EE 418: Network Security and Cryptography

Transcription

1 EE 418: Network Security and Cryptography Homework 3 Solutions Assigned: Wednesday, November 2, 2016, Due: Thursday, November 10, 2016 Instructor: Tamara Bonaci Department of Electrical Engineering University of Washington, Seattle Problem 1 (Stinson, Problem 5.7) Solve the following system of congruences: 13x 4 (mod 99) 15x 56 (mod 101) 1

2 The given system of congruences can be solved in two steps: Find modular multiplicative inverses of 13 (mod 99) and 15 (mod 101), to get rid of those scaling factors, and Apply the Chinese remainder theorem to solve the given system of congruences Let s start by finding the multiplicative inverses of x 1 = 13 (mod 99) and x 2 = 15 (mod 101) as follows: 13x 1 1 (mod 99) 13x 1 = 99λ + 1 = 91λ + (8λ + 1) (1) From equation (1) it follows that λ = 8. Therefore, we can write: Similarly, we can write: 13x 1 = x 1 = 61 (2) 15x 2 1 (mod 101) 15x 2 = 101µ + 1 = 90µ + (11µ + 1) (3) From equation (3) it follows that µ = 4. Therefore, we can write: 15x 2 = x 2 = 27 (4) Combining equations (2) and (4), we can redefine the system of congruences (1) as follows: x 244 (mod 99) x 46 (mod 99) x 1512 (mod 101) x 98 (mod 101) (5) System of congruences (5) can be solved using the Chinese reminder theorem, where: r = 2, a 1 = 46, a 2 = 98, m 1 = 99, m 2 = 101, M = 9999, M 1 = 101, M 2 = 99 (6) In order to find a unique solution of the system of congruences, X, we solve the following equations: y 1 M 1 1 (mod 99) 101y 1 1 (mod 99) 2y 1 = 99λ + 1 = 98λ + (1 + λ) (7) From equation (7) it follows that λ = 1. Therefore y 1 = 50. Similarly, for y 2 we can write: 99y 2 1 (mod 101) 99y 2 = 101µ y 2 = 99µ + (2µ + 1) (8) From equation (8) it follows that µ = 49. Therefore y 2 = 50. Finally, we can compute the solution of the system of congruences X as follows: X = a 1 M 1 y 1 + a 2 M 2 y 2 (mod M) = (mod 9999) = (mod 9999) = 7471 (mod 9999) (9) 2

3 Problem 2 In the RSA cryptosystem, a user s public key is given as e = 31, n = Please find the user s private key, and explain your procedure. To find the private key of the given user, e, we use the simple trick, saying that the most plausible choice for primes p, q, p q = n is: p q n (10) Using equation (10), we observe that a good guess for a pair of primes (p, q) would be (p = 59, q = 61), as n = 3599 = We therefore find: φ(n) = φ(p) φ(q) = = 3480 (11) Given a public cryptographic key K E = (b, n) = (31, 3599), we observe that gcd(b, φ(n)) = gcd(31, 3480) = 1. Therefore, there exist a unique multiplicative inverse of b (mod φ(n)), and using the key generation rules of the RSA cryptosystems: ab = 1 (mod φ(n)) we know that that modular multiplicative inverse is exactly equal to the private cryptographic key K D = (a). We find such a multiplicative inverse using Extended Euclidean Algorithm: 3480 = 112(31) = (31) 31 = 3(8) = 31 3(8) 8 = 1(7) = 8 1(7) 1 = 0(7) = (8) = 4(8) 31 = 4(3480) 448(31) 31 = 4(3480) 49(31) (12) From equation (12), we read of the private cryptographic key K D = (a, n) as K D = ( 449, 3599). Problem 3 Suppose that m > 2 users want to communicate securely and confidentially. Suppose further that each of the m users wants to be able to communicate with every other user without the remaining m 2 users being able to listen on their conversation. How many distinct keys are needed if we are using: A symmetric key cryptosystem, where two users use a shared secret key to communicate, A public key cryptosystem, where every user has a public key, K E and a private (secret) key, K D. How many keys are needed for each type of cryptosystems if m = 1000? Case 1: Classical Cryptosystem In classical cryptosystems, every user has to posses m 1 distinct encryption/decryption keys to be able to communicate with every other user. Since two communicating users share a common key, the total number of cryptographic keys is equal to: N 1 = m(m 1) 2. Therefore, for m = 1000, N 1 = distinct keys are needed when classical cryptosystem is used. Case 2: Public Cryptosystem If m users are using a public key cryptosystem, then in total N 2 = 2m distinct cryptographic keys are needed to make communication secure since every user is assigned one encryption key and one decryption key. Therefore, the total number of public key cryptographic keys K = (K E, K D ) is equal to: N 2 = 2m O(m) (13) For m = 1000, N 2 = 2000 distinct keys are needed when public key cryptosystem is used. 3

4 Problem 4 (Stinson, Problem 5.14) Prove that the RSA Cryptosystem is insecure against a chosen ciphertext attack. In particular, given a ciphertext y, describe how to choose a ciphertext ŷ y, such that knowledge of the plaintext ˆx = d K (ŷ) allows x = d K (y) to be computed. Hint: Use the multiplicative property of the RSA Cryptosystem, i.e., that: e K (x 1 )e K (x 2 ) mod n = e k (x 1 x 2 ) mod n Given a ciphertext y, encrypted using the RSA Cryptosystem, which has the following multiplicative property: e K (x 1 )e K (x 2 ) (mod n) = e K (x 1 x 2 (mod n)) (14) an attacker can choose a ciphertext ŷ as a multiplicative inverse of the original ciphertext y under modulo n as his chosen ciphertext: y ŷ = e K (x)e K (ˆx) (mod n) = 1 (15) We note that such a multiplicative inverse exists if gcd(ŷ, n) = 1. following cases are possible: 1. gcd(ŷ, n) = p, 2. gcd(ŷ, n) = q If, however, gcd(ŷ, n) 1, then the Both cases are useful to an attacker as the knowledge of either p or q enables him/her to factor n, and hence to find the decryption (private) key (a, n). We therefore only consider the case when gcd(ŷ, n) = 1, i.e., a multiplicative inverse of ŷ (mod n) exist. Using a multiplicative inverse of y (mod n) as his/her chosen ciphertext, an attacker can write: y ŷ = e K (x) e K (ˆx) (mod n) = e K (x ˆx (mod n)) = 1 (16) Given the encryption rule of the RSA Cryptosystem: e K (x) = x b (mod n), we can rewrite equation (16) as follows: (x ˆx) b 1 (mod n) (17) Based on the fact that 1 b = 1 (mod n), and that x 0, from equation (17) it follows: x ˆx 1 (mod n) (18) Equation (18) represents a congruence equation modulo n. Since n is a product of two primes, gcd(ˆx, n) = ˆx or 1. In case when gcd(ˆx, n) = ˆx, we know that ˆx = {p, q}, which again enables us to factor n and then to find x. In case when gcd(ˆx, n) = 1, there exist a unique multiplicative inverse ˆx 1 (mod n) = x, which shows that RSA Cryptosystem is insecure against chosen ciphertext attack. Problem 5 (Stinson, Problem 5.15) This exercise exhibits what is called a protocol failure. It provides an example where ciphertext can be decrypted by an opponent, without determining the key, if a cryptosystem is used in careless way. The moral is that it is not sufficient to use a secure cryptosystem in order to guarantee secure communication. Suppose Bob has an RSA Cryptosystem with a large modulus n for which the factorization cannot be found in a reasonable amount of time. Suppose Alice sends a message to Bob by representing each alphabetic character as an integer between 0 and 25 (i.e., A 0, B 1, etc.) and then encrypting each residue modulo 26 as a separate plaintext character. (a) Describe how an attacker Eve can easily decrypt a message which is encrypted in this way. 4

5 (b) Illustrate this attack by decrypting the following ciphertext, which was encrypted using an RSA Cryptosystem with n = and b = 25 without factoring the modulus: 365, 0, 4845, 14930, 2608, 2608, 0. (a) If Alice, given a plaintext x = x 1, x 2, x 2,..., x 2, takes each letter x i, 1 i n, converts it to an integer z i Z 26 : x z, z = z 1, z 2, z 2,..., z n, z i Z 26 and then encrypts every letter separately, using RSA Cryptosystem: e K (z i ) = z b i (mod n) = (x i (mod 26)) n (mod n) she actually limits the plaintext space to Z 26, cardinality of which is 26. She also limits the ciphertext space to Z 26, i.e., the set of the same cardinality, since Bob, as a valid receiver, has to be able to uniquely decrypt every letter of the ciphertext. Knowing the public key in this case is, however, sufficient for an attacker to compute a table, representing one-to-one correspondence between the plaintext and the ciphertext. Computed table enables him/her to decrypt any ciphertext, encrypted using RSA Cryptosystem in such a way. (b) In order to decrypt the ciphertext y = [365, 0, 4845, 14930, 2608, 2608, 0], we construct the decryption table 1. By inspection, we can read off letter by letter of the plaintext from the table: d K (365) = v, d K (0) = a, d K (4845) = n, d K (14930) = i, d K (2608) = l. The plaintext is vanilla. The code that decrypts the given ciphertext is listed below. Table 1: Decryption table x a b c d e f g h i j k l m y x n o p q r s t u v w x y z y function [decryption table, plaintext] = RSA decryption table(b, n, ciphertext) %RSA decryption table function takes public %INPUTS: %1. (b,n) public key of the RSA cryptosystem %2. ciphertext given ciphertext %OUTPUT: %1. decryption table corresponding decryption table %2. plaintext decrypted plaintext %% Decryption table construction for i = 0:1:25 decryption table(i + 1) = square and multiply(i, b, n); end %% Decrpytion for i = 1:1:length(ciphertext) plaintext aux(i) = find(decryption table == ciphertext(i)) 1; end plaintext = num2str(plaintext aux); 5

6 Problem 6 (Stinson, Problem 5.16) This exercise illustrates another example of a protocol failure (due to Simmons) involving the RSA Cryptosystem. Is is called the common modulus protocol failure. Suppose that Bob has an RSA cryptosystem with the modulus n and encryption exponent b, and Charlie has an RSA cryptosystem with the same modulus n and encryption exponent b 2. Suppose also that gcd(b 1, b 2 ) = 1. Now consider the situation that arises if Alice encrypts the same plaintext x to send to both Bob and Charlie. Thus, she computes y 1 = x b1 (mod n) and y 2 = x b2 (mod n), and then she sends y 1 to Bob and y 2 to Charlie. Suppose Eve intercepts y 1 and y 2, and performs the computation indicated in the following algorithm: Algorithm 5.16: RSA Common Modulud Decryption(n, b1, b2, y1, y2) c1 = inv(b1) mod(b2) c2 = (c1 b1-1)/b2 x1 = y1^(c1)inv(y2^(c2)) mod(n) return x1 (a) Prove that the value x 1, computed in given algorithm in is fact Alice s plaintext x. Thus eve can decrypt the message Alice sent, even though the cryptosystem may be secure. (b) Illustrate the attack by computing x by this method if n = 18721, b 1 = 43, b 2 = 7717, y 1 = and y 2 = (a) In order to prove that value x 1, computed using Algorithm represents the plaintext x, let s define y 1 and y 2 as follows: y 1 = e K1 (x) = x b1 (mod n) y 2 = e K2 (x) = x b2 (mod n) (19) Using definitions of c 1 and c 2, given in the Algorithm 5.16: let s analyze how the value of x 1 is calculated: c 1 = b 1 1 (mod b 2 ) c 2 = (c 1 b 1 1)/b 2 (20) x 1 = y c1 1 (yc2 2 ) 1 (mod n) = x b1c1 (x b2c2 ) 1 (mod n) (21) Using the Euler s theorem, equation (21) can be rewritten as: x 1 = x 1+λb2 (x b2(1+λb2 1)/b2 ) 1 (mod n) = x 1+λb2 (x λb2 ) 1 (mod n) = x 1 x λb2 (x λb2 ) 1 (mod n) = x (mod n) = x (22) Equation (22) proves that x 1 calculated using Algorithm represents the original plaintext x. (b) The code that decrypts the given ciphertext is listed below. Using the given algorithm, we obtain c 1 = 2692, c 2 = 15, y c1 1 (mod n) = 13145, y c2 2 = 3947, (y c2 2 ) 1 = Finally, we obtain the plaintext x = function [x] = RSA common modulus decryption(n, b1, b2, y1, y2) %RSA common modulus decryption %INPUTS: %1. (b1, n) First RSA public key pair %2. (b2, n) Second RSA public key pair (note that pairs have the same modulus) 6

7 %3. y1 ciphertext encryptred using the first key %4. y2 ciphertext encrypted using the second key %OUTPUT: %1. x plaintext %% Finding multiplicative inverse [r,s,t] = extendedeuclidean(b1, b2); c1 = s; c2 = (c1*b1 1)/b2; %(y1ˆc1)*(s); x1 = square and multiply(y1, c1, n); x2 = square and multiply(y2, c2, n); [r,s,t] = extendedeuclidean(x2, n); x = mod(x1*s, n); Problem 7 (a) Ciphertext 5859 was obtained using the RSA cryptosystem with n = and e = Using the factorization = , find the plaintext. (b) Ciphertext 75 was obtained using the RSA cryptosystem with n = 437 and e = 3. You know that the plaintext is either 8 or 9. Determine which it is without factoring n.] (a) In the RSA cryptosystem, the private key d satisfies equation: ed 1 (mod φ)(n). (23) For n = and e = 7467, we have d = 3. Hence the plaintext is equal to y d (mod n) = (mod 11413)) = (b) The encryption operation of the RSA cryptosystem satisfies y = m e (mod n). To determine the value of the plaintext, we substitute the two possible values of m (m = 8, 9), along with the known values of e and n, and determine which plaintext results in a ciphertext of c = 75. We find that the plaintext is equal to 8. Problem 8 Suppose that Alice and Bob communicate using ElGamal Cryptosystem and that, to save time, Bob uses the same random nonce k each time he encrypts a plaintext message (i.e., k is a fixed secret of Bob, and it is not randomly generated each time encryption is performed). Show how an attacker who possesses a (plaintext, ciphertext) pair x, (Y 1 ; Y 2 ) can decrypt any other ciphertext (Y 1; Y 2). 7

8 Alice Bob Key Generation: Generate prime p, integer α Generate a, compute β = α a mod p P K A = (α, β, p), SK A = a Alice publishes P K A = (α, β, p) Bob knows: P K A = (α, β, p) Encryption: Generate random integer k Compute ciphertext (Y 1, Y 2 ): Decryption: x = Y 2 (Y a 1 ) 1 mod p Y 1 = α k mod p Y 2 = xβ k mod p Y 1 = α k mod p, Y 2 = xβ k mod p Figure 1: Schematic illustration of ElGamal key generation, encryption, and decryption. A schematic illustration of ElGamal cryptosystem is given in Figure 1 above. If Bob reuses k for each encryption operation, then the ciphertext for some message x will be Y 1 = α k mod p Y 2 = xβ k mod p Given some (plaintext, ciphertext) pair (x, (Y 1, Y 2 )), Eve can compute β k as: β k = x 1 Y 2 mod p (24) Using the knowledge of β k, for any given ciphertext (Y 1, Y 2), the plaintext can be computed as: x = Y 2 ( β k ) 1 mod p. (25) Thus knowing β k is sufficient to allow us to decrypt any ElGamal-encrypted ciphertext without knowing the secret key, a. Problem 9 (Trappe, Problem ) Bob, Ted, Carol and Alice want to agree on a common key (cryptographic key, that is). They publicly choose a large prime p and a primitive root α. They privately choose numbers b, t, c, a, respectively. Describe a protocol that allows them to securely compute (in doing so, please ignore the man-in-the-middle attack): K := α btca (mod p) 8

9 The given problem is the modification of the Diffie-Hellman key exchange problem, in which two communicating parties, Alice and Bob, agree upon a shared secret key, K AB, by doing the following: Choose a large prime p and its corresponding primitive root, α, Alice chooses secret integer a and computes a message β a = α a (mod p), Similarly, Bob chooses secret integer b and computes a message β b = α b (mod p) Alice and Bob exchange message β a and β b, and Upon receiving the corresponding message, both parties can compute the shared secret key as β b a = β a b, using the secret integer available to them. When four parties are communicating, messages used to establish the shared secret key K bcta, are exchanged between the communicating parties in three iterations. In each iteration, the communicating parties are something new getting a step closer to establishing a shared secret key, K btca, by obtaining the component α needed so that in the last step each person can raise the received α something new to the secret component that they posses in order to get the whole key. The modified protocol proceeds as follows: Bob, Ted, Carol and Alice choose a large prime p and its corresponding primitive root, α. Bob chooses a secret number b, Ted a secret number t, Carol a secret number c, and Alice a secret number a. The First Iteration: Bob sends message α b (mod p) to Ted. Ted sends message α t (mod p) to Carol. Carol sends message α c (mod p) to Alice. Alice sends message α a (mod p) to Bob. The Second Iteration: Bob sends message α ba (mod p) to Ted. Ted sends message α tb (mod p) to Carol. Carol sends message α ct (mod p) to Alice. Alice sends message α ac (mod p) to Bob. The Thirs Iteration: Bob sends message α bac (mod p) to Ted. Ted sends message α tba (mod p) to Carol. Carol sends message α ctb (mod p) to Alice. Alice sends message α act (mod p) to Bob. After the third iteration of message, each person obtains the shared secret key by raising the last received message to their own secret number. 9