x) and y = sigK(z) and then send (z, y) to the timestamping service, or TSS. The TSS will then append the date D and sign the triple (z, y, D). This works perfectly well provided that the signing algorithm of the TSS remains secure and provided that the TSS cannot be bribed to backdate timestamps. (Note also that this method establishes only that Bob signed a message before a certain time. If Bob also wanted to establish that he signed it after a certain date, he could incorporate some public information pub as in the previous method.)

If it is undesirable to trust the TSS unconditionally, the security can be increased by sequentially linking the messages that are timestamped. In such a scheme, Bob would send an ordered triple (z, y, ID(Bob)) to the TSS. Here z is the message digest of the message x; y is Bob’s signature on z; and ID(Bob) is Bob’s identifying information. The TSS will be timestamping a sequence of triples of this form. Denote by (zn, yn, IDn) the nth triple to be timestamped by the TSS, and let tn denote the time at which the nth request is made.

The TSS will timestamp the nth triple using the algorithm in Figure 7.12. The quantity Ln is “linking information” that ties the nth request to the previous one. (L0 will be taken to be some predetermined dummy information to get the process started.)

Now, if challenged, Bob can reveal his message xn, and then yn can be verified. Next, the signature sn of the TSS can be verified. If desired, then IDn-1 or IDn+1 can be requested to produce their timestamps, (Cn-1, sn-1, IDn) and (Cn+1, sn+1, IDn+2), respectively. The signatures of the TSS can be checked in these timestamps. Of course, this process can be continued as far as desired, backwards and/or forwards.


7.9 Notes and References

The discrete log hash function described in Section 7.4 is due to Chaum, van Heijst, and Pfitzmann [CvHP92]. A hash function that can be proved secure provided that a composite integer n cannot be factored is given by Gibson [GIB91] (see Exercise 7.4 for a description of this scheme).

The material on extending hash functions in Section 7.5 is based on Damgard [DA90]. Similar methods were discovered by Merkle [ME90].

For infomation concerning the construction of hash functions from private-key cryptosystems, see Preneel, Govaerts, and Vandewalle [PGV94].

The MD4 hashing algorithm was presented in Rivest [RI91], and the Secure Hash Standard is described in [NBS93]. An attack against two of the three rounds of MD4 is given by den Boer and Bossalaers [DBB92]. Other recently proposed hash functions include N-hash [MOI90] and Snefru [ME90A].

Timestamping is discussed in Haber and Stornetta [HS91] and Bayer, Haber, and Stornetta [BHS93].

A thorough survey of hashing techniques can be found in Preneel, Govaerts, and Vandewalle [PGV93].


Chapter 7 Exercises

Exercises

7.1 Suppose h : X > Y is a hash function. For any y ? Y, let

and denote sy = |h-1(y)|. Define

Note that N counts the number of unordered pairs in X that collide under h. Answer the following:

(a) Prove that

so the mean of the sy ’s is

(b) Prove that

(c) Prove that

Figure 7.13 Hashing 4m bits to m bits

(d) Using the result proved in part (c), prove that

Further, show that equality is attained if and only if

for every y ? Y.

7.2 As in Exercise 7.1, suppose h : X > Y is a hash function, and let

for any y ? Y. Let ? denote the probability that h(x1) = h(x2), where x1 and x2 are random (not necessarily distinct) elements of X. Prove that

with equality if and only if

for every y ? Y.

7.3 Suppose p = 15083, ? = 154 and ? = 2307 in the Chaum-van Heijst-Pfitzmann Hash Function. Given the collision

compute log? ?.

7.4 Suppose n = pq, where p and q are two (secret) distinct large primes such that p = 2p1 + 1 and q = 2q1 + 1, where p1 and q1 are prime. Suppose that ? is an element of order 2p1q1 in [image] (this is the largest order of any element in [image]). Define a hash function h : {1,...,n2} > [image] by the rule h(x) = ?x mod n.

Now, suppose that n = 603241 and ? = 11 are used to define a hash function h of this type. Suppose that we are given three collisions for h: h(1294755) = h(80115359) = h(52738737). Use this information to factor n.

7.5 Suppose h1 : is a strongly collision-free hash function.

(a) Define h2 : as in Figure 7.13. Prove that h2 is strongly collision-free.
(b) For an integer i ? 2, define a hash function hi : recursively from hi-1, as indicated in Figure 7.14. Prove that hi is strongly collision-free.

7.6 Using the (original) expansion function of the SHS, Equation 7.1, express each of X[16],..., X[79] in terms of X[0],..., X[15]. Now, for each pair X[i], X[j],

Figure 7.14 Hashing 2i m bits to m bits

where 1 ? i < j ? 15, use a computer program to determine ?ij, which denotes the number of X[k]’s (16 ? k ? 79) such that X[i] and X[j] both occur in the expression for X[k]. What is the range of values ?ij?


Chapter 8 Key Distribution and Key Agreement

Chapter 8
Key Distribution and Key Agreement

8.1 Introduction

We have observed that public-key systems have the advantage over private-key systems that a secure channel is not needed to exchange a secret key. But, unfortunately, most public-key systems are much slower than private-key systems such as DES, for example. So, in practice, private-key systems are usually used to encrypt “long” messages. But then we come back to the problem of exchanging secret keys.

In this chapter, we discuss several approaches to the problem of establishing secret keys. We will distinguish between key distribution and key agreement. Key distribution is defined to be a mechanism whereby one party chooses a secret key and then transmits it to another party or parties. Key agreement denotes a protocol whereby two (or more) parties jointly establish a secret key by communicating over a public channel. In a key agreement scheme, the value of the key is determined as a function of inputs provided by both parties.

As our setting, we have an insecure network of n users. In some of our schemes, we will have a trusted authority (denoted by TA) that is reponsible for such things as verifying the identities of users, choosing and transmitting keys to users, etc.

Since the network is insecure, we need to protect against potential opponents. Our opponent, Oscar, might be a passive adversary, which means that his actions are restricted to eavesdropping on messages that are transmitted over the channel. On the other hand, we might want to guard against the possibility that Oscar is an active adversary. An active adversary can do various types of nasty things such as the following:

1. alter messages that he observes being transmitted over the network
2. save messages for reuse at a later time
3. attempt to masquerade as various users in the network.

The objective of an active adversary might be one of the following:

1. to fool U and V into accepting an “invalid” key as valid (an invalid key could be an old key that has expired, or a key chosen by the adversary, to mention two possibilities)
2. to make U or V believe that they have exchanged a key with other when they have not.

The objective of a key distribution or key agreement protocol is that, at the end of the protocol, the two parties involved both have possession of the same key K, and the value of K is not known to any other party (except possibly the TA). Certainly it is much more difficult to design a protocol providing this type of security in the presence of an active adversary as opposed to a passive one.

We first consider the idea of key predistribution in Section 8.2. For every pair of users {U, V}, the TA chooses a random key KU,V = KV,U and transmits it “off-band” to U and V over a secure channel. (That is, the transmission of keys does not take place over the network, since the network is not secure.) This approach is unconditionally secure, but it requires a secure channel between the TA and every user in the network. But, of possibly even more significance is the fact that each user must store n - 1 keys, and the TA needs to transmit a total of [image] keys securely (this is sometimes called the “n2 problem”). Even for relatively small networks, this can become prohibitively expensive, and thus it is not really a practical solution.

In Section 8.2.1, we discuss an interesting unconditionally secure key predistribution scheme, due to Blom, that allows a reduction in the amount of secret information to be stored by the users in the network. We also present in Section 8.2.2 a computationally secure key predistribution scheme based on the discrete logarithm problem.

A more practical approach can be described as on-line key distribution by TA. In such a scheme, the TA acts as a key server. The TA shares a secret key KU with every user U in the network. When U wishes to communicate with V, she requests a session key from the TA. The TA generates a session key K and sends it in encrypted form for U and V to decrypt. The well-known Kerberos system, which we describe in Section 8.3, is based on this approach.

If it is impractical or undesirable to have an on-line TA, then a common approach is to use a key agreement protocol. In a key agreement protocol, U and V jointly choose a key by communicating over a public channel. This remarkable idea is due to Diffie and Hellman, and (independently) to Merkle. We describe a few of the more popular key agreement protocols. A variation of the original protocol of Diffie and Hellman, modified to protect against an active adversary, is presented in Section 8.4.1. Two other interesting protocols are also discussed: the MTI scheme is presented in Section 8.4.2 and the Girault scheme is covered in Section 8.4.3.


8.2 Key Predistribution

In the basic method, the TA generates [image] keys, and gives each key to a unique pair of users in a network of n users. As mentioned above, we require a secure channel between the TA and each user to transmit these keys. This is a significant improvement over each pair of users independently exchanging keys over a secure channel, since the number of secure channels required has been reduced from [image] to n. But if n is large, this solution is not very practical, both in terms of the amount of information to be transmitted securely, and in the amount of information that each user must store securely (namely, the secret keys of the other other n - 1 users).

Thus, it is of interest to try to reduce the amount of information that needs to be transmitted and stored, while still allowing each pair of users U and V to be able to (independently) compute a secret key KU,V. An elegant scheme to accomplish this, called the Blom Key Predistribution Scheme, is discussed in the next subsection.


8.2.1 Blom’s Scheme

As above, we suppose that we have a network of n users. For convenience, we suppose that keys are chosen from a finite field [image], where p ? n is prime. Let k be an integer, 1 ? k ? n - 2. The value k is the largest size coalition against which the scheme will remain secure. In the Blom Scheme, the TA will transmit k + 1 elements of [image] to each user over a secure channel (as opposed to n - 1 in the basic key predistribution scheme). Each pair of users, U and V, will be able to compute a key KU,V = KV,U, as before. The security condition is as follows: any set of at most k users disjoint from {U, V} must be unable to determine any information about KU,V (note that we are speaking here about unconditional security).

We first present the special case of Blom’s scheme where k = 1. Here, the TA will transmit two elements of [image] to each user over a secure channel, and any individual user W will be unable to determine any information about KU,V if W ? U, V. Blom’s scheme is presented in Figure 8.1. We illustrate the Blom Scheme with k = 1 in the following example.

Example 8.1

Suppose the three users are U, V and W, p = 17, and their public elements are rU = 12, rV = 7 and rW = 1. Suppose that the TA chooses a = 8, b = 7 and c = 2, so the polynomial f is

The g polynomials are as follows:

Figure 8.1 Blom Key Distribution Scheme (k = 1)

The three keys are thus

U would compute KU,V as

V would compute KU,V as

We leave the computation of the other keys as an exercise for the reader.

We now prove that no one user can determine any information about the key of two other users.

THEOREM 8.1

The Blom Scheme with k = 1 is unconditionally secure against any individual user.

PROOF Let’s suppose that user W wants to try to compute the key

The values rU and rV are public, but a, b and c are unknown. W does know the values

and

since these are the coefficients of the polynomial gW (x) that was sent to W by the TA.

What we will do is show that the information known by W is consistent with any possible value [image] of the key KU,V. Hence, W cannot rule out any values for KU,V. Consider the following matrix equation (in [image]):

The first equation represents the hypothesis that [image]; the second and third equations contain the information that W knows about a, b and c from gW (x).

The determinant of the coefficient matrix is

where all arithmetic is done in [image]. Since rW ? rU and rW ? rV, it follows that the coefficient matrix has non-zero determinant, and hence the matrix equation has a unique solution for a, b, c. In other words, any possible value [image] of KU,V is consistent with the information known to W.

On the other hand, a coalition of two users, say {W, X}, will be able to determine any key KU,V where [image] W and X together know that

Thus they have four equations in three unknowns, and they can easily compute a unique solution for a, b and c. Once they know a, b and c, they can form the polynomial f(x, y) and compute any key they wish.

It is straightforward to generalize the scheme to remain secure against coalitions of size k. The only thing that changes is step 2. The TA will use a polynomial f(x, y) having the form

where [image], and ai.j = aj,i for all i, j. The remainder of the protocol is unchanged.


8.2.2 Diffie-Hellman Key Predistribution

In this section, we describe a key predistribution scheme that is a modification of the well-known Diffie-Hellman key exchange protocol that we will discuss a bit later, in Section 8.4. We call this the Diffie-Hellman Key Predistribution Scheme. The scheme is computationally secure provided a problem related to the Discrete Logarithm problem is intractible.

We will describe the scheme over [image], where p is prime, though it can be implemented in any finite group in which the Discrete Logarithm problem is intractible. We will assume that a is a primitive element of [image], and that the values p and ? are publicly known to everyone in the network.

In this scheme, ID(U) will denote certain identification information for each user U in the network, e.g., his or her name, e-mail address, telephone number, or other relevant information. Also, each user U has a secret exponent aU (where 0 ? aU ? p - 2), and a corresponding public value

The TA will have a signature scheme with a (public) verification algorithm verTA and a secret signing algorithm sigTA. Finally, we will implicitly assume that all information is hashed, using a public hash function, before it is signed. To make the procedures easier to read, we will not include the necessary hashing in the description of the protocols.

Certain information pertaining to a user U will be authenticated by means of a certificate which is issued and signed by the TA. Each user U will have a certificate

where bU is formed as described above (note that the TA does not need to know the value of aU). A certificate for a user U will be issued when U joins the network. Certificates can be stored in a public database, or each user can store his or her own certificate. The signature of the TA on a certificate allows anyone in the network to verify the information it contains.

It is very easy for U and V to compute the common key

as shown in Figure 8.2.

We illustrate the algorithm with a small example.

Example 8.2

Suppose p = 25307 and ? = 2 are publicly known (p is prime and ? is a primitive root modulo p). Suppose U chooses aU = 3578. Then she computes

which is placed on her certificate. Suppose V chooses aV = 19956. Then he computes

Figure 8.2 Diffie-Hellman Key Predistribution

which is placed on his certificate.

Now U can compute the key

and V can compute the same key

Let us think about the security of this scheme in the presence of a passive or active adversary. The signature of the TA on users’ certificates effectively prevents W from altering any information on someone else’s certificate. Hence we need only worry about passive attacks. So the pertinent question is: Can a user W compute KU,V if W ? U, V? In other words, given ?au mod p and ?av mod p (but not aU nor aV), is it feasible to compute ?aUaV mod p? This problem is called the Diffie-Hellman problem, and it is formally defined (using an equivalent but slightly different presentation) in Figure 8.3. It is clear that Diffie-Hellman Key Predistribution is secure against a passive adversary if and only if the Diffle-Hellman problem is intractible.

Figure 8.3 The Diffie-Hellman problem

If W could determine aU from bU, or if he could determine aV from bV, then he could compute KU,V exactly as U (or V) does. But both these computations are instances of the Discrete Log problem. So, provided that the Discrete Log problem in [image] is intractible, Diffie-Hellman Key Predistribution is secure against this particular type of attack. However, it is an unproven conjecture that any algorithm that solves the Diffie-Hellman problem could also be used to solve the Discrete Log problem. (This is very similar to the situation with RSA, where it is conjectured, but not proved, that breaking RSA is polynomially equivalent to factoring.)

By the remarks made above, the Diffie-Hellman problem is no more difficult than the Discrete Log problem. Although we cannot say precisely how difficult this problem is, we can relate its security to that of another cryptosystem we have already studied, namely the ElGamal Cryptosystem.

THEOREM 8.2

Breaking the ElGamal Cryptosystem is equivalent to solving the Diffie-Hellman problem.

PROOF First we recall how ElGamal encryption and decryption work. The key is K = (p, ?, a, ?), where ? = ?a mod p (a is secret and p, ?, and ? are public). For a (secret) random number [image],

where

and

For [image],

Suppose we have an algorithm A to solve the Diffie-Hellman problem, and we are given an ElGamal encryption (y1, y2). We will apply the algorithm A with inputs p, ?, y1, and ?. Then, we obtain the value

Then, the decryption of (y1, y2) can easily be computed as

Conversely, suppose we have an algorithm B that performs ElGamal decryption. That is, B takes as inputs p, ?, ?, y1, and y2, and computes the quantity

Now, given inputs p, ?, ?, and ? for the Diffie-Hellman problem, it is easy to see that

as desired.


8.3 Kerberos

In the key predistribution methods we discussed in the previous section, each pair of users can compute one fixed key. If the same key is used for a long period of time, there is a danger that it might be compromised. Thus it is often preferable to use an on-line method in which a new session key is produced every time a pair of users want to communicate (this property is called key freshness).

If on-line key distribution is used, there is no need for any network user to store keys to communicate with other users (each user will share a key with the TA, however). Session keys will be transmitted on request by the TA. It is the responsibility of the TA to ensure key freshness.

Kerberos is a popular key serving system based on private-key cryptography. In this section, we give an overview of the protocol for issuing session keys in Kerberos. Each user U shares a secret DES key KU with the TA. In the most recent version of Kerberos (version V), all messages to be transmitted are encrypted using cipher block chaining (CBC) mode, as described in Section 3.4.1.

Figure 8.4 Transmission of a session key using Kerberos

As in Section 8.2.2, ID(U) will denote public identification information for user U. When a request for a session key is sent to the TA, the TA will generate a new random session key K. Also, the TA will record the time at which the request is made as a timestamp, T, and specify the lifetime, L, during which K will be valid. That is, the session key K is to be regarded as a valid key from time T to time T + L. All this information is encrypted and transmitted to U and (eventually) to V. Before going into more details, we will present the protocol in Figure 8.4.

The information transmitted in the protocol is illustrated in the following diagram:

We will now explain what is going on in the various steps of the protocol. Although we have no formal proof that Kerberos is “secure” against an active adversary, we can at least give some informal motivation of the features of the protocol.

As mentioned above, the TA generates K, T, and L in step 2. In step 3, this information, along with ID(V), is encrypted using the key KU shared by U and the TA to form m1. Also, K, T, L, and ID(U) are encrypted using the key Kv shared by V and the TA to form m2. Both these encrypted messages are sent to U.

U can use her key to decrypt m1, and thus obtain K, T, and L. She will verify that the current time is in the interval from T to T + L. She can also check that the session key K has been issued for her desired communicant V by verifying the information ID(V) decrypted from m1.

Next, U will relay m2 to V. As well, U will use the new session key K to encrypt T and ID (U) and send the resulting message m3 to V.

When V receives m2 and m3 from U, he decrypts m2 to obtain T, K, L and ID(U). Then he uses the new session key K to decrypt m3 and he verifies that T and ID(U), as decrypted from m2 and m3, are the same. This ensures V that the session key encrypted within m2 is the same key that was used to encrypt m3. Then V uses K to encrypt T + 1, and sends the result back to U as message m4.

When U receives m4, she decrypts it using K and verifies that the result is T + 1. This ensures U that the session key K has been successfully transmitted to V, since K was needed in order to produce the message m4.

It is important to note the different functions of the messages transmitted in this protocol. The messages m1 and m2 are used to provide secrecy in the transmission of the session key K. On the other hand, m3 and m4 are used to provide key confirmation, that is, to enable U and V to convince each other that they possess the same session key K. In most key distribution schemes, (session) key confirmation can be included as a feature if it is not already present. Usually this is done in a similar fashion as it is done in Kerberos, namely by using the new session key K to encrypt known quantities. In Kerberos, U uses K to encrypt ID (U) and T, which are already encrypted in m2. Similarly, V uses K to encrypt T + 1.

The purpose of the timestamp T and lifetime L is to prevent an active adversary from storing “old” messages for retransmission at a later time (this is called a replay attack). This method works because keys are not accepted as valid once they have expired.

Figure 8.5 Diffie-Hellman Key Exchange

One of the drawbacks of Kerberos is that all the users in the network should have synchronized clocks, since the current time is used to determine if a given session key K is valid. In practice, it is very difficult to provide perfect synchronization, so some amount of variation in times must be allowed.


8.4 Diffie-Hellman Key Exchange

If we do not want to use an on-line key server, then we are forced to use a key agreement protocol to exchange secret keys. The first and best known key agreement protocol is Diffie-Hellman Key Exchange. We will assume that p is prime, ? is a primitive element of [image], and that the values p and ? are publicly known. (Alternatively, they could be chosen by U and communicated to V in the first step of the protocol.) Diffie-Hellman Key Exchange is presented in Figure 8.5.

At the end of the protocol, U and V have computed the same key

This protocol is very similar to Diffie-Hellman Key Predistribution described earlier. The difference is that the exponents aU and aV of users U and V (respectively) are chosen anew each time the protocol is run, instead of being fixed. Also, in this protocol, both U and V are assured of key freshness, since the session key depends on both random exponents aU and aV


8.4.1 The Station-to-station Protocol

Diffie-Hellman Key Exchange is supposed to look like this:

Unfortunately, the protocol is vulnerable to an active adversary who uses an intruder-in-the-middle attack. There is an episode of The Lucy Show in which Vivian Vance is having dinner in a restaurant with a date, and Lucille Ball is hiding under the table. Vivian and her date decide to hold hands under the table. Lucy, trying to avoid detection, holds hands with each of them and they think they are holding hands with each other.

An intruder-in-the-middle attack on the Diffie-Hellman Key Exchange protocol works in the same way. W will intercept messages between U and V and substitute his own messages, as indicated in the following diagram:

At the end of the protocol, U has actually established the secret key [image] with W, and V has established a secret key [image] with W. When U tries to encrypt a message to send to V, W will be able to decrypt it but V will not. (A similar situation holds if V sends a message to U.)

Clearly, it is essential for U and V to make sure that they are exchanging messages with each other and not with W. Before exchanging keys, U and V might carry out a separate protocol to establish each other’s identity, for example by using one of the identification schemes that we will describe in Chapter 9. But this offers no protection against an intruder-in-the-middle attack if W simply remains inactive until after U and V have proved their identities to each other. Hence, the key agreement protocol should itself authenticate the participants’ identities at the same time as the key is being established. Such a protocol will be called authenticated key agreement.

We will describe an authenticated key agreement protocol which is a modification of Diffie-Hellman Key Exchange. The protocol assumes a publicly known prime p and a primitive element ?, and it makes use of certificates. Each user U will have a signature scheme with verification algorithm verU and signing algorithm sigU. The TA also has a signature scheme with public verification algorithm verTA. Each user U has a certificate

where ID(U) is identification information for U.

Figure 8.6 Simplified Station-to-station Protocol

The authenticated key agreement known as the Station-to-station Protocol (or STS for short) is due to Diffie, Van Oorschot, and Wiener. The protocol we present in Figure 8.6 is a slight simplification; it can be used in such a way that it is conformant with the ISO 9798-3 protocols.

The information exchanged in the simplified STS protocol (excluding certificates) is illustrated as follows:

Let’s see how this protects against an intruder-in -the-middle attack. As before, W will intercept [image] and replace it with [image]. W then receives [image] from V. He would like to replace [image] with [image] as before. However, this means that he must also replace [image] by [image]. Unfortunately for W, he cannot compute V’s signature on [image] since he doesn’t know V’s signing algorithm sigV. Similarly, W is unable to replace [image] by [image] because he does not know U’s signing algorithm.

This is illustrated in the following diagram:

It is the use of signatures that thwarts the intruder-in-the-middle attack.

The protocol, as described in Figure 8.6, does not provide key confirmation. However, it is easy to modify so that it does, by defining

in step 4 and defining

in step 6. (As in Kerberos, we obtain key confirmation by encrypting a known quantity using the new session key.) The resulting protocol is known as the Station-to-station Protocol. We leave the remaining details for the interested reader to fill in.


8.4.2 MTI Key Agreement Protocols

Matsumoto, Takashima, and Imai have constructed several interesting key agreement protocols by modifying Diffie-Hellman Key Exchange. These protocols, which we call MTI protocols, do not require that U and V compute any signatures. They are two-pass protocols since there are only two separate transmissions of information performed (one from U to V and one from V to U). In contrast, the STS protocol is a three-pass protocol.

We present one of the MTI protocols. The setting for this protocol is the same as for Diffie-Hellman Key Predistribution. We assume a publicly known prime p and a primitive element ?. Each user U has an ID string, ID(U), a secret exponent aU (0 ? aU ? p - 2), and a corresponding public value

The TA has a signature scheme with a (public) verification algorithm verTA and a secret signing algorithm sigTA.

Figure 8.7 Matsumoto-Takashima-Imai Key Agreement Protocol

Each user U will have a certificate

where bU is formed as described above.

We present the MTI key agreement protocol in Figure 8.7. At the end of the protocol, U and V have both computed the same key

We give an example to illustrate this protocol.

Example 8.3

Suppose p = 27803 and ? = 5 are publicly known. Assume U chooses aU = 21131; then she will compute

which is placed on her certificate. As well, assume V chooses aV = 17555. Then he will compute

which is placed on his certificate.

Now suppose that U chooses rU = 169; then she will send the value

to V. Suppose that V chooses rV = 23456; then he will send the value

to U.

Now U can compute the key

and V can compute the key

Thus U and V have computed the same key.

The information transmitted during the protocol is depicted as follows:

Let’s look at the security of the scheme. It is not too difficult to show that the security of the MTI protocol against a passive adversary is exactly the same as the Diffie-Hellman problem — see the exercises. As with many protocols, proving security in the presence of an active adversary is problematic. We will not attempt to prove anything in this regard, and we limit ourselves to some informal arguments.

Here is one threat we might consider: Without the use of signatures during the protocol, it might appear that there is no protection against an intruder-in-the-middle attack. Indeed, it is possible that W might alter the values that U and V send each other. We depict one typical scenario that might arise, as follows:

In this situation, U and V will compute different keys: U will compute

while V will compute

However, neither of the key computations of U or V can be carried out by W, since they require knowledge of the secret exponents aU and aV, respectively. So even though U and V have computed different keys (which will of course be useless to them), neither of these keys can be computed by W (assuming the intractibility of the Discrete Log problem). In other words, both U and V are assured that the other is the only user in the network that could compute the key that they have computed. This property is sometimes called implicit key authentication.


8.4.3 Key Agreement Using Self-certifying Keys

In this section, we describe a method of key agreement, due to Girault, that does not require certificates. The value of a public key and the identity of its owner implicitly authenticate each other.

The Girault Scheme combines features of RSA and discrete logarithms. Suppose n = pq, where p = 2p1 + 1, q = 2q1 + 1, and p, q, p1, and q1 are all large primes. The multiplicative group [image] isomorphic to [image]. The maximum order of any element in [image] is therefore the least common multiple of p - 1 and q - 1, or 2p1q1. Let ? be an element of order 2p1q1. Then the cyclic subgroup of [image] generated by ? is a suitable setting for the Discrete Logarithm problem.

In the Girault Scheme, the factorization of n is known only to the TA. The values n and ? are public, but p, q, p1, and q1 are all secret. The TA chooses a public RSA encryption exponent, which we will denote by e. The corresponding decryption exponent, d, is secret (recall that d = e–1 mod o (n)).

Each user U has an ID string ID(U), as in previous schemes. A user U obtains a self-certifying public key, pU, from the TA as indicated in Figure 8.8. Observe that U needs the help of the TA to produce pU. Note also that

can be computed from pU and ID(U) using publicly available information.

The Girault Key Agreement Protocol is presented in Figure 8.9. The information transmitted during the protocol is depicted as follows:

Figure 8.8 Obtaining a self-certifying public key from the TA

At the end of the protocol, U and V each have computed the key

Here is an example of key exchange using the Girault Scheme.

Example 8.4

Suppose p = 839 and q = 863. Then n = 724057 and o(n) = 722356. The element ? = 5 has order 2p1q1 = o(n)/2. Suppose the TA chooses d = 125777 as the RSA decryption exponent; then e = 84453.

Suppose U has ID(U) = 500021 and aU = 111899. Then bU = 488889 and pU = 650704. Suppose also that V has ID(V) = 500022 and aV = 123456. Then bV = 111692 and pV = 683556.

Now, U and V want to exchange a key. Suppose U chooses
rU = 56381, which means that
sU = 171007. Further, suppose V chooses
rV = 356935, which means that
sV = 320688.

Then both U and V will compute the same key K = 42869.

Let’s consider how the self-certifying keys guard against one specific type of attack. Since the values bU, pU, and ID(U) are not signed by the TA, there is no way for anyone else to verify their authenticity directly. Suppose this information is forged by W (i.e., it is not produced in cooperation with the TA), who wants to masquerade as U. If W starts with ID(U) and a fake value [image], then there is no way for her to compute the exponent [image] corresponding [image] if the Discrete Log problem is intractible. Without [image] computation cannot be performed by W (who is pretending to be U).

Figure 8.9 Girault Key Agreement Protocol

The situation is similar if W acts as an intruder-in-the-middle. W will be able to prevent U and V from computing a common key, but W is unable to duplicate the computations of either U or V. Thus the scheme provides implicit key authentication, as did the MTI protocol.

An attentive reader might wonder why U is required to supply the value aU to the TA. Indeed, the TA can compute pU directly from bU, without knowing aU. Actually, the important thing here is that the TA should be convinced that U knows the value of aU before the TA computes pU for U.

We illustrate this point by showing how the scheme can be attacked if the TA indiscriminately issues public keys pU to users without first checking that they possess the value aU corresponding to their bU. Suppose W chooses a fake value [image] and computes the corresponding value

Here is how he can determine the corresponding public key

W will compute

and then given [image] and ID(W) to the TA. Suppose the TA issues the public key

to W. Using the fact that

it is immediate that

Now, at some later time, suppose U and V execute the protocol, and W substitutes information as follows:

Now V will compute the key

whereas U will compute the key

W can compute K? as

Thus W and V share a key, but V thinks he is sharing a key with U. So W will be able to decrypt messages sent by V to U.


8.5 Notes and References

Blom presented his key predistribution scheme in [BL85]. Generalizations can be found in Blundo et al. [BDSHKVY93] and Beimel and Chor [BC94].

Diffie and Hellman presented their key exchange algorithm in [DH76]. The idea of key exchange was discovered independently by Merkle [ME78]. The material on authenticated key exchange is taken from Diffie, van Oorschot, and Wiener [DVW92].

Version V of Kerberos is described in [KN93]. For a recent descriptive article on Kerberos, see Schiller [SC94].

The protocols of Matsumoto, Takashima, and Imai can be found in [MTI86]. Self-certifying key distribution was introduced by Girault [GIR91]. The scheme he presented was actually a key predistribution scheme; the modification to a key agreement scheme is based on [RV94].

Two recent surveys on key distribution and key agreement are Rueppel and Van Oorschot [RV94] and van Tilburg [VT93].


Chapter 8 Exercises

Exercises

8.1 Suppose the Blom Scheme with k = 1 is implemented for a set of four users, U, V, W and X. Suppose that p = 7873, rU = 2365, rV 6648, rW = 1837 and rX = 2186. The secret g polynomials are as follows:

(a) Compute the key for each pair of users, verifying that each pair of users obtains a common key (that is, KU,V = KV,U, etc.).
(b) Show how W and X together can compute KU,V.

8.2 Suppose the Blom Scheme with k = 2 is implemented for a set of five users, U, V, W, X and Y. Suppose that p = 97, rU = 14, rV = 38, rW = 92, rX = 69 and rY = 70. The secret g polynomials are as follows:

(a) Show how U and V each will compute the key KU,V = KV,U.
(b) Show how W, X and Y together can compute KU,V.

8.3 Suppose that U and V carry out the Diffie-Hellman Key Exchange with p = 27001 and ? = 101. Suppose that U chooses aU = 21768 and V chooses aV 9898. Show the computations performed by both U and V, and determine the key that they will compute.
8.4 Suppose that U and V carry out the MTI Protocol where p = 30113 and ? = 52. Suppose that U has aU = 8642 and chooses rU = 28654, and V has aV = 24673 and chooses rV = 12385. Show the computations performed by both U and V, and determine the key that they will compute.
8.5 If a passive adversary tries to compute the key K constructed by U and V by using the MTI protocol, then he is faced with an instance of what we might term the MTI problem, which we present in Figure 8.10. Prove that any algorithm that can be used to solve the MTI problem can be used to solve the Diffie-Hellman problem, and vice versa.
8.6 Consider the Girault Scheme where p = 167, q = 179, and hence n = 29893. Suppose ? = 2 and e = 11101.

(a) Compute d.
(b) Given that ID(U) = 10021 and aU = 9843, compute bU and pU. Given that ID(V) = 10022 and aV = 7692, compute bV and pV.
(c) Show how bU can be computed from pU and ID(U) using the public exponent e. Similarly, show how bV can be computed from pV and ID(V).

Figure 8.10 The MTI problem

(d) Suppose that U chooses rU = 15556 and V chooses rV = 6420. Compute sU and sV, and show how U and V each compute their common key.


Chapter 9 Identification Schemes

Chapter 9
Identification Schemes

9.1 Introduction

Cryptographic methods enable many seemingly impossible problems to be solved. One such problem is the construction of secure identification schemes. There are many common, everyday situations where it is necessary to electronically “prove” one’s identity. Some typical scenarios are as follows:

1. To withdraw money from an automated teller machine (or ATM), we use a card together with a four-digit personal identification number (PIN).
2. To charge purchases over the telephone to a credit card, all that is necessary is a credit card number (and the expiry date).
3. To charge long-distance telephone calls (using a calling card), one requires only a telephone number together with a four-digit PIN.
4. To do a remote login to a computer over a network, it suffices to know a valid user name and the corresponding password.

In practice, these types of schemes are not usually implemented in a secure way. In the protocols performed over the telephone, any eavesdropper can use the identifying information for their own purposes. This could include the person who is the recipient of the information; many credit card “scams” operate in this way. An ATM card is somewhat more secure, but there are still weaknesses. For example, someone monitoring the communication line can obtain all the information encoded on the card’s magnetic strip, as well as the PIN. This could allow an imposter to gain access to a bank account. Finally, remote computer login is a serious problem due to the fact that user IDs and passwords are transmitted over the network in unencrypted form. Thus they are vulnerable to anyone who is monitoring the computer network.

The goal of an identification scheme is that someone “listening in” as Alice identifies herself to Bob, say, should not subsequently be able to misrepresent herself as Alice. Furthermore, we should try to guard against the possibility that Bob himself might try to impersonate Alice after she has identified herself to him. In other words, Alice wants to be able to prove her identity electronically without “giving away” her identifying information.

Figure 9.1 Challenge-and-response protocol

Several such identification schemes have been discovered. One practical objective is to find a scheme that is simple enough that it can be implemented on a smart card, which is essentially a credit card equipped with a chip that can perform arithmetic computations. Hence, both the amount of computation and the memory requirements should be kept as small as possible. Such a card would be a more secure alternative to current ATM cards. However, it is important to note that the “extra” security pertains to someone monitoring the communication line. Since it is the card that is “proving” its identity, we have no extra protection against a lost card. It would still be necessary to include a PIN in order to establish that it is the real owner of the card who is initiating the identification protocol.

In later sections, we will describe some of the more popular identification schemes. But first, we give a very simple scheme that can be based on any private-key cryptosystem, e.g., DES. The protocol, which is described in Figure 9.1, is called a challenge-and-response protocol. In it, we assume that Alice is identifying herself to Bob, and Alice and Bob share a common secret key, K, which specifies an encryption function eK.

We illustrate this protocol with a small example.

Example 9.1

Alice and Bob use an encryption function which does a modular exponentiation:

Suppose Bob’s challenge is x = 77835. Then Alice responds with y = 100369.

Virtually all identification schemes are challenge-and-response protocols, but the most useful schemes do not require shared keys. This idea will be pursued in the remainder of the chapter


9.2 The Schnorr Identification Scheme

We begin by describing the Schnorr Identification Scheme, which is one of the most attractive practical identification schemes. The scheme requires a trusted authority, which we denote by TA. The TA will choose parameters for the scheme as follows:

1. p is a large prime (i.e., p ? 2 512) such that the discrete log problem in [image] is intractible.
2. q is a large prime divisor of p - 1 (i.e., q ? 2 140).
3. has order q (such an ? can be computed as the (p - 1)/qth power of a primitive element).
4. A security parameter t such that q > 2t. For most practical applications, t = 40 will provide adequate security.
5. The TA also establishes a secure signature scheme with a secret signing algorithm sigTA and a public verification algorithm verTA.
6. A secure hash function is specified. As usual, all information is to be hashed before it is signed. In order to make the protocols easier to read, we will omit the hashing steps from the descriptions of the protocols.

The parameters p, q, and ?, the public verification algorithm verTA and the hash function are all made public.

A certificate will be issued to Alice by the TA. When Alice wants to obtain a certificate from the TA, the steps in Figure 9.2 are carried out. At a later time, when Alice wants to prove her identity to Bob, say, the protocol of Figure 9.3 is executed.

As mentioned above, t is a security parameter. Its purpose is to prevent an impostor posing as Alice, say Olga, from guessing Bob’s challenge, r. For, if Olga guessed the correct value of r, she could choose any value for y and compute

She would give Bob ? in step 1, and then when she receives the challenge r, she would supply the value y she has already chosen. Then ? would be verified by Bob in step 6.

Figure 9.2 Issuing a certificate to Alice

The probability that Olga will guess the value of r correctly is 2-t if r is chosen at random by Bob. Thus, t = 40 should be a reasonable value for most applications. (But notice that Bob should choose his challenge r at random every time Alice identifies herself to him. If Bob always used the same challenge r, then Olga could impersonate Alice by the method described above.)

Basically, there are two things happening in the verification protocol. First, the signature s proves the validity of Alice’s certificate. Thus Bob verifies the signature of the TA on Alice’s certificate to convince himself that the certificate itself is authentic. This is essentially the same way that certificates were used in Chapter 8.

The second part of the protocol concerns the secret number a. The value a functions like a PIN in that it convinces Bob that the person carrying out the identification protocol is indeed Alice. But there is an important difference from a PIN: in the identification protocol, the value of a is not revealed. Instead Alice (or more accurately, Alice’s smart card) “proves” that she/it knows the value of a in step 5 of the protocol by computing the value y in response to the challenge r issued by Bob. Since the value of a is not revealed, this technique is called a proof of knowledge.

Figure 9.3 The Schnorr identification scheme

The following congruences demonstrate that Alice will be able to prove her identity to Bob:

Thus Bob will accept Alice’s proof of identity (assuming he is honest), and the protocol is said to have the completeness property.

Here is a small (toy) example illustrating the challenge-and-response aspect of the protocol.

Example 9.2

Suppose p = 88667, q = 1031 and t = 10. The element ? = 70322 has order q in [image]. Suppose Alice’s secret exponent is a = 755; then

Now suppose Alice chooses k = 543. Then she computes

and sends ? to Bob. Suppose Bob issues the challenge r = 1000. Then Alice computes

and sends y to Bob. Bob then verifies that

So Bob believes that he is communicating with Alice.

Next, let’s consider how someone might try to impersonate Alice. An imposter, Olga, might try to impersonate Alice by forging a certificate

where v? ? v. But s? is supposed to be a signature of (ID (Alice), v?), and this is verified by Bob in step 3 of the protocol. If the signature scheme of the TA is secure, Olga will not be able to forge a signature s? which will subsequently be verified by Bob.

Another approach would be for Olga to use Alice’s correct certificate, which is C(Alice) = (ID(Alice), v, s) (recall that certificates are not secret, and the information on a certificate is revealed each time the identification protocol is executed). But Olga will not be able to impersonate Alice unless she also knows the value of a. This is because of the “challenge” r in step 4. In step 5, Olga would have to compute y, but y is a function of a. The computation of a from v involves solving a discrete log problem, which we assume is intractible.

We can prove a more precise statement about the security of the protocol, as follows.

THEOREM 9.1

Suppose Olga knows a value ? for which she has probability ? ? 1/2t-1 of successfully impersonating Alice in the verification protocol. Then Olga can compute a in polynomial time.

PROOF For a fraction ? of the 2t possible challenges r, Olga can compute a value y which will be accepted in step 6 by Bob. Since ? ? 1/2 t-1, we have that 2t ?, and therefore Olga can compute values y1, y2, r1 and r2 such that

and

It follows that

Since v = ?-a, we have that

Now, 0 < |r2 - r1| < 2t and q > 2t is prime. Hence gcd(r2 - r1, q) = 1, and Olga can compute

as desired.

The above theorem proves that anyone who has a non-negligible chance of successfully executing the identification protocol must know (or be able to compute in polynomial time) Alice’s secret exponent a. This property is often referred to as soundness.

We illustrate with an example.

Example 9.3

Suppose we have the same parameters as in Example 9.2: p = 88667, q = 1031, t = 10, ? = 70322, ? = 755 and v = 13136. Suppose Olga learns that

Then she can compute

and thus discover Alice’s secret exponent.

We have proved that the protocol is sound and complete. But soundness and completeness are not sufficient to ensure that the protocol is “secure.” For example, if Alice simply revealed the value of her exponent a to prove her identity to Olga (say), the protocol would still be sound and complete. However, it would be completely insecure, since Olga could subsequently impersonate Alice.

This motivates the consideration of the secret information released to a verifier (or an observer) who takes part in the protocol (in this protocol, the secret information is the value of the exponent a). Our hope is that no information about a can be gained by Olga when Alice proves her identity, for then Olga would be able to masquerade as Alice.

In general, we could envision a situation whereby Alice proves her identity to Olga, say, on several different occasions. Perhaps Olga does not choose her challenges (i.e., the values of r) in a random way. After several executions of the protocol, Olga will try to determine the value of a so she can subsequently impersonate Alice. If Olga can determine no information about the value of a by taking part in a polynomial number of executions of the protocol and then performing a polynomial amount of computation, then we would be convinced that the protocol is secure.

It has not been proven that the Schnorr Scheme is secure. But in the next section, we present a modification of the Schnorr Scheme, due to Okamoto, that can be proved to be secure given a certain computational assumption.

The Schnorr Scheme was designed to be very fast and efficient, both from a computational point of view and in the amount of information that needs to be exchanged in the protocol. It is also designed to minimize the amount of computation performed by Alice. This is desirable because in many practical applications, Alice’s computations will be performed by a smart card with low computing power, while Bob’s computations will be performed by a more powerful computer.

For the purpose of discussion, let’s assume that ID (Alice) is a 512-bit string. v also comprises 512 bits, and s will be 320 bits if the DSS is used as a signature scheme. The total size of the certificate C(Alice) (which needs to be stored on Alice’s smart card) is then 1344 bits.

Let us consider Alice’s computations: step 1 requires a modular exponentiation to be performed; step 5 comprises one modular addition and one modular multiplication. It is the modular exponentiation that is computationally intensive, but this can be precomputed offline, if desired. The online computations to be performed by Alice are very modest.

It is also a simple matter to calculate the number of bits that are communicated during the protocol. We can depict the information that is communicated in the form of a diagram:

Alice gives Bob 1344 + 512 = 1856 bits of information in step 2; Bob gives Alice 40 bits in step 4; and Alice gives Bob 140 bits in step 6. So the communication requirements are quite modest, as well.

Figure 9.4 Issuing a certificate to Alice


9.3 The Okamoto Identification Scheme

In this section, we present a modification of the Schnorr Scheme due to Okamoto. This modification can be proved secure, assuming the intractibility of computing a particular discrete logarithm in [image].

To set up the scheme, the TA chooses p and q as in the Schnorr Scheme. The TA also chooses two elements [image] both having order q. The value [image] is kept secret from all the participants, including Alice. We will assume that it is infeasible for anyone (even a coalition of Alice and Olga, say) to compute the value c. As before, the TA chooses a signature scheme and hash function. The certificate issued to Alice by the TA is constructed as described in Figure 9.4. The Okamoto Identification Scheme is presented in Figure 9.5.

Here is an example of the Okamoto Scheme.

Example 9.4

As in previous examples, we will take p = 88667, q = 1031, and t = 10. Suppose ?1 = 58902 and ?2 = 73611 (both ?1 and ?2 have order q in [image]). Now, suppose ?1 = 846 and ?2 = 515; then v = 13078.

Figure 9.5 The Okamoto identification scheme

Suppose Alice chooses k1 = 899 and
k2 = 16; then ? = 14574. If Bob issues the
challenge r = 489 then Alice will respond with
y1 = 131 and
y2 = 287. Bob will verify that

So Bob will accept Alice’s proof of identity.

The proof that the protocol is complete (i.e., that Bob will accept Alice’s proof of identity) is straightforward. The main difference between Okamoto’s and Schnorr’s scheme is that we can prove that the Okamoto Scheme is secure provided that the computation of the discrete logarithm [image] is intractible.

The proof of security is quite subtle. Here is the general idea: As before, Alice identifies herself to Olga polynomially many times by executing the protocol. We then suppose (hoping to obtain a contradiction) that Olga is able to learn some information about the values of Alice’s secret exponents ?1 and ?2. If this is so, then we will show that (with high probability) Alice and Olga together will be able to compute the discrete logarithm c in polynomial time. This contradicts the assumption made above, and proves that Olga must be unable to obtain any information about Alice’s exponents by taking part in the protocol.

The first part of this procedure is similar to the soundness proof for the Schnorr Scheme.

THEOREM 9.2

Suppose Olga knows a value ? for which she has probability ? ? 1/2t-1 of successfully impersonating Alice in the verification protocol. Then, in polynomial time, Olga can compute values b1 and b2 such that

PROOF For a fraction ? of the 2t possible challenges r, Olga can compute values y1, y2, z1, z2, r and s with r ? s and

Define

b1 = (y1 - z1)(r - s)-1 mod q

and

b2 = (y2 - z2)(r - s)-1 mod q.

Then it is easy to check that

as desired.

We now proceed to show how Alice and Olga can together compute the value of c.

THEOREM 9.3

Suppose Olga knows a value ? for which she has probability ? ? 1/2t-1 of successfully impersonating Alice in the verification protocol. Then, with probability 1 - 1/q, Alice and Olga can together compute [image] in polynomial time.

PROOF By Theorem 9.2, Olga is able to determine values b1 and b2 such that

Now suppose that Alice reveals the values ?1 and ?2 to Olga. Of course

so it must be the case that

Suppose that (a1, a2) ? (b1, b2). Then (a2 - b2)-1 mod q exists, and the discrete log

can be computed in polynomial time.

There remains to be considered the possibility that (a1, a2) = (b1, b2). If this happens, then the value of c cannot be computed as described above. However, we will argue that (a1, a2) = (b1, b2) will happen only with very small probability 1/q, so the procedure whereby Alice and Olga compute c will almost surely succeed.

Define

That is, [image] consists of all the possible ordered pairs that could be Alice’s secret exponents. Observe that

where [image]. Thus [image] consist of q ordered pairs.

The ordered pair (b1, b2) computed by Olga is certainly in the set [image]. We will argue that the value of the pair (b1, b2) is independent of the value of the pair (a1, a2) that comprises Alice’s secret exponents. Since (a1, a2) was originally chosen at random by Alice, it must be the case that the probability that (a1, a2) = (b1, b2) is 1/q.

So, we need to say what we mean by (b1, b2) being “independent” of (a1, a2). The idea is that Alice’s pair (a1, a2) is one of the q possible ordered pairs in the set [image], and no information about which is the “correct” ordered pair is revealed by Alice identifying herself to Olga. (Stated informally, Olga knows that an ordered pair from [image] comprises Alice’s exponents, but she has no way of telling which one.)

Let’s look at the information that is exchanged during the identification protocol. Basically, in each execution of the protocol, Alice chooses a ?; Olga chooses an r; and Alice reveals y1 and y2 such that

Recall that Alice computes

and

where

But note that k1 and k2 are not revealed (nor are a1 and a2).

The particular quadruple (?, r, y1, y2) that is generated during one execution of the protocol appears to depend on Alice’s ordered pair (a1, a2), since y1 and y2 are defined in terms of a1 and a2. But we will show that each such quadruple could equally well be generated from any other ordered pair [image]. To see this, suppose [image] and [image] where 0 ? ? ? q - 1. We can express y1 and y2 as follows:

and

where all arithmetic is performed in [image]. That is, the quadruple (?,r,y1,y2) is also consistent with the ordered pair [image] using the random choices [image] and [image] to produce (the same) ?. We have already noted that the values of k1 and k2 are not revealed by Alice, so the quadruple (?,r,y1,y2) yields no information regarding which ordered pair in [image] Alice is actually using for her secret exponents. This completes the proof.

This security proof is certainly quite elegant and subtle. It would perhaps be useful to recap the features of the protocol that lead to the proof of security. The basic idea involves having Alice choose two secret exponents rather than one. There are a total of q pairs in the set [image] that are “equivalent” to Alice’s pair (a1, a2). The fact that leads to the ultimate contradiction is that knowledge of two different pairs in [image] provides an efficient method of computing the discrete logarithm c. Alice, of course, knows one pair in [image]; and we proved that if Olga can impersonate Alice, then Olga is able to compute a pair in [image] which (with high probability) is different from Alice’s pair. Thus Alice and Olga together can find two pairs in [image] and compute c, which provides the desired contradiction.

Here is an example to illustrate the computation of [image] by Alice and Olga.

Example 9.5

As in Example 9.4, we will take p = 88667, q = 1031 and t = 10, and assume that v = 13078.

Suppose Olga has determined that

Then she can compute

b1 = (131 - 890)(489 - 199)-1 mod 1031 = 456

and

b2 = (287 - 303)(489 - 199)-1 mod 1031 = 519.

Now, using the values of a1 and a2 supplied by Alice, the value

c = (846 - 456)(519 - 515)-1 mod 1031 = 613

is computed. This value c is in fact [image] as can be verified by calculating

58902613 mod 88667 = 73611.

Finally, we should emphasize that, although there is no known proof that the Schnorr Scheme is secure (even assuming that the discrete logarithm problem is intractible), neither is there any known weakness in the scheme. Actually, the Schnorr Scheme might be preferred in practice to the Okamoto Scheme simply because it is somewhat faster.


9.4 The Guillou-Quisquater Identification Scheme

In this section, we describe another identification scheme, due to Guillou and Quisquater, that is based on RSA.

The set-up of the scheme is as follows: The TA chooses two primes p and q and forms the product n = pq. The values of p and q are secret, while n is public. As is usually the case, p and q should be chosen large enough that factoring n is intractible. Also, the TA chooses a large prime integer b which will function as a security parameter as well as being a public RSA encryption exponent; to be specific, let us suppose that b is a 40-bit prime. Finally, the TA chooses a signature scheme and hash function.

The certificate issued to Alice by the TA is constructed as described in Figure 9.6. When Alice wants to prove her identity to Bob, say, the protocol of Figure 9.7 is executed. We will prove that the Guillou-Quisquater Scheme is sound and complete. However, the scheme has not been proved to be secure (even assuming that the RSA cryptosystem is secure).

Figure 9.6 Issuing a certificate to Alice

Figure 9.7 The Guillou-Quisquater identification scheme

Example 9.6

Suppose the TA chooses p = 467 and q = 479, so n = 223693. Suppose also that b = 503 and Alice’s secret integer u = 101576. Then she will compute

Now, let’s assume that Alice is proving her identity to Bob and she chooses k = 187485; then she gives Bob the value

Suppose Bob responds with the challenge r = 375. Then Alice will compute

and gives it to Bob. Bob then verifies that

Hence, Bob accepts Alice’s proof of identity.

As is generally the case, proving completeness is quite simple:

Now, let us consider soundness. We will prove that the scheme is sound provided that it is infeasible to compute u from v. Since v is formed from u by RSA encryption, this is a plausible assumption to make.

THEOREM 9.4

Suppose Olga knows a value ? for which she has probability ? > 1/b of successfully impersonating Alice in the verification protocol. Then, in polynomial time, Olga can compute u.

PROOF For some ?, Olga can compute values y1, y2, r1, r2 with r1 ? r2, such that

Suppose, without loss of generality, that r1 > r2. Then we have

Since 0 < r1 - r2 < b and b is prime, t = (r1 - r2)-1 mod b exists, and it can be computed in polynomial time by Olga using the Euclidean algorithm. Hence, we have that

Now,

for some positive integer [image], so

or equivalently,

Now raise both sides of the congruence to the power b-1 mod ?(n), to get the following:

Finally, compute the inverse modulo n, of both sides of this congruence, to obtain the following formula for u:

Olga can use this formula to compute u in polynomial time.

Example 9.7

As in the previous example, suppose that n = 223693, b = 503, u = 101576 and v = 89888. Suppose Olga has learned that

She will first compute

Figure 9.8 Issuing a value u to Alice

Next, she calculates

Finally, she can obtain the secret value u as follows:

Thus Alice’s secret exponent has been compromised.


9.4.1 Identity-based Identification Schemes

The Guillou-Quisquater Identification Scheme can be transformed into what is known as an identity-based identification scheme. This basically means that certificates are not necessary. Instead, the TA computes the value of u as a function of Alice’s ID string, using a public hash function h with range [image]. This is done as indicated in Figure 9.8. The identification protocol now works as described in Figure 9.9. The value v is computed from Alice’s ID string via the public hash function h. In order to carry out the identification protocol, Alice needs to know the value of u, which can be computed only by the TA (assuming that the RSA cryptosystem is secure). If Olga tries to identify herself as Alice, she will not succeed because she does not know the value of u.

Figure 9.9 The Guillou-Quisquater identity-based identification scheme


9.5 Converting Identification to Signature Schemes

There is a standard method of converting an identification scheme to a signature scheme. The basic idea is to replace the verifier (Bob) by a public hash function, h. In a signature scheme obtained by this approach, the message is not hashed before it is signed; the hashing is integrated into the signing algorithm.

We illustrate this approach by converting the Schnorr Scheme into a signature scheme. See Figure 9.10. In practice, one would probably take the hash function h to be the SHS, with the result reduced modulo q. Since the SHS produces a bitstring of length 160 and q is a 160-bit prime, the modulo q reduction is necessary only if the message digest produced by the SHS exceeds q; and even in this situation it is necessary only to subtract q from the result.

In proceeding from an identification scheme to a signature scheme, we replaced a 40-bit challenge by a 160-bit message digest. 40 bits suffice for a challenge since an impostor needs to be able to guess the challenge in order to precompute a response that will be accepted. But in the context of a signature scheme, we need message digests of a much larger size, in order to prevent attacking the scheme by finding collisions in the hash function.

Other identification schemes can be converted to signature schemes in a similar fashion.

Figure 9.10 Schnorr Signature Scheme


9.6 Notes and References

The Schnorr Identification Scheme is from [SC91], the Okamoto Scheme was presented in [OK93], and the Guillou-Quisquater Scheme can be found in [GQ88]. Another scheme that can be proved secure under a plausible computational assumption has been given by Brickell and McCurley [BM92].

Other popular identification schemes include the Feige-Fiat-Shamir Scheme [FFS88] (see also [FS87]) and Shamir’s Permuted Kernel Scheme [SH90]. The Feige-Fiat-Shamir Scheme is proved secure using zero-knowledge techniques (see Chapter 13 for more information on zero-knowledge proofs).

The method of constructing signature schemes from identification schemes is due to Fiat and Shamir [FS87]. They also describe an identity-based version of their identification scheme.

Surveys on identification schemes have been published by Burmester, Desmedt, and Beth [BDB92] and de Waleffe and Quisquater [DWQ93].


Chapter 9 Exercises

Exercises

9.1 Consider the following possible identification scheme. Alice possesses a secret key n = pq, where p and q are prime and p ? q ? 3 (mod 4). The values n and ID(Alice) are signed by the TA, as usual, and stored on Alice’s certificate. When Alice wants to identify herself to Bob, say, Bob will present Alice with a random quadratic residue modulo n, say x. Then Alice will compute a square root y of x and give it to Bob. Bob then verifies that y2 ? x (mod n). Explain why this scheme is insecure.
9.2 Suppose Alice is using the Schnorr Scheme where q = 1201, p = 122503, t = 10 and ? = 11538.

(a) Verify that ? has order q in [image].
(b) Suppose that Alice’s secret exponent is a = 357. Compute v.
(c) Suppose that k = 868. Compute ?.
(d) Suppose that Bob issues the challenge r = 501. Compute Alice’s response y.
(e) Perform Bob’s calculations to verify y.

9.3 Suppose that Alice uses the Schnorr Scheme with p, q, t and ? as in Exercise 9.2. Now suppose that v = 51131, and Olga has learned that

Show how Olga can compute Alice’s secret exponent a.

9.4 Suppose that Alice is using the Okamoto Scheme with q = 1201, p = 122503, t = 10, ?1 = 60497 and ?2 = 17163.

(a) Suppose that Alice’s secret exponents are a1 = 432 and a2 = 423. Compute v.
(b) Suppose that k1 = 389 and k2 = 191. Compute ?.
(c) Suppose that Bob issues the challenge r = 21. Compute Alice’s response, y1 and y2.
(d) Perform Bob’s calculations to verify y1 and y2.

9.5 Suppose that Alice uses the Okamoto Scheme with p, q, t, ?1, and ?2 as in Exercise 9.4. Suppose also that v = 119504.

(a) Verify that

(b) Use this information to compute b1 and b2 such that

(c) Now suppose that Alice reveals that a1 = 484 and a2 = 935. Show how Alice and Olga together will compute [image].

9.6 Suppose that Alice is using the Guillou-Quisquater Scheme with p = 503, q = 379, and b = 509.

(a) Suppose that Alice’s secret u = 155863. Compute v.
(b) Suppose that k = 123845. Compute ?.
(c) Suppose that Bob issues the challenge r = 487. Compute Alice’s response, y.
(d) Perform Bob’s calculations to verify y.

9.7 Suppose that Alice is using the Guillou-Quisquater Scheme with n = 199543, b = 523 and v = 146152. Suppose that Olga has discovered that

Show how Olga can compute u.


Chapter 10 Authentication Codes

Chapter 10
Authentication Codes

10.1 Introduction

We have spent a considerable amount of time studying cryptosystems, which are used to obtain secrecy. An authentication code provides a method of ensuring the integrity of a message, i.e., that the message has not been tampered with and that it originated with the presumed transmitter. Our goal is to achieve this authentication capability even in the presence of an active opponent, Oscar, who can observe messages in the channel and introduce messages of his own choosing into the channel. This goal is accomplished in the “private-key” setting whereby Alice and Bob share a secret key, K, before any message is transmitted.

In this chapter, we study codes that provide authentication but no secrecy. In such a code, a key is used to compute an authentication tag which will enable Bob to check the authenticity of the message he receives. Another application of an authentication code is verify that data in a large file has not been tampered with. An authentication tag would be stored with the data; the key used to generate and verify the authenticator would be stored separately, in a “secure” area.

We should also point out that, in many respects, an authentication code is similar to a signature scheme or to a message authentication code (MAC). The main differences are as follows: The security of an authentication code is unconditional, whereas signature schemes and MACs are studied from the point of view of computational security. Also, when an authentication code (or a MAC) is used, a message can be verified only by the intended receiver. In comparison, anyone can verify a signature using a public verification algorithm.

We now give a formal definition of the terminology we use in the study of authentication codes.

DEFINITION 10.1 An authentication code is a four-tuple [image], where the following conditions are satisfied:

1. is a finite set of possible source states

Figure 10.1 Impersonation by Oscar

2. is a finite set of possible authentication tags
3. , the keyspace, is a finite set of possible keys.
4. For each [image], there is an authentication rule [image].

The message set is defined to be [image].

REMARK Note that a source state is analogous to a plaintext. A message consists of a plaintext with an appended authentication tag; it could be more precisely referred to as a signed message. Also, an authentication rule need not be an injective function.

In order to transmit a (signed) message, Alice and Bob follow the following protocol. First, they jointly choose a random key [image]. This is done in secret, as in a private-key cryptosystem. At a later time, suppose that Alice wants to communicate a source state [image] to Bob over an insecure channel. Alice computes a = eK(s) and sends the message (s, a) to Bob. When Bob receives (s, a), he computes a? = eK(s). If a? = a, then he accepts the message as authentic; otherwise, he rejects it.

We will study two different types of attacks that Oscar might carry out. In both of these attacks, Oscar is an “intruder-in-the-middle.” These attacks described are as follows:

Impersonation
Oscar introduces a message (s, a) into the channel, hoping to have it accepted as authentic by Bob. This is depicted in Figure 10.1.
Substitution
Oscar observes a message (s, a) in the channel, and then changes it to (s?, a?), where s? ? s, again hoping to have it accepted as authentic by Bob. Hence, he is hoping to mislead Bob as to the source state. This is depicted in Figure 10.2.

Associated with each of these attacks is a deception probability, which represents the probability that Oscar will successfully deceive Bob, if he (Oscar) follows an optimal strategy. These probabilities are denoted by Pd0 (impersonation) and Pd1 (substitution). In order to compute Pd0 and Pd1, we need to specify probability distributions on [image] and [image]. These will be denoted by [image] and [image], respectively. We assume that the authentication code and these two probability distributions are known to Oscar. The only information that Alice and Bob possess that is not known to Oscar is the value of the key, K. This is analogous to the way that we studied the unconditional security of private-key cryptosystems.

Figure 10.2 Substitution by Oscar


10.2 Computing Deception Probabilities

In this section, we look at the computation of deception probabilities. We begin with a small example of an authentication code.

Example 10.1

Suppose

and

For each [image] and each [image], define

It will be useful to study the authentication matrix, which tabulates all the values eij(s). For each key [image] and for each [image], place the authentication tag eK(s) in row K and column s of a [image] matrix M. The array M is presented in Figure 10.3.

Suppose that the key is chosen at random, i.e., [image] for each [image]. We do not specify the probability distribution [image] since it turns out to be immaterial in this example.

Let’s first consider an impersonation attack. Oscar will pick a source state s, and attempt to guess the “correct” authentication tag. Denote by K0 the actual key being used (which is unknown to Oscar). Oscar will succeed in deceiving Bob if he guesses the tag [image]. However, for any [image] and [image], it is easy to verify that there are exactly three (out of nine) authentication rules [image] such that eK(s) = a. (In other words, each symbol occurs three times in each column of the authentication matrix.) Hence, it follows that Pd0 = 1/3.

Figure 10.3 An authentication matrix

Substitution is a bit more complicated to analyze. As a specific case, suppose Oscar observes the message (0, 0) in the channel. This does give Oscar some information about the key: he now knows that

Now suppose Oscar replaces the message (0, 0) with the message (1, 1). Then, he will succeed in his deception if and only if K0 = (1, 0). The probability that K0 is the key is 1/3, since the key is known to be in the set {(0, 0), (1, 0), (2, 0)}.

A similar analysis can be done for any substitution that Oscar might make. In general, if Oscar observes the message (s, a), and replaces it with any message (s?, a?) where s? ? s, then he deceives Bob with probability 1/3. We can see this as follows. Observation of (s, a) restricts the key to one of three possibilities. Then, for each choice of (s?, a?), there is one key (out of the three possible keys) under which a? is the authentication tag for s?.

Let’s now discuss how to compute the deception probabilities in general. First, we consider Pd0. As above, let K0 denote the key chosen by Alice and Bob. For [image] and [image], define payoff (s, a) to be the probability that Bob will accept the message (s, a) as being authentic. It is not difficult to see that

That is, payoff (s, a) is computing by selecting the rows of the authentication matrix that have entry a in column s, and summing the probabilities of the corresponding keys.

In order to maximize his chance of success, Oscar will choose (s, a) such that payoff (s, a) is a maximum. Hence,

Note that Pd0 does not depend on the probability distribution [image].

Pd1 is more difficult to compute, and it may depend on the probability distribution [image]. Let’s first consider the following problem: Suppose Oscar observes the message (s, a) in the channel. Oscar will substitute some (s?, a?) for (s, a), where s? ? s. Hence, for [image], and [image], we define payoff (s?, a?; s, a) to be the probability that a substitution of (s, a) with (s?, a?) will succeed in deceiving Bob. Then we can compute the following:

The numerator of this fraction is found by selecting the rows of the authentication matrix that have the value a in column s and the value a? in column s?, and summing the probabilities of the corresponding keys.

Since Oscar wants to maximize his chance of deceiving Bob, he will compute

The quantity ps,a denotes the probability that Oscar can deceive Bob with a substitution, given that (s, a) is the message observed in the channel.

Now, how do we compute the deception probability Pd1? Evidently, we have to compute a weighted average of the quantities Ps,a with respect to the probabilities [image] of observing messages (s, a) in the channel. That is, we calculate Pd1 to be

Figure 10.4 An authentication matrix

The probability distribution [image] is as follows:

In Example 10.1,

for all s, a, so Pd0 = 1/3. Also, it can be checked that

for all s, s?, a, a?, s ? s?. Hence, Pd1 = 1/3 for any probability distribution [image]. (In general, though, Pd1 will depend on [image].)

Let’s look at the computation of Pd0 and Pd1 for a less “regular” example.

Example 10.2

Consider the authentication matrix of Figure 10.4. Suppose the probability distributions on [image] and [image] are

1 ? i ? 4; and

The values payoff (s, a) are as follows:

Hence, Pd0 = 3/4. Oscar’s optimal impersonation strategy is to place any of the messages (1, 1), (3, 1) or (4, 2) into the channel.

Now we turn to the computation of Pd1. First, we present the various values payoff (s?, a?; s, a) in the form of a matrix. The entry in row (s, a) and column (s?, a?) is the value payoff (s?, a?; s, a).

Thus we have p1,1 = 2/3, p2,2 = 1/2, and ps,a = 1 for all other s, a. It is then a simple matter to evaluate Pd1 = 7/8. An optimal substitution strategy for Oscar is as follows:

This strategy indeed yields Pd1 = 7/8.

The computation of Pd1 in Example 10.2 is straightforward but lengthy. We can in fact simplify the computation of Pd1 by observing that we divide by the quantity payoff (s, a) in the computation of ps,a, and then later multiply by payoff (s, a) in the computation of Pd1. Of course, these two operations cancel each other out. Suppose we define

for all s, a. Then we have the following more concise formula for Pd1:


10.3 Combinatorial Bounds

We have seen that the security of an authentication code is measured by the deception probabilities. Hence, we want to construct codes so that these probabilities are as small as possible. But other considerations are also important. Let’s consider the various objectives that we might strive for in an authentication code:

1. The deception probabilities Pd0 and Pd1 must be small enough to obtain the desired level of security.
2. The number of source states must be large enough so that we can communicate the desired information by appending an authentication tag to one source state.
3. The size of the key space should be minimized, since the value of the key must be communicated over a secure channel. (Note that the key must be changed every time a message is communicated, as is done with the One-time Pad.)

In this section, we determine lower bounds on the deception probabilities, which will be computed in terms of other parameters of the code. Recall that we have defined an authentication code to consist of a four-tuple [image]. Throughout this section, we will denote [image].

Suppose we fix a source state [image]. Then we can compute:

Hence, for every [image], there exists an authentication tag a(s) such that

The following theorem follows easily.

THEOREM 10.1

Suppose [image] is an authentication code. Then [image], where [image]. Further, [image] if and only if

for every [image].

Now, we turn our attention to substitution. Suppose we fix s, a and s?, where s? ? s. Then we have the following:

So, there exists an authentication tag a?(s?, s, a) such that

The next theorem follows as a consequence.

THEOREM 10.2

Suppose [image] is an authentication code. Then [image], where [image]. Further, [image] if and only if

for every [image].

PROOF We have

Further, equality occurs if and only if [image] for ever (s, a). But this is in turn equivalent to the condition that [image] for every (s, a).

Combining Theorems 10.1 and 10.2, we get the following:

THEOREM 10.3

Suppose [image] is an authentication code, where [image]. Then [image] if and only if

for every [image].

PROOF Equations (10.4) and (10.5) imply Equation (10.6). Conversely, Equation (10.6) implies Equations (10.4) and (10.5).

If the keys are equiprobable, then we obtain the following corollary:

COROLLARY 10.4

Suppose [image] is an authentication code where [image], and keys are chosen equiprobably. Then [image] if and only if

for every [image].


10.3.1 Orthogonal Arrays

In this section, we look at the connections between authentication codes and certain combinatorial structures called orthogonal arrays. First, we give a definition.

Figure 10.5 An OA(3, 3, 1)

DEFINITION 10.2 An orthogonal array OA(n, k, ?) is a ?n2 ? k array of n symbols, such that in any two columns of the array every one of the possible n2 pairs of symbols occurs in exactly ? rows.

Orthogonal arrays are well-studied structures in combinatorial design theory, and are equivalent to other structures such as transversal designs, mutually orthogonal Latin squares and nets.

In Figure 10.5, we present an orthogonal array OA(3, 3, 1) which is obtained from the authentication matrix of Figure 10.3. Any orthogonal array OA(n, k, ?) can be used to construct an authentication code with Pd0 = Pd1 = 1/n, as stated in the following theorem.

THEOREM 10.5

Suppose there is an orthogonal array OA(n, k, ?). Then there is an authentication code [image], where [image] and Pd0 = Pd1 = 1/n.

PROOF Use each row of the orthogonal array as an authentication rule with equal probability 1/(?n2). The correspondences are as follows:

Since Equation (10.7) is satisfied, we can apply Corollary 10.4, obtaining a code with the stated properties.


10.3.2 Constructions and Bounds for OAs

Suppose that we construct an authentication code from an OA(n, k, ?). The parameter n determines the number of authenticators (i.e., the security of the code), while the parameter k determines the number of source states the code can accommodate. The parameter ? relates only to the number of keys, which is ?n2. Of course, the case ? = 1 is most desirable, but we will see that it is sometimes necessary to use orthogonal arrays with higher values of ?.

Suppose we want to construct an authentication code with a specified source set [image], and a specified security level ? (i.e., so that Pd0 ? ? and Pd1 ? ?). An appropriate orthogonal array will satisfy the following conditions:

1. n ? 1/?
2. (observe that we can always delete one or more columns from an orthogonal array and the resulting array is still an orthogonal array, so we do not require [image])
3. ? is minimized, subject to the two previous conditions being satisfied.

Let’s first consider orthogonal arrays with ? = 1. For a given value of n, we are interested in maximizing the number of columns. Here is a necessary condition for existence:

THEOREM 10.6

Suppose there exists an OA(n, k, 1). Then k ? n + 1.

PROOF Let A be an OA(n, k, 1) on symbol set X = {0, 1, …, n - 1}. Suppose ? is a permutation of X, and we permute the symbols in any column of A according to the permutation ?. The result is again an OA(n, k, 1). Hence, by applying a succession of permutations of this type, we can assume without loss of generality that the first row of A is (00 … 0).

We next show that each symbol must occur exactly n times in each column of A. Choose two columns, say c and c?, and let x be any symbol. Then for each symbol x?, there is a unique row of A in which x occurs in column c and x? occurs in column c?. Letting x? vary over X, we see that x occurs exactly n times in column c.

Now, since the first row is (00 … 0), we have exhausted all occurrences of ordered pairs (0, 0). Hence, no other row contains more than one occurrence of 0. Now, let us count the number of rows containing at least one 0: the total is 1 + k(n - 1). But this total cannot exceed the total number of rows in A, which is n2. Hence, 1 + k(n - 1) ? n2, so k ? n + 1, as desired.

We now present a construction for orthogonal arrays with ? = 1 in which k = n. This is, in fact, the construction that was used to obtain the orthogonal array presented in Figure 10.5.

THEOREM 10.7

Suppose p is prime. Then there exists an orthogonal array OA(p, p, 1).

PROOF The array will be a p2 ? p array, where the rows are indexed by [image] and the columns are indexed by [image]. The entry in row (i, j) and column x is defined to be ix + j mod p.

Suppose we choose two columns, x, y, x ? y, and two symbols a, b. We want to find a (unique) row (i, j) such that a occurs in column x and b occurs in column y of row (i, j). Hence, we want to solve the two equations

for the unknowns i and j (where all arithmetic is done in the field [image]). But this system has the unique solution

Hence, we have an orthogonal array.

We remark that any OA(n, n, 1) can be extended by one column to form an OA(n, n + 1, 1) (see the Exercises). Hence, using Theorem 10.7, we can obtain an infinite class of OA’s that meet the bound of Theorem 10.6 with equality.

Theorem 10.6 tells us that ? > 1 if k > n + 1. We will prove a more general result that places a lower bound on ? as a function of n and k. First, however, we derive an important inequality that we will use in the proof.

LEMMA 10.8

Suppose b1, …, bm are real numbers. Then

PROOF Apply Jensen’s Inequality (Theorem 2.5) with f(x) = -x2 and ai = 1/m, 1 ? i ? m. The function f is continuous and concave, so we obtain

which simplifies to give the desired result.

THEOREM 10.9

Suppose there exists an OA(n, k, ?). Then

PROOF Let A be an OA(n, k, ?) on symbol set X = {0, 1,…, n - 1}, where, without loss of generality, the first row of A (00 … 0) (as in Theorem 10.6).

Let us denote the set of rows of A by [image] let r1 denote the first row, and let [image]. For any row r of A, denote by xr the number of occurrences of 0 in row r. It is easy to count the total number of occurrences of 0 in [image]. Since each symbol must occur exactly ?n times in each column of A, we have that

Now, the number of times the ordered pair (0, 0) occurs in rows in [image] is

Applying Lemma 10.8, we obtain

and hence

On the other hand, in any given pair of columns, the ordered pair (0, 0) occurs in exactly ? rows. Since there are k(k - 1) ordered pairs of columns, it follows that the exact number of occurrences of the ordered pair (0, 0) in rows in [image] is (? - 1)k(k - 1). We therefore have

and hence

If we divide out a factor of k, we get

Expanding, we have

This simplifies to give

or

Finally, taking out a factor of ?(n - 1), we obtain

which is the desired bound.

Our next result establishes the existence of an infinite class of orthogonal arrays that meet the above bound with equality.

THEOREM 10.10

Suppose p is prime and d ? 2 is an integer. Then there is an orthogonal array OA(p, (pd - 1)/(p - 1), pd-2).

PROOF Denote by [image] the vector space of all d-tuples over [image]. We will construct A, an OA(p,(pd - 1)/(p - 1), pd-2) in which the rows and columns are indexed by certain vectors in [image]. The entries of A will be elements of [image]. The set of rows is defined to be [image]; the set of columns is

consists of all vectors in [image], so [image]. consists of all non-zero vectors that have the first non-zero coordinate equal to 1. Observe that

and that no two vectors in [image] are scalar multiples of each other.

Now, for each [image] and each [image], define

where · denotes the inner product of two vectors (reduced modulo p).

We prove that A is the desired orthogonal array. Let [image] be two distinct columns, and let [image]. We will count the number of row [image] such that [image] and [image]. Denote [image] and [image]. The two equations [image] can be written as two linear equations in [image]:

Figure 10.6 An OA(2, 7, 2)

This is a system of two linear equations in the d unknowns r1, … rd. Since [image] and [image] are not scalar multiples, the two equations are linearly independent. Hence, this system has a solution space of dimension d - 2. That is, the number of solutions (i.e., the number of rows in which x occurs in column [image] and y occurs in column [image]) is pd-2, as desired.

Let’s carry out a small example of this construction.

Example 10.3

Suppose we take p = 2, d = 3. Then we will construct an OA(2, 7, 2). We have

and

The orthogonal array in Figure 10.6 results.


10.3.3 Characterizations of Authentication Codes

To this point, we have studied authentication codes obtained from orthogonal arrays. Then we looked at necessary existence conditions and constructions for orthogonal arrays. One might wonder whether there are better alternatives to the orthogonal array approach. However, two characterization theorems tell us that this is not the case if we restrict our attention to authentication codes in which the deception probabilities are as small as possible.

We first prove the following partial converse to Theorem 10.5:

THEOREM 10.11

Suppose [image] is an authentication code where [image] and Pd0 = Pd1 = 1/n. Then [image]. Further, [image] if and only if there is an orthogonal array OA (n, k, 1) where [image], and [image] for every key [image].

PROOF Fix two (arbitrary) source states s and s?, s ? s?, and consider Equation (10.6). For each ordered pair (a, a?) of authentication tags, define

Then [image] for every pair (a, a?). Also, the n2, sets [image] are disjoint. Hence, [image].

Now, suppose that [image]. Then [image] for every pair (a, a?), and Equation (10.6) tells us that [image] for every key [image].

It remains to show that the authentication matrix forms an orthogonal array OA(n, k, 1). Consider the columns indexed by the source states s and s?. Since [image] for every (a, a?), we have every ordered pair occurring exactly once in these two columns. Since, s and s? are arbitrary, we see that every ordered pair occurs exactly once in any two columns.

The following characterization is more difficult; we state it without proof.

THEOREM 10.12

Suppose [image] is an authentication code where [image] and Pd0 = Pd1 = 1/n. Then [image]. Further, [image] if and only if there is an orthogonal array OA(n, k, ?), where ? = (k(n - 1) + 1)/n2, and [image] for every key [image].

REMARK Notice that Theorem 10.10 provides an infinite class of orthogonal arrays that meet the bound of Theorem 10.12 with equality.


10.4 Entropy Bound

In this section, we use entropy techniques to obtain bounds on the deception probabilities. The first of these is a bound on Pd0.

THEOREM 10.13

Suppose that [image] is an authentication code. Then

PROOF From Equation (10.1), we have

Since the maximum of the values payoff (s, a) is greater than their weighted average, we obtain

Hence, by Jensen’s inequality (Theorem 2.5), we have

Recalling from Section 10.2 that

we see that

Now, we observe that [image] (i.e., the probability that a is the authenticator, given that s is the source state). Hence,

by the definition of conditional entropy. We complete the proof by showing that - H(A|S) = H(K|M) - H(K). This follows from basic entropy identities. On one hand, we have

On the other hand, we compute

where we use the facts that H(A|K, S) = 0 since the key and source state uniquely determine the authenticator, and H(K, S) = H(K) + H(S) since the source and key are independent events.

Equating the two expressions for H(K, A, S), we obtain

But a message m = (s, a) is defined to consist of a source state and an authenticator (i.e., [image]). Hence, H(K|A, S) = H(K|M) and the proof is complete.

There is a similar bound for Pd1 which we will not prove here. It is as follows:

THEOREM 10.14

Suppose that [image] is an authentication code. Then

We need to define what we mean by the random variable M2. Suppose we authenticate two distinct source states using the same key K. In this way, we obtain an ordered pair of message [image]. In order to define a probability distribution on [image], it is necessary to define a probability distribution on [image], with the stipulation that [image] for every [image] (that is, we do not allow source states to be repeated). The probability distribution on [image] and [image] will induce a probability distribution on [image], in the same way that the probability distributions on [image] and [image] induce a probability on [image].

As an illustration of the two bounds, we consider our basic orthogonal array construction and show that the bounds of Theorems 10.13 and 10.14 are both met with equality. First, it is clear that

since each of the ?n2 authentication rules are chosen with equal probability. Let’s next turn to the computation of H(K|M). If any message m = (s, a) is observed, this restricts the possible keys to a subset of size ?n. Each of these ?n keys is equally likely. Hence, H(K|m) = log ?n, for any message m. Then, we get the following:

Thus we have

so the bound is met with equality.

If we observe two messages which have been produced using the same key (and different source states), then the number of possible keys is reduced to ?. Using similar reasoning as above, we have that H(K|M2) = log ?. Then

so this bound is also met with equality.


10.5 Notes and References

Authentication codes were invented in 1974 by Gilbert, MacWilliams, and Sloane [GMS74]. Much of the theory of authentication codes was developed by Simmons, who proved many fundamental results in the area. Two useful survey articles by Simmons are [SI92] and [SI88]. Another good survey is Massey [MA86].

The connections between orthogonal arrays and authentication codes has been addressed by several researchers. The treatment here is based on three papers by Stinson [ST88], [ST90] and [ST92]. Orthogonal arrays have been studied for over 45 years by researchers in statistics and in combinatorial design theory. For example, the bound in Theorem 10.9 was first proved by Plackett and Berman in 1945 in [PB45]. Many interesting results on orthogonal arrays can be found in various textbooks on combinatorial design theory such as Beth, Jungnickel, and Lenz [BJL85].

Finally, the use of entropy techniques in the study of authentication codes was introduced by Simmons. The bound of Theorem 10.13 was first proved in Simmons [SI85]; a proof of Theorem 10.14 can be found in Walker [WA90].


Chapter 10 Exercises

Exercises

10.1 Compute Pd0 and Pd1 for the following authentication code, represented in matrix form:

The probability distributions on [image] and [image] are as follows:

What are the optimal impersonation and substitution strategies?

10.2 We have seen a construction for an orthogonal array OA(p, p, 1) when p is prime. Prove that this OA(p, p, 1) can always be extended by one extra column to form an OA(p, p + 1, 1). Illustrate your construction in the case p = 5.
10.3 Suppose A is an OA(n1, k, ?1) on symbol set {1, …, n1} and suppose B is an OA(n2, k, ?2) on symbol set {1, …, n2}. We construct C, an OA(n1n2, k, ?1 ?2) on symbol set {1, …, n1} ? {1, …, n2}, as follows: for each row r1 = (x1, …, xk) of A and for each row s1 = (y1, …, yk) of B, define a row

of C. Prove that C is indeed an OA(n1 n2, k, ?1 ?2).

10.4 Construct an orthogonal array OA(3, 13, 3).
10.5 Write a computer program to compute H(K), H(K|M) and H(K|M2) for the authentication code from Exercise 10.1. The probability distribution on sequences of two sources is as follows:

Compare the entropy bounds for Pd0 and Pd1 with the actual values you computed in Exercise 10.1.

HINT To compute [image], use Bayes’ formula

We already know how to calculate [image]. To compute [image], write m = (s, a) and then observe that [image] if ek(s) = a, and [image] otherwise.

To compute [image], use Bayes’ formula

can be calculated as follows: write m1 = (s1, a1) and m2 = (s2, a2). Then

(Note the similarity with the computation of p(m).) To compute [image], observe that [image] and ek(s2) = a2, and [image], otherwise.


Chapter 11 Secret Sharing Schemes

Chapter 11
Secret Sharing Schemes

11.1 Introduction: The Shamir Threshold Scheme

In a bank, there is a vault which must be opened every day. The bank employs three senior tellers, but they do not trust the combination to any individual teller. Hence, we would like to design a system whereby any two of the three senior tellers can gain access to the vault, but no individual teller can do so. This problem can be solved by means of a secret sharing scheme, the topic of this chapter.

Here is an interesting “real-world” example of this situation: According to Time-Magazine1, control of nuclear weapons in Russia involves a similar “two-out-of-three” access mechanism. The three parties involved are the President, the Defense Minister and the Defense Ministry.

1 Time Magazine, May 4, 1992, p. 13

We first study a special type of secret sharing scheme called a threshold scheme. Here is an informal definition.

DEFINITION 11.1 Let t, w be positive integers, t ? w. A (t, w) -threshold scheme is a method of sharing a key K among a set of w participants (denoted by [image]), in such a way that any t participants can compute the value of K, but no group of t - 1 participants can do so.

Note that the examples described above are (2, 3)-threshold schemes.

The value of K is chosen by a special participant called the dealer. The dealer is denoted by D and we assume [image]. When D wants to share the key K among the participants in [image], he gives each participant some partial information called a share. The shares should be distributed secretly, so no participant knows the share given to another participant.

At a later time, a subset of participants [image] will pool their shares in an attempt to compute the key K. (Alternatively, they could give their shares to a trusted authority which will perform the computation for them.) If |B| ? t, then they should be able to compute the value of K as a function of the shares they collectively hold; if |B| < t, then they should not be able to compute K.

Figure 11.1 The Shamir (t, w)-threshold scheme in

We will use the following notation. Let

be the set of w participants. is the key set (i.e., the set of all possible keys); and [image] is the share set (i.e., the set of all possible shares).

In this section, we present a method of constructing a (t, w)-threshold scheme, called the Shamir Threshold Scheme, which was invented in 1979. Let [image] where p ? w + 1 is prime. Also, let [image]. Hence, the key will be an element of [image], as will be each share given to a participant. The Shamir threshold scheme is presented in Figure 11.1. In this scheme, the dealer constructs a random polynomial a(x) of degree at most t - 1 in which the constant term is the key, K. Every participant Pi obtains a point (xi, yi) on this polynomial.

Let’s look at how a subset B of t participants can reconstruct the key. This is basically accomplished by means of polynomial interpolation. We will describe a couple of methods of doing this.

Suppose that participants [image] want to determine K. They know that

1 ? j ? t, where [image] is the (secret) polynomial chosen by D. Since a(x) has degree at most t - 1, a(x) can be written as

where the coefficients a0, . . . , at-1 are unknown elements of [image], and a0 = K is the key. Since [image], 1 ? j ? t, B can obtain t linear equations in the t unknowns a0, . . . , at-1, where all arithmetic is done in [image]. If the equations are linearly independent, there will be a unique solution, and a0 will be revealed as the key.

Here is a small example to illustrate.

Example 11.1

Suppose that p = 17, t = 3, and w = 5; and the public x-co-ordinates are xi = i, 1 ? i ? 5. Suppose that B = {P1, P3, P5} pool their shares, which are respectively 8, 10, and 11. Writing the polynomial a(x) as

and computing a(1), a(3) and a(5), the following three linear equations in [image] are obtained:

This system does have a unique solution in [image]. The key is therefore K = a0 = 13.

Clearly, it is important that the system of t linear equations has a unique solution, as in Example 11.1. We show now that this is always the case. In general, we have

1 ? j ? t, where

and

The system of linear equations (in [image]) is the following:

This can be written in matrix form as follows:

Now, the coefficient matrix A is a so-called Vandermonde matrix. There is a well-known formula for the determinant of a Vandermonde matrix, namely

Recall that the xi’s are all distinct, so no term [image] in this product is equal to zero. The product is computed in [image], where p is prime, which is a field. Since the product non-zero terms in a field is always non-zero, we have that det A ? 0. Since the determinant of the coefficient matrix is non-zero, the system has a unique solution over the field [image]. This establishes that any group of t participants will be able to recover the key in this threshold scheme.

What happens if a group of t - 1 participants attempt to compute K? Proceeding as above, they will obtain a system of t - 1 equations in t unknowns. Suppose they hypothesize a value y0 for the key. Since the key is a0 = a(0), this will yield a tth equation, and the coefficient matrix of the resulting system of t equations in t unknowns will again be a Vandermonde matrix. As before, there will be a unique solution. Hence, for every hypothesized value y0 of the key, there is a unique polynomial ay0(x) such that

1 ? j ? t - 1, and such that

Hence, no value of the key can be ruled out, and thus a group of t - 1 participants can obtain no information about the key.

We have analyzed the Shamir scheme from the point of view of solving systems of linear equations over [image]. There is an alternative method, based on the Lagrange interpolation formula for polynomials. The Lagrange interpolation formula is an explicit formula for the (unique) polynomial a(x) of degree at most t that we computed above. The formula is as follows:

It is easy to verify the correctness of this formula by substituting [image]: all terms in the summation vanish except for the jth term, which is [image]. Thus, we have a polynomial of degree at most t - 1 which contains the t ordered pairs [image], 1 ? j ? t. We already proved above that this polynomial is unique, so the interpolation formula does yield the correct polynomial.

A group B of t participants can compute a(x) by using the interpolation formula. But a simplification is possible, since the participants in B do not need to know the whole polynomial a(x). It is sufficient for them to compute the constant term K = a(0). Hence, they can compute the following expression, which is obtained by substituting x = 0 into the Lagrange interpolation formula:

Suppose we define

1 ? j ? t. (Note that these values bj can be precomputed, if desired, and their values are not secret.) Then we have

Hence, the key is a linear combination of the t shares.

To illustrate this approach, let’s recompute the key from Example 11.1.

Example 11.1 (Con’t.)

The participants {P 1, P3, P5} can compute b1, b2, and b3 according to the formula given above. For example, they would obtain

Similarly, b2 = 3 and b3 = 11. Then, given shares 8, 10, and 11 (respectively), they would obtain

as before.

The last topic of this section is a simplified construction for threshold schemes in the special case w = t. This construction will work for any key set [image] with [image]. (For this scheme, it is not required that m be prime, and it is not necessary that m ? w + 1.) If D wants to share the key [image], he carries out the protocol of Figure 11.2.

Figure 11.2 A (t, t)-threshold scheme in

Observe that the t participants can compute K by the formula

Can t - 1 participants compute K? Clearly, the first t - 11 participants cannot do so, since they receive t - 1 independent random numbers as their shares. Consider the t - 1 participants in the set [image], where 1 ? i ? t - 1. These t - 1 participants possess the shares

and

By summing their shares, they can compute K - yi. However, they do not know the random value yi, and hence they have no information as to the value of K. Consequently, we have a (t, t)-threshold scheme.


11.2 Access Structures and General Secret Sharing

In the previous section, we desired that any t of the w participants should be able to determine the key. A more general situation is to specify exactly which subsets of participants should be able to determine the key and which should not. Let ? be a set of subsets of [image]; the subsets in ? are those subsets of participants that should be able to compute the key. ? is called an access structure and the subsets in ? are called authorized subsets.

Let [image] be the key set and let [image] be the share set. As before, when a dealer D wants to share a key [image], he will give each participant a share from [image]. At a later time a subset of participants will attempt to determine K from the shares they collectively hold.

DEFINITION 11.2 A perfect secret sharing scheme realizing the access structure ? is a method of sharing a key K among a set of w participants (denoted by [image]), in such a way that the following two properties are satisfied:

1. If an authorized subset of participants, [image] pool their shares, then they can determine the value of K.
2. If an unauthorized subset of participants [image] pool their shares, then they can determine nothing about the value of K.

Observe that a (t, w)-threshold scheme realizes the access structure

Such an access structure is called a threshold access structure. We showed in the previous section that the Shamir scheme is a perfect scheme realizing the threshold access structure.

We study the unconditional security of secret sharing schemes. That is, we do not place any limit on the amount of computation that can be performed by an unauthorized subset of participants.

Suppose that B ? ? and [image]. Suppose the subset C wants to determine K. Since B is an authorized subset, it can already determine K. Hence, the subset C can determine K by ignoring the shares of the participants in C\B. Stated another way, a superset of an authorized set is again an authorized set. What this says is that the access structure should satisfy the monotone property:

In the remainder of this chapter, we will assume that all access structures are monotone.

If ? is an access structure, then B ? ? is a minimal authorized subset if A ? ? whenever [image]. The set of minimal authorized subsets of ? is denoted ?0 and is called the basis of ?. Since ? consists of all subsets of [image] that are supersets of a subset in the basis ?0, ? is determined uniquely as a function of ?0. Expressed mathematically, we have

We say that ? is the closure of ?0 and write

Example 11.2

Suppose [image] and

Then

Conversely, given this access structure ?, it is easy to see that ?0 consists of the minimal subsets in ?.

In the case of a (t, w)-threshold access structure, the basis consists of all subsets of (exactly) t participants.


11.3 The Monotone Circuit Construction

In this section, we will give a conceptually simple and elegant construction due to Benaloh and Leichter that shows that any (monotone) access structure can be realized by a perfect secret sharing scheme. The idea is to first build a monotone circuit that “recognizes” the access structure, and then to build the secret sharing scheme from the description of the circuit. We call this the monotone circuit construction.

Suppose we have a boolean circuit C, with w boolean inputs, x1, . . . , xw (corresponding to the w participants P1, . . . , Pw), and one boolean output, y. The circuit consists of “or” gates and “and” gates; we do not allow any “not” gates. Such a circuit is called a monotone circuit. The reason for this nomenclature is that changing any input xi from “0” (false) to “1” (true) can never result in the output y changing from “1” to “0.” The circuit is permitted to have arbitrary fan-in, but we require fan-out equal to 1 (that is, a gate can have arbitrarily many input wires, but only one output wire).

If we specify boolean values for the w inputs of such a monotone circuit, we can define

i.e., the subset of [image] corresponding to the true inputs. Suppose C is a monotone circuit, and define

where C (x1, . . . , xw) denotes the output of C, given inputs x1, . . . , xw. Since the circuit C is monotone, it follows that ?(C) is a monotone set of subsets of [image].

It is easy to see that there is a one-to-one correspondence between monotone circuits of this type and boolean formulae which contain the operators [image] (“and”) and [image] (“or”), but do not contain any negations.

If ? is a monotone set of subsets of [image], then it is easy to construct a monotone circuit C such that ?(C) = ?. One way to do this is as follows. Let ?0 be the basis of ?. Then construct the disjunctive normal form boolean formula

In Example 11.2, where

we would obtain the boolean formula

Each clause in the boolean formula corresponds to an “and” gate of the associated monotone circuit; the final disjunction corresponds to an “or” gate. The number of gates in the circuit is |?0| + 1.

Suppose C is any monotone circuit that recognizes ? (note that C need not be the circuit described above.) We describe an algorithm which enables D, the dealer, to construct a perfect secret sharing scheme that realizes ?. This scheme will use as a building block the (t, t)-schemes constructed in Figure 11.2. Hence, we take the key set to be [image] for some integer m.

The algorithm proceeds by assigning a value [image] to every wire W in the circuit C. Initially, the output wire Wout of the circuit is assigned the value K, the key. The algorithm iterates a number of times, until every wire has a value assigned to it. Finally, each participant Pi is given the list of values f(W) such that W is an input wire of the circuit which receives input xi.

A description of the construction is given in Figure 11.3. Note that, whenever a gate G is an “and” gate having (say) t input wires, we share the “key” f(WG) among the input wires using a (t, t)-threshold scheme.

Let’s carry out this procedure for the access structure of Example 11.2, using the circuit corresponding to the boolean formula (11.1).

Example 11.3

We illustrate the construction in Figure 11.4. Suppose K is the key. The value K is given to each of the three input wires of the final “or” gate. Next, we consider the “and” gate corresponding to the clause [image]. The three input wires are assigned values a1, a2, K - a1 - a2, respectively, where all arithmetic is done in [image]. In a similar way, the three input wires corresponding to [image] are assigned values b1, b2, K - b1 - b2. Finally, the two input wires corresponding to [image] are assigned values ci, K - c1. Note that a1, a2, b1, b2 and c1 are all independent random values in [image]. If we look at the shares that the four participants receive, we have the following:

1. P1 receives a 1, b1.
2. P2 receives a2, c1.
3. P3 receives b2, K - c1.
4. P4 receives K - a1 - a2, K - b1 - b2.

Figure 11.3 The monotone circuit construction

Thus, every participant receives two elements of [image] as his or her share.

Let’s prove that the scheme is perfect. First, we verify that each basis subset can compute K. The authorized subset {P1, P2, P4} can compute

The subset {P1, P3, P4} can compute

Finally, the subset {P2, P3} can compute

Figure 11.4 A monotone circuit

Thus any authorized subset can compute K, so we turn our attention to the unauthorized subsets. Note that we do not need to look at all the unauthorized subsets. For, if B1 and B2 are both unauthorized subsets, [image], and B2 cannot compute K, then neither can B1 compute K. Define a subset [image] to be a maximal unauthorized subset if B1 ? ? for all [image]. It follows that it suffices to verify that none of the maximal unauthorized subsets can determine any information about K. Here, the maximal unauthorized subsets are

In each case, it is easy to see that K cannot be computed, either because some necessary piece of “random” information is missing, or because all the shares possessed by the subset are random. For example, the subset {P1, P2} possesses only the random values a1, b1, a2, c1. As another example, the subset {P3, P4} possesses the shares b2, K - c1, K - a1 - a2, K - b1 - b2. Since the values of c1, a1, a2, and b1 are unknown random values, K cannot be computed. In each possible case, an unauthorized subset has no information about the value of K.

We can obtain a different scheme realizing the same access structure by using a different circuit. We illustrate by returning again to the access structure of Example 11.2.

Example 11.4

Suppose we convert the formula (11.1) to the so-called conjunctive normal form:

(The reader can verify that this formula is equivalent to the formula (11.1).) If we implement the scheme using the circuit corresponding to formula (11.2), then we obtain the following:

1. P1 receives a1, a2.
2. P2 receives a1, a3, a4.
3. P3 receives a2, a3, K - a1 - a2 - a3 - a4.
4. P4 receives a4, K - a1 - a2 - a3 - a4.

We leave the details for the reader to check.

We now prove that the monotone circuit construction always produces a perfect secret sharing scheme.

THEOREM 11.1

Let C be any monotone boolean circuit. Then the monotone circuit construction yields a perfect secret sharing scheme realizing the access structure ?(C).

PROOF We proceed by induction on the number of gates in the circuit C. If C contains only one gate, then the result is fairly trivial: If C consists of one “or” gate, then every participant will be given the key. This scheme realizes the access structure consisting of all non-empty subsets of participants. If C consists of a single “and” gate with t inputs, then the scheme is the (t, t)-threshold scheme presented in Figure 11.2.

Now, as an induction assumption, suppose that there is an integer j > 1 such that, for all circuits C with fewer than j gates, the construction produces a scheme that realizes ?(C). Let C be a circuit on j gates. Consider the “last” gate, G, in the circuit; again, G could be either an “or” gate or an “and” gate. Let’s first consider the case where G is an “or” gate. Denote the input wires to G by Wi, 1 ? i ? t. These t input wires are the outputs of t sub-circuits of C, which we denote Ci, 1 ? i ? t. Corresponding to each Ci, we have a (sub-)scheme that realizes the access structure ?Ci, by induction. Now, it is easy to see that

Since every Wi is assigned the key K, it follows that the scheme realizes ?(C), as desired.

The analysis is similar if G is an “and” gate. In this situation, we have

Since the key K is shared among the t wires Wi using a (t, t)-threshold scheme, it follows again that the scheme realizes ?(C). This completes the proof.

Of course, when an authorized subset, B, wants to compute the key, the participants in B need to know the circuit used by D to distribute shares, and which shares correspond to which wires of the circuit. All this information will be public knowledge. Only the actual values of the shares are secret. The algorithm for reconstructing the key involves combining shares according to the circuit, with the stipulation that an “and” gate corresponds to summing the values on the input wires modulo m (provided these values are all known), and an “or” gate involves choosing the value on any input wire (with the understanding that all these values will be identical).


11.4 Formal Definitions

In this section, we will give formal mathematical definitions of a (perfect) secret sharing scheme. We represent a secret sharing scheme by a set of distribution rules. A distribution rule is a function

A distribution rule represents a possible distribution of shares to the participants, where f(Pi) is the share given to Pi, 1 ? i ? w.

Now, for each [image], let [image] be a set of distribution rules. will be distribution rules corresponding to the key having the value K. The sets of distribution rule [image] are public knowledge.

Next, define

is the complete set of distribution rules of the scheme. If [image] is the value of the key that D wishes to share, then D will choose a distribution rule [image], and use it to distribute shares.

This is a completely general model in which we can study secret sharing schemes. Any of our existing schemes can be described in this setting by determining the possible distribution rules which the scheme will use. The fact that this model is mathematically precise makes it easier to give definitions and to present proofs.

It is useful to develop conditions which ensure that a set of distribution rules for a scheme realizes a specified access structure. This will involve looking at certain probability distributions, as we did previously when studying the concept of perfect secrecy. To begin with, we suppose that there is a probability distribution [image] on [image]. Further, for every [image], D will choose a distribution rule in [image] according to a probability distribution [image].

Given these probability distributions, it is straightforward to compute the probability distribution on the list of shares given to any subset of participants, B (authorized or unauthorized). This is done as follows. Suppose [image]. Define

where the function f|B denotes the restriction of the distribution rule f to B. That is, [image] is defined by

for all Pi ? B. Thus, [image] is the set of possible distributions of shares to the participants in B.

The probability distribution on [image], denoted [image], is computed as follows: Let [image]. Then

Also

for all [image] and [image].

Here now is a formal definition of a perfect secret sharing scheme.

DEFINITION 11.3 Suppose ? is an access structure and [image] is a set of distribution rules. The [image] is a perfect secret sharing scheme realizing the access structure ? provided that the following two properties are satisfied:

1. For any authorized subset of participants [image], there do not exist two distribution rules [image] and [image] with K ? K’, such that f|B = f’|B. (That is, any distribution of shares to the participants in an authorized subset B determines the value of the key.)
2. For any unauthorized subset of participants [image] and for any distribution of shares [image] for every [image]. (That is, the conditional probability distribution on [image], given a distribution of shares fB to an unauthorized subset B, is the same as the a priori probability distribution on [image]. In other words, the distribution of shares to B provides no information as to the value of the key.)

Figure 11.5 Distribution rules for a secret sharing scheme

Observe that the second property in Definition 11.3 is very similar to the concept of perfect secrecy; this similarity is why the resulting secret sharing scheme is termed “perfect.”

Note that the probability [image] can be computed from probability distributions exhibited above using Bayes’ theorem:

Let us now illustrate these definitions by looking at a small example.

Example 11.5

We will present the distribution rules for the scheme constructed in Example 11.4 when it is implemented in [image]. Each of [image] and [image] contains 16 equiprobable distribution rules. For conciseness, we replace a binary k-tuple by an integer between 0 and 2k - 1. If this is done, then [image] and [image] are as depicted in Figure 11.5, where each row represents a distribution rule.

This yields a perfect scheme for any probability distribution [image] on the keys. We will not perform all the verifications here, but we will look at a couple of typcial cases to illustrate the use of the two properties in Definition 11.3.

The subset {P2, P3} is an authorized subset. Thus the shares that P2 and P3 receive should (together) determine a unique key. It can easily be checked that any distribution of shares to these two participants occurs in a distribution rule in at most one of the sets [image] and [image]. For example, if P2 has the share 3 and P3 has the share 6, then the distribution rule must be the eighth rule in [image] and thus the key is 0.

On the other hand, B = {P1, P2} is an unauthorized subset. It is not too hard to see that any distribution of shares to these two participants occurs in exactly one distribution rule in [image] and in exactly one distribution rule in [image]. That is,

for any [image] and for K = 0, 1. Next, we compute

Now, we use Bayes’ theorem to compute [image]:

so the second property is satisfied for this subset B.

Similar computations can be performed for other authorized and unauthorized sets, and in each case the appropriate property is satisfied. Hence we have a perfect secret sharing scheme.


11.5 Information Rate

The results of Section 11.3 prove that any monotone access structure can be realized by a perfect secret sharing scheme. We now want to consider the efficiency of the resulting schemes. In the case of a (t, w)-threshold scheme, we can construct a circuit corresponding to the disjunctive normal form boolean formula which will have [image] gates. Each participant will receive [image] elements of [image] as his or her share. This seems very inefficient, since a Shamir (t, w)-threshold scheme enables a key to be shared by giving each participant only one “piece” of information.

In general, we measure the efficiency of a secret sharing scheme by the information rate, which we define now.

DEFINITION 11.4 Suppose we have a perfect secret sharing scheme realizing an access structure ?. The information rate for Pi is the ratio

(Note that [image] denotes the set of possible shares that Pi might receive; of course [image] The information rate of the scheme is denoted by ? and is defined as

The motivation for this definition is as follows. Since the key K comes from a finite set [image], we can think of K as being represented by a bit-string of length [image], by using a binary encoding, for example. In a similar way, a share given to Pi can be represented by a bit-string of length [image]. Intuitively, Pi receives [image] bits of information (in his or her share), but the information content of the key is [image] bits. Thus ?i is the ratio of the number of bits in a share to the number of bits in the key.

Example 11.6

Let’s look at the two schemes from Section 11.2. The scheme produced in Example 11.3 has

However, in Example 11.4, we get a scheme with

Hence, the first implementation is preferable.

In general, if we construct a scheme from a circuit C using the monotone circuit construction, then the information rate can be computed as indicated in the following theorem.

THEOREM 11.2

Let C be any monotone boolean circuit. Then there is a perfect secret sharing scheme realizing the access structure ?(C) having information rate

where ri denotes the number of input wires to C carrying the input xi.

With respect to threshold access structures, we observe that the Shamir scheme will have information rate 1, which we show below is the optimal value. In contrast, an implementation of a (t, w)-threshold scheme using a disjunctive normal form boolean circuit will have information rate [image], which is much lower (and therefore inferior) if 1 < t < w.

Obviously, a high information rate is desirable. The first general result we prove is that ? ? 1 in any scheme.

THEOREM 11.3

In any perfect secret sharing scheme realizing an access structure ?, ? ? 1.

PROOF Suppose we have a a perfect secret sharing scheme that realizes the access structure ?. Let B ? ?0 and choose any participant Pj ? B. Define B? = B\{Pj}. Let [image]. Now, B? ? ?, so the distribution of shares g|B? provides no information about the key. Hence, for each [image], there is a distribution rule [image] such that gK|B? = g|B?. Since B ? ?, it must be the case that gK (Pj) ? gK? (Pj) if K ? K?. Hence, [image] and thus ? ? 1.

Since ? = 1 is the optimal situation, we refer to such a scheme an ideal scheme. The Shamir schemes are ideal schemes. In the next section, we present a construction for ideal schemes that generalizes the Shamir schemes.


11.6 The Brickell Vector Space Construction

In this section, we present a construction for certain ideal schemes known as the Brickell vector space construction.

Suppose ? is an access structure, and let [image] denote the vector space of all d-tuples over [image], where p is prime and d ? 2. Suppose there exists a function

which satisfies the property

Figure 11.6 The Brickell scheme

In other words, the vector (1, 0, . . . , 0) can be expressed as a linear combination of the vectors in the set {?(Pi) : Pi ? B} if and only if B is an authorized subset.

Now, suppose there is a function ? that satisfies Property (11.3). (In general, finding such a function is often a matter of trial and error, though we will see some explicit constructions of suitable functions ? for certain access structures a bit later.) We are going to construct an ideal secret sharing scheme with [image]. The distribution rules of the scheme are as follows: for every vector [image], define a distribution rule [image], where

for every [image], and the operation “·” is the inner product modulo p.

Note that each [image] contains pd-1 distribution rules. We will suppose that each probability distribution [image] is equiprobable: for every [image]. The Brickell scheme is presented in Figure 11.6

We have the following result.

THEOREM 11.4

Suppose ? satisfies Property (11.3). Then the sets of distribution rules [image], comprise an ideal scheme that realizes ?.

PROOF First, we will show that if B is an authorized subset, then the participants in B can compute K. Since

we can write

where each [image]. Denote by si the share given to Pi. Then

where [image] is an unknown vector chosen by D and

By the linearity of the inner product operation,

Thus, it is a simple matter for the participants in B to compute

What happens if B is not an authorized subset? Denote by e the dimension of the subspace ??(Pi) : Pi ? B? (note that e ? |B|). Choose any [image], and consider the system of equations:

This is a system of linear equations in the d unknowns a1, . . . , ad. The coefficient matrix has rank e + 1, since

Provided the system of equations is consistent, the solution space has dimension d - e - 1 (independent of the value of K). It will then follow that there are precisely pd-e-1 distribution rules in each [image] that are consistent with any possible distribution of shares to B. By a similar computation as was performed in Example 11.5, we see that [image] for every [image], where fB(Pi) = si for all Pi ? B.

Why is the system consistent? The first |B| equations are consistent, since the vector [image] chosen by D is a solution. Since

(as mentioned above) the last equation is consistent with the first |B| equations. This completes the proof.

It is interesting to observe that the Shamir (t, w)-threshold scheme is a special case of the vector space construction. To see this, define d = t and let

for 1 ? i ? w, where xi is the x-coordinate given to Pi. The resulting scheme is equivalent to the Shamir scheme; we leave the details to the reader to check.

Here is another general result that is easy to prove. It concerns access structures that have as a basis a collection of pairs of participants that forms a complete multipartite graph. A graph G = (V, E) with vertex set V and edge set E is defined to be a complete multipartite graph if the vertex set V can be partitioned into subsets [image] such that {x, y} ? E if and only if x ? Vi, y ? Vj, where i ? j. The sets Vi are called parts. The complete multipartite graph is denoted by [image] if [image]. A complete multipartite graph K1, . . . , 1 (with [image] parts) is in fact a complete graph and is denoted [image].

THEOREM 11.5

Suppose G = (V, E) is a complete multipartite graph. Then there is an ideal scheme realizing the access structure cl (E) on participant set V.

PROOF Let [image] be the parts of G. Let [image] be distinct elements of [image], where [image]. Let d = 2. For every participant v ? Vi, define ?(v) = (xi, 1).

It is straightforward to verify Property (11.3). By Theorem 11.4, we have an ideal scheme.

To illustrate the application of these constructions, we will consider the possible access structures for up to four participants. Note that it suffices to consider only the access structures in which the basis cannot be partitioned into two non-empty subsets on disjoint participant sets. (For example, ?0 = {{P1, P2}, {P3, P4}} can be partitioned as {{P1, P2}} ? {{P3, P4}} so we do not consider it.) We list the non-isomorphic access structures of this type on two, three, and four participants in Table 11.1 (the quantities ?* are defined in Section 11.7).

Of these 18 access structures, we can already obtain ideal schemes for ten of them using the constructions we have at our disposal now. These ten access structures are either threshold access structures or have a basis which is a complete multipartite graph, so Theorem 11.5 can be applied. One such access structure is # 9, whose basis is the complete multipartite graph K1,1,2. We illustrate in the following example.

Example 11.7

For access structure # 9, take d = 2, p ? 3, and define ? as follows:

Table 11.1 Access structures for at most four participants
 | w | subsets in ?0 | ?* | comments
1. | 2 | P1P2 | 1 | (2, 2)-threshold
2. | 3 | P1P2, P2P3 | 1 | ?0 ? K1,2
3. | 3 | P1P2, P2P3, P1P3 | 1 | (2, 3)-threshold
4. | 3 | P1P2P3 | 1 | (3, 3)-threshold
5. | 4 | P1P2, P2P3, P3P4 | 2/3 |
6. | 4 | P1P2, P1P3, P1P4 | 1 | ?0 ? K1,3
7. | 4 | P1P2, P1P4, P2P3, P3P4 | 1 | ?0 ? K2,2
8. | 4 | P1P2, P2P3, P2P4, P3P4 | 2/3 |
9. | 4 | P1P2, P1P3, P1P4, P2P3, P2P4 | 1 | ?0 ? K1,1,2
10. | 4 | P1P2, P1P3, P1P4, P2P3, P2P4, P3P4 | 1 | (2, 4)-threshold
11. | 4 | P1P2P3, P1P4 | 1 |
12. | 4 | P1P 3P4, P1P2, P2P3 | 2/3 |
13. | 4 | P1P3P4,P1P2, P2P3, P2P4 | 2/3 |
14. | 4 | P1P2P3, P1P2P4 | 1 |
15. | 4 | P1P2P3, P1P2P4, P3P4 | 1 |
16. | 4 | P1P2P3, P1P2P4, P1P3P4 | 1 |
17. | 4 | P1P2P3, P1P2P4, P1P3P4, P2P3P4 | 1 | (3, 4)-threshold
18. | 4 | P1P2P3P4 | 1 | (4, 4)-threshold

Applying Theorem 11.5, an ideal scheme results.

Eight access structures remain to be considered. It is possible to use ad hoc applications of the vector space construction to construct ideal schemes for four of these: # 11, # 14, # 15 and # 16. We present the constructions for # 11 and # 14 here.

Example 11.8

For access structure # 11, take d = 3, p ? 3, and define ? as follows:

First, we have

Also,

Hence,

and

Now, it suffices to show that

if B is a maximal unauthorized subset. There are three such subsets B to be considered: {P1, P2}, {P1, P3}, and {P2, P3, P4}. In each case, we need to establish that a system of linear equations has no solution. For example, suppose that

where [image]. This is equivalent to the system

The system is easily seen to have no solution. We leave the other two subsets B for the reader to consider.

Example 11.9

For access structure # 14, take d = 3, p ? 2 and define ? as follows:

Again, Property (11.3) is satisfied and hence an ideal scheme results.

Constructions of ideal schemes for the access structures # 15 and # 16 are left as exercises. In the next section, we will show that the remaining four access structures cannot be realized by ideal schemes.


11.7 An Upper Bound on the Information Rate

Four access structures remain to be considered: # 5, # 8, # 12, and # 13. We will see in this section that in each case, there does not exist a scheme having information rate ? > 2/3.

Denote by ?* = ?* (?) the maximum information rate for any perfect secret sharing scheme realizing a specified access structure ?. The first result we present is an entropy bound that will lead to an upper bound on ?* for certain access structures. We have defined a probability distribution [image] on [image]; the entropy of this probability distribution is denoted H(K). We have also denoted by [image] the probability distribution on the shares given to a subset [image]. We will denote the entropy of this probability distribution by H(B).

We begin by giving yet another definition of perfect secret sharing schemes, this time using the language of entropy. This definition is equivalent to Definition 11.3.

DEFINITION 11.5 Suppose ? is an access structure and [image] is a set of distribution rules. Then [image] is a perfect secret sharing scheme realizing the access structure ? provided that the following two properties are satisfied:

1. For any authorized subset of participants
2. For any unauthorized subset of participants [image].

We will require several entropy identities and inequalities. Some of these results were given in Section 2.3 and the rest are proved similarly, so we state them without proof in the following Lemma.

LEMMA 11. 6

Let X, Y and Z be random variables. Then the following hold:

We next prove two preliminary entropy lemmas for secret sharing schemes.

LEMMA 11.7

Suppose ? is an access structure and [image] is a set of distribution rules realizing ?.

Suppose B ? ? and [image], where [image]. Then

PROOF From Equations 11.5 and 11.6, we have that

and

so

Since, by Property 2 of Definition 11.5, we have

and, by Property 1 of Definition 11.5, we have

the result follows.

LEMMA 11.8

Suppose ? is an access structure and [image] is a set of distribution rules realizing ?. Suppose [image], where [image]. Then H (A|B) = H (A|BK).

PROOF As in Lemma 11.7, we have that

Since

and

the result follows.

We now prove the following important theorem.

THEOREM 11.9

Suppose ? is an access structure such that

and

Let [image] be any perfect secret sharing scheme realizing ?. Then H (XY) ? 3H (K).

PROOF We establish a sequence of inequalities:

H(K) | = | H(Y|WZ) - H(Y|WZK) | by Lemma 11.7
 | ? | H(Y|WZ) | by (11.7)
 | ? | H(Y|W) | by (11.8)
 | = | H(Y|WK) | by Lemma 11.8
 | ? | H(XY|WK) | by (11.9)
 | = | H(X|WK) + H(Y|WXK) | by (11.5)
 | ? | H(X|WK) + H(Y|XK) | by (11.8)
 | = | H(X|W) - H(K) + H(Y|X) - H(K) | by Lemma 11.7
 | ? | H(X) - H(K) + H(Y|X) - H(K) | by (11.7)
 | = | H(XY) - 2H(K) | by (11.4).

Hence, the result follows.

COROLLARY 11.10

Suppose that ? is an access structure that satisfies the hypotheses of Theorem 11.9. Suppose the [image] keys are equally probable. Then ? ? 2/3.

PROOF Since the keys are equiprobable, we have

Also, we have that

By Theorem 11.9, we have that

Hence it follows that

Now, by the definition of information rate, we have

and

It follows that

Hence, ? ? 2/3.

For the access structures # 5, # 8, # 12, and # 13, the hypotheses of Theorem 11.9 are satisfied. Hence, ?* ? 2/3 for these four access structures.

We also have the following result concerning ?* in the case where the access structure has a basis ?0 which is a graph. The proof involves showing that any connected graph which is not a multipartite graph contains an induced subgraph on four vertices that is isomorphic to the basis of access structure # 5 or # 8. If G = (V, E) is a graph with vertex set V and edge set E, and [image], then the induced subgraph G[V1] is defined to be the graph (V1, E1), where

THEOREM 11.11

Suppose G is a connected graph that is not a complete multipartite graph. Let ?(G) be the access structure that is the closure of E, where E is the edge set of G. Then ?*(?(G)) ? 2/3.

PROOF We will first prove that any connected graph that is not a complete multipartite graph must contain four vertices w, x, y, z such that the induced subgraph G[w, x, y, z] is isomorphic to either the basis of access structure # 5 or # 8.

Let GC denote the complement of G. Since G is not a complete multipartite graph, there must exist three vertices x, y, z such that xy, yz ? E(GC) and xz ? E(G). Define

where dG denotes the length of a shortest path (in G) between two vertices. Then d ? 2. Without loss of generality, we can assume that d = dG (y, x) by symmetry.

Let

be a path in G, where yo = y. We have that

and

It follows that G[yd-2, yd-1, x, z] is isomorphic to the basis of access structure # 5 or # 8, as desired.

So, we can assume that we have found four vertices w, x, y, z such that the induced subgraph G[w, x, y, z] is isomorphic to either the basis of access structure #5 or # 8. Now, let [image] be any scheme realizing the access structure ?(G). If we restrict the domain of the distribution rules to {w, x, y, z}, then we obtain a scheme [image] realizing access structure # 5 or # 8. It is also obvious that [image]. Since [image], it follows that [image]. This completes the proof.

Since ?* = 1 for complete multipartite graphs, Theorem 11.11 tells us that it is never the case that 2/3 < ?* < 1 for any access structure that is the closure of the edge set of a connected graph.


11.8 The Decomposition Construction

We still have four access structures in Table 11.1 to consider. Of course, we can use the monotone circuit construction to produce schemes for these access structures. However, by this method, the best we can do is to obtain information rate ? = 1/2 in each case. We can get ? = 1/2 in cases # 5 and # 12 by using a disjunctive normal form boolean circuit. For cases # 8 and # 13, a disjunctive normal form boolean circuit will yield ? = 1/3, but other monotone circuits exist which allow us to attain ? = 1/2. But in fact, it is possible to construct schemes with ? = 2/3 for each of these four access structures, by employing constructions that use ideal schemes as building blocks in the construction of larger schemes.

We present a construction of this type called the “decomposition construction.” First, we need to define an important concept.

DEFINITION 11.6 Suppose ? is an access structure having basis ?0. Let [image] be a specified key set. An ideal [image] decomposition of ?0 consists of a set {?1, . . . ?n} such that the following properties are satisfied:

1.
2.
3. for 1 ? k ? n, there exists an ideal scheme with key set [image], on the subset of participants

for the access structure having basis ?k.

Given an ideal [image] -decomposition of an access structure ?, we can easily construct a perfect secret sharing scheme, as described in the following theorem.

THEOREM 11.12

Suppose ? is an access structure having basis ?0. Let [image] be a specified key set, and suppose {?1,...?n} is an ideal [image] -decomposition of ?. For every participant Pi, define

Then there exists a perfect secret sharing scheme realizing ?, having information rate ? 1/R, where

PROOF For 1 ? k ? n, we have an ideal scheme realizing the access structure with basis ?k, with key set [image], having [image] as its set of distribution rules. We will construct a scheme realizing ?, with key set [image]. The set of distribution rules [image] is constructed according to the following recipe. Suppose D wants to share a key K. Then, for 1 ? k ? n, he chooses a random distribution rule [image] and distributes the resulting shares to the participants in [image].

We omit the proof that the scheme is perfect. However, it is easy to compute the information rate of the resulting scheme. Since each of the component schemes is ideal, it follows that

for 1 ? i ? w. So

and

which is what we were required to prove.

Although Theorem 11.12 is useful, it is often much more useful to employ a generalization in which we have [image] ideal [image] -decompositions of ?0 instead of just one. Each of the [image] decompositions is used to share a key chosen from [image]. Thus, we build a scheme with key set [image]. The construction of the scheme and its information rate are as stated in the following theorem.

THEOREM 11.13 (Decomposition Construction)

Suppose ? is an access structure having basis ?0, and [image] is an integer. Let [image] be a specified key set, and for 1 [image], suppose that [image] is an ideal decomposition of ?0. Let [image] denote the participant set for the access structure ?j,k. For every participant Pi, define

Then there exists a perfect secret sharing scheme realizaing ?, having information rate [image] where

PROOF For [image] and 1 ? k ? n, we have an ideal scheme realizing the access structure with basis ?j,k, with key set [image], having [image] as its set of distribution rules. We construct a scheme realizing ?, with key set [image]. The set of distribution rules [image] is constructed according to the following recipe. Suppose D wants to share a key [image]. Then for [image] and 1 ? k ? n, he chooses a random distribution rule [image] and distributes the resulting shares to the participants in

The information rate can be computed in a manner similar to that of Theorem 11.12.

Let's look at a couple of examples.

Example 11.10

Consider access structure # 5. The basis is a graph that is not a complete multi-partite graph. Therefore we know from Theorem 11.11 that ?* ? 2/3.

Let p be prime, and consider the following two ideal [image] -decompositions:

where

and

where

Each decomposition consists of a K2 and a K1,2, so they are indeed ideal [image] -decompositions. Either of them yields a scheme with ? = 1/2. However, if we “combine” them by applying Theorem 11.13 with [image], then we get a scheme with ? = 2/3, which is optimal.

One implementation of the scheme, using Theorem 11.5, is as follows. D will choose four random elements (independently) from [image], say b11, b12, b21, and b22. Given a key [image], D distributes shares as follows:

1. P1 receives b11, b21.
2. P2 receives b11 + K1, b12, b21 + K2.
3. P3 receives b12 + K1, b21, b22.
4. P4 receives b12, b22 + K2.

(All arithmetic is performed in [image].)

Example 11.11

Consider access structure # 8. Again, ?* ? 2/3 by Theorem 11.11, and two suitable ideal compositions will yield an (optimal) scheme with ? = 2/3.

Take [image] for any prime p ? 3, and define two ideal [image] -decompositions to be:

where

and

where

consists of a K2 and a K3, and [image] consists of a K2 and a K1,3, so both are ideal [image] -decompositions. Applying Theorem 11.13 with [image], we get a scheme with ? = 2/3.

One implementation, using Theorem 11.5, is as follows. D will choose four random elements (independently) from [image], say b11, b12, b21, and b22. Given a key [image], D distributes shares as follows:

1. P1 receives b11 + K1, b21 + K2.
2. P2 receives b11, b12, b21.
3. P3 receives b12 + K1, b21 + K2, b22.
4. P4 receives b12 + 2K1, b21 + K2, b22 + K2.

(All arithmetic is performed in

To this point, we have explained all the information in Table 11.1 except for the values of ?* for access structures # 12 and # 13. These values arise from a more general version of the decomposition construction which we do not describe here; see the notes below.


11.9 Notes and References

Threshold schemes were invented independently by Blakley [BL79] and Shamir [SH79]. Secret sharing for general access structures was first studied in Ito, Saito, and Nishizeki [ISN87]; we based Section 11.2 on the approach of Benaloh and Leichter [BL90]. The vector space construction is due to Brickell [BR89A]. The entropy bound of Section 11.7 is proved in Capocelli et al. [CDGV93], and some of the other material from this section is found in Blundo et al. [BDSV93].

In this chapter, we have emphasized a linear-algebraic and combinatorial approach to secret sharing. Some interesting connections with matroid theory can be found in Brickell and Davenport [BD91]. Secret sharing schemes can also be constructed using geometric techniques. Simmons has done considerable research in this direction; we refer to [SI92A] for an overview of geometric techniques in secret sharing. Further discussion of these topics, as well as constructions for schemes having information rate 2/3 for access structures # 12 and # 13, can be found in the expository paper by Stinson [ST92A].


Chapter 11 Exercises

Exercises

11.1 Write a computer program to compute the key for a Shamir (t, w)-threshold scheme implemented in [image]. That is, given t public x-coordinates, x1, x2, . . . , xt, and t y-coordinates y1, . . . , yt, compute the resulting key. Use the Lagrange interpolation method, as it is easier to program.

(a) Test your program if p = 31847, t = 5 and w = 10, with the following

shares:

x1 = 413 y1 = 25439
x2 = 432 y2 = 14847
x3 = 451 y3 = 24780
x4 = 470 y4 = 5910
x5 = 489 y5 = 12734
x6 = 508 y1 = 12492
x7 = 527 y2 = 12555
x8 = 546 y3 = 128578
x9 = 565 y4 = 20806
x10 = 584 y5 = 21462

Verify that the same key is computed by using several different subsets of five shares.

(b) Having determined the key, compute the share that would be given to a participant with x-coordinate 10000. (Note that this can be done without computing the whole secret polynomial a(x).)

11.2 A dishonest dealer might distribute “bad” shares for a Shamir threshold scheme, i.e., shares for which different t-subsets determine different keys. Given all w shares, we could test the consistency of the shares by computing the key for every one of the [image] t-subsets of participants, and verifying that the same key is computed in each case. Can you describe a more efficient method of testing the consistency of the shares?
11.3 For access structures having the following bases, use the monotone circuit construction to construct a secret sharing scheme with information rate ? = 1/3.

(a) ?0 = {{P1, P2}, {P2, P3}, {P2, P4}, {P3, P4}}.
(b) ?0 = {{P1, P3, P4}, {P1, P2}, {P2, P3},{P2, P4}}.
(c) ?0 = {{P1, P2}, {P1, P3}, {P2, P3, P4}, {P2, P4, P5}, {P3, P4, P5}}.

11.4 Use the vector space construction to obtain ideal schemes for access structures having the following bases:

(a) ?0 = {{P1, P2, P3}, {P1, P2, P4}, {P3, P4}}.
(b) ?0 = {{P1, P2, P3}, {P1, P2, P4},{P1, P3, P4}}.
(c) ?0 = {{P1, P2}, {P1, P3}, {P2, P3}, {P1, P4, P5}, {P2, P4, P5}}.

11.5 Use the decomposition construction to obtain schemes with specified information rates for access structures having the following bases:

(a) ?0 = {{P1, P3, P4}, {P1, P2}, {P2, P3}}, ? = 3/5.
(b) ?0 = {{P1, P3, P4}, {P1, P2}, {P2, P3},{P2, P4}}, ? = 4/7.


Chapter 12 Pseudo-random Number Generation

Chapter 12
Pseudo-random Number Generation

12.1 Introduction and Examples

There are many situations in cryptography where it is important to be able to generate random numbers, bit-strings, etc. For example, cryptographic keys are to be generated at random from a specified keyspace, and many protocols require random numbers to be generated during their execution. Generating random numbers by means of coin tosses or other physical processes is time-consuming and expensive, so in practice it is common to use a pseudo-random bit generator (or PRBG). A PRBG starts with a short random bit-string (a “seed”) and expands it into a much longer “random-looking” bit-string. Thus a PRBG reduces the amount of random bits that are required in an application.

More formally, we have the following definition.

DEFINITION 12.1 Let k, [image] be positive integers such that [image] (where [image] is a specified polynomial function of k). A [image] - pseudo-random bit generator (more briefly, a [image] -PRBG) is a function [image] that can be computed in polynomial time (as a function of k). The input [image] is called the seed, and the output [image] is called a pseudo-random bit-string.

The function f is deterministic, so the bit-string f(s0) is dependent only on the seed. Our goal is that the pseudo-random bit-string f(s0) should “look like” truly random bits, given that the seed is chosen at random. Giving a precise definition is quite difficult, but we will try to give an intuitive description of the concept later in this chapter.

One motivating example for studying this type PRBG is as follows. Recall the concept of perfect secrecy that we studied in Chapter 2. One realization of perfect secrecy is the One-time Pad, where the plaintext and the key are both bitstrings of a specified length, and the ciphertext is constructed by taking the bitwise exclusive-or of the plaintext and the key. The practical difficulty of the One-time Pad is that the key, which must be randomly generated and communicated over a secure channel, must be as long as the plaintext in order to ensure perfect secrecy. PRBGs provide a possible way of alleviating this problem. Suppose Alice and Bob agree on a PRBG and communicate a seed over the secure channel. Alice and Bob can then both compute the same string of pseudo-random bits, which will be used as a One-time Pad. Thus the seed functions as a key, and the PBRG can be thought of as a keystream generator for a stream cipher.

Figure 12.1 Linear Congruential Generator

We now present some well-known PRBGs to motivate and illustrate some of the concepts we will be studying. First, we observe that a linear feedback shift register, as described in Section 1.1.7, can be thought of as a PRBG. Given a k-bit seed, an LFSR of degree k can be used to produce as many as 2k - k - 1 further bits before repeating. The PRBG obtained from an LFSR is very insecure: we already observed in Section 1.2.5 that knowledge of any 2k consecutive bits suffice to allow the seed to be determined, and hence the entire sequence can be reconstructed by an opponent. (Although we have not yet defined security of a PRBG, it should be clear that the existence of an attack of this type means that the generator is insecure!)

Another well-known (but insecure) PRBG, called the Linear Congruential Generator, is presented in Figure 12.1. Here is a very small example to illustrate.

Example 12.1

We can obtain a (5, 10)-PRBG by taking M = 31, a = 3 and b = 5 in the Linear Congruential Generator. If we consider the mapping [image] mod 31, then [image], and the other 30 residues are permuted in a cycle of length 30, namely 0, 5, 20, 3, 14, 16, 22, 9, 1, 8, 29, 30, 2, 11, 7, 26, 21, 6, 23, 12, 10, 4, 17, 25, 18, 28, 27, 24, 15, 19. If the seed is anything other than 13, then the seed specifies a starting point in this cycle, and the next 10 elements, reduced modulo 2, form the pseudo-random sequence.

Table 12.1 Bit-strings produced by the linear congruential generator
seed | sequence
0 | 1010001101
1 | 0100110101
2 | 1101010001
3 | 0001101001
4 | 1100101101
5 | 0100011010
6 | 1000110010
7 | 0101000110
8 | 1001101010
9 | 1010011010
10 | 0110010110
11 | 1010100011
12 | 0011001011
13 | 1111111111
14 | 0011010011
15 | 1010100011
16 | 0110100110
17 | 1001011010
18 | 0101101010
19 | 0101000110
20 | 1000110100
21 | 0100011001
22 | 1101001101
23 | 0001100101
24 | 1101010001
25 | 0010110101
26 | 1010001100
27 | 0110101000
28 | 1011010100
29 | 0011010100
30 | 0110101000

The 31 possible pseudo-random bit-strings produced by this generator are illustrated in Table 12.1.

We can use some concepts developed in earlier chapters to consrtruct PRBGs. For example, the output feedback mode of DES, as described in Section 3.4.1, can be thought of as a PRBG; moreover, it appears to be computationally secure.

Figure 12.2 RSA Generator

Another approach in constructing very fast PRBGs is to combine LFSRs in some way that the output looks less linear. One such method, due to Coppersmith, Krawczyk and Mansour, is called the Shrinking Generator. Suppose we have two LFSRs, one of degree k1 and one of k2. We will require a total of k1 + k2 bits as our seed, in order to initialize both LFSRs. The first LFSR will produce a sequence of bits, say a1, a2, …, and the second produces a sequence of bits b1, b2, ….Then we define a sequence of pseudo-random bits z1, z2, … by the rule

where ik is the position of the kth 1 in the sequence b1, b2, …. These pseudo-random bits comprise a subsequence of the bits produced by the first LFSR. This method of pseudo-random bit generation is very fast and is resistent to various known attacks, but there does not seem to be any way to prove that it is secure.

In the rest of this chapter, we will investigate PRBGs that can be proved to be secure given some plausible computational assumption. There are PRBGs based on the fundamental problems of factoring (as it relates to the RSA public-key cryptosystem) and the Discrete Logarithm problem. A PRBG based on the RSA encryption function is shown in Figure 12.2, and a PRBG based on the Discrete Logarithm problem is discussed in the exercises.

We now give an example of the RSA Generator.

Table 12.2 Bits produced by RSA generator
i | si | zi
0 | 75634 |
1 | 31483 | 1
2 | 31238 | 0
3 | 51968 | 0
4 | 39796 | 0
5 | 28716 | 0
6 | 14089 | 1
7 | 5923 | 1
8 | 44891 | 1
9 | 62284 | 0
10 | 11889 | 1
11 | 43467 | 1
12 | 71215 | 1
13 | 10401 | 1
14 | 77444 | 0
15 | 56794 | 0
16 | 78147 | 1
17 | 72137 | 1
18 | 89592 | 0
19 | 29022 | 0
20 | 13356 | 0

Example 12.2

Suppose n = 91261 = 263 ? 347, b = 1547, and s0 = 75364. The first 20 bits produced by the RSA Generator are computed as shown in Table 12.2. Hence the bit-string resulting from this seed is

10000111011110011000.


12.2 Indistinguishable Probability Distributions

There are two main objectives of a pseudo-random number generator: it should be fast (i.e., computable in polynomial time as a function of k) and it should be secure. Of course, these two requirements are often conflicting. The PRBGs based on linear congruences or linear feedback shift registers are indeed very fast. These PRBGs are quite useful in simulations, but they are very insecure for cryptographic applications.

Let us now try to make precise the idea of a PRBG being “secure.” Intuitively, a string of km bits produced by a PRBG should look “random.” That is, it should be impossible in an amount of time that is polynomial in k (equivalently, polynomial in [image]) to distinguish a string of [image] pseudo-random bits produced by a PRBG from a string of [image] truly random bits.

This motivates the idea of distinguishability of probability distributions. Here is a definition of this concept.

DEFINITION 12.2 Suppose p0 and p1 are two probability distributions on the set [image] of bit-strings of length [image]. Let [image] be a probabilistic algorithm that runs in polynomial time (as a function of [image]). Let ? > 0. For j = 0, 1, define

We say that A is an ?-distinguisher of p0 and p1 provided that

and we say that p0 and p1 are ?-distinguishable if there exists an ?-distinguisher of p0 and p1.

REMARK If A is a deterministic algorithm, then the conditional probabilities

always have the value of 0 or 1.

The intuition behind this definition is as follows. The algorithm A tries to decide if a bit-string [image] of length [image] is more likely to have arisen from probability distribution p1 or from probability distribution p0. This algorithm may use random numbers if desired, i.e., it can be probabilistic. The output [image] represents the algorithm’s guess as to which of these two probability distributions is more likely to have produced, [image]. The quantity EA (pj) represents the average (i.e., expected) value of the output of A over the probability distribution pj, for j = 0, 1. This is computed by summing over all possible sequences [image] the product of the probability of the [image] -tuple [image] and the probability that A answers “1” when given [image] as input. A is an ?-distinguisher provided that the values of these two expectations are at least ? apart.

The relevance to PRBGs is as follows. Consider the sequence of [image] bits produced by the PRBG. There are [image] possible sequences, and if the bits were chosen independently at random, each of these [image] sequences would occur with equal probability [image]. Thus a truly random sequence corresponds to an equiprobable distribution on the set of all bit-strings of length [image]. Suppose we denote this probability distribution by p0.

Now, consider sequences produced by the PRBG. Suppose a k-bit seed is chosen at random, and then the PRBG is used to obtain a bit-string of length [image]. Then we obtain a probability distribution on the set of all bit-strings of length [image], which we denote by p1. (For the purposes of illustration, suppose we make the simplifying assumption that no two seeds give rise to the same sequence of bits. Then, of the [image] possible sequences, 2k sequences each occur with probability 1/2k, and the remaining [image] sequences never occur. So, in this case, the probability distribution p1 is very non-uniform.)

Even though the two probability distributions p0 and p1 may be quite different, it is still conceivable that they might be ?-distinguishable only for small values of ?. This is our objective in constructing PRBGs.

Example 12.3

Suppose that a PRBG only produces sequences in which exactly [image] bits have the value 0 and [image] bits have the value 1. Define the function A by

In this case, the algorithm A is deterministic. It is not hard to see that

and

It can be shown that

Hence, for any fixed value of ? < 1, p0 and p1 are ?-distinguishable if [image] is sufficiently large.


12.2.1 Next Bit Predictors

Another useful concept in studying PRBGs is that of a next bit predictor, which works as follows. Let f be a [image] -PRBG. Suppose we have a probabilistic algorithm Bi, which takes as input the first i-1 bits produced by f (given an unknown seed), say z1, …, zi-1, and attempts to predict the next bit zi. The value i can be any value such that [image]. We say that Bi is an ?-next bit predictor if Bi can predict the ith bit of a pseudo-random sequence with probability at least 1/2 + ?, where ? > 0.

We can give a more precise formulation of this concept in terms of probability distributions, as follows. We have already defined the probability distribution p1 on [image] induced by the PRBG f. We can also look at the probability distributions induced by f on any of the [image] pseudo-random output bits (or indeed on any subset of these [image] output bits). So, for [image], we will can think of the ith pseudo-random output bit as a random variable that we will denote by zi.

In view of these definitions, we have the following characterization of a next bit predictor.

THEOREM 12.1

Let f be a [image] -PRBG. Then the probabilistic algorithm Bi is an ?-next bit predictor for f if and only if

PROOF The probability of correctly predicting the ith bit is computed by summing over all possible (i - 1)-tuples (z1, … , zi-1) the product of the probability that the (i - 1)-tuple, (z1,…, zi-1) is produced by the PRBG and the probability that the ith bit is predicted correctly given the (i - 1)-tuple, (z1, … , zi-1).

The reason for the expression 1/2 + ? in this definition is that any predicting algorithm can predict the next bit of a random sequence with probability 1/2. If a sequence is not random, then it may be possible to predict the next bit with higher probability. (Note that it is unnecessary to consider algorithms that predict the next bit with probability less than 1/2, because in this case an algorithm that replaces every prediction z by 1 - z will predict the next bit with probability greater than 1/2.)

We illustrate these ideas by producing a next-bit predictor for the Linear Congruential Generator of Example 12.1.

Example 12.1 (Cont.)

For any i such that 1 ? i ? 9, Define Bi(z) = 1 - z. That is, Bi predicts that a 0 is most likely to be followed by a 1, and vice versa. It is not hard to compute from Table 12.1 that each of these predictors Bi is a [image] -next bit predictor (i.e., they predict the next bit correctly with probability 20/31).

We can use a next bit predictor to construct a distinguishing algorithm A, as shown in Figure 12.3. The input to algorithm A is a sequence of bits, [image], and A calls the algorithm Bi as a subroutine.

Figure 12.3 Constructing a distinguisher from a next bit predictor

THEOREM 12.2

Suppose Bi is an ?-next bit predictor for the [image] -PRBG f. Let p1 be the probability distribution induced on [image] by f, and let p0 be the uniform probability distribution on [image]. Then A, as described in Figure 12.3, is an ?-distinguisher of p1 and p0.

PROOF First, observe that

Also, the output of A is independent of the values of [image]. Thus we can compute as follows:

On the other hand, any predictor Bi will predict the ith bit of a truly random sequence with probability 1/2. Then, it is not difficult to see that EA (p0) = 1/2. Hence |EA (p0) - EA (p1)| ? ?, as desired.

One of the main results in the theory of pseudo-random bit generators, due to Yao, is that a next bit predictor is a universal test. That is, a PRBG is “secure” if and only if there does not exist an ?-next bit predictor except for very small values of ?. Theorem 12.2 proves the implication in one direction. To prove the converse, we need to show how the existence of a distinguisher implies the existence of a next bit predictor. This is done in Theorem 12.3.

THEOREM 12.3

Suppose A, is an ?-distinguisher of p1 and p0, where p1 is the probability distribution induced on [image] by the [image] -PRBG f, and p0 is the uniform probability distribution on [image]. Then for some i, [image], there exists an [image] -next bit predictor Bi for f.

PROOF For [image], define qi to be a probability distribution on [image] where the first i bits are generated using f, and the remaining [image] bits are generated at random. Thus q0 = p0 and [image]. We are given that

By the triangle inequality, we have that

Hence, it follows that there is at least one value [image], such that

Without loss of generality, we will assume that

We are going to construct an ith bit predictor (for this specified value of i). The predicting algorithm is probabilistic in nature and is presented in Figure 12.4. Here is the idea behind this construction. The predicting algorithm in fact produces an [image] -tuple according to the probability distribution qi - 1, given that z1,…,zi-1are generated by the PRBG. If A answers “0,” then it thinks that the [image] -tuple was most likely generated according to the probability distribution qi. Now qi-1 and qi differ only in that the ith bit is generated at random in qi-1, whereas it is generated according to the PRBG in qi. Hence, when A answers “0,” it thinks that the ith bit, zi, is what would be produced by the PRBG. Hence, in this case we take zi as our prediction of the ith bit. If A answers “1,” it thinks that zi is random, so we take 1 - zi as our prediction of the ith bit.

We need to compute the probability that the ith bit is predicted correctly. Observe that if A answers “0,” then the prediction is correct with probability

Figure 12.4 Constructing a next bit predictor from a distinguisher

where p1 is the probability distribution induced by the PRBG. If A answers “1,” then the prediction is correct with probability

For brevity, we denote [image]. In our computation, we will make use of the fact that

This can be proved easily as follows:

Now we can perform our main computation:

which was what we wanted to prove.


12.3 The Blum-Blum-Shub Generator

In this section we describe one of the most popular PRBGs, due to Blum, Blum, and Shub. First, we review some results on Jacobi symbols from Section 4.5 and other number-theoretic facts from other parts of Chapter 4.

Suppose p and q are two distinct primes, and let n = pq. Recall that the Jacobi symbol

Denote the quadratic residues modulo n by QR (n). That is,

Recall that x is a quadratic residue modulo n if and only if

Define

Thus

An element [image] is called a pseudo-square modulo n.

The Blum-Blum-Shub Generator, as well as some other cryptographic systems, is based on the Quadratic Residues problem defined in Figure 12.5. (In Chapter 4, we defined the Quadratic Residues problem modulo a prime and showed that it is easy to solve; here we have a composite modulus.) Observe that the Quadratic Residues problem requires us to distinguish quadratic residues modulo n from pseudo-squares modulo n. This can be no more difficult than factoring n. For if the factorization n = pq can be computed, then it is a simple matter to compute [image], say. Given that [image], it follows that x is a quadratic residue if and only if [image].

Figure 12.5 Quadratic Residues

Figure 12.6 Blum-Blum-Shub Generator

There does not appear to be any way to solve the Quadratic Residues problem efficiently if the factorization of n is not known. So this problem appears to be intractible if it is infeasible to factor n.

The Blum-Blum-Shub Generator is presented in Figure 12.6. The generator works quite simply. Given a seed s0 ? QR(n), we compute the sequence [image] by successive squaring modulo n, and then reduce each si modulo 2 to obtain zi. It follows that

.

Table 12.3 Bits produced by BBS generator
i | si | zi
0 | 20749 |
1 | 143135 | 1
2 | 177671 | 1
3 | 97048 | 0
4 | 89992 | 0
5 | 174051 | 1
6 | 80649 | 1
7 | 45663 | 1
8 | 69442 | 0
9 | 186894 | 0
10 | 177046 | 0
11 | 137922 | 0
12 | 123175 | 1
13 | 8630 | 0
14 | 114386 | 0
15 | 14863 | 1
16 | 133015 | 1
17 | 106065 | 1
18 | 45870 | 0
19 | 137171 | 1
20 | 48060 | 0

We now give an example of the BBS Generator.

Example 12.4

Suppose n = 192649 = 383 ? 503 and s0 = 1013552 mod n = 20749. The first 20 bits produced by the BBS Generator are computed as shown in Table 12.3. Hence the bit-string resulting from this seed is

11001110000100111010.

Here is a feature of the BBS Generator that is useful when we look at its security. Since n = pq where p ? q ? 3 mod 4, it follows that for any quadratic residue x, there is a unique square root of x that is also a quadratic residue. This square root is called the principal square root of x. It follows the mapping [image] mod n used to define the BBS Generator is a permutation on QR(n), the set of quadratic residues modulo n.


12.3.1 Security of the BBS Generator

In this section, we look at the security of the BBS Generator in detail. We begin by supposing that the pseudo-random bits produced by the BBS Generator are ?-distinguishable from [image] random bits and then see where that leads us. Throughout this section, n = pq, where p and q are primes such that p ? q ? 3 mod 4, and the factorization n = pq is unknown.

We have already discussed the idea of a next bit predictor. In this section we consider a similar concept that we call a previous bit predictor. A previous bit predictor for a [image] -BBS Generator will take as input [image] pseudo-random bits produced by the generator (as determined by an unknown random seed s0 ? QR(n)), and attempt to predict the value z0 = s0 mod 2. A previous bit predictor can be a probabilistic algorithm, and we say that a previous bit predictor B0 is an ?-previous bit predictor if its probability of correctly guessing z0 is at least 1/2 + ?, where this probability is computed over all possible seeds s0.

We state the following theorem, which is similar to Theorem 12.3, without proof.

THEOREM 12.4

Suppose A, is an ?-distinguisher of p1 and p0, where p1 is the probability distribution induced on [image] by the [image] -BBS Generator, f, and p0 is the uniform probability distribution on [image]. Then there exists an [image] -previous bit predictor B0 for f.

We now show how to use an [image] -previous bit predictor, B0, to construct a probabilistic algorithm that distinguishes quadratic residues modulo n from pseudo-squares modulo n with probability 1/2 + ?. This algorithm A, presented in Figure 12.7, uses B0 as a subroutine, or oracle.

THEOREM 12.5

Suppose B0 is an ?-previous bit predictor for the [image] -BBS Generator f. Then the algorithm A, as described in Figure 12.7, determines quadratic residuosity correctly with probability at least 1/2 + ?, where this probability is computed over all possible inputs [image].

PROOF Since n = pq and p ? q ? 3 mod 4, it follows that [image] so [image]. Hence, if [image] then the principal square root s0 = x2 is x if x ? QR(n); and -x if [image]. But

so it follows that algorithm A gives the correct answer if and only if B0 correctly predicts z. The result then follows immediately.

Figure 12.7 Constructing a quadratic residue distinguisher from a previous bit predictor

Theorem 12.5 shows how we can distinguish pseudo-squares from quadratic residues with probability at least 1/2 + ?. We now show that this leads to a Monte Carlo algorithm that gives the correct answer with probability at least 1/2 + ?. In other words, for any [image], the Monte Carlo algorithm gives the correct answer with probabilty at least 1/2 + ?. Note that this algorithm is an unbiased algorithm (it may give an incorrect answer for any input) in contrast to the Monte Carlo algorithms that we studied in Section 4.5 which were all biased algorithms.

The Monte Carlo algorithm A1 is presented in Figure 12.8. It calls the previous algorithm A as a subroutine.

THEOREM 12.6

Suppose that algorithm A determines quadratic residuosity correctly with probability at least 1/2 + ?. Then the algorithm A1, as described in Figure 12.8, is a Monte Carlo algorithm for Quadratic Residues with error probability at most 1/2 + ?.

PROOF For any given input [image], the effect of step 2 in algorithm A1 is to produce an element x? that is a random element of [image] whose status as a quadratic residue is known.

The last step is to show that any (unbiased) Monte Carlo algorithm that has error probability at most 1/2 + ? can be used to construct an unbiased Monte Carlo algorithm with error probability at most ?, for any ? > 0. In other words, we can make the probability of correctness arbitrarily close to 1. The idea is to run the given Monte Carlo algorithm 2m + 1 times, for some integer m, and take the “majority vote” as the answer. By computing the error probability of this algorithm, we can also see how m depends on ?. This dependence is stated in the following theorem.

Figure 12.8 A Monte Carlo algorithm for Quadratic Residues

THEOREM 12.7

Suppose A1 is an unbiased Monte Carlo algorithm with error probability at most 1/2 + ?. Suppose we run A1 n = 2m + 1 times on a given instance I, and we take the most frequent answer. Then the error probability of the resulting algorithm is at most

PROOF The probability of obtaining exactly i correct answers in the n trials is at most

The probability that the most frequent answer is incorrect is equal to the probability that the number of correct answers in the n trials is at most m. Hence, we compute as follows

as required.

Suppose we want to lower the probability of error to some value ?, where 0 < ? < 1/2 - ?. We need to choose m so that

Hence, it suffices to take

Then, if algorithm A is run 2m + 1 times, the majority vote yields the correct answer with probability at least 1 - ?. It is not hard to show that this value of m is at most c/(??2) for some constant c. Hence, the number of times that the algorithm must be run is polynomial in 1/? and 1/?.

Example 12.5

Suppose we start with a Monte Carlo algorithm that returns the correct answer with probability at least .55, so ? = .05. If we desire a Monte Carlo algorithm in which the probability of error is at most .05, then it suffices to take m = 230 and n = 461.

Let us combine all the reductions we have done. We have the following sequence of implications:

Since it is widely believed that there is no polynomial-time Monte Carlo algorithm for Quadratic Residues with small error probability, we have some evidence that the BBS Generator is secure.

We close this section by mentioning a way of improving the efficiency of the BBS Generator. The sequence of pseudo-random bits is constructed by taking the least significant bit of each si, where [image] mod n. Suppose instead that we extract the m least significant bits from each si. This will improve the efficiency of the PRBG by a factor of m, but we need to ask if the PRBG will remain secure. It has been shown that this approach will remain secure provided that m ? log2 log2 n. So we can extract about log2 log2 n pseudo-random bits per modular squaring. In a realistic implementation of the BBS Generator, [image], so we can extract nine bits per squaring.


12.4 Probabilistic Encryption

Probabilistic encryption is an idea of Goldwasser and Micali. One motivation is as follows. Suppose we have a public-key cryptosystem, and we wish to encrypt a single bit, i.e., x = 0 or 1. Since anyone can compute eK (0) and eK (1), it is a simple matter for an opponent to determine if a ciphertext y is an encryption of 0 or an encryption of 1. More generally, an opponent can always determine if the plaintext has a specified value by encrypting a hypothesized plaintext, hoping to match a given ciphertext.

The goal of probabilistic encryption is that “no information” about the plaintext should be computable from the ciphertext (in polynomial time). This objective can be realized by a public-key cryptosystem in which encryption is probabilistic rather than deterministic. Since there are “many” possible encryptions of each plaintext, it is not feasible to test whether a given ciphertext is an encryption of a particular plaintext.

Here is a formal mathematical definition of this concept.

DEFINITION 12.3 A probabilistic public-key cryptosystem is defined to be a six-tuple [image] where [image] is the set of plaintexts, [image] is the set of ciphertexts, [image] is the keyspace, [image] is a set of randomizers, and for each key [image], [image] is a public encryption rule and [image] is a secret decryption role. The following properties should be satisfied:

1. Each [image] and [image] are functions such that

for every plaintext [image] and every [image]. (In particular, this implies that [image].)

2. Let ? be a specified security parameter. For any fixed [image] and for any [image], define a probability distribution pK,x on [image], where pK,x(y) denotes the probability that y is the ciphertext given that K is the key and x is the plaintext (this probability is computed over all [image] ). Suppose [image], x ? x?, and [image]. Then the probability distributions pK,x and pK,x? are not ?-distinguishable.

Here is how the system works. To encrypt a plaintext x, choose a randomizer [image] and compute y = eK(x,r). Any such value y = eK(x,r) can be decrypted to x. Property 2 is stating that the probability distribution of all encryptions of x cannot be distinguished from the probability distribution of all encryptions of x? if x? ? x. Informally, an encryption of x “looks like” an encryption of x?. The security parameter ? should be small: in practice we would want to have [image] for some small c > 0.

We now present the Goldwasser-Micali Probabilistic Public-key Cryptosystem in Figure 12.9. This system encrypts one bit at a time. A 0 bit is encrypted to a random quadratic residue modulo n; a 1 bit is encrypted to a random pseudo-square modulo n. When Bob recieves an element [image] he can use his knowledge of the factorization of n to determine whether y ? QR(n) or whether [image]. He does this by computing

then

Figure 12.9 Goldwasser-Micali Probabilistic Public-key Cryptosystem

A more efficient probabilistic public-key cryptosystem was given by Blum and Goldwasser. The Blum-Goldwasser Probabilistic Public-key Cryptosystem is presented in Figure 12.10. The basic idea is as follows. A random seed s0 generates a sequence of [image] psuedorandom bits [image] using the BBS Generator. The zi’s are used as a keystream, i.e., the are exclusive-ored with the [image] plaintext bits to form the ciphertext. As well, the [image] element [image] mod n is transmitted as part of the ciphertext.

When Bob receives the ciphertext, he can compute s0 from [image], then reconstruct the keystream, and finally exclusive-or the keystream with the [image] ciphertext bits to obtain the plaintext. We should explain how Bob derives s0 from [image]. Recall that each si-1 is the principal square root of si. Now, n = pq with p ? q ? 3 mod 4, so the square roots of any quadratic residue x modulo p are ±x(p+1)/4. Using properties of Jacobi symbols, we have that

It follows that x(p+1)/4 is the principal square root of x modulo p. Similarly, x(q+1)/4 is the principal square root of x modulo q. Then, using the Chinese remainder theorem, we can find the principal square root of x modulo n.

Figure 12.10 Blum-Goldwasser Probabilistic Public-key Cryptosystem

More generally, [image] will be the principal [image] root of x modulo p and [image] will be the principal [image] root of x modulo q. Since [image] has order p - 1, we can reduce the exponent [image] modulo p - 1 in the computation [image] mod p. In a similar fashion, we can reduce the exponent [image] modulo q - 1. In Figure 12.10, having obtained the principal [image] roots of [image] modulo p and modulo q (steps 1-4 of the decryption process), the Chinese remainder theorem is used to compute the principal [image] root of [image] modulo n.

Here is an example to illustrate.

Example 12.6

Suppose n = 192649, as in Example 12.4. Suppose further that Alice chooses r = 20749 and wants to encrypt the 20-bit plaintext string

She will first compute the keystream

exactly as in Example 12.4, and then exclusive-or it with the plaintext, to obtain the ciphertext

which she transmits to Bob. She also computes

and sends it to Bob.

Of course Bob knows the factorization n = 383 ? 503, so (p + 1)/4 = 96 and (q + 1)/4 = 126. He begins by computing

and

Next, he calculates

and

Now Bob proceeds to solve the system of congruences

to obtain Alice’s seed r = 20749. Then he constructs Alice’s keystream from r. Finally, he exclusive-ors the keystream with the ciphertext to get the plaintext.


12.5 Notes and References

A lengthy treatment of PRBGs can be found in the book by Kranakis [KR86]. See also the survey paper by Lagarias [LA90].

The Shrinking Generator is due to Coppersmith, Krawczyk, and Mansour [CKM94]; another practical method of constructing PBRGs using LFSRs has been given by Gunther [GU88]. For methods of breaking the Linear Congruential Generator, see Boyar [BO89].

The basic theory of secure PRBGs is due to Yao [YA82], who proved the universality of the next bit test. Further basic results can be found in Blum and Micali [BM84]. The BBS Generator is described in [BBS86]. The security of the Quadratic Residues problem is studied by Goldwasser and Micali [GM84], on which we based much of Section 12.3.1. We have, however, used the approach of Brassard and Bratley [BB88A, Section 8.6] to reduce the error probability of an unbiased Monte Carlo algorithm.

Properties of the RSA Generator are studied in Alexi, Chor, Goldreich, and Schnorr [ACGS88]. PRBGs based on the Discrete Logarithm problem are treated in Blum and Micali [BM84], Long and Wigderson [LW88], and Hastad, Schrift, and Shamir [HSS93]. A sufficient condition for the secure extraction of multiple bits per iteration of a PRBG was proved by Vazirani and Vazirani [VV84].

Figure 12.11 Discrete Logarithm Generator

The idea of probabilistic encryption is due to Goldwasser and Micali [GM84]; the Blum-Goldwasser Cryptosystem is presented in [BG85].


Chapter 12 Exercises

Exercises

12.1 Consider the Linear Congruential Generator defined by si = (asi-1 + b) mod M. Suppose that M = qa + 1 where a is odd and q is even, and suppose that b = 1. Show that the next bit predictor Bi(z) = 1 - z for the i bit is an ?-next bit predictor, where

12.2 Suppose we have an RSA Generator with n = 36863, b = 229 and seed s0 = 25. Compute the first 100 bits produced by this generator.
12.3 A PRBG based on the Discrete Logarithm problem is given in Figure 12.11. Suppose p = 21383, the primitive element ? = 5 and the seed s0 = 15886. Compute the first 100 bits produced by this generator.
12.4 Suppose that Bob has knowledge of the factorization n = pq in the BBS Generator.

(a) Show how Bob can use this knowledge to compute any si from so with 2k multiplications modulo ?(n) and 2k multiplications modulo n, where n has k bits in its binary representation. (If i is large compared to k, then this approach represents a substantial improvement over the i multiplications required to sequentially compute s0, …, si.)
(b) Use this method to compute s10000 if n = 59701 = 227 ? 263 and s0 = 17995.

Table 12.4 Blum-Goldwasser Ciphertext
E1866663F17FDBD1DC8C8FD2EEBC36AD7F53795DBA3C9CE22D
C9A9C7E2A56455501399CA6B98AED22C346A529A09C1936C61
ECDE10B43D226EC683A669929F2FFB912BFA96A8302188C083
46119E4F61AD8D0829BD1CDE1E37DBA9BCE65F40C0BCE48A80
0B3D087D76ECD1805C65D9DB730B8D0943266D942CF04D7D4D
76BFA891FA21BE76F767F1D5DCC7E3F1D86E39A9348B3
12.5 We proved that, in order to reduce the error probability of an unbiased Monte Carlo algorithm from 1/2 - ? to ?, where ? + ? < 1/2, it suffices to run the algorithm m times, where

Prove that this value of m is O(1/(??2).

12.6 Suppose Bob receives some ciphertext which was encrypted with the Blum-Goldwasser Probabilistic Public-key Cryptosystem. The original plaintext consisted of English text. Each alphabetic character was converted to a bitstring of length five in the obvious way: A - 00000, B - 00001, …, Z - 11001. The plaintext consisted of 236 alphabetic characters, so a bitstring of length 1180 resulted. This bitstring was then encrypted. The resulting ciphertext bitstring was then converted to a hexadecimal representation, to save space. The final string of 295 hexadecimal characters is presented in Table 12.4. Also, s1181 = 20291 is part of the ciphertext, and n = 29893 is Bob’s public key. Bob’s secret factorization of n is n = pq, where p = 167 and q = 179.

Your task is to decrypt the given ciphertext and restore the original English plaintext, which was taken from “Under the Hammer,” by John Mortimer, Penguin Books, 1994.


Chapter 13 Zero-knowledge Proofs

Chapter 13
Zero-knowledge Proofs

13.1 Interactive Proof Systems

Very informally, a zero-knowledge proof system allows one person to convince another person of some fact without revealing any information about the proof. We first discuss the idea of an interactive proof system. In an interactive proof system, there are two participants, Peggy and Vic. Peggy is the prover and Vic is the verifier. Peggy knows some fact, and she wishes to prove to Vic that she does.

It is necessary to describe the kinds of computations that Peggy and Vic will be allowed to perform, and also to describe the interaction that takes place. It is convenient to think of both Peggy and Vic as being probabilistic algorithms. Peggy and Vic will each perform private computations, and each of them has a private random number generator. They will communicate to each other through a communication channel. Initially, Peggy and Vic both possess an input x. The object of the interactive proof is for Peggy to convince Vic that x has some specified property. More precisely, x will be a yes-instance of a specified decision problem II.

The interactive proof, which is a challenge-and-response protocol, consists of a specified number of rounds. During each round, Peggy and Vic alternately do the following:

1. receive a message from the other party
2. perform a private computation
3. send a message to the other party.

A typical round of the protocol will consist of a challenge by Vic, and a response by Peggy. At the end of the proof, Vic either accepts or rejects, depending on whether or not Peggy successfully replies to all of Vic’s challenges. We define the protocol to be an interactive proof system for the decision problem II if the following two properties are satisfied whenever Vic follows the protocol:

Figure 13.1 Graph Isomorphism

completeness
If x is a yes-instance of the decision problem II, then Vic will always accept Peggy’s proof.
soundness
If x is a no-instance of II, then the probability that Vic accepts the proof is very small.

We will restrict our attention to interactive proof systems in which the computations performed by Vic can be done in polynomial time. On the other hand, we do not place any bound on the computation time required by Peggy (informally, Peggy is “all-powerful”).

We begin by presenting an interactive proof system for the problem of Graph Non-isomorphism. The Graph Isomorphism problem is described in Figure 13.1. This is an interesting problem since no polynomial-time algorithm to solve it is known, but it is not known to be NP-complete.

We will present an interactive proof system which will allow Peggy to “prove” to Vic that two specified graphs are not isomorphic. For simplicity, let us suppose that G1 and G2 each have vertex set {1, …, n}. The interactive proof system for Graph Non-isomorphism is presented in Figure 13.2.

We present a toy example.

Example 13.1

Suppose G1 = (V, E1) and G2 = (V, E2), where V = {1, 2, 3, 4}, E1 = {12, 14, 23, 34} and E2 = {12, 13, 14, 34}.

Suppose in some round of the protocol that Vic gives Peggy the graph H = (V, E3), where E3 = {13, 14, 23, 24} (see Figure 13.3). The graph H is isomorphic to G1 (one isomorphism from H to G1 is the permutation (1 3 4 2)). So Peggy answers “1.”

It is easy to see that this proof system satisfies the completeness and soundness properties. If G1 is not isomorphic to G2, then j will equal i in every round, and Vic will accept with probability 1. Hence, the protocol is complete.

Figure 13.2 An interactive proof system for Graph Non-isomorphism

Figure 13.3 Peggy’s non-isomorphic graphs and Vic’s challenge

On the other hand, suppose that G1 is isomorphic to G2. Then any challenge graph H submitted by Vic is isomorphic to both G1 and G2. Peggy has no way of determining if Vic constructed H as an isomorphic copy of G1 or of G2, so she can do no better than make a guess j = 1 or 2 for her response. The only way that Vic will accept is if Peggy is able to guess all n choices of i made by Vic. Her probability of doing this is 2-n. Hence, the protocol is sound.

Notice that Vic’s computations are all polynomial-time. We cannot say anything about Peggy’s computation time since the Graph Isomorphism problem is not known to be solvable in polynomial time. However, recall that we assumed that Peggy has infinite computing power, so this is allowed under the “rules of the game.”


13.2 Perfect Zero-knowledge Proofs

Although interactive proof systems are of interest in their own right, the most interesting type of interactive proof is a zero-knowledge proof. This is one in which Peggy convinces Vic that x possesses some specified property, but at the end of the protocol, Vic still has no idea of how to prove (himself) that x has this property. This is a very tricky concept to define formally, and we present an example before attempting any definitions.

In Figure 13.4, we present a zero-knowledge interactive proof for Graph Isomorphism. A small example will illustrate the workings of the protocol.

Example 13.2

Suppose G1 = (V, E1) and G2 = (V, E2), where V = {1, 2, 3, 4}, E1 = {12, 13, 14, 34} and E2 = {12, 13, 23, 24}. One isomorphism from G2 to G1 is the permutation ? = (4 1 3 2).

Now suppose in some round of the protocol that Peggy chooses the permutation ? = (2 4 1 3). Then H has edge set {12, 13, 23, 24} (see Figure 13.5).

If Vic’s challenge is i = 1, then Peggy gives Vic the permutation ? and Vic checks that the image of G1 under ? is H. If Vic’s challenge is i = 2, then Peggy gives Vic the composition ? = ? ? = (3 2 1 4) and Vic checks that the image of G2 under ? is H.

Completeness and soundness of the protocol are easy to verify. It is easy to see that the probablity that Vic accepts is 1 if G1 is isomorphic to G2. On the other hand, if G1 is not isomorphic to G2, then the only way for Peggy to deceive Vic is for her to correctly guess the value i that Vic will choose in each round, and write a (random) isomorphic copy of Gi on the communication tape. Her probability of correctly guessing Vic’s n random challenges is 2-n.

Figure 13.4 A perfect zero-knowledge interactive proof system for Graph Isomorphism

Figure 13.5 Peggy’s isomorphic graphs

All of Vic’s computations can be done in polynomial time (as a function of n, the number of vertices in G1 and G2). Although it is not necessary, notice that Peggy’s computations can also be done in polynomial time provided that she knows the existence of one permutation a such that the image of G2 under ? is G1.

Why would we refer to this proof system as a zero-knowledge proof? The reason is that, although Vic is convinced that G1 is isomorphic to G2, he does not gain any “knowledge” that would help him find a permutation ? that carries G2 to G1. All he sees in each round of the proof is a random isomorphic copy H of the graphs G1 and G2, together with a permutation that carries G1 to H or G2 to H (but not both!). But Vic can compute random isomorphic copies of these graphs by himself, without any help from Peggy. Since the graphs H are chosen independently and at random in each round of the proof, it seems unlikely that this will help Vic find an isomorphism from G1 to G2.

Let us look carefully at the information that Vic obtains by participating in the interactive proof system. We can represent Vic’s view of the interactive proof by means of a transcript that contains the following information:

1. the graphs G1 and G2
2. all the messages that are transmitted by both Peggy and Vic
3. the random numbers used by Vic to generate his challenges.

Hence, a transcript T for the above interactive proof of Graph Isomorphism would have the following form:

The essential point, which is the basis for the formal definition of zero-knowledge proof, is that Vic (or anyone else) can forge transcripts — without participating in the interactive proof — that “look like” real transcripts. This can be done provided that the input graphs G1 and G2 are isomorphic. Forging is accomplished by means of the algorithm presented in Figure 13.6. The forging algorithm is a polynomial-time probabilistic algorithm. In the vernacular of zero-knowledge proofs, a forging algorithm is often called a simulator.

The fact that a simulator can forge transcripts has a very important consequence. Anything that Vic (or anyone else) can compute from the transcript could also be computed from a forged transcript. Hence, participating in the proof system does not increase Vic’s ability to perform any computation; and in particular, it does not enable Vic himself to “prove” that G1 and G2 are isomorphic. Moreover, Vic cannot subsequently convince someone else that G1 and G2 are isomorphic by showing them the transcript T, since there is no way to distinguish a legitimate transcript from one that has been forged.

We still have to make precise the idea that a forged transcript “looks like” a real one. We give a rigorous definition in terms of probability distributions.

Figure 13.6 Forging algorithm for transcripts for Graph Isomorphism

DEFINITION 13.1 Suppose that we have a polynomial-time interactive proof system for a decision problem II, and a polynomial-time simulator S. Denote the set of all possible transcripts that could be produced as a result of Peggy and Vic carrying out the interactive proof with a yes-instance x by [image], and denote the the set of all possible forged transcripts that could be produced by S by [image]. For any transcript [image], let [image] denote the probability that T is the transcript produced from the interactive proof. Similarly, for [image], let [image] denote the probability that T is the (forged) transcript produced by S. Suppose that [image], and for any [image], suppose that [image]. (In other words, the set of real transcripts is identical to the set of forged transcripts, and the two probability distributions are identical.) Then we define the interactive proof system to be perfect zero-knowledge for Vic.

Of course we can define zero-knowledge however we like. But it is important that the definition captures our intuitive concept of what “zero-knowledge” should mean. We are saying that an interactive proof system is zero-knowlege for Vic if there exists a simulator that produces transcripts with an identical probability distribution to those produced when Vic actually takes part in the protocol. (This is a related but stronger concept than that of indistinguishable probability distributions that we studied in Chapter 12.) We have observed that a transcript contains all the information gained by Vic by taking part in the protocol. So it should seem reasonable to say that whatever Vic might be able to do after taking part in the protocol he could equally well do by just using the simulator to generate a forged transcript. We are perhaps not defining “knowledge” by this approach; but whatever “knowledge” might be, Vic doesn’t gain any!

We will now prove that the interactive proof system for Graph Isomorphism is perfect zero-knowledge for Vic.

THEOREM 13.1

The interactive proof system for Graph Isomorphism is perfect zero-knowledge for Vic.

PROOF Suppose that G1 and G2 are isomorphic graphs on n vertices. A transcript T (real or forged) contains n triples of the form (H, i, p), where i = 1 or 2, ? is a permutation of {1, …, n}, and H is the image of Gi under the permutation ?. Call such a triple a valid triple and denote by [image] the set of all valid triples. We begin by computing [image], the number of valid triples. Evidently [image] since each choice of i and p determines a unique graph H.

In any given round, say j, of the forging algorithm, it is clear that each valid triple (H, i, p) occurs with equal probability 1/(2 ? n!). What is the probability that the valid triple (H, i, p) is the jth triple on a real transcript? In the interactive proof system, Peggy first chooses a random permutation ? and then computes H to be the image of G1 under ?. The permutation ? is defined to be ? if i = 1, and it is defined to be the composition of the two permutations ? and ? if i = 2.

We are assuming that the value of i is chosen at random by Vic. If i = 1, then all n! permutations ? are equiprobable, since ? = ? in this case and ? was chosen to be a random permutation. On the other hand, if i = 2, then p = ? ?, where ? is random and ? is fixed. In this case as well, every possible permutation ? is equally probable. Now, since the two cases i = 1 and 2 are equally probable, and each permutation ? is equally probable (independent of the value of i), and since i and p together determine H, it follows that all triples in [image] are equally likely.

Since a transcript consists of the concatenation of n independent random triples, it follows that

for every possible transcript T.

The proof of Theorem 13.1 assumes that Vic follows the protocol when he takes part in the interactive proof system. The situation is much more subtle if Vic does not follow the protocol. Is it true that an interactive proof remains zero-knowledge even if Vic deviates from the protocol?

In the case of Graph Isomorphism, the only way that Vic can deviate from the protocol is to choose his challenges i in a non-random way. Intuitively, it seems that this does not provide Vic with any “knowledge.” However, transcripts produced by the simulator will not “look like” transcripts produced by Vic if he deviates from the protocol. For example, suppose Vic chooses i = 1 in every round of the proof. Then a transcript of the interactive proof will have ij = 1 for 1 ? j ? n; whereas a transcript produced by the simulator will have ij = 1 for 1 ? j ? n only with probability 2-n.

The way around this difficulty is to show that, no matter how a “cheating” Vic deviates from the protocol, there exists a polynomial-time simulator that will produce forged transcripts that “look like” the transcripts produced by Peggy and (the cheating) Vic during the interactive proof. As before, the phrase “looks like” is formalized by saying that two probability distributions are identical.

Here is a more formal definition.

DEFINITION 13.2 Suppose that we have a polynomial-time interactive proof system for a given decision problem II. Let V* be any polynomial-time probabilistic algorithm that (a possibly cheating) verifier uses to generate his challenges. (That is, V* represents either an honest or cheating verifier.) Denote the set of all possible transcripts that could be produced as a result of Peggy and V* carrying out the interactive proof with a yes-instance x of II by [image]. Suppose that, for every such V*, there exists an expected polynomial-time probabilistic algorithm S* = S*(V*) (the simulator) which will produce a forged transcript. Denote the set of possible forged transcripts by [image]. For any transcript [image], let [image] denote the probability that T is the transcript produced by V* taking part in the interactive proof. Similarly, for [image], let [image] denote the probability that T is the (forged) transcript produced by S*. Suppose that [image], and for any [image], suppose that [image]. Then the interactive proof system is said to be perfect zero-knowledge (without qualification).

In the special case where V* is the same as Vic (i.e., when Vic is honest), the above definition is exactly the same as what we defined as “perfect zero-knowledge for Vic.”

In order to prove that a proof system is perfect zero-knowledge, we need a generic transformation which will construct a simulator S* from any V*. We proceed to do this for the proof system for Graph Isomorphism. The simulator will play the part of Peggy, using V* as a “restartable subroutine.” Informally, S* tries to guess the challenge ij that V* will make in each round j. That is, S* generates a random valid triple of the form (Hj, ij, ?j), and then executes the algorithm V* to see what its challenge is for round j. If the guess ij is the same as the challenge i?j (as produced by V*), then the triple (Hj, ij, ?j) is appended to the forged transcript. If not, then this triple is discarded, S* guesses a new challenge ij, and the algorithm V* is restarted after resetting its “state” to the way it was at the beginning of the current round. By the term “state” we mean the values of all variables used by the algorithm.

We now give a more detailed description of the simulation algorithm S*. At any given time during the execution of the program V*, the current state of V* will be denoted by state(V*). A pseudo-code description of the simulation algorithm is given in Figure 13.7.

It is possible that the simulator will run forever, if it never happens that ij = i?j. However, we can show that the average running time of the simulator is polynomial, and that the two probability distributions [image] and [image] are identical.

Figure 13.7 Forging algorithm for V* for transcripts for Graph Isomorphism

THEOREM 13.2

The interactive proof system for Graph Isomorphism is perfect zero-knowledge.

PROOF First, we observe that, regardless of how V* generates its challenges, the probability that the guess ij of S* is the same as the challenge i?j is 1/2. Hence, on average, S* will generate two triples for every triple that it concatenates to the forged transcript. Hence, the average running time is polynomial in n.

The more difficult task is to show that the two probability distributions [image] and [image] are identical. In Theorem 13.1, where Vic was honest, we were able to compute the two probability distributions and see that they were identical. We also used the fact that triples (H, i, ?) generated in different rounds of the proof are independent. However, in the current setting, we have no way of explicitly computing the two probability distributions. Further, triples generated in different rounds of the proof need not be independent. For example, the challenge that V* presents in round j may depend in some very complicated way on challenges from previous rounds and on the way Peggy replied to those challenges.

The way to handle these difficulties is to look at the probability distributions on the possible partial transcripts during the course of the simulation or interactive proof, and proceed by induction on the number of rounds. For 0 ? j ? n, we define probability distributions [image] and [image] on the set of partial transcripts [image] that could occur at the end of round j. Notice that [image] and [image]. Hence, if we can show that the two distributions [image] and [image] are identical for all j, then we will be done.

The case j = 0 corresponds to the beginning of the algorithm; at this point the transcript contains only the two graphs G1 and G2. Hence, the probability distributions are identical when j = 0. We use this for the start of the induction.

We make an inductive hypothesis that the two probability distributions [image] and [image] on [image] are identical, for some j ? 1. We now prove that the two probability distributions [image] and [image] on [image] are identical.

Consider what happens during round j of the interactive proof. The probability that V*’s challenge i?j = 1 is some real number p1 and the probability that his challenge i?j = 2 is 1 - p1, where p1 depends on the state of the algorithm V* at the beginning of round j. We noted earlier that in the interactive proof, all possible graphs H are chosen by Peggy with equal probability. As well, any permutation ? occurs with equal probability, independent of the value of p1, since all permutations are equally likely for either possible challenge i?j. Hence, the probability that the jth triple on the transcript is (H, i, ?) is p1/n! if i = 1, and (1 - p1)/n! if i = 2.

Next, let’s do a similar analysis for the simulation. In any given iteration of the repeat loop, S* will choose any graph H with probability 1/n!. The probability that ij = 1 and V*’s challenge is 1 is p1/2; and the probability that ij = 2 and V*’s challenge is 2 is (1 - p1)/2. In each of these situations, (H, ij, ?) is written as the jth triple on the transcript. With probability 1/2, nothing is written on the tape during any given iteration of the repeat loop.

Let us first consider the case ij = 1. As mentioned above, the probability that V*’s challenge is 1 is p1. The probability that a triple (H, 1, ?) is written as the jth triple on the transcript during the [image] iteration of the repeat loop is

Hence, the probability that (H, 1, ?) is the jth triple on the transcript is

The case ij = 2 is analyzed in a similar fashion: the probability that (H, 2, ?) is written as the jth triple on the transcript is (1 - p1)/n!

Hence, the two probability distributions on the partial transcripts at the end of round j are identical. By induction, the two probability distribution [image] and [image] are identical, and the proof is complete.

It is interesting also to look at the interactive proof system for Graph Non-isomorphism. It is not too difficult to prove that this proof is perfect zero-knowledge if Vic follows the protocol (i.e., if Vic chooses each challenge graph to be a random isomorphic copy of Gi where i = 1 or 2 is chosen at random). Further, provided that Vic constructs each challenge graph by taking an isomorphic copy of either G1 or G2, the protocol remains zero-knowledge even if Vic chooses his challenges in a non-random fashion. However, suppose that our ubiquitous troublemaker, Oscar, gives a graph H to Vic which is isomorphic to one of G1 or G2, but Vic does not know which Gi is isomorphic to H. If Vic uses this H as one of his challenge graphs in the interactive proof system, then Peggy will give Vic an isomorphism he didn’t previously know, and (possibly) couldn’t figure out for himself. In this situation, the proof system is (intuitively) not zero-knowledge, and it does not seem likely that a transcript could be forged by a simulator.

Figure 13.8 A perfect zero-knowledge interactive proof system for Quadratic Residues

It is possible to alter the proof of Graph Non-isomorphism so it is perfect zero-knowledge, but we will not go into the details.

We now present some other examples of perfect zero-knowledge proofs. A perfect zero-knowledge proof for Quadratic Residues (modulo n = pq, where p and q are prime) is given in Figure 13.8. Peggy is proving that x is a quadratic residue. In each round, she generates a random quadratic residue y and sends it to Vic. Then, depending on Vic’s challenge, Peggy either gives Vic a square root of y or a square root of xy.

Figure 13.9 Subgroup Membership

It is clear that the protocol is complete. To prove soundness, observe that if x is not a quadratic residue, then Peggy can answer only one of the two possible challenges since, in this case, y is a quadratic residue if and only if xy is not a quadratic residue. So Peggy will be caught in any given round of the protocol with probability 1/2, and her probability of deceiving Vic in all log2 n rounds is only [image]. (The reason for having log2 n rounds is that the size of the problem instance is proportional to the number of bits in the binary representation of n, which is log2 n. Hence, the deception probability for Peggy is exponentially small as a function of the size of the problem instance, as in the zero-knowledge proof for Graph Isomorphism.)

Perfect zero-knowledge for Vic can be shown in a similar manner as was done for Graph Isomorphism. Vic can generate a triple (y, i, z) by first choosing i and z, and then defining

Triples generated in this fashion have exactly the same probability distribution as those generated during the protocol, assuming Vic chooses his challenges at random. Perfect zero-knowledge (for an arbitrary V*) is proved by following the same strategy as for Graph Isomorphism. It requires building a simulator S* that guesses V*’s challenges and keeps only the triples where the guesses are correct.

We now present one more example of a perfect zero-knowledge proof, this one for a decision problem related to the Discrete Logarithm problem. The problem, which we call Subgroup Membership, is defined in Figure 13.9. Of course, the integer k (if it exists) is just the discrete logarithm of ?.

We present a perfect zero-knowledge proof for Subgroup Membership in Figure 13.10. The analysis of this protocol is similar to the others that we have looked at; the details are left to the reader.

Figure 13.10 A perfect zero-knowledge interactive proof system for Subgroup Membership


13.3 Bit Commitments

The zero-knowledge proof system for Graph Isomorphism is interesting, but it would be more useful to have zero-knowledge proof systems for problems that are known to be NP-complete. There is theoretical evidence that perfect zero-knowledge proofs do not exist for NP-complete problems. However, we can describe proof systems that attain a slightly weaker form of zero-knowledge called computational zero-knowledge. The actual proof systems are described in the next section; in this section we describe the technique of bit commitment that is an essential tool used in the proof system.

Suppose Peggy writes a message on a piece of paper, and then places the message in a safe for which she knows the combination. Peggy then gives the safe to Vic. Even though Vic doesn’t know what the message is until the safe is opened, we would agree that Peggy is committed to her message because she cannot change it. Further, Vic cannot learn what the message is (assuming he doesn’t know the combination of the safe) unless Peggy opens the safe for him. (Recall that we used a similar analogy in Chapter 4 to describe the idea of a public-key cryptosystem, but in that case, it was the recipient of the message, Vic, who could open the safe.)

Suppose the message is a bit b = 0 or 1, and Peggy encrypts b in some way. The encrypted form of b is sometimes called a blob and the encryption method is called a bit commitment scheme. In general, a bit commitment scheme will be a function f : {0, 1} ? X > Y, where X and Y are finite sets. An encryption of b is any value f(b, x), x ? X. We can informally define two properties that a bit commitment scheme should satisfy:

concealing
For a bit b = 0 or 1, Vic cannot determine the value of b from the blob f(b, x).
binding
Peggy can later “open” the blob, by revealing the value of x used to encrypt b, to convince Vic that b was the value encrypted. Peggy should not be able to open a blob as both a 0 and a 1.

If Peggy wants to commit any bitstring, she simply commits every bit independently.

One way to perform bit commitment is to use the Goldwasser-Micali Probabilistic Cryptosystem described in Section 12.4. Recall that in this system, n = pq, where p and q are primes, and [image]. The integers n and m are public; the factorization n = pq is known only to Peggy. In our bit commitment scheme, we have [image] and

Peggy encrypts a value b by choosing a random x and computing y = f(b, x); the value y comprises the blob.

Later, when Peggy wants to open y, she reveals the values b and x. Then Vic can verify that

Let us think about the concealing and binding properties. A blob is an encryption of 0 or of 1, and reveals no information about the plaintext value x provided that the Quadratic Residues problem is infeasible (we discussed this at length in Chapter 12). Hence, the scheme is concealing.

Is the scheme binding? Let us suppose not; then

for some [image]. But then

which is a contradiction since [image].

We will be using bit commitment schemes to construct zero-knowledge proofs. However, they have another nice application, to the problem of coin-flipping by telephone. Suppose Alice and Bob want to make some decision based on a random coin flip, but they are not in the same place. This means that it is impossible for one of them to flip a real coin and have the other verify it. A bit commitment scheme provides a way out of this dilemma. One of them, say Alice, chooses a random bit b, and computes a blob, y. She gives y to Bob. Now Bob guesses the value of b, and then Alice opens the blob to reveal b. The concealing property means that it is infeasible for Bob to compute b given y, and the binding property means that Alice can’t “change her mind” after Bob reveals his guess.

We now give another example of a bit commitment scheme, this time based on the Discrete Logarithm problem. Recall from Section 5.1.2 that if p = 3 (mod 4) is a prime such that the Discrete Logarithm problem in [image] is infeasible, then the second least significant bit of a discrete logarithm is secure. Actually, it has been proved for primes p ? 3 (mod 4) that any Monte Carlo algorithm for the Second Bit problem having error probability 1/2 = ? with ? > 0 can be used to solve the Discrete Log problem in [image]. This much stronger result is the basis for the bit commitment scheme.

This bit commitment scheme will have X = {1, …, p - 1} and [image]. The second least significant bit of an integer x, denoted by SLB(x), is defined as follows:

The bit commitment scheme f is defined by

In other words, a bit b is encrypted by choosing a random element having second last bit b, and raising ? to that power modulo p. (Note that SLB(p - x) ? SLB (x) since p ? 3 (mod 4).)

The scheme is binding, and by the remarks made above, it is concealing provided that the Discrete Logarithm problem in [image] is infeasible.


13.4 Computational Zero-knowledge Proofs

In this section, we give a zero-knowledge proof system for the NP-complete decision problem Graph 3-Colorability, which is defined in Figure 13.11. The proof system uses a bit commitment scheme; to be specific, we will employ the bit commitment scheme presented in Section 13.3 that is based on probabilistic encryption. We assume that Peggy knows a 3-coloring ? of a graph G, and she wants to convince Vic that G is 3-colorable in a zero-knowledge fashion. Without loss of generality, we assume that G has vertex set V = {1, …, n}. Denote m = |E|. The proof system will be described in terms of a commitment scheme f : {0, 1} x X > Y which is made public. Since we want to encrypt a color rather than a bit, we will replace the color 1 by the two bits 01, the color 2 by 10 and the color 3 by 11. Then we encrypt each of the two bits representing the color by using f.

Figure 13.11 Graph 3-Colorability

The interactive proof system is presented in Figure 13.12. Informally, what happens is the following. In each round, Peggy commits a coloring that is a permutation of the fixed coloring ?. Vic requests that Peggy open the blobs corresponding to the endpoints of some randomly chosen edge. Peggy does so, and then Vic checks that the commitments are as claimed and that the two colors are different. Notice that all Vic’s computations are polynomial-time, and so are Peggy’s, provided that she knows the existence of one 3-coloring ?.

Here is a very small example to illustrate.

Example 13.3

Suppose G is the graph (V, E), where

and

Suppose that Peggy knows the 3-coloring ? where ?(1) = 1, ?(2) = ?(4) = 2 and ?(3) = ?(5) = 3. Suppose also that the bit commitment scheme is defined as f(b, x) = 156897bx2 mod 321389, where b = 0, 1 and [image].

Suppose that Peggy chooses the permutation ? = (1 3 2) in some round of the proof. Then she computes:

Figure 13.12 A computational zero-knowledge interactive proof system for Graph 3-colorability

She will encode this coloring in binary as the 10-tuple

0111101110

and then compute commitments of these ten bits. Suppose that she does this as follows:

Then Peggy gives Vic the ten values f(b, x) computed above.

Next, suppose that Vic chooses the edge 34 as his challenge. Then Peggy opens four blobs: the two that correspond to vertex 3 and the two that correspond to vertex 4. So Peggy gives Vic the ordered pairs

Vic will first check that the two colors are distinct: 10 encodes color 2 and 11 encodes color 3, so this is all right. Next, Vic verifies that the four commitments are valid and hence this round of the proof is completed successfully.

As in previous proof systems we have studied, Vic will accept a valid proof with probability 1, so we have completeness. What is the probability that Vic will accept if G is not 3-colorable? In this case, for any coloring, there must be at least one edge ij such that i and j have the same color. Vic’s chances of choosing such an edge are at least 1/m. Peggy’s probability of fooling Vic in all m2 rounds is at most

Since (1 - 1/m)m > e-1 as m ?, there exists an integer m0 such that (1 - 1/m)m ? 2/e for m ? m0. Hence [image]. Since (2/e)m approaches zero exponentially quickly as a function of m = |E|, we have soundness as well.

Let’s now turn to the zero-knowledge aspect of the proof system. All that Vic sees in any given round of the protocol is an encrypted 3-colouring of G, together with the two distinct colours of the endpoints of one particular edge, as previously committed by Peggy. Since the colors are permuted in each round, it seems that Vic cannot combine information from different rounds to reconstruct the 3-coloring.

The proof system is not perfect zero-knowledge, but it does provide a weaker form of zero-knowledge called computational zero-knowledge. Computational zero-knowledge is defined exactly as perfect zero-knowledge, except that the relevant probability distributions of transcripts are required only to be polynomially indistinguishable (in the sense of Chapter 12) rather than identical.

We begin by showing how transcripts can be forged. We give an explicit algorithm that will forge transcripts that cannot be distinguished from those produced by an honest Vic. If Vic deviates from the protocol, then it is possible to construct a simulator which uses the algorithm V* as a restartable subroutine to construct forged transcripts. Both forging algorithms follow the pattern of the related algorithms for the Graph Isomorphism proof system.

Here, we consider only the case where Vic follows the protocol. A transcript T for the interactive proof of Graph 3-colorability would have the form

where Aj consists of 2n blobs computed by Peggy, the edge uv chosen by Vic, the colors assigned by Peggy in round j to u and v, and the four random numbers used by Peggy to encrypt the colors of these two vertices. A transcript is forged by means of the forging algorithm presented in Figure 13.13.

Proving (computational) zero-knowledge for Vic requires showing that the two probability distributions on transcripts (as produced by the Vic taking part in the protocol, and as produced by the simulator) are indistinguishable. We will not do this here, but we will make a couple of comments. Notice that the two probability distributions are not identical. This is because virtually all the Rij’s in a forged transcript are blobs encrypting 1; whereas the Rij’s on a real transcript will (usually) be encryptions of more equal numbers of 0’s and 1’s. However, it is possible to show that the two probability distributions cannot be distinguished in polynomial time, provided that the underlying bit commitment scheme is secure. More precisely, this means that the probability distribution on blobs encrypting color c are indistinguishable from the probability distribution on blobs encrypting color d if c ? d.

Readers familiar with NP-completeness theory will realize that, having given a zero-knowledge proof for one particular NP-complete problem, we can obtain a zero-knowledge proof for any other problem in NP. This can be done by applying a polynomial transformation from a given problem in NP to the Graph 3-coloring problem.

Figure 13.13 Forging algorithm for transcripts for Graph 3-colorability


13.5 Zero-knowledge Arguments

Let us recap the basic properties of the computational zero-knowledge proof for Graph 3-colorability presented in the last section. No assumptions are needed to prove completeness and soundness of the protocol. A computational assumption is needed to prove zero-knowledge, namely that the underlying bit commitment scheme is secure. Observe that if Peggy and Vic take part in the protocol, then Vic may later try to break the bit commitment scheme that was used in the protocol (for example, if the scheme based on quadratic residuosity were used, then Vic would try to factor the modulus). If at any future time Vic can break the bit commitment scheme, then he can decrypt the blobs used by Peggy in the protocol and extract the 3-coloring.

This analysis depends on the properties of the blobs that were used in the protocol. Although the binding property of the blobs is unconditional, the concealing property relies on a computational assumption.

An interesting variation is to use blobs in which the concealing property is unconditional but the binding property requires a computational assumption. This leads to a protocol that is known as a zero-knowledge argument rather than a zero-knowledge proof. The reader will recall that we have assumed up until now that Peggy is all-powerful; in a zero-knowledge argument we will assume that Peggy’s computations are required to be polynomial-time. (In fact, this assumption creates no difficulties, for we have already observed that Peggy’s computations are polynomial-time provided she knows one 3-coloring of G.)

Let us begin by describing a couple of bit commitment schemes of this type and then examine the ramifications of using them in the protocol for Graph 3-coloring.

The first scheme is (again) based on the Quadratic Residues problem. Suppose n = pq, where p and q are prime, and let m ? QR(n) (note that in the previous scheme m was a pseudo-square). In this scheme neither the factorization of n nor the square root of m should be known to Peggy. So either Vic should construct these values or they should be obtained from a (trusted) third party.

Let [image] and Y = QR(n), and define

As before, Peggy encrypts a value b by choosing a random x and computing the blob y = f(b, x). In this scheme all the blobs are quadratic residues. Further, any y ? QR(n) is both an encryption of 0 and an encryption of 1. For suppose y = x2 mod n and m = k2 mod n. Then

This means that the concealing property is achieved unconditionally. On the other hand, what happens to the binding property? Peggy can open any given blob both as a 0 and as a 1 if and only if she can compute k, a square root of m. So, in order for the scheme to be (computationally) binding, we need to make the assumption that it is infeasible for Peggy to compute a square root of m. (If Peggy were all-powerful, then she could, of course, do this. This is one reason why we are now assuming that Peggy is computationally bounded.)

As a second bit commitment scheme of this type, we give an example of a scheme based on the Discrete Logarithm problem. Let p be a prime such that the discrete log problem in [image] is infeasible, let ? be a primitive element of [image] and let [image]. The value of ? should be chosen by Vic, or by a trusted third party, rather than by Peggy. This scheme will have [image], and f is defined by

It is not hard to see that this scheme is unconditionally concealing, and it is binding if and only if it is infeasible for Peggy to compute the discrete logarithm log? ?.

Now, suppose we use one of these two bit commitment schemes in the protocol for Graph 3-colorability. It is easy to see that the protocol remains complete. But now the soundness condition depends on a computational assumption: the protocol is sound if and only if the bit commitment scheme is binding. What happens to the zero-knowledge aspect of the protocol? Because the bit commitment scheme is unconditionally concealing, the protocol is now perfect zero-knowledge rather than just computational zero-knowledge. Thus we have a perfect zero-knowledge argument.

Table 13.1 Comparison of Properties of Proofs and Arguments
property | zero-knowledge proof | zero-knowledge argument
completeness | unconditional | unconditional
soundness | unconditional | computational
zero-knowledge | computational | perfect
binding blobs | unconditional | computational
concealing blobs | computational | unconditional

Whether one prefers an argument to a proof depends on the application, and whether one wants to make a computational assumption regarding Peggy or Vic. A comparison of the properties of proofs and arguments is summarized in Table 13.1. In the column “zero-knowledge proof,” the computational assumptions pertain to Peggy’s computing power; in the column “zero-knowledge argument,” the computational assumptions refer to Vic’s computing power.


13.6 Notes and References

Most of the material in this chapter is based on Brassard, Chaum, and Crepeau [BCC88] and on Goldreich, Micali, and Wigderson [GMW91]. The bit commitment schemes we present, and a thorough discussion of the differences between proofs and arguments, can be found in [BCC88] (however, note that the term “argument” was first used in [BC90]). Zero-knowledge proofs for Graph Isomorphism, Graph Non-isomorphism and Graph 3-colorability can be found in [GMW91]. Another relevant paper is Goldwasser, Micali, and Rackoff [GMR89], in which interactive proof systems are first defined formally. The zero-knowledge proof for Quadratic Residues is from this paper.

The idea of coin-flipping by telephone is due to Blum [BL82].

A very informal and entertaining illustration of the concept of zero-knowledge is presented by Quisquater and Guillou [QG90]. Also, see Johnson [JO88] for a more mathematical survey of interactive proof systems.

Figure 13.14 An interactive proof system for Quadratic Non-residues


Chapter 13 Exercises

Exercises

13.1 Consider the interactive proof system for the problem Quadratic Non-residues presented in Figure 13.14. Prove that the system is sound and complete, and explain why the protocol is not zero-knowledge.
13.2 Devise an interactive proof system for the problem Subgroup Non-membership. Prove that your protocol is sound and complete.
13.3 Consider the zero-knowledge proof for Quadratic Residues that was presented in Figure 13.8.

(a) Define a valid triple to be one having the form (y, i, z), where y ? QR(n), i = 0 or 1, [image] and z2 ? xiy (mod n). Show that the number of valid triples is 2(p - 1)(q - 1), and each such triple is generated with equal probability if Peggy and Vic follow the protocol.
(b) Show that Vic can generate triples having the same probability distribution without knowing the factorization n = pq.
(c) Prove that the protocol is perfect zero-knowledge for Vic.

13.4 Consider the zero-knowledge proof for Subgroup Membership that was presented in Figure 13.10.

(a) Prove that the protocol is sound and complete.
(b) Define a valid triple to be one having the form (?, i, h), where [image], i = 0 or 1, 0 ? h ? - 1 and ?h ? ?i? (mod n). Show that the number of valid triples is [image], and each such triple is generated with equal probability if Peggy and Vic follow the protocol.
(c) Show that Vic can generate triples having the same probability distribution without knowing the discrete logarithm log? ?.
(d) Prove that the protocol is perfect zero-knowledge for Vic.

13.5 Prove that the Discrete Logarithm bit commitment scheme presented in Section 13.5 is unconditionally concealing, and prove that it is binding if and only if Peggy cannot compute log? ?.
13.6 Suppose we use the Quadratic Residues bit commitment scheme presented in Section 13.5 to obtain a zero-knowledge argument for Graph 3-coloring. Using the forging algorithm presented in Figure 13.13, prove that this protocol is perfect zero-knowledge for Vic.


Further Reading

Other recommended textbooks and monographs on cryptography include the following:

Beker and Piper [BP82] | Beutelspacher [Be94]
Brassard [Br88] | Biham and Shamir [BS93]
Denning [De82] | Kahn [Ka67]
Kaufman, Perlman and Speciner [KPS95] | Koblitz [Ko94]
Konheim [Ko81] | Kranakis [Kr86]
Menezes [Me93] | Meyer and Matyas [MM82]
Patterson [Pa87] | Pomerance [Po90a]
Rhee [Rh94] | Rueppel [Ru86]
Salomaa [Sa90] | Schneier [Sc95]
Seberry and Pieprzyk [SP89] | Simmons [Si92b]
Stallings [St95] | van Tilborg [vT88]
Wayner [Wa96] | Welsh [We88]

For a thorough and highly recommended reference on all aspects of practical cryptogrpahy, see Menezes, Van Oorschot and Vanstone [MVV96].

The main research journals in cryptography are the Journal of Cryptology, Designs, Codes and Cryptography and Cryptologia. The Journal of Cryptology is the journal of the International Association for Cryptologic Research (or IACR) which also sponsors the two main annual cryptology conferences, CRYPTO and EUROCRYPT.

CRYPTO has been held since 1981 in Santa Barabara. The proceedings of CRYPTO have been published annually since 1982:

CRYPTO '82 [CRS83] | CRYPTO '83 [Ch84]
CRYPTO '84 [BC85] | CRYPTO '85 [Wi86]
CRYPTO '86 [Od87] | CRYPTO '87 [Po88]
CRYPTO '88 [Go90] | CRYPTO '89 [Br90]
CRYPTO '90 [MV91] | CRYPTO '91 [Fe92]
CRYPTO '92 [Br93] | CRYPTO '93 [St94]
CRYPTO '94 [De94] | CRYPTO '95 [Co95]
CRYPTO '96 [Ko96] |

EUROCRYPT has been held annually since 1982, and except for 1983 and 1986, its proceedings have been published, as follows:

EUROCRYPT '82 [Be83] | EUROCRYPT '84 [BCI85]
EUROCRYPT '85 [Pi86] | EUROCRYPT '87 [CP88]
EUROCRYPT '88 [Gu88a] | EUROCRYPT '89 [QV90]
EUROCRYPT '90 [Da91] | EUROCRYPT '91 [Da91a]
EUROCRYPT '92 [Ru93] | EUROCRYPT '93 [He94]
EUROCRYPT '94 [De95] | EUROCRYPT '95 [GQ95]
EUROCRYPT '96 [Ma96] |

A third conference series, AUSCRYPT/ASIACRYPT, has been held “in association with” the IACR. Its conference proceedings have also been published:

AUSCRYPT '90 [SP90] | ASIACRYPT '91 [IRM93]
AUSCRYPT '92 [SZ92] | ASIACRYPT '94 [PS95]

Bibliography

[ACGS88] | W. Alexi, B. Chor, O. Goldreich and C. P. Schnorr. RSA and Rabin functions: certain parts are as hard as the whole. SIAM Jounal on Computing, 17 (1988), 194-209.
[An91] | H. Anton. Elementary Linear Algebra (Sixth Edition). John Wiley and Sons, 1991.
[BHS93] | D. Bayer, S. Haber and W. S. Stornetta. Improving the efficiency and reliability of digital time-stamping. In Sequences II, Methods in Communication, Security, and Computer Science, pages 329-334. Springer-Verlag, 1993.
[BB88] | P. Beauchemin and G. Brassard. A generalization of Hellman’s extension to Shannon’s approach to cryptography. Journal of Cryptology, 1 (1988), 129-131.
[BBCGP88] | P. Beauchemin, G. Brassard, C. Crepeau, C. Goutier and C. Pomerance. The generation of random numbers that are probably prime. Journal of Cryptology, 1 (1988), 53-64.
[BC94] | A. Beimel and B. Chor. Interaction in key distribution schemes. Lecture Notes in Computer Science, 773 (1994), 444-455. (Advances in Cryptology - CRYPTO '93.)
[BP82] | H. Beker and F. Piper. Cipher Systems, The Protection of Communications. John Wiley and Sons, 1982.
[BL90] | J. Benaloh and J. Leichter. Generalized secret sharing and monotone functions. Lecture Notes in Computer Science, 403 (1990), 27-35. (Advances in Cryptology - CRYPTO '88.)
[Be83] | T. Beth (Ed.) Cryptography Proceedings, 1982. Lecture Notes in Computer Science, vol. 149, Springer-Verlag, 1983.
[BCI85] | T. Beth, N. Cot and I. Ingemarsson (Eds.) Advances in Cryptology: Proceedings of EUROCRYPT '84. Lecture Notes in Computer Science, vol. 209, Springer-Verlag, 1985.
[BJL85] | T. Beth, D. Jungnickel, and H. Lenz. Design Theory. Bibliographisches Institut, Zurich, 1985.
[Be94] | A. Beutelspacher. Cryptology. Mathematical Association of America, 1994.
[BS91] | E. Biham and A. Shamir. Differential cryptanalysis of DES-like cryptosystems. Journal of Cryptology, 4 (1991), 3-72.
[BS93] | E. Biham and A. Shamir. Differential Cryptanalysis of the Data Encryption Standard. Springer-Verlag, 1993.
[BS93a] | E. Biham and A. Shamir. Differential cryptanalysis of the full 16-round DES. Lecture Notes in Computer Science, 740 (1993), 494-502. (Advances in Cryptology - CRYPTO '92.)
[Bl79] | G. R. Blakley. Safeguarding cryptographic keys. AFIPS Conference Proceedings, 48 (1979), 313-317.
[BC85] | G. R. Blakley and D. Chaum (Eds.) Advances in Cryptology: Proceedings of CRYPTO '84. Lecture Notes in Computer Science, vol. 196, Springer-Verlag, 1985.
[Bl85] | R. Blom An optimal class of symmetric key generation schemes. Lecture Notes in Computer Science, 209 (1985), 335-338. (Advances in Cryptology - EUROCRYPT '84.)
[BBS86] | L. Blum, M. Blum and M. Shub. A simple unpredictable random number generator. SIAM Jounal on Computing, 15 (1986), 364-383.
[Bl82] | M. Blum. Coin flipping by telephone: a protocol for solving impossible problems In 24th IEEE Spring Computer Conference, pages 133-137. IEEE Press, 1982.
[BG85] | M. Blum and S. Goldwasser. An efficient probabilistic public-key cryptosystem that hides all partial information. Lecture Notes in Computer Science, 196 (1985), 289-302. (Advances in Cryptology - CRYPTO '84.)
[BM84] | M. Blum and S. Micali. How to generate cryptographically strong sequences of pseudo-random bits. SIAM Journal on Computing, 13 (1984), 850-864.
[Bo89] | J. Boyar. Inferring sequences produced by pseudo-random number generators. Journal of Association for Computing Machinery, 36 (1989), 129-141.
[BDSV93] | C. Blundo, A. De Santis, D. R. Stinson, and U. Vaccaro. Graph decompositions and secret sharing schemes. Lecture Notes in Computer Science, 658 (1993), 1-24. (Advances in Cryptology - EUROCRYPT '92.)
[BDSHKVY93] | C. Blundo, A. De Santis,A. Herzberg, S. Kutten, U. Vaccaro and M. Yung. Perfectly-secure key distribution for dynamic conferences. Lecture Notes in Computer Science, 740 (1993), 471-486. (Advances in Cryptology - CRYPTO '92.)
[BC93] | J. N. E. Bos and D. Chaum. Provably unforgeable signatures. Lecture Notes in Computer Science, 740 (1993), 1-14. (Advances in Cryptology - CRYPTO '92.)
[Br88] | G. Brassard. Modern Cryptology - A Tutorial. Lecture Notes in Computer Science, vol. 325, Springer-Verlag, 1988.
[Br90] | G. Brassard (Ed.) Advances in Cryptology - CRYPTO '89 Proceedings. Lecture Notes in Computer Science, vol. 435, Springer-Verlag, 1990.
[BB88a] | G. Brassard and P. Bratley. Algorithmics, Theory and Practice. Prentice Hall, 1988.
[BCC88] | G. Brassard, D. Chaum and C. Crepeau. Minimum disclosure proofs of knowledge. Journal of Computer and Systems Science, 37 (1988), 156-189.
[BC90] | G. Brassard and C. Crepeau. Sorting out zero-knowledge. Lecture Notes in Computer Science, 434 (1990), 181-191. (Advances in Cryptology - EUROCRYPT '89.)
[Br89] | D. M. Bressoud. Factorization and Primality Testing. Springer-Verlag, 1989.
[Br85] | E. F. Brickell. Breaking iterated knapsacks. Lecture Notes in Computer Science, 218 (1986), 342-358. (Advances in Cryptology - CRYPTO '85.)
[Br89a] | E. F. Brickell. Some ideal secret sharing schemes. Journal of Combinatorial Mathematics and Combinatorial Computing, 9 (1989), 105-113.
[Br93] | E. F. Brickell (Ed.) Advances in Cryptology - CRYPTO '92 Proceedings. Lecture Notes in Computer Science, vol. 740, Springer-Verlag, 1993.
[BD91] | E. F. Brickell and D. M. Davenport. On the classification of ideal secret sharing schemes. Journal of Cryptology, 4 (1991), 123-134.
[BM92] | E. F. Brickell and K. S. McCurley. An interactive identification scheme based on discrete logarithms and factoring. Journal of Cryptology, 5 (1992), 29-39.
[BMP87] | E. F. Brickell, J. H. Moore and M. R. Purtill. Structure in the S-boxes of DES. Lecture Notes in Computer Science, 263 (1987), 3-8. (Advances in Cryptology - CRYPTO '86.)
[BO92] | E. F. Brickell and A. M. Odlyzko. Cryptanalysis, a survey of recent results. In Contemporary Cryptology, The Science of Information Integrity, pages 501-540. IEEE Press, 1992.
[BS92] | E. F. Brickell and D. R. Stinson. Some improved bounds on the information rate of perfect secret sharing schemes. Journal of Cryptology, 5 (1992), 153-166.
[BKPS90] | L. Brown, M. Kwan, J. Pieprzyk and J. Seberry. LOKI - A cryptographic primitive for authentication and secrecy applications. Lecture Notes in Computer Science, 453 (1990), 229-236. (Advances in Cryptology - AUSCRYPT '90.)
[BDB92] | M. Burmester, Y. Desmedt and T. Beth. Efficient zero-knowledge identification schemes for smart cards. The Computer Journal, 35 (1992), 21-29.
[CDGV93] | R. M. Capocelli, A. De Santis, L. Gargano, and U. Vaccaro. On the size of shares for secret sharing schemes. Journal of Cryptology, 6 (1993), 157-167.
[Ch95] | F. Chabaud. On the security of some cryptosystems based on error-correcting codes. Lecture Notes in Computer Science, to appear. (Advances in Cryptology - EUROCRYPT '94.)
[Ch84] | D. Chaum (Ed.) Advances in Cryptology: Proceedings of CRYPTO '83. Plenum Press, 1984.
[CP88] | D. Chaum and W. L. Price (Eds.) Advances in Cryptology - EUROCRYPT '87 Proceedings. Lecture Notes in Computer Science, vol. 304, Springer-Verlag, 1988.
[CRS83] | D. Chaum, R. L. Rivest and A. T. Sherman (Eds.) Advances in Cryptology: Proceedings of CRYPTO '82. Plenum Press, 1983.
[CvA90] | D. Chaum and H. van Antwerpen. Undeniable signatures. Lecture Notes in Computer Science, 435 (1990), 212-216. (Advances in Cryptology - CRYPTO '89.)
[CvHP92] | D. Chaum, E. van Heijst and B. Pfitzmann. Cryptographically strong undeniable signatures, unconditionally secure for the signer. Lecture Notes in Computer Science, 576 (1992), 470-484. (Advances in Cryptology - CRYPTO '91.)
[CR88] | B. Chor and R. L. Rivest. A knapsack-type public key cryptosystem based on arithmetic in finite fields. IEEE Transactions on Information Theory, 45 (1988), 901-909.
[Co95] | D. Coppersmith (Ed.) Advances in Cryptology - CRYPTO '95 Proceedings. Lecture Notes in Computer Science, vol. 963, Springer-Verlag, 1995.
[CKM94] | D. Coppersmith, H. Krawczyz and Y. Mansour. The shrinking generator. Lecture Notes in Computer Science, 773 (1994), 22-39. (Advances in Cryptology - CRYPTO '93.)
[CSV94] | D. Coppersmith, J. Stern and S. Vaudenay. Attacks on the birational permutation signature schemes. Lecture Notes in Computer Science, 773 (1994), 435-443. (Advances in Cryptology - CRYPTO '93.)
[CW91] | T. W. Cusick and M. C. Wood. The REDOC-II cryptosystem. Lecture Notes in Computer Science, 537 (1991), 545-563. (Advances in Cryptology - CRYPTO '90.)
[Da90] | I. B. Damgard. A design principle for hash functions. Lecture Notes in Computer Science, 435 (1990), 416-427. (Advances in Cryptology - CRYPTO '89.)
[Da91] | I. B. Damgard (Ed.) Advances in Cryptology - EUROCRYPT '90 Proceedings. Lecture Notes in Computer Science, vol. 473, Springer-Verlag, 1991.
[DLP93] | I. Damgard, P. Landrock and C. Pomerance. Average case error estimates for the strong probable prime test. Mathematics of Computation, 61 (1993), 177-194.
[Da91a] | D. W. Davies (Ed.) Advances in Cryptology - EUROCRYPT '91 Proceedings. Lecture Notes in Computer Science, vol. 547, Springer-Verlag, 1991.
[De84] | J. M. DeLaurentis. A further weakness in the common modulus protocol for the RSA cryptosystem. Cryptologia, 8 (1984), 253-259.
[dBB92] | B. den Boer and A. Bossalaers. An attack on the last two rounds of MD4. Lecture Notes in Computer Science, 576 (1992), 194-203. (Advances in Cryptology - CRYPTO '91.)
[De82] | D. E. R. Denning. Cryptography and Data Security. Addison-Wesley, 1982.
[De95] | A. De Santis (Ed.) Advances in Cryptology - EUROCRYPT '94 Proceedings. Lecture Notes in Computer Science, vol. 950, Springer-Verlag, 1995.
[De94] | Y. G. Desmedt (Ed.) Advances in Cryptology - CRYPTO '94 Proceedings. Lecture Notes in Computer Science, vol. 839, Springer-Verlag, 1994.
[dWQ93] | D. de Waleffe and J.-J. Quisquater. Better login protocols for computer networks. Lecture Notes in Computer Science, 741 (1993), 50-70. (Computer Security and Industrial Cryptography, State of the Art and Evolution, ESAT Course, May 1991.)
[Di92] | W. Diffie. The first ten years of public-key cryptography. In Contemporary Cryptology, The Science of Information Integrity, pages 135-175. IEEE Press, 1992.
[DH76] | W. Diffie and M. E. Hellman. Multiuser cryptographic techniques. AFIPS Conference Proceedings, 45 (1976), 109-112.
[DH76a] | W. Diffie and M. E. Hellman. New directions in cryptography. IEEE Transactions on Information Theory, 22 (1976), 644-654.
[DVW92] | W. Diffie, P. C. Van Oorschot and M. J. Wiener. Authentication and authenticated key exchanges. Designs, Codes and Cryptography, 2 (1992), 107-125.
[Eb93] | H. Eberle. A high-speed DES implementation for network applications. Lecture Notes in Computer Science, 740 (1993), 527-545. (Advances in Cryptology - CRYPTO '92.)
[El85] | T. ElGamal. A public key cryptosystem and a signature scheme based on discrete logarithms. IEEE Transactions on Information Theory, 31 (1985), 469-472.
[EAKMM86] | D. Estes, L. M. Adleman, K. Kompella, K. S. McCurley and G. L. Miller. Breaking the Ong-Schnorr-Shamir signature schemes for quadratic number fields. Lecture Notes in Computer Science, 218 (1986), 3-13. (Advances in Cryptology - CRYPTO '85.)
[FFS88] | U. Feige, A. Fiat and A. Shamir. Zero-knowledge proofs of identity. Journal of Cryptology, 1 (1988), 77-94.
[Fe92] | J. Feigenbaum (Ed.) Advances in Cryptology - CRYPTO '91 Proceedings. Lecture Notes in Computer Science, vol. 576, Springer-Verlag, 1992.
[Fe73] | H. Feistel. Cryptography and computer privacy. Scientific American, 228(5) (1973), 15-23.
[FN91] | A. Fiat and M. Naor. Rigorous time/space trade-offs for inverting functions. In Proceedings of the 23rd Symposium on the Theory of Computing, pages 534-541. ACM Press, 1991.
[FS87] | A. Fiat and A. Shamir. How to prove yourself: practical solutions to identification and signature problems. Lecture Notes in Computer Science, 263 (1987), 186-194. (Advances in Cryptology - CRYPTO '86.)
[FOM91] | A. Fujioka, T. Okamoto and S. Miyaguchi. ESIGN: an efficient digital signature implementation for smart cards. Lecture Notes in Computer Science, 547 (1991), 446-457. (Advances in Cryptology - EUROCRYPT '91.)
[Gib91] | J. K. Gibson. Discrete logarithm hash function that is collision free and one way. IEE Proceedings-E, 138 (1991), 407-410.
[GMS74] | E. N. Gilbert, F. J. MacWilliams and N. J. A. Sloane. Codes which detect deception. Bell Systems Technical Journal, 53 (1974), 405-424.
[Gir91] | M. Girault. Self-certified public keys. Lecture Notes in Computer Science, 547 (1991), 490-497. (Advances in Cryptology - EUROCRYPT '91.)
[GP91] | C. M. Goldie and R. G. E. Pinch. Communication Theory. Cambridge University Press, 1991.
[GMW91] | O. Goldreich, S. Micali and A. Wigderson. Proofs that yield nothing but their validity or all languages in NP have zero-knowledge proof systems. Journal of the ACM, 38 (1991), 691-729.
[Go90] | S. Goldwasser (Ed.) Advances in Cryptology - CRYPTO '88 Proceedings. Lecture Notes in Computer Science, vol. 403, Springer-Verlag, 1990.
[GM84] | S. Goldwasser and S. Micali. Probabilistic encryption. Journal of Computer and Systems Science, 28 (1984), 270-299.
[GMR89] | S. Goldwasser, S. Micali and C. Rackoff. The knowledge complexity of interactive proof systems. SIAM Journal on Computing, 18 (1989), 186-208.
[GMT82] | S. Goldwasser, S. Micali and P. Tong. Why and how to establish a common code on a public network. In 23rd Annual Symposium on the Foundations of Computer Science, pages 134-144. IEEE Press, 1982.
[GM93] | D. M. Gordon and K. S. McCurley. Massively parallel computation of discrete logarithms. Lecture Notes in Computer Science, 740 (1993), 312-323. (Advances in Cryptology - CRYPTO '92.)
[GQ88] | L. C. Guillou and J.-J. Quisquater. A practical zero-knowledge protocol fitted to security microprocessor minimizing both transmission and memory. Lecture Notes in Computer Science, 330 (1988), 123-128. (Advances in Cryptology - EUROCRYPT '88.)
[GQ95] | L. C. Guillou and J.-J. Quisquater (Eds.) Advances in Cryptology - EUROCRYPT '95 Proceedings. Lecture Notes in Computer Science, vol. 921, Springer-Verlag, 1995.
[Gu88] | C. G. Gunther Alternating step generators controlled by de Bruijn sequences. Lecture Notes in Computer Science, 304 (1988), 88-92. (Advances in Cryptology - EUROCRYPT '87.)
[Gu88a] | C. G. Gunther (Ed.) Advances in Cryptology - EUROCRYPT '88 Proceedings. Lecture Notes in Computer Science, vol. 330, Springer-Verlag, 1988.
[HS91] | S. Haber and W. S. Stornetta. How to timestamp a digital document. Journal of Cryptology, 3 (1991), 99-111.
[HSS93] | J. Hastad, A. W. Schrift and A. Shamir. The discrete logarithm modulo a composite hides O(n) bits. Journal of Computer and Systems Science, 47 (1993), 376-404.
[He80] | M. E. Hellman. A cryptanalytic time-memory trade-off. IEEE Transactions on Information Theory, 26 (1980), 401-406.
[Hi29] | L. S. Hill. Cryptogaphy in an algebraic alphabet. American Mathematical Monthly, 36 (1929), 306-312.
[He94] | T. Helleseth (Ed.) Advances in Cryptology - EUROCRYPT '93 Proceedings. Lecture Notes in Computer Science, vol. 765, Springer-Verlag, 1994.
[HLLPRW91] | D. G. Hoffman, D. A. Leonard, C. C. Lindner, K. T. Phelps, C. A. Rodger and J. R. Wall. Coding Theory, The Essentials. Marcel Dekker, 1991.
[IRM93] | H. Imai, R. L. Rivest and T. Matsumoto (Eds.) Advances in Cryptology - ASIACRYPT '91 Proceedings. Lecture Notes in Computer Science, vol. 739, Springer-Verlag, 1993.
[ISN87] | M. Ito, A. Saito, and T. Nishizeki. Secret sharing scheme realizing general access structure. Proceedings IEEE Globecom '87, pages 99-102, 1987.
[Jo88] | D. S. Johnson. The NP-completeness column: an ongoing guide. Journal of Algorithms, 9 (1988), 426-444.
[Ka67] | D. Kahn. The Codebreakers. The Story of Secret Writing. Macmillan, 1967.
[KPS95] | C. Kaufman, R. Perlman and M. Speciner. Network Security. Private Communication in a Public World. Prentice Hall, 1995.
[Ko87] | N. Koblitz. Elliptic curve cryptosystems. Mathematics of Computation, 48 (1987), 203-209.
[Ko94] | N. Koblitz. A Course in Number Theory and Cryptography (Second Edition). Springer-Verlag, 1994.
[Ko96] | N. Koblitz (Ed.) Advances in Cryptology - CRYPTO '96 Proceedings. Lecture Notes in Computer Science, vol. 1109, Springer-Verlag, 1996.
[KN93] | J. Kohl and C. Neuman. The Kerboros Network Authentication Service. Network Working Group Request for Comments: 1510, September 1993.
[Ko81] | A. G. Konheim. Cryptography, A Primer. John Wiley and Sons, 1981.
[Kr86] | E. Kranakis. Primality and Cryptography. John Wiley and Sons, 1986.
[La90] | J. C. Lagarias Pseudo-random number generators in cryptography and number theory. In Cryptology and Computational Number Theory, pages 115-143. American Mathematical Society, 1990.
[LO91] | B. A. Lamacchia and A. M. Odlyzko. Computation of discrete logarithms in prime fields. Designs, Codes and Cryptography, 1 (1991), 47-62.
[LL93] | A. K. Lenstra and H. W. Lenstra, Jr. (Eds.) The Development of the Number Field Sieve. Lecture Notes in Mathematics, vol. 1554. Springer-Verlag, 1993.
[LL90] | A. K. Lenstra and H. W. Lenstra, Jr. Algorithms in number theory. In Handbook of Theoretical Computer Science, Volume A: Algorithms and Complexity, pages 673-715. Elsevier Science Publishers, 1990.
[LN83] | R. Lidl and H. Niederreiter. Finite Fields. Addison-Wesley, 1983.
[LW88] | D. L. Long and A. Wigderson. The discrete log hides O(log n) bits. SIAM Jounal on Computing, 17 (1988), 363-372.
[MS77] | F. J. MacWilliams and N. J. A. Sloane. The Theory of Error-Correcting Codes. North-Holland, 1977.
[Ma86] | J. L. Massey. Cryptography - a selective survey. In Digital Communications, pages 3-21. North-Holland, 1986.
[Ma94] | M. Matsui. Linear cryptanalysis method for DES cipher. Lecture Notes in Computer Science, 765 (1994), 386-397. (Advances in Cryptology - EUROCRYPT '93.)
[Ma94a] | M. Matsui. The first experimental cryptanalysis of the data encryption standard. Lecture Notes in Computer Science, 839 (1994), 1-11. (Advances in Cryptology - CRYPTO '94.)
[MTI86] | T. Matsumoto, Y. Takashima and H. Imai. On seeking smart public-key distribution systems. Transactions of the IECE (Japan), 69 (1986), 99-106.
[Ma96] | U. Maurer (Ed.) Advances in Cryptology - EUROCRYPT '96 Proceedings. Lecture Notes in Computer Science, vol. 1070, Springer-Verlag, 1996.
[Mc90] | K. McCurley The discrete logarithm problem. In Cryptology and Computational Number Theory, pages 49-74. American Mathematical Society, 1990.
[Mc78] | R. McEliece. A public-key cryptosystem based on algebraic coding theory. DSN Progress Report, 42-44 (1978), 114-116.
[Mc87] | R. McEliece. Finite Fields for Computer Scientists and Engineers. Kluwer Academic Publishers, 1987.
[Me93] | A. J. Menezes. Elliptic Curve Public Key Cryptosystems. Kluwer Academic Publishers, 1993.
[MBGMVY93] | A. J. Menezes, I. F. Blake, X. Gao, R. C. Mullin, S. A. Vanstone and T. Yaghoobian. Applications of Finite Fields. Kluwer Academic Publishers, 1993.
[MOV94] | A. J. Menezes, T. Okamoto and S. A. Vanstone. Reducing elliptic curve logarithms to logarithms in a finite field. IEEE Transactions on Information Theory, 39 (1993), 1639-1646.
[MV91] | A. J. Menezes and S. A. Vanstone (Eds.) Advances in Cryptology - CRYPTO '90 Proceedings. Lecture Notes in Computer Science, vol. 537, Springer-Verlag, 1991.
[MV93] | A. J. Menezes and S. A. Vanstone. Elliptic curve cryptosystems and their implementation. Journal of Cryptology, 6 (1993), 209-224.
[MVV96] | A. J. Menezes, P. C. Van Oorschot and S. A. Vanstone. Handbook of Applied Cryptography. CRC Press, 1996.
[Me78] | R. C. Merkle. Secure communications over insecure channels. Communications of the ACM, 21 (1978), 294-299.
[Me90] | R. C. Merkle. One way hash functions and DES. Lecture Notes in Computer Science, 435 (1990), 428-446. (Advances in Cryptology - CRYPTO '89.)
[Me90a] | R. C. Merkle. A fast software one-way hash function. Journal of Cryptology, 3 (1990), 43-58.
[MH78] | R. C. Merkle and M. E. Hellman. Hiding information and signatures in trapdoor knapsacks. IEEE Transactions on Information Theory, 24 (1978), 525-530.
[MM82] | C. Meyer and S. Matyas. Cryptography: A New Dimension in Computer Security. John Wiley and Sons, 1982.
[Mi76] | G. L. Miller. Riemann’s hypothesis and tests for primality. Journal of Computer and Systems Science, 13 (1976), 300-317.
[Mi86] | V. Miller. Uses of elliptic curves in cryptography. Lecture Notes in Computer Science, 218 (1986), 417-426. (Advances in Cryptology - CRYPTO '85.)
[MPW92] | C. J. Mitchell, F. Piper and P. Wild. Digital signatures. In Contemporary Cryptology, The Science of Information Integrity, pages 325-378. IEEE Press, 1992.
[Mi91] | S. Miyaguchi. The FEAL cipher family. Lecture Notes in Computer Science, 537 (1991), 627-638. (Advances in Cryptology - CRYPTO '90.)
[MOI90] | S. Miyaguchi, K. Ohta and M. Iwata. 128-bit hash function (N-hash). Proceedings of SECURICOM 1990, 127-137.
[Mo92] | J. H. Moore. Protocol failures in cryptosystems. In Contemporary Cryptology, The Science of Information Integrity, pages 541-558. IEEE Press, 1992.
[NBS77] | Data Encryption Standard (DES). National Bureau of Standards FIPS Publication 46, 1977.
[NBS80] | DES modes of operation. National Bureau of Standards FIPS Publication 81, 1980.
[NBS81] | Guidelines for implementing and using the NBS data encryption standard. National Bureau of Standards FIPS Publication 74, 1981.
[NBS85] | Computer data authentication. National Bureau of Standards FIPS Publication 113, 1985.
[NBS93] | Secure hash standard. National Bureau of Standards FIPS Publication 180, 1993.
[NBS94] | Digital signature standard. National Bureau of Standards FIPS Publication 186, 1994.
[Od87] | A. M. Odlyzko (Ed.) Advances in Cryptology - CRYPTO '86 Proceedings. Lecture Notes in Computer Science, vol. 263, Springer-Verlag, 1987.
[Ok93] | T. Okamoto. Provably secure and practical identification schemes and corresponding signature schemes. Lecture Notes in Computer Science, 740 (1993), 31-53. (Advances in Cryptology - CRYPTO '92.)
[OSS85] | H. Ong, C. P. Schnorr and A. Shamir. Efficient signature schemes based on polynomial equations. Lecture Notes in Computer Science, 196 (1985), 37-46. (Advances in Cryptology - CRYPTO '84.)
[Pa87] | W. Patterson. Mathematical Cryptology for Computer Scientists and Mathematicians. Rowman and Littlefield, 1987.
[Pe86] | R. Peralta. Simultaneous security of bits in the discrete log. Lecture Notes in Computer Science, 219 (1986), 62-72. (Advances in Cryptology - EUROCRYPT '85.)
[Pi86] | F. Pichler (Ed.) Advances in Cryptology - EUROCRYPT '85 Proceedings. Lecture Notes in Computer Science, vol. 219, Springer-Verlag, 1986.
[PS95] | J. Piepryzk and R. Safavi-Naini (Eds.) Advances in Cryptology - ASIACRYPT '94 Proceedings. Lecture Notes in Computer Science, vol. 917, Springer-Verlag, 1995.
[PB45] | R. L. Plackett and J. P. Burman. The design of optimum multi-factorial experiments. Biometrika, 33 (1945), 305-325.
[PH78] | S. C. Pohlig and M. E. Hellman. An improved algorithm for computing logarithms over GF(p) and its cryptographic significance. IEEE Transactions on Information Theory, 24 (1978), 106-110.
[Po88] | C. Pomerance (Ed.) Advances in Cryptology - CRYPTO '87 Proceedings. Lecture Notes in Computer Science, vol. 293, Springer-Verlag, 1988.
[Po90] | C. Pomerance. Factoring. In Cryptology and Computational Number Theory, pages 27-47. American Mathematical Society, 1990.
[Po90a] | C. Pomerance (Ed.) Cryptology and Computational Number Theory, American Mathematical Society, 1990.
[PGV93] | B. Preneel, R. Govaerts and J. Vandewalle. Information authentication: hash functions and digital signatures. Lecture Notes in Computer Science, 741 (1993), 87-131. (Computer Security and Industrial Cryptography, State of the Art and Evolution, ESAT Course, May 1991.)
[PGV94] | B. Preneel, R. Govaerts and J. Vandewalle. Hash functions based on block ciphers: a synthetic approach. Lecture Notes in Computer Science, 773 (1994), 368-378. (Advances in Cryptology - CRYPTO '93.)
[QG90] | J.-J. Quisquater and L. Guillou. How to explain zero-knowledge protocols to your children. Lecture Notes in Computer Science, 435 (1990), 628-631. (Advances in Cryptology - CRYPTO '89.)
[QV90] | J.-J. Quisquater and J. Vandewalle (Eds.) Advances in Cryptology - EUROCRYPT '89 Proceedings. Lecture Notes in Computer Science, vol. 434, Springer-Verlag, 1990.
[Ra79] | M. O. Rabin. Digitized signatures and public-key functions as intractible as factorization. MIT Laboratory for Computer Science Technical Report, LCS/TR-212, 1979.
[Ra80] | M. O. Rabin. Probabilistic algorithms for testing primality. Journal of Number Theory, 12 (1980), 128-138.
[Rh94] | M. Y. Rhee. Cryptography and Secure Communications. McGraw-Hill, 1994.
[Ri91] | R. L. Rivest. The MD4 message digest algorithm. Lecture Notes in Computer Science, 537 (1991), 303-311. (Advances in Cryptology - CRYPTO '90.)
[RSA78] | R. L. Rivest, A. Shamir, and L. Adleman. A method for obtaining digital signatures and public key cryptosystems. Commununications of the ACM, 21 (1978), 120-126.
[Ro93] | K. H. Rosen. Elementary Number Theory and its Applications (Third Edition). Addison Wesley, 1993.
[Ru86] | R. A. Rueppel. Analysis and Design of Stream Ciphers. Springer-Verlag, 1986.
[Ru93] | R. A. Rueppel (Ed.) Advances in Cryptology - EUROCRYPT '92 Proceedings. Lecture Notes in Computer Science, vol. 658, Springer-Verlag, 1993.
[RV94] | R. A. Rueppel and P. C. Van Oorschot Modern key agreement techniques. To appear in Computer Communications, 1994.
[Sa90] | A. Salomaa. Public-Key Cryptography. Springer-Verlag, 1990.
[Sc94] | J. I. Schiller. Secure distributed computing. Scientific American, 271(5) (1994), 72-76.
[Sc95] | B. Schneier. Applied Cryptography, Protocols, Algorithms and Source Code in C (Second Edition). John Wiley and Sons, 1995.
[Sc91] | C. P. Schnorr. Efficient signature generation by smart cards. Journal of Cryptology, 4 (1991), 161-174.
[SP89] | J. Seberry and J. Pieprzyk Cryptography: An Introduction to Computer Security. Prentice-Hall, 1989.
[SP90] | J. Seberry and J. Pieprzyk (Eds.) Advances in Cryptology - AUSCRYPT '90 Proceedings. Lecture Notes in Computer Science, vol. 453, Springer-Verlag, 1990.
[SZ92] | J. Seberry and Y. Zheng (Eds.) Advances in Cryptology - AUSCRYPT '92 Proceedings. Lecture Notes in Computer Science, vol. 718, Springer-Verlag, 1993.
[Sh79] | A. Shamir. How to share a secret. Communications of the ACM, 22 (1979), 612-613.
[Sh84] | A. Shamir. A polynomial-time algorithm for breaking the basic Merkle-Hellman cryptosystem. IEEE Transactions on Information Theory, 30 (1984), 699-704.
[Sh90] | A. Shamir. An efficient identification scheme based on permuted kernels. Lecture Notes in Computer Science, 435 (1990), 606-609. (Advances in Cryptology - CRYPTO '89.)
[Sh94] | A. Shamir. Efficient signature schemes based on birational permutations. Lecture Notes in Computer Science, 773 (1994), 1-12. (Advances in Cryptology - CRYPTO '93.)
[Sh48] | C. E. Shannon. A mathematical theory of communication. Bell Systems Technical Journal, 27 (1948), 379-423, 623-656.
[Sh49] | C. E. Shannon. Communication theory of secrecy systems. Bell Systems Technical Journal, 28 (1949), 656-715.
[ST92] | J. H. Silverman and J. Tate. Rational Points on Elliptic Curves. Springer-Verlag, 1992.
[Si85] | G. J. Simmons. Authentication theory / coding theory. Lecture Notes in Computer Science, 196 (1985), 411-432. (Advances in Cryptology - CRYPTO '84.)
[Si88] | G. J. Simmons. A natural taxonomy for digital information authentication schemes. Lecture Notes in Computer Science, 293 (1988), 269-288. (Advances in Cryptology - CRYPTO '87.)
[Si92] | G. J. Simmons. A survey of information authentication. In Contemporary Cryptology, The Science of Information Integrity, pages 379-419. IEEE Press, 1992.
[Si92a] | G. J. Simmons. An introduction to shared secret and/or shared control schemes and their application. In Contemporary Cryptology, The Science of Information Integrity, pages 441-497. IEEE Press, 1992.
[Si92b] | G. J. Simmons (Ed.) Contemporary Cryptology, The Science of Information Integrity. IEEE Press, 1992.
[SB92] | M. E. Smid and D. K. Branstad. The data encryption standard: past and future. In Contemporary Cryptology, The Science of Information Integrity, pages 43-64. IEEE Press, 1992.
[SB93] | M. E. Smid and D. K. Branstad. Response to comments on the NIST proposed digital signature standard. Lecture Notes in Computer Science, 740 (1993), 76-88. (Advances in Cryptology - CRYPTO '92.)
[SS77] | R. Solovay and V. Strassen. A fast Monte Carlo test for primality. SIAM Journal on Computing, 6 (1977), 84-85.
[St95] | W. STallings. Network and Internetwork Security. Principles and Practice. Prentice Hall, 1995.
[St88] | D. R. Stinson. Some constructions and bounds for authentication codes. Journal of Cryptology, 1 (1988), 37-51.
[St90] | D. R. Stinson. The combinatorics of authentication and secrecy codes. Journal of Cryptology, 2 (1990), 23-49.
[St92] | D. R. Stinson. Combinatorial characterizations of authentication codes. Designs, Codes and Cryptography, 2 (1992), 175-187.
[St92a] | D. R. Stinson. An explication of secret sharing schemes. Designs, Codes and Cryptography, 2 (1992), 357-390.
[St94] | D. R. Stinson (Ed.) Advances in Cryptology - CRYPTO '93 Proceedings. Lecture Notes in Computer Science, vol. 773, Springer-Verlag, 1994.
[vHP93] | E. van Heyst and T. P. Pedersen. How to make efficient fail-stop signatures. Lecture Notes in Computer Science, 658 (1993), 366-377. (Advances in Cryptology - EUROCRYPT '92.)
[VV89] | S. A. Vanstone and P. C. Van Oorschot. An Introduction to Error Correcting Codes with Applications. Kluwer Academic Publishers, 1989.
[vT88] | H. C. A. van Tilborg. An Introduction to Cryptology. Kluwer Academic Publishers, 1988.
[vT93] | J. van Tilburg. Secret-key exchange with authentication. Lecture Notes in Computer Science, 741 (1993), 71-86. (Computer Security and Industrial Cryptography, State of the Art and Evolution, ESAT Course, May 1991.)
[VV84] | U. Vazirani and V. Vazirani. Efficient and secure pseudorandom number generation. In Proceedings of the 25th Annual Symposium on the Foundations of Computer Science, pages 458-463. IEEE Press, 1984.
[Wa90] | M. Walker. Information-theoretic bounds for authentication systems. Journal of Cryptology, 2 (1990), 131-143.
[Wa96] | P. Wayner. Disappearing Cryptography. Academic Press, 1996.
[We88] | D. Welsh. Codes and Cryptography. Oxford Science Publications, 1988.
[Wi94] | M. J. Wiener. Efficient DES key search. Technical report TR-244, School of Computer Science, Carleton University, Ottawa, Canada, May 1994 (also presented at CRYPTO '93 Rump Session).
[Wi80] | H. C. Williams. A modification of the RSA public-key encryption procedure. IEEE Transactions on Information Theory, 26 (1980), 726-729.
[Wi86] | H. C. Williams (Ed.) Advances in Cryptology - CRYPTO '85 Proceedings. Lecture Notes in Computer Science, vol. 218, Springer-Verlag, 1986.
[Ya82] | A. Yao. Theory and applications of trapdoor functions. In Proceedings of the 23rd Annual Symposium on the Foundations of Computer Science, pages 80-91. IEEE Press, 1982.


Top

Cryptography : Theory and Practice (Discrete Mathematics and Its Applications)
by Douglas R. Stinson

Our Price: $79.95

Availability: This title usually ships within 2-3 days.

Holly Need this for the holidays? No problem! Select any shipping method for delivery by December 22 (U.S. addresses only).