Crypto CH 3 ECE

Cryptography and
Network Security
Chapter- 3
Asymmetric (public) key
cryptography
Public Key
Cryptography
Every Egyptian received two names, which were
known respectively as the true name and the
good name, or the great name and the little
name; and while the good or little name was
made public, the true or great name appears to
have been carefully concealed.
—The Golden Bough, Sir James George Frazer
2
Private-Key Cryptography
From its earliest beginnings to modern times,
virtually all cryptographic systems have been
based on the elementary tools of substitution and
permutation, and can be classed as
private/secret/single key (symmetric) systems.
All classical, and modern block and stream
ciphers are of this form.
traditional private/secret/single key
cryptography uses one key
shared by both sender and receiver
if this key is disclosed communications are
compromised
also is symmetric, parties are equal
3
hence does not protect sender from receiver
forging a message & claiming is sent by sender
Why Public-Key
Cryptography?
• developed to address two key issues:
• key distribution – how to have secure
communications in general without
having to trust a KDC(key distribution
center) with your key
• digital signatures – how to verify a
message comes intact from the claimed
sender
• public invention due to Whitfield Diffie &
Martin Hellman at Stanford University in
1976 4
Public-Key Cryptography
• public-key/two-key/asymmetric cryptography
involves the use of two keys:
• a public-key, which may be known by anybody, and
can be used to encrypt messages, and verify
signatures
• a related private-key, known only to the recipient,
used to decrypt messages, and sign (create)
signatures
• It is computationally infeasible to determine the
decryption key given only knowledge of the
cryptographic algorithm and the encryption key.
• is asymmetric because
• those who encrypt messages or verify signatures
cannot decrypt messages or create signatures
7
Symmetric vs Public-Key
Public-Key Cryptosystems
• With the message X and the encryption key PUb as

input, A forms the ciphertext Y : 9
• Y = E(PUb, X)
• Provides secrecy (confidentiality)
• Y = E(PRa, X)
• X = D(PUa, Y) 10
• the entire encrypted message serves as a digital
signature and this provides Authentication
• Z = E(PUb, E(PRa, X))

• X = D(PRb, D(PUa, Z))
• To provide both the authentication function and confidentiality have a double use of
the public-key scheme as shown in the figure.
Public-Key Applications
• can classify the use of public-key cryptosystems into
the three categories:
• encryption/decryption (provide secrecy)
• digital signatures (provide authentication)
• key exchange (of session keys)
• some algorithms are suitable for all uses, others are
specific to one
Public-Key Requirements
• Public-Key algorithms rely on two keys
where:
• it is computationally infeasible to find decryption
key knowing only algorithm & encryption key
• it is computationally easy to en/decrypt messages
when the relevant (en/decrypt) key is known
• either of the two related keys can be used for
encryption, with the other used for decryption
(for some algorithms)
• these are formidable requirements which only a few
algorithms have satisfied
Security of Public Key
Schemes
Public key schemes are no more or less secure than
private key schemes. In both cases the size of the key
determines the security.
like private key schemes brute force exhaustive
search attack is always theoretically possible
the key size must be large enough to make brute-
force attack impractical but small enough for
practical encryption and decryption.
Another form of attack is to find some way to compute
the private key given the public key.
- requires the use of very large numbers
- hence it is slow compared to private key
schemes
Confidentiality using Symmetric
Encryption
• Confidentiality using Symmetric Encryption
• Link encryption: encrypts all the data along a
specific communication path. Not only is the user
information encrypted, but the header, trailers,
addresses, and routing data that are part of the
15
packets are also encrypted.
• Link encryption provides protection against
packet sniffers and eavesdroppers.
• All of the information is encrypted, and the
packets must be decrypted at each hop so the
router, or other intermediate device, knows
where to send the packet next.
• Link encryption occurs at the data link and
physical layers
Confidentiality using Symmetric
Encryption
• End-to-end encryption : the headers, addresses,

routing, and trailer information are not
encrypted, enabling attackers to learn more
about a captured packet and where it is headed.
• There is a difference between link encryption
and end-to-end encryption in that , link
encryption encrypts and decrypts all traffic at
each end of a communication line , whereas
with end-to-end encryption the message is
encrypted by the sender at the point of origin
and only decrypted by the intended reader
16
Link encryption
• Advantages
• Headers, addresses, and routing information are
encrypted, and therefore are protected.
• Traffic analysis is difficult since links operates
continuously and carries an unvarying level of
traffic
17
• Disadvantages
• The message is vulnerable at each switch
• Key distribution and management are more
complex because each hop device must receive a
key, and when the keys change, each must be
updated.
End-to-end encryption
• Advantages
• End-to-end encryption relieves the user of
concerns about the degree of security of links
and network
• End-to-end decryption provides a degree of
18
authentication
• Disadvantages
• Only the application layer data is encrypted
(headers are transmitted in clear text)
RSA
• by Rivest, Shamir & Adleman of MIT in

1977 best known & widely used public-key
scheme based on exponentiation in a finite
(Galois) field over integers modulo a prime)
19
• uses large integers (eg. 1024 bits)
• security due to cost of factoring large

numbers
RSA Key Setup
Each user generates a public/private key pair by:
selecting two large primes at random: p, q
 computing their system modulus n=p.q
 Calculate ø(n)=(p-1)(q-1)
 selecting at random the encryption key e
where 1<e<ø(n), gcd(e,ø(n))=1 i.e
Must be a prime
Must be less than a totient
Must not be a factor of the totient
RSA Key Setup(...)
 solve following equation to find decryption

key d e.d=1 mod ø(n) and 0≤d≤n
 The product of D and E divided by Totient
must result in remainder of 1 i.e
d*e modø(n) = 1
 publish their public encryption key: PU={e,n}
 keep secret private decryption key: PR={d,n}
RSA Example - Key Setup
1. Select primes: p=17 & q=11
2. Calculate n = pq =17 x 11=187
3. Calculate ø(n)=(p–1)(q-1)=16x10=160
4. Select e: gcd(e,160)=1; choose e=7
5. Determine d: de=1 mod 160 and d < 160
Value is d=23 since 23x7=161= 10x160+1
6. Publish public key PU={7,187}
7. Keep secret private key PR={23,187}
RSA Example - En/Decryption
 sample RSA encryption/decryption is:
 given message M = 88 (nb. 88<187)
 encryption:
C = 887 mod 187 = 11
 decryption:
M = 1123 mod 187 = 88
Diffie-Hellman Key Exchange
 first public-key type scheme proposed by Diffie &
Hellman in 1976 along with the exposition of public
key concepts
 is a practical method for public exchange of a secret
key
 used in a number of commercial products
 a public-key distribution scheme

cannot be used to exchange an arbitrary message

rather it can establish a common key

known only to the two participants
 value of key depends on the participants (and their
private and public key information)
 based on exponentiation in a finite (Galois) field
(modulo a prime or a polynomial) - easy
 security relies on the difficulty of computing discrete
logarithms (similar to factoring) – hard
Diffie-Hellman Setup
 all users agree on global parameters:

large prime integer or polynomial q

a being a primitive root mod q
 each user (eg. A) generates their key
 chooses a secret key (number): xA < q
xA

compute their public key: yA = a mod q
 each user makes public that key yA
 shared session key for users A & B is KAB:
x x
KAB = a A. B mod q
xB
= yA mod q (which B can compute)
xA
= yB mod q (which A can compute)
 KAB is used as session key in private-key
encryption scheme between Alice and Bob
 if Alice and Bob subsequently communicate,
they will have the same key as before, unless
they choose new public-keys
Diffie-Hellman Example
 users Alice & Bob who wish to swap keys:
 agree on prime q=353 and a=3
 select random secret keys:

A chooses xA=97, B chooses xB=233
 compute respective public keys:
97

yA=3 mod 353 = 40 (Alice)
233

yB=3 mod 353 = 248 (Bob)
 compute shared session key as:
xA 97

KAB= y B mod 353 = 248 = 160 (Alice)
xB 233

KAB= y A mod 353 = 40 = 160 (Bob)

Crypto CH 3 ECE

Uploaded by

Copyright:

Available Formats

Crypto CH 3 ECE

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Crypto CH 3 ECE

Uploaded by

Copyright:

Available Formats

Cryptography and

• With the message X and the encryption key PUb as

• Z = E(PUb, E(PRa, X))

• End-to-end encryption : the headers, addresses,

• by Rivest, Shamir & Adleman of MIT in

• security due to cost of factoring large

 solve following equation to find decryption

You might also like