NSEC5-RSAb

Bản ghi

1 5

2 Contents n 5.1 q n 5.2 DH n 5.3 RSA q(5.4

3

4 n n K SK K Hello PK Hello K= K PK SK

5 Alice Carroll Bob Dave Eve

6 n A k AB k AC n sk A A B k BC k BD E sk B B pk A pk B pk C pk D pk E E sk E C ænö ç = è2ø n( n -1) 2 D sk C C = O( n 2 ) D 2n = O( n) n=5 : 5*4/2 = 10 n=5 : 2*5 = 10 sk D

7 (n= ) Symmetric Key Public Key # of keys n

8 n-1 1 (n 2 -n)/2 2n (Mbps) (kbps)

9 pk = 3 c = 3m m = 1 3 c 1. pk sk 2. pk sk (?) sk = 1/3

10 n q q q (TSP) q (SAT) q q (DLP) q (IF)

11 (DLP) n qy g x y = g x mod p x = log g y. x, g y = g x mod p q 1/ 3 2 / 3» (lnn) (lnlnn) e» p = 1024 bit

12 1985 ElGamal (DLP) (4.3 ) 1998 Cramer, Shoup DLP+ Hash (6 ) 1985 * DLP RSA 1977 Rivest, Shamir, Adleman (IF) DH ( M. Rabin IF OAEP ( Bellare, Rogaway IF+ PKCS#1 V.2

13 1 2 DSA ECDSA RSA-PSS RSASSA-PKCS1-v1_5 RSA-OAEP DH ECDH 64 3-key Triple DES 128 AES Camellia KCipher-2 SHA-256 SHA-384 SHA-512 CBC CFB CTR OFB CCM GCM CMAC HMAC ISO/IEC ISO/IEC CRYPTREC 1

14

15 n qp: q e (p ) q e d mod p = 1 d n qc = E(m) = m e mod p n qd = D(c) = c d mod p

16 n q q q n q q q = a/n q r = a mod n = a - a/n n q 33 mod 5 = 3 q 63 mod 11 = 63 63/11 11 = = 8

17 n qp = 7, e = 3, d = 5 (3 5 mod 7 = 15 mod 7 = 1) n q E(2) = 2 3 mod 7 = 6 q D(6) = 6 5 mod 7 = 2 qe(4) = 4 3 mod 7 = qd(5) = 5 5 mod 7 =

18 1 n + 6 [a] n + n [b] n = [a + b] n = 1 in Z 6 2. e = = = (2+ 6 4)= (1+ 6 2) a = n a = 0-2 = = -5 = (Z )

19 2 n (Z 6, 6 ) = 2 in Z 6 2. e = = = (2 6 4) = (1 6 2) a -1 = 1/a? (a ) = = 2-1 = 3-1 =

20 n (Z 5 *, 5 ) Z 5 *= {1,2,3,4} 2-1 = = = 4 n (Z 7 *, 7 ) (mod 7) 4-1 = 2-1 = (Z 5 *, 5 )

21 a -1 n a a -1 qa n b 1 (mod n) b qb 1: n» 3 1 mod 7 = 3 no» 3 2 mod 7 = 6 no» 3 4 mod 7 = 1 yes! qb 2: n a x b (mod n) gcd(a,n) b.

22 pk = 3 E(2) = 2 3 mod 7 = 6 D(6) = 6 4 mod 7 = 2 sk = 4 (= 1/3) 1. pk sk 2. pk sk (p )

23 n (mod 13) (mod 13) 3. 6 * 7 * 8 (mod 13) (mod 13) 5. 4/3 (mod 13)

24 DH

25 1. Diffie-Hellman n W. Diffie and M.E. Hellman, New directions in cryptography, IEEE Transactions on Information Theory 22 (1976),

26 2015 n ACM A. M. Turing Award q q Google 100 (1 )» 1.2 q

27 Alan M. Turing n q q q 41

28 D-H n q p, Z p *, g, n A 1. x Z p-1 2. a = g x mod p n B 1. y Z p-1 2. b = g y mod p 3. k A = b x mod p = g yx mod p 3. k B = a y mod p = g xy mod p = k B

29 2. ElGamal n q p, Z p *, g, n A( 1. x Z p-1 2. E pk [m]: u =g x e = m pk B x (=m g yx ) pk B u,e n B 1. y Z p-1 2. pk B = g y mod p 3. m = D y [u,e] = e/u y = m g xy /g xy

30 pk = g y e = pk x m pk x m m = ( g x ) y 1. pk sk sk = y 2. pk sk (Yes!)

31 n p = 11 Zp* g = 3 DH n A x = 3 a = g x mod p B B b = 6 A 1. a 2. A b k 3. a C k

32 RSA

33 (IF) n n n=pq p, q n = pq λ(n) = LCM(p-1,q-1) e d

34 RSA n Rivest, Shamir and Adeleman A method for obtaining digital signatures and publickey cryptosystems, Communications of the ACM, Vol. 21, No.2, pp , mit.edu/~rivest/rs a-photo.jpeg Adi, Ron and Len

35 RSA n n n n n q Diffie and Hellman, New Directions in Cryptography, IEEE Trans. on Information Theory, Vol. 22, No. 6, q MIT Rivest 29, Adelman, Shamir q q MIT LCS TM No. 82, ( q Martin Gardner, A New Kind of Cipher That Would Take Millions of Years to Break, Scientific American, Vol. 237, No. 2, q q CACM

36 RSA n Rivest, Shamir, Adeleman A method for obtaining digital signatures and publickey cryptosystems, Communication s of the ACM, Vol. 21, No.2, pp , 1978

37 RSA n q p, q q n = pq ( q λ(n) = LCM(p-1, q-1) q : λ(n) e q : e λ(n) d = e -1 mod λ(n) ed = 1 mod λ(n) n / / C = E(M) = M e (mod n) M = D(C) = C d (mod n)

38 n q p = 5, q = 7 λ(n) =LCM(5-1, 7-1) = (4 6)/2 = 12 q e = 5 GCD(e, λ(n)) = q d = e -1 mod λ(n) = 5-1 = 5 (5 5 mod 12 = 1 ) n C = E[M] = 4 e mod 35 = 9 n M = D[C] = 9 d mod 35 = 9 5 mod 35 = 4

39 <a> n subgroup <a> = {a k : k 1} a: generator <2> = {2, 4, 1} <3> = {3, 2, 6, 4, 5, 1} = Z 7 * 3 Z 7 * <6> = {6, 1} a a 2 a 3 a 4 a 5 a Z 7*

40 : a t = e t n ord(a) a t = e t <2> = {2, 4, 1} ord(2) = 3 ord(3) = ord(6) = n primitive root q ord(a) = Z n * a q 3, 5 Z 7 * a a 2 a 3 a 4 a 5 a

41 : a t = e t a 0 =1 a 5 =5 a 1 =3 a 2 =2 a a 2 a 3 a 4 a 5 a a 4 =4 a 3 =6

42 Fermat, Pierre de n q Last theorem x n + y n = z n n>2 I have discovered a truly remarkable proof which this margin is too small to contain Andrew J. Wiles q Little theorem com/biography/fermat.html

43 n n (Fermat) p, for any a in Z p *, a p-1 1 (mod p) mod 11 = mod 11 = mod 11 = mod 11 =

44 RSA n Z* 11 M = a 1 =2 a 2 =4 a 10 =1 a 9 =6 a 8 =3 a 3 =8=C a 4 =5 a 5 =10 n RSA p = 11 λ(p) = p 1 = 10 e = 3 d = e -1 mod 10 = 7 M = 2 C = M 3 = 8 M = C 7 = (a 3 ) 7 = 2 a 7 =7 a 6 =9

45 RSA n Z* 11 a 1 =2 a 2 =4 a 10 =1 a 9 =6 a 8 =3 a 3 =8 a 4 =5 a 5 =10 n RSA p = 11 φ(p) = p 1 = 10 e = 3 d = 7 m = 4 c = E(4) = m = 8 c = E(8) = a 7 =7 a 6 =9

46 n n RSA 3 ed (mod 35) p q g g 2 g 3 g 4 g 5 g 6 g 7 g 8 g 9 g 10 g 11 g 12 g 13 p= q= n= λ(n)=lcm(p-1, q-1) = LCM(4,6)=12

47 RSA 2010 n 2010 q2010 NIST Key Triple DES AES, key T-DES RSA/DSA/DH 1024 bit 2048 SHA1 SHA2

48 RSA Cryptrec ( )

49 n RSA n = 5 11 = 55, e = 7 RSA 1. d 2. M = c = 8

50 n n DH n 1 t