1 / 30

Cryptography and Network Security Chapter 10

Cryptography and Network Security Chapter 10. Fifth Edition by William Stallings . Chapter 10 – Other Public Key Cryptosystems.

tom
Télécharger la présentation

Cryptography and Network Security Chapter 10

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Cryptography and Network SecurityChapter 10 Fifth Edition by William Stallings

  2. Chapter 10 – Other Public Key Cryptosystems No Singhalese, whether man or woman, would venture out of the house without a bunch of keys in his hand, for without such a talisman he would fear that some devil might take advantage of his weak state to slip into his body. —The Golden Bough, Sir James George Frazer

  3. Diffie-Hellman Key Exchange • first public-key type scheme proposed • by Diffie & Hellman in 1976 along with the exposition of public key concepts • is a practical method for public exchange of a secret key • used in a number of commercial products

  4. Diffie-Hellman Key Exchange • a public-key distribution scheme • cannot be used to exchange an arbitrary message • rather it can establish a common key • known only to the two participants • value of key depends on the participants (and their private and public key information) • based on exponentiation in a finite (Galois) field (modulo a prime or a polynomial) - easy • security relies on the difficulty of computing discrete logarithms (similar to factoring) – hard

  5. Discrete Logs Given Find x We denote this as Why is this hard?

  6. Diffie-Hellman Setup • all users agree on global parameters: • large prime integer or polynomial q • a being a primitive root mod q • each user (eg. A) generates their key • chooses a secret key (number): xA < q • compute their public key: yA = axA mod q • each user makes public that key yA

  7. Diffie-Hellman Key Exchange • shared session key for users A & B is KAB: KAB = axA.xB mod q = yAxB mod q (which B can compute) = yBxA mod q (which A can compute) • KAB is used as session key in private-key encryption scheme between Alice and Bob • if Alice and Bob subsequently communicate, they will have the same key as before, unless they choose new public-keys • attacker needs an x, must solve discrete log

  8. Diffie-Hellman Example • users Alice & Bob who wish to swap keys: • agree on prime q=353 and a=3 • select random secret keys: • A chooses xA=97, B chooses xB=233 • compute respective public keys: • yA=397 mod 353 = 40 (Alice) • yB=3233 mod 353 = 248 (Bob) • compute shared session key as: • KAB= yBxA mod 353 = 24897 = 160 (Alice) • KAB= yAxB mod 353 = 40233 = 160 (Bob)

  9. Key Exchange Protocols • users could create random private/public D-H keys each time they communicate • users could create a known private/public D-H key and publish in a directory, then consulted and used to securely communicate with them • both of these are vulnerable to a meet-in-the-Middle Attack • authentication of the keys is needed

  10. Man-i-the-middle attack on Diffie-Hellman Darth prepares for the attack by generating two random private keys XD1 and XD2 and then computing the corresponding public keys YD1=a XD1 mod q and YD2 =a XD2 mod q Alice transmitsYA to Bob. Darth intercepts YA but transmits YD1 to Bob. Darth also calculates K2 = (YA) XD2 mod q. Bob receives YD1 and calculates K1 = (YD1)XB mod q. Bob transmits YB to Alice. Darth intercepts YB but transmits YD2 to Alice. Darth calculates K1 = (YB) XD1 mod q. Alice receives YD2 and calculates K2 = (YD2)XA mod q. Allice and Bob think they share a secret key, but actually Bob and Darth share K1, and Alice and Darth share K2.

  11. ElGamal Cryptosystem • Another public-key cryptosystem like RSA. • Bob publishes (a, p, b), where 1 < m < p and b=aa • Alice chooses secret k, computes and sends to Bob the pair (r,t) where • r=ak (mod p) • t = bkm (mod p) • Bob calculates: tr-a=m (mod p) • Why does this decrypt?

  12. Bob publishes (a, p, b), where 1 < m < p and b=aa Alice chooses secret k, computes and sends to Bob the pair (r,t) where r=ak (mod p) t = bkm (mod p) Bob finds: tr-a=m (mod p) Why does this work? Multiplying m by bk scrambles it. Eve sees a, p, b, r, t. If she only knew a or k! Knowing a allows decryption. Knowing k also allows decryption. Why? Can’t find k from r or t.Why? ElGamal Cryptosystem

  13. Elliptic Curve Cryptography • majority of public-key crypto (RSA, D-H) use either integer or polynomial arithmetic with very large numbers/polynomials • imposes a significant load in storing and processing keys and messages • an alternative is to use elliptic curves • offers same security with smaller bit sizes • newer, but not as well analysed

  14. Elliptic Curve CryptographyAbelian Group • A set of elements G and operation * among elements (G,*) with some • Axioms: • (A1) Closure:  a,b  G, a*b  G • (A2) associative law:(a*b)*c = a*(b*c) • (A3) has identity e: e*a = a*e = a • (A4) has inverses a-1: a*a-1 = e • (A5) commutative law a*b = b*a

  15. Elliptic Curve CryptographyOperations • If the operation * is x, and we perform all operations mod q, a x a x ... x a = ak mod q • If the operation * is +, a + a + ... + a = k a k k

  16. Real Elliptic Curves • an elliptic curve is defined by an equation in two variables x & y, with coefficients • consider a cubic elliptic curve of form • y2 = x3 + ax + b • where x,y,a,b are all real numbers • also define zero point O • Note: More general form of the elliptical curve (Weierstrass equation): y2 + axy + by = x3 + cx2 + dx + e can be transformed to the form: y2 = x3 + ax + b • have addition operation for elliptic curve • geometrically sum of Q+R is reflection of intersection R

  17. Real Elliptic Curve Example - - - R= - -

  18. Elliptic Curve Cryptography Slope of the line between P and Q

  19. Elliptic Curve Cryptography • ECC addition is analog of modulo multiply • ECC repeated addition is analog of modulo exponentiation • need “hard” problem equiv to discrete log • Q= kP = P+P+…+P, where Q,P belong to a prime curve • is “easy” to compute Q given k, P • but “hard” to find k given Q, P • known as the elliptic curve logarithm problem

  20. Finite Elliptic Curves • Elliptic curve cryptography uses curves whose variables & coefficients are finite • have two families commonly used: • prime curves Ep(a,b) defined over Zp • use integers modulo a prime • best in software • binary curves E2m(a,b) defined over GF(2n) • use polynomials with binary coefficients • best in hardware

  21. Certicom example: E23(1,1) All operations work mod 23. Not all values for x and y satisfy y2 = x3 + x + 1 For x=9, only y=7 and y=16

  22. ECC Diffie-Hellman • can do key exchange analogous to D-H • users select a suitable curve Ep(a,b) • select base point G=(x1,y1) • with large order n s.t. nG=O • A & B select private keys nA<n, nB<n • compute public keys: PA=nAG, PB=nBG • compute shared key: K=nAPB,K=nBPA • same since K=nAnBG

  23. ECC Encryption/Decryption • several alternatives, will consider simplest • must first encode any message M as a point on the elliptic curve Pm • select suitable curve & point G as in D-H • each user chooses private key nA<n • and computes public key PA=nAG • to encrypt Pm : Cm={kG, Pm+kPb}, k random • decrypt Cm compute: Pm+kPb–nB(kG) = Pm+k(nBG)–nB(kG) = Pm

  24. ECC Security • relies on elliptic curve logarithm problem • fastest method is “Pollard rho method” • compared to factoring, can use much smaller key sizes than with RSA etc • for equivalent key lengths computations are roughly equivalent • hence for similar security ECC offers significant computational advantages

  25. Comparable Key Sizes for Equivalent Security

  26. Legal use of ECC A lot of ECC techniques are patented by the company Certicom NSA bought some patents from them and made the royalty free via NIST standardisation BUT …

  27. Summary • have considered: • distribution of public keys • public-key distribution of secret keys • Diffie-Hellman key exchange • EllGamal encryption • Elliptic Curve cryptography

More Related