CSE 291-I: Applied

Nadia Heninger UCSD

Spring 2020 Lecture 11 Legal Notice

The Zoom session for this class will be recorded and made available asynchronously on Canvas to registered students. Announcements

1. HW 5 is due Wednesday!

2. HW 6 will be online this afternoon! Last time: RSA •

This time: Attacks on RSA • CCA security • Reminder: Textbook RSA

Key Generation: • 1. N = pq 2. Choose e s.t. gcd(e, (N)) = 1

1 = ) 3. d = e mod (N) Le more ECN 4. pk =(N, e), sk =(N, d). Encryption: c = me mod N • d te Decryption: m = c mod N = c mod N •

pk =(N, e)

c = me mod N

m = cd mod N Textbook RSA is insecure

Small e attack: If e = 3andm < N1/3, m = c1/3 over Z.

no modN - ⇒ 2048- sit N m is 256 bitAES e.s .

- time cube roots our Z : poly known to be efficient cube roots over EINE : not " rub ( RSA assumption taking elm moan is hard)

Conclusion : mod N for RSA required security. Textbook RSA is insecure

Small e with Chinese Remainder Theorem Assume three parties have RSA keys with e = 3:

(3, N1)(3, N2)(3, N3) And the same (full-length) message is encrypted to each:

3 3 3 c1 = m mod N1 c2 = m mod N2 c3 = m mod N3 Use the Chinese remainder theorem to reconstruct

c m3 mod N N N ⌘ 1 2 3 3 Now since m < N1N2N3 we are in the same situation as before.

over 7L £3 am . Textbook RSA is insecure

Meet-in-the-middle attack for random m Input c. Compute x = c/r e mod N for r from 1,...,pm. • i Compute y = se mod N for s from 1,...,pm. • i If y = x return r s.=Ck mod N • i j · If m = r s, me = r e se . · · For a randomly chosen m, good probability it has no large factors. RSA Key Generation Vulnerabilities

Common moduli, different exponents

If pk1 =(e1, N) and pk2 =(e2, N)

Factorization of N reveals d = e 1 mod (p 1)(q 1) for any e. RSA Key Generation Vulenrabilities

Common moduli, different exponent and encryption

Let pk1 =(e1, N) and pk2 =(e2, N).

Encrypt the same m to both keys above:

e1 e2 c1 = m mod Nc2 = m mod N

If gcd(e1, e2)=1computeae1 + be2 = 1

a b e1a e2b c1 c2 = m m = m mod N RSA is homomorphic under multiplication

If we have a ciphertext c = me mod N, can forge encryption of mr by computing

cr e mod N = me r e mod N =(mr)e mod N

Implications:

Positive use: blinding. Can blind before decryption • to try to prevent side-channel attacks, or blind signatures before signing. (More later.)

Negative use: Chosen ciphertext attacks. • Chosen Ciphertext Attack Game for Public-Key Encryption

Mt sk) Cpk,

Definition (Enc, Dec) is CCA-secure if Pr[A = 1 b = 0] Pr[A = 1 b = 1] is negligible. | | | | Chosen ciphertext attack on textbook RSA

1. Input challenge ciphertext c = me mod N.

e 2. Submit ciphertext c0 = r c mod N for decryption.

3. Receive message m0 = rm.

1 4. Original message is m0r mod N = m. Unfortunately, nobody actually uses this in practice.

CCA-Secure RSA encryption

Our hybrid RSA encryption from last lecture is also CCA secure.

Key Generation: • 1. Generate primes p, q; N = pq 2. Choose odd e s.t. gcd(e, (N)) = 1 1 3. d = e mod (N) 4. pk =(N, e), sk =(N, d).

Encryption: Choose random x, y = xe mod N; k = H(x); • c =SymEnc (m) Seul c) k Cy, - c Input Cy, ) Decryption: x = y d mod N; k = H(x); m =SymDec (c) • k CCA-Secure RSA encryption

Our hybrid RSA encryption from last lecture is also CCA secure.

Key Generation: • 1. Generate primes p, q; N = pq 2. Choose odd e s.t. gcd(e, (N)) = 1 1 3. d = e mod (N) 4. pk =(N, e), sk =(N, d).

Encryption: Choose random x, y = xe mod N; k = H(x); • c =SymEnck (m) Decryption: x = y d mod N; k = H(x); m =SymDec (c) • k

Unfortunately, nobody actually uses this in practice. You have seen this result in problems before.

RSA Schemes

To protect against RSA malleability, RSA is universally used with a padding schemein2 practice.

e Instead of Encpk (m)=m mod N, we define: Enc (m)=(pad(m))e mod N • pk Dec (m): • sk 1. Compute p = cd mod N. 2. If p has correct padding format, return unpad(p). 3. Else return “failure”. RSA Padding Schemes

To protect against RSA malleability, RSA is universally used with a padding schemein practice.

e Instead of Encpk (m)=m mod N, we define: Enc (m)=(pad(m))e mod N • pk Dec (m): • sk 1. Compute p = cd mod N. 2. If p has correct padding format, return unpad(p). 3. Else return “failure”.

You have seen this result in problems before. PKCS #1 v. 1.5 padding

PKCS #1 v. 1.5 padding is the most common padding scheme for RSA in practice. her too used signatures ¢ m=0002[randompaddingstring]00[data]

To decrypt, implementation checks padding format: First two byes correct. • Padding string contains no null bytes. • Presence of null byte. • is typically symmetric key data. • data 1. Attacker queries server with candidates cr e mod N. 2. aborts if padding incorrect server (continues if padding correct 3. Server is padding oracle that leaks information about plaintext.

With a few million queries can decrypt a 2048-bit RSA ciphertext.

Bleichenbacher PKCS #1 v. 1.5 chosen ciphertext attack [Bleichenbacher 1998] m=0002[randompaddingstring]00[data]

Attack setup: Attacker has a valid ciphertext c which is an encryption of a • 48-byte SSL “premaster secret”. Victim is a SSL 3.0 server with the private key. • Bleichenbacher PKCS #1 v. 1.5 chosen ciphertext attack [Bleichenbacher 1998] m=0002[randompaddingstring]00[data] -

Attack setup: Attacker has a valid ciphertext c which is an encryption of a • =48-byte SSL “premaster secret”. Victim is a SSL 3.0 server with the private key. •

1. Attacker queries server with candidates cr e mod N. 2. aborts if padding incorrect server (continues if padding correct 3. Server is padding oracle that leaks information about plaintext. ' - - is 1. caus r smell . Thur Cunanan) doesn't . M . ✓ = 0002 . . . . nrodw Guy - neehcemolw 0002 Linkmen] . With a few million queries can decrypt a 2048-bit RSA ciphertext. Q: Why didn’t they use a CCA-secure padding scheme? A: Fears about backwards compatibility.

2016: DROWN Attack Since servers use the same RSA keys with old versions of • SSL/TLS, attacker can mount Bleichenbacher attack against servers supporting SSL 2.0 to decrypt a TLS ciphertext.

TLS 1.3 countermeasure: Eliminate RSA entirely.

TLS countermeasures against Bleichenbacher attack

TLS 1.0–1.2 countermeasure:

If padding incorrect, server generates fake plaintext and • continues connection with that fake plaintext. Since client doesn’t know secret, connection will fail later. • 2016: DROWN Attack Since servers use the same RSA keys with old versions of • SSL/TLS, attacker can mount Bleichenbacher attack against servers supporting SSL 2.0 to decrypt a TLS ciphertext.

TLS 1.3 countermeasure: Eliminate RSA key exchange entirely.

TLS countermeasures against Bleichenbacher attack

TLS 1.0–1.2 countermeasure:

If padding incorrect, server generates fake plaintext and • continues connection with that fake plaintext. Since client doesn’t know secret, connection will fail later. • Q: Why didn’t they use a CCA-secure padding scheme? A: Fears about backwards compatibility. TLS countermeasures against Bleichenbacher attack

TLS 1.0–1.2 countermeasure:

If padding incorrect, server generates fake plaintext and • continues connection with that fake plaintext. Since client doesn’t know secret, connection will fail later. • Q: Why didn’t they use a CCA-secure padding scheme? A: Fears about backwards compatibility.

2016: DROWN Attack Since servers use the same RSA keys with old versions of • SSL/TLS, attacker can mount Bleichenbacher attack against servers supporting SSL 2.0 to decrypt a TLS ciphertext. ITE TLS 1.3 countermeasure: Eliminate RSA key exchange entirely.

or E C DH for DH only key exchange. OAEP: CCA-secure RSA padding [Bellare Rogaway 1994], [Fujisaki et al.]

Uses hash functions H, W , optional associated data d. Theorem OAEP padding is CCA-secure in the random oracle model assuming that RSA is “partially one-way”.

TLS, SSH, IPsec, etc. all default to PKCS#1 v. 1.5 padding. Elementary factoring algorithms: Trial division

Input: N Z 2 Output: p, q Z s.t. pq = N 2 Trial division: For i pN check if i N.  | Try #2: Pseudorandom walk. Define f (x)=x2 + c mod N, our pseudorandom function.

1. Choose random starting point s, constant c. x1 = x2 = s

2. Iterate walk: x1 = f (x1), x2 = f (f (x2)), compute g = gcd(a a , N). 1 2 If g = N start over. If g = 1returng. 6 If f is sufficiently random, expect collision after O(pp) steps. N must have a factor p of size at most O(pN).

Elementary factoring algorithms: Pollard rho Input: N Z 2 Output: p, q Z s.t. pq = N 2 Pollard rho: Take a random walk mod N, hope to find a cycle modulo p N. | Problem: Want a collision modulo p, but we don’t know p! Solution: a a mod p = p gcd(a a , N) i ⌘ j ) | i j Try #2: Pseudorandom walk. Define f (x)=x2 + c mod N, our pseudorandom function.

1. Choose random starting point s, constant c. x1 = x2 = s 2. Iterate walk: x1 = f (x1), x2 = f (f (x2)), compute g = gcd(a a , N). 1 2 If g = N start over. If g = 1returng. 6 If f is sufficiently random, expect collision after O(pp) steps. N must have a factor p of size at most O(pN).

Elementary factoring algorithms: Pollard rho Input: N Z 2 Output: p, q Z s.t. pq = N 2 Pollard rho: Take a random walk mod N, hope to find a cycle modulo p N. | Problem: Want a collision modulo p, but we don’t know p! Solution: a a mod p = p gcd(a a , N) i ⌘ j ) | i j 1/4 Try #1: Generate pp = O(N ) elements ai . Check gcd(a a , N). Problem: O(pN) time. i j Elementary factoring algorithms: Pollard rho

Input: N Z 2 Output: p, q Z s.t. pq = N 2 Pollard rho: Take a random walk mod N, hope to find a cycle modulo p N. | Try #2: Pseudorandom walk. Define f (x)=x2 + c mod N, our pseudorandom function.

1. Choose random starting point s, constant c. x1 = x2 = s at 2. Iterate walk: x1 = f (x1), x2 = f (f (x2)), compute g = gcd(a a , N). 9¥ 1 2 If g = N start over. If g = 1returng. 6 T If f is sufficiently random, expect collision after O(pp) steps. N must have a factor p of size at most O(pN). Elementary factoring algorithms: Pollard p 1

Input: N Z 2 Output: p, q Z s.t. pq = N 2 Recall Fermat’s little theorem: ap 1 1 mod p. ⌘

1. Choose random a. ei ei 2. Compute M(k)=lcm(1 ...k)= i pi , pi < k 3. Compute b = aM(k) 1 mod N. Q 4. Compute gcd(b, N)=g. 5. If g = 1orN return g. 6 Factors N if p 1 M(k)= p 1hasallsmallfactors. | ) Countermeasure: Choose p so that p 1hassomebigprime factors. Advanced factoring algorithms: Number field sieve

Running time: O(exp(c(lg N)1/3(lg lg N)2/3)) Current record: RSA-250, 829 bits (February 2020) If two RSA moduli share a common factor,

N1 = pq1 N2 = pq2

gcd(N1, N2)=p

You can factor both keys with GCD algorithm.

Time to factor Time to calculate GCD 829-bit RSA modulus: for 1024-bit RSA moduli: 2700 core-years 15µs [Boudot et al. 2020]

RSA and factoring

Public Key Private Key 1 (N = pq, e) (p, q, d e mod (p 1)(q 1)) ⌘ gcd(N1, N2)=p

You can factor both keys with GCD algorithm.

Time to factor Time to calculate GCD 829-bit RSA modulus: for 1024-bit RSA moduli: 2700 core-years 15µs [Boudot et al. 2020]

RSA and factoring

Public Key Private Key 1 (N = pq, e) (p, q, d e mod (p 1)(q 1)) ⌘ If two RSA moduli share a common factor,

N1 = pq1 N2 = pq2 RSA and factoring

Public Key Private Key 1 (N = pq, e) (p, q, d e mod (p 1)(q 1)) ⌘ If two RSA moduli share a common factor,

N1 = pq1 N2 = pq2

gcd(N1, N2)=p

You can factor both keys with GCD algorithm.

Time to factor Time to calculate GCD 829-bit RSA modulus: for 1024-bit RSA moduli: 2700 core-years 15µs [Boudot et al. 2020]