IV054 IV054 IV054 IV054 LITERATURE INTRODUCTION HISTORY OF CRYPTOGRAPHY

Transcription

1 IV5 CODING, CRYPTOGRAPHY ad CRYPTOGRAPHIC PROTOCOLS CONTENTS Prof. Josef Gruska DrSc.. Liear codes 3. Cyclic codes. Classical (secret-key) cryptosystems 5. Public-key cryptography 6. RSA cryptosystem. Prime recogitio ad factorizatio. Other cryptosystems 9. Digital sigatures. Idetificatio ad Autheticatio. Protocols to do seemigly impossible. Zero-kowledge proof protocols 3. Stegaography ad Watermarkig. From theory to practice i cryptography 5. Quatum cryptography IV5 LITERATURE R. Hill: A first course i codig theory, Claredo Press, 95 V. Pless: Itroductio to the theory of error-correctig codes, Joh Willey, 99 J. Gruska: Foudatios of computig, Thomso Iteratioal Computer Press, 99 A. Salomaa: Public-key cryptography, Spriger, 99 D. R. Stiso: Cryptography: theory ad practice, 995 B. Scheier: Applied cryptography, Joh Willey ad Sos, 996 J. Gruska: Quatum computig, McGraw-Hill, 999 (For additios ad updatigs: S. Sigh, The code book, Achor Books, 999 D. Kah: The codebreakers. Two story of secret writig. Macmilla, 996 (A etertaiig ad iformative history of cryptography.) IV5 INTRODUCTION IV5 HISTORY OF CRYPTOGRAPHY Trasmissio of classical iformatio i time ad space is owadays very easy (through oiseless chael). It took ceturies, ad may igeious developmets ad discoveries(writig, book pritig, photography, movies, radio trasmissios,tv,souds recordig) ad the idea of the digitalizatio of all forms of iformatio to discover fully this property of iformatio. Codig theory develops methods to protect iformatio agaist a oise. Iformatio is becomig a icreasigly available commodity for both idividuals ad society. Cryptography develops methods how to protect iformatio agaist a eemy (or a uauthorized user). A very importat property of iformatio is that it is ofte very easy to make ulimited umber of copies of iformatio. Stegaography develops methods to hide importat iformatio i iocetly lookig iformatio (ad that ca be used to protect itellectual properties). The history of cryptography is the story of ceturies-old battles betwee codemakers ad codebreakers, a itellectual arms race that has had a dramatic impact o the course of history. The ogoig battle betwee codemakers ad codebreakers has ispired a whole series of remarkable scietific breakthroughts. History is full of codes. They have decided the outcomes of battles ad led to the deaths of kigs ad quees. 3

2 IV5 CHAPTER : Basics of codig theory ABSTRACT Codig theory - theory of error correctig codes - is oe of the most iterestig ad applied part of mathematics ad iformatics. All real systems that work with digitally represeted data, as CD players, TV, fax machies, iteret, satelites, mobiles, require to use error correctig codes because all real chaels are, to some extet, oisy. Codig theory problems are therefore amog the very basic ad most frequet problems of storage ad trasmissio of iformatio. Codig theory results allow to create reliable systems out of ureliable systems to store ad/or to trasmit iformatio. Codig theory methods are ofte elegat applicatios of very basic cocepts ad methods of (abstract) algebra. Chapter presets ad illustrates the very basic problems, cocepts,methods ad results of codig theory. 5 IV5 Codig - basic cocepts Without codig theory ad error-correctig codes there would be o deep-space travel ad pictures, o satelite TV, o compact disc, o o o. Error-correctig codes are used to correct messages whe they are trasmitted through oisy chaels. Error correctig framework A code C over a alphabet Σ is a subset of Σ* - (C Σ*). A q -ary code is a code over a alphabet of q -symbols. A biary code is a code over the alphabet {,}. s of codes C = {,,, } C = {,,, } C 3 = {,,, } 6 IV5 CHANNEL BASIC IDEA is the physical medium through which iformatio is trasmitted. (Telephoe lies ad the atmosphere are examples of chaels.) NOISE may be caused by supots, lightig, meteor showers, radom radio disturbace, poor typig, poor hearig,. TRANSMISSION GOALS. Fast ecodig of iformatio.. Easy trasmissio of ecoded messages. 3. Fast decodig of received messages.. Reliable correctio of errors itroduced i the chael. 5. Maximum trasfer of iformatio per uit time. METHOD OF FIGHTING ERRORS: REDUNDANCY!!! is ecoded as ad is ecoded as. The details of techiques used to protect iformatio agaist oise i practice are sometimes rather complicated, but basic priciples are easily uderstood. The key idea is that i order to protect a message agaist a oise, we should ecode the message by addig some redudat iformatio to the message. I such a case, eve if the message is corrupted by a oise, there will be eough redudacy i the ecoded message to recover, or to decode the message completely.

3 I case of: the ecodig EXAMPLE IV5 EXAMPLE: Codigs of a path avoidig a eemy territory Story Alice ad Bob share a idetical map (Fig. ) gridded as show i Fig.. Oly Alice kows the route through which Bob ca reach her avoidig the eemy territory. Alice wats to sed Bob the followig iformatio about the safe route he should take. the probability of the bit error p, ad the maority votig decodig NNWNNWWSSWWNNNNWWN,,,,,,, the probability of a erroeous message is 3 3 3p ( p) + p = 3p p < p Three ways to ecode the safe route from Bob to Alice are:. C = {,,, } Ay error i the code word would be a disaster.. C = {,,, } A sigle error i ecodig each of symbols N, W, S, E could be detected. 3. C 3 = {,,, } A sigle error i decodig each of symbols N, W, S, E could be corrected. 9 IV5 Basic termiology IV5 Hammig distace Block code - a code with all words of the same legth. Codewords - words of some code. Basic assumptios about chaels. Code legth preservatio Each output codeword of a chael has the same legth as the iput codeword.. Idepedece of errors The probability of ay oe symbol beig affected i trasmissios is the same. Basic strategy for decodig For decodig we use the so-called maximal likehood priciple, or earest eighbor decodig strategy, which says that the receiver should decode a word w' as that codeword w that is the closest oe to w'. The ituitive cocept of closeess'' of two words is well formalized through Hammig distace h(x, y) of words x, y. For two words x, y h(x, y) = the umber of symbols x ad y differ. : h(, ) = 3, h(fourth, eighth) = Properties of Hammig distace () h(x, y) = x = y () h(x, y) = h(y, x) (3) h(x, z) h(x, y) + h(y, z) triagle iequality A importat parameter of codes C is their miimal distace. h(c) = mi {h(x, y) x,y C, x y}, because it gives the smallest umber of errors eeded to chage oe codeword ito ather. Theorem Basic error correctig theorem () A code C ca detected up to s errors if h(c) s +. () A code C ca correct up to t errors if h(c) t +. Proof () Trivial. () Suppose h(c) t +. Let a codeword x is trasmitted ad a word y is recceived with h(x, y) t. If x' x is a codeword, the h(x y) t + because otherwise h(x', y) <t + ad therefore h(x, x') h(x, y) +h(y, x') < t + what cotradicts the assumptio h(c) t +.

4 IV5 Biary symmetric chael IV5 Additio of oe parity-check bit Cosider a trasmitio of biary symbols such that each symbol has probability of error p </. Biary symmetric chael If symbols are trasmitted, the the probability of t errors is t t p ( p) (). t I the case of biary symmetric chaels the earest eighbour decodig strategy is also maximum likehood decodig strategy''. Cosider C = {, } ad the earest eighbour decodig strategy. Probability that the received word is decoded correctly as is ( - p) 3 +3p( - p), as is ( - p) 3 +3p( - p). Therefore P err (C) = - (( - p) 3 +3p( - p) ) is the so-called word error probability. If p =., the P err (C) =.9 ad oly oe word i 3555 will reach the user with a error. 3 Let all of biary words of legth be codewords. Let the probability of a error be -. Let bits be trasmitted at the rate bits per secod. The probability that a word is trasmitted icorrectly is approximately p( p). Therefore =. of words per secod are trasmitted icorrectly. Oe wrog word is trasmitted every secods, 36 erroeous words every hour ad 6 words every day without beig detected! Let oe parity bit be added. Ay sigle error ca be detected. The probability of at least two errors is: 66 ( p) ( p) p ( )( p) p Therefore approximately words per secod are trasmitted with a udetectable error. Corollary Oe udetected error occurs oly every days! ( 9 /(5.5 6).) IV5 TWO-DIMENSIONAL PARITY CODE IV5 Notatio ad s The two-dimesioal parity code arrages the data ito a two-dimesioal array ad the to each row (colum) parity bit is attached. Biary strig is represeted ad ecoded as follows Questio How much better is two-dimesioal ecodig tha oe-dimesioal ecodig? Notatio: A (,M,d) - code C is a code such that - is the legth of codewords. M - is the umber of codewords. d - is the miimum distace i C. ample: C = {,,, } is a (,,)-code. C = {,,, } is a (3,,)-code. C 3 = {,,, } is a (5,,3)-code. Commet: A good (,M,d) code has small ad large M ad d. 5 6

5 IV5 Notatio ad s (Trasmissio of photographs from the deep space) I Marier -5 took the first photographs of aother plaet - photos. Each photo was divided ito elemetary squares - pixels. Each pixel was assiged 6 bits represetig 6 levels of brightess. Hadamard code was used. Trasmissio rate:.3 bits per secod. I 9- Mariers 6- took such photographs that each picture was broke ito 3 squares. Reed-Muller (3,6,6) code was used. Trasmissio rate was 6 bits per secod. (Much better pictures) IV5 HADAMARD CODE I Marier 5, 6-bit pixels were ecoded usig 3-bit log Hadamard code that could correct up to errors. Hadamard code had 6 codewords. 3 of them were represeted by the 3 3 matrix H ={h IJ }, where i, ad a b + ab ab ( ) where i ad have biary represetatios i = a a 3 a a a, = b b 3 b b b. h i = The remaig 3 codewords were represeted by the matrix -H. Decodig was quite simple. IV5 CODE RATE IV5 The ISBN-code For q-ary (,M,d)-code we defie code rate, or iformatio rate, R, by lgq M R =. The code rate represets the ratio of the umber of iput data symbols to the umber of trasmitted code symbols. Code rate (6/ for Hadamard code), is a importat parameter for real implemetatios, because it shows what fractio of the badwidth is beig used to trasmit actual data. Each recet book has Iteratioal Stadard Book Number which is a -digit codeword produced by the publisher with the followig structure: l p m w = x x laguage publisher umber weighted check sum 953 such that i= ix i ( mod ) The publisher has to put X ito the -th positio if x =. The ISBN code is desiged to detect: (a) ay sigle error (b) ay double error created by a traspositio Sigle error detectio Let X = x x be a correct code ad let Y = x x J- y J x J+ x with y J = x J +a, a I such a case: i= iyi = ixi + a i= ( mod ) 9

6 IV5 The ISBN-code IV5 Equivalece of codes Let x J ad x k be exchaged. i= iyi = ixi + = i= Traspositio detectio ( k ) x + ( k) ( k )( x x ) ( mod ) if k ad x x. k x k k Defiitio Two q -ary codes are called equivalet if oe ca be obtaied from the other by a combiatio of operatios of the followig type: (a) a permutatio of the positios of the code. (b) a permutatio of symbols apperig i a fixed positio. Questio: Let a code be displayed as a M matrix. To what correspod operatios (a) ad (b)? Claim: Distaces betwee codewords are uchaged by operatios (a), (b). Cosequetly, equivalet codes have the same parameters (,M,d) (ad correct the same umber of errors). s of equivalet codes () ( ) Lemma Ay q -ary (,M,d) -code over a alphabet {,,,q -} is equivalet to a (,M,d) -code which cotais the all-zero codeword. Proof Trivial. IV5 The mai codig theory problem IV5 The mai codig theory problem A good (,M,d) -code has small, large M ad large d. The mai codig theory problem is to optimize oe of the parameters, M, d for give values of the other two. Notatio: A q (,d) is the largest M such that there is a q -ary (,M,d) -code. Theorem (a) A q (,) = q ; (b) A q (,) =q. Proof (a) obvios; (b) Let C be a q -ary (,M,) -code. Ay two distict codewords of C differ i all positios. Hece symbols i ay fixed positio of M codewords have to be differet A q (,) q. Sice the q -ary repetitio code is (,q,) -code, we get A q (,) q. Proof that A (5,3) =. (a) Code C 3 is a (5,,3) -code, hece A (5,3). (b) Let C be a (5,M,3) -code with M. By previous lemma we ca assume that C. C cotais at most oe codeword with at least four 's. (otherwise d (x,y) for two such codewords x, y) Sice C there ca be o codeword i C with oe or two. Sice d =3 C caot cotai three codewords with three 's. Sice M there have to be i C two codewords with three 's. (say, ), the oly possible codeword with four or five 's is the. 3

7 IV5 The mai codig theory problem IV5 The mai codig theory problem Theorem Suppose d is odd. The a biary (,M,d) -code exists iff a biary ( +,M,d +) -code exists. Proof Oly if case: Let C be a biary code (,M,d) -code. Let C = { x... xx+ x... x C, x+ = ( xi ) mod } i = Sice parity of all codewords i C is eve, d(x,y ) is eve for all x,y C. Hece d(c ) is eve. Sice d d(c ) d + ad d is odd, d(c ) = d +. Hece C is a ( +,M,d +) -code. Corollary: If d is odd, the A (,d) =A ( +,d +). If d} is eve, the A (,d) =A ( -,d -). A (5,3) = A (6,) = (5,,3) -code (6,,) code by addig check. If case: Let D be a ( +,M,d +) -code. Choose code words x, y of D such that d(x,y) =d +. Fid a positio i which x, y differ ad delete this positio from all codewords of D. Resultig code is a (,M,d) -code. 5 6 IV5 A geeral upper boud o A q (,d) IV5 A geeral upper boud o A q (,d) Notatio F q is a set of all words of legth over alphabet {,,,,q -} Defiitio For ay codeword u F q ad ay iteger r the sphere of radius r ad cetre u is deoted by S (u,r) ={v F q d (u,v) r }. Theorem A sphere of radius r i F q, r cotais words. () + ()( q ) + ()( q ) ()( q ) r r Proof Let u be a fixed word i F q. The umber of words that differ from u i m positio is ( )( q m ) m. Theorem (The sphere-packig or Hammig boud) If C is a q -ary (,M,t +) -code, the M {() + ()( q ) ()( q ) } t q Proof Ay two spheres of radius t cetered o distict codewords have o codeword i commo. Hece the total umber of words i M spheres of radius t cetered o M codewords is give by the left side (). This umber has to be less or equal to q. A code which achieves the sphere-packig boud from (), i.e. such that equality holds i (), is called a perfect code. t ()

8 IV5 A geeral upper boud o A q (,d) IV5 LOWER BOUND for A q (,d) A (,M,3) -code is perfect if M ( ) ( + ) = i.e. M =6 A example of such a code: C = {,,,,,,,,,,,,,,, } Table of A (,d) from d = d = d = The followig lower boud for A q (,d) is kow as Gilbert-Varshaov boud: Theorem Give d, there exists a q -ary (,M,d) -code with q M d ( )( ) = q ad therefore q Aq (, d ) d q = ( )( ) For curret best results see IV5 Geeral codig problem IV5 Shao's oisless codig theorem The basic problems of iformatio theory are how to defie formally such cocepts as iformatio ad how to store or trasmit iformatio efficietly. Let X be a radom variable (source) which takes a value x with probability p(x). The etropy of X is defied by S( X ) = p( x) lg p( x) x ad it is cosidered to be the iformatio cotet of X. The maximum iformatio which ca be stored by a -value variable is lg. I a special case of a biary variable X which takes o the value with probability p ad the value with probability p S(X) =H(p) =-plg p -(-p)lg( - p) Problem: What is the miimal umber of bits we eed to trasmit values of X? Basic idea: To ecode more probable outputs of X by shorter biary words. (Morse code) a.- b - c -.-. d -.. e. f..-. g --. h. i k -.- l.-.. m o --- p.--. q --.- r.-. s t - u..- v - w.-- x -..- y -.-- z I a simple form Shao's oisless codig theorem says that i order to trasmit values of X we eed S(X) bits. More exactly, we caot do better ad we ca reach the boud S(X) as close as desirable. Let a source X produce the value with probability p =¼ Let the source X produce the value with probability - p =¾ Assume we wat to ecode blocks of the outputs of X of legth. By Shao's theorem we eed H (¼) = 3.5 bits per blocks (i average) A simple ad practical methods kow as Huffma's code requires i this case 3.3 bits per message. mess. code mess. code mess. code mess. Code Observe that this is a prefix code - o codeword is a prefix of aother codeword. 3

9 IV5 Desig of Huffma code Give a sequece of obects, x,,x with probabilities p p. Stage - shrikig of the sequece. Replace x -, x with a ew obect y - with probability p - + p ad rearrage sequece so oe has agai oicreasig probabilities. Keep doig the above step till the sequece shriks to two obects. IV5 Desig of Huffma code Stage Apply agai ad agai the followig method: If C ={c,,c r } is a prefix optimal code for a source S r, the C' ={c',,c' r+ } is a optimal code for S r+, where c' i = c i i r c' r = c r c' r+ = c r. Stage - extedig the code - Apply agai ad agai the followig method. If C ={c,,c r } is a prefix optimal code for a source S r, the C' ={c',,c' r+ } is a optimal code for S r+, where c' i = c i i r c' r = c r c' r+ = c r IV5 A BIT OF HISTORY IV5 A BIT OF HISTORY The subect of error-correctig codes arose origially as a respose to practical problems i the reliable commuicatio of digitally ecoded iformatio. The disciplie was iitiated i the paper Claude Shao: A mathematical theory of commuicatio, Bell Syst.Tech. Joural V, 9, 39-3, Shao's paper started the scietific disciplie iformatio theory ad error-corectig codes are its part. Origially, iformatio theory was a part of electrical egieerig. Nowadays, it is a importat part of mathematics ad also of iformatics. SHANNON's VIEW I the itroductio to his semial paper A mathematical theory of commuicatio Shao wrote: The fudametal problem of commuicatio is that of reproducig at oe poit either exactly or approximately a message selected at aother poit