# RSA

- Introduced in 1977 by Ron Rivest, Adi Shamir and Leonard Adleman
- The most popular public key algorithm in the world
- Solves an important problem that symmetric cryptography doesn’t
- RSA keys are normally `2084` or `4096` bits
- Security is built around the difficulty of *factoring large numbers*

### RSA Encryption

- Encryption performed by the *public key* can only be reversed using the *private key*

![1647283829.png](img/1647283829.png)

### RSA Signatures

- The authenticity of signatures generated by the *private key* can be verified by the *public key*

![1647283883.png](img/1647283883.png)

### Euler Totient Function

- Integers $a$ and $m$ are *relatively prime* if they do not share a divisor (except 1)
    - $gcd(a,m) = 1$
- The **Euler totient** $\Phi$ is the number of integers in $\mathbb{Z}_m = \{0,1,...m-1\}$ for which $gcd(a,m)=1$
    - For example $\Phi(9)=6$ as:
        - $gcd(1,9)=1$ ✅
        - $gcd(2,9)=1$ ✅
        - $gcd(3,9)=3$ ❌
        - $gcd(4,9)=1$ ✅
        - $gcd(5,9)=1$ ✅
        - $gcd(6,9)=3$ ❌
        - $gcd(7,9)=1$ ✅
        - $gcd(8,9)=1$ ✅

#### Integer Factorisation

- Any integer can be expressed as the multiplication of a list of prime numbers

#### Calculating $\Phi(n)$

- The totient is much easier to calculate given the prime factorisation of $n$

$$
m = p_1^{e_1}\cdot p_2^{e_2} ... \cdot p_3^{e_3} \\
\Phi(n) = \prod^n_{i=1}  (p_i^{e_i} - p_i^{e_i-1})
$$

##### $\Phi(p)$ for Primes

$$
\Phi(n) = \prod^n_{i=1}  (p_i^{e_i} - p_i^{e_i-1}) \\
\Phi(n) = (p^1 - p_0) = (p-1)
$$

This is similar for semi-primes $n=p\cdot q$

$$
\Phi(n) = (p^1 - p_0) \cdot (q^1-q_0) = (p-1)(q-1)
$$

#### Fermat’s Little Theorem

- Fermat’s little theorem states that for some prime $p$, and any integer $a$:
    - $a^{p-1} \equiv 1 \space (mod \space p)$
        - Also note that $a^{p-1} = a\cdot a^{p-2} \equiv 1 \space (mod \space p)$
        - Therefore $a^{p-2}$ is actually the inverse of $a\space (mod \space p)$
    - It follows that $a^p \equiv p \space (mod \space p)$

#### Euler’s Theorem

- Generalisation of Fermat’s little theorem, not exclusive to primes
    - $a^{\Phi(m)} \equiv 1 \space (mod \space m)$
    - If $gcd(a,m)=1$
- This works for any integer ring $\mathbb{Z}_m$
    - We can see that FLT is a special case of this
    - $\Phi(p) = (p-1) \therefore a^{\Phi(p)} = a^{p-1} \equiv 1 \space (mod \space p)$

## RSA Key Generation

1. Choose two large primes, $p$ and $q$
2. Calculate the modulus $n=p\cdot q$
3. Calculate $\Phi(n) = (p-1)\cdot (q-1)$
4. Choose a value $e\in \{2, ..., \Phi(n) -1\}$ where $gcd(\Phi(n),e)=1$
5. Compute $d$ where $d\cdot e \equiv 1 \space (mod \space \Phi(n))$

![1647285406.png](img/1647285406.png)

$d$ is very easy to calculate if you know $p$ and $q$

#### Example

![1647285527.png](img/1647285527.png)

##### Encryption

- Now we have a public key $(3, 187)$ and private key $107$
- Encryption and decryption are performed by:
    - $x^e \equiv y \space (mod \space n)$
    - $y^d \equiv x \space (mod \space n)$

![1647285650.png](img/1647285650.png)

#### Proof

- We want to show that $(x^e)^d = x^{ed} \equiv x \space (mod \space n)$
- Let’s assume $gcd(x,n)=1$, so Euler’s theorem applies
    - $e\cdot d=1\space (mod \space \Phi(n))$
    - $\therefore e\cdot d = 1 + k\cdot \Phi(n)$
    - $x^{e\cdot d} = x^{1+k\cdot \Phi(n)} = x\cdot x^{k+\Phi(n)}$
    - $x\cdot (x^{\Phi(n)})^k=x\cdot(1)^k=x$

### Why is RSA Secure

- We’d like the message $x$ based on some ciphertext $y$, given the public key $e$:
    - $y \equiv ?^d \space (mod \space n)$
    - $x \equiv y^? \space (mod \space n)$
- It can be fairly easy to calculate $d$:
    - $e\cdot d \equiv q \space (mod \space \Phi(n))$
    - $\Phi(n) = (p-1)(q-1)$
- As an attacker we only have access to $e$ and $d$

### Exponentiation

$$
x^4 = x^2 \cdot x^2 \\
x^8 = x^4 \cdot x^4
$$

When calculating an exponent raised to a power of two, we can use previously calculated values.

##### Binary Exponentiation

Where we treat the exponent as a binary number

- We either square or multiply

$26=11010_2$

- Remember squaring is 1 bit shift to the left
- Multiplying is just adding $1$

$$
x^{101} \quad = \quad x^{1100101_2} \\
x\cdot x = x^2 \quad x^{10_2} \\
x^2 \cdot x = x^3 \quad x^{110_2}\\
x^3 \cdot x^3 = x^6 \quad x^{1100_2}\\
x^6 \cdot x^6 = x^{12} \quad x^{11000_2}\\
x^{12} \cdot x^{12} = x^{24} \quad x^{110000_2}\\
x^{24} \cdot x = x^{25} \quad x^{110001_2}\\
x^{25} \cdot x^{25} = x^{50} \quad x^{1100010_2}\\
x^{50} \cdot x^{50} = x^{100} \quad x^{11000100_2}\\
x^{100} \cdot x = x^{101} \quad x^{110001001_2}\\
$$

##### Computational Complexity

- What is the computational complexity of exponentiation?
    - For a 2048 key:
        - $X^{2^{2048}}$ - A ridiculously big number
    - Whereas using square and multiply
        - $2048=T$ we need $\frac{3T}{2}$ calculations