notes/docs/lectures/cryptography/10_RSA.md

RSA

• Introduced in 1977 by Ron Rivest, Adi Shamir and Leonard Adleman
• The most popular public key algorithm in the world
• Solves an important problem that symmetric cryptography doesn’t
• RSA keys are normally 2084 or 4096 bits
• Security is built around the difficulty of factoring large numbers

RSA Encryption

• Encryption performed by the public key can only be reversed using the private key

RSA Signatures

• The authenticity of signatures generated by the private key can be verified by the public key

Euler Totient Function

• Integers a and m are relatively prime if they do not share a divisor (except 1)
  • gcd(a,m) = 1
• The Euler totient \Phi is the number of integers in \mathbb{Z}_m = \{0,1,...m-1\} for which gcd(a,m)=1
  • For example \Phi(9)=6 as:
    • gcd(1,9)=1 ✅
    • gcd(2,9)=1 ✅
    • gcd(3,9)=3 ❌
    • gcd(4,9)=1 ✅
    • gcd(5,9)=1 ✅
    • gcd(6,9)=3 ❌
    • gcd(7,9)=1 ✅
    • gcd(8,9)=1 ✅

Integer Factorisation

• Any integer can be expressed as the multiplication of a list of prime numbers

Calculating \Phi(n)

• The totient is much easier to calculate given the prime factorisation of n

m = p_1^{e_1}\cdot p_2^{e_2} ... \cdot p_3^{e_3} \\
\Phi(n) = \prod^n_{i=1}  (p_i^{e_i} - p_i^{e_i-1})

\Phi(p) for Primes

\Phi(n) = \prod^n_{i=1}  (p_i^{e_i} - p_i^{e_i-1}) \\
\Phi(n) = (p^1 - p_0) = (p-1)

This is similar for semi-primes n=p\cdot q

\Phi(n) = (p^1 - p_0) \cdot (q^1-q_0) = (p-1)(q-1)

Fermat’s Little Theorem

• Fermat’s little theorem states that for some prime p, and any integer a:
  • a^{p-1} \equiv 1 \space (mod \space p)
    • Also note that a^{p-1} = a\cdot a^{p-2} \equiv 1 \space (mod \space p)
    • Therefore a^{p-2} is actually the inverse of a\space (mod \space p)
  • It follows that a^p \equiv p \space (mod \space p)

Euler’s Theorem

• Generalisation of Fermat’s little theorem, not exclusive to primes
  • a^{\Phi(m)} \equiv 1 \space (mod \space m)
  • If gcd(a,m)=1
• This works for any integer ring \mathbb{Z}_m
  • We can see that FLT is a special case of this
  • \Phi(p) = (p-1) \therefore a^{\Phi(p)} = a^{p-1} \equiv 1 \space (mod \space p)

RSA Key Generation

1. Choose two large primes, p and q
2. Calculate the modulus n=p\cdot q
3. Calculate \Phi(n) = (p-1)\cdot (q-1)
4. Choose a value e\in \{2, ..., \Phi(n) -1\} where gcd(\Phi(n),e)=1
5. Compute d where d\cdot e \equiv 1 \space (mod \space \Phi(n))

d is very easy to calculate if you know p and q

Example

Encryption

• Now we have a public key (3, 187) and private key 107
• Encryption and decryption are performed by:
  • x^e \equiv y \space (mod \space n)
  • y^d \equiv x \space (mod \space n)

Proof

• We want to show that (x^e)^d = x^{ed} \equiv x \space (mod \space n)
• Let’s assume gcd(x,n)=1, so Euler’s theorem applies
  • e\cdot d=1\space (mod \space \Phi(n))
  • \therefore e\cdot d = 1 + k\cdot \Phi(n)
  • x^{e\cdot d} = x^{1+k\cdot \Phi(n)} = x\cdot x^{k+\Phi(n)}
  • x\cdot (x^{\Phi(n)})^k=x\cdot(1)^k=x

Why is RSA Secure

• We’d like the message x based on some ciphertext y, given the public key e:
  • y \equiv ?^d \space (mod \space n)
  • x \equiv y^? \space (mod \space n)
• It can be fairly easy to calculate d:
  • e\cdot d \equiv q \space (mod \space \Phi(n))
  • \Phi(n) = (p-1)(q-1)
• As an attacker we only have access to e and d

Exponentiation

x^4 = x^2 \cdot x^2 \\
x^8 = x^4 \cdot x^4

When calculating an exponent raised to a power of two, we can use previously calculated values.

Binary Exponentiation

Where we treat the exponent as a binary number

• We either square or multiply

26=11010_2

• Remember squaring is 1 bit shift to the left
• Multiplying is just adding 1

x^{101} \quad = \quad x^{1100101_2} \\
x\cdot x = x^2 \quad x^{10_2} \\
x^2 \cdot x = x^3 \quad x^{110_2}\\
x^3 \cdot x^3 = x^6 \quad x^{1100_2}\\
x^6 \cdot x^6 = x^{12} \quad x^{11000_2}\\
x^{12} \cdot x^{12} = x^{24} \quad x^{110000_2}\\
x^{24} \cdot x = x^{25} \quad x^{110001_2}\\
x^{25} \cdot x^{25} = x^{50} \quad x^{1100010_2}\\
x^{50} \cdot x^{50} = x^{100} \quad x^{11000100_2}\\
x^{100} \cdot x = x^{101} \quad x^{110001001_2}\\

Computational Complexity

• What is the computational complexity of exponentiation?
  • For a 2048 key:
    • X^{2^{2048}} - A ridiculously big number
  • Whereas using square and multiply
    • 2048=T we need \frac{3T}{2} calculations