DOCSLIB.ORG

RSA, Integer Factorization, Diffie–Hellman, Discrete Logarithm

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
RSA, Integer Factorization, Diffie–Hellman, Discrete Logarithm RSA, integer factorization, Diffie–Hellman, discrete logarithm computation Aurore Guillevic Inria Nancy, France November 12, 2020 1/71 Aurore Guillevic [email protected] • L1-L2 at Université de Bretagne Sud, Lorient (2005–2007) • L3 Vannes (2007–2008) • M1-M2 maths and cryptography at Université de Rennes 1 (2008–2010) • internship and PhD at Thales Communication, Gennevilliers (92) • post-doc at Inria Saclay (2 years) and Calgary (Canada, 1 year) • researcher in cryptography at Inria Nancy since November 2016 • adjunct assistant professor at Polytechnique (2017–2020) 2/71 Outline Preliminaries RSA, and integer factorization problem Naive methods Quadratic sieve Number Field Sieve Bad randomness: gcd, Coppersmith attacks Diffie-Hellman, and the discrete logarithm problem Generic algorithms of square root complexity Pairings 3/71 Introduction: public-key cryptography Introduced in 1976 (Diffie–Hellman, DH) and 1977 (Rivert–Shamir–Adleman, RSA) Asymmetric means distinct public and private keys • encryption with a public key • decryption with a private key • deducing the private key from the public key is a very hard problem Two hard problems: • Integer factorization (for RSA) • Discrete logarithm computation in a finite group (for Diffie–Hellman) 4/71 Textbooks Alfred Menezes, Paul C. van Oorschot, and Scott A. Vanstone. Handbook of Applied Cryptography. CRC Press, 1996. Christof Paar and Jan Pelzl. Understanding Cryptography, a Textbook for Students and Practitioners. Springer, 2010. (Two texbooks [PP10] (Paar and Pelzl) are available at the library at Lorient, code 005.8 PAA). Relvant chapters: 6, 7, 8, and 10. During lockdown, the library is opened: see La BU sur rendez-vous https://www-actus.univ-ubs.fr/fr/index/actualites/scd/ covid-19-la-bu-sur-rdv.html Lecture notes: https://gitlab.inria.fr/guillevi/enseignement/ (Lorient → Master-CSSE.md) 5/71 Textbooks The Handbook is available in PDF for free. Relevant chapters: • chapter 3 http://cacr.uwaterloo.ca/hac/about/chap3.pdf • section 3.3 on the RSA problem, • section 3.6 on the discrete logarithm problem, • section 3.7 on the Diffie-Hellman problem, • chapter 8 http://cacr.uwaterloo.ca/hac/about/chap8.pdf • section 8.2 on public-key cryptography and RSA, • section 8.4 on ElGamal encryption. • chapter 11 http://cacr.uwaterloo.ca/hac/about/chap11.pdf • section 11.5.2 on ElGamal signature scheme, • section 11.5.1 on Digital Signature Algorithm. 6/71 Outline Preliminaries RSA, and integer factorization problem Introduction on RSA Attacking RSA with Integer Factorization Naive methods Quadratic sieve Number Field Sieve Attacks on the RSA cryptosystem Bad randomness: gcd, Coppersmith attacks Diffie-Hellman, and the discrete logarithm problem Generic algorithms of square root complexity Pairings 7/71 public parameters PKA public parameters public keyPK A secret key skA 1. gets Alice’s public keyPK A 2. encrypts M withPK A 3. sends C = EncPKA (M) to Alice C 4. gets C from Bob 5. computes DecskA (C) = M Public-key encryption Alice Bob 8/71 PKA public keyPK A secret key skA 1. gets Alice’s public keyPK A 2. encrypts M withPK A 3. sends C = EncPKA (M) to Alice C 4. gets C from Bob 5. computes DecskA (C) = M Public-key encryption Alice Bob public parameters public parameters 8/71 PKA 1. gets Alice’s public keyPK A 2. encrypts M withPK A 3. sends C = EncPKA (M) to Alice C 4. gets C from Bob 5. computes DecskA (C) = M Public-key encryption Alice Bob public parameters public parameters public keyPK A secret key skA 8/71 1. gets Alice’s public keyPK A 2. encrypts M withPK A 3. sends C = EncPKA (M) to Alice C 4. gets C from Bob 5. computes DecskA (C) = M Public-key encryption Alice Bob public parameters PKA public parameters public keyPK A secret key skA 8/71 C 4. gets C from Bob 5. computes DecskA (C) = M Public-key encryption Alice Bob public parameters PKA public parameters public keyPK A secret key skA 1. gets Alice’s public keyPK A 2. encrypts M withPK A 3. sends C = EncPKA (M) to Alice 8/71 4. gets C from Bob 5. computes DecskA (C) = M Public-key encryption Alice Bob public parameters PKA public parameters public keyPK A secret key skA 1. gets Alice’s public keyPK A 2. encrypts M withPK A 3. sends C = EncPKA (M) to Alice C 8/71 Public-key encryption Alice Bob public parameters PKA public parameters public keyPK A secret key skA 1. gets Alice’s public keyPK A 2. encrypts M withPK A 3. sends C = EncPKA (M) to Alice C 4. gets C from Bob 5. computes DecskA (C) = M 8/71 RSA, how does it work? 1977, Rivest, Shamir, Adleman • modulus N = p × q, p, q two distinct large primes • arithmetic modulo N, in Z/NZ = {0, 1,..., N − 1} The multiplicative group is the set of invertible integers in {1, 2,..., N − 1}. invertible x means gcd(x, N) = 1, x coprime to N. There are ϕ(N) = (p − 1)(q − 1) invertible integers in {1,..., N − 1} Hard tasks without knowing p, q if N is large enough: • computing (p − 1)(q − 1), √ • computing a square root x = x 1/2 mod N, • computing an e-th root x 1/e mod N. 9/71 RSA, how does it work? Alice chooses two distinct primes p and q and set N = pq Alice chooses a public exponent e coprime to N and (p − 1)(q − 1) Alice computes ϕ(N) = (p − 1)(q − 1) and d = 1/e mod ϕ(N) public key: (N, e), e for encryption private key: (p, q, d), d for decryption Encryption: To send a secret message m to Alice: Bob • obtains Alice’s public key (N, e) • encodes m as an integer between 0 and N − 1, • ciphertext c = me mod N, sends c to Alice. Decryption: Alices computes m = cd mod N. It works because med = m mod N, because ed = 1 mod ϕ(N). 10/71 RSA, how does it work? The security relies on the hardness of computing d from N, e. p, q are required to compute ϕ(N) → security relies on the hardness of integer factorization. Usecases: ssh-keygen (linux), PGP: Enigmails on Thunderbird, Protonmail. Note that short keys are not allowed: ssh-keygen -b 512 -t rsa Invalid RSA key length: minimum is 1024 bits 11/71 Knowing the public and private exponents gives a factorization of N Facts: • if x is a square mod N, it has 4 square roots y such that y 2 = x mod N • ed = 1 mod (p − 1)(q − 1) ⇐⇒ ed − 1 = 0 mod (p − 1)(q − 1) • For all x ∈ {1,..., N − 1} coprime to N, x ed−1 ≡ x mod N • ed − 1 is even: (ed − 1)/2 is integer If N, e and d are known: Compute y = x (ed−1)/2 mod N a square root of 1. If y =6 ±1, then y 2 ≡ 1 mod N ⇐⇒ y 2 − 1 = (y − 1)(y + 1) ≡ 0 mod N → compute gcd(y − 1, N) or gcd(y + 1, N) to find p or q. If y is 1, try with (ed − 1)/4,..., (ed − 1)/2i as long as it is an integer. Otherwise, try with another x. Success rate is high. 12/71 Example N = 43 × 47 = 2021, e = 5 coprime to ϕ(N) = 42 × 46 = 1932, d = 1/e mod ϕ(N) = 773 p= 43;q= 47;N=p*q e=5 phiN=(p-1)*(q-1) g,d,v= xgcd(e, phiN) # d is the private exponent y=1;x=2 whiley ==1: expo=e*d-1 whiley ==1 and(expo%2) ==0: expo= expo//2 y=x**expo%N ify ==1: x=x+1 gcd(y-1,N); gcd(y+1,N) We obtain: 21932/4 = 988 mod N, gcd(y − 1, N) = 47 = q, gcd(y + 1, N) = 43 = p. 13/71 Short private exponent is a bad idea For faster encryption, one can choose a short public exponent e (coprime to N). Two common choices of prime exponents: • e = 3 • e = 216 + 1 = 65537 For a faster decryption, one could set a short private exponent d (and a large public exponent e instead). It is wrong: Wiener attack. Idea: continued fraction technique. 14/71 Padding m ∈ {0, 1, 2,..., N − 1}. Problems: • m = 0 =⇒ c = me = 0 mod N • m = 1 =⇒ c = me = 1 mod N √ • 2 ≤ m ≤ b e Nc =⇒ c = me (no modular reduction) =⇒ m = c1/e as an integer. Standards (PKCS) define ways to fill the zeros (the unused bytes) between m and N. 15/71 Choosing key sizes Symmetric ciphers (AES): key sizes are 128, 192 or 256 bits. Perfect symmetric cipher: trying all keys of size n bits takes 2n tests → brute-force search perfect symmetric cipher with secret key of 2n bits ↔ n bits of security For RSA with N of length(N) bits: n bits of security ↔ the best (mathematical) attack should take at least 2n steps • what is the fastest attack? • how much time does it take with respect to length(N)? RSA keys are much larger. Cipher suite: a pair of symmetric and asymmetric ciphers offering the same level of security. 16/71 log2 cost 512 √ √ N, p N /p √ (naive facto. , generic DL in Z Z) 3 448 e 64/9(ln p)(ln ln p)2 / 10.17 ↔ 67.51 √ 2 (DL-240 2 ) 3 e 64/9(ln N)(ln ln N)2 / 11.91 ↔ 65.77 384 2 (RSA-240 2 ) 320 256 192 128 64 log2 N 1024 2048 3072 4096 5120 6144 7168 8192 log2 p 17/71 Particles n 2n Examples 32 232 = 109.6 number of humans on Earth 46 246 = 1013.8 distance Earth - Sun in millimeters number of operations in one day on a processor at 1 GHz 55 255 = 1016.6 number of operations in one year on a processor at 1 GHz 82 282 = 1024.7 mass of Earth in kilogramms 90 290 = 1027.1 numer of operations in 15 · 109 years (age of the universe) on a processor at 1 GHz 155 2155 = 1046.7 number of molecules of water on Earth 256 2256 = 1077.1 number of electrons in universe Courtesy Marine Minier 18/71 Boiling water Universal Security; From bits and mips to pools, lakes – and beyond Arjen Lenstra, Thorsten Kleinjung, and Emmanuel Thomé https://hal.inria.fr/hal-00925622 • 290 operations require enough energy to boil the lake of Genève • 2114 operations: boiling all the water on Earth • 2128 operations: boiling 16000 planets like the Earth 19/71 Naive way 1: Testing all primes up to square root of N √ Trial division: testing all the primes up to N But if there are too many primes to test, it never ends • x/ ln x prime numbers between 1 and x (with ln exp(1) = 1) √ √ √ • N/ ln N prime numbers between 1 and N √ √ N (bits) N (digits) N/ ln N 256 77 2122 1037 512 154 2249 1075 768 231 2376 10114 1024 308 2504 10152 1280 385 2632 10191 1536 462 2759 10229 1792 539 2887 10267 2048 617 21015 10306 20/71 Naive way 2: testing all primes around square root of N √ If√p and q are of the same length (in bits), test all prime factors between b N/2c and b Nc.
Load more

Recommended publications
  • The Quadratic Sieve - Introduction to Theory with Regard to Implementation Issues
    The Quadratic Sieve - introduction to theory with regard to implementation issues RNDr. Marian Kechlibar, Ph.D. April 15, 2005 Contents I The Quadratic Sieve 3 1 Introduction 4 1.1 The Quadratic Sieve - short description . 5 1.1.1 Polynomials and relations . 5 1.1.2 Smooth and partial relations . 7 1.1.3 The Double Large Prime Variation . 8 1.1.4 Problems to solve . 10 2 Quadratic Sieve Implementation 12 2.1 The Factor Base . 12 2.2 The sieving process . 15 2.2.1 Interval sieving and solution of polynomials . 16 2.2.2 Practical implementation . 16 2.3 Generation of polynomials . 17 2.3.1 Desirable properties of polynomials . 17 2.3.2 Assessment of magnitude of coecients . 18 2.3.3 MPQS - The Silverman Method . 20 2.3.4 SIQS principle . 21 2.3.5 Desirable properties of b . 22 2.3.6 SIQS - Generation of the Bi's . 23 2.3.7 Generation of b with Gray code formulas . 24 2.3.8 SIQS - General remarks on a determination . 26 2.3.9 SIQS - The bit method for a coecient . 27 2.3.10 SIQS - The Carrier-Wagsta method for a coecient . 28 2.4 Combination of the relations, partial relations and linear algebra 30 2.5 Linear algebra step . 31 2.6 The Singleton Gap . 32 1 3 Experimental Results 36 3.1 Sieving speed - dependence on FB size . 36 3.2 Sieving speed - dependence on usage of 1-partials . 38 3.3 Singletons - dependence on log(N) and FB size . 39 3.4 Properties of the sieving matrices .
    [Show full text]
  • Improvements in Computing Discrete Logarithms in Finite Fields
    ISSN (Print): 2476-8316 ISSN (Online): 2635-3490 Dutse Journal of Pure and Applied Sciences (DUJOPAS), Vol. 5 No. 1a June 2019 Improvements in Computing Discrete Logarithms in Finite Fields 1*Ali Maianguwa Shuaibu, 2Sunday Babuba & 3James Andrawus 1, 2,3 Department of Mathematics, Federal University Dutse, Jigawa State Email: [email protected] Abstract The discrete logarithm problem forms the basis of numerous cryptographic systems. The most efficient attack on the discrete logarithm problem in the multiplicative group of a finite field is via the index calculus. In this paper, we examined a non-generic algorithm that uses index calculus. If α is a generator × × for 퐹푝 then the discrete logarithm of 훽 ∈ 퐹푝 with respect to 훼 is also called the index of 훽 (with respect to 훼), whence the term index calculus. This algorithm depends critically on the distribution of smooth numbers (integers with small prime factors), which naturally leads to a discussion of two algorithms for factoring integers that also depend on smooth numbers: the Pollard 푝 − 1method and the elliptic curve method. In conclusion, we suggest improved elliptic curve as well as hyperelliptic curve cryptography methods as fertile ground for further research. Keywords: Elliptic curve, Index calculus, Multiplicative group, Smooth numbers Introduction 푥 It is known that the logarithm 푙표푔푏 푎 is a number x such that 푏 = 푎, for given numbers a and b. Similarly, in any group G, powers 푏푘 can be defined for all integers 푘, and 푘 the discrete logarithm푙표푔푏 푎 is an integer k such that 푏 = 푎. In number theory,푥 = 푥 푖푛푑푟푎(푚표푑 푚) is read as the index of 푎 to the base r modulo m which is equivalent to 푟 = 푎(푚표푑 푚) if r is the primitive root of m and greatest common divisor, 푔푐푑( 푎, 푚) = 1.
    [Show full text]
  • The Index Calculus Method Using Non-Smooth Polynomials
    MATHEMATICS OF COMPUTATION Volume 70, Number 235, Pages 1253{1264 S 0025-5718(01)01298-4 Article electronically published on March 7, 2001 THE INDEX CALCULUS METHOD USING NON-SMOOTH POLYNOMIALS THEODOULOS GAREFALAKIS AND DANIEL PANARIO Abstract. We study a generalized version of the index calculus method for n the discrete logarithm problem in Fq ,whenq = p , p is a small prime and n !1. The database consists of the logarithms of all irreducible polynomials of degree between given bounds; the original version of the algorithm uses lower bound equal to one. We show theoretically that the algorithm has the same asymptotic running time as the original version. The analysis shows that the best upper limit for the interval coincides with the one for the original version. The lower limit for the interval remains a free variable of the process. We provide experimental results that indicate practical values for that bound. We also give heuristic arguments for the running time of the Waterloo variant and of the Coppersmith method with our generalized database. 1. Introduction Let G denote a group written multiplicatively and hgi the cyclic subgroup gen- erated by g 2 G.Giveng and y 2hgi,thediscrete logarithm problem for G is to find the smallest integer x such that y = gx.Theintegerx is called the discrete logarithm of y in the base g, and is written x =logg y. The main reason for the intense current interest on the discrete logarithm prob- lem (apart from being interesting on a purely mathematical level) is that the se- curity of many public-key cryptosystems depends on the assumption that finding discrete logarithms is hard, at least for certain groups.
    [Show full text]
  • A Public-Key Cryptosystem Based on Discrete Logarithm Problem Over Finite Fields 퐅퐩퐧
    IOSR Journal of Mathematics (IOSR-JM) e-ISSN: 2278-5728, p-ISSN: 2319-765X. Volume 11, Issue 1 Ver. III (Jan - Feb. 2015), PP 01-03 www.iosrjournals.org A Public-Key Cryptosystem Based On Discrete Logarithm Problem over Finite Fields 퐅퐩퐧 Saju M I1, Lilly P L2 1Assistant Professor, Department of Mathematics, St. Thomas’ College, Thrissur, India 2Associate professor, Department of Mathematics, St. Joseph’s College, Irinjalakuda, India Abstract: One of the classical problems in mathematics is the Discrete Logarithm Problem (DLP).The difficulty and complexity for solving DLP is used in most of the cryptosystems. In this paper we design a public key system based on the ring of polynomials over the field 퐹푝 is developed. The security of the system is based on the difficulty of finding discrete logarithms over the function field 퐹푝푛 with suitable prime p and sufficiently large n. The presented system has all features of ordinary public key cryptosystem. Keywords: Discrete logarithm problem, Function Field, Polynomials over finite fields, Primitive polynomial, Public key cryptosystem. I. Introduction For the construction of a public key cryptosystem, we need a finite extension field Fpn overFp. In our paper [1] we design a public key cryptosystem based on discrete logarithm problem over the field F2. Here, for increasing the complexity and difficulty for solving DLP, we made a proper additional modification in the system. A cryptosystem for message transmission means a map from units of ordinary text called plaintext message units to units of coded text called cipher text message units. The face of cryptography was radically altered when Diffie and Hellman invented an entirely new type of cryptography, called public key [Diffie and Hellman 1976][2].
    [Show full text]
  • 2.3 Diffie–Hellman Key Exchange
    2.3. Di±e{Hellman key exchange 65 q q q q q q 6 q qq q q q q q q 900 q q q q q q q qq q q q q q q q q q q q q q q q q 800 q q q qq q q q q q q q q q qq q q q q q q q q q q q 700 q q q q q q q q q q q q q q q q q q q q q q q q q q qq q 600 q q q q q q q q q q q q qq q q q q q q q q q q q q q q q q q qq q q q q q q q q 500 q qq q q q q q qq q q q q q qqq q q q q q q q q q q q q q qq q q q 400 q q q q q q q q q q q q q q q q q q q q q q q q q 300 q q q q q q q q q q q q q q q q q q qqqq qqq q q q q q q q q q q q 200 q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q qq q q qq q q 100 q q q q q q q q q q q q q q q q q q q q q q q q q 0 q - 0 30 60 90 120 150 180 210 240 270 Figure 2.2: Powers 627i mod 941 for i = 1; 2; 3;::: any group and use the group law instead of multiplication.
    [Show full text]
  • Making NTRU As Secure As Worst-Case Problems Over Ideal Lattices
    Making NTRU as Secure as Worst-Case Problems over Ideal Lattices Damien Stehlé1 and Ron Steinfeld2 1 CNRS, Laboratoire LIP (U. Lyon, CNRS, ENS Lyon, INRIA, UCBL), 46 Allée d’Italie, 69364 Lyon Cedex 07, France. [email protected] – http://perso.ens-lyon.fr/damien.stehle 2 Centre for Advanced Computing - Algorithms and Cryptography, Department of Computing, Macquarie University, NSW 2109, Australia [email protected] – http://web.science.mq.edu.au/~rons Abstract. NTRUEncrypt, proposed in 1996 by Hoffstein, Pipher and Sil- verman, is the fastest known lattice-based encryption scheme. Its mod- erate key-sizes, excellent asymptotic performance and conjectured resis- tance to quantum computers could make it a desirable alternative to fac- torisation and discrete-log based encryption schemes. However, since its introduction, doubts have regularly arisen on its security. In the present work, we show how to modify NTRUEncrypt to make it provably secure in the standard model, under the assumed quantum hardness of standard worst-case lattice problems, restricted to a family of lattices related to some cyclotomic fields. Our main contribution is to show that if the se- cret key polynomials are selected by rejection from discrete Gaussians, then the public key, which is their ratio, is statistically indistinguishable from uniform over its domain. The security then follows from the already proven hardness of the R-LWE problem. Keywords. Lattice-based cryptography, NTRU, provable security. 1 Introduction NTRUEncrypt, devised by Hoffstein, Pipher and Silverman, was first presented at the Crypto’96 rump session [14]. Although its description relies on arithmetic n over the polynomial ring Zq[x]=(x − 1) for n prime and q a small integer, it was quickly observed that breaking it could be expressed as a problem over Euclidean lattices [6].
    [Show full text]
  • The Discrete Log Problem and Elliptic Curve Cryptography
    THE DISCRETE LOG PROBLEM AND ELLIPTIC CURVE CRYPTOGRAPHY NOLAN WINKLER Abstract. In this paper, discrete log-based public-key cryptography is ex- plored. Specifically, we first examine the Discrete Log Problem over a general cyclic group and algorithms that attempt to solve it. This leads us to an in- vestigation of the security of cryptosystems based over certain specific cyclic × groups: Fp, Fp , and the cyclic subgroup generated by a point on an elliptic curve; we ultimately see the highest security comes from using E(Fp) as our group. This necessitates an introduction of elliptic curves, which is provided. Finally, we conclude with cryptographic implementation considerations. Contents 1. Introduction 2 2. Public-Key Systems Over a Cyclic Group G 3 2.1. ElGamal Messaging 3 2.2. Diffie-Hellman Key Exchanges 4 3. Security & Hardness of the Discrete Log Problem 4 4. Algorithms for Solving the Discrete Log Problem 6 4.1. General Cyclic Groups 6 × 4.2. The cyclic group Fp 9 4.3. Subgroup Generated by a Point on an Elliptic Curve 10 5. Elliptic Curves: A Better Group for Cryptography 11 5.1. Basic Theory and Group Law 11 5.2. Finding the Order 12 6. Ensuring Security 15 6.1. Special Cases and Notes 15 7. Further Reading 15 8. Acknowledgments 15 References 16 1 2 NOLAN WINKLER 1. Introduction In this paper, basic knowledge of number theory and abstract algebra is assumed. Additionally, rather than beginning from classical symmetric systems of cryptog- raphy, such as the famous Caesar or Vigni`ere ciphers, we assume a familiarity with these systems and why they have largely become obsolete on their own.
    [Show full text]
  • The Quadratic Sieve Factoring Algorithm
    The Quadratic Sieve Factoring Algorithm Eric Landquist MATH 488: Cryptographic Algorithms December 14, 2001 1 1 Introduction Mathematicians have been attempting to find better and faster ways to fac- tor composite numbers since the beginning of time. Initially this involved dividing a number by larger and larger primes until you had the factoriza- tion. This trial division was not improved upon until Fermat applied the factorization of the difference of two squares: a2 b2 = (a b)(a + b). In his method, we begin with the number to be factored:− n. We− find the smallest square larger than n, and test to see if the difference is square. If so, then we can apply the trick of factoring the difference of two squares to find the factors of n. If the difference is not a perfect square, then we find the next largest square, and repeat the process. While Fermat's method is much faster than trial division, when it comes to the real world of factoring, for example factoring an RSA modulus several hundred digits long, the purely iterative method of Fermat is too slow. Sev- eral other methods have been presented, such as the Elliptic Curve Method discovered by H. Lenstra in 1987 and a pair of probabilistic methods by Pollard in the mid 70's, the p 1 method and the ρ method. The fastest algorithms, however, utilize the− same trick as Fermat, examples of which are the Continued Fraction Method, the Quadratic Sieve (and it variants), and the Number Field Sieve (and its variants). The exception to this is the El- liptic Curve Method, which runs almost as fast as the Quadratic Sieve.
    [Show full text]
  • Sieve Algorithms for the Discrete Logarithm in Medium Characteristic Finite Fields Laurent Grémy
    Sieve algorithms for the discrete logarithm in medium characteristic finite fields Laurent Grémy To cite this version: Laurent Grémy. Sieve algorithms for the discrete logarithm in medium characteristic finite fields. Cryptography and Security [cs.CR]. Université de Lorraine, 2017. English. NNT : 2017LORR0141. tel-01647623 HAL Id: tel-01647623 https://tel.archives-ouvertes.fr/tel-01647623 Submitted on 24 Nov 2017 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. AVERTISSEMENT Ce document est le fruit d'un long travail approuvé par le jury de soutenance et mis à disposition de l'ensemble de la communauté universitaire élargie. Il est soumis à la propriété intellectuelle de l'auteur. Ceci implique une obligation de citation et de référencement lors de l’utilisation de ce document. D'autre part, toute contrefaçon, plagiat, reproduction illicite encourt une poursuite pénale. Contact : [email protected] LIENS Code de la Propriété Intellectuelle. articles L 122. 4 Code de la Propriété Intellectuelle. articles L 335.2- L 335.10 http://www.cfcopies.com/V2/leg/leg_droi.php
    [Show full text]
  • Index Calculus in the Trace Zero Variety 3
    INDEX CALCULUS IN THE TRACE ZERO VARIETY ELISA GORLA AND MAIKE MASSIERER Abstract. We discuss how to apply Gaudry’s index calculus algorithm for abelian varieties to solve the discrete logarithm problem in the trace zero variety of an elliptic curve. We treat in particular the practically relevant cases of field extensions of degree 3 or 5. Our theoretical analysis is compared to other algorithms present in the literature, and is complemented by results from a prototype implementation. 1. Introduction Given an elliptic curve E defined over a finite field Fq, consider the group E(Fqn ) of rational points over a field extension of prime degree n. Since E is defined over Fq, the group E(Fqn ) contains the subgroup E(Fq) of Fq-rational points of E. Moreover, it contains the subgroup Tn of − points P E(F n ) whose trace P + ϕ(P )+ ... + ϕn 1(P ) is zero, where ϕ denotes the Frobenius ∈ q homomorphism on E. The group Tn is called the trace zero subgroup of E(Fqn ), and it is the group of Fq-rational points of the trace zero variety relative to the field extension Fqn Fq. In this paper, we study the hardness of the DLP in the trace zero variety. Our| interest in this question has several motivations. First of all, supersingular trace zero varieties can achieve higher security per bit than supersingular elliptic curves, as shown by Rubin and Silverberg in [RS02, RS09] and by Avanzi and Cesena in [AC07, Ces10]. Ideally, in pairing-based proto- F∗ cols the embedding degree k is such that the DLP in Tn and in qkn have the same complexity.
    [Show full text]
  • The RSA Algorithm Clifton Paul Robinson
    Bridgewater State University Virtual Commons - Bridgewater State University Honors Program Theses and Projects Undergraduate Honors Program 5-1-2018 The Key to Cryptography: The RSA Algorithm Clifton Paul Robinson Follow this and additional works at: http://vc.bridgew.edu/honors_proj Part of the Computer Sciences Commons Recommended Citation Robinson, Clifton Paul. (2018). The Key ot Cryptography: The RSA Algorithm. In BSU Honors Program Theses and Projects. Item 268. Available at: http://vc.bridgew.edu/honors_proj/268 Copyright © 2018 Clifton Paul Robinson This item is available as part of Virtual Commons, the open-access institutional repository of Bridgewater State University, Bridgewater, Massachusetts. The Key to Cryptography: The RSA Algorithm Clifton Paul Robinson Submitted in Partial Completion of the Requirements for Commonwealth Interdisciplinary Honors in Computer Science and Mathematics Bridgewater State University May 1, 2018 Dr. Jacqueline Anderson Thesis Co-Advisor Dr. Michael Black, Thesis Co-Advisor Dr. Ward Heilman, Committee Member Dr. Haleh Khojasteh, Committee Member BRIDGEWATER STATE UNIVERSITY UNDERGRADUATE THESIS The Key To Cryptography: The RSA Algorithm Author: Advisors: Clifton Paul ROBINSON Dr. Jackie ANDERSON Dr. Michael BLACK Submitted in Partial Completion of the Requirements for Commonwealth Honors in Computer Science and Mathematics Dr. Ward Heilman, Reading Committee Dr. Haleh Khojasteh, Reading Committee ii Dedicated to Mom, Dad, James, and Mimi iii Contents Abstractv 1 Introduction1 1.1 The Project Overview........................1 2 Theorems and Definitions2 2.1 Definitions..............................2 2.2 Theorems...............................5 3 The History of Cryptography6 3.1 Origins................................6 3.2 A Transition.............................6 3.3 Cryptography at War........................7 3.4 The Creation and Uses of RSA...................7 4 The Mathematics9 4.1 What is a Prime Number?.....................9 4.2 Factoring Numbers........................
    [Show full text]
  • Integer Factorization and Computing Discrete Logarithms in Maple
    Integer Factorization and Computing Discrete Logarithms in Maple Aaron Bradford∗, Michael Monagan∗, Colin Percival∗ [email protected], [email protected], [email protected] Department of Mathematics, Simon Fraser University, Burnaby, B.C., V5A 1S6, Canada. 1 Introduction As part of our MITACS research project at Simon Fraser University, we have investigated algorithms for integer factorization and computing discrete logarithms. We have implemented a quadratic sieve algorithm for integer factorization in Maple to replace Maple's implementation of the Morrison- Brillhart continued fraction algorithm which was done by Gaston Gonnet in the early 1980's. We have also implemented an indexed calculus algorithm for discrete logarithms in GF(q) to replace Maple's implementation of Shanks' baby-step giant-step algorithm, also done by Gaston Gonnet in the early 1980's. In this paper we describe the algorithms and our optimizations made to them. We give some details of our Maple implementations and present some initial timings. Since Maple is an interpreted language, see [7], there is room for improvement of both implementations by coding critical parts of the algorithms in C. For example, one of the bottle-necks of the indexed calculus algorithm is finding and integers which are B-smooth. Let B be a set of primes. A positive integer y is said to be B-smooth if its prime divisors are all in B. Typically B might be the first 200 primes and y might be a 50 bit integer. ∗This work was supported by the MITACS NCE of Canada. 1 2 Integer Factorization Starting from some very simple instructions | \make integer factorization faster in Maple" | we have implemented the Quadratic Sieve factoring al- gorithm in a combination of Maple and C (which is accessed via Maple's capabilities for external linking).
    [Show full text]