163 lines
4.9 KiB
Markdown
163 lines
4.9 KiB
Markdown
# RSA
|
||
|
||
- Introduced in 1977 by Ron Rivest, Adi Shamir and Leonard Adleman
|
||
- The most popular public key algorithm in the world
|
||
- Solves an important problem that symmetric cryptography doesn’t
|
||
- RSA keys are normally `2084` or `4096` bits
|
||
- Security is built around the difficulty of *factoring large numbers*
|
||
|
||
### RSA Encryption
|
||
|
||
- Encryption performed by the *public key* can only be reversed using the *private key*
|
||
|
||
|
||
|
||
### RSA Signatures
|
||
|
||
- The authenticity of signatures generated by the *private key* can be verified by the *public key*
|
||
|
||
|
||
|
||
### Euler Totient Function
|
||
|
||
- Integers $a$ and $m$ are *relatively prime* if they do not share a divisor (except 1)
|
||
- $gcd(a,m) = 1$
|
||
- The **Euler totient** $\Phi$ is the number of integers in $\mathbb{Z}_m = \{0,1,...m-1\}$ for which $gcd(a,m)=1$
|
||
- For example $\Phi(9)=6$ as:
|
||
- $gcd(1,9)=1$ :white_check_mark:
|
||
- $gcd(2,9)=1$ :white_check_mark:
|
||
- $gcd(3,9)=3$ ❌
|
||
- $gcd(4,9)=1$ :white_check_mark:
|
||
- $gcd(5,9)=1$ :white_check_mark:
|
||
- $gcd(6,9)=3$ ❌
|
||
- $gcd(7,9)=1$ :white_check_mark:
|
||
- $gcd(8,9)=1$ :white_check_mark:
|
||
|
||
#### Integer Factorisation
|
||
|
||
- Any integer can be expressed as the multiplication of a list of prime numbers
|
||
|
||
#### Calculating $\Phi(n)$
|
||
|
||
- The totient is much easier to calculate given the prime factorisation of $n$
|
||
|
||
$$
|
||
m = p_1^{e_1}\cdot p_2^{e_2} ... \cdot p_3^{e_3} \\
|
||
\Phi(n) = \prod^n_{i=1} (p_i^{e_i} - p_i^{e_i-1})
|
||
$$
|
||
|
||
##### $\Phi(p)$ for Primes
|
||
|
||
$$
|
||
\Phi(n) = \prod^n_{i=1} (p_i^{e_i} - p_i^{e_i-1}) \\
|
||
\Phi(n) = (p^1 - p_0) = (p-1)
|
||
$$
|
||
|
||
This is similar for semi-primes $n=p\cdot q$
|
||
|
||
$$
|
||
\Phi(n) = (p^1 - p_0) \cdot (q^1-q_0) = (p-1)(q-1)
|
||
$$
|
||
|
||
#### Fermat’s Little Theorem
|
||
|
||
- Fermat’s little theorem states that for some prime $p$, and any integer $a$:
|
||
- $a^{p-1} \equiv 1 \space (mod \space p)$
|
||
- Also note that $a^{p-1} = a\cdot a^{p-2} \equiv 1 \space (mod \space p)$
|
||
- Therefore $a^{p-2}$ is actually the inverse of $a\space (mod \space p)$
|
||
- It follows that $a^p \equiv p \space (mod \space p)$
|
||
|
||
#### Euler’s Theorem
|
||
|
||
- Generalisation of Fermat’s little theorem, not exclusive to primes
|
||
- $a^{\Phi(m)} \equiv 1 \space (mod \space m)$
|
||
- If $gcd(a,m)=1$
|
||
- This works for any integer ring $\mathbb{Z}_m$
|
||
- We can see that FLT is a special case of this
|
||
- $\Phi(p) = (p-1) \therefore a^{\Phi(p)} = a^{p-1} \equiv 1 \space (mod \space p)$
|
||
|
||
## RSA Key Generation
|
||
|
||
1. Choose two large primes, $p$ and $q$
|
||
2. Calculate the modulus $n=p\cdot q$
|
||
3. Calculate $\Phi(n) = (p-1)\cdot (q-1)$
|
||
4. Choose a value $e\in \{2, ..., \Phi(n) -1\}$ where $gcd(\Phi(n),e)=1$
|
||
5. Compute $d$ where $d\cdot e \equiv 1 \space (mod \space \Phi(n))$
|
||
|
||
|
||
|
||
$d$ is very easy to calculate if you know $p$ and $q$
|
||
|
||
#### Example
|
||
|
||
|
||
|
||
##### Encryption
|
||
|
||
- Now we have a public key $(3, 187)$ and private key $107$
|
||
- Encryption and decryption are performed by:
|
||
- $x^e \equiv y \space (mod \space n)$
|
||
- $y^d \equiv x \space (mod \space n)$
|
||
|
||
|
||
|
||
#### Proof
|
||
|
||
- We want to show that $(x^e)^d = x^{ed} \equiv x \space (mod \space n)$
|
||
- Let’s assume $gcd(x,n)=1$, so Euler’s theorem applies
|
||
- $e\cdot d=1\space (mod \space \Phi(n))$
|
||
- $\therefore e\cdot d = 1 + k\cdot \Phi(n)$
|
||
- $x^{e\cdot d} = x^{1+k\cdot \Phi(n)} = x\cdot x^{k+\Phi(n)}$
|
||
- $x\cdot (x^{\Phi(n)})^k=x\cdot(1)^k=x$
|
||
|
||
### Why is RSA Secure
|
||
|
||
- We’d like the message $x$ based on some ciphertext $y$, given the public key $e$:
|
||
- $y \equiv ?^d \space (mod \space n)$
|
||
- $x \equiv y^? \space (mod \space n)$
|
||
- It can be fairly easy to calculate $d$:
|
||
- $e\cdot d \equiv q \space (mod \space \Phi(n))$
|
||
- $\Phi(n) = (p-1)(q-1)$
|
||
- As an attacker we only have access to $e$ and $d$
|
||
|
||
### Exponentiation
|
||
|
||
$$
|
||
x^4 = x^2 \cdot x^2 \\
|
||
x^8 = x^4 \cdot x^4
|
||
$$
|
||
|
||
When calculating an exponent raised to a power of two, we can use previously calculated values.
|
||
|
||
##### Binary Exponentiation
|
||
|
||
Where we treat the exponent as a binary number
|
||
|
||
- We either square or multiply
|
||
|
||
$26=11010_2$
|
||
|
||
- Remember squaring is 1 bit shift to the left
|
||
- Multiplying is just adding $1$
|
||
|
||
$$
|
||
x^{101} \quad = \quad x^{1100101_2} \\
|
||
x\cdot x = x^2 \quad x^{10_2} \\
|
||
x^2 \cdot x = x^3 \quad x^{110_2}\\
|
||
x^3 \cdot x^3 = x^6 \quad x^{1100_2}\\
|
||
x^6 \cdot x^6 = x^{12} \quad x^{11000_2}\\
|
||
x^{12} \cdot x^{12} = x^{24} \quad x^{110000_2}\\
|
||
x^{24} \cdot x = x^{25} \quad x^{110001_2}\\
|
||
x^{25} \cdot x^{25} = x^{50} \quad x^{1100010_2}\\
|
||
x^{50} \cdot x^{50} = x^{100} \quad x^{11000100_2}\\
|
||
x^{100} \cdot x = x^{101} \quad x^{110001001_2}\\
|
||
$$
|
||
|
||
##### Computational Complexity
|
||
|
||
- What is the computational complexity of exponentiation?
|
||
- For a 2048 key:
|
||
- $X^{2^{2048}}$ - A ridiculously big number
|
||
- Whereas using square and multiply
|
||
- $2048=T$ we need $\frac{3T}{2}$ calculations
|