INTERNATIONAL JOURNAL OF SCIENTIFIC & TECHNOLOGY RESEARCH VOLUME 6, ISSUE 07, JULY 2017 ISSN 2277-8616 RSA Public Key Cryptography Algorithm – A Review Shireen Nisha, Mohammed Farik Abstract: This paper aims to review RSA, examine its strengths and weaknesses, and propose novel solutions to overcome the weakness. RSA (Rivest, Shamir, and Adleman) is one of the best cryptographic algorithms in use today that ensures secure communication over networks. Index Terms: Algorithm, Cryptography, Cypher text, Private Key, Public Key, RSA. ———————————————————— 1 INTRODUCTION The rest of the paper is organized as follows: the next section NETWORKS are a must for any company to achieve looks at literature review on RSA algorithm as the most widely competitive advantage; however, all communication over any used PKC algorithm, section 3 looks at current usage of RSA, network, mainly the Internet needs to be secure to prevent section 4 highlights the strengths and weakness of RSA, while breach of confidential and sensitive data. An IBM sponsored section 5 briefly discusses the recommendations to mitigate benchmark study carried out by Ponemon Institute for the past some of the identified drawbacks. Lastly, section 6 concludes 11 years highlights the alarming boost (see Fig. 1) in the the paper and discusses about future works in this area. average cost of data breach globally (ACoDBG) each year with 2016 being $4 million [1], a 29 percent increase since 2 RSA PUBLIC KEY CRYPTOGRAPHY 2013 [2]. Known also as asymmetric encryption, PKC works on the concept of dual keys. While the recipients’ public key is used to encrypt the message, the private key is used for decryption, so there is no need to share a secret key as required in secret key (symmetric) cryptography [6]. PKC is largely used for authentication, non-repudiation, and key exchange [7]. The most widely used PKC algorithm in the world today, Rivest, Shamir, and Adleman algorithm (RSA) [6], [7], [8], [9] is considered superlative in comparison with algorithms such as the symmetric key Advanced Encryption Standard (AES) [8] and the asymmetric Goldwasser and Micali (GM) algorithms [7]. Officially launched in 1977 and named with the surname Fig 1: Global average cost of data breach from years 2012 to initials of inventors Ron Rivest, Adi Shamir, and Leonard 2016. Data from Ponemon Institute reports for the years 2012 Adleman, RSA is actually a set of two algorithms; key [3], 2013 [3], 2014 [4], 2015 [5] and 2016 [1]. generation, the most complex part used to produce the public and private keys, and RSA function evaluation which looks at Networks aren’t just used by businesses but also by home encrypting and decrypting [10]. Fig. 2 explains how the public users. Hence, network security is of utmost importance. This and private key is generated. Fig. 4 shows the methods of brings in cryptography, as a major component enabling secure encrypting plaintext and decrypting a ciphertext using the two communications over networks. Cryptography looks at keys. methods of hiding the actual message from unintended recipients by scrambling the data via an algorithm. The first proven use of cryptography dates back to 1900 B.C, Ancient Egypt, when a document writer used irregular hieroglyphs (writing system using a combination of graphics, symbols and alphabet) while copying a document [6]. Modern cryptography algorithms offer more security than the ancient ones and can be divided into 3 categories, namely secret key, public key and hash functions. The focus of this paper is public key cryptography (PKC) algorithm. ____________________ Shireen Nisha is currently pursuing masters degree program in Information Technology in the School of Science and Technology at the University of Fiji. E-mail: [email protected] Mohammed Farik (Member IEEE) is a Lecturer in Information Technology in the School of Science and Technology at the University of Fiji. E-mail: Fig 2: RSA Public Key and Private Key Generation Method [email protected] 187 IJSTR©2017 www.ijstr.org INTERNATIONAL JOURNAL OF SCIENTIFIC & TECHNOLOGY RESEARCH VOLUME 6, ISSUE 07, JULY 2017 ISSN 2277-8616 application protocols such as HTTP, Telnet, Network News Transfer Protocol (NNTP), or File Transfer Protocol (FTP) by establishing an RSA key exchange during the SSL handshake between client and server to authenticate each end of the connection [14]. Moreover, RSA is used for employee verification in many organizations. Chip based smart cards use cryptographic algorithms to ensure security by checking the PIN code [22]. Some of these cards use RSA algorithms in combination with other algorithms. For instance, IDPrime MD 3811 smart cards, a single chip based dual-interface (contact Fig 3: RSA Encryption and Decryption Methods and contactless ISO14443 interface) smart card developed by Gemalto is also compatible with the NFC standard already RSA Security Inc. had a 17 year hold on RSA algorithm patent widely used by mobile devises today and is secured with both from 1983 till its expiry in 2000, however, the company RSA and elliptic curves algorithms [23]. Another example of surprisingly released its claim on the patent two weeks before Gemalto's cards is the IDPrime PIV (personal identity the expiry date, making RSA available to the public domain, verification) card v1.55 that looks at improved identification prompting a major competitor, Baltimore Technologies into free and authentication of US Federal employees and contractors giveaway of a version of its Keytools developer tool kit which to access Federal amenities and was published as FIPS PUB uses RSA algorithm and had cost developers $10,000 to – 201 [24]. Another product that uses RSA is the RSA $20,000 until now [11]. The patent years saw more than 800 SecurID, a two-factor authentication technology used in high- licensed customers and development of over 1,000 security environments to protect network resources and can applications, including the likes of Microsoft Windows, be hardware authenticator (a USB token, smart card, software Netscape Navigator, Intuit Quicken, Lotus Notes, PGP, Cisco application residing on your smartphone or key fob) and RSA Systems Inc., routers, credit cards, iPhone text messaging, authentication manager software based tokens [25]. The making web connections, and hundreds of other authenticator generates passcodes/pin tokens which resets products/services to protect trillions of transactions [9], [11], itself every 60 seconds making the previous token worthless. [12], [13]. When trying to access a protected resource, users enter the passcode together with their username which are intercepted by the RSA authentication Agent and presented to the RSA 3 CURRENT USAGE OF RSA SecureID system on the RSA authentication server which Looking at where RSA is being used today, let’s take the validates the pass code by running the same algorithm that example of Pretty Good Privacy in short PGP, a freeware was used to generate the passcode to check if their 8 digit created by Phil Zimmerman, providing encryption and output matches the one entered by the user along with the authentication for e-mail and file storage applications across username before granting access to the remote server [26]. multiple platforms and it uses RSA algorithm for its key transportation [14], [15]. Many cloud service providers also use PKC for authentication. One example is Googles G Suite, a 4 STRENGTHS AND WEAKNESSES OF RSA brand of cloud based services that has been rated as excellent One of the reason RSA has become most widely used is on PGMags review in February 2017, has about 3 million paid because it allows either of the two keys to encrypt a message customers including large companies such as Whirlpool and and the opposite key to decrypt it, thus promising PiceWaterhouseCoopers taking advantage of a collaboration- confidentiality, integrity, authenticity and non-reputability of ready office suite, a website, shared calendars, mail services, data and electronic communications [20]. It’s important to note chat, video conferences, social media, real-time document that a weak key generation will make RSA very vulnerable to collaborations, and many more [16], [17]. This service has attacks therefore care must be taken to ensure that two large encryption at numerous stages and is enabled by default for all random prime numbers are used to calculate the modulus, n customers. Firstly, data access is enabled through Hypertext [10], which will become the public key and the private key will Transfer Protocol Secure (HTTPS) encrypted tunnels, then it consist of those two primes themselves. The effectiveness of uses Perfect Forward Secrecy (PFS), for which Google made RSA algorithm comes from the fact that it’s difficult to headlines in 2011 for being the first to enable this feature [18], computationally factor large integers into primes [12], [20]. which scrambles data as it moves between their and other Multiplying the two primes is easy but performing the reverse companies servers and it uses SSL (Secure Sockets in the form of factoring is actually hard and gets even harder Layer)/TLS (Transport Layer Security) for connectivity where as the values of p and q gets bigger [27]. Take for instance, the 256-bit TLS looks at the encryption enforcement policy the RSA Factoring Challenge enacted by RSA Laboratories in which rejects all inbound and outbound mail from other mail 1991, has many moduli still pending to be factored. On 12 servers if they don’t use TLS [19]. A common operation in IT is December 2009, a 768-bit RSA modulus containing a 232 RSA signature verification and many protocols such as SSH, decimal digit number was factored by a total of 13 researchers OpenPGP, S/MIME and SSL/TLS rely on it [20]. SSL over a span of two years using hundreds of parallel certificates are used to protect the online users’ private and computers, a task equivalent to approximately 2000 years of sensitive data.