An introduction to cryptography and

cryptanalysis
Edward Schaefer
Santa Clara University
[email protected]
I have given history short-shrift in my attempt to get to modern cryptography as quickly
as possible. As sources for these lectures I used conversations with K. Dyer, B. Kaliski, H.W.
Lenstra, P. Makowski, Jr., K. McCurley, A. Odlyzko, C. Pomerance, M. Robshaw, and Y.L.
Yin as well as the publications listed in the bibliography. I am very grateful to each person
listed above. Any mistakes in this document are mine. Please notify me of any that you nd
at the above e-mail address.
Table of contents
Part I: Introduction
1 Vocabulary
2 Concepts
3 History
4 Crash Course in Number Theory
4.1 Calculator Algorithms - Reducing a(mod m) and Repeated Squares
5 Running Time of Algorithms
Part II: Cryptography
6 Simple Cryptosystems
7 Symmetric key cryptography
8 Finite Fields
9 Finite Fields, Part II
10 Modern Stream Ciphers
10.1 RC4
10.2 Self-Synchronizing Stream Ciphers
10.3 One-Time Pads
11 Modern Block Ciphers
11.1 Modes of Operation of a Block Cipher
11.2 The Block Cipher DES
11.3 The Block Cipher AES
12 Public Key Cryptography
12.1 RSA
12.2 Finite Field Discrete Logarithm Problem
12.3 Die Hellman Key Agreement
12.4 Lesser Used Public Key Cryptosystems
1
12.4.1 RSA for Message Exchange
12.4.2 ElGamal Message Exchange
12.4.3 Massey Omura Message Exchange
12.5 Elliptic Curve Cryptography
12.5.1 Elliptic Curves
12.5.2 Elliptic Curve Discrete Logarithm Problem
12.5.3 Elliptic Curve Cryptosystems
12.5.4 Elliptic Curve Die Hellman
12.5.5 Elliptic Curve ElGamal Message Exchange
13 Hash functions and Message Authentication Codes
13.1 The MD5 hash function
14 Signatures and Authentication
14.1 Signatures with RSA
14.2 ElGamal Signature System and Digital Signature Standard
14.3 Schnorr Authentication and Signature Scheme
14.4 Pairing based cryptography for digital signatures
Part III: Applications of Cryptography
15 Public Key Infrastructure
15.1 Certicates
15.2 PGP and Web-of-Trust
16 Internet Security
16.1 Transport Layer Security
16.2 IPSec
17 Timestamping
18 KERBEROS
19 Key Management and Salting
20 Quantum Cryptography
21 Blind Signatures
22 Digital Cash
23 Secret Sharing
24 Committing to a Secret
25 Digital Elections
Part IV: Cryptanalysis
26 Basic Concepts of Cryptanalysis
27 Historical Cryptanalysis
27.1 The Vigen`ere cipher
28 Cryptanalysis of modern stream ciphers
2
28.1 Continued Fractions
28.2 b/p Random Bit Generator
28.3 Linear Shift Register Random Bit Generator
29 Cryptanalysis of Block Ciphers
29.1 Brute Force Attack
29.2 Standard ASCII Attack
29.3 Meet-in-the-Middle Attack
29.4 One-round Simplied AES
29.5 Linear Cryptanalysis
29.6 Dierential Cryptanalysis
30 Attacks on Public Key Cryptography
30.1 Pollards algorithm
30.2 Factoring
30.2.1 Fermat Factorization
30.2.2 Factor Bases
30.2.3 Continued Fraction Factoring
30.2.4 H.W. Lenstra Jr.s Elliptic Curve Method of Factoring
30.2.5 Number Fields
30.2.6 The Number Field Sieve
30.3 Solving the Finite Field Discrete Logarithm Problem
30.3.1 The Chinese Remainder Theorem
30.3.2 The Pohlig Hellman Algorithm
30.3.3 The Index Calculus Algorithm
3
Introduction
Cryptography is used to hide information. It is not only use by spies but for phone, fax
and e-mail communication, bank transactions, bank account security, PINs, passwords and
credit card transactions on the web. It is also used for a variety of other information security
issues including electronic signatures, which are used to prove who sent a message.
1 Vocabulary
A plaintext message, or simply a plaintext, is a message to be communicated. A disguided
version of a plaintext message is a ciphertext message or simply a ciphertext. The process
of creating a ciphertext from a plaintext is called encryption. The process of turning a
ciphertext back into a plaintext is called decryption. The verbs encipher and decipher are
synonymous with the verbs encrypt and decrypt. In England, cryptology is the study of
encryption and decryption and cryptography is the application of them. In the U.S., the
terms are synonymous, and the latter term is used more commonly.
In non-technical English, the term encode is often used as a synonym for encrypt. We
will not use it that way. To encode a plaintext changes the plaintext into a series of bits
(usually) or numbers (traditionally). A bit is simply a 0 or a 1. There is nothing secret about
encoding. A simple encoding of the alphabet would be A 0, . . . , Z 25. Using this, we
could encode the message HELLO as 7 4 11 11 14. The most common method of encoding
a message nowadays is to replace it by its ASCII equivalent, which is an 8 bit representation
for each symbol. See Appendix A for ASCII encoding. Decoding turns bits or numbers back
into plaintext.
A stream cipher operates on a message symbol-by-symbol, or nowadays bit-by-bit. A
block cipher operates on blocks of symbols. A digraph is a pair of letters and a trigraph is a
triple of letters. These are blocks that were used historically in cryptography. The Advanced
Encryption Standard (AES) operates on 128 bit strings. So when AES is used to encrypt a
text message, it encrypts blocks of 128/8 = 16 symbols.
A transposition cipher rearranges the letters, symbols or bits in a plaintext. A substitution cipher
replaces letters, symbols or bits in a plaintext with others without changing the order. A
product cipher alternates transposition and substitution. The concept of stream versus block
cipher really only applies to substitution and product ciphers, not transposition ciphers.
An algorithm is a series of steps performed by a computer (nowadays) or a person
(traditionally) to perform some task. A cryptosystem consists of an enciphering algo-
rithm and a deciphering algorithm. The word cipher is synonymous with cryptosystem.
A symmetric key cryptosystem requires a secret shared key. We will see examples of keys
later on. Two users must agree on a key ahead of time. In a public key cryptosystem, each
user has an encrypting key which is published and a decrypting key which is not.
Cryptanalysis is the process by which the enemy tries to turn CT into PT. It can also
mean the study of this.
Cryptosystems come in 3 kinds:
1. Those that have been broken (most).
4
2. Those that have not yet been analyzed (because they are new and not yet widely used).
3. Those that have been analyzed but not broken. (RSA, Discrete log cryptosystems, Triple-
DES, AES).
3 most common ways for the enemy to turn ciphertext into plaintext:
1. Steal/purchase/bribe to get key
2. Exploit sloppy implementation/protocol problems (hacking). Examples: someone used
spouses name as key, someone sent key along with message
3. Cryptanalysis
Alice is the sender of an encrypted message. Bob is the recipient. Eve is the eavesdropper
who tries to read the encrypted message.
2 Concepts
1. Encryption and decryption should be easy for the proper users, Alice and Bob. Decryption
should be hard for Eve.
Number theory is an excellent source of discrete (i.e. nite) problems with easy and hard
aspects. Computers are much better at handling discrete objects.
2. Security and practicality of a successful cryptosystem are almost always tradeos. Prac-
ticality issues: time, storage, co-presence.
3. Must assume that the enemy will nd out about the nature of a cryptosystem and will
only be missing a key.
3 History
400 BC Spartan scytale cipher (sounds like Italy). Example of transposition cipher. Letters
were written on a long thin strip of leather wrapped around a cylinder. The diameter of the
cylinder was the key.
_____________________________
/T/H/I/S/I/S/_/ / \
/ /H/O/W/I/T/ | |
/ /W/O/U/L/D/ \ /
-----------------------------
Julius Caesars substitution cipher. Shift all letters three to the right. In our alphabet
that would send A D, B E, . . . , Z C.
1910s British Playfair cipher (Boer War, WWI). One of the earliest to operate on di-
graphs. Also a substitution cipher. Key PALMERSTON
P A L M E
R S T O N
B C D F G
H IJ K Q U
V W X Y Z
5
To encrypt SF, make a box with those two letter as corners, the other two corners are the
ciphertext OC. The order is determined by the fact that S and O are in the same row as are
F and C. If two plaintext letters are in the same row then replace each letter by the letter
to its right. So SO becomes TN and BG becomes CB. If two letters are in the same column
then replace each letter by the letter below it. So IS becomes WC and SJ becomes CW.
Double letters are separated by Xs so The plaintext BALLOON would become BA LX LO
ON before being encrypted. There are no Js in the ciphertext, only Is.
The Germany Armys ADFGVX cipher used during World War I. One of the earliest
product ciphers.
There was a xed table.
A D F G V X
A
D
F
G
V
X
_

_
K Z W R 1 F
9 B 6 C L 5
Q 7 J P G X
E V Y 3 A N
8 O D H 0 2
U 4 I S T M
_

_
To encrypt, replace the plaintext letter/digit by the pair (row, column). So plaintext PRO-
DUCTCIPHERS becomes FG AG VD VF XA DG XV DG XF FG VG GA AG XG. Thats
the substitution part. Transposition part follows and depends on a key with no repeated
letters. Lets say it is DEUTSCH. Number the letters in the key alphabetically. Put the
tentative ciphertext above, row by row under the key.
D E U T S C H
2 3 7 6 5 1 4
F G A G V D V
F X A D G X V
D G X F F G V
G G A A G X G
Write the columns numerically. Ciphertext: DXGX FFDG GXGG VVVG VGFG GDFA
AAXA (the spaces would not be used).
In World War II it was shown that alternating substitution and transposition ciphers is
a very secure thing to do. ADFGVX is weak since the substitution and transposition each
occur once and the substitution is xed, not key controlled.
In the late 1960s, threats to computer security were considered real problems. There
was a need for strong encryption in the private sector. One could now put very complex
algorithms on a single chip so one could have secure high-speed encryption. There was also
the possibility of high-speed cryptanalysis. So what would be best to use?
The problem was studied intensively between 1968 and 1975. In 1974, the Lucifer cipher
was introduced and in 1975, DES (the Data Encryption Standard) was introduced. In 2002,
AES was introduced. All are product ciphers. DES uses a 56 bit key with 8 additional bits
for parity check. DES operates on blocks of 64 bit plaintexts and gives 64 bit ciphertexts.
6
It alternates 16 substitutions with 15 transpositions. AES uses a 128 bit key and alternates
10 substitutions with 10 transpositions. Its plaintexts and ciphertexts each have 128 bits.
In 1975 came public key cryptography. This enables Alice and Bob to agree on a key safely
without ever meeting.
4 Crash course in Number Theory
You will be hit with a lot of number theory here. Dont try to absorb it all at once. I want
to get it all down in one place so that we can refer to it later. Dont panic if you dont get
it all the rst time through.
Let Z denote the integers . . . , 2, 1, 0, 1, 2, . . .. The symbol means is an element of.
If a, b Z we say a divides b if b = na for some n Z and write a[b. a divides b is just
another way of saying b is a multiple of a. So 3[12 since 12 = 4 3, 3[3 since 3 = 1 3, 5[ 5
since 5 = 1 5, 6[0 since 0 = 0 6. If x[1, what is x? (Answer 1). Properties:
If a, b, c Z and a[b then a[bc. I.e., since 3[12 then 3[60.
If a[b and b[c then a[c.
If a[b and a[c then a[b c.
If a[b and a ,[c (not divide) then a ,[b c.
The primes are 2, 3, 5, 7, 11, 13 . . ..
The Fundamental Theorem of Arithmetic: Any n Z, n > 1, can be written uniquely as
a product of powers of distinct primes n = p

1
1
. . . p

r
r
where the
i
s are positive integers.
For example 90 = 2
1
3
2
5
1
.
Given a, b Z
0
(the non-negative integers), not both 0, the greatest common divisor of
a and b is the largest integer d dividing both a and b. It is denoted gcd(a, b) or just (a, b). As
examples: gcd(12, 18) = 6, gcd(12, 19) = 1. You were familiar with this concept as a child.
To get the fraction 12/18 into lowest terms, cancel the 6s. The fraction 12/19 is already in
lowest terms.
If you have the factorization of a and b written out, then take the product of the primes
to the minimum of the two exponents, for each prime, to get the gcd. 2520 = 2
3
3
2
5
1
7
1
and 2700 = 2
2
3
3
5
2
7
0
so gcd(2520, 2700) = 2
2
3
2
5
1
7
0
= 180. Note 2520/180 = 14,
2700/180 = 15 and gcd(14, 15) = 1. We say that two numbers with gcd equal to 1 are
relatively prime.
Factoring is slow with large numbers. The Euclidean algorithm for gcding is very fast
with large numbers. Find gcd(329, 119). Recall long division. When dividing 119 into 329
you get 2 with remainder of 91. In general dividing y into x you get x = qy + r where
0 r < y. At each step, previous divisor and remainder become the new dividend and
divisor.
329 = 2 119 + 91
119 = 1 91 + 28
91 = 3 28 + 7
28 = 4 7 + 0
The number above the 0 is the gcd. So gcd(329, 119) = 7.
7
We can always write gcd(a, b) = na + mb for some n, m Z. At each step, replace the
smaller underlined number.
7 = 91 3 28 replace smaller
= 91 3(119 1 91) simplify
= 4 91 3 119 replace smaller
= 4 (329 2 119) 3 119 simplify
7 = 4 329 11 119
So we have 7 = 4 329 11 119 where n = 4 and m = 11.
Modulo. There are two kinds, that used by number theorists and that used by computer
scientists.
Number theorists: a b(modm) if m[a b. In words: a and b dier by a multiple of m.
So 7 2(mod5), since 5[5, 2 7(mod5) since 5[ 5, 12 7(mod5) since 5[5, 12 2(mod5)
since 5[10, 7 7(mod5) since 5[0, 3 7(mod5) since 5[ 10. Below, the integers with the
same symbols underneath them are all congruent (or equivalent) mod 5.
4 3 2 1 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14

In general working mod m breaks the integers into m subsets. Each subset contains
exactly one representative in the range [0, m 1]. The set of subsets is denoted Z/mZ or
Z
m
. We see that Z/mZ has m elements. So the number 0, . . . , m1 are representatives of
the m elements of Z/mZ.
Computer scientists: b(modm) = r is the remainder you get 0 r < m when dividing
m into b. So 12(mod5) is 2 and 7(mod5) is 2.
Here are some examples of mod you are familiar with. Clock arithmetic is mod 12. If
its 3 hours after 11 then its 2 oclock because 11 + 3 = 14 2(mod 12). Even numbers are
those numbers that are 0(mod 2). Odd numbers are those that are 1(mod 2).
Properties of mod
1) a a(modm)
2) if a b(modm) then b a(modm)
3) if a b(modm) and b c(modm) then a c(modm)
4) If a b(modm) and c d(modm) then a c b d(modm) and a c b d(modm). So
you can do these operations in Z/mZ.
Another way to explain 4) is to say that mod respects +, and .
12, 14
mod 5
2, 4
+ +
26
mod 5
1
Say m = 5, then Z/5Z = 0, 1, 2, 3, 4. 2 3 = 1 in Z/5Z since 2 3 = 6 1(mod5).
3 + 4 = 2 in Z/5Z since 3 + 4 = 7 2(mod5). 0 1 = 4 in Z/5Z since 1 4(mod5).
Addition table in Z/5Z.
0 1 2 3 4
8
0
1
2
3
4
_

_
0 1 2 3 4
1 2 3 4 0
2 3 4 0 1
3 4 0 1 2
4 0 1 2 3
_

_
5) An element x of Z/mZ has a multiplicative inverse (1/x) or x
1
in Z/mZ when gcd(x, m) =
1. The elements of Z/mZ with inverses are denoted Z/mZ

. Note 1/2 = 2
1
3(mod5)
since 2 3 1(mod5).
When we work in Z/9Z = 0, 1, . . . , 8 we can use +, , . When we work in Z/9Z

=
1, 2, 4, 5, 7, 8 we can use , .
Find the inverse of 7 mod 9, i.e. nd 7
1
in Z/9Z (or more properly in Z/9Z

). Use the
Euclidean algorithm
9 = 1 7 + 2
7 = 3 2 + 1
(2 = 2 1 + 0)
so
1 = 7 3 2
1 = 7 3(9 7)
1 = 4 7 3 9
Take that equation mod 9 (we can do this because a a(mod m)). We have 1 = 4 73 9
4 7 3 0 4 7(mod9). So 1 4 7(mod9) so 7
1
= 1/7 = 4 in Z/9Z or 7
1
4(mod9)
and also 1/4 = 7 in Z/9Z.
Whats 2/7 in Z/9Z? 2/7 = 2 1/7 = 2 4 = 8 Z/9Z. So 2/7 8(mod9). Note
2 8 7(mod9) since 9[(2 56 = 54).
6 cant have an inverse mod 9. If 6x 1(mod9) then 9[6x 1 so 3[6x 1 and 3[6x so
3[ 1 which is not true which is why 6 cant have an inverse mod 9.
6) If a b(modm) and gcd(c, m) = 1 (so gcd(d, m) = 1) then ac
1
bc
1
(modm) or
a/c b/c(modm). In other words, division works well as long as you divide by something
relatively prime to the modulus m, i.e. invertible. It is like avoiding dividing by 0.
7) Solving ax b(modm) with a, b, m given. If gcd(a, m) = 1 then the solutions are all
numbers x a
1
b(modm). If gcd(a, m) = g then there are solutions when g[b. Then
the equation is equivalent to ax/g b/g(modm/g). Now gcd(a/g, m/g) = 1 so x
(a/g)
1
(b/g)(modm/g) are the solutions. If g ,[b then there are no solutions.
Solve 7x 3(mod10). gcd(7, 10) = 1. So x 7
1
3(mod10). Find 7
1
(mod10):
10 = 7 + 3, 7 = 2 3 + 1 so 1 = 7 2(10 7) = 3 7 2 10. Thus 1 3 7(mod10)
and 1/7 3 7
1
(mod10). So x 3 3 9(mod10). Of course this is the set of positive
integers whose 1s digit is a 9 or negative integers whose 1s digit is a 1.
Solve 6x 8(mod10). gcd(6, 10) = 2 and 2[8 so there are solutions. This is the same as
3x 4(mod5) so x 4 3
1
(mod5). Weve seen 3
1
2(mod5) so x 4 2 3(mod5).
Another way to write that is x = 3 + 5n where n Z. Yet another is x 3 or 8(mod10).
Solve 6x 7(mod10). Cant since gcd(6, 10) = 2 and 2 ,[7.
Lets do some cute practice with modular inversion. A computer will always use the
Euclidean algorithm. But cute tricks will help us understand mod better. Example: Find
9
the inverses of all elements of Z/17Z

. The integers that are 1 mod 17 are those of the

form 17n + 1. We can factor a few of those. The rst few positive integers that are 17n + 1
bigger than 1 are 18, 35, 52. Note 18 = 2 9 so 2 9 1(mod 17) and 2
1
9(mod 17) and
9
1
2(mod 17). We also have 18 = 36, so 3 and 6 are inverses mod 17. We have 35 = 57 so
5 and 7 are inverses. We have 52 = 4 13. Going back, we have 18 = 2 9 (2)(9) 15 8
and 18 = 3 6 = (3)(6) 14 11. Similarly we have 35 = 5 7 = (5)(7) 12 10.
Note that 16 1 and 1 = (1)(1) 16 16. So now we have the inverse of all elements
of Z/17Z

.
Practice using mod: Show x
3
x 1 is never a perfect square if x Z. Solution: All
numbers are 0, 1, or 2(mod3). So all squares are 0
2
, 1
2
, or 2
2
(mod3) 0, 1, 1(mod3). But
x
3
x 1 0
3
0 1 2, 1
3
1 1 2, or2
3
2 1 2(mod3).
The Euler phi function: Let n Z
+
. We have Z/nZ

= a [ 1 a n, gcd(a, n) = 1.
(This is a group under multiplication.) Z/12Z

= 1, 5, 7, 11. Let (n) = [Z/nZ

[. We
have (12) = 4. We have (5) = 4 and (6) = 2. If p is prime then (p) = p 1. What
is (5
3
)? Well Z

125
= Z
125
without multiples of 5. There are 125/5 = 25 multiples of 5.
So (125) = 125 25. If r 1, and p is prime, then (p
r
) = p
r
p
r1
= p
r1
(p 1). If
gcd(m, n) = 1 then (mn) = (m)(n). To compute of a number, break it into prime
powers as in this example: (720) = (2
4
)(3
2
)(5) = 2
3
(2 1)3
1
(3 1)(5 1) = 192. So
if n =

p

i
i
then (n) = p

1
1
1
(p
1
1) p

r
1
r
(p
r
1).
Fermats little theorem. If p is prime and a Z then a
p
a(modp). If p does not divide
a then a
p1
1(modp).
So it is guaranteed that 2
5
2(mod5) since 5 is prime and 4
5
4(mod5) and 2
4

1(mod5). You can check that they are all true.

If gcd(a, m) = 1 then a
(m)
1(modm).
We have (10) = (5)(2) = 4 1 = 4. Z/10Z

= 1, 3, 7, 9. So it is guaranteed that
1
4
1(mod10), 3
4
1(mod10), 7
4
1(mod10) and 9
4
1(mod10). You can check that
they are all true.
If gcd(c, m) = 1 and a b(mod(m)) with a, b Z
0
then c
a
c
b
(modm).
Reduce 2
1004
(mod15). Note (15) = (5)(3) = 4 2 = 8 and 1004 4(mod8) so
2
1004
2
4
16 1(mod15).
In other words, exponents work mod (m) as long as the bases are relatively prime.
4.1 Calculator algorithms
Reducing a mod m (often the parenthesis are omitted): Reducing 1000 mod 23. On calcu-
lator: 1000 23 = (you see 43.478...) 43 = (you see .478...) 23 = (you see 11). So
1000 11 mod 23. Why does it work? If divide 23 into 1000 you get 43 with remainder
11. So 1000 = 43 23 + 11. 23 and get 43 +
11
23
. 43 and get
11
23
. 23 and get 11. Note
1000 = 43 23 + 11(mod 23). So 1000 43 23 + 11 0 + 11 11(mod 23).
Repeated squares algorithm
Recall, if (b, m) = 1 and n a(mod (m)) then b
n
b
a
(mod m). So if computing
b
n
(mod m) with (b, m) = 1 and n (m), rst reduce n mod (m).
10
Repeated squares algorithm for a calculator. This is useful for reducing b
n
mod m when
n < (m), but n is still large. Reduce 87
43
mod 103. First write 43 in base 2. This is
also called the binary representation of 43. The sloppy/easy way is to write 43 as a sum
of dierent powers of 2 We have 43 = 32 + 8 + 2 + 1 (keep subtracting o largest possible
power of 2). We are missing 16 and 4. So 43 = (101011)
2
(binary). Recall this means
43 = 1 2
5
+ 0 2
4
+ 1 2
3
+ 0 2
2
+ 1 2
1
+ 1 2
0
. A computer uses a program described by
the following pseudo-code Let v be an array (vector) whose entries are v[0], v[1], v[2], . . ..
i = 0
n = 43
while n > 0
v[i] = n(mod 2)
n = (n v[i])/2
i = i + 1
end while
The output is a vector with the binary representation written backwards. (In class, do
the example.)
Now the repeated squares algorithm for reducing b
n
(modm). Write n in its binary rep-
resentation (v[k]v[k 1] . . . v[1]v[0])
2
. Let a be the partial product. At the beginning a = 1.
Round 0: If v[0] = 1 change a to b, else no change in a.
Round 1: Reduce b
2
(modm) = b[1]. If v[1] = 1, replace a by the reduction of a b[1](modm),
else no change in a.
Round 2: Reduce b[1]
2
(modm) = b[2]. If v[2] = 1, replace a by the reduction of ab[2](modm),
else no change in a.
.
.
.
Round k: Reduce b[k 1]
2
(modm) = b[k]. Now v[k] = 1, so replace a by the reduction of
a b[k](modm). Now a is congruent to b
n
(modn).
Or as pseudo-code
a = 1
if v[0] = 1 then a = b
b[0] = b
for i = 1 to k
b[i] = b[i 1]
2
(mod m)
if v[i] = 1, a = a b[i](mod m)
end for
print(a)
Well do the above example again with b = 87, n = 43. 43 in base 2 is 101011, so k = 5.
v[0] = 1, v[1] = 1, v[2] = 0, v[3] = 1, v[4] = 0, v[5] = 1.
11
a = 1 (v[0] = 1) a = 87
87
2
50 (v[1] = 1) a = 50 87 24 ( 87
2
87
1
)
50
2
28 (v[2] = 0) a = 24
28
2
63 (v[3] = 1) a 63 24 70 ( 87
8
87
2
87
1
)
63
2
55 (v[4] = 0) a = 70
55
2
38 (v[5] = 1) a = 38 70 85 ( 87
32
87
8
87
2
87
1
)
( 87
32+8+2+1
87
43
)
5 Running Time of Algorithms
Encryption and decryption should be fast; cryptanalysis should be slow. To quantify these
statements, we need to understand how fast certain cryptographic algorithms run.
Logarithms really shrink very large numbers. As an example, if you took a sheet of paper
and then put another on top, and then doubled the pile again (four sheets now) and so on
until youve doubled the pile 50 times you would have 2
50
10
15
sheets of paper and the
stack would reach the sun. On the other hand log
2
(2
50
) = 50. A stack of 50 sheets of paper
is 1cm tall.
If x is a real number then x| is the largest integer x. So 1.4| = 1 and 1| = 1. Recall
how we write integers in base 2. Keep removing the largest power of 2 remaining. Example:
47 32. 47 32 = 15. 15 8 = 7, 7 4 = 3, 3 2 = 1. So 47 = 32 + +8 + 4 + 2 + 1 =
(101111)
2
.
Another algorithm uses the following pseudo-code, assuming the number is represented
as 32 bits. Assume entries of v are v[1], . . . , v[32].
input n
v:=[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
i:=0
while n ,= 0
reduction := n(mod 2).
v[length(v) i] :=reduction,
n := (nreduction)/2.
i := i + 1.
We say 47 is a 6 bit number. The number of base 2 digits of an integer N (often called
the length) is its number of bits or log
2
(N)| + 1. So its about log
2
(N). All logarithms
dier by a constant multiple; (for example: log
2
(x) = klog
10
(x), where k = log
2
(10)).)
Running time estimates (really upper bounds) are based on worst/slowest case scenarios
where you assume inputs are large. Let me describe a few bit operations. Lets add two
n-bit numbers N + M. Well add 219 + 242 or 11011011 + 11110010, here n = 8
111 1
11011011
11110010
---------
111001101
We will call what happens in a column a bit operation. It is a xed set of comparisons and
shifts. So this whole thing took n log
2
(N) bit operations. If you add n and m bit numbers
12
together and n m then it still takes n bit operations (since youll have to copy all of the
unaected digits starting the longer number).
Lets multiply an n-bit number N with an m-bit number M where n m. Note that we
omit the nal addition in the diagram.
10111
1011
-----
10111
101110
10111000
Two parts: writing rows, then add them up. First part: There are at most m rows appearing
below the 1st line, each row has at most n+m1 bits. Just writing the last one down takes
n+m1 bit opns. So the rst part takes at most m(n+m1) bit opns. Second part: There
will then be at most m1 addns, each of which takes at most n+m1 bit opns. So this part
takes at most (m1)(n+m1) bit opns. We have a total of m(m+n1)+(m1)(n+m1)
= (2m1)(n+m1) bit opns. We have (2m1)(n+m1) (2m)(n+m) (2m)(2n) =
4mn bit opns or 4log
2
(N)log
2
M as a nice upper bound. (We ignore the time to access
memory, etc. as this is trivial.) How fast a computer runs varies so the running time is
C 4log
2
(N)log
2
M where C depends on the computer and how we measure time. Or we
could say C

log
2
(N)log
2
M = C

log(N)log(M).
If f and g are positive functions on positive integers (domain Z
>0
or Z
r
>0
if several
variables, range R
>0
- the positive real numbers) and theres a constant c > 0 such that
f < cg for suciently large input then we say f = O(g).
So f = O(g) means f is bounded by a constant multiple of g (usually g is nice).
So the running time of adding N to M where N M is O(log(N)). This is also
true for subtraction. For multiplying N and M its O(log(N)log(M)). If N and M are
about the same size we say the time for computing their product is O(log
2
(N)). Note
log
2
(N) = (log(N))
2
,= log(log(N)) = loglog(N). Writing down N takes time O(log(N)).
There are faster multiplication algorithms that take time O(log(N)loglog(N)logloglog(N)).
It turns out that the time to divide N by M and get quotient and remainder is O(log(N)log(M)).
So reducing N mod M same.
Rules:
1. kO(f(n)) = O(kf(n)) = O(f(n)).
2. Let p(n) = a
d
n
d
+ a
d1
n
d1
+ . . . + a
0
be a polynomial.
a) Then p(n) = O(n
d
). (It is easy to show that 2n
2
+ 5n < 3n
2
for large n, so 2n
2
+ 5n =
O(3n
2
) = O(n
2
).)
b) O(log(p(n))) = O(log(n)) (since O(log(p(n))) = O(log(n
d
)) = O(dlog(n)) = O(log(n)).
3. If h(n) f(n) then O(f(n)) + O(h(n)) = O(f(n)). Proof: O(f(n)) + O(h(n)) =
O(f(n) + h(n)) = O(2f(n)) = O(f(n)).
4. f(n)O(h(n)) = O(f(n))O(h(n)) = O(f(n)h(n)).
How to do a running time analysis.
A) Count the number of (mega)-steps.
13
B) Describe the worst/slowest step.
C) Find an upper bound for the running time of the worst step. (Ask: What is the action?)
D) Find an upper bound for the running time of the whole algorithm (often by computing
A) times C)).
E) Answer should be of the form O(. . .).
Review: F G and F G are O(logFlogG). F + G and F G are O(log(bigger)).
Problem 1: Find an upper bound for how long it takes to compute gcd(N, M) if N > M
by the Euclidean algorithm. Solution: gcding is slowest, if the quotients are all 1: Like
gcd(21, 13): The quotients are always 1 if you try to nd gcd(F
n
, F
n1
) where F
n
is the nth
Fibonacci number. F
1
= F
2
= 1, F
n
= F
n1
+ F
n2
. Note, number of steps is n 3, which
rounds up to n. Let = (1 +

5)/2. Then F
n

n
. So, worst if N = F
n
, M = F
n1
. Note
N
n
so n log

(N). Impt: Running time upper bound: (number of steps) times (time
per step). There are n = O(log(N)) steps. ((Never use n again)). Each step is a division,
which takes O(log(N)log(M)). So O(log(N)O(log(N)log(M))
rule 4
= O(log
2
(N)log(M)) or,
rounding up again O(log
3
(N)). So if you double the length (= O(log(N))) of your numbers,
it will take 8 times as long. Why is this true? Lets say that the time to compute gcd(N, M)
is k(log(N))
3
for some constant k. Assume M
1
, N
1
2
500
. Then the time to compute
gcd(N
1
, M
1
) is t
1
= k(log(2
500
))
3
= k(500log(2))
3
= k 500
3
(log(2))
3
. If M
2
, N
2

2
1000
(so twice the length), then the time to compute gcd(N
2
, M
2
) is t
2
= k(log(2
1000
))
3
= k 1000
3
(log(2))
3
= k 2
3
500
3
(log(2))
3
= 8t
1
.
If the numbers are suciently small, like less than 32 bits in length, then the division
takes a constant time depending on the size of the processor.
Problem 2: Find an upper bound for how long it takes to compute B
1
(modM). Solution:
Example: 11
1
(mod 26).
26 = 2 11 + 4
11 = 2 4 + 3
4 = 1 3 + 1
1 = 4 1 3
= 4 1(11 2 4) = 3 4 1 11
= 3(26 2 11) 1 11 = 3 26 7 11
So 11
1
7 + 26 = 19(mod 26). Two parts: 1st: gcd, 2nd: write gcd as linear combo.
gcding takes O(log
3
(M)).
2nd part: O(log(M)) steps (same as gcd). The worst step is = 3(26 2 11) 1 11 =
3 26 7 11. First copy down 6 numbers M. Takes time 6O(log(M))
rule 1
= O(log(M)).
Then simplication involves one multiplication O(log
2
(M) and one addition of numbers
M, which takes time O(log(M)). So the worst step takes time O(log(M)) +O(log
2
(M)) +
O(log(M))
rule 3
= O(log
2
(M)). So writing the gcd as a linear combination has running time
(# steps)(time per step) = O(log(M))O(log
2
(M))
rule 4
= O(log
3
(M)). The total time for the
modular inversion is the time to gcd and the time to write it as a linear combination which
is O(log
3
(M)) + O(log
3
(M))
rule 1 or 3
= O(log
3
(M)).
14
Problem 3: Assume B, N M. Find an upper bound for how long it takes to reduce
B
N
(modM) using the repeated squares algorithm on a computer. Solution: There are
n = O(log(N)) steps.
Example. Compute 87
43
(mod 103). 43 = (101011)
2
= (n
5
n
4
n
3
n
2
n
1
n
0
)
2
.
Step 0. Start with a = 1. Since n
0
= 1, set a = 87.
Step 1. 87
2
50. Since n
1
= 1, set a = 87 50 24( 87
2
87).
Step 2. 50
2
28( 87
4
). Since n
2
= 0, a = 24.
Step 3. 28
2
63( 87
8
). Since n
3
= 1, a = 24 63 70( 87
8
87
2
87).
Step 4. 63
2
55( 87
16
). Since n
4
= 0, a = 70.
Step 5. 55
2
38( 87
32
). Since n
5
= 1, a = 70 38 85( 87
32
87
8
87
2
87).
Theres no obvious worst step, except that it should have n
i
= 1. Lets consider the
running time of a general step. Let S denote the current reduction of B
2
i
. Note 0 a < M
and 0 S < M. For the step, we rst multiply S S, O(log
2
(M)). Note 0 S
2
<
M
2
. Then we reduce S
2
mod M (S
2
M), O(log(M
2
)log(M))
rule 2
= O(log(M)log(M)) =
O(log
2
(M)). Let H be the reduction of S
2
mod M; note 0 H < M. Second we multiply
H a, O(log
2
(M)). Note 0 Ha < M
2
. Then reduce Ha mod M, O(log(M
2
)log(M)) =
O(log
2
(M)). So the time for a general step is O(log
2
(M)) + O(log
2
(M)) + O(log
2
(M)) +
O(log
2
(M)) = 4O(log
2
(M))
rule 1
= O(log
2
(M)).
The total running time for computing B
N
(modM) using repeated squares is (# of
steps)(time per step) = O(log(N)O(log
2
(M)
rule 4
= O(log(N)log
2
(M)). If N M then we
simply say O(log
3
(M)). End Problem 3.
The running time to compute B
N
is O(N
i
log
j
(B)), for some i, j 1 (to be determined
in the homework) This is very slow.
Problem 4: Find an upper bound for how long it takes to compute N! using (((1 2) 3)
4) . . .. Hint: log(A!) = O(Alog(A)) (later).
Example: Let N = 5. So nd 5!.
1 2 = 2
2 3 = 6
6 4 = 24
24 5 = 120
There are N1 steps, which we round up to N. The worst step is the last which is [(N1)!]
N, O(log((N 1)!)log(N)). From above we have log((N 1)!) log(N!) = O((N)log(N))
which we round up to O(Nlog(N)). So the worst step takes time O(Nlog(N)log(N)) =
O(Nlog
2
N).
Since there are about N steps, the total running time is (# steps)(time per step) =
O(N
2
log
2
(N)), which is very slow.
So why is log(A!) = O(Alog(A))? Stirlings approximation says A! (A/e)
A

2A
(Stirling). Note 20! = 2.4310
18
and (20/e)
20

2 20 = 2.4210
18
. So log(A!) = A(log(A)
log(e)) +
1
2
(log(2) + log(A) + log()). Thus log(A!) = O(Alog(A)) (the other terms are
smaller).
15
End Problem 4.
Say you have a cryptosystem with a key space of size N. You have a known plain-
text/ciphertext pair. Then a brute force attack takes, on average
N
2
= O(N) steps.
The running time to nd a prime factor of N by trial division (N/2, N/3, N/4, . . .) is
O(

Nlog
j
(N)) for some j 1 (to be determined in the homework). This is very slow.
Say you have r integer inputs to an algorithm (i.e. r variables N
1
, . . . , N
r
) (for multipli-
cation: r = 2, factoring: r = 1, reduce b
N
(modM): r = 3). An algorithm is said to run
in polynomial time in the lengths of the numbers (= number of bits) if the running time
is O(log
d
1
(N
1
) log
d
r
(N
r
)). (All operations involved in encryption and decryption, namely
gcd, addition, multiplication, division, repeated squares, inverse mod m, run in polynomial
time).
If n = O(log(N)) and p(n) is an increasing polynomial, then an algorithm that runs in
time c
p(n)
for some constant c > 1 is said to run in exponential time (in the length of N).
This includes trial division and brute force.
Trial division: The log
j
(N)) is so insignicant, that people usually just say the running
time is O(

N) = O(N
1/2
) = O((c
logN
)
1/2
) = O(c
logN/2
) = O(c
n/2
). Since
1
2
n is a polynomial
in n, this takes exponential time. The running times of computing B
N
and N! are also
exponential. For AES, the input N is the size of the key space N = 2
128
and the running
time is
1
2
N = O(N) = c
log(N)
. The running time to solve the discrete logarithm problem
for an elliptic curve over a nite eld F
q
is O(

q), which is exponential, like trial division

factoring.
There is a way to interpolate between polynomial time and exponential time. Let 0 < <
1 and c > 1. Then L
N
(, c) = O(c
(log

(N)loglog
1
(N))
. Note if = 0 we get O(c
loglog(N)
) =
O(logN) is polynomial. If = 1 we get O(c
logN
) is exponential. If the running time is
L
N
(, c) for 0 < < 1 then it is said to be subexponential. The running time to factor N
using the Number Field Sieve is L
N
(
1
3
, c) for some c. So this is much slower than polynomial
but faster than exponential.
The current running time for nding a factor of N using the number eld sieve is L
N
(
1
3
, c)
for some c. This which is much slower than polynomial but faster than exponential. Factoring
a 20 digit number using trial division would take longer than the age of the universe. In
1999, a 155-digit RSA challenge number was factored. In January 2010, a 232 digit (768 bit)
RSA challenge number was factored. The number eld sieve has been adapted to solving
the nite eld discrete logarithm problem in F
q
. So the running time is also L
q
(
1
3
, c).
The set of problems whose solutions have polynomial time algorithms is called P. Theres
a large set of problems for which no known polynomial time algorithm exists for solving
them (though you can check that a given solution is correct in polynomial time) called NP.
Many of the solutions dier from each other by polynomial time algorithms. So if you could
solve one in polynomial time, you could solve them all in polynomial time. It is known that,
in terms of running times, P NP exponential.
One NP problem: nd simultaneous solutions to a system of non-linear polynomial equa-
tions mod 2. Like x
1
x
2
x
5
+ x
4
x
3
+ x
7
0(mod2), x
1
x
9
+ x
2
+ x
4
1(mod2), . . . . If you
could solve this problem quickly you could crack AES quickly. This would be a lone plaintext
attack and an x
i
would be the ith bit of the key.
16
Cryptography
In this section we will introduce the major methods of encryption, hashing and signatures.
6 Simple Cryptosystems
Let T be the set of possible plaintext messages. For example it might be the set A, B,. . . ,Z
of size 26 or the set AA, AB, . . . ,ZZ of size 26
2
. Let ( be the set of possible ciphertext
messages.
An enchiphering transformation f is a map from T to (. f shouldnt send dierent
plaintext messages to the same ciphertext message (so f should be one-to-one, or injective).
We have T
f
( and (
f
1
T; together they form a cryptosystem. Here are some simple
ones.
Well start with a cryptosystem based on single letters. You can replace letters by other
letters. Having a weird permutation is slow, like A F, B Q, C N,. . .. Theres less
storage if you have a mathematical rule to govern encryption and decryption.
Shift transformation: P is plaintext letter/number A=0, B=1, . . . , Z=25. The Caesar
cipher is an example: Encryption is given by C P + 3(mod26) and so decryption is given
by P C 3(mod26). This is the Caesar cipher. If you have an N letter alphabet, a
shift enciphering transformation is C P +b(modN) where b is the encrypting key and b
is the decrypting key.
For cryptanalysis, the enemy needs to know its a shift transformation and needs to nd
b. In general one must assume that the nature of the cryptosystem is known (here a shift).
Say you intercept a lot of CT and want to nd b so you can decrypt future messages.
Methods: 1) Try all 26 possible bs. Probably only one will give sensible PT. 2) Use frequency
analysis. You know E = 4 is the most common letter in English. You have a lot of CT and
notice that J = 9 is the most common letter in the CT so you try b = 5.
An ane enciphering transformation is of the form C aP + b(modN) where the pair
(a, b) is the encrypting key. You need gcd(a, N) = 1 or else dierent PTs will encrypt as
the same CT (as there are N/gcd(a, N) possible aPs).
Example: C 4P + 5(mod 26). Note B = 1 and O = 14 go to 9 = J.
Example: C 3P + 4(mod, 26) is OK since gcd(3, 26) = 1. Alice sends the message
U to Bob. U = 20 goes to 3 20 + 4 = 64 12(mod 26). So U= 2012 =M (that was
encode, encrypt, decode). Alice sends M to Bob. Bob can decrypt by solving for P. C4
3P(mod 26). 3
1
(C 4) P(mod 26). 3
1
9mod 26) (since 3 9 = 27 1(mod 26)).
P 9(C 4) 9C 36 9C + 16(mod 26). So P 9C + 16(mod 26). Since Bob received
M= 12 he then computes 9 12 + 16 = 124 20(mod 26).
In general encryption: C aP + b(modN) and decryption: P a
1
(C b)(modN).
Here (a
1
, a
1
b) is the decryption key.
How to cryptanalyze. We have N = 26. You could try all (26) 26 = 312 possible key
pairs (a, b) or do frequency analysis. Have two unknown keys so you need two equations.
Assume you are the enemy and you have a lot of CT. You nd Y = 24 is the most common
and H = 7 is the second most common. In English, E = 4 is the most common and T = 19
is the second most common. Lets say that decryption is by P a

C + b

(mod26) (where
a

= a
1
and b

= a
1
b). Decrypt HFOGLH.
17
First we nd (a

, b

). We assume 4 a

24 + b

(mod26) and 19 a

7 + b

(mod26).
Subtracting we get 17a

4 19 4 + 7 11(mod26) (). So a

17
1
11(mod26). We
can use the Euclidean algorithm to nd 17
1
23(mod26) so a

23 11 19(mod26).
Plugging this into an earlier equation we see 19 19 7 +b

(mod26) and so b

16(mod26).
Thus P 19C + 16(mod26).
Now we decrypt HFOGLH or 7 5 14 6 11 7. We get 19 7 + 16 19 = T, 19 5 + 16
7 = H,. . . and get the word THWART. Back at (), it is possible that you get an equation
like 2a

8(mod26). The solutions are a

4(mod13) which is a

4 or 17(mod26). So you
would need to try both and see which gives sensible PT.
Lets say we want to impersonate the sender and send the message DONT i.e. 3 14 13
19. We want to encrypt this so we use C aP +b(mod26). We have P 19C +16(mod26)
so C 19
1
(P 16) 11P + 6(mod26).
We could use an ane enciphering transformation to send digraphs (pairs of letters). If
we use the alphabet A - Z which we number 0 - 25 then we can encode a digraph xy as
26x + y. The resulting number will be between 0 and 675 = 26
2
1. Example: TO would
become 26 19 + 14 = 508. To decode, compute 508 26 = 19.54, then 19 = .54, then
26 = 14. We would then encrypt by C aP + b(mod626).
7 Symmetric key cryptography
In symmetric key cryptosystem, Alice and Bob must agree on a secret, shared key ahead of
time. We will consider stream ciphers and block ciphers.
8 Finite elds
If p is a prime we rename Z/pZ = F
p
, the eld with p elements = 0, 1, . . . , p 1 with
+, , . Note all elements other than 0 have gcd(, p) = 1 so we can nd
1
(modp).
So we can divide by any non-0 element. So its like other elds like the rationals, reals and
complex numbers.
F

p
is 1, . . . , p 1 here we do , . Note F

p
has (p 1) generators g (also called
primitive roots of p). The sets g, g
2
, g
3
, . . . , g
p1
and 1, 2, . . . , p1 are the same (though
the elements will be in dierent orders).
Example, F

5
, g = 2: 2
1
= 2, 2
2
= 4, 2
3
= 3, 2
4
= 1. Also g = 3: 3
1
= 3, 3
2
= 4, 3
3
= 2,
3
4
= 1. For F

7
, 2
1
= 2, 2
2
= 4, 2
3
= 1, 2
4
= 2, 2
5
= 4, 2
6
= 1, so 2 is not a generator. g = 3:
3
1
= 3, 3
2
= 2, 3
3
= 6, 3
4
= 4, 3
5
= 5, 3
6
= 1.
9 Finite Fields Part II
Here is a dierent kind of nite eld. Let F
2
[x] be the set of polynomials with coecients
in F
2
= Z/2Z = 0, 1. Recall 1 = 1 here so = +. The polynomials are
0, 1, x, x + 1, x
2
, x
2
+ 1, x
2
+ x, x
2
+ x + 1, . . .
18
There are two of degree 0 (0,1), four of degree 1, eight of degree 2 and in general the
number of polynomials of degree n is 2
n+1
. They are are a
n
x
n
+. . . +a
0
, a
i
0, 1. Lets
multiply:
x^2 + x + 1
x^2 + x
-------------
x^3 + x^2 + x
x^4 + x^3 + x^2
-------------------
x^4 + x
A polynomial is irreducible over a eld if it cant be factored into polynomials with coecients
in that eld. Over the rationals (fractions of integers), x
2
+ 2, x
2
2 are both irreducible.
Over the reals, x
2
+ 2 is irreducible and x
2
2 = (x +

2)(x

2) is reducible. Over the

complex numbers x
2
+ 2 = (x +

2i)(x

2i), so both are reducible.

x
2
+ x + 1 is irreducible over F
2
(its the only irreducible quadratic). x
2
+ 1 = (x + 1)
2
is reducible. x
3
+ x + 1, x
3
+ x
2
+ 1 are the only irreducible cubics over F
2
.
When you take Z and reduce mod p a prime (an irreducible number) you get 0, . . . , p1,
thats the stu less than p. In addition, p = 0 and everything else can be inverted. You can
write this set as Z/pZ or Z/(p).
Now take F
2
[x] and reduce mod x
3
+ x + 1 (irreducible). You get polynomials of lower
degree and x
3
+ x + 1 = 0, i.e. x
3
= x + 1. F
2
[x]/(x
3
+ x + 1) = 0, 1, x, x + 1, x
2
, x
2
+ 1,
x
2
+x, x
2
+x+1 with the usual +, (), and x
3
= x+1. Lets multiply in F
2
[x]/(x
3
+x+1).
x^2 + x + 1
x + 1
-----------
x^2 + x + 1
x^3 + x^2 + x
-----------------
x^3 + 1
But x
3
= x + 1 so x
3
+ 1 (x + 1) + 1(modx
3
+ x + 1) and x
3
+ 1 x(modx
3
+ x + 1).
So (x
2
+ x + 1)(x + 1) = x in F
2
[x]/(x
3
+ x + 1). This is called F
8
since it has 8 elements.
Notice x
4
= x
3
x = (x + 1)x = x
2
+ x in F
8
.
The set F
2
[x]/(irreducible polynomial of degree d) is a eld called F
2
d with 2
d
elements.
It consists of the polynomials of degree d 1. F

2
d
is the non-0 elements and has (2
d
1)
generators. x is a generator for F

8
described above. g = x, x
2
, x
3
= x + 1, x
4
= x
2
+ x,
x
5
= x
4
x = x
3
+ x
2
= x
2
+ x + 1, x
6
= x
3
+ x
2
+ x = x
2
+ 1, x
7
= x
3
+ x = 1.
You can represent elements easily in a computer. You could represent 1 x
2
+ 0 x + 1
by 101. For this reason, people usually use discrete log cryptosystems with elds of the type
F
2
d instead of the type F
p
where p 2
d
10
300
. Over F
p
they are more secure; over F
2
d
they are easier to implement on a computer.
In F
2
[x]/(x
6
+ x + 1) invert x
4
+ x
3
+ 1. Use the polynomial Euclidean algorithm.
x
6
+x + 1 = q(x
4
+x
3
+ 1) +r where the degree of r is less than the degree of x
4
+x
3
+ 1.
19
x^2 + x + 1
____________________________________
x^4+x^3 +1 | x^6 + x + 1
x^6 + x^5 + x^2
___________________________
x^5 + x^2 + x
x^5 + x^4 + x
_________________________
x^4 + x^2 + 1
x^4 + x^3 + 1
_______________________
x^3 + x^2 = r
So x
6
+ x + 1 = (x
2
+ x + 1)(x
4
+ x
3
+ 1) + (x
3
+ x
2
).
Similarly x
4
+ x
3
+ 1 = x(x
3
+ x
2
) + 1.
So 1 = (x
4
+ x
3
+ 1) + x(x
3
+ x
2
)
1 = (x
4
+ x
3
+ 1) + x(x
6
+ x + 1 + (x
2
+ x + 1)(x
4
+ x
3
+ 1))
1 = 1(x
4
+ x
3
+ 1) + x(x
6
+ x + 1) + (x
3
+ x
2
+ x)(x
4
+ x
3
+ 1)
1 = (x
3
+ x
2
+ x + 1)(x
4
+ x
3
+ 1) + x(x
6
+ x + 1)
1 = (x
3
+ x
2
+ x + 1)(x
4
+ x
3
+ 1)(mod x
6
+ x + 1).
So (x
4
+ x
3
+ 1)
1
= x
3
+ x
2
+ x + 1 in F
2
[x]/(x
6
+ x + 1) = F
64
. End example.
In F
8
described above, you are working in Z[x] with two mods: coecients are mod 2
and polynomials are mod x
3
+x +1. Note that if d > 1 then F
2
d ,= Z/2
d
Z (in F
8
, 1 +1 = 0
in Z/8Z, 1 +1 = 2). In much of the cryptography literature, they use GF(q) to denote both
F
q
and F

q
, where q is usually prime or 2
d
.
10 Modern stream ciphers
Modern stream ciphers are symmetric key cryptosystems. So Alice and Bob must agree
on a key beforehand. The plaintext is turned into ASCII. So the plaintext Go would be
encoded as 0100011101101111. Theres a given (pseudo)random bit generator. Alice and
Bob agree on a seed, which acts as the symmetric/shared/secret key. They both generate
the same random bit stream like 0111110110001101, which we call the keystream. Alice gets
the ciphertext by bit-by-bit XORing, i.e. bit-by-bit addition mod 2. 0 0 = 0, 0 1 = 1,
1 0 = 1, 1 1 = 0.
Example.
PT 0100011101101111
keystream 0111110110001101
CT 0011101011100010
CT 0011101011100010
keystream 0111110110001101
0100011101101111
Go
Let p
i
be the ith bit of plaintext, k
i
be the ith bit of keystream and c
i
be the ith bit of
ciphertext. Here c
i
= p
i
k
i
and p
i
= c
i
k
i
. (See earlier example.)
Here is an unsafe stream cipher used on PCs to encrypt les (savvy users aware it gives
minimal protection). Use keyword like Sue 01010011 01110101 01100101. The keystream is
that string repeated again and again. At least theres variable key length.
20
Here is a random bit generator that is somewhat slow, so it is no longer used. Say p is a
large prime for which 2 generates F

p
and assume q = 2p+1 is also prime. Let g generate F

q
.
Say the key is k with gcd(k, 2p) = 1. Let s
1
= g
k
F
q
. (so 1 s
1
< q) and k
1
s
1
(mod 2)
with k
1
0, 1. For i 1, let s
i+1
= s
2
i
F
q
with 1 s
i
< q and k
i
s
i
(mod 2) with
k
i
0, 1.
Example. 2 generates F

29
. 2
28/7
,= 1). g = 2 also generates F

59
. Let k = 11. Then
s
1
= 2
11
= 42, s
2
= 42
2
= 53, s
3
= 53
2
= 36, s
4
= 36
2
= 57, . . . so k
1
= 0, k
2
= 1, k
3
= 0,
k
4
= 1, . . ..
10.1 RC4
RC4 is the most widely used stream cipher. Invented by Ron Rivest (R of RSA) in 1987.
The RC stands for Rons code. The pseudo random bit generator was kept secret. The source
code was published anonymously on Cypherpunks mailing list in 1994.
Choose n, a positive integer. Right now, people use n = 8. Let l = (length of PT in
bits/n)|.
There is a key array K
0
, . . . , K
2
n
1
whose entries are n-bit strings (which will be thought
of as integers from 0 to 2
n
1). You enter the key into that array and then repeat the key
as necessary to ll the array.
The algorithm consists of permuting the integers from 0 to 2
n1
. The permutations are
stored in an array S
0
, . . . , S
2
n
1
. Initially we have S
0
= 0, . . . , S
2
n
1
= 2
n
1.
Here is the algorithm.
j = 0.
For i = 0, . . . , 2
n
1 do:
j := j + S
i
+ K
i
(mod 2
n
).
Swap S
i
and S
j
.
End For
Set the two counters i, j back to zero.
To generate l random n-bit strings, do:
For r = 0, . . . , l 1 do
i := i + 1(mod 2
n
).
j := j + S
i
(mod 2
n
).
Swap S
i
and S
j
.
t := S
i
+ S
j
(mod 2
n
).
KS
r
:= S
t
.
End For
Then KS
0
KS
1
KS
2
. . ., written in binary, is the keystream.
Do example with n = 3.
Say key is 011001100001101 or 011 001 100 001 101 or [3, 1, 4, 1, 5]. We expand to
[3, 1, 4, 1, 5, 3, 1, 4] = [K
0
, K
1
, K
2
, K
3
, K
4
, K
5
, K
6
, K
7
].
21
i j t KS
r
S
0
S
1
S
2
S
3
S
4
S
5
S
6
S
7
0 0 1 2 3 4 5 6 7
0 3 3 1 2 0 4 5 6 7
1 5 3 5 2 0 4 1 6 7
2 3 3 5 0 2 4 1 6 7
3 6 3 5 0 6 4 1 2 7
4 7 3 5 0 6 7 1 2 4
5 3 3 5 0 1 7 6 2 4
6 6 3 5 0 1 7 6 2 4
7 6 3 5 0 1 7 6 4 2
0 0
1 5 3 1 3 6 0 1 7 5 4 2
2 5 5 0 3 6 5 1 7 0 4 2
3 6 5 0 3 6 5 4 7 0 1 2
4 5 7 2 3 6 5 4 0 7 1 2
5 4 7 2 3 6 5 4 7 0 1 2
6 5 1 6 3 6 5 4 7 1 0 2
7 7 4 7 3 6 5 4 7 1 0 2
0 2 0 5 5 6 3 4 7 1 0 2
1 0 3 4 6 5 3 4 7 1 0 2
2 3 7 2 6 5 4 3 7 1 0 2
3 6 3 0 6 5 4 0 7 1 3 2
4 5 0 6 6 5 4 0 1 7 3 2
The keystream is from the 3-bit representations of 1, 0, 0, 2, 2, 6, 7, 5, 4, 2, 0, 6, which is
001 000 000 010 010 110 111 101 100 010 000 110 (without spaces).
The index i ensures that every element changes and j ensures that the elements change
randomly. Interchanging indices and values of the array gives security.
10.2 Self-synchronizing stream cipher
When you simply XOR the plaintext with the keystream to get the ciphertext, that is called
a synchronous stream cipher. Now Eve might get a hold of a matched PT/CT pair and nd
part of the keystream and somehow nd the whole keystream. There can be mathematical
methods to do this. One solution is to use old plaintext to encrypt also. This is called a
self-synchronizing stream cipher. (I made this one up).
Example
c
i
= p
i
k
i

_
p
i2
if p
i1
= 0
p
i3
if p
i1
= 1
Need to add p
1
= p
0
= 0 to the beginning of the plaintext. The receiver uses
p
i
= c
i
k
i

_
p
i2
if p
i1
= 0
p
i3
if p
i1
= 1
Using the plaintext (Go) and keystream from an earlier example, we would have:
22
sender: receiver:
PT 000100011101101111 CT 0010101000001111
keystream 0111110110001101 keystream 0111110110001101
---------------- ----------------
CT 0010101000001111 PT 000100011101101111 (Go)
10.3 One-time pads
If the key (not the keystream) for a stream cipher is random and as long as the plaintext then
this is called a one-time-pad. The key must never be used again. Cryptanalysis is provably
impossible. This was used by Russians during the cold war and by the phone linking the
White House and the Kremlin. It is very impractical.
11 Modern Block Ciphers
Most encryption now is done using block ciphers. The two most important historically have
been the Data Encryption Standard (DES) and the Advanced Encryption Standard (AES).
DES has a 56 bit key and 64 bit plaintext and ciphertext blocks. AES has a 128 bit key,
and 128 bit plaintext and ciphertext blocks.
11.1 Modes of Operation of a Block Cipher
On a chip for a block cipher, there are four modes of operation. The standard mode is the
electronic code book (ECB) mode. It is the most straightforward but has the disadvantage
that for a given key, two identical plaintexts will correspond to identical ciphertexts. If the
number of bits in the plaintext message is not a multiple of the block length, then add extra
bits at the end until it is. This is called padding.
------- ------- -------
| PT1 | | PT2 | | PT3 |
------- ------- -------
| | |
V V V
E_k E_k E_k
| | |
V V V
------- ------- -------
| CT1 | | CT2 | | CT3 |
------- ------- -------
The next mode is the cipherblock chaining (CBC) mode. This is the most commonly
used mode. Alice and Bob must agree on a non-secret initialization vector (IV) which has
the same length as the plaintext. The IV may or may not be secret.
23
------- ------- -------
| PT1 | | PT2 | | PT3 |
------- ------- -------
| | |
------ V V V
| IV | --> + |------> + |-----> +
------ | | | | |
V | V | V
E_k | E_k | E_k
| | | | |
V | V | V
------- | ------- | -------
| CT1 |---- | CT2 |---- | CT3 |
------- ------- -------
The next mode is the cipher feedback (CFB) mode. If the plaintext is coming in slowly,
the ciphertext can be sent as soon as as the plaintext comes in. With the CBC mode, one
must wait for a whole plaintext block before computing the ciphertext. This is also a good
mode of you do not want to pad the plaintext.
------- -------
| PT1 | | PT2 |
------- -------
| |
------ V V
| IV |---> E_k ---> + |----> E_k ---> +
------ | | |
V | V
------- | -------
| CT1 |----| | CT2 |
------- -------
The last mode is the output feedback (OFB) mode. It is a way to create a keystream for
a stream cipher. Below is how you create the keystream.
------ ------- ------- -------
| IV | -> E_k -> | Z_1 | -> E_k -> | Z_2 | -> E_k -> | Z_3 |
------ ------- ------- -------
The keystream is the concatenation of Z
1
Z
2
Z
3
. . .. As usual, this will be XORed with
the plaintext. (In the diagram you can add PT
i
s, CT
i
s and s.)
24
11.2 The Block Cipher DES
The U.S. government in the early 1970s wanted an encryption process on a small chip that
would be widely used and safe. In 1975 they accepted IBMs Data Encryption Standard
Algorithm (DES). DES is a symmetric-key cryptosystem which has a 56-bit key and encrypts
64-bit plaintexts to 64-bit ciphertexts. By the early 1990s, the 56-bit key was considered
too short. Surprisingly, Double-DES with two dierent keys is not much safer than DES,
as is explained in Section 29.3. So people started using Triple-DES with two 56 bit keys.
Lets say that E
K
and D
K
denote encryption and decryption with key K using DES. Then
Triple-DES with keys K
1
and K
2
is CT = E
K
1
(D
K
2
(E
K
1
(PT))). The reason there is a D
K
in
the middle is for backward compatibility. Note that Triple-DES using a single key each time
is the same thing as Single-DES with the same key. So if one person has a Triple-DES chip
and the other a Single-DES chip, they can still communicate privately using Single-DES.
In 1997 DES was brute forced in 24 hours by 500000 computers. In 2008, ATMs world-
wide still used Single-DES because they ATMs started using Single-DES chips and they all
need to communicate with each other and it was too costly in some places to update to a
more secure chip.
11.3 The Block Cipher AES
Introduction
However, DES was not designed with Triple-DES in mind. Undoubtedly there would be a
more ecient algorithm with the same level of safety as Triple-DES. So in 1997, the National
Institute of Standards and Technology (NIST) solicited proposals for replacements of DES.
In 2001, NIST chose 128-bit block Rijndael with a 128-bit key to become the Advanced
Encryption Standard (AES). (If you dont speak Dutch, Flemish or Afrikaans, then the
closest approximation to the pronunciation is Rine-doll). Rijndael is a symmetric-key block
cipher designed by Joan Daemen and Vincent Rijmen.
Simplied AES
Simplied AES was designed by Mohammad Musa, Steve Wedig (two former Crypto
students) and me in 2002. It is a method of teaching AES. We published the article A sim-
plied AES algorithm and its linear and dierential cryptanalyses in the journal Cryptologia
in 2003. We will learn the linear and dierential cryptanalyses in the Cryptanalysis Course.
The Finite Field
Both the key expansion and encryption algorithms of simplied AES depend on an S-box
that itself depends on the nite eld with 16 elements.
Let F
16
= F
2
[x]/(x
4
+ x + 1). The word nibble refers to a four-bit string, like 1011. We
will frequently associate an element b
0
x
3
+ b
1
x
2
+ b
2
x + b
3
of F
16
with the nibble b
0
b
1
b
2
b
3
.
The S-box
The S-box is a map from nibbles to nibbles. It can be inverted. (For those in the know,
it is one-to-one and onto or bijective.) Here is how it operates. First, invert the nibble
in F
16
. The inverse of x + 1 is x
3
+ x
2
+ x so 0011 goes to 1110. The nibble 0000 is not
invertible, so at this step it is sent to itself. Then associate to the nibble N = b
0
b
1
b
2
b
3
(which
25
is the output of the inversion) the element N(y) = b
0
y
3
+ b
1
y
2
+ b
2
y + b
3
in F
2
[y]/(y
4
+ 1).
Let a(y) = y
3
+ y
2
+ 1 and b(y) = y
3
+ 1 in F
2
[y]/(y
4
+ 1). Doing multiplication and
addition is similar to doing so in F
16
except that we are working modulo y
4
+ 1 so y
4
= 1
and y
5
= y and y
6
= y
2
. The second step of the S-box is to send the nibble N(y) to
a(y)N(y) +b(y). So the nibble 1110 = y
3
+y
2
+y goes to (y
3
+y
2
+1)(y
3
+y
2
+y) +(y
3
+1)
= (y
6
+y
5
+y
4
)+(y
5
+y
4
+y
3
)+(y
3
+y
2
+y)+(y
3
+1) = y
2
+y+1+y+1+y
3
+y
3
+y
2
+y+y
3
+1
= 3y
3
+ 2y
2
+ 3y + 3 = y
3
+ y + 1 = 1011. So S-box(0011) = 1011.
Note that y
4
+ 1 = (y + 1)
4
is reducible over F
2
so F
2
[y]/(y
4
+ 1) is not a eld and not
all of its non-zero elements are invertible; the polynomial a(y), however, is. So N(y)
a(y)N(y) +b(y) is an invertible map. If you read the literature, then the second step is often
described by an ane matrix map.
We can represent the action of the S-box in two ways (note we do not show the interme-
diary output of the inversion in F

16
). These are called look up tables.
nib Sbox(nib) nib Sbox(nib)
0000 1001 1000 0110
0001 0100 1001 0010
0010 1010 1010 0000
0011 1011 1011 0011
0100 1101 1100 1100
0101 0001 1101 1110
0110 1000 1110 1111
0111 0101 1111 0111
or
_

_
9 4 10 11
13 1 8 5
6 2 0 3
12 14 15 7
_

_
.
The left-hand side is most useful for doing an example by hand. For the matrix on the
right, we start in the upper left corner and go across, then to the next row and go across
etc. The integers 0 - 15 are associated with their 4-bit binary representations. So 0000 = 0
goes to 9 = 1001, 0001 = 1 goes to 4 = 0100, . . . , 0100 = 4 goes to 13 = 1101, etc.
Keys
For our simplied version of AES, we have a 16-bit key, which we denote k
0
. . . k
15
. That
needs to be expanded to a total of 48 key bits k
0
. . . k
47
, where the rst 16 key bits are
the same as the original key. Let us describe the expansion. Let RC[i] = x
i+2
F
16
. So
RC[1] = x
3
= 1000 and RC[2] = x
4
= x + 1 = 0011. If N
0
and N
1
are nibbles, then we
denote their concatenation by N
0
N
1
. Let RCON[i] = RC[i]0000 (this is a byte, a string
of 8 bits). So RCON[1] = 10000000 and RCON[2] = 00110000. These are abbreviations
for round constant. We dene the function RotNib to be RotNib(N
0
N
1
) = N
1
N
0
and the
function SubNib to be SubNib(N
0
N
1
) =S-box(N
0
)S-box(N
1
); these are functions from bytes
to bytes. Their names are abbreviations for rotate nibble and substitute nibble. Let us dene
an array (vector, if you prefer) W whose entries are bytes. The original key lls W[0] and
W[1] in order. For 2 i 5,
if i 0(mod 2) then W[i] = W[i 2] RCON(i/2) SubNib(RotNib(W[i 1]))
if i , 0(mod 2) then W[i] = W[i 2] W[i 1]
.
26
The bits contained in the entries of W can be denoted k
0
. . . k
47
. For 0 i 2 we let
K
i
= W[2i]W[2i + 1]. So K
0
= k
0
. . . k
15
, K
1
= k
16
. . . k
31
and K
2
= k
32
. . . k
47
. For i 1,
K
i
is the round key used at the end of the i-th round; K
0
is used before the rst round.
Recall denotes bit-by-bit XORing.
Key Expansion Example
Lets say that the key is 0101 1001 0111 1010. So W[0] = 0101 1001 and W[1] =
0111 1010. Now i = 2 so we Rotnib(W[1])=1010 0111. Then we SubNib(1010 0111)=0000
0101. Then we XOR this with W[0] RCON(1) and get W[2].
0000 0101
0101 1001
1000 0000
1101 1100
So W[2] = 11011100.
Now i = 3 so W[3] = W[1] W[2] = 0111 1010 1101 1100 = 1010 0110. Now i = 4 so
we Rotnib(W[3])=0110 1010. Then we SubNib(0110 1010)=1000 0000. Then we XOR this
with W[2] RCON(2) and get W[4].
1000 0000
1101 1100
0011 0000
0110 1100
So W[4] = 01101100.
Now i = 5 so W[5] = W[3] W[4] = 1010 0110 0110 1100 = 1100 1010.
The Simplied AES Algorithm
The simplied AES algorithm operates on 16-bit plaintexts and generates 16-bit cipher-
texts, using the expanded key k
0
. . . k
47
. The encryption algorithm consists of the composition
of 8 functions applied to the plaintext: A
K
2
SR NS A
K
1
MC SR NS A
K
0
(so A
K
0
is applied rst), which will be described below. Each function operates on a state. A state
consists of 4 nibbles congured as in Figure 1. The initial state consists of the plaintext as
in Figure 2. The nal state consists of the ciphertext as in Figure 3.
b
0
b
1
b
2
b
3
b
8
b
9
b
10
b
11
b
4
b
5
b
6
b
7
b
12
b
13
b
14
b
15
p
0
p
1
p
2
p
3
p
8
p
9
p
10
p
11
p
4
p
5
p
6
p
7
p
12
p
13
p
14
p
15
c
0
c
1
c
2
c
3
c
8
c
9
c
10
c
11
c
4
c
5
c
6
c
7
c
12
c
13
c
14
c
15
Figure 1 Figure 2 Figure 3
The Function A
K
i
: The abbreviation A
K
stands for add key. The function A
K
i
consists
of XORing K
i
with the state so that the subscripts of the bits in the state and the key bits
agree modulo 16.
The Function NS: The abbreviation NS stands for nibble substitution. The function NS
replaces each nibble N
i
in a state by S-box(N
i
) without changing the order of the nibbles.
So it sends the state
27
N
0
N
2
N
1
N
3
to the state
S-box(N
0
) S-box(N
2
)
S-box(N
1
) S-box(N
3
)
.
The Function SR: The abbreviation SR stands for shift row. The function SR takes the
state
N
0
N
2
N
1
N
3
to the state
N
0
N
2
N
3
N
1
.
The Function MC: The abbreviation MC stands for mix column. A column [N
i
, N
j
]
of the state is considered to be the element N
i
z + N
j
of F
16
[z]/(z
2
+ 1). As an example,
if the column consists of [N
i
, N
j
] where N
i
= 1010 and N
j
= 1001 then that would be
(x
3
+ x)z + (x
3
+ 1). Like before, F
16
[z] denotes polynomials in z with coecients in F
16
.
So F
16
[z]/(z
2
+ 1) means that polynomials are considered modulo z
2
+ 1; thus z
2
= 1. So
representatives consist of the 16
2
polynomials of degree less than 2 in z.
The function MC multiplies each column by the polynomial c(z) = x
2
z + 1. As an
example,
[((x
3
+ x)z + (x
3
+ 1))](x
2
z + 1) = (x
5
+ x
3
)z
2
+ (x
3
+ x + x
5
+ x
2
)z + (x
3
+ 1)
= (x
5
+ x
3
+ x
2
+ x)z + (x
5
+ x
3
+ x
3
+ 1) = (x
2
+ x + x
3
+ x
2
+ x)z + (x
2
+ x + 1)
= (x
3
)z + (x
2
+ x + 1),
which goes to the column [N
k
, N
l
] where N
k
= 1000 and N
l
= 0111.
Note that z
2
+ 1 = (z + 1)
2
is reducible over F
16
so F
16
[z]/(z
2
+ 1) is not a eld and not all
of its non-zero elements are invertible; the polynomial c(z), however, is.
The simplest way to explain MC is to note that MC sends a column
b
0
b
1
b
2
b
3
b
4
b
5
b
6
b
7
to
b
0
b
6
b
1
b
4
b
7
b
2
b
4
b
5
b
3
b
5
b
2
b
4
b
0
b
3
b
5
b
0
b
1
b
6
b
1
b
7
.
The Rounds: The composition of functions A
K
i
MC SR NS is considered to be the
i-th round. So this simplied algorithm has two rounds. There is an extra A
K
before the
rst round and the last round does not have an MC; the latter will be explained in the next
section.
Decryption
Note that for general functions (where the composition and inversion are possible) (f
g)
1
= g
1
f
1
. Also, if a function composed with itself is the identity map (i.e. gets you
back where you started), then it is its own inverse; this is called an involution. This is true
of each A
K
i
. Although it is true for our SR, this is not true for the real SR in AES, so we
will not simplify the notation SR
1
. Decryption is then by A
K
0
NS
1
SR
1
MC
1

A
K
1
NS
1
SR
1
A
K
2
.
To accomplish NS
1
, multiply a nibble by a(y)
1
= y
2
+y+1 and add a(y)
1
b(y) = y
3
+y
2
in F
2
[y]/(y
4
+ 1). Then invert the nibble in F
16
. Alternately, we can simply use one of the
S-box tables in reverse.
Since MC is multiplication by c(z) = x
2
z + 1, the function MC
1
is multiplication by
c(z)
1
= xz + (x
3
+ 1) in F
16
[z]/(z
2
+ 1).
28
Decryption can be done as above. However to see why there is no MC in the last
round, we continue. First note that NS
1
SR
1
= SR
1
NS
1
. Let St denote a state.
We have MC
1
(A
K
i
(St)) = MC
1
(K
i
St) = c(z)
1
(K
i
St) = c(z)
1
(K
i
) c(z)
1
(St)
= c(z)
1
(K
i
) MC
1
(St) = A
c(z)
1
K
i
(MC
1
(St)). So MC
1
A
K
i
= A
c(z)
1
K
i
MC
1
.
What does c(z)
1
(K
i
) mean? Break K
i
into two bytes b
0
b
1
. . . b
7
, b
8
, . . . b
15
. Consider the
rst byte
b
0
b
1
b
2
b
3
b
4
b
5
b
6
b
7
to be an element of F
16
[z]/(z
2
+ 1). Multiply by c(z)
1
, then convert back to a byte. Do
the same with b
8
. . . b
15
. So c(z)
1
K
i
has 16 bits. A
c(z)
1
K
i
means XOR c(z)
1
K
i
with the
current state. Note when we do MC
1
, we will multiply the state by c(z)
1
(or more easily,
use the equivalent table that you will create in your homework). For A
c(z)
1
K
1
, you will rst
multiply K
1
by c(z)
1
(or more easily, use the equivalent table that you will create in your
homework), then XOR the result with the current state.
Thus decryption is also
A
K
0
SR
1
NS
1
A
c(z)
1
K
1
MC
1
SR
1
NS
1
A
K
2
.
Recall that encryption is
A
K
2
SR NS A
K
1
MC SR NS A
K
0
.
Notice how each kind of operation for decryption appears in exactly the same order as in
encryption, except that the round keys have to be applied in reverse order. For the real
AES, this can improve implementation. This would not be possible if MC appeared in the
last round.
Encryption Example
Lets say that we use the key in the above example 0101 1001 0111 1010. So W[0] =
0101 1001, W[1] = 0111 1010, W[2] = 1101 1100, W[3] = 1010 0110, W[4] = 0110 1100,
W[5] = 1100 1010,
Lets say that the plaintext is my name Ed in ASCII: 01000101 01100100 Then the
initial state is (remembering that the nibbles go in upper left, then lower left, then upper
right, then lower right)
0100 0110
0101 0100
Then we do A
K
0
(recall K
0
= W[0]W[1]) to get a new state:
0100 0110
0101 0111
0101 0100
1001 1010
=
0001 0001
1100 1110
Then we apply NS and SR to get
0100 0100
1100 1111
SR
0100 0100
1111 1100
29
Then we apply MC to get
1101 0001
1100 1111
Then we apply A
K
1
, recall K
1
= W[2]W[3].
1101 0001
1101 1010
1100 1111
1100 0110
=
0000 1011
0000 1001
Then we apply NS and SR to get
1001 0011
1001 0010
SR
1001 0011
0010 1001
Then we apply A
K
2
, recall K
2
= W[4]W[5].
1001 0011
0110 1100
0010 1001
1100 1010
=
1111 1111
1110 0011
So the ciphertext is 11111110 11110011.
The Real AES
For simplicity, we will describe the version of AES that has a 128-bit key and has 10
rounds. Recall that the AES algorithm operates on 128-bit blocks . We will mostly explain
the ways in which it diers from our simplied version. Each state consists of a four-by-four
grid of bytes.
The nite eld is F
2
8 = F
2
[x]/(x
8
+x
4
+x
3
+x+1). We let the byte b
0
b
1
b
2
b
3
b
4
b
5
b
6
b
7
and
the element b
0
x
7
+. . . +b
7
of F
2
8 correspond to each other. The S-box rst inverts a byte in
F
2
8 and then multiplies it by a(y) = y
4
+y
3
+y
2
+y + 1 and adds b(y) = y
6
+y
5
+y + 1 in
F
2
[y]/(y
8
+ 1). Note a(y)
1
= y
6
+ y
3
+ y and a(y)
1
b(y) = y
2
+ 1.
The real ByteSub is the obvious generalization of our NS - it replaces each byte by its
image under the S-box. The real ShiftRow shifts the rows left by 0, 1, 2 and 3. So it sends
the state
B
0
B
4
B
8
B
12
B
1
B
5
B
9
B
13
B
2
B
6
B
10
B
14
B
3
B
7
B
11
B
15
to the state
B
0
B
4
B
8
B
12
B
5
B
9
B
13
B
1
B
10
B
14
B
2
B
6
B
15
B
3
B
7
B
11
.
The real MixColumn multiplies a column by c(z) = (x+1)z
3
+z
2
+z+x in F
2
8[z]/(z
4
+1).
Also c(z)
1
= (x
3
+x + 1)z
3
+(x
3
+x
2
+ 1)z
2
+(x
3
+ 1)z +(x
3
+x
2
+x). The MixColumn
step appears in all but the last round. The real AddRoundKey is the obvious generalization
of our A
K
i
. There is an additional AddRoundKey with round key 0 at the beginning of the
encryption algorithm.
For key expansion, the entries of the array W are four bytes each. The key lls in
W[0], . . . , W[3]. The function RotByte cyclically rotates four bytes 1 to the left each, like
the action on the second row in ShiftRow. The function SubByte applies the S-box to each
30
byte. RC[i] = x
i
in F
2
8 and RCON[i] is the concatenation of RC[i] and 3 bytes of all 0s.
For 4 i 43,
if i 0(mod 4) then W[i] = W[i 4] RCON(i/4) SubByte(RotByte(W[i 1]))
if i , 0(mod 4) then W[i] = W[i 4] W[i 1].
The i-th key K
i
consists of the bits contained in the entries of W[4i] . . . W[4i + 3].
AES as a product cipher
Note that there is transposition by row using ShiftRow. Though it is not technically
transposition, there is dispersion by column using MixColumn. The substitution is accom-
plished with ByteSub and AddRoundKey makes the algorithm key-dependent.
Analysis of Simplied AES
We want to look at attacks on the ECB mode of simplied AES.
The enemy intercepts a matched plaintext/ciphertext pair and wants to solve for the key.
Lets say the plaintext is p
0
. . . p
15
, the ciphertext is c
0
. . . c
15
and the key is k
0
. . . k
15
. There
are 15 equations of the form
f
i
(p
0
, . . . , p
15
, k
0
, . . . k
15
) = c
i
where f
i
is a polynomial in 32 variables, with coecients in F
2
which can be expected
to have 2
31
terms on average. Once we x the c
j
s and p
j
s (from the known matched
plaintext/ciphertext pair) we get 16 non-linear equations in 16 unknowns (the k
i
s). On
average these equations should have 2
15
terms.
Everything in simplied AES is a linear map except for the S-boxes. Let us consider how
they operate. Let us denote the input nibble of an S-box by abcd and the output nibble as
efgh. Then the operation of the S-boxes can be computed with the following equations
e = acd + bcd + ab + ad + cd + a + d + 1
f = abd + bcd + ab + ac + bc + cd + a + b + d
g = abc + abd + acd + ab + bc + a + c
h = abc + abd + bcd + acd + ac + ad + bd + a + c + d + 1
where all additions are modulo 2. Alternating the linear maps with these non-linear maps
leads to very complicated polynomial expressions for the ciphertext bits.
Solving a system of linear equations in several variables is very easy. However, there
are no known algorithms for quickly solving systems of non-linear polynomial equations in
several variables.
Design Rationale
The quality of an encryption algorithm is judged by two main criteria, security and
eciency. In designing AES, Rijmen and Daemen focused on these qualities. They also
instilled the algorithm with simplicity and repetition. Security is measured by how well
the encryption withstands all known attacks. Eciency is dened as the combination of
encryption/decryption speed and how well the algorithm utilizes resources. These resources
include required chip area for hardware implementation and necessary working memory for
31
software implementation. Simplicity refers to the complexity of the ciphers individual steps
and as a whole. If these are easy to understand, proper implementation is more likely. Lastly,
repetition refers to how the algorithm makes repeated use of functions.
In the following two sections, we will discuss the concepts security, eciency, simplicity,
and repetition with respect to the real AES algorithm.
Security
As an encryption standard, AES needs to be resistant to all known cryptanalytic attacks.
Thus, AES was designed to be resistant against these attacks, especially dierential and
linear cryptanalysis. To ensure such security, block ciphers in general must have diusion
and non-linearity.
Diusion is dened by the spread of the bits in the cipher. Full diusion means that
each bit of a state depends on every bit of a previous state. In AES, two consecutive rounds
provide full diusion. The ShiftRow step, the MixColumn step, and the key expansion
provide the diusion necessary for the cipher to withstand known attacks.
Non-linearity is added to the algorithm with the S-Box, which is used in ByteSub and
the key expansion. The non-linearity, in particular, comes from inversion in a nite eld.
This is not a linear map from bytes to bytes. By linear, I mean a map that can be described
as map from bytes (i.e. the 8-dimensional vector space over the eld F
2
) to bytes which can
be computed by multiplying a byte by an 8 8-matrix and then adding a vector.
Non-linearity increases the ciphers resistance against cryptanalytic attacks. The non-
linearity in the key expansion makes it so that knowledge of a part of the cipher key or a
round key does not easily enable one to determine many other round key bits.
Simplicity helps to build a ciphers credibility in the following way. The use of simple
steps leads people to believe that it is easier to break the cipher and so they attempt to do
so. When many attempts fail, the cipher becomes better trusted.
Although repetition has many benets, it can also make the cipher more vulnerable to
certain attacks. The design of AES ensures that repetition does not lead to security holes.
For example, the round constants break patterns between the round keys.
Eciency
AES is expected to be used on many machines and devices of various sizes and processing
powers. For this reason, it was designed to be versatile. Versatility means that the algorithm
works eciently on many platforms, ranging from desktop computers to embedded devices
such as cable boxes.
The repetition in the design of AES allows for parallel implementation to increase speed
of encryption/decryption. Each step can be broken into independent calculations because
of repetition. ByteSub is the same function applied to each byte in the state. MixColumn
and ShiftRow work independently on each column and row in the state respectively. The
AddKey function can be applied in parallel in several ways.
Repetition of the order of steps for the encryption and decryption processes allows for the
same chip to be used for both processes. This leads to reduced hardware costs and increased
speed.
Simplicity of the algorithm makes it easier to explain to others, so that the implementa-
tion will be obvious and awless. The coecients of each polynomial were chosen to minimize
32
computation.
AES vs RC4. Block ciphers more exible, have dierent modes. Can turn block cipher into
stream cipher but not vice versa. RC4 1.77 times as fast as AES. Less secure.
12 Public Key Cryptography
In a symmetric key cryptosystem, if you know the encrypting key you can quickly determine
the decrypting key (C aP +b(modN) or they are the same (modern stream cipher, AES).
In public key cryptography, everyone has a public key and a private key. There is know
known way of quickly determining the private key from the public key.
Main uses of public-key cryptography:
1) Agree on a key for a symmetric cryptosystem.
2) Digital signatures.
Public-key cryptography is rarely used for message exchange since it is slower than sym-
metric key cryptosystems.
12.1 RSA
This is named for Rivest, Shamir and Adleman. Recall that if gcd(m, n) = 1 and a
1(mod(n)) then m
a
m(modn).
Bob picks p, q, primes around 10
150
. He computes n = pq 10
300
and (n) = (p 1)(q
1). He nds some number e with gcd(e, (n)) = 1 and computes d e
1
(mod(n)). Note
ed 1(mod(n)) and 1 < e, d < (n). He publishes (n, e) and keep d, p, q hidden. He can
throw out p and q. Bob does the above once a year.
Alice wants to send Bob the plaintext message M (maybe an AES key) encoded as a
number 0 M < n. If the message is longer than n (which is rare), then she breaks the
message into blocks of size < n. Alice looks up Bobs n, e in a directory (more likely on his
website). She reduces M
e
(mod n) (thats a trapdoor function) and gets C with 0 C < n.
Note C M
e
(mod n). She sends C to Bob.
Bob reduces C
d
(mod n) and gets M. Why? C
d
(M
e
)
d
M
ed
M
1
= M(mod n).
If Eve intercepts C, its useless without Bobs d.
Example: Bob chooses p = 17, q = 41. Then computes n = pq = 17 41 = 697 and
(n) = (17 1)(41 1) = 640. He chooses e = 33 which is relatively prime to 640. He then
computes d 33
1
(mod 640) = 97. Bob publishes n = 697 and e = 33.
Alice wants to use C = aP +b(mod 26) with key(s) C 7P +25(mod 26) to send a long
message to Bob. She encodes the key as 7 26 + 25 = 207. She computes 207
e
(mod n) =
207
33
(mod 697). Her computer uses repeated squares to do this. 207
33
(mod 296) = 156.
Alice sends 156 to Bob. From 156, it is very hard for Eve to determine 207.
Bob gets 156 and computes 156
d
(mod n) = 156
97
(mod 697) = 207. Then (and this is not
part of RSA) breaks 207 = 7 26 +25. Now (again this is not part of RSA), Alice sends Bob
a long message using C 7P + 25(mod 26). End example.
Every user has a pair n
A
, e
A
for Alice, n
B
, e
B
for Bob, etc. in a directory or on his/her
website. n
A
, e
A
are called Alices public keys. d
a
is called Alices private key.
33
When Alice sends a message M to Bob, as above, she computes M
e
B
(mod n
B
). Bob has
d
B
so can get back to M.
Why is it hard to nd d from e and n? Well, d e
1
(mod (n)). Finding the inverse is
fast (polynomial time). Finding (n) is slow, if all you have is n, since it requires factoring,
for which the only known algorithms are subexponential, but not polynomial.
Assume n is know. Then knowing (n) is polynomial time equivalent to knowing p and
q. In simpler terms: computing (n) takes about as long as factoring.
Proof. If you know n, p, q then (n) = (p 1)(q 1) which can be computed in O(log
2
(n)).
Now lets say you know n, (n). We have x
2
+ ((n) n 1)x + n = x
2
+ ((p 1)(q
1) pq 1)x+pq = x
2
+(pq pq +1pq 1)x+pq = x
2
(p+q)x+pq = (xp)(xq).
So we can nd p, q by nding the roots of x
2
+ ((n) n 1)x +n. Can nd integer roots
of a quadratic polynomial in Z[x] using the quadratic formula. Taking the square root (of
a necessarily integer square) and doing the rest of the arithmetic will take little time. End
proof.
So nding (n) is as hard as factoring.
Practicalities: You want 1) gcd(p 1, q 1) to be small. 2) p 1 and q 1 should each
have a large prime factor. 3) p and q shouldnt be too close together, on the other hand, the
ratio of bigger/smaller is usually < 4.
There are special factorization algorithms to exploit each of the 3 weaknesses.
4) Usually e is relatively small (which saves time). Often e = 3 or 17.
For personal use, people use n of 1024 bits, so n 10
308
. For corporate use, people use
1024 or 2048 bits (latter n 10
617
. In the early 1990s, it was common to use 512 bits, so
n 10
154
. An RSA challenge number with n 2
768
10
232
was factored in 2009.
In a symmetric key cryptosystem, Alice and Bob must agree on a shared key ahead of
time. This is a problem. It requires co-presence (inconvenient) or sending a key over insecure
lines (unsafe). We see from the example of RSA, that public key cryptography solves the
problem of symmetric key cryptography.
12.2 Finite Field Discrete logarithm problem
Let F
q
be a nite eld. Let g generate F

q
. Let b F

q
. Then g
i
= b for some positive integer
i q 1. Determining i given F
q
, g and b is the nite eld discrete logarithm problem
(FFDLP), which is (to our current knowledge) as hard as factoring.
Example. 2 generates F

101
. So we know 2
i
= 3 (i.e. 2
i
3(mod 101)) has a solution. It
is i = 69. Similarly, we know 2
i
= 5 has a solution; it is i = 24. How could you solve such
problems faster than brute force? In Sections 30.1 and 30.3.3 we present solutions faster
than brute force. But they are nonetheless not fast. End example.
For cryptographic purposes we take 10
300
< q < 10
600
where q is a (large) prime or of
the form 2
d
. Notation, if g
i
= b then we write log
g
(b) = i. Recall the logarithms you have
already learned: log
10
(1000) = 3 since 10
3
= 1000 and ln(e
2
) = log
e
(e
2
) = 2. In the above
example, for q = 101 we have log
2
(3) = 69 (since 2
69
3(mod 101)).
The best known algorithms for solving the FFLDP take as long as those for factoring,
and so are subexponential.
34
12.3 Die-Hellman key agreement
Die-Hellman key agreement over a nite eld (FFDH) is commonly used. For a bunch of
users A, B, C, etc. we x q and g (a generator of F

q
. The numbers q and g are used for the
whole system.
Each user has a private key a (a
A
, a
B
, a
C
, . . .) with 1 < a < q 1 and a public key, which
is the reduction of g
a
in the eld F
q
. Each user publishes (the reductions of) g
a
A
, g
a
B
, . . . in
a directory or on their websites.
Note, often you create a new a
A
, g
a
A
for each transaction. Alice would then need to send
g
a
A
to Bob at the beginning and vice versa.
If Alice and Bob want to agree on a key for AES, they use the reduction of g
a
A
a
B
. Alice
can compute this since she looks up g
a
B
and raises it to a
A
. Bob can compute this since he
looks up g
a
A
and raises it to a
B
.
Eve has q, g, g
a
A
, g
a
B
but can not seem to nd g
a
A
a
B
without solving the FFDLP. This
often seems amazing. She can nd g
a
A
g
a
B
= ga
A
+ a
B
, but thats useless. To get g
a
A
a
B
,
she needs to raise g
a
A
, for example, to a
B
. To get a
B
she could try to use g and g
a
B
. But
determining a
B
from g and g
a
B
is the FFDLP, for which there is no known fast solution.
Example. q = p = 97, g = 5. a
A
= 36 is Alices private key. g
a
A
= 5
36
50(mod 97)
so g
a
A
= 50 is Alices public key. a
B
= 58 is Bobs private key. g
a
B
= 5
58
44(mod 97) so
g
a
B
= 44 is Bobs public key.
Alice computes (g
a
B
)
a
A
= 44
36
75 (in F
97
) (Ive changed notation as a reminder) and
Bob comptues (g
a
A
)
a
B
= 50
58
= 75.
From 97, 5, 50, 44, Eve cant easily get 75.
Practicalities: The number q 1 should have a large prime factor (or else there is a
special algorithm for solving the FFDLP). The reduction of g
a
A
a
B
will be about the same
size as q 10
300
. To turn this into an AES key, they could agree to use the last 128 bits of
the binary representation of g
a
A
a
B
if q is prime. If F
q
= F
2
[x]/(f(x)) then they could agree
to use the coecients of x
127
, . . . , x
0
in g
a
A
a
B
.
Often Alice and Bob generate a
A
and a
B
at the moment of rst contact and use them
only for that one exchange.
12.4 Lesser used public key cryptosystems
12.4.1 RSA for message exchange
RSA could be used for encrypting a message instead of encrypting an AES key (then there
is no need to use AES). Alice encodes a message M as a number 0 M < n
B
and sends
Bob the reduction of M
e
B
(mod n
B
).
If the message is too long, she breaks the message into blocks M
1
, M
2
, M
3
, . . . with each
M
i
< n
B
.
12.4.2 ElGamal message exchange
ElGamal message exchange has no patent so it is used in PGP for key agreement. Typically
used to exchange a key for a symmetric cryptosystem (like AES; in PGP use CAST-128, like
AES) but can be used to send any message.
35
We have the same initial set-up as Die-Hellman. Everyone uses same F
q
and g, a
generator of F

q
.
Alice wants to send a message M to Bob. If q = p, then encode as a number between 0
and p 1. If q = 2
d
then take the ASCII of M (like 101110 . . .) and encode as a polynomial
(like 1x
d1
+ 0x
d2
+ 1x
d3
+ . . .). If M is an AES key, then you would also encode it as a
polynomial. If M is too big, then break it into blocks.
Alice chooses a random number k with 1 < k < q. She picks a dierent k each session.
She then sends Bob the pair g
k
, Mg
a
B
k
(each reduced in the nite eld).
Alice knows g and g
a
B
(since its public) and k so she can compute g
k
and (g
a
B
)
k
= g
a
B
k
and then multiplies the latter to get Mg
a
B
k
. Bob receives the pair. He wont nd k and
wont need to. He rst computes (g
k
)
a
B
= g
a
B
k
(he knows a
B
, his private key). Then he
computes (g
a
B
k
)
1
(in F
q
) and multiplies (Mg
a
B
k
)(g
a
B
k
)
1
= M.
If Eve nds k (which seems to require solving the FFDLP since g is known and g
k
is
sent) she could compute (g
a
B
)k = g
a
B
k
then (g
a
B
k
)
1
, then M.
Example: q = 97, g = 5, a
B
= 58 is Bobs private key, g
a
B
= 44 is Bobs public key.
Alice wants to send M = 30 to Bob. She picks a random session key k = 17. She computes
g
k
= 5
17
= 83. She knows g
a
B
= 44 (its public) and computes (g
a
B
)
k
= 44
17
= 65. Then
she computes Mg
a
B
k
= 30 65 = 10. She sends Bob g
k
, Mg
a
B
k
= 83, 10.
Bob receives 83, 10. He knows a
B
= 58 so computes (g
k
)
a
B
= 83
58
= 65 = g
a
B
k
. Then
computes (g
a
B
k
)
1
= 65
1
= 3 (i.e. 65
1
3(mod 97)), then multiplies (Mg
a
B
k
(g
a
B
k
)
1
=
10 3 = 30 = M.
12.4.3 Massey-Omura message exchange
The Massey-Omura cryptosystem (this is not really symmetric or public key). It can be used
to send a key or a message. For a system of users, there is a nite eld F
q
with q large. You
dont need a generator or public keys. Alice and Bob arrange to communicate. Alice picks
a random encrypting key e
A
with gcd(e
A
, q 1) = 1. Bob picks a random encrypting key e
B
with gcd(e
B
, q 1) = 1. Both es are for this session only.
Alice computes d
A
e
1
A
(mod q 1). Bob computes d
B
e
1
B
(mod q 1). Nothing is
published.
Alice encodes a plaintext message as an element of the eld M F

q
. If its too big, she
breaks it into blocks. She sends the reduction of M
e
A
in F
q
to Bob. Its gibberish to Bob
who sends back to Alice (M
e
A
)
e
B
= M
e
A
e
B
, which is gibberish to her. Alice sends to Bob
(M
e
A
e
B
)
d
A
= M
e
A
e
B
d
A

= M
e
A
d
A
e
B
= M
e
B
. Then Bob computes (M
e
B
)
d
B
= M.
The special step is happening at . In a sense, Alice puts a sock on a foot. Bob sticks a
shoe over that. Alice then removes the sock, without removing the shoe, then Bob removes
the shoe. Bob now sees the foot, though Alice never does.
The Massey-Omura cryptosystem was tried with cell-phones.
Example. p = 677. Alice sends Bob the digraph SC. Since S= 18 and C= 2 the digraph is
encoded as 18 26+2 = 470 = M. Alice picks e
A
= 255, so d
A
= 255
1
(mod 676) = 395. Bob
picks e
B
= 421 so d
B
= 421
1
(mod 676) = 281. Alice computes 470
255
292(mod 677) and
sends 292 to Bob. Bob computes 292
421
156(mod 677) and sends 156 to Alice. Alice com-
putes 156
395
313(mod 677) and sends 313 to Bob. Bob computes 313
281
470(mod 677)
and decodes 470 to SC.
36
12.5 Elliptic curve cryptography
12.5.1 Elliptic curves
An elliptic curve is a curve described by an equation of the form y
2
+ a
1
xy + a
3
y = x
3
+
a
2
x
2
+ a
4
x + a
6
and an extra 0-point. Example y
2
+ y = x
3
x is in gure 1 (on a future
page). Where did this form come from? It turns out that all cubic curves can be brought
to this form by a change of variables and this is a convenient form for the addition we will
describe. For now we will work over the real numbers. We need a zero-point that we will
denote . Bend all vertical lines so they meet at the top and bottom and glue those two
endpoints together. Its called the point at or the 0-point. It closes o our curve. That
point completes our curves. Its at the top and bottom of every vertical line.
We can put an addition rule (group structure) for points of an elliptic curve. Rule: Three
points lying on a line sum to the 0-point (which well denote ).
The vertical line L
1
meets the curve at P
1
, P
2
and ; so P
1
+ P
2
+ = , so P
1
= P
2
,
and P
2
= P
1
. Two dierent points with the same x-coordinate are inverses/negatives of
each other. See gure 2.
If you want to add P
1
+P
2
, points with dierent x-coordinates, draw a line between them
and nd the third point of intersection P
3
. Note P
1
+ P
2
+ P
3
= , P
1
+ P
2
= P
3
. See
gure 3.
Aside: Where do y = x
2
and y = 2x 1 intersect? Where x
2
= 2x 1 or x
2
2x + 1 =
(x1)
2
= 0. They meet at x = 1 twice (from the exponent) and this explains why y = 2x1
is tangent to y = x
2
. See gure 4.
Back to elliptic curves. How to double a point P
1
. Draw the tangent line and nd the
other point of intersection P
2
. P
1
+ P
1
+ P
2
= so 2P
1
= P
2
. See gure 5.
37
1. An elliptic curve with x & y-axes. 2. EC without axes.
y^2 + y = x^3 - x Finding negatives.
@ <- 0-point
*
| | * |
| / * /
| / * /
| / * /
| / * /
| / * /
| / * /
| / * /
_ | / _ * /
/ \ | / / \ @ <- P1
--/-----\---------- /------------- / \ / *
| | \ / | \ / *
| | | | | | | *
| | / \ | / \ *
\ / \ \ / \ *
\_ / | \ \_ / @ <- P2
| \ * \
| \ * \
| \ * \
| \ * \
| \ * \
| \ * \
| \ * \
| | * |
38
3. Summing P1+P2. 5. Doubling P1.
| /
/ -P2=2P1 -> @
/ /
/ /
/ * /
P3 / * /
@ /
* / /
_ * / _ /
/ \ P2 * / / \ /
/ \@ / / \ /
P1 | * \ / | \ /
@ | | | | |
* | / \ * | / \
\ / \ * \ / \
\_ / \ @_ / \
\ P1 * \
\ * \
@ -P3 * \
\ =P1+P2 * \
\ * \
\ * \
\ * \
4. y = x^2 and y = 2x-1 \ * \
| @ P2
\ / \
\ /
\ / *
\ /*
\ /
\ * <-(1,1)
\__/
*
*
Lets do an example. Clearly P = (1, 0) is on the curve y
2
+ y = x
3
x. Lets nd
2P. We nd the tangent line at P using implicit dierentiation. 2y
dy
dx
+
dy
dx
= 3x
2
1.
So
dy
dx
=
3x
2
1
2y+1
and
dy
dx
[
(1,0)
= 2. The tangent line is y 0 = 2(x 1) or y = 2x 2.
Where does that intersect y
2
+ y = x
3
x? Where (2x 2)
2
+ (2x 2) = x
3
x or
x
3
4x
2
+5x 2 = 0 = (x 1)
2
(x 2). It meets twice where x = 1 (i.e. at (1, 0)) and once
where x = 2. Note that the third point of intersection is on the line y = 2x 2 so it is the
point (2, 2). Thus (1, 0) +(1, 0) +(2, 2) = 2P +(2, 2) = , (2, 2) = 2P, 2P = (2, 2). Now
39
(2, 2) is the other point with the same x-coordinate. If x = 2 then we have y
2
+ y = 6 so
y = 2, 3 so 2P = (2, 3).
To nd 3P = P + 2P = (1, 0) + (2, 3), we will nd the line through (1, 0), (2, 3). Its
slope is 3 so y 0 = 3(x1) or y = 3x+3. Where does that line meet y
2
+y = x
3
x?
Well (3x+3)
2
+(3x+3) = x
3
x or x
3
9x
2
+20x12 = 0 = (x1)(x2)(x6) (note
that we knew the line met the curve where x = 1 and x = 2 so (x 1)(x 2) is a factor of
x
3
9x
2
+20x 12, so nding the third factor is then easy). The third point of intersection
has x = 6 and is on y = 3x + 3 so its (6, 15). So (1, 0) + (2, 3) + (6, 15) = and
(1, 0) +(2, 3) = (6, 15). Whats (6, 15)? If x = 6, then y
2
+y = 210, y = 15, 14 so
(6, 15) = (6, 14) = P + 2P = 3P. End of example.
Since adding points is just a bunch of algebraic operations, there are formulas for it. If
P
1
= (x
1
, y
1
), P
2
= (x
2
, y
2
) and P
1
,= P
2
then P
1
+ P
2
= P
3
= (x
3
, y
3
) where
=
y
2
y
1
x
2
x
1
, =
y
1
x
2
y
2
x
1
x
2
x
1
if x
1
,= x
2
and
=
3x
2
1
+ 2a
2
x
1
+ a
4
a
1
y
1
2y
1
+ a
1
x
1
+ a
3
, =
x
3
1
+ a
4
x
1
+ 2a
6
a
3
y
1
2y
1
+ a
1
x
1
+ a
3
if x
1
= x
2
and x
3
=
2
+a
1
a
2
x
1
x
2
and y
3
= ( +a
1
)x
3
a
3
(in either case).
Example. Find (1, 0) + (2, 3) on y
2
+ y = x
3
x using the addition formulas. a
1
= 0,
a
3
= 1, a
2
= 0, a
4
= 1, a
6
= 0, x
1
= 1, y
1
= 0, x
2
= 2, y
2
= 3. =
30
21
= 3,
=
02(3)(1)
21
= 3. So x
3
= (3)
2
+0(3)012 = 6 and y
3
= (3+0)(6)31 = 14.
So (1, 0) + (2, 3) = (6, 14).
12.5.2 Elliptic curve discrete logarithm problem
Lets work over nite elds. In F

p
with p ,= 2, a prime, half of the elements are squares. As
an example, in F

13
, 1
2
= 1, 2
2
= 4, 3
2
= 9, 4
2
= 3, 5
2
= 12, 6
2
= 10, 7
2
= 10, 8
2
= 12,
9
2
= 3, 10
2
= 9, 11
2
= 4, 12
2
= 1. The equation y
2
= 12 has two solutions y = 5 = 5, 8.
There are ecient algorithms for determining whether or not an element of F

p
is a square
and if so, what are the square roots. If p > 3 then we can nd an equation for our elliptic
curve of the form y
2
= x
3
+ a
4
x + a
6
, by changing variables, if necessary.
Example. Let E be y
2
= x
3
+ 1 nd E(F
5
) (the points with coordinates in F
5
). It helps
to know the squares: 0
2
= 0, 1
2
= 1, 2
2
= 4, 3
2
= 4, 4
2
= 1.
x x
3
+ 1 y =

x
3
+ 1 points
0 1 1 = 1, 4 (0, 1), (0, 4)
1 2 no
2 4 2 = 2, 3 (2, 2), (2, 3)
3 3 no
4 0 0 (4, 0)
and
40
We have 6 points in E(F
5
). Over a nite eld you can add points using lines or addition
formulas. If G = (2, 3) then 2G = (0, 1), 3G = (4, 0), 4G = (0, 4) (note it has same x-
coordinate as 2G so 4G = 2G and 6G = ), 5G = (2, 2), 6G = . So G = (2, 3) is a
generator of E(F
5
).
Example. Let E be y
2
= x
3
+x+1 over F
109
. It turns out that E(F
109
) has 123 points and
is generated by G = (0, 1). The point (39, 45) is in E(F
109
) since 39
3
+39+1 63(mod 109)
and 45
2
63(mod 109). So (39, 45) = (0, 1)+(0, 1)+. . . +(0, 1) = n(0, 1) for some integer n.
What is n? That is the discrete log problem for elliptic curves over nite elds (ECDLP).
You could solve this by brute force, but not if 109 is replaced by a prime around 10
50
. This
problem is currently harder to solve than the FFDLP. So we can use shorter keys. Another
advantage here is that for a given nite eld there can be lots of associated elliptic curves.
It takes one or two points to generate E(F
p
). Consider y
2
= x
3
+ 1 over F
7
. 0
2
= 0,
(1)
2
= 1, (2)
2
= 4, (3)
2
= 2.
x x
3
+ 1 y =

x
3
+ 1 points
0 1 1 (0, 1), (0, 6)
1 2 3 (1, 3), (1, 4)
2 2 3 (2, 3), (2, 4)
3 0 0 (3, 0)
4 2 3 (4, 3), (4, 4)
5 0 0 (5, 0)
6 0 0 (6, 0)
and
So E(F
7
) has 12 points.
R = (5, 0) 2R =
Q = (1, 3) Q + R = (2, 3)
2Q = (0, 1) 2Q + R = (4, 4)
3Q = (3, 0) 3Q + R = (6, 0)
4Q = (0, 6) 4Q + R = (4, 3)
5Q = (1, 4) 5Q + R = (2, 4)
6Q =
All points are of the form nQ+mR with n Z/6Z and m Z/2Z. Note that the coecients
of y
2
= x
3
+1 and the coordinates of the points are all dened modulo 7, whereas the points
add up modulo 6. In this case, two points together generate. You could still use discrete log
with G = (1, 3) as a pseudo-generator point, for example. It wouldnt generate all of E(F
7
)
but half of it.
On average, #E(F
p
) = p + 1.
12.5.3 Elliptic curve cryptosystems
In the next two sections, we describe the analogues of the Die Hellman key agreement
system and the ElGamal message exchange system. The section on the Elliptic Curve El-
Gamal message exchange system explains how to encode a plaintext message on a point of
an elliptic curve.
41
12.5.4 Elliptic curve Die Hellman
Analogue of Die Hellman key exchange for elliptic curves (ECDH). Choose a nite eld F
q
with q 10
50
. Note that since this discrete logarithm problem is currently harder to solve
than that described earlier in F

q
, we can pick q smaller than before. Fix some elliptic curve
E whose dening equation has coecients in F
q
and a (pseudo) generator point G = (x
1
, y
1
)
which is in E(F
q
). The point G must have the property that some very high multiple of G is
the 0-point nG = . Recall nG = G+G+G+. . . +G (n times). The number n should have
a very large prime factor and n ,= q, q +1, q 1 (otherwise there are special faster algorithms
for solving the ECDLP).
Each user has a private key number a
A
, a
B
, . . . and a public key point a
A
G, a
B
G, . . ..
Alice and Bobs Die-Hellman shared key will be a
A
a
B
G.
Example q = p = 211, E : y
2
= x
3
4, G = (2, 2). It turns out that 241G = . Alices
private key is a
A
= 121 so As public key is a
A
G = 121(2, 2) = (115, 48). Bobs private key
is a
B
= 223 so Bs public key is a
B
G = 223(2, 2) = (198, 72). Their shared key is a
A
a
B
G.
So Acomputes a
A
(a
B
G) = 121(198, 72) = (111, 66) and B computes a
B
(a
A
G) = 223(115, 48) =
(111, 66). So (111, 66) is their shared key that they could use for a symmetric key cryptosys-
tem.
Note that trying to gure out what multiple of G = (2, 2) gives you Alices public key
(115, 48) is the ECDLP. Alice can compute 121G through repeated doubling. In addition, if
p 10
50
, Alice and Bob could agree to use the last 128 bits of the binary representation of
the x-coordinate of their shared key as an AES key.
Practicalities: For FFDH people use q > 10
300
but for ECDH people q > 10
50
. Usually
q = 2
r
with r 163. Indeed, adding two points on an elliptic curve is much slower than
doing a multiplication in a nite eld. However, since q is much smaller for ECDH, that
makes up for much of the slow-down.
12.5.5 Elliptic Curve ElGamal Message Exchange
Analogue of ElGamal message exchange. First issue: How to encode a message as a point.
Go back to nite elds. If working with p = 29 then you can encode each letter as an element
of F
29
, A = 0, . . . , Z = 25. What to do with the elliptic curve, for example y
2
= x
3
4 over
F
29
. Ideally you could encode a number as an x-coordinate of a point, but not all numbers
are x-coordinates of points (only about half of them). Not all numbers are y-coordinates of
points either (only about half of them). Try to encode I = 8. 8
3
4 = 15 ,= 2 F

29
.
Instead you could work over p = 257 (chosen because its the rst prime bigger than
25 10). Encode the message and one free digit as the x-coordinate of a point. With 10
digits to choose from and each having a 50% chance of success, this should work (in real life
you might have the last eight bits free so the probability of trouble is essentially 0).
Say you have p = 257, E : y
2
= x
3
4. Message L = 11. Find a point (11a, y) on the
curve. Try x = 110.
x = 110, 110
3
4 250 ,= 2(mod257).
x = 111, 111
3
4 130 ,= 2(mod257).
x = 112, 112
3
4 162 26
2
(mod257).
A handout shows how to do this in PARI.
42
So (112, 26) is a point on the curve and all but the last digit of the x-coordinate is our
message. If Alice wants to send the message L to Bob, then she picks a random k. Let
a
B
G be Bs public key. Q is the encoded plaintext point. Then Alice sends (kG, Q+ka
B
G)
to Bob. Bob receives it. Computes a
B
kG and subtracts that from Q + kA
B
G to get the
plaintext point Q.
Example. p = 257, E : y
2
= x
3
4, G = (2, 2), a
B
= 101, a
B
G = 101(2, 2) = (197, 167)
(this is Bobs public key point). Alice wants to send the message L encoded as Q = (112, 26)
to Bob. She picks the random session k = 41 and computes kG = 41(2, 2) = (136, 128),
k(a
B
G) = 41(197, 167) = (68, 84) and Q + ka
B
G = (112, 26) + (68, 84) = (246, 174).
Alices sends the pair of points kG, Q + ka
B
G or (136, 128), (246, 174) to Bob.
Bob receives the pair of points and computes a
B
(kG) = 101(136, 128) = (68, 84). Then
computes (Q+ka
B
G) (a
B
kG) = (246, 174) (68, 84) = (246, 174) +(68, 84) = (112, 26).
And decodes all but the last digit of the x-coordinate to 11 =L.
Again people actually prefer to work over elds of the type F
2
r . There are subexponential
algorithms for solving the FFDLP in F

q
and for factoring n so people work with q n >
10
300
. The best known algorithm for solving the ECDLP in E(F
q
) takes time O(

q), which
is exponential. So people work with q > 10
50
. It takes longer to add points on an elliptic
curve than to do a multiplication in a nite eld (or mod n) for the same size of q. But since
q is much smaller for an EC, the slow-down is not signicant. In addition, we have smaller
keys when working with ECs which is useful in terms of key agreement and working where
there is minimal storage or computations should be kept short, like on smart cards.
13 Hash Functions and Message Authentication Codes
A hash function f(x) sends m+t bit strings to t bit strings and should have three properties.
A hash algorithm H(x) is built up from a hash function and sends strings of arbitrary length
to t bit stings and should have the same three properties.
A hash algorithm H(x) is said to have the one-way property if given an output y it is
dicult to nd any input x such that H(x) = y. It is said to have the weakly collision free
property if, given input x, it is dicult dicult to nd any x

,= x such that H(x) = H(x

).
It is said to have the strongly collision free property it is dicult to nd any x and x

with
x ,= x

such that H(x) = H(x

). It can be shown (under reasonable assumptions) that

strongly collision free implies one-way and weakly collision free.
Wang, Feng, Lai, and Yu have shown recently that none of the popular hash algorithms
is strongly collision free so now everyone is searching for a strongly-collision free and ecient
hash algorithm.
To create a hash algorithm from a hash function one normally uses a hash function with
two inputs: an m-bit string a and a t-bit string b. So f(a, b) outputs a t-bit string. Lets
extend a hash function f to a hash algorithm H. Assume that the M has more than m bits.
Break M into m-bit blocks, padding the last block if necessary with 0s. Initially we take b
to be a given, known t-bit initialization vector (perhaps all 0s).
Example.
43
mbits mbits mbits
M1 M2 end msg / pad
t bits
IV f
t bits
f
t bits
f H(msg)
If a hash algorithm depends on a secret key, it is called a MAC. To do this, we just
replace the known IV with a secret shared key.
Example. f is AES, so t = m = 128. Break the message into 128 bit blocks. If the
message length is not a multiple of 128 bits then add 0s to the end (padding) so that it is.
The key for the second AES is the output of the rst AES and so on. The nal output is
the hash of the message. This is not a secure hash function but its OK as a MAC.
Lets esh out this scenario. Alice and Bob used public-key cryptography to agree on
two AES keys, key
1
and key
2
. Alice sends Bob (in ECB mode, for simplicity) a message
encrypted with AES. She breaks the message into n blocks: PT
1
, . . . , PT
n
. She encrypts
each PT
i
with AES and using key
1
to get the corresponding ciphertexts CT
1
, . . . , CT
n
.
Then Alice computes the MAC of PT
1
P
2
. . . PT
n
using key
2
and sends the (unencrypted)
MAC to Bob.
Bob receives CT
1
, . . . , CT
n
and decrypts them using key
1
. Now Bob has the PT
i
s. Then
Bob MACs those PT
i
s with key
2
and nds the MAC. Then Bob checks to see if this MAC
agrees with the one that Alice sent him. If it does, then he can be sure that no one tampered
with the CT
i
s during transmission. This is called message integrity.
Without the MAC, Eve could intercept CT
1
, . . . , CT
n
along the way and tamper with
it (though it probably wouldnt decrypt to something sensible since Eve doesnt know the
key).
If Eve tampers with it, she cant create a MAC that will agree with hers. End Example
13.1 The MD5 hash algorithm
One of the most popular hash algorithms at the moment is MD5 (SHA1 is another - this
stands for Secure Hash Algorithm). It is more ecient than the hash algorithm described
above using AES. It is based on the following hash function f. The function f maps 512 bit
strings to 128 bit strings. Let X be a 512 bit string. For MD5 we will call a 32 bit string a
word. So X consists of 16 words. Let X[0] be the rst word, X[1] be the next, . . ., X[15] be
the last word.
Initial buers
While evaluating f we continue to update four buers: A, B, C, D; each contains one
word. There are four constants Const
A
0x67452301, Const
B
= 0xefcdab89, Const
C
=
0x98badcfe, Const
D
0x10325476. The notation 0x indicates that what comes after is a hex-
adecimal representation which uses the symbols 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, a, b, c, d, e, f to rep-
resent the nibbles 0000, 0001, . . . , 1111. So Const
A
= 01100111010001010010001100000001.
Initially we let A = Const
A
, B = Const
B
, C = Const
C
, D = Const
D
. For clarity dur-
ing the hash function, when we update, A, B, C or D we will give it an index. So initiall
A
0
= Const
A
, B
0
= Const
B
, C
0
= Const
C
, D
0
= Const
D
.
44
The four functions
Let us dene four functions. Each takes 3 words as inputs.
F(X, Y, Z) = XY

XZ,
G(X, Y, Z) = XZ Y

Z,
H(X, Y, Z) = X Y Z,
I(X, Y, Z) = Y (X

Z).
Note

1 = 0 and

0 = 1 (this NOT). Note 0 0 = 0, 0 1 = 1, 1 0 = 1, 1 1 = 1 (this is
OR).
For example, let us apply F to three bytes (instead of 3 words). Let X = 00001111,
Y = 00110011, Z = 01010101.
X Y Z XY

XZ XY

XZ
0 0 0 0 0 0
0 0 1 0 1 1
0 1 0 0 0 0
0 1 1 0 1 1
1 0 0 0 0 0
1 0 1 0 0 0
1 1 0 1 0 1
1 1 1 1 0 1
So F(X, Y, Z) = 01010011. Note that for 1-bit inputs to F, we had all 8 possibilities
000, . . . , 111 and the outputs were 0 half the time and 1 half the time. This is true for G,
H, and I as well.
The constants
There are 64 constants T[1], . . . , T[64]. Let i measure radians. Then [sin(i)[ is a real
number between 0 and 1. Let T[i] be the rst 32 bits after the decimal point in the binary
representation of [sin(i)[. Be careful, here the index starts at 1 because sin(0) is no good.
Rotation notation
If E is a 32-bit string, and 1 n 31 then E <<< n is a left rotational shift
of E by n bits. So if E = 01000000000000001111111111111111 then E <<< 3 =
00000000000001111111111111111010.
More notation
We let + denote addition modulo 2
32
where a word is considered to be the binary repre-
sentation of an integer n with 0 n 2
32
1.
In computer science x := y means set x equal to the value of y at this moment. So if
x = 4 at a particular moment and you write x := x + 1 then after that step, x = 5.
Evaluating f
f takes as input, X and 4 words which we denote A, B, C, D.
First the 4 words are stored: AA := A
0
, BB := B
0
, CC := C
0
, DD := D
0
.
Then there are 64 steps in four rounds.
45
Round 1 consists of 16 steps.
Let [abcd k s i] denote the operation a := b + ((a + F(b, c, d) + X[k] + T[i]) <<< s).
Those 16 steps are
[ABCD 0 7 1] [DABC 1 12 2] [CDAB 2 17 3] [BCDA 3 22 4]
[ABCD 4 7 5] [DABC 5 12 6] [CDAB 6 17 7] [BCDA 7 22 8]
[ABCD 8 7 9] [DABC 9 12 10] [CDAB 10 17 11] [BCDA 11 22 12]
[ABCD 12 7 13] [DABC 13 12 14] [CDAB 14 17 15] [BCDA 15 22 16].
Round 2 consists of the next 16 steps.
Let [abcd k s i] denote the operation a := b + ((a + G(b, c, d) + X[k] + T[i]) <<< s).
Those 16 steps are
[ABCD 1 5 17] [DABC 6 9 18] [CDAB 11 14 19] [BCDA 0 20 20]
[ABCD 5 5 21] [DABC 10 9 22] [CDAB 15 14 23] [BCDA 4 20 24]
[ABCD 9 5 25] [DABC 14 9 26] [CDAB 3 14 27] [BCDA 8 20 28]
[ABCD 13 5 29] [DABC 2 9 30] [CDAB 7 14 31] [BCDA 12 20 32]
Round 3 consists of the next 16 steps.
Let [abcd k s i] denote the operation a := b + ((a + H(b, c, d) + X[k] + T[i]) <<< s).
Those 16 steps are
[ABCD 5 4 33] [DABC 8 11 34] [CDAB 11 16 35] [BCDA 14 23 36]
[ABCD 1 4 37] [DABC 4 11 38] [CDAB 7 16 39] [BCDA 10 23 40]
[ABCD 13 4 41] [DABC 0 11 42] [CDAB 3 16 43] [BCDA 6 23 44]
[ABCD 9 4 45] [DABC 12 11 46] [CDAB 15 16 47] [BCDA 2 23 48]
Round 4 consists of the last 16 steps.
[abcd k s i] denote the operation a := b + ((a + I(b, c, d) + X[k] + T[i]) <<< s).
Those 16 steps are
[ABCD 0 6 49] [DABC 7 10 50] [CDAB 14 15 51] [BCDA 5 21 52]
[ABCD 12 6 53] [DABC 3 10 54] [CDAB 10 15 55] [BCDA 1 21 56]
[ABCD 8 6 57] [DABC 15 10 58] [CDAB 6 15 59] [BCDA 13 21 60]
[ABCD 4 6 61] [DABC 11 10 62] [CDAB 2 15 63] [BCDA 9 21 64]
Lastly, add in the saved words from the beginning.
A := A + AA, B := B + BB, C := C + CC, D := D + DD.
The output of f is the concatenation ABCD, which has 128 bits.
Clarication
46
Let us clarify the notation above. First let us look at Step 1. Before Step 1, we have
A = A
0
= 67 45 23 01, B = B
0
= . . ., C = C
0
= . . ., D = D
0
= . . .. Recall
[abcd k s i] denotes the operation a := b + ((a +F(b, c, d) +X[k] +T[i]) <<< s). And Step
1 is [ABCD 0 7 1].
So that means
A := B + ((A + F(B, C, D) + X[0] + T[1]) <<< 7)
or
A
1
:= B
0
+ ((A
0
+ F(B
0
, C
0
, D
0
) + X[0] + T[1]) <<< 7).
So rst we evaluate F(B
0
, C
0
, D
0
). Then we turn it into an integer. Then we turn A
0
,
X[0] and T[1] into integers. Then we add the four integers together modulo 2
32
. Recall X[0]
is the beginning of the 512-bit input message and T[1] comes from sin(1). Take the result
and convert it to a 32-bit word and shift left by 7. Turn that back into an integer and turn
B
0
into an integer and add those two modulo 2
32
to get A
1
. Turn A
1
back into a 32-bit word.
Now A = A
1
, B = B
0
, C = C
0
, D = D
0
.
Now we move onto Step 2. Recall
[abcd k s i] denotes the operation a := b + ((a +F(b, c, d) +X[k] +T[i]) <<< s). And Step
2 is [DABC 1 12 2]. So that means
D := A + ((D + F(A, B, C) + X[1] + T[2]) <<< 12) or
D
1
:= A
1
+ ((D
0
+ F(A
1
, B
0
, C
0
) + X[1] + T[2]) <<< 12).
Now A = A
1
, B = B
0
, C = C
0
, D = D
1
.
Hash algorithm
We will call the input to the hash algorithm the message. Let us say that the (padded)
message has 3 512 bits and consists of the concatenation of three 512-bit strings S
1
S
2
S
3
.
First we take S
1
and break it into 16 words: X[0], . . . , X[15].
We start with the buers A = 0x67452301, B = 0xefcdab89, C = 0x98badcfe, D =
0x10325476. We go through the algorithm described above. After the 64th steps A = A
16
,
B = B
16
, C = C
16
, D = D
16
. Then A

16
= A
16
+ AA, B

16
= B
16
+ BB, C

16
= C
16
+ CC,
D

16
= D
16
+ DD. That gives the 128-bit output ABCD = A

16
B

16
C

16
D

16
. (Note, I
consider the outputs of steps 61 - 64 to be A
16
, D
16
, C
16
, B
16
and then after adding in
AA = A
0
, BB = B
0
, CC = C
0
, DD = D
0
the output is A

16
B

16
C

16
D

16
.)
Next, break S
2
into 16 words: X[0], . . . , X[15]. These will undoubtedly be dierent
from the X[0], . . . , X[15] above. We go through the algorithm described above except the
initial values of A, B, C, D come from the output of the previous 64 steps A = A

16
, BB =
B

16
, C = C

16
, D = D

16
, not 0x67452301, . . . . There will again be a 128-bit output ABCD =
A

32
B

32
C

32
D

32
.
Next, break S
3
into 16 words: X[0], . . . , X[15]. We go through the algorithm described
above except the initial values of A, B, C, D come from the output of the previous 64 steps,
i.e. A = A

32
, B = B

32
, C = C

32
, D = D

32
.
There will again be a 128-bit output ABCD = A

48
B

48
C

48
D

48
, which is the output of the
algorithm, known as the hash value.
Notes: 1) Technically, to make f a hash function, we can write f
hash
(X) = f(A, B, C, D, X).
Now f
hash
(X) is a map simply from 512-bit strings to 128-bit strings.
47
2) The message is always padded. First, it is padded so that the number of bits in the
message is 448 64(mod 512). To pad, you append at the end one 1 and then as many
0s as you need so that the message length will be 64(mod 512). Let b be the length of the
message before padding. If b 448(mod 512) to begin with, then append one 1 and 511 0s.
Write b in its 64-bit binary representation (so there will probably be a lot of 0s on the left).
Now append this 64-bit binary representation of b to the right of our padded message so its
length is a multiple of 512.
Lets give an example. Assume the original message has length 1700 bits. Now 1700
164(mod 512). We have 448164 = 284. So we append one 1 and 283 0s on the right. Now
the message has 1984 bits. Note 1984 448 64(mod 512). Now 1700 = (11010100100)
2
.
So we append the 64 bit binary representation of 1700, namely
0000000000000000000000000000000000000000000000000000011010100100, to the right and
the message now has length 1984 + 64 = 2048 = 4 512.
3) The function f
hash
is complicated because within each step it cycles through bit-wise
operations (F, G, H, I), shifting and additions modulo 2
32
which operate on entire strings
at once (and have carries, unlike bit-wise operations). The fact that all four buers are
constantly updated and the message pieces introduced slowly increases the safety also.
4) It was shown in 2004 (Wang, Feng, Lai, Yu) that MD5 does not have the strongly collision
free property. However it may still have the two desired properties: one way and weakly
collision free.
14 Signatures and authentication
A bank in Maine agrees to hire an Idaho architecture rm to design their next building. The
bank of Maine writes up a contract. Everything is occuring electronically so the Idaho rm
wants a digital signature on it. How can this be done? You want the Idaho rm to be sure
its the bank that signed it and not some hacker impersonating that bank.
Making yourself sure that a message came from the proper sender is called authentication.
The solution is signatures and certicates. Signatures connect a message with a public key.
Certicates connect a public key with an entity. You can use public-key cryptography for
signatures.
14.1 Signatures with RSA
Signatures with RSA: Say George Bush (=G) and Tony Blair =(T) are using RSA. In a
public key cryptosystem, there is no shared key that only Bush and Blair have. So Osama
bin Laden (=L) could e-mail Bush an AES key, encrypted with Bushs public RSA key and
then send Bush the message Lay o Bin Laden, sincerely, Tony Blair encrypted with AES.
How would Bush know who its from. He must demand a signature.
Case 1, T sends PT msg M to G, no need to encrypt. At end signs M
2
=Tony Blair.
Wants to make sure G knows its from him. T then computes M
d
T
2
(mod n
T
). Could add to
end of mgs. Only T can do that. G can verify its from him by computing (M
d
T
2
)
e
T
(mod N
T
)
48
to get M
2
. Eve can read signature too. Also Eve can cut and paste signature to end of her
own message.
Case 2. T creates an AES key and sends (key
AES
)
e
G
(mod n
G
) to G. G decrypts to get
key
AES
. T encrypts message M for G using AES and sends CT to G. T hashes M to get
hash(M). and G hashes (decrypted) M to get hash(M). T computes hash(M)
d
T
(mod n
T
) = X
and sends to G. G compute X
e
T
(mod n
T
) and conrms it equals the hash(M) he earlier
computed. Only T could have created X so that X
e
T
= hash(M).
Case 3. Same as case 2, but instead of just sending the signed hash, T wants to encrypt
the signed hash with Gs public RSA keys.
Case 3a. Assume n
T
< n
G
. T=Tony encrypts message M for G=George using AES
and sends CT to G. G decrypts to get M. Then Tony hashes M to get hash(M) and G
hashes (decrypted) M to get hash(M). Tony wants to sign and encrypt hash(M) using RSA.
Tony computes [hash(M)
d
T
(mod n
T
)]
e
G
(mod n
G
) = X and sends that to G. Now G com-
putes [X
d
G
(mod n
G
)]
e
T
(mod n
T
). Then he checks to see whether or not this equals hash(M).
If it does, then G knows 1) the message was sent by whoever owns the keys e
T
and n
T
(authentication) and that it was not tampered with by anyone else (integrity).
Case 3b. Assume n
T
> n
G
. There is a problem now. Example: Assume n
T
= 100000
and n
G
= 1000 (bad RSA numbers). Assume that hash(M)
d
T
(mod n
T
) = 10008. Now
when encrypting for G, computations done mod 1000. So after G decrypts (and before he
checks the signature) hell get 8. Then he doesnt know if that should be 8, 1008, 2008, . . . ,
99008. Solution. Recall message is from T to G. If n
T
> n
G
then encrypt rst then sign.
So T computes [hash(M)
e
G
(mod n
G
)]
d
T
(mod n
T
) = Y and sends to G. Now G computes
[Y
e
T
(mod n
T
)]
d
G
(mod n
G
).
When sending: Always small n then big n.
Signatures with RSA. Remember: When sending, small n then big n.
Lets say that n
G
= 221, e
G
= 187, d
G
= 115 and n
T
= 209, e
T
= 191, d
T
= 131.
T wants to sign and encrypt the hash 97 for G. What does he do? In sending, you work
with the small n then the big n.
First sign: 97
d
T
(mod n
T
) = 97
131
(mod 209) = 108
Then encrypt: 108
e
G
(mod n
G
) = 108
187
(mod 221) = 56
T sends 56 to G; the enemy sees 56.
G receives 56. The receiver works with the big n and then the small n (since hes undoing).
56
d
G
(mod n
G
) = 56
115
(mod 221) = 108
108
e
T
(mod n
T
) = 108
191
(mod 209) = 97.
Now G wants to sign and encrypt the hash 101 for T. In sending, work with small n then
big n.
First encrypt: 101
e
T
(mod n
T
) = 101
191
(mod 209) = 112
Then sign: 112
d
G
(mod n
G
) = 112
115
(mod 221) = 31
G sends 31 to T, the enemy sees 31.
49
T receives 31. The receiver works with the big n and then the small n.
31
e
G
(mod n
G
) = 31
187
(mod 221) = 112
112
d
T
(mod n
T
) = 112
131
(mod 209) = 101.
Case 4. Easier (and used frequently on web). Tony encrypts the signed hash using AES
instead of RSA.
14.2 ElGamal Signature System and Digital Signature Standard
ElGamal signature scheme (basis for slightly more complicated Digital Signature Standard,
DSS). You have a large prime p and g, a generator of F

p
. There are secret keys a
A
, a
B
, . . .
and public keys g
a
A
, g
a
B
, . . .. These should not change frequently.
Lets say Alice wants to sign the hash of a message and send that to Bob. Let S be the
encoding of the hash as a number with 1 < S < p. Alice picks a random session k with
1 < k < p and gcd(k, p 1) = 1 and reduces g
k
= r F
p
.
Then she solves S a
A
r + kx(mod p 1) for x. So x k
1
(S a
A
r)(mod p 1). Note
that g
S
g
a
A
r+kx
g
a
A
r
g
kx
(g
a
A
)
r
(g
k
)
x
(g
a
A
)
r
r
x
(mod p).
Alice sends r, x, S to Bob as a signature. Bob conrms its from Alice by reducing
(g
a
A
)
r
r
x
(mod p) and g
S
(mod p) and conrms they are the same. Now Bob knows it is from
Alice. Why? Only Alice could have solved x k
1
(S a
A
r)(mod p 1) since only she
knows a
A
. It seems the only way someone can impersonate Alice and create sucha triple is
if s/he can solve the FFDLP and nd a
A
.
Example. p = 677, g = 2. Lets say the hash of a message is 316 = S. Alices private
key is a
A
= 307, her public key is 2
307
(mod 677) = 498. So g
a
A
= 498. She picks the session
k = 401 (OK since gcd(k, p 1) = 1).
Alice computes r = g
k
= 2
401
616(mod p) so r = 616. She solves S = a
A
r +
kx(mod p 1) or 316 = 307 616 + 401 x(mod 676). So x 401
1
(316 307 616).
Now 401
1
617(mod 676). So x 617(316 307 616) 512(mod 676). Alice sends
(r, x, S) = (616, 512, 316).
Bob receives and computes g
S
= 2
316
424(mod 677). (g
a
A
)
r
= 498
616
625(mod 677).
r
x
= 616
512
96(mod 677). Conrms g
a
A
r
g
kx
625 96 424 is the same as g
S

424(mod 677). End example.

To get DSS, basically replace p 1 by a prime [p 1 where > 10
50
but signicantly
smaller than p. You choose g with g

= 1, g ,= 1. This speeds up the algorithm. For further

details, see Section 30.1
14.3 Schnorr Authentication and Signature Scheme
Let p be a prime and be a prime such that [p 1. Pick a such that a

1(mod p). The

numbers a, p, are used by everyone in the system. Each person has a private key s and a
public key v a
s
(mod p).
Authentication: Peg (the prover) picks a random r < and computes x a
r
(mod p). She
sends x to Vic (the verier). Vic sends Peg a random number e with 0 e 2
t
1 (t
will be explained later). Peg computes y r + s
P
e(mod ) and sends y to Vic. Vic reduces
50
a
y
v
e
P
(mod p) and veries that it equals x. This authenticates that the person who sent y is
the person with public key v
P
.
Schnorr suggests now using p 2
512
, 2
140
and t = 72.
Signature: Alice wants to sign a message M. She picks a random r

< and computes

x

a
r

(mod p). Alice concatenates M and x

and hashes the concatenation to get e

. Alice
computes y

+ s
A
e

(mod ). The signature is the triple x

, e

, y

. Bob has M (either

it was encrypted for him or sent in the clear). Bob computes a
y

v
e

A
(mod p) and veries it
equals x

. Then he veries that e

is the hash of the concatenation of M and x

.
Computing y r + s
P
e(mod ) is fast as it involves no modular inversions. Alice can
compute x at any earlier time which speeds up signature time. The security seems based on
the diculty of the FFDLP. The signatures are shorter than with RSA for the same security
(since signatures work mod while the FFDLP most be solved in the larger F
p
).
14.4 Pairing based cryptography for digital signatures
Pairing based cryptography is used for short digital signatures (short refers to the length of
the key), one round three-way key exchange and identity-based encryption. We will just do
signatures.
Let p be a large prime. Let G be a nite dimensional F
p
-vector space. So G

= Z/pZ
Z/pZ Z/pZ. Let H be a cyclic group of order p (a one-dimensional F
p
-vector space).
We will treat G as a group under addition and H as a group under multiplication. Assume
the DLP is hard in both groups. A pairing is a map from G G H. Note, if g
1
, g
2
G
then we denote their pairing by g
1
, g
2
) H. Assume there is a pairing GGH with the
following four properties.
i) For all g
1
, g
2
, g
3
G we have g
1
+ g
2
, g
3
) = g
1
, g
3
)g
2
, g
3
).
ii) For all g
1
, g
2
, g
3
G we have g
1
, g
2
+ g
3
) = g
1
, g
2
)g
1
, g
3
).
iii) Fix g. If g, g
1
) = id H for all g
1
G, then g is the identity element of G.
iv) The pairing is easy to evaluate.
(Note, i) - iii) says that m is a non-degenerate bilinear pairing.)
Let g G be published and used by everyone.
Alice chooses secret x and publishes j = g
x
in a directory:
.
.
.
Akuzike, i
Alice, j
Arthur, k
.
.
.
Or, Alice just comes up with a new secret random x for this session and sends j = g
x
to
Bob.
Alice wants to digitally sign a message m G for Bob.
Alice signs message m G by computing s = m
x
G.
51
Alice sends Bob m and s.
Bob conrms its from Alice by verifying g, s) = j, m).
Proof: g, s) = g, m
x
) = g, m)
x
= g
x
, m) = j, m). End proof.
Bob knows must be from Alice. Only Alice (who knows x) could have found s such that
g, s) = j, m).
Implementation. We need to nd groups G, H and a pairing with the four properties.
Let F
q
be a nite eld and E be an elliptic curve whose coecients are in F
q
. Let
[E(F
q
)[ = pn where p is a large prime and n is small. Assume gcd(p, q) = 1. Fact: There
is a nite extension F
q
r of F
q
such that E(F
q
) has a subgroup isomorphic to Z/pZZ/pZ.
We will denote this subgroup by E[p]. Fact: Necessarily r > 1. Fact: The group F

q
r has a
(unique) subgroup of order p. Fact: If p ,[q 1 then r is the order of q in Z/pZ

. In other
words, r is the smallest positive integer such that p[q
r
1.
We want to create a pairing from E[p] E[p]F

q
r . Actually, the image of the pairing
will land in the subgroup of F

q
r of order p. Let R, T E[p]. Want R, T). Find function f
T
such that div(f
T
) = pT pO. That means that f
T
(x, y) describes a curve which intersects
E only at T and with multiplicity p. To evaluate R, T), we evaluate (f(U)/f(V ))
k
where
U V = R on the elliptic curve and U and V did not appear in the construction of f
T
. Also
k = (q
r
1)/p.
How to nd such an f
T
. If f(x, y) is a function of two variables then the curve f(x, y) = 0
meets E in certain points with certain multiplicities. The divisor of f(x, y) is the formal
sum of those points (not the sum on the elliptic curve) minus the same number of O-points.
Example: E is given by y
2
= x
3
+ 17. Let f(x, y) = y + 3x 1. Then f(x, y) = 0 is
y + 3x 1 = 0 or y = 3x + 1. To nd where line intersects E we solve the equations
simultaneously. y
2
= x
3
+ 17 and y
2
= (3x + 1)
2
, or x
3
+ 17 = 9x
2
6x + 1 or x
3

9x
2
+ 6x 16 = 0 or (x 8)(x 2)(x + 1) = 0. So the line meets the curve in three
points, with x = 1, 2, 8. To get the y-coordinates we use y = 3x + 1. So we get
div(y +3x 1) = (1, 4) +(2, 5) +(8, 23) 3(O). Lets nd div(x 2). Then x 2 = 0
is x = 2. Solve that simultaneously with y
2
= x
3
+ 17 and get y
2
= 25 or y = 5. So
div(x 2) = (2, 5) + (2, 5) 2(O).
Fact: If you add (on the elliptic curve) the points in a divisor, you will get O. We will
write for addition on the elliptic curve and for subtraction on the elliptic curve.
Note: If div(fg) =div(f)+div(g) and div(1/f) = div(f). So div(f/g) =div(f)div(g).
So div(y + 3x 1)/(x 2) = (1, 4) + (8, 23) (2, 5) (O). And (1, 4) (8, 23)
(2, 5) O = O. End example.
Algorithm to nd f
T
:
Let p = a
n
2
n
+a
n1
2
n1
+. . . +a
1
2 +a
0
where a
i
0, 1 (note a
n
= a
0
= 1). Let f
T
:= 1.
Let R := T.
For i = n 1, . . . , 0 do
i) Let f
T
:= f
2
T
.
ii) Let l
i
= 0 be the tangent line at R. Note, we have div(l
i
) = 2(R) + (S
i
) 3(O).
52
iii) Let v
i
:= x x(S
i
).
iv) Let R := S
i
.
v) Let f
T
:= (l
i
/v
i
)f
T
.
vi) If a
i
= 1, let m
i
= 0 be the line through R and T. (Note that if R = T then m
i
= 0 is
the tangent line.) Note, we have div(m
i
) = (R) + (T) + (U
i
) 3(O). If a
i
= 0 let m
i
:= 1.
vii) If i > 0 and a
i
= 1, let w
i
:= x x(U
i
). If a
i
= 0 let w
i
:= 1. If i = 0 let w
0
:= 1.
viii) If a
i
= 1, let R := U
i
. If a
i
= 0, then R remains unchanged.
ix) Let f
T
:= (m
i
/w
i
)f
T
.
End do.
Output f
T
. Note, div(f
T
) = p(T) p(O).
End algorithm.
Example. Let E : y
2
= x
3
+ 3x + 2 over F
11
. We have [E(F
11
) = 13. Let T = (2, 4).
Note T has order 13. So 13T = 0. We have 13 = (1101)
2
. Let f
T
= 1, R = T.
53
i = 2
f
T
= 1
2
= 1
l
2
= y 6x + 8 div(y 6x + 8) = 2(2, 4) + (10, 8) 3O = 2(T) + (2T) 3(O)
(Note y = 6x 8 is the tangent line at (2, 4).)
v
2
= x 10 div(x 10) = (10, 8) + (10, 3) 2O = (2T) + (2T) 2(O)
R = (10, 3) = (2T)
f
T
= (
l
2
v
2
)1 div(f) = 2(2, 4) (10, 3) (O) = 2(T) (2T) (O)
a
2
= 1
m
2
= y + 7x + 4 div(y + 7x + 4) = (10, 3) + (2, 4) + (4, 1) 3(O)
= (2T) + (T) + (3T) 3(O)
w
2
= x 4 divx 4 = (4, 1) + (4, 10) 2(O) = (3T) + (3T) 2(O)
R = (4, 10) = (3T)
f
T
= (
l
2
m
2
v
2
w
2
) div(f
T
) = 3(2, 4) (4, 10) 2(O) = 3(T) (3T) 2(O)
i = 1
f
T
= (
l
2
2
m
2
2
v
2
2
w
2
2
) div(f
T
) = 6(2, 4) 2(4, 10) 4(O) = = 6(T) 2(3T) 4(O)
l
1
= y + 9x + 9 divl
2
= 2(4, 10) + (7, 5) 3(O) = 2(3T) + (6T) 3(O)
v
1
= x 7 divv
2
= (7, 5) + (7, 6) 2(O) = (6T) + (6T) 2(O)
R = (7, 6) = (6T)
f
T
= (
l
2
2
m
2
2
l
1
v
2
2
w
2
2
v
1
) div(f
T
) = 6(2, 4) (7, 6) 5(O) = 6(T) (6T) 5(O)
a
1
= 0
m
1
= 1
w
1
= 1
R = (7, 6) = (6T)
f
T
= (
l
2
2
m
2
2
l
1
m
1
v
2
2
w
2
2
v
1
w
1
) div(f
T
) = 6(2, 4) (7, 6) 5(O) = 6(T) (6T) 5(O)
i = 0
f
T
= (
l
4
2
m
4
2
l
2
1
m
2
1
v
4
2
w
4
2
v
2
1
w
2
1
) div(f
T
) = 12(2, 4) 2(7, 6) 10(O) = 12(T) 2(6T) 10(O)
l
0
= y + 4x + 10 div(l
0
) = 2(7, 6) + (2, 4) 3(O) = 2(6T) + (12T) 3(O)
v
0
= x 2 div(v
0
) = (2, 4) + (2, 7) 2(O) = (12T) + (12T) 2(O)
R = (2, 7) = (12T)
f
T
= (
l
4
2
m
4
2
l
2
1
m
2
1
l
0
v
4
2
w
4
2
v
2
1
w
2
1
v
0
) div(f
T
) = 12(2, 4) (2, 7) 11(O) = 12(T) (12T) 11(O)
m
0
= x 2 div(x 2) = (2, 7) + (2, 4) 2(O) = (12T) + (T) 2(O)
w
0
= 1
f
T
= (
l
4
2
m
4
2
l
2
1
m
2
1
l
0
m
0
v
4
2
w
4
2
v
2
1
w
2
1
v
0
w
0
) div(f
T
) = 13(2, 7) 13(O) = 13(T) 13(O)
So f
T
= (
l
4
2
m
4
2
l
2
1
m
2
1
l
0
m
0
v
4
2
w
4
2
v
2
1
w
2
1
v
0
w
0
)
Example: E : y
2
= x
3
+ x + 4 over F
7
. Now [E(F
7
)[ = 10. Let p = 5. The smallest
positive power of 7 that is 1(mod 5) is 4. Let K = F
7
4 = F
7
[t]/(t
4
+ t + 1). The points
R = (6t
3
+ t
2
+ 1, 3t
3
+ 5t
2
+ 6t + 1) and T = (4, 4) each have order 5. We want to nd
R, T). First we must nd f
T
, where div(f
T
) = 5(4, 4) 5O. We have f
T
= (l
2
1
l
0
)/(v
2
1
) where
l
1
= y 4, l
0
= y + 4x + 1, v
1
= x 6. We must nd U, V such that U V = R and U, V
were not involved in nding f
T
.
The points that occurred while nding f
T
were (4, 4), (4, 3), (6, 3), (6, 4), O. We can not
let U = R and V = O, but we can let U = 2R = (6t
3
+ 6t
2
+ 3t, 5t
3
+ 2t
2
+ 4t + 6) and
54
V = R. (Ed, nd U and V). We evaluate f
T
(U)/f
T
(V ).
f
T
(U) = (l
1
(U))
2
l
0
(U)/(v
1
(U))
2
.
Now l
1
(U) = (y 4)(U) = (5t
3
+ 2t
2
+ 4t + 6 4).
l
0
(U) = (y + 4x + 1)(U) = (5t
3
+ 2t
2
+ 4t + 6 + 4(6t
3
+ 6t
2
+ 3t) + 1).
v
1
(U) = (x 6)(U) = (6t
3
+ 6t
2
+ 3t 6).
f
T
(U) = 6t
3
+ 4t
2
+ 3t + 1.
l
1
(V ) = (3t
3
+ 5t
2
+ 6t + 1 4).
l
0
(V ) = (3t
3
+ 5t
2
+ 6t + 1 + 4(6t
3
+ t
2
+ 1) + 1).
v
1
(V ) = (6t
3
+ t
2
+ 1 6).
f
T
(V ) = t
3
+ 5t
2
+ t + 1
f
T
(U)/f
T
(V ) = 4t
3
+ 6t
2
Now k = (7
4
1)/5 = 480.
(f
T
(U)/f
T
(V ))
480
=5t
3
+ 2t
2
+ 6t.
Note that (5t
3
+ 2t
2
+ 6t)
5
= 1, so it is in the subgroup of order 5. End example.
On an elliptic curve, g
x
means xg where x is an integer and g is a point on the elliptic
curve.
Applications of Cryptography
15 Public Key Infrastructure
Public key infrastructure (PKI) enables a web of users to make sure of the identities of the
other users. This is authentication. If Alice wants to authenticate Bobs identity, then a PKI
will have software at Alices end, and at Bobs end, hardware. A PKI will use certication
chains or a web-of-trust and use certain protocols. Below we will explain certication chains
and web-of-trust.
15.1 Certcates
Ed uses his Bank of America (BA) ATM card in the Mzuzu branch of the National Bank
of Malawi (BM). BM connects to BA. BM creates a random DES key and encrypts it with
BAs RSA key and sends to BA. BM will encrypt the message remove 6000MK from Eds
account and send Bank of Malawi 6000MK to replace our cash with DES. How does BM
know that the RSA public key really belongs to BA and not some hacker in between?
Verisign in Mountain View is a certication authority (CA). Here is a simplied sketch
of how it works.
BA has created a public key and a document saying the RSA public key X belongs
to Bank of America. Then BA and their lawyers go to a reputable notary public with
identication documents. The notary notarizes the public key document, which is sent to
Verisign.
Verisign uses Verisigns public key to sign the following document:
Version: V3
Serial Number: Hex string
Issuer: Verisign
55
Valid from: April 7, 2009
Valid to: April 6, 2010
Subject: bankofamerica.com
Signature Algorithm: SHA (hash)/RSA
Encryption Algorithm: RSA
Public key: n
BA
, e
BA
(both as hex strings).
Certication path: Bank of America, Verisign.
Hash: Sha(everything above this in certicate).
Signature: Hash
d
Ver
(mod n
Ver
).
BM also uses Verisigns services. BoM trusts Verisign and Verisigns public keys. BM
veries the signature at the end of BAs certicate using Verisigns public keys. BA and
BM exchange certicates at the beginning of the transaction. (BA will also check Verisigns
signature on BMs certicate).
Theres actually a certication tree with Verisign at the top. At a bank, you may have a
sub-CA who uses his or her public key to sign certicates for each branch.
Lets say in the above example that Eds browsers certicate is signed by Santa Clara
Universitys sub-CA, and SCUs sub-CAs certicate is signed by Verisign. Eds account is in
Bank of Americas Santa Clara branch (BASC). Ed uses his browser to log into his branchs
website. Eds browser rst looks at BASCs certicate which is similar to above except it
says
Subject: bofasantaclara.com
Public key: n
BASC
, e
BASC
Certication path: Bank of America Santa Clara, Bank of America, Verisign.
Hash: (Bank of Americas signature (using d
BA
, n
BA
) on hash of everything above this).
Eds browser knows Verisigns public keys since Eds browser uses Verisign also. From
the certication path, Eds browser knows to look at BAs certicate. Eds browser uses SHA
to hash the top of BAs certicate and conrms it gets the hash listed on BAs certicate.
Then Eds browser takes signature on BAs certicate and raises it to d
Ver
(mod n
Ver
) and
conrms it equals hash. Now Eds browser trusts that n
BA
, e
BA
really is BAs public key.
Then Eds browser veries BAs signature on the hash of BASCs certicate as above. Now
Eds browser trusts that n
BASC
, e
BASC
really is BASCs public key. So when BASCs website
asks for Eds password, Eds browser will not give Ed a warning message.
In practice, there are dierent levels of certication. For a serious one, you really do
show ID. You can get a less serious certicate that basically says the e-mail address es-
[email protected] and the public key n
E
, e
E
are connected. This less serious one does not
certify that the e-mail address is provably connected to the person Ed Schaefer.
Not everyone uses Verisign. The Turkish government and a German bank each have their
own CAs. Each can certify the others certicate. This is called cross-certication.
Verisign can revoke a certicate at any time. Verisign keeps a list on-line of revoked
certicates. One reason Verisign would revoke a certicate is if a public key is compromised.
What is the most likely way for a public key to be compromised? From most to least
common: 1) Theft, 2) bribery, 3) hacking, 4) cryptanalysis (no known cases).
When a URL says https: it has a certicate. To see certicate in Mozilla, left click on
box to left of URL. To see certicate in Internet explorer, right click on web page and left
56
click on properties. Internet explorer concatenates n, e and e is last 6 hex symbols. Note e
is often 17 or 3.
15.2 PGP and Web-of-Trust
PGP started as a free secure e-mail program. Now it implements most kinds of cryptography.
It was rst distributed by Zimmerman in 1991. It uses public key cryptography, symmetric
key cryptography, signatures and hash functions. Most interesting part is that instead of
using certication chains it uses a web of trust. A web of trust is good for private users but
not businesses. It allows authentication without certication authorities.
The users themselves decide whom to trust. Each user keeps a list of signed public keys.
Let S
X
(K
Y
) be Xs signature on Y s public keys. (In reality, there will be an entire certicate
containing S
X
(K
Y
)). Each user has a public key ring. For example, Alices public key ring
contains keys of people with whom Alice wants to communicate (and whom Alice trusts),
signed by Alice. It also contains Alices key, signed by others. Each such signed key has
certain trust levels assigned to it. Below might be A=Alices public key ring.
As public key ring
Signed A trusts legitimacy A trusts key owner A trusts signer to
name key of key to certify other keys certify other keys
Bob S
A
(K
B
) High High
Cath S
A
(K
C
) High High
Dee S
A
(K
D
) High Medium
Ed S
A
(K
E
) High Low
Cath S
C
(K
Q
) High
C J L
HH
M

B
H
A
M
D
L
F E G

I H
In the diagram, X Y means that S
X
(K
Y
) is in both Xs and Ys PKRs. Also X
H
Y
means S
X
(K
Y
) is in both PKRs and X trusts Y highly to certify others public keys.
Say Alice wants to e-mail F. A contacts F and F sends his PKR to A. Fs PKR includes
S
B
(K
F
). Since A highly trusts B to certify others PKs, A now trusts Fs PK.
Alice wants to e-mail G. Gs PKR includes S
D
(K
G
). But Alice only has medium trust of
D to certify others PKs. So A does not trust Gs PK. Similarly, A would not trust Hs PK.
Alice wants to e-mail L. Ls PKR includes S
D
(K
L
) and S
J
(K
L
). Alice medium trusts
both D and J to certify others PKs and two mediums is good enough so Alice trusts Ls
PK.
Alice wants to e-mail I. Is PKR includes S
F
(K
I
). Now A trusts Fs PK but has no
reason to trust F to certify Is so A does not trusts Is PK.
57
When Alice e-mails F, PGP will allow it. When Alice e-mails I, PGP will put a message
on Alices screen that she has no reason to trust Is public key.
Say C wants to e-mail B. B sends C his PKR which includes S
A
(K
B
). Now C trusts A
to certify others PKs. So C trusts Bs PK. So in this sense, Alice (and so every other user)
is like a kind of CA.
Instead of e-mailing key rings, there can be a server that nds the connections and sends
information on public key rings.
One problem with a web of trust is key revocation. It is impossible to guarantee that
no one will use a compromised key (since key distribution is ad hoc). However, MIT does
keep a list of compromised and revoked keys. PGP supports RSA and Die Hellman key
agreement, DSS(DSA) and RSA for signing, SHA1 and MD5 for hashing, and AES and other
block ciphers for encryption..
16 Internet security
The two main protocols for providing security on the internet (encryption and authentica-
tion) are Transport Layer Security and IPSec.
16.1 Transport Layer Security
So how does cryptography actually happen on-line? The process is called the Secure Sockets
Layer (SSL), invented by Taher ElGamal. Now being replaced by Transport Layer Security
(TLS). When you see https:, the s tells use that one of these is being used. The following
is a simplication of how it goes. I will use SHA1(key
MAC
,message). To indicate using
key
MAC
as the IV to hash the message with SHA1, which is a hash algorithm. I will use
AESENC(key
AES
,message) to denote encrypting a message with AES and the key: key
AES
.
Bob Amazon
< Bobs cert or PKs=
< Amazs cert =
check As cert
check Bs cert
create key
AES
create key
MAC
< M
1
:= (key
AES
key
MAC
)
e
B
(mod n
B
) =
M
d
B
1
(mod n
B
) (= key
AES
key
MAC
)
< M
2
:= AESENC(key
AES
, message) =
M
3
:= SHA1(key
MAC
, message)
M
4
:= M
d
B
3
(mod n
B
)
< M5 := AESENC(Key
AES
, M
4
) =
AESDEC(key
AES
, M
2
) (= message)
M
6
:= SHA1(key
MAC
, message)
AESDEC(key
AES
, M
5
)(= M
4
)
M
e
B
4
(mod n
B
)(= M
3
)
Check M
3
= M
6
58
Notes.
1. There are MANY ways this can be done.
2. Most private e-mail addresses and browsers do not have certicates, though one can get
a certicate for them.
3. MSG would be the whole transaction (I want to but the book Cryptonomicon and here
is my credit card number)
4. Instead of AES sometimes DES, 3-DES, RC4, Camellia used. Instead of RSA, sometimes
Die Hellman also used. Instead of Sha-1, sometimes MD5 used.
Now lets replace Bob by Bank of America and Amazon by Bank of Malawi.
5. When BM checks that the two hashes are the same, it knows two things. i) The message
was not tampered with (integrity). ii) BA must have sent it since only it could raise to d
BA
.
So the signature is veried. From BAs certicate, BM is certain of connection between BA
and BAs public keys.
6. Lets say BA decides later to deny that he sent the message. This is called repudiation.
BM can go to court and argue that BA did agree because only BA could have signed it.
7. Actually, BA could deny it by publishing its private key. Then it could say anyone could
have faked the signature. On the other hand, if BM can prove that BAs private key got out
after the order, then BA cant repudiate the order.
16.2 IPSec
Internet Protocol Security (IPSec) is a competitor of TLS. It works at a dierent level than
TLS which gives it more exibility. I do not understand dierent levels on a computer - it is a
concept from computer engineering. IPSec is, however, less ecient than TLS. Its primary
use is in Virtual Private Networks (VPN). A VPN is a private communications network.
That means it is used within one company or among a small network of companies. TLS is
used by everyone on the internet.
17 Timestamping
If you have a printed document and want to prove that it existed on a certain date, you can
get it notarized. This is important for copyrighting a document to prove you originated it.
This is more dicult with digital data. If there is a date on it, then the date can be easily
replaced by another. The solution is a timestamping service.
Here is a second scenario. If Alice signs a message, and later decides that she does not
want that message to be signed (this is a kind of cheating) then she can anonymously publish
her private key and say that anyone could have done the signing. This is called repudiation.
So if someone receives a signature from Alice, he or she can demand that Alice use a digital
timestamping service. That lessens Alices ability to repudiate the signature.
We will give three protocols for timestamping.
Lets say that Trent is a timestamper. Let / be Alices name. Lets say that Alices is
the nth request for a trusted timestamp that Trent has ever received.
Timestamping protocol 1. Alice wants to get a TTS = trusted timestamp on her docu-
ment. She computes H, the hash and sends it to Trent. Trent creates a timestamp t = time
59
and date when he received H. Trent computes TTS = [(/, H, t, Trents address)
d
T
(mod n
T
),
Trents public key]. Technically t is a timestamp. Alice keeps the TTS. Trent stores nothing.
Digistamp does this. Each costs $0.40, theyve done over a million, none has been called
into question.
Problem: Alice could bribe Digistamp to sign with a false t.
Protocol 2. Alice sends H to Trent. Trent creates t and serial # n (serial # s increment
by 1 each time). Trent computes TTS = (hash(/, H, t, n))
d
T
(mod n
T
) and sends it to Alice.
Every week, Trent publishes last serial number used each day (which Trent signs). Every
week, Trent zips collection of weeks TTSs and signs that and publishes that. Publications
are at web site.
PGP does this and also publishes at alt.security.pgp user group.
Solves the bribing problem.
Problem: Depends on popularity of Trent for trust (must trust that theyre not messing
with old posts on web site or user group). Hard to have small competitors. Lots of storage.
Protocol 3 (Stuart Haber and W. Scott Stornetta). Alice sends H
n
, the hash of her
document, to Trent. Let I
k
denote the identity of the person getting the kth timestamp.
Note I
n
= /. Trent computes
TTS
n
= (n, t
n
, I
n
, H
n
, L
n
)
d
T
(mod n
T
) where L
n
= (t
n1
, I
n1
, H
n1
, H(L
n1
)). Note L
n
connects connects the nth with the n 1st.
Later Trent sends Alice I
n+1
. In homework youll describe storage.
Can Alice or Alice and Trent together change t
n
later? David, the doubter, can ask Alice
for the name of I
n+1
. David contacts I
n+1
. Then David raises (TTS
n+1
)
e
T
(mod n
T
). Note,
the fth entry is L
n+1
= t
n
, . . .. So David sees Alices timestamp t
n
in I
n+1
s TTS
n+1
. David
can also contact I
n1
if he wants to. David can make sure t
n1
< t
n
< t
n+1
. This prevents
Alice and Trent from colluding to change t
n
.
Solves bribing problem. Solves storage problem. Solves problem that trust requires
popularity of Trent.
Problem: To check, need to contact people before and after Alice.
The author is not aware of a company implementing Protocol 3.
Note in all protocols, Alice does not have to release the actual document, but only its
hash. This is good if she wants a trusted time stamp on an idea, without releasing the idea
at that moment.
18 KERBEROS
A protocol is a sequence of steps involving at least two parties that accomplishes a task.
KERBEROS is a third-party authentication protocol for insecure, closed systems. Between
systems people use re walls. Note most problems come from people within a system.
KERBEROS is used to prove someones identity (authentication) in a secure manner without
using public key cryptography. At SCU, KERBEROS is probably used for access to e-
campus, OSCAR, Peoplesoft, Novell, etc. It was developed by MIT and can be obtained
free. KERBEROS requires a trusted third party.
It enables a person to use a password to gain access to some service. Let C be the client,
KDC be the key distribution center, S be the service that C wants access to and TGS be Ss
60
ticket granting service.
Summary:
i) KDC authenticates Cs identity to TGS.
ii) TGS gives permission to C to use S.
Initial set-up: If D is a participant (i.e. C, KDC, S, or TGS), then K
D
is his/her/its
key/password and d is the message that is that persons/machines name. Let K
D,E
denote
a key for D and E. Let msg K denote a message encrypted with the key K.
Only C and KDC have K
C,KDC
(a password usually). A system administrator gives
K
C,KDC
to KDC and gives it to C o-line. Only KE and TGS have K
KE,TGS
. Only TGS
and S have K
TGS,S
. (These last two keys are semi-permanent.)
1. C indicates to KDC her intention to use TGS by sending KDC: c, tgs. Indicating this
may simply be by logging into the particular services page.
2. KDC creates a session key K
C,TGS
and sends C: K
C,TGS
K
C,KDC
, tgs, c, a, v, K
C,TGS
K
KDC,TGS
where a is the clients network address (this is the address of the machine C works on - it
may be shared by several users, like on a Unix server). v is the validity period for the ticket.
Note c, a, v, K
C,TGS
is called a ticket-granting ticket (TGT).
3. C sends TGS: tgs, c, a, v, K
C,TGS
K
KDC,TGS
, c, tK
C,TGS
.
Notes: t is a simple timestamp (like Thu Apr 24 11:23:04 PST 2008) and c, t is called an
authenticator.
4. TGS creates a session key K
C,S
and sends C: K
C,S
K
C,TGS
, c, a, v, K
C,S
K
TGS,S
5. C sends S: c, a, v, K
C,S
K
TGS,S
, c, a, tK
C,S
The ticket-granting ticket authenticates the identity of C to Ss ticket granting service. Then
the ticket granting service gives permission to C to use S.
TGS
3 4
KERB
1

2
Client
5
Service
One password K
C,KDC
is used for lots of TGSs. The t in part 5 prevents C from using
c, a, tK
C,S
later. C doesnt know K
TGS,S
so S trusts the messsage encrypted with it.
19 Key Management and Salting
A common hacker attack is exploiting sloppy key management. Often bribe or steal to get
a key.
Scenario 1. Web: You pick your own password, usually. Uses SSL/TLS so use RSA
to agree on AES key which is used to encrypt password (rst time and later visits). They
store passwords in (hopefully hidden) le with userids. Your password is not hashed. End
Scenario 1.
Scenario 2. Non-web systems. The system has a le (may or may not be public) with
pairs: userid, hash(password). The system administrator has access to this le. Maybe
61
some day Craig, the password cracker, can get access to this le. He can not use the hashed
passwords to get access to your account because access requires entering a password and
then having it hashed. End Scenario 2.
In Scenario 2, from the hashes, Craig may be able to determine the original password.
Most peoples passwords are not random. For example, when I was immature, I used to break
into computer systems by guessing that my fathers friends passwords were the names of their
eldest daughters. As another example, it would take about 11 seconds on a single computer
using brute force to determine someones key if you knew it consisted of 7 lowercase letters
(that is 7 bytes). But if it consisted of 7 bytes from a pseudo-random number generator,
then it would take 11 thousand years to brute force it. (This is basically like brute-forcing
DES since DES has a 7 byte key and running a hash is like running DES. In fact, DES
used to be used as a hash were the key was the 0 string and the password was used as the
plaintext.) But most people have trouble remembering a password like 8 &u!M and so
dont want to use it. They could write it down and put it in their wallet/purse, but that
can get stolen. So instead, most passwords are easy to remember.
So Craig can do a dictionary attack. Craig can hash all entries of a dictionary. On-line
you can nd dictionaries containing all common English words, common proper names and
then all of the above entries with is and ls replaced by 1s and os replaced by 0s, etc. Craig
can even brute force all alpha-numeric strings up to a certain length. Then Craig looks in
the password le and nds many matches. This has been used to get tens of thousands of
dierent passwords. The Password Recovery Toolkit can test 200000 passwords per second.
In 1998, there was an incident where 186000 account names collected and hashed pass-
words collected. Discovered 1/4 of them using dictionary attack.
Salt is a string that is concatenated to a password. It should be dierent for each userid.
It is public for non-SSL/TLS applications like KERBEROS and UNIX. It might seem like
the salt should be hidden. But then the user would need to know the salt and keep it secret.
But then the salt may as well just be appended to the password. If the salt were stored on
the users machine instead (so its secret and the user would not need to memorize it) then
the user could not log in from a dierent machine.
For KERBEROS and UNIX, the system administrator usually gives you your password
o-line in a secure way. The system creates your salt.
Scenario 3. (Old UNIX) This is the same as Scenario 2, but the public password le has
triples: username, userid, expiration of password, location information, salt, hash(salt,password).
The salt is a random string in plaintext, unique for this userid. Now the dictionary attack
wont get lots of passwords. But you can attack a single user as in Scenario 2.
Scenario 4. UNIX. For reasons of backward-compatibility, new Unix-like operating sys-
tems need a non-encrypted password le. It has to be similar to the old password le or
certain utilities dont work. For example, several utilities need the username to userid map
available and look in password le for it. In the password le, where there was once the
salt and the hash of a salted password, there is now a *. Unix has a second hidden le
called the shadow password le. It is encrypted using a password only known to the system
administrator. The shadow le contains userid, salt, hash(salt,password).
The user doesnt need to look up the salt. If the user connects to UNIX with SSH, then
the password goes, unhashed, through SSHs encryption. The server decrypts the password,
appends the salt, hashes and checks against hash(salt,password) in shadow le.
62
Scenario 5. KERBEROS uses a non-secret salt which is related to the userid and domain
names. If two people have the same password, they wont have the same hash and if one
person has two accounts with the same password, they wont have the same hash. The
authentication server (for KERBEROS this is called the key distribution center) keeps the
hash secret, protected by a password known only to the authentication server.
End scenarios.
A single key or password should not be used forever. The longer it is used, the more
documents there are encrypted with it and so the more damage is done if it is compromised.
The longer it is used, the more tempting it is to break it and the more time an attacker has
to break it.
Good way to generate key, easy to remember, hard to crack. You the words of a song you
know. Decide how to capitalize and add punctuation. Then use the rst letters of each word
and the punctuation. So from the Black-eyed Peas song Ive got a feeling you could use the
lyrics Fill up my cup, mazel tov! Look at her dancing, to get the password Fumc,mt!Lahd,
20 Quantum Cryptography
There are two ways of agreeing on a symmetric key that do not involve co-presence. The
rst is public key cryptography, which is based on mathematics. The second is quantum
cryptography. It currently (2008) works up to 100 miles and is on the market but is not
widely used.
A photon has a polarization. A polarization is like a direction. The polarization can be
measured on any basis in two-space: rectilinear (horizontal and vertical), diagonal (slope 1
and slope -1), etc. If you measure a photon in the wrong basis then you get a random result
and you disturb all future measurements.
Here is how it works. Alice and Bob need to agree on a symmetric key. Alice sends Bob
a stream of photons. Each photon is randomly assigned a polarization in one of the four
directions: [, , , /. We will have [ = 1, = 0, = 1, / = 0. Lets say that Alice sends:
/ [ [ / [ [ /.
Bob has a polarization detector. For each photon, he randomly chooses a basis: rectilinear
or diagonal. Say his choices are + + + + + + + Each time he chooses
the right basis, he measures the polarization correctly. If he measures it wrong, then he will
get a random measurement. His detector might output [ / / [ / [ [.
Alice sends / [ [ / [ [ /
Bob sets + + + + + + +
Correct
Bob gets [ / [ / [ [
Notice that when Bob correctly sets the basis, Alice and Bob have the same polarization,
which can be turned into a 0 or 1. Looking at the second and last photons, we see an example
of the randomness of Bobs measurement if the basis is chosen incorrectly.
Now Bob contacts Alice, in the clear, and tells her the basis settings he made. Alice tells
him which were correct. The others are thrown out.
63
Alice sends [ / [ [
Bob gets [ / [ [
Those are turned into 0s and 1s
Alice sends 1 1 0 1 0 1 1
Bob gets 1 1 0 1 0 1 1
On average, if Alice sends Bob 2n bits, they will end up with n bits after throwing out
those from the wrong basis settings. So to agree on a 128 bit key, on average Alice must
send 256 bits.
What if Eve measures the photons along the way. We will focus on the photons for which
Bob correctly guessed the basis. For half of those, Eve will guess the wrong basis. Whenever
Eve measures in the wrong basis, she makes Bobs measurement random, instead of accurate.
Alice sends [ / [ [
Eve sets + + +
Bob sets + + + +
Bob gets / [ / [
Alice sends 1 1 0 1 0 1 1
Bob gets 1 0 0 1 0 0 1
Note for the second and fourth photon, since Eve set the basis incorrectly, Bob gets a
random (and half the time wrong) bit. So if Eve is eavesdropping then we expect her to get
the wrong basis sometimes and some of those times Bob will get the wrong polarization.
To detect eavesdropping, Alice and Bob agree to check on some of the bits, which are
randomly chosen by Alice. For example, in the above, they could both agree to tell, in the
clear, what the rst three bits are. Alice would say 110 and Bob would say 100 and they
would know that they had been tampered with. They would then have to start the whole
process again and try to prevent Eve from eavesdropping somehow. ((Ed, what if Eve gets
in between and just reects back the answer to each one? There are identity issues.))
If those check-bits agreed, then they would use the remaining four bits for their key. Of
course there is a possibility that Alice and Bob would get the same three bits even though
Eve was eavesdropping. So in real life, Alice and Bob would tell each other a lot more
bits to detect eavesdropping. The probability that a lot of bits would all agree, given that
Eve was eavesdropping, would then be very small. If they disagreed, then they would know
there was eavesdropping. If those all agreed, then with very high probability, there was no
eavesdropping. So they would throw the check-bits away and use as many bits as necessary
for the key.
Notice that Alice needs to be sure that it is actually Bob with whom she is communicating.
In 2007, they had gotten quantum cryptography working over 150 kilometers. Quantum
cryptography is considered safer than public key cryptography and has a built-in eavesdrop-
ping detection. However, it is dicult to transmit a lot of information this way, which is why
it would be used for agreeing on a symmetric key (like for AES). At the moment, there are
physics implementation issues that have been discovered so that the current implementation
of quantum cryptography is insecure.
64
21 Blind Signatures
Here you want a signer to sign a document but the signer not see the document. The
analogy: You put a document with a piece of carbon paper above it and place them both
in an envelope. You have the signer sign the outside of the envelope so that the document
gets signed. How to do with RSA. Say Alice wants Bob to sign a message M without Bob
knowing about M. Alice nds a random number r with gcd(r, n
B
) = 1. Then Alice computes
M

:= Mr
e
B
(mod n
B
) and sends it to Bob. Bob then computes M

:= (M

)
d
B
(mod n
B
) and
sends it to Alice. Note M

(M

)
d
B
(Mr
e
B
)
d
B
M
d
B
r
e
B
d
B
M
d
B
r(mod n
B
). Now
Alice computes M

:= M

r
1
(mod n
B
). Note M

r
1
M
d
B
rr
1
M
d
B
(mod n
B
).
So Alice now has Bobs signature on M. But Bob has not seen M and does not seem able
to compute it.
Attack on RSA blind signatures. Lets say that n
B
is used both for Bobs signing as well
as for people encrypting messages for Bob. Lets say that Carol encrypts the message Q for
Bob. She sends Bob, C := Q
e
B
(mod n
B
). Eve comes up with a random r and computes
Q

:= Cr
e
B
(mod n
B
) and sends it to Bob for signing. Bob computes Q

:= (Q

)
d
B
(mod n
B
)
and sends it to Eve. Note Q

(Q

)
d
B
C
d
B
(r
e
B
)
d
B
(Q
e
B
)
d
B
(r
e
B
)
d
B
Q
e
B
d
B
r
e
B
d
B

Qr(mod n
B
). So Eve computes Q

r
1
(mod n
B
). Note Q

r
1
Qrr
1
Q(mod n
B
). So
now Eve knows Carols plaintext message Q. So n
B
, e
B
, d
B
should only be used for signing,
not encrypting.
22 Digital Cash
If you use a credit card, ATM card or a check to make a purchase, a large institution knows
whom you bought something from and how much you spent. Sometimes you prefer privacy.
In addition, in such instances, you do not receive the goods until the transaction has been
veried through a bank or credit card company. Cash gives privacy and is immediately
accepted. However cash is not good for long distance transactions and you can be robbed
and sometimes run out. The solution is digital cash.
Lets say Alice wants to buy a $20 book from Carol with digital cash. Alice gets a signed,
digital $20 bill from the bank, gives it to Carol and then Carol can deposit it in the bank.
This system has some requirements. 1) Forgery is hard. So Eve should not be able to create
a signed digital bill without having the bank deduct that amount from her account. 2) Alice
should not be able to use the same signed, digital bill twice. So this should be prevented or
noticed. 3) When Carol deposits the bill, the bank should not know that it came from Alice.
4) Should be so trustworthy that Carol does not need to check with the bank to accept the
bill.
Here is a rst attempt at a solution. Well attack this.
Alice creates a message M=This is worth $20, date, time, S. Here S is a long random serial
number used to distinguish this bill from others. She creates a random r with gcd(r, n
B
) = 1.
Alice sends M

:= Mr
e
B
(mod n
B
) to the bank and tells them to deduct $20 from her account.
65
The bank signs blindly as above and sends Alice M

:= (M

)
d
B
(mod n
B
). Alice computes
M

:= M

r
1
M
d
B
(mod n
B
). Alice computes (M

)
e
B
(M
d
B
)
e
B
(mod n
B
) and conrms
it equals M. Alice sends M, M

to Carol. Carol computes (M

)
e
B
(mod n
B
) and conrms
it equals M. Carol reads This is worth $20 . . . . Carol sends M

to the Bank. The bank

computes (M

)
e
B
M(mod n
B
) and puts $20 in Carols account. Only then does Carol
give the book to Alice.
Problem 1. Alice could create the message M=This is worth $20 . . . and tell the bank
to deduct $5 from her account. Since the bank can not gure out M during the interaction
with Alice, the bank can not detect the cheating.
Solution 1. The bank has several dierent triples n
Bi
, e
Bi
, d
Bi
where i is an amount of money.
So perhaps the bank has public keys for $0.01, $0.02, $0.05, $0.10,$0.20, $0.50, $1, $2, $5,
$10, $20, $50, $100, $200, $500. The bank will sign with d
B$5
, n
B$5
. If Carol computes
(M

)
e
B$20
(mod n
B$20
) she will get a random string. Note, if the book costs $54, Alice can
get three bills signed: $50 + $2 + $2 and send them all to Carol.
Solution 2 (preferred as it will work well with eventual full solution). Alice blinds 100
dierent messages M
i
=This is worth $20, date, time, S
i
for i = 1, . . . , 100, each with a
dierent r
i
(S
i
is the serial number). The bank randomly picks one of them and signs it and
asks Alice to unblind the rest. (In homework, you will determine how to unblind.) The other
99 had better say This is worth $20 . . . , S
i
. You can increase the number 100 to make it
harder for Alice to cheat.
Problem 2. Alice can buy another book from David for $20 using the same M

= M
d
B
again. The bank will notice that the serial number has been used twice, but not know that
it was Alice who cheated. Putting a serial number in M that is tied to Alice will not help
because then Alice loses her anonymity.
Problem 3. Slow like a credit card. Carol should have the bank check the message se-
rial number against its database to make sure it hasnt been sent before. This is called
on-line digital cash because Carol has to get conrmation from the bank rst, on-line, that
they will put the $20 in her account.
Solutions to Problems 2 and 3. O-line digital cash. Uses random identity string (RIS) on
the bill.
The RIS 1) must be dierent for every payment 2) only Alice can create a valid RIS 3) if
the bank gets two identical bills with dierent extended RIS then Alice has cheated and the
bank should be able to identify her 4) if the bank received two identical bills with the same
extended RIS then Carol has cheated.
Let H be a hash function with one-way and weakly collision free properties.
Withdrawal:
1) For i = 1 to 100, Alice prepares bills of $20 which look like M
i
= I am worth $20,
date, time, S
i
, y
i,1
, y

i,1
, y
i,2
, y

i,2
, . . . , y
i,50
, y

i,50
where y
i,j
= H(x
i,j
), y

i,j
= H(x

i,j
) where
66
x
i,j
and x

i,j
are random bitstrings such that x
i,j
x

i,j
=Alice for each i and j. Note
y
i,1
, y

i,1
, y
i,2
, y

i,2
, . . . , y
i,50
, y

i,50
is the RIS.
2) Alice blinds all 100 messages to get M

i
and sends to the bank. Alice tells the bank to
deduct $20 from her account.
3) The bank randomly chooses one of the blinded messages (say 63) asks Alice to unblind
the other 99 of the M
i
s.
4) Alice unblinds the other 99 messages ands also sends all of the x
i,j
and x

i,j
for all 99
messages.
5) The bank checks that the other 99 are indeed $20 bills and for the other 99 that y
i,j
=
H(x
i,j
) and y

i,j
= H(x

i,j
) and x
i,j
x

i,j
= Alice.
6) The bank signs the 63rd blinded message M

63
and gets M

63
and sends it to Alice.
7) Alice multiplies M

63
by r
1
63
and gets M

63
.
Payment
1) Alice gives M
63
, M

63
to Carol.
2) Carol checks the signature on M

63
. I.e. Carol computes (M

63
)
e
B
(mod n
B
) and conrms it
equals M
63
.
3) Carol sends Alice a random bit string of length 50: b
1
, . . . , b
50
.
4) For j = 1, . . . , 50: If b
j
= 0, Alice sends Carol x
63,j
. If b
j
= 1, Alice sends Carol x

63,j
.
5) For j = 1, . . . , 50: Carol checks that y
63,j
= H(x
63,j
) if b
j
= 0 or y

63,j
= H(x

63,j
) if b
j
= 1.
If the above equalities hold, Carol accepts the bill.
6) Carol sends Alice the book.
Deposit
1) Carol sends the bank: M
63
, M

63
and the x
63,j
s and x

63,j
s that Alice sent to Carol. The
y
63,j
s and y

63,j
s and those x
63,j
s and x

63,j
s that are revealed form an extended RIS.
2) The bank veries the signature on M

63
.
3) The bank checks to see if the bill (indentied by S
63
) is already in their database. If it
is not, it puts $20 in Carols account and records M
63
, and the x
63,j
s and x

63,j
s that Carol
sent.
If the bill is in the database and the x
63,j
s and x

63,j
s are the same on both, then the bank
knows Carol is cheating by trying to deposit the same bill twice.
Lets say that Alice tries to send the same bill to Carol and later to Dave. Carol sends Al-
ice 11001. . . and Dave sends 11100. . . . Now those strings dier at the 3rd place. So Alice will
67
send Carol x
63,3
and send David x

63,3
. Carol will send M
63
, M

63
, x

63,1
, x

63,2
, x
63,3
, x
63,4
, x

63,5
, . . .
to the bank. After Carol has sent hers in, the bank will record M
63
, M

63
, x

63,1
, x

63,2
, x
63,3
, x
63,4
, x

63,5
, . . .
under S
63
. Later Dave will send M
63
, M

63
, x

63,1
, x

63,2
, x

63,3
, x
63,4
, x
63,5
, . . . to the bank. How-
ever, the bank will see S
63
in the database from when Carol sent the bill in. They will note
x

63,3
,= x
63,3
and compute x

63,3
x
63,3
=Alice and know Alice used the same bill twice. Note
for this scenario, Alice could try sending the same bill to Carol at a later time. But Carol
would use a dierent bit-string each time so the bank would still notice.
Used in Singapore, Hong Kong, the Netherlands and Dubain for transit, parking and
shops. How is it dierent than a gift card or an SCU access card with money on it? Digital
cash can be used on-line.
23 Secret Sharing
Let us assume that you have ve managers at Coca Cola in Atlanta who are to share the
secret recipe for Coca Cola. You do not want any one of them to have the secret, because
then he could go o and sell it to Pepsi. You could encode the secret as a bit-string S of
length l. Then you could come up with four random bit-strings of length l, R
1
, R
2
, R
3
, R
4
.
You could give the rst four managers R
1
, R
2
, R
3
, R
4
(one each) and to the fth you would
give R
1
R
2
R
3
R
4
S. Note that no one has the secret S, but if you XOR all ve
together, you get S. No four people can get S. But what if one of the managers dies and
his piece is lost. Maybe you want it so that any three together could get the secret.
Key escrowing is an example of this. There is a secret key that K. Someone comes up
with a random string R and then R is given to one trusted entity (like a major bank) and
K R is given to another trusted entity. If someone needs the secret key for some reason,
one can go through a legal process to get R and K R.
LaGrange interpolating polynomial scheme for secret sharing
This was invented by Shamir (the S of RSA). Let S be a secret encoded as a positive
integer. Let p be a prime with p > S. We give shares of the secret to the managers.
We want any three (say) of the managers to have access to the secret. So we create a
polynomial with three coecients f(x) = ax
2
+ bx + S. The numbers a and b are chosen
randomly from 0 to p1. You give the rst person the reduction of f(1)(mod p), the second
manager the reduction of f(2)(mod p), etc. Not only will this work for ve managers but
for n managers as long as n 3, assuming you want any three managers together to be
able to get the secret. Example. The secret is 401. You pick p = 587 (way too small) and
a = 322, b = 149. So f(x) = 322x
2
+ 149x + 401(mod 587). Then f(1) = 285, f(2) = 226,
f(3) = 224, f(4) = 279, f(5) = 391. The rst, fourth and fth managers collude to get the
secret. They know f(x) = ax
2
+ bx + S(mod 587) but do not know a, b, S. They do know
f(1) = a + b + S = 285, 16a + 4b + S = 279 and 25a + 5b + S = 391. They now solve
_

_
1 1 1
16 4 1
25 5 1
_

_
_

_
a
b
S
_

_ =
_

_
285
279
391
_

_ (mod 587)
to nd a, b, S. They are only interested in S. In PARI use m=[1,1,1;16,4,1;25,5,1]Mod(1,587),
v=[285;279;391], matsolve(m,v).
68
If you want any m managers to have access, create a polynomial of degree m1 with m
coecients.
24 Committing to a Secret
Committing to a secret (Torben Pedersen, 1998). Let p be a large prime and g generate
F

p
. Assume h also generates and that you do not know the solution to g
x
= h. Assume
0 s < p1 is a secret that you want to commit to now and that you will later expose. You
want to convince people that you have not changed s when you reveal your secret later. For
example, s might be a bid. Choose a random t with 0 t < p1 and compute E(s, t) = g
s
h
t
and publish E(s, t). That is your commitment to s. You can later open this commitment
by revealing s and t. The verier can check that indeed g
s
h
t
is the same as your published
E(s, t). Note 1) E(s, t) reveals no information about s. 2) You (as the committer) can not
nd s

, t

such that E(s, t) = E(s

, t

).
In real life, you choose p, with p > 2
512
, such that q[p 1 where q is prime and q > 2
200
.
large. You pick g and h such that g
q
= 1, h
q
= 1 and g ,= 1, h ,= 1. It adds some speed and
does not seem to aect security as explained in Section 30.1.
25 Digital Elections
We will describe the new Scantegrity II (Invisible Ink). Chaum, Carback, Clark, Essex,
Popoveniuc, Rivest, Ryan, Shen, Sherman. For simplicity, assume the voters are voting for
a single position with a slate of candidates.
Voter experience
The voter gets a ballot. It has two parts, separated by perforation. The same ID number
is on each part, unique to the ballot. The top part has a list of candidates on the left and
then bubbles to the right. Each bubble contains a conrmation code (CC) in invisible ink.
The voter is given a decoder pen to rub the bubble for her chosen candidate. The CC then
appears. She then has the option to copy the CC onto the bottom part, which is the receipt.
She tears o the receipt and keeps it. The poll worker (PW) stamps the top and helps her
enters the top into an optical scanner.
The voter has the option to instead ask for two ballots. She then picks one to be the
ocial ballot and one to be an audit ballot. The PW then audit-stamps the audit ballot.
The voter can expose (decode) all of the CCs on the audit ballot. The PW helps her enter
the audit ballot into the optical scanner which reads the data and notes it is an audit ballot.
She may leave with the audit ballot. The audit ballot does not count toward the auctual
votes. The ocial ballots are stored as a paper trail as one way of auditing the election
afterwards, if necessary.
After the election, the voter can check the election website which should include the
voters ID number and conrmation code.
As an example, assume 001 voted for Alice so CC is WT9, 002 for Carol J3K, 003 for
Alice CH7, 004 was audit WJL, KWK and H7T (from same person who has ID=003), 005
for Bob LTM.
69
Election preparation
Assume N is the number of candidates and B is the number of ballots to be created.
For m voters we need B = 2m ballots (because of audit ballots). The election ocials
(EO)s secret-share a seed and enough of them input their shares into a trusted work-station
(WS) to start a (pseudo-)random number generator which creates BN dierent, random
alpha-numeric conrmation codes (CC)s (like WT9).
The work-station creates Table P, which is never published.
Table P (not published)
ID Alice Bob Carol
001 WT9 7LH JNC
002 KMT TC3 J3K
003 CH7 3TW 9JH
004 WJL KWK H7T
005 M39 LTM HNN
When I say not published it also means the EOs dont see it either. Each row is used
to create a single ballot.
Then the WS creates Table Q. It is the same as table P except with the rows permuted.
The columns no longer correspond to single candidates. In our example, the votes correspond
to (ID, column): (001, 2), (002, 1), (003, 2), (005, 3) and the audits correspond to (004, 1),
(004, 2), (004, 3).
Table Q (not published)
001 7LH WT9 JNC
002 J3K TC3 KMT
003 9JH CH7 3TW
004 KWK H7T WJL
005 M39 HNN LTM
The work station creates random t
i,j
s and computes commitments to each CC in Table
Q and the EOs have the WS publish the commitments at the election website.
Table Q commitments (published)
001 g
7LH
h
t
1,1
g
WT9
h
t
1,2
g
JNC
h
t
1,3
002
003
.
.
.
.
.
.
.
.
.
004
005 g
M39
h
t
5,1
g
HNN
h
t
5,2
g
LTM
h
t
5,3
Here, for example, g
7LH
assumes you have encoded 7LH as an integer.
The WS creates Tables R and S.
Table R (not published)
70
Flag Q-ptr S-ptr
005, 1 2, 1
003, 3 4, 2
(X) 002, 1 4, 3
001, 3 3, 3
(X) 001, 2 4, 1
(X) 005, 3 3, 2
004, 2(A) 5, 3
003, 1 2, 3
004, 3(A) 3, 1
002, 3 1, 1
001, 1 2, 2
002, 2 5, 2
004, 1(A) 1, 2
(X) 003, 2 5, 1
005, 2 1, 3
Table S (published)
Alice Bob Carol
Table S begins blank and will record votes. Each row of Table R corresponds to a CC
from Q. Each row of R has three entries. Column 1 is rst empty. Once a vote has been
cast, it contains a ag 0 or 1 (for us, blank or X, which is now (X)s since they are not there
when the table is created). Column 2 contains a pointer to Table Q of the form (ID, col
of Q). They are entered in random order. The ag is raised if that CC was used in a vote.
So there will be ags next to from Q-pointers (001, 2), (002, 1), (003, 2), (005, 3). Column
3 of R contains all pairs (row of S, col of S). The S-pointers are not entirely random. For
example, S-pointers (1,2), (2,2), (3,2), (4,2), (5,2) must be in the same row as the Q-pointers
to CCs for Bob (namely 7LH, TC3, 3TW, KWK, LTM, which have Q-pointers (001,1),
(002,2), (003,3), (004,1), (005,2)). Given that, they are randomized.
The WS creates commitments to all the pointers and the EOs have the WS publish them
(in their same positions) in Table R-commitments at the election website.
Table R commitments (published)
71
Flag Q-ptr S-ptr
g
005,1
h
u
1,1
g
2,1
h
u
1,2
.
.
.
.
.
.
g
005,2
h
u
15,1
g
1,3
h
u
15,2
In our example, Table S will get lled out by the WS and look like.
Table S
Alice Bob Carol
1
1 1
1
For example, 001 voted for Alice, which is CC = WT9. In Table Q that was (001,2). In
table R, (001,2) corresponds to S-pointer (4,1). So the WS lls in row 4 column 1 in Table
S. Note that the rows of S in which there are checks do not tell you who cast each vote. This
is because of the (constrained) randomness of the third row of Table R.
Tables P, Q and R remain hidden inside the main-frame.
EOs after the election
The EOs have the WS publish to the election website part of Table Q: The IDs, the CCs
corresponding to votes, the CCs corresponding to audits and the t
i,j
s for each published
CC.
Table Q, partly opened
001 WT9, t
1,2
002 J3K, t
2,1
003 CH7, t
3,2
004 KWK, t
4,1
H7T, t
4,2
WJL, t
4,3
005 LTM, t
5,3
The EOs have the WS ag the entries in Table R corresponding to votes. For each row
of R, a random, publicly veriable bit generator (called a coin-ip) decides if the EOs will
have the WS open the commitment to the Q-pointer or the S-pointer. One suggestion is
to use closing prices of major stock indices as a source. Note that if either the second or
72
third column of Table R is not in a random order, then an observer could make a connection
between an ID number and the candidate that person voted for. If the ballot was for auditing,
the EOs open the commitments for all the CCs in Table Q and the Q- and S-pointers in
Table R.
Table R, partly opened
Flag Q-ptr S-ptr
2, 1, u
1,2
003, 3, u
2,1
X 4, 3, u
3,2
3, 3, u
4,2
X 001, 2, u
5,1
X 005, 3, u
6,1
004, 2, u
7,1
A 5, 3, u
7,2
2, 3, u
8,2
004, 3, u
9,1
A 3, 1, u
9,2
002, 3, u
10,1
001, 1, u
11,1
002, 2, u
12,1
004, 1, u
13,1
A 1, 2, u
13,2
X 5, 1, u
14,2
005, 2, u
15,1
The EOs publish the sums of the columns with the names of the corresponding candi-
dates.
Table S
Alice Bob Carol
1
1 1
1
Sum 2 1 1
Voters after the election
Each voter may check her ID number and her votes CC are there in Table Q. Any
interested party can check i) the commitments for Table Q agree with the opened parts of
Table Q, ii) that each revealed Q-pointer in Table R either connects a ii-1) revealed code in
Table Q to a ag in Table R or ii-2) a hidden code in Table Q to an unagged element of
Table R and iii) each revealed S-pointer in Table R connects a iii-1) ag in R to a ag in S
or iii-2) an unagged element of R to an unagged element of S and iv) that the vote tallies
published agree with the sums in Table S and the number of votes agrees with the number
of ags in Table R.
Person 003 can check, for example, that on their audit ballot, WJL (vote for Alice) was
Q-pointer (004,3), which in the partially-opened Table R is next to S-pointer (3,1) and that
indeed column 1 contains votes for Alice.
73
If Cody the coercer tries to coerce Dan on how to vote, Dan can show Cody Dans CC.
Note that no information at the election website can connect Dans CC with the candidate
for whom Dan voted.
It is possible that poll workers could ll in a few ballots. But the poll workers have to
keep records of the names of the people in their districts who voted. So they will have to
add names to this record. If too many ballots are lled out by poll workers, then auditors
might get suspicious and determine that some of the people the poll workers claim voted,
did not vote.
Scantegrity II has been used in Takoma Park MD city election.
Cryptanalysis
26 Basic Concepts of Cryptanalysis
Cryptosystems come in 3 kinds:
1. Those that have been broken (most).
2. Those that have not yet been analyzed (because they are new and not yet widely used).
3. Those that have been analyzed but not broken. (RSA, Discrete log cryptosystems, AES).
3 most common ways to turn ciphertext into plaintext:
1. Steal/purchase/bribe to get key
2. Exploit sloppy implementation/protocol problems (hacking/cracking). Examples: some-
one used spouses name as key, someone sent key along with message
3. Cryptanalysis
There are three kinds of cryptanalysis.
Ciphertext only attack. The enemy has intercepted ciphertext but has no matching plain-
text. You typically assume that the enemy has access to the ciphertext. Two situations:
a) The enemy is aware of the nature of the cryptosystem, but does not have the key. True
with most cryptosystems used in U.S. businesses.
b) The enemy is not aware of the nature of the cryptosystem. The proper users should never
assume that this situation will last very long. The Skipjack algorithm on the Clipper Chip
is classied, for example. Often the nature of a military cryptosystem is kept secret as long
as possible. RSA has tried to keep the nature of a few of its cryptosystems secret, but they
were published on Cypherpunks.
Known plaintext attack. The enemy has some matched ciphertext/plaintext pairs. The
enemy may well have more ciphertext also.
Chosen plaintext attack. Here we assume that the enemy can choose the plaintext that he
wants put through the cryptosystem. Though this is, in general, unrealistic, such attacks
are of theoretic interest because if enough plaintext is known, then chosen plaintext attack
techniques may be useable. However this is an issue with with smart cards.
As in the rst cryptography course, we will not spend much time on classical cryptanalysis,
but will instead spend most of our time looking at current cryptanalytic methods.
74
27 Historical Cryptanalysis
Designers of cryptosystems have frequently made faulty assumptions about the diculty of
breaking a cryptosystem. They design a cryptosystem and decide the enemy would have to
be able to do x in order to break this cryptosystem. Often there is another way to break the
cryptosystem. Here is an example. This is a simple substitution cipher where one replaces
every letter of the alphabet by some other letter of the alphabet. For example A F, B
S, C A, D L . . . . We will call this a monalphabetic substitution cipher. There are
about 1.4 10
26
permutations of 26 letters that do not x a letter. The designers of this
cryptosystem reasoned that there were so many permutations that this cryptosystem was
safe. What they did not count on was that there is much regularity within each language.
In classical cryptanalysis, much use was made of the regularity within a language. For
example, the letters, digraphs and trigraphs in English text are not distributed randomly.
Though their distributions vary some from text to text. Here are some sample percentages
(assuming spaces have been removed from the text): E - 12.3, T - 9.6, A - 8.1, O - 7.9, . . . ,
Z - 0.01. The most common digraphs are TH - 6.33, IN, 3.14, ER - 2.67, . . . , QX - 0. The
most common trigraphs are THE - 4.73, ING - 1.42, AND - 1.14, . . . . Note there are tables
where the most common digraphs are listed as TH, HE, IN, ER, so it does depend on the
sample. What do you notice about these percentages? AES works on ASCII 16-graphs that
include upper and lower case, spaces, numerals, punctuation marks, etc.
The most common reversals are ER/RE, ES/SE, AN/NA, TI/IT, ON/NO, etc. Note
that they all involve a vowel.
If there is a lot of ciphertext from a monalphabetic substitution cipher, then you can just
count up the frequencies of the letters in the ciphertext and guess that the most commonly
occurring letter is E, the next most is T, etc. If there is not much ciphertext, then you
can still often cryptanalyze successfully. For example, if you ran across XMOX XMB in a
text, what two words might they be? (that the, onto one). Find a common word that ts
FQJFUQ (people).
Lets cryptanalyze this: GU P IPY AKJW YKN CJJH HPOJ RGNE EGW OKIH-
PYGKYW HJVEPHW GN GW DJOPZWJ EJ EJPVW P AGUUJVJYN AVZIIJV MJN
EGI WNJH NK NEJ IZWGO REGOE EJ EJPVW EKRJSJV IJPWZVJA KV UPV PRPB
(Note second and last words)
27.1 The Vigen`ere cipher
Encryption of single letters by C P+b(mod 26) (where b is a constant) is a monalphabetic shift cipher.
If b = 3 we get the Caesar cipher. We can cycle through some nite number of monalphabetic
shift ciphers. This is the Vigen`ere cipher (1553). There would be a key word, for example
TIN. T is the 19th letter of the alphabet, I is the 7th and N is the 13th (A is the 0th). So
we would shift the rst plaintext letter by 19, the second by 7, the third by 13, the fourth
by 19, etc. See the Vigen`ere square on the next page. In order to encrypt CRYPTO with
the key TIN you rst encrypt C with T. Look in the square on the next page in row C,
column T (or vice versa). You would get VZLIBB. Note that the letter B appears twice in
the ciphertext. If the proper addressee has the same key then she can make the same table
and decryption is easy.
75
ABCDEFGHIJKLMNOPQRSTUVWXYZ
BCDEFGHIJKLMNOPQRSTUVWXYZA
CDEFGHIJKLMNOPQRSTUVWXYZAB
DEFGHIJKLMNOPQRSTUVWXYZABC
EFGHIJKLMNOPQRSTUVWXYZABCD
FGHIJKLMNOPQRSTUVWXYZABCDE
GHIJKLMNOPQRSTUVWXYZABCDEF
HIJKLMNOPQRSTUVWXYZABCDEFG
IJKLMNOPQRSTUVWXYZABCDEFGH
JKLMNOPQRSTUVWXYZABCDEFGHI
KLMNOPQRSTUVWXYZABCDEFGHIJ
LMNOPQRSTUVWXYZABCDEFGHIJK
MNOPQRSTUVWXYZABCDEFGHIJKL
NOPQRSTUVWXYZABCDEFGHIJKLM
OPQRSTUVWXYZABCDEFGHIJKLMN
PQRSTUVWXYZABCDEFGHIJKLMNO
QRSTUVWXYZABCDEFGHIJKLMNOP
RSTUVWXYZABCDEFGHIJKLMNOPQ
STUVWXYZABCDEFGHIJKLMNOPQR
TUVWXYZABCDEFGHIJKLMNOPQRS
UVWXYZABCDEFGHIJKLMNOPQRST
VWXYZABCDEFGHIJKLMNOPQRSTU
WXYZABCDEFGHIJKLMNOPQRSTUV
XYZABCDEFGHIJKLMNOPQRSTUVW
YZABCDEFGHIJKLMNOPQRSTUVWX
ZABCDEFGHIJKLMNOPQRSTUVWXY
Lets say that we receive the following text that we know was encrypted with the Vigen`ere
cipher.
wzggqbuawq pvhveirrbv nysttaknke nxosavvwfw frvxqumhuw
wqgwtgziih locgpnhjmn nmtzqboavv abcuawohbv rjTAMPOvkl
gpigfsmfmw vnniyhzyrv qkkiqywweh vjrjwgWEWG Zhcxucakep
wpsnjhvama hkmehnhuww vtzguwaclz stsvfxlplz muywzygagk
aofkioblwi argtvrgzit xeofswcrqb tllcmiabfk ttbwbfenvz
snlytxahuw vgtzstghut vrzwrcglpr ariltwxwTA MPOtgvwlqh
vkhkynwpmp vmwgbjxqnb tnuxhkwasa gvbwbntswm pwfdmhxnce
zinbdsqarv aihojmneqo alfwmpomqd qgmkuwvgfg husrfaqggg
vavwzyahgg wbrgjjbake axkgovnkww kdwiwhdnbo aumggbgbmv
exaoogypWE WGZvgymfrf gglbcuaq
How could we determine the length of the keyword? There are two methods we will look
at. They were invented by Kasiski (19th century) and Friedman (20th century).
76
The Kasiski text. Lets consider a frequent trigraph like THE and lets say that the
keyword is 5 letters long. If the trigraph THE starts at the n and mth positions in the
plaintext and n , m(mod 5) then they will be encrypted dierently. If n m(mod 5), then
they will be encrypted the same way. Keyword VOICE. Plaintext THEONETHE becomes
ciphertext OVMQRZHPG whereas plaintext THEBOTHE becomes OVMDSOVM. Of course
this would work for AND, ING or any other frequent trigraph. For any given pair of the
same plaintext trigraphs, we expect that one fth of the time they will be separated by a
distance a multiple of 5 and so will be encrypted identically. With enough ciphertext we can
look for repeated trigraphs and compute the distance between them. These distances should
be multiples of the key length usually.
Note the repeated appearances of WEWGZ and TAMPO that are 322 = 2 7 23 and
196 = 2
2
7
2
apart. Repeated appearances of HUWW and UWVG are 119 = 7 17 and
126 = 2 3
2
7 apart. These distances should be multiples of the length of the keyword. We
suspect the keylength is 7 or 14 if HUWW is a coincidence. We must be cautious though
because there can be coincidences like the fact that the two AVVs are 43 apart. So if we
write a computer program to get the greatest common divisor of all of the distances it would
output 1.
The Friedman test gives you an estimate of the length of the keyword. Note that if we
have a monalphabetic shift cipher, and draw a histogram of the letter appearances in the
ciphertext, it will look like a histogram of the letters in the plaintext, only shifted over.
Sorted, the percentages would be (12.31, 9.59, 8.05, 7.94, . . . .20, .20, .1, .09) for ETAO,
. . . QXJZ. If we have a two alphabet shift cipher then, for example, the frequency of A
appearing in the ciphertext is the average of the frequencies of the two letters sent to A.
Sorted the percentages might be (8.09, 7.98, 7.565, 7.295, . . . 1.115, 1.04, 0.985, 0.31). If there
is a ten alphabet shift cipher then for each ciphertext letter, the frequency of appearance
is the average of the ten frequencies of the letters mapping to it. Sorted, the percentages
might be (4.921, 4.663, 4.611, 4.589, . . . 3.284, 3.069, 3.064, 2.475). Note that if we consider
the frequencies of each letter in the ciphertext, that the mean, regardless of the number of
alphabets, is 1/26. But the variance is smaller, the more alphabets there are. So we can use
the variance to estimate the number of alphabets used (i.e. the length of the keyword).
We need a statistic like variance. If one selects a pair of letters from the text (they need
not be adjacent), what is the probability that both are the same letter? Say we have an n
letter text (plaintext or ciphertext) and there are n
0
As, n
1
Bs, . . . , n
25
Zs. So

n
i
= n.
The number of pairs of As is n
0
(n
0
1)/2, etc. So the total number of pairs of the same letter
is

n
i
(n
i
1)/2. The total number of pairs in the text is n(n 1)/2. So the probability
that a pair of letters (in an n letter text) is the same is

25
i=0
n
i
(n
i
1)
2
n(n 1)/2
=

25
i=0
n
i
(n
i
1)
n(n 1)
= I.
I is called the observed index of coincidence (IOC) of that text. What is the expected IOC
of standard English plaintexts? Let p
0
be the probability that the letter is A, p
0
.0805,
etc. The probability that both letters in a pair are As is p
2
0
. The probability that both are
Zs is p
2
25
. So the probability that a pair of letters is the same is

p
2
i
.065 for English. For
a random string of letters p
0
= . . . = p
25
= 1/26 then

p
2
i
= 1/26 0.038. (Note that we
77
would get a random string of letters from a Vigen`ere cipher with innite key length if the key
is random.) For any monalphabetic substitution cipher, the expected IOC is approximately
.065.
To make this a little more understandable, lets consider an easier example than English.
Create a new language , , , with letter frequencies .4, .3, .2, .1. The expected IOC is 0.3.
Shift one, and then the ciphertext letter frequencies are .1, .4, .3, .2 and again the expected
IOC is 0.3. If we encrypt with the Vigen`ere cipher and key (i.e. shift one, then two,
then one, . . . ) then the frequency of in the ciphertext is 1/2(.1) + 1/2(.2) = .15 of is
1/2(.4) + 1/2(.1) = .25 of is 1/2(.3) + 1/2(.4) = .35 and of = 1/2(.2) + 1/2(.3) = .25.
Then the expected IOC is 0.27. Note it becomes smaller, the longer the key length. Note
you can use the observed IOC to determine if ciphertext comes from a monalphabetic or
polyalphabetic cipher.
Back to English. Lets say we have ciphertext of length n with a keyword of length k,
which we want to determine. For simplicity, assume k[n and there is no repeated letter in
the keyword. We can write the ciphertext in an array as follows (of course, we dont really
know k yet).
c
1
c
2
c
3
. . . c
k
c
k+1
c
k+2
c
k+3
. . . c
2k
.
.
.
c
n
We have n/k rows. Each column is just a monalphabetic shift. Two letters chosen in one
column have probability .065 of being the same. Two letters in dierent columns have
probability 0.038 of being the same.
Whats the expected IOC? The number of pairs from the same column is n((n/k)1)/2 =
n(nk)/(2k). The number of pairs from dierent columns is n(n(n/k))/2 = n
2
(k1)/(2k).
The expected number of pairs of the same letter is
A = 0.065
_
n(n k)
2k
_
+ 0.038
_
n
2
(k 1)
2k
_
.
The probability that any given pair consists of the same two letters is
A
n(n 1)/2
=
1
k(n 1)
[0.027n + k(0.038n 0.065)].
This is the expected IOC. We set this equal to the observed IOC and solve for k.
k
.027n
(n 1)I 0.038n + 0.065
where I =
25

i=0
n
i
(n
i
1)
n(n 1)
In our example I = 0.04498, k 3.844. Thus we get an estimate of the key length of 3.844
(it is actually 7 - this is the worst Ive ever seen the Friedman test perform).
Solving for the key. Considering the results of the (Friedman and) Kasiski tests, lets
assume that the key length is 7. Now we want to nd the key, i.e. how much each is shifted.
78
We can write a program to give us a histogram of the appearance of each letter of CT in
the 1st, 8th, 15th, 22nd, etc. positions. In PARI we type k=7, l=478, r ctnum2.txt, r
hist.txt The output is 7 vectors of length 26. The nth is the histogram giving the frequency
of each letter in the nth column if we write the CT as 7 columns. So the rst vector gives the
histogram of the appearance of each letter of CT in the 1st, 8th, 15th, 22nd, etc. positions.
w z g g q b u
a w q p v h e
i r r b v n y
Here it is with the number of appearances for the letters A - Z
[10, 0, 0, 1, 1, 3, 7, 0, 0, 5, 7, 3, 2, 2, 0, 0, 1, 0, 4, 1, 2, 3, 10, 0, 1, 6]. We know that E, T, A, are the
most frequently appearing letters. The distances between them are A - 4 - E - 15 - T - 7 - A.
So for keylength 7 and ciphertext of length 478, I will assume that each of these letters must
show up at least 3 times in each of the seven sets/histograms. So we look in the histogram
for three letters, each of which appears at least 3 times and which have distances 4 - 15 - 7
apart. If there is more than one such triple, then we will sum the number of appearances of
each of the 3 letters and assign higher preferences to the shifts giving the greatest sums.
For the histogram above we note that a shift of 6 has appearance sum 7 + 7 + 6 = 20
whereas a shift of 18 has sum 17. We can similarly make a histogram for the ciphertext
letters in the 2nd, 9th, 16th, etc. positions and for the 3rd, . . . , the 4th, . . . , the 5th, . . . ,
the 6th, . . . and the 7th, . . . positions. For the second, the only shift is 4. For the third, the
shift of 0 has sum 11 and 2 has sum 17. For the fourth, the shift 7 has sum 14 and shift 19
has sum 20. For the fth, shift 8 has sum 16 and shift 11 has sum 12. For the sixth, shift 2
has sum 13 and shift 14 has sum 22. For the seventh, shift 1 has sum 17 and shift 13 has
sum 21. So our rst guess is that the shifts are [6,4,2,19,8,14,13]. We can decrypt using this
as a keyword and the rst seven letter of plaintext are QVENINH. That Q seems wrong.
The other guess for the rst shift was 18. Lets try that. We get EVEN IN HIS OWN TIME
. . . .
28 Cryptanalysis of modern stream ciphers
We will discuss the cryptanalysis of two random bit generators from the 1970s. Each is a
known plaintext attack. To crack the rst one, we need to learn about continued fractions
28.1 Continued Fractions
A simple continued fraction is of the form
a
1
+
1
a
2
+
1
a
3
+
1
.
.
.
+
1
a
n
a
i
Z and a
i
,= 0 if i > 1. This is often written [a
1
, a
2
, . . . , a
n
] for typesetting purposes.
Every rational number (fraction of integers) has a simple continued fraction. Example 27/8 =
3 + 1/(2 + 1/(1 + 1/(2))) = [3, 2, 1, 2]. If we let the expansion continue forever we get
79
something looking like = a
1
+ 1/(a
2
+ 1/(a
3
+ . . . = [a
1
, a
2
, . . .. This is called an innite
simple continued fraction. is dened to be lim
n
[a
1
, a
2
, . . . , a
n
] which is a real number.
Conversely, every irrational number has a unique innite simple continued fraction. The
rational numbers
a
1
, a
1
+ 1/a
2
, a
1
+ 1/(a
2
+ 1/a
3
), (or [a
1
], [a
1
, a
2
], [a
1
, a
2
, a
3
]) are called the partial quotients
or convergents of .
The convergents are very good rational approximations of . Conversely, every very
good rational approximation of is a convergent (I wont explain very good precisely).
For example, 22/7 is a famous very good rational approximation to . Indeed it is a
convergent. We have = 3 + 1/(7 + 1/(15 + . . .. The rst three convergents are 3,
3 + 1/7 = 22/7 = 3.14 . . ., and 3 + 1/(7 + 1/15) = 333/106 = 3.1415 . . .. If is irrational
and [
a
b
[ <
1
2b
2
where a, b Z, b 1 then
a
b
is a convergent to .
Given , heres how to nd the a
i
s. Let | be the greatest integer . So | = 3,
5| = 5, 1.5| = 2. Let
1
= and a
1
=
1
|. Let
2
= 1/(
1
a
1
) and a
2
=
2
|. Let

3
= 1/(
2
a
2
) and a
3
=
3
|, etc.
Here is a cool example. Let e = 2.71828 . . .. Then
1
= e, a
1
=
1
| = 2.
2
=
1
e2
= 1.39 . . ., a
2
= 1.39 . . .| = 1.
3
=
1
1.39...2
= 2.55 . . ., a
3
= 2.55 . . .
2
| = 1,
4
=
1
2.55...2
= 1.82 . . ., a
4
= 1.82 . . .
2
| = 1,
5
=
1
1.82...1
= 1.22 . . ., a
5
= 1.22 . . .
2
| = 1,

6
=
1
1.22...1
= 4.54 . . ., a
6
= 4.54 . . .
2
| = 4, etc. In fact, the continued fraction is
[2, 1, 2, 1, 1, 4, 1, 1, 6, 1, 1, 8, 1, 1, 10, . . .], the pattern continues.
28.2 b/p Random Bit Generator
This is a (pseudo)-random bit generator that was used in the 1970s. Let p be a large prime
for which 2 generates F

p
. Choose 1 b < p and let b/p be the key. Write out the base
2 decimal expansion of b/p = 0.k
1
k
2
k
3
k
4
. . . (where k
i
is a bit). Then k
1
k
2
k
3
. . . is the
keystream. It repeats every p 1 bits.
Example. Let p = 11. Since 2
2
,= 1 and 2
5
,= 1 F
11
we see that 2 generates F

11
. Let
the key be 5/11. In base 2 that is 101/1011. Heres how you expand that to a decimal.
0.01110...
___________
1011 | 101.00000
10 11
______
10 010
1 011
______
1110
1011
____
110 etc.
For our homework, well do something awkward thats easier to calculate. Let p be a
prime for which 10 generates F

p
. Choose 1 b < p. Write out the decimal expansion of
80
b/p = 0.n
1
n
2
n
3
. . . (with 0 n
i
9). Then n
1
n
2
n
3
. . . is the keystream. Since 10 generates,
it repeats every p 1 digits (as seldom as possible).
Example, b = 12, p = 17, b/p = .70588235294117647058 . . ., n
1
= 7, n
2
= 0, etc. Say you
have plaintext like MONTEREY . Turn each letter into a pair of digits 1214131904170424 =
p
1
p
2
p
3
. . ., 0 p
i
9, so p
1
= 1, p
2
= 2, p
3
= 1, etc.
To encrypt, c
i
= p
i
+ n
i
(mod10), and the ciphertext is c
1
c
2
c
3
. . .. To decrypt p
i
=
c
i
n
i
(mod10).
Example (encryption) (decryption)
PT 12141319 CT 82629544
+ keystream 70588325 - keystream 70588235
-------------------- --------------------
CT 82629544 PT 12141319
(note theres no carrying) M O N T
Heres a known plaintext attack. Say the number p has l digits and Eve has the ciphertext
and the rst 2l+1 plaintext digits/bits. She can nd b and p using simple continued fractions.
Say Eve has the ciphertext and the rst 3n bits of plaintext. So she can get the rst
3n bits of keystream. She nds the rst convergent to the keystream that agrees with the
rst 2n + 1 bits of the keystream. She sees if it agrees with the rest. If n > log(p) then
this will succeed.
In the following example, we have the rst 18 digits of PT, so n = 6.
CT 5309573992060 746098818740243
PT 0200170405201 11704
keystream 5109403597869 63905
We nd the continued fraction of .510940359786963905 and get
[0, 1, 1, 22, 2, 1, 5, 1, 1, 3, 2, 4, 308404783, 1, 2, 1, 2 . . .]. The convergents are 0, 1, 1/2, 23/45, 47/92, . . . ,.
The convergent [0, 1, 1, . . . 1, 3, 2] = 6982/13665 = .51094035858 . . . is not right but the next
one [0, 1, 1, . . . 1, 3, 2, 4] = 30987/60647 = .5109403597869630958815769987. It is the rst
one that agrees with the rst 13 digits of keystream and it also agrees with the following 5
so we are condent that it is right.
CT 5309573992060 746098818740243
PT 0200170405201 117040003081306 = CAREFULREADING
keystream 5109403597869 639058815769947
Actually we can intercept any consecutive bits, not just the rst ones, it is just a bit
more complicated. It still works as long as n p.
28.3 Linear Shift Register Random Bit Generator
The following random bit generator is quite ecient, though as we will see, not safe. It is
called the linear shift register (LSR) and was popular in the late 1960s and early 1970s.
They are still used for hashing and check sums and there are non-linear shift registers still
being used as random bit generators.
Heres an example.
81
s_0 s_1 s_2
----- ----- -----
output <- | | <- | | <- | | <-|
----- ----- ----- |
| | | |
V V V |
----------------------- |
| s_0 + s_1 |---|
-----------------------
The output is the keystream. Lets start with an initial state of (s
0
, s
1
, s
2
) = (0, 1, 1).
This is in gure 1 on the next page. Starting with gure 1, we will make the small boxes
adjacent and include down-arrows only at the boxes contributing to the sum. At the bottom
of the gure you see that we come back to the initial state so the keystream will start
repeating the same 7 bit string.
That was a 3-stage LSR. For an n-stage LSR (32 is the most common for cryptography),
the key/seed is 2n bits called b
0
, . . . , b
n1
, k
0
, . . . , k
n1
, all 0, 1 where b
0
,= 0 and not all
of the k
i
s are 0s.
The rst set of (s
0
, . . . s
n1
) is called the initial state and its (k
0
, . . . , k
n1
). In the last
example we had (k
0
, k
1
, k
2
) = (0, 1, 1). The function giving the last bit of the next state is
f(s
0
, . . . , s
n1
) = b
0
s
0
+b
1
s
1
+. . .+b
n1
s
n1
. In the last example, f = s
0
+s
1
= 1s
0
+1s
1
+0s
2
so (b
0
, b
1
, b
2
) = (1, 1, 0). The state is (s
0
, . . . , s
n1
) and we move from state to state. At each
state, s
i
is the same as s
i+1
from the previous state, with the exception of s
n1
which is the
output of f.
For a xed f (i.e. a xed set of b
i
s) there are 2
n
dierent initial states for an n-stage
LSR. We say that 2 states are in the same orbit if one state leads to another. 000 . . . 0 has its
own orbit. In the example, all other seven states are in one single orbit. So our keystream
repeats every 7 = 2
3
1 (which is best possible).
Lets consider the 4-stage LSR with (b
0
, b
1
, b
2
, b
3
) = (1, 0, 1, 0). Well nd the orbit
size of the state (0, 1, 1, 1). See gure 2. The orbit size is 6. So the keystream repeats
every 6. We would prefer a keystream to repeat every 2
4
1 = 15. A 4-stage LSR with
(b
0
, b
1
, b
2
, b
3
) = (1, 0, 0, 1) has orbit sizes of 15 and 1.
82
1. ------------------- x 2. -----------------
b_0=1 | 0 | 1 | 1 | x b_0=1 | 0 | 1 | 1 | 1 |
b_1=1 ------------------- x b_1=0 -----------------
b_2=0 | | x b_2=1 | |
k_0=0 ----- + ------------| x b_3=0 ------- + ---------|
k_1=1 | x k_0=0 |
k_2=1 ------------------- | x k_1=1 ----------------- |
0 | 1 | 1 | 1 | <--| x k_2=1 0 | 1 | 1 | 1 | 1 | <--|
------------------- x k_3=1 -----------------
| | x | |
----- + ------------| x ------- + ---------|
| x |
------------------- | x ----------------- |
01 | 1 | 1 | 0 | <--| x 01 | 1 | 1 | 1 | 0 | <--|
------------------- x -----------------
| | x | |
----- + ------------| x ------- + ---------|
| x |
------------------- | x ----------------- |
011 | 1 | 0 | 0 | <--| x 011 | 1 | 1 | 0 | 0 | <--|
------------------- x -----------------
| | x | |
----- + ------------| x ------- + ---------|
| x |
------------------- | x ----------------- |
0111 | 0 | 0 | 1 | <--| x 0111 | 1 | 0 | 0 | 1 | <--|
------------------- x -----------------
| | x | |
----- + ------------| x ------- + ---------|
| x |
------------------- | x ----------------- |
01110 | 0 | 1 | 0 | <--| x 01111 | 0 | 0 | 1 | 1 | <--|
------------------- x -----------------
| | x | |
----- + ------------| x ------- + ---------|
| x |
------------------- | x ----------------- |
011100 | 1 | 0 | 1 | <--| x 011110 | 0 | 1 | 1 | 1 | <--|
------------------- x -----------------
| | x
----- + ------------| x
key- | x
stream: ------------------- | x
0111001 | 0 | 1 | 1 | <--| x
------------------- x
83
Lets consider the 5-stage LSR with (b
0
, b
1
, b
2
, b
3
, b
4
) = (1, 1, 1, 0, 1). Find the orbit size
of state (1, 1, 0, 0, 1). We see it has orbit length 31 = 2
5
1. The output keystream is
1100110111110100010010101100001. Note that all states other than (0, 0, 0, 0, 0) appear.
That also means that all possible consecutive strings of length 5 of 0s and 1s (other than
00000) appear exactly once in the above keystream.
How to tell if there are two orbits of sizes 1 and 2
n
1. Let g(x) = b
0
+ b
1
x
1
+ b
2
x
2
+
. . . + b
n1
x
n1
+ x
n
. You get a maximal length orbit (size 2
n
1) exactly when g(x) is
primitive mod 2 (i.e. over F
2
). We say g(x) is primitive mod 2 if it is irreducible mod 2 and
x is a generator of F

2
n = F
2
[x]/(g(x))

. If 2
n
1 is prime, then it is sucient that g(x) be
irreducible.
So we want to pick (b
0
, . . . , b
n1
) so that g(x) is irreducible and x generates F
2
n. That
way the keystream repeats as seldom as possible. For a 32-stage LSR there are about 67
million dierent irreducible polynomials.
Note in the rst example we had (b
0
, b
1
, b
2
) = (1, 1, 0) which corresponds to 1 + x + x
3
which is irreducible and it did have a maximal length orbit. In the second example we
had (b
0
, b
1
, b
2
, b
3
) = (1, 0, 1, 0) which corresponds to 1 + x
2
+ x
4
= (1 + x + x
2
)
2
. The
polynomial isnt irreducible and we didnt get a maximal length orbit. The third example
was (b
0
, b
1
, b
2
, b
3
, b
4
) = (1, 1, 1, 0, 1) which corresponds to 1 + x + x
2
+ x
4
+ x
5
which is
irreducible and again there was a maximal length orbit.
As an example, encrypt Hi with (b
0
, . . . , b
4
)(k
0
, . . . , k
4
) = (1, 1, 1, 0, 1)(1, 1, 0, 0, 1). We
get the keystream of the third example. The plaintext Hi = 0100100001101001 in ASCII.
PT 0100100001101001
keystream 1100110111110100
CT 1000010110011101
Note CT+keystream=PT too and PT+CT=keystream. This is a nice property of XOR.
How can we crack this? Lets say we intercept CT and the rst 2n bits of PT (so this
is a known plaintext attack). Then we can get the rst 2n bits of keystream k
0
, . . . , k
2n1
.
Then we can generate the whole 2
n
1 keystream. Lets say that the proper users are using
f = s
0
+ s
1
+ s
2
+ s
4
as in the third example, though we dont know this. We do know
k
0
k
1
k
2
k
3
k
4
k
5
k
6
k
7
k
8
k
9
= 1100110111.
know don

t know can write

k
5
= k
0
+ k
1
+ k
2
+ k
4
= b
0
k
0
+ b
1
k
1
+ b
2
k
2
+ b
3
k
3
+ b
4
k
4
k
6
= k
1
+ k
2
+ k
3
+ k
5
= b
0
k
1
+ b
1
k
2
+ b
2
k
3
+ b
3
k
4
+ b
4
k
5
k
7
= k
2
+ k
3
+ k
4
+ k
6
= b
0
k
2
+ b
1
k
3
+ b
2
k
4
+ b
3
k
5
+ b
4
k
6
k
8
= k
3
+ k
4
+ k
5
+ k
7
= b
0
k
3
+ b
1
k
4
+ b
2
k
5
+ b
3
k
6
+ b
4
k
7
k
9
= k
4
+ k
5
+ k
6
+ k
8
= b
0
k
4
+ b
1
k
5
+ b
2
k
6
+ b
3
k
7
+ b
4
k
8
In general k
t+n
= b
0
k
t
+b
1
k
t+1
+. . . +b
n1
k
t+n1
. We have n linear equations (over F
2
)
in n unknowns (the b
i
s). We re-write this as a matrix equation.
_

_
k
0
k
1
k
2
k
3
k
4
k
1
k
2
k
3
k
4
k
5
k
2
k
3
k
4
k
5
k
6
k
3
k
4
k
5
k
6
k
7
k
4
k
5
k
6
k
7
k
8
_

_
_

_
b
0
b
1
b
2
b
3
b
4
_

_
=
_

_
k
5
k
6
k
7
k
8
k
9
_

_
84
We then ll in the known values for the k
i
s and get
_

_
1 1 0 0 1
1 0 0 1 1
0 0 1 1 0
0 1 1 0 1
1 1 0 1 1
_

_
_

_
b
0
b
1
b
2
b
3
b
4
_

_
=
_

_
1
0
1
1
1
_

_
We solve this matrix equation over F
2
and get b
0
b
1
b
2
b
3
b
4
= 11101.
Now you know the b
i
s and you know the initial state (the rst k
i
s) so you can create
the keystream yourself. End of example.
In general, we have
_

_
k
0
k
1
k
2
. . . k
n1
k
1
k
2
k
3
. . . k
n
k
2
k
3
k
4
. . . k
n+1
.
.
.
k
n1
k
n
k
n+1
. . . k
2n2
_

_
_

_
b
0
b
1
b
2
.
.
.
b
n1
_

_
=
_

_
k
n
k
n+1
k
n+2
.
.
.
k
2n1
_

_
Example. You know Alice and Bob are using a 6 stage LSR and this message starts with
To (in ASCII) and you intercept the ciphertext 1011 0000 1101 1000 0010 0111 1100 0011.
CT 10110000110110000010011111000011
PT 0101010001101111
T o
________________
KS 1110010010110111
We have
_

_
1 1 1 0 0 1
1 1 0 0 1 0
1 0 0 1 0 0
0 0 1 0 0 1
0 1 0 0 1 0
1 0 0 1 0 1
_

_
_

_
b
0
b
1
b
2
b
3
b
4
b
5
_

_
=
_

_
0
0
1
0
1
1
_

_
Solving we get b
0
b
1
b
2
b
3
b
4
b
5
= 110000. Since we know the b
i
s and the rst 6 bits of keystream,
we can create the whole keystream and decrypt the rest of the plaintext.
In Pari, we type
s=[1,1,1,0,0,1,0,0,1,0,1,1]
r mat6.txt
matsolve(mMod(1,2),v)
b=[1,1,0,0,0,0]
k=[1,1,1,0,0,1]
r ctlsr.txt
r declsr6.txt
85
We see that the plaintext is ToAl
What if we only knew the rst character of plaintext is T. Then we would have to
brute force the remaining 4 bits to get a total of 12 keybits. Note that only some of those
possibilities would result in an invertible matrix over F
2
. Of those, we can see which give
keystreams that give sensible plaintext.
End example.
There are people using non-linear shift registers as random bit generators. Example
f = s
0
s
2
s
7
+ s
1
+ s
2
s
4
+ s
4
.
29 Cryptanalysis of block ciphers
29.1 Brute Force Attack
A brute force attack is a known plaintext attack. Eve has one known plaintext/ciphertext
pair. Let us say the keys are b bits. She encrypts the plaintext with all 2
b
keys and sees which
gives the ciphertext. There will probably be few keys that do it. If there is more than one
candidate, then she tries the few candidates on a second plaintext/ciphertext pair. Probably
only one will work. She expects success half way through, so the number of attempts is one
half the size of the key space. So for DES this is 2
55
attempts and for AES it is 2
127
attempts.
29.2 Standard ASCII Attack
Single DES is a block cipher with a 64 bit plaintext, a 64 bit ciphertext and a 56 bit key.
Here is a ciphertext-only attack if the plaintext is standard (not extended) ASCII. So the
rst bit of each byte is a 0. Decrypt CT
1
with all 2
56
keys. Find which ones give standard
ASCII PT. That should be 1/2
8
of them or 2
48
keys. Decrypt CT
2
with the 2
48
keys. Again
only 1/2
8
of those or 2
40
should give standard ASCII. After decrypting CT
3
with 2
40
keys
will have 2
32
keys, . . . . After CT
7
will probably only have one key left. This attack requires
2
56
+ 2
48
+ 2
40
+ 2
32
+. . . + 2
8
attempts. That number 2
56
so only twice as bad as known
PT attack.
29.3 Meet-in-the-Middle Attack
The meet-in-the-middle attack on a double block cipher was invented by Die and Hellman.
It is a known plaintext attack also. Let E
K
1
denote encryption with key K
1
and a given
block cipher. Then CT = E
K
2
(E
K
1
(PT)) (where PT = plaintext and CT = ciphertext) is a
double block cipher.
Eve needs two known plaintext/ciphertext pairs. She encrypts the rst plaintext (with
the single block cipher) with all keys and saves the results. She then decrypts the matching
ciphertext with all keys and saves the results. She then nds the key pairs key
1,n
1
, key
2,n
2
where E
key
1,n
1
(PT
1
) = D
key
2,n
2
(CT
1
) (and D denotes decryption). For each successful key
pair, she computes E
key
2,n
2
(E
key
1,n
1
(PT
2
)) to see if she gets CT
2
. There will probably be only
one pair for which this works. This attack requires a huge amount of storage. But note, for
86
a block cipher with a b-bit key, that the number of steps is about 3(2
b
). So a double block
cipher is not much more secure than a single block cipher with a single key.
You can use a meet-in-the-middle attack to show that Triple-DES with three keys is
not much more secure than Triple-DES with two keys. Two keys are easier to agree on, so
Triple-DES is done with two keys, as described in Section 11.2.
29.4 One-round Simplied AES
We will use one-round simplied AES in order to explain linear and dierential cryptanalysis.
One-round Simplied AES
Recall S-box is a map from 4 bit strings to 4 bit strings. It is not a linear map. So,
for example, S-box(b
0
, b
1
, b
2
, b
3
) ,= b
0
+ b
1
, b
1
+ b
2
+ b
3
, b
0
, b
1
+ b
2
. We have a key K
0
=
k
0
k
1
k
2
k
3
k
4
k
5
k
6
k
7
k
8
k
9
k
10
k
11
k
12
k
13
k
14
k
15
. To expand the key, we
k
8
k
9
k
10
k
11
k
12
k
13
k
14
k
15

k
12
k
13
k
14
k
15
k
8
k
9
k
10
k
11
S b o x S b o x
n
0
n
1
n
2
n
3
n
4
n
5
n
6
n
7
1 0 0 0 0 0 0 0
k
0
k
1
k
2
k
3
k
4
k
5
k
6
k
7
= k
16
k
17
k
18
k
19
k
20
k
21
k
22
k
23
k
8
k
9
k
10
k
11
k
12
k
13
k
14
k
15
= k
24
k
25
k
26
k
27
k
28
k
29
k
30
k
31
We have K
1
= k
16
k
17
k
18
k
19
k
20
k
21
k
22
k
23
k
24
k
25
k
26
k
27
k
28
k
29
k
30
k
31
.
For linear cryptanalysis later note: k
16
+k
24
= k
8
and k
17
+k
25
= k
9
, . . . , k
23
+k
31
= k
15
.
Lets recall encryption:
p
0
p
1
p
2
p
3
p
8
p
9
p
10
p
11
p
4
p
5
p
6
p
7
p
12
p
13
p
14
p
15
A
K
0

p
0
+k
0
p
1
+k
1
p
2
+k
2
p
3
+k
3
p
8
+k
8
p
9
+k
9
p
10
+k
10
p
11
+k
11
p
4
+k
4
p
5
+k
5
p
6
+k
6
p
7
+k
7
p
12
+k
12
p
13
+k
13
p
14
+k
14
p
15
+k
15
Let S-box(p
0
p
1
p
2
p
3
+ k
0
k
1
k
2
k
3
) = m
0
m
1
m
2
m
3
, and so on. After NS the state is then
NS

m
0
m
1
m
2
m
3
m
8
m
9
m
10
m
11
m
4
m
5
m
6
m
7
m
12
m
13
m
14
m
15
SR

m
0
m
1
m
2
m
3
m
8
m
9
m
10
m
11
m
12
m
13
m
14
m
15
m
4
m
5
m
6
m
7
After MC the state is then
MC

m
0
+m
14
m
1
+m
12
+m
15
m
2
+m
12
+m
13
m
3
+m
13
m
6
+m
8
m
4
+m
7
+m
9
m
4
+m
5
+m
10
m
5
+m
11
m
2
+m
12
m
0
+m
3
+m
13
m
0
+m
1
+m
14
m
1
+m
15
m
4
+m
10
m
5
+m
8
+m
11
m
6
+m
8
+m
9
m
7
+m
9
.
Lastly, we add K
1
. The state is then
A
K
1

m
0
+m
14
+k
16
. . . m
3
+m
13
+k
19
m
6
+m
8
+k
24
. . . m
5
+m
11
+k
27
m
2
+m
12
+k
20
. . . m
1
+m
15
+k
23
m
4
+m
10
+k
28
. . . m
7
+m
9
+k
31
=
c
0
c
1
c
2
c
3
c
8
c
9
c
10
c
11
c
4
c
5
c
6
c
7
c
12
c
13
c
14
c
15
Well denote the cells:
cell 1 cell 3
cell 2 cell 4
87
29.5 Linear Cryptanalysis
Linear cryptanalysis is a known plaintext attack. It was invented by Matsui and published
in 1992. You need a lot of matched plaintext/ciphertext pairs from a given key. Lets say
that the plaintext block is p
0
. . . p
n1
, the key is k
0
. . . k
m1
and the corresponding ciphertext
block is c
0
. . . c
n1
.
Say that the linear equation p

1
+ p

2
+ . . . + p

a
+ c

1
+ . . . + c

b
+ k

1
+ . . . + k

g
= x
(where x = 0 or 1, 1 a n, 1 b n, 1 g m) holds with probability p > .5 over all
plaintext/key pairs. So x + p

1
+ . . . + c

b
= k

1
+ . . . k

g
with probability p > .5.
Compute x +p

1
+. . . +c

b
over all intercepted plaintext/ciphertext pairs. If its 0 most
of the time, assume k

1
+ . . . k

g
= 0. If its 1 most of the time, assume k

1
+ . . . k

g
= 1.
Now you have a relation on key bits. Try to get several relations.
linear non-linear
x
0
x
1
x
0
+ x
1
x
0
x
1
0 0 0 0
0 1 1 0
1 0 1 0
1 1 0 1
Linear cryptanalysis of 1 round Simplied AES
Let S-box(a
0
a
1
a
2
a
3
) = b
0
b
1
b
2
b
3
. We have
a
0
a
1
a
2
a
3
b
0
b
1
b
2
b
3
0 0 0 0 1 0 0 1
0 0 0 1 0 1 0 0
0 0 1 0 1 0 1 0
0 0 1 1 1 0 1 1
0 1 0 0 1 1 0 1
0 1 0 1 0 0 0 1
0 1 1 0 1 0 0 0
0 1 1 1 0 1 0 1
1 0 0 0 0 1 1 0
1 0 0 1 0 0 1 0
1 0 1 0 0 0 0 0
1 0 1 1 0 0 1 1
1 1 0 0 1 1 0 0
1 1 0 1 1 1 1 0
1 1 1 0 1 1 1 1
1 1 1 1 0 1 1 1
I computed the output of all linear combinations of the a
i
s and b
i
s. Here are a few of
the relations I found with probabilities higher than .5 (there are no relations of probability
> .75).
88
a
3
+ b
0
= 1110111101011011 = 1, p = 12/16 = .75 (1)
a
0
+ a
1
+ b
0
= 1011010111111110 = 1, p = .75 (2)
a
1
+ b
1
= 0100011010000000 = 0, p = .75 (3)
a
0
+ a
1
+ a
2
+ a
3
+ b
1
= 0, p = .75 (4)
a
1
+ a
2
+ b
0
+ b
1
= 1, p = .75 (5)
a
0
+ b
0
+ b
1
= 1, p = .75 (6)
Finding Equations
In order to nd equations of the form p

1
+p

2
+. . .+p

a
+c

1
+. . .+c

b
+k

1
+. . .+k

g
= x,
we need to eliminate the m
i
s and n
i
s. We will rst eliminate the n
i
s.
c
0
+ k
16
+ c
8
+ k
24
= c
0
+ c
8
+ k
8
= m
0
+ m
14
+ m
6
+ m
8
(7)
c
1
+ k
17
+ c
9
+ k
25
= c
1
+ c
9
+ k
9
= m
1
+ m
12
+ m
15
+ m
4
+ m
7
+ m
9
(8)
c
2
+ c
10
+ k
10
= m
2
+ m
12
+ m
13
+ m
4
+ m
5
+ m
10
(9)
c
3
+ c
11
+ k
11
= m
3
+ m
13
+ m
5
+ m
11
(10)
c
4
+ c
12
+ k
12
= m
2
+ m
12
+ m
4
+ m
10
(11)
c
5
+ c
13
+ k
13
= m
0
+ m
3
+ m
13
+ m
5
+ m
8
+ m
11
(12)
c
6
+ c
14
+ k
14
= m
0
+ m
1
+ m
14
+ m
6
+ m
8
+ m
9
(13)
c
7
+ c
15
+ k
15
= m
1
+ m
15
+ m
7
+ m
9
. (14)
The right-hand side of each of those eight equations involves all four cells of a state. So
to use these equations as they are and combine them with equations like 1 through 6 would
give us equations with probabilities very close to .5 (we will see later where this tendency
toward .5 comes from when combining equations).
Instead we notice that the bits appearing on the right-hand side of Equation 7 are a
subset of those appearing in Equation 13. Similarly, the bits appearing on the right-hand
side of equations 10, 11 and 14 are subsets of those appearing in Equations 12, 9 and 8,
respectively. So if we add the Equations 7 and 13, then 10 and 12, then 11 and 9 and lastly
14 and 8, we get
c
0
+ c
6
+ c
8
+ c
14
+ k
8
+ k
14
= m
1
+ m
9
(15)
c
3
+ c
5
+ c
11
+ c
13
+ k
11
+ k
13
= m
0
+ m
8
(16)
c
2
+ c
4
+ c
10
+ c
12
+ k
10
+ k
12
= m
5
+ m
13
(17)
c
1
+ c
7
+ c
9
+ c
15
+ k
9
+ k
15
= m
4
+ m
12
. (18)
Equations 15 - 18 are always true.
Let us consider Equation 16. We want to replace m
0
+ m
8
with expressions in the p
i
s
and k
i
s that hold with some probability higher than .5. Within a cell, both m
0
and m
8
correspond to the bit b
0
in the nibble b
0
b
1
b
2
b
3
. So we can use Equations 1 and 2.
Lets rst use Equation 1 for both cells 1 and 3.
p
0
+k
0
p
1
+k
1
p
2
+k
2
p
3
+k
3
p
8
+k
8
p
9
+k
9
p
10
+k
10
p
11
+k
11
p
4
+k
4
p
5
+k
5
p
6
+k
6
p
7
+k
7
p
12
+k
12
p
13
+k
13
p
14
+k
14
p
15
+k
15
NS

m
0
m
1
m
2
m
3
m
8
m
9
m
10
m
11
m
4
m
5
m
6
m
7
m
12
m
13
m
14
m
15
Recall the notation S-box(a
0
a
1
a
2
a
3
) = b
0
b
1
b
2
b
3
.
89
Equation 1 is a
3
+ b
0
= 1, p = .75 (for cells 1 and 3).
p
3
+ k
3
+ m
0
= 1, p = .75
p
11
+ k
11
+ m
8
= 1, p = .75
p
3
+ p
11
+ k
3
+ k
11
+ m
0
+ m
8
= 0, p = (.75)
2
+ (.25)
2
= .625
p
3
+ p
11
+ k
3
+ k
11
= m
0
+ m
8
, p = .625
Recall
c
3
+ c
5
+ c
11
+ c
13
+ k
11
+ k
13
= m
0
+ m
8
(16) always
Combining
c
3
+ c
5
+ c
11
+ c
13
+ k
11
+ k
13
= p
3
+ p
11
+ k
3
+ k
11
, p = .625
p
3
+ p
11
+ c
3
+ c
5
+ c
11
+ c
13
= k
3
+ k
13
(19), p = .625
This is our rst of the kind of equation needed to do linear cryptanalysis.
Next we use Equation 1 on cell 1 and Equation 2 on cell 3 (we will again combine with
Equation 16).
p
0
+k
0
p
1
+k
1
p
2
+k
2
p
3
+k
3
p
8
+k
8
p
9
+k
9
p
10
+k
10
p
11
+k
11
p
4
+k
4
p
5
+k
5
p
6
+k
6
p
7
+k
7
p
12
+k
12
p
13
+k
13
p
14
+k
14
p
15
+k
15
NS

m
0
m
1
m
2
m
3
m
8
m
9
m
10
m
11
m
4
m
5
m
6
m
7
m
12
m
13
m
14
m
15
Recall the notation S-box(a
0
a
1
a
2
a
3
) = b
0
b
1
b
2
b
3
.
Equation 1 is a
3
+ b
0
= 1, p = .75 (for cell 1).
Equation 2 is a
0
+ a
1
+ b
0
= 1, p = .75 (for cell 3).
p
3
+ k
3
+ m
0
= 1, p = .75
p
8
+ k
8
+ p
9
+ k
9
+ m
8
= 1, p = .75
p
3
+ p
8
+ p
9
+ c
3
+ c
5
+ c
11
+ c
13
= m
0
+ m
8
, p = .625
Recall
c
3
+ c
5
+ c
11
+ c
13
+ k
11
+ k
13
= m
0
+ m
8
(16) always
Combining
p
3
+ p
8
+ p
9
+ c
3
+ c
5
+ c
11
+ c
13
= k
3
+ k
8
+ k
9
+ k
11
+ k
13
(20), p = .625
This is the second of the kind of equation needed to do linear cryptanalysis.
If we use Equation 2 on both cells 1 and 3 we get p
0
+ p
1
+ p
8
+ p
9
+ c
3
+ c
5
+ c
11
+ c
13
= k
0
+ k
1
+ k
8
+ k
9
+ k
11
+ k
13
(21).
Using Equation 2 on cell 1 and Equation 1 on cell 3 is now redundant as it gives the same
information as we get by combining equations 19, 20 and 21.
For Equation 18 we can also use Equations 1 and 1, 1 and 2, and 2 and 2 on cells 2 and 4,
respectively, to get equations 22 - 24.
For Equation 15 we can use Equations 3 and 3, 3 and 4, and 4 and 4 on cells 1 and 3,
respectively, to get equations 25 - 27.
For Equation 17 we can use Equations 3 and 3, 3 and 4, and 4 and 4, on cells 2 and 4,
respectively, to get equations 28 - 29.
90
If we add Equations 15 and 16 we get c
0
+c
3
+c
5
+c
6
+c
8
+c
11
+c
13
+c
14
+k
8
+k
11
+k
13
+k
14
= m
0
+ m
1
+ m
8
+ m
9
.
p
0
+k
0
p
1
+k
1
p
2
+k
2
p
3
+k
3
p
8
+k
8
p
9
+k
9
p
10
+k
10
p
11
+k
11
p
4
+k
4
p
5
+k
5
p
6
+k
6
p
7
+k
7
p
12
+k
12
p
13
+k
13
p
14
+k
14
p
15
+k
15
NS

m
0
m
1
m
2
m
3
m
8
m
9
m
10
m
11
m
4
m
5
m
6
m
7
m
12
m
13
m
14
m
15
Recall the notation S-box(a
0
a
1
a
2
a
3
) = b
0
b
1
b
2
b
3
.
Equation 5 is a
1
+ a
2
+ b
0
+ b
1
= 1, p = .75 (for cells 1 and 3).
p
1
+ k
1
+ p
2
+ k
2
+ m
0
+ m
1
= 1, p = .75
p
9
+ k
9
+ p
10
+ k
10
+ m
8
+ m
9
= 1, p = .75.
p
1
+ p
2
+ p
9
+ p
10
+ k
1
+ k
2
+ k
9
+ k
10
= m
0
+ m
1
+ m
8
+ m
9
, p = .675.
Recall
c
0
+c
3
+c
5
+c
6
+c
8
+c
11
+c
13
+c
14
+k
8
+k
11
+k
13
+k
14
= m
0
+m
1
+m
8
+m
9
, (15) +(16)
always.
Combining
p
1
+p
2
+p
9
+p
10
+c
0
+c
3
+c
5
+c
6
+c
8
+c
11
+c
13
+c
14
= k
1
+k
2
+k
8
+k
9
+k
10
+k
11
+k
13
+k
14
(31),
p = .675.
It is tempting to use Equation 6 until one notices that it is the same as Equation 2 +
Equation 3, and hence is redundant. If we add 17 and 18 we can also use Equation 5 on
cells 2 and 4 to get equation (32).
The 14 equations are
p
3
+p
11
+c
3
+c
5
+c
11
+c
13
= k
3
+k
13
(19)
p
3
+p
8
+p
9
+c
3
+c
5
+c
11
+c
13
= k
3
+k
8
+k
9
+k
11
+k
13
(20)
p
0
+p
1
+p
8
+p
9
+c
3
+c
5
+c
11
+c
13
= k
0
+k
1
+k
8
+k
9
+k
11
+k
13
(21)
p
7
+p
15
+c
1
+c
7
+c
9
+c
15
= k
7
+k
9
(22)
p
7
+p
12
+p
13
+c
1
+c
7
+c
9
+c
15
= k
7
+k
9
+k
12
+k
13
+k
15
(23)
p
4
+p
5
+p
12
+p
13
+c
1
+c
7
+c
9
+c
15
= k
4
+k
5
+k
9
+k
12
+k
13
+k
15
(24)
p
1
+p
9
+c
0
+c
6
+c
8
+c
14
= k
1
+k
8
+k
9
+k
14
(25)
p
1
+p
8
+p
9
+p
10
+p
11
+c
0
+c
6
+c
8
+c
14
= k
1
+k
9
+k
10
+k
11
+k
14
(26)
p
0
+p
1
+p
2
+p
3
+p
8
+p
9
+p
10
+p
11
+c
0
+c
6
+c
8
+c
14
= k
0
+k
1
+k
2
+k
3
+k
9
+k
10
+k
11
+k
14
(27)
p
5
+p
13
+c
2
+c
4
+c
10
+c
12
= k
5
+k
10
+k
12
+k
13
(28)
p
5
+p
12
+p
13
+p
14
+p
15
+c
2
+c
4
+c
10
+c
12
= k
5
+k
10
+k
13
+k
14
+k
15
(29)
p
4
+p
5
+p
6
+p
7
+p
12
+p
13
+p
14
+p
15
+c
2
+c
4
+c
10
+c
12
= k
4
+k
5
+k
6
+k
7
+k
10
+k
13
+k
14
+k
15
(30)
p
1
+p
2
+p
9
+p
10
+c
0
+c
3
+c
5
+c
6
+c
8
+c
11
+c
13
+c
14
= k
1
+k
2
+k
8
+k
9
+k
10
+k
11
+k
13
+k
14
(31)
p
5
+p
6
+p
13
+p
14
+c
1
+c
2
+c
4
+c
7
+c
9
+c
10
+c
12
+c
15
= k
5
+k
6
+k
9
+k
10
+k
12
+k
13
+k
14
+k
15
; (32)
they each hold with probability .625.
91
This set of linear equations can be represented by the matrix equation
_

_
0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0
0 0 0 1 0 0 0 0 1 1 0 1 0 1 0 0
1 1 0 0 0 0 0 0 1 1 0 1 0 1 0 0
0 0 0 0 0 0 0 1 0 1 0 0 0 0 0 0
0 0 0 0 0 0 0 1 0 1 0 0 1 1 0 1
0 0 0 0 1 1 0 0 0 1 0 0 1 1 0 1
0 1 0 0 0 0 0 0 1 1 0 0 0 0 1 0
0 1 0 0 0 0 0 0 0 1 1 1 0 0 1 0
1 1 1 1 0 0 0 0 0 1 1 1 0 0 1 0
0 0 0 0 0 1 0 0 0 0 1 0 1 1 0 0
0 0 0 0 0 1 0 0 0 0 1 0 0 1 1 1
0 0 0 0 1 1 1 1 0 0 1 0 0 1 1 1
0 1 1 0 0 0 0 0 1 1 1 1 0 1 1 0
0 0 0 0 0 1 1 0 0 1 1 0 1 1 1 1
_

_
_

_
k
0
k
1
k
2
k
3
k
4
k
5
k
6
k
7
k
8
k
9
k
10
k
11
k
12
k
13
k
14
k
15
_

_
=
_

_
p
3
+ p
11
+ c
3
+ c
5
+ c
11
+ c
13
. . .
p
5
+ p
6
+ . . . c
15
_

_
The rows are linearly independent, so there is no redundancy of information in the 14
equations.
The Attack
Eve takes the known plaintext/ciphertext pairs and evaluates p
3
+p
11
+c
3
+c
5
+c
11
+c
13
for all of them. If its usually 0, then she puts 0 at the top of that vector. If its usually 1,
then she puts 1.
For simplicity, assume Eve has gotten all 14 choices of 0 or right 1. She now has 14
equations in 16 unknowns (k
0
, . . . , k
15
), so there are 2
1614
= 4 possible solutions for the
key. The simplest way to extend the 14 rows of the matrix to a basis (of the 16-dimensional
F
2
-vector space) is to include the vectors associate to k
0
and k
4
. Eve uses the matrix equation
_

_
0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0
0 0 0 1 0 0 0 0 1 1 0 1 0 1 0 0
1 1 0 0 0 0 0 0 1 1 0 1 0 1 0 0
0 0 0 0 0 0 0 1 0 1 0 0 0 0 0 0
0 0 0 0 0 0 0 1 0 1 0 0 1 1 0 1
0 0 0 0 1 1 0 0 0 1 0 0 1 1 0 1
0 1 0 0 0 0 0 0 1 1 0 0 0 0 1 0
0 1 0 0 0 0 0 0 0 1 1 1 0 0 1 0
1 1 1 1 0 0 0 0 0 1 1 1 0 0 1 0
0 0 0 0 0 1 0 0 0 0 1 0 1 1 0 0
0 0 0 0 0 1 0 0 0 0 1 0 0 1 1 1
0 0 0 0 1 1 1 1 0 0 1 0 0 1 1 1
0 1 1 0 0 0 0 0 1 1 1 1 0 1 1 0
0 0 0 0 0 1 1 0 0 1 1 0 1 1 1 1
1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0
_

_
_

_
k
0
k
1
k
2
k
3
k
4
k
5
k
6
k
7
k
8
k
9
k
10
k
11
k
12
k
13
k
14
k
15
_

_
=
_

_
p
3
+ p
11
+ c
3
+ c
5
+ c
11
+ c
13
. . .
p
5
+ p
6
+ . . . c
15

_
92
In the vector at right, in the rst 14 places, she puts in 0, or 1, whichever appeared more
commonly. She brute forces the remaining two bits.
Let us say that Eve wants to be 95% certain that all 14 of the bit choices are correct. We
can approximate the number n of dierent plaintexts and corresponding ciphertexts she will
need for this certainty level. For i = 19, . . . , 32, let p
i
denote the random variable whose value
is equal to the proportion of the n plaintexts and corresponding ciphertexts for which the
left-hand side of Equation i is equal to the correct value (0 or 1) of the right-hand side, for the
given key. For each i, the expected value of p
i
is .625 and its variance is (.625)(1 .625)/n.
Therefore the standard deviation of p
i
is
_
15/(64n).
We want Prob( p
i
> .5 for i = 19 . . . , 32) = .95. We will assume that the p
i
s are
independent since we do not know any better and it is probably close to true. Thus we have
.95 = Prob( p
i
> .5 for i = 19 . . . , 32) = Prob( p
i
> .5)
14
, for any given i. Therefore we want
Prob( p
i
> .5) =
14

.95 = .99634, for any given i.

For suciently large n, the random variable p
i
is essentially normal. So we will standard-
ize p
i
by subtracting o its expected value and dividing by its standard deviation, which will
give us (approximately) the standard normal random variable denoted Z.
We have
.99634 = Prob( p
i
> .5) = Prob
_
_
p
i
.625
_
15
64n
>
.5 .625
_
15
64n
_
_
= Prob
_
Z >

15
_
.
Therefore
1 .99634 = .00366 = Prob
_
Z <

15
_
.
By the symmetry of the probability density function for Z we have
.00366 = Prob
_
Z >

15
_
.
Looking in a Z-table, we see Prob(Z > 2.685) .00366. To solve for n, we set

n/

15 =
2.685. This gives us n = 15(2.685)
2
; rounding up we get n = 109.
A generalization of the above argument shows that for a certainty level of c with 0 < c < 1
(we chose c = .95) we have n = 15z
2
where z is the value in a Z-table corresponding to
1
14

c. In fact only n = 42 plaintexts and corresponding ciphertexts are needed for the
certainty level to go above c = .5. If none of the keys works, she can get more plaintexts
and corresponding ciphertexts. Alternately, she can try switching some of her 14 choices for
the bits. Her rst attempt would be to switch the one that had occurred the fewest number
of times.
Speed of attack
If Eve has a single plaintext and corresponding ciphertext, then she can try all 2
16
= 65536
keys to see which sends the plaintext to the ciphertext. If more than one key works, she
can check the candidates on a second plaintext and corresponding ciphertext. Undoubtedly
only one key will work both times. This is called a pure brute force attack. On average, she
expects success half way through, so the expected success occurs after 2
15
encryptions.
93
For our linear cryptanalytic attack to succeed with 95% certainty, Eve needs to compute
the values of the 14 dierent

iS
1
p
i


jS
2
c
j
s for each of the 109 plaintexts and cor-
responding ciphertexts. Then she only needs to do a brute force attack with four possible
keys.
Thus this linear cryptanalytic attack seems very attractive compared to a pure brute
force attack for one-round simplied AES. However, when you add rounds, you have to do
more additions of equations in order to eliminate unknown, intermediary bits (like the m
i
s
and n
i
s) and the probabilities associated to the equations then tend toward .5 (as we saw our
probabilities go from .75 to .625). The result is that many more plaintexts and corresponding
ciphertexts are needed in order to be fairly certain of picking the correct bit values for the

lS
3
k
l
s.
29.6 Dierential cryptanalysis
Dierential cryptanalysis (Biham, Shamir) is chosen plaintext attack. Usually unrealistic.
You can use if have enormous amount of known PT (with enough, youll nd ones you would
have chosen). (Smart cards/cable box). Eve picks 2 PTs that dier in specied bits and
same at specied bits and looks at dierence in corresponding two CTs and deduces info
about key.
Dil crys of 1-round simplied Rijndael: A
K
1
MC SR NS A
K
0
. One key used
to encrypt 2 PTs p
0
. . . p
15
& p

0
. . . p

15
with p
8
. . . p
15
= p

8
. . . p

15
to get 2 CTs c
0
. . . c
15
&
c

0
. . . c

15
. Want p
0
p
1
p
2
p
3
,= p

0
p

1
p

2
p

3
as nibbles (OK if some bits same). Want p
4
p
5
p
6
p
7
,=
p

4
p

5
p

6
p

7
.
94
p
0
p
1
p
2
p
3
p
8
p
9
p
10
p
11
p
4
p
5
p
6
p
7
p
12
p
13
p
14
p
15
p

0
p

1
p

2
p

3
p
8
p
9
p
10
p
11
p

4
p

5
p

6
p

7
p
12
p
13
p
14
p
15
A
K
0
p
0
+ k
0
p
1
+ k
1
p
2
+ k
2
p
3
+ k
3
p
8
+ k
8
p
9
+ k
9
p
10
+ k
10
p
11
+ k
11
p
4
+ k
4
p
5
+ k
5
p
6
+ k
6
p
7
+ k
7
p
12
+ k
12
p
13
+ k
13
p
14
+ k
14
p
15
+ k
15
and
p

0
+ k
0
p

1
+ k
1
p

2
+ k
2
p

3
+ k
3
p
8
+ k
8
p
9
+ k
9
p
10
+ k
10
p
11
+ k
11
p

4
+ k
4
p

5
+ k
5
p

6
+ k
6
p

7
+ k
7
p
12
+ k
12
p
13
+ k
13
p
14
+ k
14
p
15
+ k
15
NS (S-box each nybble)
m
0
m
1
m
2
m
3
m
8
m
9
m
10
m
11
m
4
m
5
m
6
m
7
m
12
m
13
m
14
m
15
m

0
m

1
m

2
m

3
m
8
m
9
m
10
m
11
m

4
m

5
m

6
m

7
m
12
m
13
m
14
m
15
SR (shiftrow)
m
0
m
1
m
2
m
3
m
8
m
9
m
10
m
11
m
12
m
13
m
14
m
15
m
4
m
5
m
6
m
7
m

0
m

1
m

2
m

3
m
8
m
9
m
10
m
11
m
12
m
13
m
14
m
15
m

4
m

5
m

6
m

7
MC (mixcolumn)
m
0
+m
14
m
1
+m
12
+m
15
m
2
+m
12
+m
13
m
3
+m
13
m
6
+m
8
m
4
+m
7
+m
9
m
4
+m
5
+m
10
m
5
+m
11
m
2
+m
12
m
0
+m
3
+m
13
m
0
+m
1
+m
14
m
1
+m
15
m
4
+m
10
m
5
+m
8
+m
11
m
6
+m
8
+m
9
m
7
+m
9
and
m

0
+m
14
m

1
+m
12
+m
15
m

2
+m
12
+m
13
m

3
+m
13
m

6
+m
8
m

4
+m

7
+m
9
m

4
+m

5
+m
10
m

5
+m
11
m

2
+m
12
m

0
+m

3
+m
13
m

0
+m

1
+m
14
m

1
+m
15
m

4
+m
10
m

5
+m
8
+m
11
m

6
+m
8
+m
9
m

7
+m
9
AK
1
m
0
+m
14
+k
16
m
1
+m
12
+m
15
+k
17
m
2
+m
12
+m
13
+k
18
m
3
+m
13
+k
19
m
2
+m
12
+k
20
m
0
+m
3
+m
13
+k
21
m
0
+m
1
+m
14
+k
22
m
1
+m
15
+k
23
m
6
+m
8
+k
24
m
4
+m
7
+m
9
+k
25
m
4
+m
5
+m
10
+k
26
m
5
+m
11
+k
27
m
4
+m
10
+k
28
m
5
+m
8
+m
11
+k
29
m
6
+m
8
+m
9
+k
30
m
7
+m
9
+k
31
and
m

0
+m
14
+k
16
m

1
+m
12
+m
15
+k
17
m

2
+m
12
+m
13
+k
18
m

3
+m
13
+k
19
m

2
+m
12
+k
20
m

0
+m

3
+m
13
+k
21
m

0
+m

1
+m
14
+k
22
m

1
+m
15
+k
23
m

6
+m
8
+k
24
m

4
+m

7
+m
9
+k
25
m

4
+m

5
+m
10
+k
26
m

5
+m
11
+k
27
m

4
+m
10
+k
28
m

5
+m
8
+m
11
+k
29
m

6
+m
8
+m
9
+k
30
m

7
+m
9
+k
31
This equals
c
0
c
1
c
2
c
3
c
8
c
9
c
10
c
11
c
4
c
5
c
6
c
7
c
12
c
13
c
14
c
15
c

0
c

1
c

2
c

3
c

8
c

9
c

10
c

11
c

4
c

5
c

6
c

7
c

12
c

13
c

14
c

15
XOR the next to the lasts (with m
i
s and k
i
s) together and get
m
0
+ m

0
m
1
+ m

1
m
2
+ m

2
m
3
+ m

3
dont care
dont care m
4
+ m

4
m
5
+ m

5
m
6
+ m

6
m
7
+ m

7
which equals the XOR of the last one (with the c
i
s).
c
0
+ c

0
c
1
+ c

1
c
2
+ c

2
c
3
+ c

3
dont care
dont care c
12
+ c

12
c
13
+ c

13
c
14
+ c

14
c
15
+ c

15
95
We have c
0
c
1
c
2
c
3
+ c

0
c

1
c

2
c

3
= m
0
m
1
m
2
m
3
+ m

0
m

1
m

2
m

3
= Sbox(p
0
p
1
p
2
p
3
+ k
0
k
1
k
2
k
3
)+Sbox(p

0
p

1
p

2
p

3
+ k
0
k
1
k
2
k
3
).
So if p
8
. . . p
15
= p

8
. . . p

15
then Sbox(p
0
p
1
p
2
p
3
+ k
0
k
1
k
2
k
3
)+Sbox(p

0
p

1
p

2
p

3
+ k
0
k
1
k
2
k
3
) =
c
0
c
1
c
2
c
3
+ c

0
c

1
c

2
c

3
. (I). ((Box, including if statement.))
All known except k
0
k
1
k
2
k
3
. Note equation DEPENDS ON p
8
. . . p
15
= p

8
. . . p

15
.
Similarly c
12
c
13
c
14
c
15
+ c

12
c

13
c

14
c

15
= m
4
m
5
m
6
m
7
+ m

4
m

5
m

6
m

7
Sbox(p
4
p
5
p
6
p
7
+ k
4
k
5
k
6
k
7
)+ Sbox(p

4
p

5
p

6
p

7
+ k
4
k
5
k
6
k
7
).
So if p
8
. . . p
15
= p

8
. . . p

15
then Sbox(p
4
p
5
p
6
p
7
+ k
4
k
5
k
6
k
7
)+ Sbox(p

4
p

5
p

6
p

7
+ k
4
k
5
k
6
k
7
) =
c
12
c
13
c
14
c
15
+ c

12
c

13
c

14
c

15
. (II).
All known except k
4
k
5
k
6
k
7
.
Ex: Eve encrypts
p
0
p
15
ASCII No = 0100 1110 0110 1111
CT = 0010 0010 0100 1101
and
p

0
p

15
ASCII to = 0111 0100 0110 1111
CT = 0000 1010 0001 0001
Eqn I: Sbox(0100 + k
0
k
1
k
2
k
3
) +Sbox(0111 + k
0
k
1
k
2
k
3
) = 0010 + 0000 = 0010.
cand A B
k
0
k
1
k
2
k
3
+0100 +0111 Sbox(A) Sbox(B) Sbox(A)+Sbox(B)
0000 0100 0111 1101 0101 1000
0001 0101 0110 0001 1000 1001
0010 0110 0101 1000 0001 1001
0011 0111 0100 0101 1101 1000
0100 0000 0011 1001 1011 0010
0101 0001 0010 0100 1010 1110
0110 0010 0001 1010 0100 1110
0111 0011 0000 1011 1001 0010
1000 1100 1111 1100 0111 1011
1001 1101 1110 1110 1111 0001
1010 1110 1101 1111 1110 0001
1011 1111 1100 0111 1100 1011
1100 1000 1011 0110 0011 0101
1101 1001 1010 0010 0000 0010
1110 1010 1001 0000 0010 0010
1111 1011 1000 0011 0110 0101
So k
0
k
1
k
2
k
3
0100, 0111, 1101, 1110.
96
Note that set of cands is determined by 2nd and 3rd columns. Those are pairs with
XOR=0011. So if p
0
p
1
p
2
p
3
+ p

0
p

1
p

2
p

3
= 0011 will get same cands. So nd new pair
with p
0
p
1
p
2
p
3
+ p

0
p

1
p

2
p

3
,= 0011, (0000).
In PARI we
? p1=[0,1,0,0]
? p2=[0,1,1,1]
ctxor=[0,0,1,0]
? r xor.txt
((Output:))
[0,1,0,0]
.
.
.
[1,1,1,0]
Eve encrypts
p
0
p
15
ASCII Mr = 0100 1101 0111 0010
CT = 1101 0101 1101 0000
and
p

0
p

15
ASCII or = 0110 1111 0111 0010
CT = 1100 0001 0100 1111
I: Sbox(0100 + k
0
k
1
k
2
k
3
) +Sbox(0110 + k
0
k
1
k
2
k
3
) = 1101 + 1100 = 0001. We get the
candidates k
0
k
1
k
2
k
3
1101, 1111. The intersection of two sets is k
0
k
1
k
2
k
3
= 1101.
Using II, and these two matched PT/CT pairs, Eve determines k
4
k
5
k
6
k
7
= 1100.
To get k
8
k
9
k
10
k
11
and k
12
k
13
k
14
k
15
, need two more eqns III and IV (to be determined in
HW).
With enough rounds (> 3 DES, > 1 Rijndael) impossible to nd such equations with prob-
ability 1. Instead nd such eqns with lower proby p. Then right keybits appear in propor-
tion p of candidate sets. Others show up randomly and since so many (real DES/Rijndael),
will appear much less often.
30 Attacks on Public Key Cryptography
In this section, we present algorithms for factoring, the nite eld discrete logarithm problem
and the elliptic curve discrete logarithm problem that run faster than brute force.
30.1 Pollards algorithm
The birthday paradox says that if there are more than 23 people in a room, then odds are
that two have the same birthday. In general, if

n items are drawn with replacement

from a set of size n, then the probability that two will match is approximately 1 e

2
/2
.
97
So if you pick
_
ln(4)n 1.2

n items, odds are 50/50 that two will match. So you need
_
365ln(4) 23 birthdays.
If you take a random walk through a set of size n, then you expect after 1.2

n steps that
youll come back to a place youve been before. Exploiting this is called Pollards -method.
The number of expected steps before returning to some previous point is O(

n). Below is
a random walk that shows why its called the -method (note shape).
* * -> * *
* / \ \ *
* / * -- *
* * *
* / * * *
* * *
| * * *
| * * *
* * *
Start
A factoring algorithm based on this was the rst algorithm signicantly faster than trial
division. It is still best on numbers in the 8 - 15 digit range. We want to factor n. Iterate
a function, like f(x) = x
2
+ 1(modn) (starting with, say x = 0) and you get a random walk
through Z/nZ. If n = pq, you hope that modulo p you come back (to a place youve been
before) and mod q that you dont. Example: Lets say we want to factor 1357. Well use
the map x
2
+ 1 so a
m+1
= a
2
m
+ 1(mod 1357) where we start with a
0
= 0.
Heres an algorithm with little storage and no look-up.
Step 1) Compute a
1
, a
1
, a
2
, gcd(a
2
a
1
, n), store a
1
, a
2
Step 2) Compute a
2
, a
3
, a
4
, gcd(a
4
a
2
, n), store a
2
, a
4
and delete a
1
, a
2
Step 3) Compute a
3
, a
5
, a
6
, gcd(a
6
a
3
, n), store a
3
, a
6
and delete a
2
, a
4
Step 4) Compute a
4
, a
7
, a
8
, gcd(a
8
a
4
, n), store a
4
, a
8
and delete a
3
, a
6
Step 5) Compute a
5
, a
9
, a
10
, gcd(a
10
a
5
, n), store a
5
, a
10
, and delete a
4
, a
8
, etc.
i 2i 1 2i a
i
a
2i1
a
2i
gcd(a
2i
a
i
, 1357)
1 1 2 1 1 2 1

2 3 4 2 5 26 1

3 5 6 5 677 1021 1

4 7 8 26 266 193 1

5 9 10 677 611 147 1

6 11 12 1021 1255 906 23
So 23[1357 and 1357/23 = 59. Note that computing x
2
+ 1(mod n) is fast and gcding is
fast.
98
Why did this work? Lets look behind the scenes at what was happening modulo 23 and
modulo 59.
a
i
mod 1357 a
i
mod 23 a
i
mod 59
a
1
= 1 1 1
a
2
= 2 2 2
a
3
= 5 5 5
a
4
= 26 3 26
a
5
= 677 10 28
a
6
= 1021 9 18
a
7
= 266 13 30
a
8
= 193 9 16
a
9
= 611 13 21
a
10
= 147 9 29
a
11
= 1255 13 16
a
12
= 906 9 21
Note 906 1021 9 9 0(mod 23), 21 18 3(mod 59). So 23[906 1021, 59 ,
[906 1021. So gcd(906 1021, 1357) = 23.
Wouldnt it be faster just to make the list a
1
, . . . , a
8
and gcd at each step with all the
previous a
i
s? No. If the (when we get back, modulo p to where weve been before) happens
after m steps (above we see it happened for m = 8) then we need 1 +2 +. . . +(m1)
m
2
2
gcds and a lot of storage. The earlier algorithm has only about 4m steps.
How long until we ? Assume n = pq and p <

n. If we come back to somewhere we
have been before mod p after m steps then m = O(

p) = O(
4

n) = O(e
1
4
logn
). Trial division
takes O(

n) = O(e
1
2
logn
) steps. In each case, we multiply by O(log
i
(n)) for i = 2 or 3 to get
the running time. This multiplier, however, is insignicant. The number eld sieve takes
time e
O(logn)
1/3
(loglogn)
2/3
)
.
We can use the same idea to solve the discrete log problem for elliptic curves over nite
elds. This is still the best known algorithm for solving the ECDLP. Let E : y
2
= x
3
+17x+1
over F
101
. The point G = (0, 1) generates E(F
101
). In addition, 103G = so the multiples
of the points work modulo 103. The point Q = (5, 98) = nG for some n; nd n. Let x(point)
denote the x-coordinate of a point, so x(Q) = 5.
Lets take a random walk through E(F
101
). Let v
0
= [0, 0] and P
0
= . The vector
v
i
= [a
i
, b
i
] means P
i
= a
i
Q + b
i
G where a
i
, b
i
are dened modulo 103. Here is the walk:
If x(P
i
) 33 or P
i
= then P
i+1
= Q + P
i
and v
i+1
= v
i
+ [1, 0].
If 33 < x(P
i
) < 68 then P
i+1
= 2P
i
and v
i+1
= 2v
i
.
If 68 x(P
i
) then P
i+1
= G + P
i
and v
i+1
= v
i
+ [0, 1].
When P
2j
= P
j
, quit. Then P
2j
= a
2j
Q + b
2j
G = a
j
Q + b
j
G = P
j
. So (a
2j
a
j
)Q =
(b
j
b
2j
)G and Q = (b
j
b
2j
)(a
2j
a
j
)
1
G where (a
2j
a
j
)
1
is reduced modulo 103. Note
the step P
i+1
= 2P
i
depends on the fact that gcd(2, #E(F
p
)) = 1. If 2[#E(F
p
), then replace
99
2 with the smallest prime relatively prime to #E(F
p
).
P
i
= a
i
Q + b
i
G
i P
i
v
i
= [a
i
, b
i
]
0 [0, 0]
1 (5, 98) [1, 0]
2 (68, 60) [2, 0]
3 (63, 29) [2, 1]
4 (12, 32) [4, 2]
5 (8, 89) [5, 2]
6 (97, 77) [6, 2]
7 (62, 66) [6, 3]
8 (53, 81) [12, 6]
9 (97, 77) [24, 12]
10 (62, 66) [24, 13]
11 (53, 81) [48, 26]
12 (97, 77) [96, 52]
Note that P
12
= P
6
so 6Q + 2G = 96Q + 52G. Thus 90Q = 50G and Q = (90)
1
50G.
We have (90)
1
50 91(mod103) so Q = 91G. Of course we really compute P
1
, P
1
, P
2
and compare P
1
, P
2
. Then we compute P
2
, P
3
, P
4
and compare P
2
, P
4
. Then we compute
P
3
, P
5
, P
6
and compare P
3
, P
6
, etc..
We can use a similar idea to solve the FFDLP. Instead of doubling (i.e. squaring here) in
random walk, we raise to a power relatively prime to #F

q
for q = 2
r
or q a prime. Example.
g = 2 generates F

101
. We have y = 86 = g
x
. Find x.
Well take a random walk through F

101
. Let c
0
= 1 and v
0
= [0, 0]. The vector v
i
= [a
i
, b
i
]
means c
i
= y
a
i
g
b
i
= 86
a
i
2
b
i
. Note a
i
, b
i
are dened modulo 100.
If c
i
33 then c
i+1
= c
i
y = 86c
i
and v
i+1
= v
i
+ [1, 0].
If 33 < c
i
< 68 then c
i+1
= c
3
i
and v
i+1
= 3v
i
(we used 3 since it is relatively prime to 100,
the group order).
If 68 c
i
then c
i+1
= c
i
g = 2c
i
and v
i+1
= v
i
+ [0, 1].
When c
2j
= c
j
you quit. Then c
2j
= y
a
2j
g
b
2j
= y
a
j
g
b
j
= c
j
. So y
a
2j
a
j
= g
b
j
b
2j
and
y = g
(b
j
b
2j
)(a
2j
a
j
)
1
, where the inversion in the exponent happens modulo 100.
We have
c
i
= 86
a
i
2
b
i
i c
i
v
i
= [a
i
, b
i
]
0 1 [0,0]
1 86 [1,0]
2 71 [1,1]
3 41 [1,2]
4 39 [3,6]
5 32 [9,18]
6 25 [10,18]
7 29 [11,18]
8 70 [12,18]
9 39 [12,19]
10 32 [36,57]
100
So 32 = 86
36
2
57
= 86
9
2
18
and 86
27
= 2
1857
. Now 18 57 61(mod 100) so 86
27
= 2
61
and 86 = 2
61(27
1
)
. Now 61(27
1
) 61(63) 43(mod 100) so 86 = 2
43
in F
101
. Note that
if the entries in the vector [a
i
, b
i
] become 100 or larger, you reduce them modulo 100. Had
(a
2j
a
j
) not been invertible modulo 100, then we would nd all solutions to (a
2j
a
j
)x =
b
j
b
2j
(mod 100).
Often, when the security of a cryptosystem depends on the diculty of solving the discrete
logarithm problem in F

q
, you choose q so that there is a prime with [q 1 = #F

q
of a
certain size. In this case, you nd an element h F

q
such that h

= 1, with h ,= 1. All
computations are done in the subset (subgroup) of F

q
generated by h. If is suciently
smaller than q, then encryption, decryption, signing or verifying a signature will be faster.
Note that Pollards -algorithm can be done in the subset of elements in F

q
generated by
h. So this subset has size . So the running time depends on . The number eld sieve
adaptation of the index calculus algorithm, runs in sub-exponential time, so is much faster
than Pollards algorithm for a whole nite eld. The index calculus algorithm, however,
can not be adapted to the subset generated by h. So its running time depends on q. You can
choose so that the Pollards algorithm in the subset generated by h takes the same amount
of time as the index calculus algorithm in F

q
. This increases speed without compromising
security. Note that the number eld sieve and the index calculus algorithm are described in
Sections 30.3.3 and 30.2.6, though the number eld sieve adaptation of the index calculus
algorithm is not.
30.2 Factoring
The most obvious way of cracking RSA is to factor a users n = pq into the primes p and
q. When we talk about the problem of factoring, we assume that we are looking for a single
non-trivial factor of a number n, so we can assume n is odd. So 105 = 7 15 is a successful
factorization, despite the fact that 15 is not prime.
The best known algorithm for factoring an RSA number is the number eld sieve. How-
ever, factoring appears in other cryptographic contexts as well. Given the Pohlig-Hellman
algorithm described in Section 30.3.2, we can se that it is important to be able to factor the
size of a group of the form F

q
or E(F
q
). That way we can ensure that the discrete logarithm
problem is dicult in those groups. Typically, factoring algorithms other than the number
eld sieve are used for such factorizations. For that reason, we will look at other factoring
algorithms (like those using continued fractions and elliptic curves) that are used in these
other cryptographic contexts.
Trial division is very slow, but still the fastest way of factoring integers of fewer than 15
digits.
Most of the better factoring algorithms are based on the following. For simplication
we will assume that n = pq where p and q are dierent odd primes. Say we nd x and y
such that x
2
y
2
(modn). Assume x , y(modn). Then n[x
2
y
2
so n[(x + y)(x y). So
pq[(x+y)(xy). We hope that p[(x+y) and q[(xy). If so, gcd(x+y, n) = p (and gcding
is fast) and q = n/p. If not, then n = pq[x + y or n = pq[x y so x y(mod n) and you
try again.
Note that n need not be the product of exactly two primes. In general, all the arguments
above go through for more complicated n. In general gcd(x y, n) is some divisor of n.
101
Here are some algorithms for nding x and y.
30.2.1 Fermat Factorization
This algorithm exploits the fact that small integers are more likely than large integers to be
squares. It does not help to let x = 1, 2, 3, . . . since the reduction of x
2
(mod n) is equal to x
2
.
So we need to nd x such that x
2
> n (or x >

n) and we want the reduction of x
2
(mod n)
to be small modulo n so we pick x just larger than

n.
The notation x| denotes the smallest number that is greater than or equal to x. So
1.5| = 2 and 3| = 3. First compute

n|. Then compute

_

n|
2
n. If its not an inte-
ger then compute
_
(

n| + 1)
2
n. If its not an integer then compute
_
(

n| + 2)
2
n,
etc. until you get an integer. Example. n = 3229799,

n 1797.16 so

n| = 1798.
1798
2
n = 3005, but

3005 , Z. 1799
2
n = 6602, but

6602 , Z. 1800
2
n = 10201 and

10201 = 101. Thus 1800

2
n = 101
2
and 1800
2
101
2
= n so (1800 +101)(1800 101) =
n = 1901 1699.
Fermat factorization tends to work well when n is not too much larger than a square.
30.2.2 Factor Bases
In most modern factoring algorithms (continued fraction, quadratic sieve and number eld
sieve), you want to nd xs so that the reduction of x
2
(mod n) is smooth. That is because it
is easier to multiply smooth numbers together in the hopes of getting a square. One way to
make that likely is for the reductions to be small. So you could choose x
2
near a multiple of
n. So x
2
kn for k Z and x

kn. We then create a factor base consisting of the primes

b, our smoothness bound. The best choice of b depends on some complicated number
theory. The bound b will increase with n.
We want to exploit any x
2
kn whether x
2
> kn or x
2
< kn. Now if x
2
< kn then
we should have x
2
1 l(mod n) where l is small. So we include 1 in our factor base as
well. For each x with x
2
kn, compute the reduction of x
2
(mod n). If the reduction r is
just under n, then you will instead use 1 (nr). Now factor the reduction over the factor
base using trial division. If you can not, then try another x. Continue until some product
of some subset of the reductions is a square.
Here is a simple algorithm exploiting this idea. Choose the closest integers to

kn for
k = 1, 2, . . .. The number of close integers depends on n in an ugly way. Let x be an integer
near

kn.
Example. n = 89893, use b = 20 and the four closest integers to each

kn. We have

n 299.8.
102
1 2 3 5 7 11 13 17 19
299
2
492 not factor
300
2
107 not factor
298
2
1089 1 3
2
11
2
1 0 0 0 0 0 0 0 0
301
2
708 not factor

2n 424.01
424
2
10 1 2 5 1 1 0 1 0 0 0 0 0
425
2
839 not factor
423
2
857 not factor
426
2
1690 = 2 5 13
2
0 1 0 1 0 0 0 0 0
In order to get the product of the reductions to be a square, we need to nd some
subset of the vectors on the right that sum to 0 modulo 2. We see that 298
2
424
2
426
2

1 3
2
11
2
1 2 5 2 5 13
2
(mod n). So (298 424 426)
2
(1 2 3 5

11 13)
2
(mod n). Recall
that if x
2
y
2
(mod n) and x , y(mod n) then gcd(x + y, n) is a non-trivial factor of n
Now you reduce what is inside the parentheses. We have 298 424 426 69938(mod n) and
1 2 3 5 11 13 85603(mod n). Note that gcd(69938+85603, n) = 373 and n/373 = 241.
As a note, this example is unrepresentative of the usual case in that we used each vector
that arose. You might have gotten vectors v
1
= [1, 0, 0, 0, 0, 0, 0 . . ., v
2
= [1, 1, 0, 1, 0, 0, 0 . . .,
v
3
= [0, 0, 1, 0, 1, 0, 0 . . ., v
4
= [1, 0, 0, 0, 0, 1, 0 . . ., v
5
= [0, 1, 0, 1, 0, 0, 0, . . . (where . . . means
0s). Then we would need to nd a subset whose sum is 0 modulo 2. Note that if we let M
be the matrix whose columns are v
1
, . . . , v
5
, we can compute the null space of M modulo 2.
Any non-0 vector in the null space gives a trivial linear combination of the v
i
s. The null
space of M mod 2 has (1, 1, 0, 0, 1) as a basis, so v
1
+ v
2
+ v
5
= 0 modulo 2.
There are several algorithms which improve ways of nding b
i
s so that the b
2
i
(mod n)s
are smooth. This includes the continued fraction factoring algorithm, the quadratic sieve
and the number eld sieve.
30.2.3 Continued Fraction Factoring
This was the best factoring algorithm around 1975. See Section 28.1 for an explanation of
continued fractions. It is still the fastest algorithm for factoring some medium sized integers.
We want x
2
near a multiple of n. Lets say that b/c is a convergent to

ns simple continued
fraction. Then b/c

n so b
2
/c
2
n so b
2
c
2
n so b
2
is near a multiple of n. So b
2
(modn)
is small.
Let n = 17873. The simple continued fraction expansion of

n = 133.689939 . . . starts
[133, 1, 2, 4, 2, 3, 1, 2, 1, 2, 3, 3, . . .. We will use the factor base 1, 2, 3, 5, 7, 11, 13, 17, 19, 23, 29
and omit the 0s in our chart.
1 2 3 5 7 11 13 17 19 23 29
[133] = 133 133
2
184 = 1 2
3
23 1 1 1
[133, 1] = 134 134
2
83 = n.f.
[133, 1, 2] =
401
3
401
2
56 = 1 2
3
7 1 1 1
[133, 1, 2, 4] =
1738
13
1738
2
107 = n.f.
[133, . . . , 2] =
3877
29
3877
2
64 = 1 2
6
1
[133, . . . , 3] =
13369
100
13369
2
161 = 7 23 1 1
103
Note
401
3
133.67,
1738
13
133.692,
3877
29
133.6896, etc.
(133 401 13369)
2
(1 2
3
7 23)
2
(mod n). Now 133 401 13369 1288 and
1 2
3
7 23 16585 but 1288 16585. Thats bad. It means gcd(16585 + 1288, n) = n
and gcd(16585 1288, n) = 1. So we get no factors. We continue.
1 2 3 5 7 11 13 17 19 23 29
[133, . . . , 1] =
17246
129
17246
2
77 = 1 7 11 1 1 1
[133, . . . , 2] =
47861
358
47861
2
149 = n.f.
[133, . . . , 1] =
65107
487
65107
2
88 = 1 2
3
11 1 1 1
(40138771724665107)
2
(1
2
2
6
711)
2
(mod n). Now 40138771724665107 7272
and 1
2
2
6
7 11 4928. We have 7272 4928 = 2344 and gcd(2344, n) = 293 and
n/293 = 61. Both 293 and 61 are prime.
30.2.4 H.W. Lenstra Jr.s Elliptic Curve Method of Factoring
This algorithm is often best if ns smallest prime factor is between 13 and 65 digits and the
next smallest prime factor is a lot bigger. Lets start with a motivating example.
Example. Lets use the elliptic curve y
2
= x
3
+ x + 1 to factor 221. Clearly the point
R = (0, 1) is on this elliptic curve. Modulo 221 you could compute 2R = (166, 137), 3R =
(72, 169), 4R = (109, 97), and 5R = (169, 38). To compute 6R = R + 5R, you rst nd
the slope
381
1690
=
37
169
(mod 221). So we need to nd 169
1
(mod 221). We do the Euclidean
algorithm and discover that gcd(221, 169) = 13. So 13[221 and 221/13 = 17.
What happened behind the scenes?
mod 13 mod 17
R (0,1) (0,1)
2R (10,7) (13,1)
3R (7,0) (4,16)
4R (10,6) (9,12)
5R (0,12) (16,4)
6R (10,12)
Note that 18R = (mod 17). We succeeded since modulo 13, 6R = but modulo 17,
6R ,= .
Note modulo any prime, some multiple of R is 0. End example.
For simplicity, we will consider the elliptic curve method of factoring n = pq, though the
method works for arbitrary positive integers. Choose some elliptic curve E and point R on
it modulo n. Find a highly composite number like t! (the size of t depends on n) and hope
that t!R = modulo one prime (say p) but not the other. Then gcd(denominator of the
slope used in the computation of t!R, n) = p and you get a factor.
Why t!? Theres some m with mR = 0 (mod p). If m[t! (which is somewhat likely) then
t! = lm and so t!R = lmR = l(mR) = l = .
There are two ways this can fail. 1) t!R is not mod p or q (like 2!R in the last example).
2) t!R is mod p and q so gcd(denominator,n) = n. If you fail, choose a new E and R.
With most other factoring algorithms you do not have such choices. For example, you could
use the family E : y
2
= x
3
+ jx + 1 and R = (0, 1) for various j.
104
Example. Let n = 670726081, E : y
2
= x
3
+ 1 and R = (0, 1) Then (100!)R = .
So 2) happened. Now use E : y
2
= x
3
+ x + 1 and the same R. Then (100!)R =
(260043248, 593016337). So 1) happened. Now use E : y
2
= x
3
+2x +1 and the same R. In
trying to compute (100!)R, my computer gave an error message since it could not invert 54323
(mod n). But this failure brings success since gcd(54323, n) = 54323 and n/54323 = 12347.
30.2.5 Number Fields
We will study number elds so as to have some understanding of the number eld sieve.
Let Z denote the integers, Q denote the rationals (fractions of integers), and R denote
the real numbers. Let i =

1, i
2
= 1, i
3
= i, i
4
= 1. The set C = a + bi[ a, b R is
the set of complex numbers. +ei is complex. Let f(x) = a
n
x
n
+a
n1
x
n1
+. . . +a
1
x +a
0
with a
i
Z. Then we can write f(x) = a
n
(x
1
)(x
2
) . . . (x
n
) with
i
C. The
set of
i
is unique. The
i
s are called the roots of f. is a root of f(x) if and only if
f() = 0.
Q() is called a number eld. It is all numbers gotten by combining the rationals and
using +, , , .
Example. f(x) = x
2
2 = (x+

2)(x

2). Take =

2. Q(

2) = a+b

2[ a, b Q.
Addition and subtraction are obvious in this set. (a + b

2)(c + d

2) = (ac + 2bd) + (ad +

bc)

2 Q(

2). To divide (a + b

2)/(c + d

2):
a + b

2
c + d

2
=
(a + b

2)(c d

2)
(c + d

2)(c d

2)
=
ac 2bd
c
2
2d
2
+
bc ad
c
2
2d
2

2 Q(

2).
Example. g(x) = x
3
2, = 2
1/3
. Q() = a + b 2
1/3
+ c 2
2/3
[ a, b, c Q. You
can add, subtract, multiply and divide in this set also (except by 0). The division is slightly
uglier.
Every element of a number eld is a root of a polynomial with integer coecients (a
i
Z),
which as a set are relatively prime, and positive leading coecient (a
n
> 0). The one with
the lowest degree is called the minimal polynomial of .
Example. Find the minimal polynomial of = 2
1/3
+ 1. We can be clever here. Note
( 1)
3
= 2,
3
3
2
+ 3 1 = 2,
3
3
2
+ 3 3 = 0. The minimal polynomial is
f(x) = x
3
3x
2
+ 3x 3. Clearly f() = 0 so is a root of f.
If the leading coecient of the minimal polynomial is 1 then is called an algebraic
integer. This agrees with the usual denition for rational numbers. The minimal polynomial
of 5 is 1x 5 and the minimal polynomial of 3/4 is 4x 3.
In a number eld K if = and all three are algebraic integers, then we say [. In a
number eld K, we call an algebraic integer prime if [ implies that [ or [, where
, are algebraic integers in K. Not all number elds have enough primes sadly. This
fact makes the number eld sieve dicult to implement.
For example, Q(

5) is one of the problem number elds. The integers are of the form
a+b

5 [ a, b Z. We have 6 = (1+

5)(1

5) = 2 3. Now 2 is irreducible in this

number eld; i.e. we can only factor it: 2 = 2 1 = 2 1. However 2 is not prime. Notice
that 2[(1 +

5)(1

5) but 2 ,[1 +

5 and 2 ,[1

5. What I mean by 2 ,[1 +

5
105
is that (1 +

5)/2 has minimal polynomial 2x

2
2x + 3 so it is not an algebraic integer.
Notice that we also do not have unique factorization here.
In Z, we say that we have unique factorization (as in the fundamental theorem of arith-
metic (see page 5 from the cryptography class). On the other hand 14 = 7 2 = 7 2. We
can say that 7 and 7 are associated primes because their quotient is a unit (an invertible
algebraic integer).
From now on, for simplicity, we will always work in the number eld Q(i) = a+bi[ a, b
Q. The algebraic integers in Q(i) are a + bi[ a, b Z. This set is usually denoted Z[i].
This is a well-behaved number eld. The units are 1, i. If p Z
>0
is prime, and
p 3(mod4) then p is still prime in Z[i]. If p 1(mod4) then we can write p = a
2
+b
2
with
a, b Z and then p = (a + bi)(a bi) and a + bi and a bi are non-associated primes. So
there are two primes over p. Note 17 = 4
2
+ 1
2
= (4 +i)(4 i) also 17 = (1 + 4i)(1 4i).
Thats OK since (1 4i)i = 4 +i and i is a unit so 1 4i and 4 +i are associated. We can
denote that 1 4i 4 +i. The number i is a unit since its minimal polynomial is x
2
+1, so
its an algebraic integer, and i i
3
= 1 so i[1. In fact, 1 4i 4 +i 1 + 4i 4 i and
1+4i 4i 14i 4+i (since i, 1 are units). However none of the rst four are
associated to any of the latter 4. Among associates, we will always pick the representative
of the form a bi with a b 0.
2 = (1 +i)(1 i) but (1 i)i = 1 +i so 1 i 1 +i so there is one prime (1 +i) over 2.
Let us list some primes in Z and their factorizations in Z[i]: 2 = (1 + i)
2
i
3
, 3 = 3,
5 = (2 +i)(2 i), 7 = 7, 11 = 11, 13 = (3 +2i)(3 2i), 17 = (4 +i)(4 i), 19 = 19, 23 = 23,
29 = (5 + 2i)(5 2i), 31 = 31, 37 = (6 + i)(6 i).
There is a norm map Q(i)
N
Q by N(a + bi) = a
2
+ b
2
so N(2 + i) = 5, N(7) = 49.
If a + bi Z[i], p is a prime in Z and p[N(a + bi) (so p[a
2
+ b
2
) then a prime lying over p
divides a + bi. This helps factor algebraic integers in Z[i].
Factor 5 +i. Well N(5 +i) = 26 so all factors are in the set i, 1 +i, 3 +2i, 3 2i. Now
3 + 2i[5 + i if (5 + i)/(3 + 2i) is an integer.
5 + i
3 + 2i
_
3 2i
3 2i
_
=
17
13
+
7
13
i
so 3 + 2i ,[5 + i.
5 + i
3 2i
_
3 + 2i
3 + 2i
_
=
13
13
+
13
13
i = 1 + i
so (5 + i) = (3 2i)(1 + i).
Factor 7 + i. Well N(7 + i) = 50 = 2 5
2
. (7 + i)/(2 + i) = 3 i and N(3 i) = 10.
(3i)/(2+i) = (1i) and N(1i) = 2. (1i)/(1+i) = i = i
3
so 7+i = i
3
(1+i)(2+i)
2
.
The following is even more useful for factoring in Z(i). If a +bi Z[i] and gcd(a, b) = 1
and N(a + bi) = p

1
1
. . . p

r
r
where the p
i
s are positive prime numbers then p
i
, 3(mod4)
and a + bi = i

1
1
. . .

r
r
where
i
is one or the other of the primes over p
i
. You never
get both primes over p
i
showing up.
In the last case, N(7 + i) = 2
1
5
2
. So we know that 7 + i = i

0
(1 + i)
1
(2 i)
2
. So
we need only determine
0
and . Heres another example. N(17 6i) = 325 = 5
2
13 so
17 6i = i

0
(2 i)
2
(3 2i), and the s need not agree.
If and are elements of Q(i) then N() = N()N().
106
30.2.6 The Number Field Sieve
The number eld sieve (Pollard, Adleman, H. Lenstra) is currently the best known factoring
algorithm for factoring a number n if n > 10
130
and the smallest prime dividing n is at least
10
65
. RSA numbers are of this type. The number RSA-193 was factored in 2005 using the
number eld sieve. That number has 193 digits.
Choose a degree d (it depends on n, d
_
ln(n)/ln ln(n)). Let m =
d

n| and expand n in
base m. So n = m
d
+a
d1
m
d1
+. . .+a
0
with 0 a
i
< m. Let f(x) = x
d
+a
d1
x
d1
+. . .+a
0
.
Let be a root of f. We work in Q().
Lets factor 2501. We have
_
ln(n)
ln(ln(n))
1.95 so we let d = 2.

2501| = 50 and
2501 = 50
2
+ 1 so f(x) = x
2
+ 1 a root of which is i. Note 50 acts like i in Z/2501Z since
50
2
1(mod2501). Dene maps h : Z[i] Z by h(a+bi) = a+b50 and

h : Z[i]Z/2501Z
by

h(a+bi) = a+b50(mod 2501). The map

h has the properties that

h(+) =

h()+

h()
and

h() =

h()

h() for all , Z[i]. The map h has the former, but not the latter
property.
Find numbers of the form = a +bi with a, b Z, a 0, b ,= 0 and gcd(a, b) = 1 where
a +bi is smooth in Z[i] and h(a +bi) is smooth in Z. These are needles in a haystack, which
is why factoring is still dicult. We need to nd
1
, . . . ,
r
where
1

2

r
=
2
in Z[i]
and h(
1
)h(
2
) h(
r
) = t
2
in Z.
Let us explain how this helps. We have h()
2
= h()h()

h()

h()

h(
2
)

h(
1

2

r
)

h(
1
)

h(
r
) h(
1
) h(
r
) = t
2
. Now reduce h() and t mod n (both
are in Z). Now h())
2
t
2
(mod n). If we have h() , t(mod n), then gcd(h() + t, n) is
a non-trivial factor of n.
Now lets factor 2501 with the number eld sieve. Well use the factor base i, 1 + i, 2
i, 32i, 4i, 52i for the algebraic integers. These lie over 1, 2, 5, 13, 17, 29. The primes 3, 7,
13 are not in the factorbase since they do not exploit the h map and so give no information.
Well use the factor base
1, 2, 3, 5, 7, 11, 13, 17, 19, 23, 29 for the integers. We have h(a + bi) = a + b 50.
107
factor h() factor h()
i = i 50 = 2 5
2
1 + i = 1 + i 51 = 3 17
2 + i = 2 + i 52 = 2
2
13
4 + i = 4 + i 54 = 2 3
3

7 + i = i
3
(1 +i)(2 + i)
2
57 = 3 19
1 i = i
3
(1 + i) 49 = 1 7
2

2 i = 2 i 48 = 1 2
4
3
4 i = 4 i 46 = 1 2 23
5 i = i
3
(3 + 2i)(1 + i) 45 = 1 3
2
5
8 i = (3 2i)(2 + i) 42 = 1 2 3 7
5 + 2i = 5 + 2i 105 = 3 5 7
1 2i = i
3
(2 + i) 99 = 1 3
2
11
9 2i = (4 + i)(2 i) 91 = 1 7 13
5 2i = 5 2i 95 = 1 5 19
5 3i = i
3
(1 +i)(4 + i) 145 = 1 5 29
3 + 4i = (2 + i)
2
203 = 7 29
2 + 5i = i(5 2i) 252 = 2
2
3
2
7
3 + 5i = (4 + i)(1 + i) 253 = 11 23
3 5i = i
3
(1 +i)(4 i) 247 = 1 13 19
These s would be stored as vectors with entries mod 2. So the last one would be
3 5i (1, 1, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0) corresponding to
(i, 1 +i, 2 +i, 2 i, 3 + 2i, 3 2i, 4 +i, 4 i, 5 + 2i, 5 2i, 1, 2, 3, 5, 7, 11, 13, 17, 19, 23, 29).
Then do linear algebra to nd relations. We nd found that if we add all the vectors with s
you get the 0 vector. So multiplying the corresponding s we get a square in the algebraic
integers and multiplying the corresponding h()s we get a square in the integers. The
product of the starred algebraic integers is i
12
(1 +i)
4
(2 +i)
4
(4 +i)
2
(4 i)
2
and the product
of the corresponding integers is (1)
4
2
4
3
6
7
2
11
2
13
2
19
2
23
2
.
Let
= i
6
(1 +i)
2
(2 + i)
2
(4 +i)(4 i) = 136 102i.
So h() = 136 102 50 = 4964 38(mod 2501).
Let t = (1)
2
2
2
3
3
7 11 13 19 23 = 47243096 1807(mod 2501).
Thus 38
2
1444 1807
2
(mod 2501). gcd(1807 38, 2501) = 61 and 2501/61 = 41 so
2501 = 61 41.
The word sieve refers to a way of choosing only certain s that have a higher probability
of being smooth and having h() be smooth. For example, a number n with 1 n 1000
that is divisible by 36 has a higher chance of being 11-smooth than an arbitrary number in
that range. You can nd conditions on a and b, modulo 36, to guarantee that h(a +bi) is a
multiple of 36.
108
30.3 Solving the Finite Field Discrete Logarithm Problem
We will look at two methods for solving the FFLDP. The rst is the Pollig-Hellman method
which is useful if the size of F

q
is smooth. Note, this algorithm can be adapted to solving
the ECDLP as well. The second is the index calculus method, for which there is no known
adaptation to the ECDLP.
30.3.1 The Chinese Remainder Theorem
First we need to learn the Chinese Remainder Theorem. Let m
1
, m
2
, . . . , m
r
be pairwise
co-prime (gcd=1) integers. The system of congruences x a
1
(modm
1
), x a
2
(modm
2
),
. . . ,x a
r
(modm
r
) has a unique solution x(modm
1
m
2
. . . m
r
). Example: If x 1(mod7)
and x 2(mod4), then x 22(mod28). In words, you could say that if you know something
modulo m and you know it also modulo n then you can know it modulo mn.
Here is a cute example. If we square 625
2
= 390625. In fact, if the last three digits
of any positive integer are 000, 001 or 625 and you square it, the square will have that
property. Are there any other 3 digit combinations with that property? We want to solve
x
2
x(mod 1000). Instead we can solve x
2
x(mod 8) and x
2
x(mod 125). Clearly
x 0, 1(mod 8) and x 0, 1(mod 125) work. So we get four solutions x 0(mod 8) and
x 0(mod 125) so x 0(mod 1000), x 1(mod 8) and x 1(mod 125) so x 1(mod 1000),
x 1(mod 8) and x 0(mod 125) so x 625(mod 1000), x 0(mod 8) and x 1(mod 125)
so x 376(mod 1000). Indeed 376
2
= 141376. End cute example.
Here is an algorithm for nding such an x. We want a term that is a
1
(modm
1
) and 0
mod the rest of the m
i
s. So we can use the term a
1
m
2
m
3
. . . m
r
b
1
where m
2
m
3
. . . m
r
b
1

1(modm
1
) so let b
1
= (m
2
. . . m
r
)
1
(modm
1
). We want a term that is a
2
(modm
2
) and 0 mod
the rest. Use a
2
m
1
m
3
m
4
. . . m
r
b
2
where b
2
= (m
1
m
3
m
4
. . . m
r
)
1
(modm
2
), etc. So
x = (a
1
m
2
m
3
. . . m
r
b
1
) + (a
2
m
1
m
3
. . . m
r
b
2
) + . . . + (a
r
m
1
m
2
. . . m
r1
b
r
)(modm
1
m
2
. . . m
r
).
Example: Solve x 2(mod3), x 3(mod5), x 9(mod11).
b
1
= (5 11)
1
(mod3) = 1
1
(mod3) = 1
b
2
= (3 11)
1
(mod5) = 3
1
(mod5) = 2
b
3
= (3 5)
1
(mod11) = 4
1
(mod11) = 3
so x = 2(5 11)1 + 3(3 11)2 + 9(3 5)3 = 713 53(mod165).
Aside: Using the Chinese Remainder Theorem to speed up RSA decryption
Let n = pq. Assume M
e
C(mod n). Then decryption is the computation of C
d

M(mod n) which takes time O(log

3
(n)). This is a slow O(log
3
(n)). Instead, let M(mod p) =
M
p
, M(mod q) = M
q
, C(mod p) = C
p
, C(mod q) = C
q
, ((ask them for modulus:)) d(mod p
1) = d
p
, d(modq 1) = d
q
. We have M
p
, M
q
, C
p
, C
q
, d
p
, d
q
< 2n
1/2
. You can pre-compute
d
p
and d
q
. The reductions C
p
and C
q
take time O(log
2
(n
1/2
)), which will be insignicant.
Computing C
d
p
p
(mod p) = M
p
and C
d
q
q
(mod q) = M
q
each take time O(log
3
(n
1/2
). So each
of these computations takes ((ask them)) 1/8 as long as computing C
d
(mod n). Using the
Chinese remainder theorem to determine M from M
p
(mod p) and M
q
(mod q) takes time
O(log
3
(n
1/2
)), but is slower than computing C
d
p
p
M
p
(mod p). In practice, the two repeated
squares modulo p and q and using the Chinese remainder theorem algorithm take about half
as long as computing C
d
M(mod n).
109
30.3.2 The Pollig-Hellman algorithm
First a rigorous and then an imprecise denition. Let r be a positive integer. An integer
n is r-smooth if all of the prime divisors of n are r. So one million is 6 smooth. An
integer is said to be smooth if all of its prime divisors are relatively small, like one million
or 2520 = 2
3
3
2
5 7.
The Pohlig-Hellman algorithm is useful for solving the discrete logarithm problem in a
group whose size is smooth. It can be use in F

q
where q is a prime number or the power
of a prime in general. It only works quickly if q 1 is smooth. So for discrete logarithm
cryptosystems, q should be chosen so that q 1 has a large prime factor. First I will show
the algorithm, then give an example of the algorithm, then explain why it works.
Let g be a generator of F

q
. We are given y F

q
and we want to solve g
x
= y for x. Let
q 1 = p

1
1
. . . p

r
r
where the p
i
s are primes. For each prime p
i
, we want to nd a solution
of z
p
i
= 1 (with z ,= 1) in F

q
. Such a solution is called a primitive p
i
th root of unity and is
denoted
p
i
. Recall for any w F

q
, we have w
q1
= 1. Since q 1 is the smallest power of
g giving 1, we see that
p
i
= g
(q1)/p
i
is a primitive p
i
th root of unity.
For each prime p
i
we precompute all solutions to the equation z
p
i
= 1. These are
0
p
i
= 1,

1
p
i
, . . .,
p
i
1
p
i
. These values are stored with the corresponding exponents of
p
i
.
Recall that in F

q
, exponents work mod q 1. So once we nd x(modp

i
i
) we can use the
Chinese Remainder Theorem to nd x. So now we want to nd x(modp

) (where we drop the

subscript). Lets say we write x (reduced mod p

) in base p. Mind you we dont yet know how

to do this, but the base p expansion does exist: x

= x
0
+x
1
p+x
2
p
2
+. . . +x
1
p
1
(mod p

),
with 0 x
i
< p. Now we start determining the x
i
s. Note if we are dealing with Alices
private key, then Alice knows x and the x
i
s and Eve does not know any of them (yet).
Find y
(q1)/p
(modq). Its in the list of
i
p
. We have y
(q1)/p

x
0
p
(modq). Now we know x
0
.
Let y
1
y/(g
x
0
)(modq). Find y
(q1)/p
2
1

x
1
p
(modq). Now we know x
1
.
Let y
2
y/(g
x
0
+x
1
p
). Find y
(q1)/p
3
2

x
2
p
. Now we know x
2
.
Let y
3
y/(g
x
0
+x
1
p+x
2
p
2
). Find y
(q1)/p
4
3

x
3
p
. Now we know x
3
. Etc.
Lets do an example. Let q = 401, g = 3 and y = 304. We want to solve 3
x
=
304(mod401). We have q 1 = 2
4
5
2
. First nd x(mod16). First we pre-compute g
(400/2)
=

2
=
1
2
= 400 and
2
2
=
0
2
= 1 (this is all mod 401). We have x = x
0
+x
1
2+x
2
4+x
3
8(mod16)
and want to nd the x
i
s.
y
(q1)/p
= 304
400/2
400(mod401) =
1
2
so x
0
= 1.
y
g
x
0
= 304/3
1
235(mod401) = y
1
. y
(q1)/p
2
1
= 235
400/(2
2
)
400 =
1
2
so x
1
= 1.
y
g
x
0
+x
1
p
= 304/(3
1+12
) 338 = y
2
. y
(q1)/p
3
2
= 338
400/(2
3
)
1 =
0
2
so x
2
= 0.
y
g
x
0
+x
1
p+x
2
p
2
= 304/(3
1+12+04
) 338 = y
3
. y
(q1)/p
4
3
= 336
400/(2
4
)
400 =
1
2
so x
3
= 1.
Thus x = 1 +1 2 +0 4 +1 8 = 11(mod16). This was four steps instead of brute forcing 2
4
.
Now we nd x(mod25). First we pre-compute g
400/5
=
5
= 72,
2
5
= 372,
3
5
= 318,

4
5
= 39, and
5
5
=
0
5
= 1. We have x = x
0
+ x
1
5(mod25).
y
(q1)/p
= 304
400/5
372 =
2
5
so x
0
= 2.
y/(g
x
0
) = 304/(3
2
) 212 = y
1
. y
(q1)/p
2
1
= 212
400/5
2
318 =
3
5
so x
1
= 3.
110
Thus x 2 + 3 5 = 17(mod25). This was two steps instead of brute forcing 5
2
. If x
11(mod16) and 17(mod25) then, from the Chinese Remainder Theorem algorithm x = 267.
So 3
267
= 304(mod401). We have a total of 2 + 4 + 5 + 2 = 13 steps (the 2 and 5 are from
pre-computing) instead of brute forcing 400 = 2
4
5
2
.
Why does this work? Lets look at a simpler example. Let q = 17, g = 3. We have
q 1 = 16 = 2
4
. 3
18
= 16 =
1
2
and 3
08
= 1 =
0
2
.
Note that w
16
1(mod 17) for any 1 w 16. We have 3
11
7(mod 17) and assume
that 11 is unknown. So 3
1+12+04+18
7(mod 17).
same, but
know not know
7, 7
8
16 = (3
8
)
1
3
1+12+04+18
, 3
18+16n
= 3
18
(3
16
)
n
= (3
8
)
1
7
3
1
, (
7
3
1
)
4
= 16 = (3
8
)
1
3
12+04+18
, 3
18+16n
= (3
8
)
1
7
3
1+12
, (
7
3
1+12
)
2
= 1 = (3
8
)
0
3
04+18
, 3
08+16n
= (3
8
)
0
7
3
1+12+04
, (
7
3
1+12+04
)
1
= 16 = (3
8
)
1
3
18
= (3
8
)
1
Lets say that q 1 = 2
200
. Then Pollards algorithm would take 2
100
steps and this
would take 2 + 100 steps.
30.3.3 The Index Calculus Algorithm
The index calculus algorithm is a method of solving the discrete logarithm problem in elds
of the type F
q
, where q is prime, or a prime power. We will do an example in a eld of the
form F
2
d. For homework you will do an example in a eld of the form F
p
for p a prime.
Recall F
2
[x]/(x
3
+ x + 1) = a
0
+ a
1
x + a
2
x
2
[a
i
F
2
. We can call this eld F
8
. We
have 2 = 0 and x
3
+ x + 1 = 0 so x
3
= x 1 = x + 1. F

8
is F
8
without the 0. There are
8 1 = 7 elements of F

8
and they are generated by x. We see x
1
= 1, x
2
= x
2
, x
3
= x + 1,
x
4
= x
2
+x, x
5
= x
2
+x + 1, x
6
= x
2
+ 1 and x
7
= 1. Note x
12
= x
7
x
5
= x
5
so exponents
work modulo 7 (= #F

8
).
Recall log
b
m = a means b
a
= m so log
x
(x
2
+ x + 1) = 5 since x
5
= x
2
+ x + 1. We
will usually drop the subscript x. The logs give exponents so the logs work mod 7. Note
(x
2
+1)(x +1) = x
2
. Now log(x
2
+1)(x +1) = log(x
2
+1) +log(x +1) = 6 +3 = 9 whereas
log(x
2
) = 2 and thats OK since 9 2(mod7).
Lets do this in general. Let f(x) F
2
[x] have degree d and be irreducible mod 2. We
have F
q
= F
2
[x]/(f(x)) where q = 2
d
. Lets say g generates F

q
. If g
n
= y we say log
g
y = n
or logy = n. We have log(uv) log(u) +log(v)(modq 1) and log(u
r
) rlog(u)(modq 1).
The discrete log problem in F

q
is the following. Say g
n
= y. Given g and y, nd n mod
q 1, i.e. nd n = log
g
y. Note log
g
g = 1.
For the index calculus algorithm, choose m with 1 < m < d (how these are chosen is
based on dicult number theory and statistics, for d = 127, choose m = 17).
Part 1. Let h
1
, . . . , h
k
be the set of irreducible polynomials in F
2
[x] of degree m.
Find the log of every element of h
i
. To do this, take powers of g like g
t
and hope g
t
=
h

1
1
h

2
2
. . . h

k
k
(some of the
i
s may be 0). In other words, we want g
t
to be m-smooth.
Log both sides. We get t =
1
log(h
1
) + . . . +
r
log(h
r
). Thats a linear equation in log(h
i
)
(the only unknowns). Find more such linear equations until you can solve for the log(h
i
)s.
Once done, all of the a
i
= log(h
i
) are known.
111
Part 2. Compute y(g
t
) for various t until yg
t
= h

1
1
. . . h

r
r
. Then logy + tlogg =

1
logh
1
+. . . +
r
logh
r
or logy +t =
1
a
1
+. . . +
r
a
r
. The only unknown here is logy. When
working in a nite eld, people often use ind instead of log.
Heres an example. ((See the handout))
Let f(x) = x
11
+x
4
+x
2
+x+1. This is irreducible mod 2. Work in the eld F
2
[x]/(f(x)) =
F
q
where q = 2
11
. We note g = x is a generator for F

q
. Well choose m=4.
We want to solve g
n
= y = x
9
+ x
8
+ x
6
+ x
5
+ x
3
+ x
2
+ 1 for n. I.e. nd log(y). The
rst part has nothing to do with y. Let
1 = log(x) a = log(x + 1) c = log(x
2
+ x + 1) d = log(x
3
+ x + 1)
e = log(x
3
+ x
2
+ 1) h = log(x
4
+ x + 1) j = log(x
4
+ x
3
+ 1) k = log(x
4
+ x
3
+ x
2
+ x + 1).
We search through various g
t
s and nd
g
11
= (x + 1)(x
3
+ x
2
+ 1) 11 = a + e(mod 2047 = q 1)
g
41
= (x
3
+ x
2
+ 1)(x
3
+ x + 1)
2
41 = e + 2d
g
56
= (x
2
+ x + 1)(x
3
+ x + 1)(x
3
+ x
2
+ 1) 56 = c + d + e
g
59
= (x + 1)(x
4
+ x
3
+ x
2
+ x + 1)
2
59 = a + 2k
g
71
= (x
3
+ x
2
+ 1)(x
2
+ x + 1)
2
71 = e + 2c
Note that although we have four relations in a, c, d, e (the rst, second, third and fth), the
fth relation comes from twice the third minus the second, and so is redundant. Thus we
continue searching for relations.
g
83
= (x
3
+ x + 1)(x + 1)
2
, 83 = d + 2a.
Now the rst, second, third and the newest are four equations (mod 2047) in four un-
knowns that contain no redundancy. In other words, the four by four coecient matrix for
those equations is invertible modulo 2047. We solve and nd a = 846, c = 453, d = 438,
e = 1212. Now we can solve for k: k = (59 a)/2(modq 1) = 630. Now lets nd h and j.
So we need only look for relations involving one of those two.
g
106
= (x + 1)(x
4
+ x
3
+ 1)(x
4
+ x
3
+ x
2
+ x + 1) so 106 = a + j + k and j = 677.
g
126
= (x
4
+ x + 1)(x
4
+ x
3
+ x
2
+ x + 1)(x + 1)
2
so 126 = h + k + 2a and h = 1898.
So a = 846, c = 453, d = 438, e = 1212, h = 1898, j = 677, k = 630.
Now move onto the second part. We compute yg
t
for various ts. We nd y(g
19
) =
(x
4
+ x
3
+ x
2
+ x + 1)
2
. So log(y) + 19log(g) = 2k. Recall log(g)=log(x)=1. So log(y)
= 2k 19 1241 mod 2047 and so x
1241
= y.
The number eld sieve can be combined with the index calculus algorithm. As a result,
the running time for solving the FFDLP is essentially the same as for factoring.
112
Appendix A. ASCII Encoding
ASCII
00100000 32 8 00111000 56 P 01010000 80 h 01101000 104
! 00100001 33 9 00111001 57 Q 01010001 81 i 01101001 105

00100010 34 : 00111010 58 R 01010010 82 j 01101010 106

# 00100011 35 ; 00111011 59 S 01010011 83 k 01101011 107
$ 00100100 36 < 00111100 60 T 01010100 84 l 01101100 108
% 00100101 37 = 00111101 61 U 01010101 85 m 01101101 109
& 00100110 38 > 00111110 62 V 01010110 86 n 01101110 110

00100111 39 ? 00111111 63 W 01010111 87 o 01101111 111

( 00101000 40 @ 01000000 64 X 01011000 88 p 01110000 112
) 00101001 41 A 01000001 65 Y 01011001 89 q 01110001 113
00101010 42 B 01000010 66 Z 01011010 90 r 01110010 114
+ 00101011 43 C 01000011 67 [ 01011011 91 s 01110011 115
, 00101100 44 D 01000100 68 01011100 92 t 01110100 116
- 00101101 45 E 01000101 69 ] 01011101 93 u 01110101 117
. 00101110 46 F 01000110 70 01011110 94 v 01110110 118
/ 00101111 47 G 01000111 71 01011111 95 w 01110111 119
0 00110000 48 H 01001000 72 01100000 96 x 01111000 120
1 00110001 49 I 01001001 73 a 01100001 97 y 01111001 121
2 00110010 50 J 01001010 74 b 01100010 98 z 01111010 122
3 00110011 51 K 01001011 75 c 01100011 99 01111011 123
4 00110100 52 L 01001100 76 d 01100100 100 [ 01111100 124
5 00110101 53 M 01001101 77 e 01100101 101 01111101 125
6 00110110 54 N 01001110 78 f 01100110 102 01111110 126
7 00110111 55 O 01001111 79 g 01100111 103
References
[1] Beutelspacher, A., Cryptology. Washington: The Mathematical Association of America,
1994.
[2] Blum, L., Blum, M. & Shub, M., Comparison of two pseudo-random number generators.
in Conf. Proc. Crypto 82, 1982, 6178.
[3] Brassard, G., Modern cryptology: A tutorial. Lecture Notes in Computer Science 325,
New York: Springer-Verlag, 1994.
[4] Chaum, D., Carback, R., Clark, J., Essex, A., Popoveniuc, S., Rivest, R.L., Ryan,
P.Y.A., Shen, E., Sherman, A.T., Scantegrity II: End-to-end veriability for op-
tical scan election systems using invisible ink conrmation codes, Proceedings of
USENIX/ACCURATE EVT 2008.
[5] Koblitz, N., A course in number theory and cryptography. New York: Springer Verlag,
1987.
113
[6] Konheim, A.G., Cryptography: A primer. New York: John Wiley & Sons, Inc., 1981.
[7] Matsui, M., Linear cryptanalysis method for DES cipher. In Advances in Cryptography
- Eurocrypt 93, Springer-Verlag, Berlin, 1993, 386 - 397.
[8] Pomerance, C., The number eld sieve. Mathematics of Computation, 1943 - 1993: a
half century of computional mathematics (Vancouver, BC, 1993), Proc. Sympos. Appl.
Math., 48, Amer. Math. Soc. Providence, RI 1994, 465 - 480.
[9] Schneier, B., Applied cryptography. New York: John Wiley & Sons, Inc., 1996.
[10] RSA Laboratories, Answers to frequently asked questions about todays cryptography,
version 3.0. RSA Data Security, Inc., 1996.
114