![Fermat Primality Test
Probabilistic test
Based on Fermat’s Little Theorem
p prime => ap-1 = 1 (mod p), for 1<a<p
Do k times
1. Pick a randomly in the range [2, n-2]
2. If aN-1 ≠ 1 (mod p), N is composite, end
If Fermat’s expression holds all k times, N is likely
prime
Modular exponentiation takes O(n)
multiplications
However, the multiplications are O(n log(n)](https://image.slidesharecdn.com/themathematicsofrsaencryption-170723190533/85/The-Mathematics-of-RSA-Encryption-31-320.jpg)
The Mathematics of RSA Encryption
- 1. THE MATHEMATICS OF RSA ENCRYPTION By Nathan Dunn University of Hawaii at Manoa – Graduate Student Mathematics Se Mar. 2017
- 2. Outline What is RSA Encryption? How do you encrypt and decrypt a message? Why can you encrypt and decrypt a message? Why is it secure? Bonus Content!
- 3. What is RSA Encryption? Public Key Cryptography System
- 8. Encoding a message as a number Say you want to encode the message ‘Hi!’ Each character has an ASCII code H 7210 010010002 i 10510 011010012 ! 3310 001000012 Concatenate the bit strings so you have one big number 0100100001101001001000012 474550510
- 9. How to encrypt a message Public key: (e, n) Private key: (d, n) Message: M Encrypted Message: EM = Me (mod n) Decrypted Message: DM = EMd (mod n)
- 10. Example Public key: (e, n) = (3593, 150349) Private key: (d, n) = (957, 150349) Message: M = 90001 Encrypted Message: EM = Me (mod n) EM = 900013593 (mod 150349) 131425 Decrypted Message: DM = EMd (mod n) DM = 131425957 (mod 150349) 90001
- 11. Why did that work? Euler’s Theorem Cleverly chosen keys
- 12. φ, the totient function Define φ(n) as the totient of n Number of integers between 0 and n, coprime with n φ(15) = Number of integers coprime with 15 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 1, 2, 4, 7, 8, 11, 13, 14 φ(15) = 8
- 13. Calculating φ(n) φ(15) = 8 Notice: φ(5 * 3) = (5-1) * (3-1) n = p * q n is the product of 2 different primes, p and q There are p multiples of q There are q multiples of p 0 is counted twice φ(n) = p*q – p – q + 1 = (p-1) * (q-1)
- 14. Euler’s Theorem xφ(n) = 1 (mod n), where x is coprime with n Proof Consider multiplicative group of integers modulo n, (Z/nZ)* Group consists of integers between 0 and n that are coprime with n Order of this group is φ(n) Apply Lagrange’s Theorem
- 15. Key Generation How did we get our keys from the example? Public key: (e, n) = (3593, 150349) Private key: (d, n) = (957, 150349)
- 16. Key Generation p, q = 251, 599 random primes n = p * q 150349 e = 3593 arbitrarily φ(n) = (p-1) * (q-1) 149500 d = e-1 (mod φ(n)) d = 957
- 17. What makes those keys work? EM = Me (mod n) DM = EMd (mod n) DM = Med (mod n) ed = 1 (mod φ(n)) ed = 1 + k*φ(n) DM = M(1 + k*φ(n)) (mod n) = M1 (Mφ(n))k (mod n) = M
- 18. Why is it secure? All we’ve shown is we get the same message back after decrypting What makes the encrypted message unreadable? Computational difficulty of certain math problems
- 19. Big-O notation A function f is said to be O(g) if E m, a, s.t. A x > m, f(x) ≤ a*g(x) 35.23x4log2(x) + x3log(x) + 10100 is O(x4log(x)) Used to compare efficiency of algorithms T(n) – time it takes for an algorithm to solve a problem of size n “size of problem” refers to the number of bits, not the magnitude, of the input n = bits to represent N ≈ log2(N) Polynomial time algorithms are considered “efficient”
- 20. Easy problem - Exponentiation aN Naïve solution – multiply a times itself N times Requires N multiplications O(N) = O(2n) = bad
- 21. Easy problem - Exponentiation aN Better solution – exponentiation by squaring aN = (aN/2)2 N even a(a(N-1)/2)2 N odd Recurrence relation for number of multiplications TN = TN/2 + 1 N even T(N-1)/2 + 2 N odd Requires no more than 2log2N multiplications TN is O(logN) = O(n) = good
- 22. Why is it secure? Can we get the private key from the public key? d = e-1 (mod φ(n)) d = 3593-1 (mod φ(150349)) Need to calculate φ(150349) Need the prime factorization
- 23. The Factoring Problem Given a number N, find the prime factors Naïve solution – Trial division O(N) = O(2n) Better naïve solution – Trial division up to sqrt(N) O(sqrt(N)) = O(2n/2) Best known solution – General number field sieve O(ecbrt(n))
- 24. The Factoring Problem RSA-200 279978339112213278708294676387226016210 704467869554285375600099293261284001076 093456710529553608560618223519109513657 886371059544820065767750985805576135790 987349501441788631789462951872378692218 23983 663 bits, 2 years real time, 75 years CPU time Modern RSA moduli are 1024 – 4096 bits
- 25. Why is it secure? Can we solve for M given the encrypted message? EM = Me (mod n) 131435 = M3593 (mod 150349) No, because taking the modular eth root (The RSA Problem) appears to be difficult Best known solution is to derive the private exponent by factoring the modulus
- 26. Why is it secure? Can we solve for d given a decrypted (authenticated) message? EM = Md (mod n) 131435 = 90001d (mod 150349) No, because the discrete logarithm appears to be difficult Similar complexities to the factoring problem
- 27. More References Video demonstrating Public Key Cryptography https://www.youtube.com/watch?v=GSIDS_lvRv4 Wikipedia Page https://en.wikipedia.org/wiki/RSA_(cryptosystem)
- 28. Why is it secure? Can we take a guess at M, given the encrypted message? EM = Me (mod n) 131435 = M3593 (mod 150349) 900013593 (mod 150329) = 131435 !! Yes, that is a “chosen plaintext attack”, and that is why you must pad your messages
- 29. Modular Inverse d = e-1 (mod n) eφ(n) = 1 (mod n) e*eφ(n)-1 = 1 (mod n) d = eφ(n)-1 (mod n)
- 30. Generating Prime Numbers How did we generate our primes, p and q, initially? 1. Generate a random number n bits long 2. Test if that number is prime 3. If yes, done. If not, go to 1. Generating an n-bit number is O(n) The Fermat Primality Test is O(n2 log(n) log(log(n))) N/π(N) ~ log(N) test O(n) values on average Total is O(n3 log(n) log(log(n)))
- 31. Fermat Primality Test Probabilistic test Based on Fermat’s Little Theorem p prime => ap-1 = 1 (mod p), for 1<a<p Do k times 1. Pick a randomly in the range [2, n-2] 2. If aN-1 ≠ 1 (mod p), N is composite, end If Fermat’s expression holds all k times, N is likely prime Modular exponentiation takes O(n) multiplications However, the multiplications are O(n log(n)
- 32. Fermat Primality Test Can give false positives – may say N is prime when it is not No false negatives – if N is composite For composite N, a is a Fermat witness if aN-1 ≠ 1 (mod N) a is a Fermat liar if aN-1 = 1 (mod N) For most composite N, at least half of (Z/NZ)* are witnesses Can make probability of false positives tolerably low by choosing high k
- 33. Charmichael Numbers Some composite N have aN-1 = 1 (mod N) for all a coprime with N Called Charmichael Numbers Much more likely to get a false positive with Fermat Primality Test Charmichael Numbers are very rare Variants of Fermat Primality Test are used in practice
- 34. Argument for Euler’s Theorem X 1 2 4 7 8 11 13 14 1 1 2 4 7 8 11 13 14 2 2 4 8 14 1 7 11 13 4 4 8 1 13 2 14 7 11 7 7 14 13 4 11 2 1 8 8 8 1 2 11 4 13 14 7 11 11 7 14 2 13 1 8 4 13 13 11 7 1 14 8 4 2 14 14 13 11 8 7 4 2 1
- 35. Argument for Euler’s Theorem X 1 2 4 7 8 11 13 14 1 1 2 4 7 8 11 13 14 2 2 4 8 14 1 7 11 13 4 4 8 1 13 2 14 7 11 7 7 14 13 4 11 2 1 8 8 8 1 2 11 4 13 14 7 11 11 7 14 2 13 1 8 4 13 13 11 7 1 14 8 4 2 14 14 13 11 8 7 4 2 1
- 36. Argument for Euler’s Theorem Consider the product of each number in the first row 1*2*4*7*8*11*13*14 (mod 15) Multiply by 78 78 (1*2*4*7*8*11*13*14) (mod 15) (7*1)(7*2)(7*4)(7*7)(7*8)(7*11)(7*13)(7*14) (mod 15) 7*14*13*4*11*2*1*8 (mod 15) 1*2*4*7*8*11*13*14 (mod 15) Same value, therefore 78 = 1 (mod 15)
Editor's Notes
- #2: Encryption and cybersecurity in general is an important part of my career, so I wanted to get a better idea of how it actually works Also understand those things you hear about in the news about prime numbers and all that I’ve given a variant of this talk twice before. Once for an open talk for a .NET user group. Found the math was a little too advanced. Then I gave it at a meetup for cybersecurity professionals…and the math was a little too advanced. So I’m hoping I found the proper audience for this.
- #3: What it is The actual algorithm to encrypt and decrypt a message Why does it work from a mathematical persepctive What makes an encrypted message unreadable
- #5: http://www.technicaljones.com/AsymmetricEncryption_March%202010.gif
- #6: https://upload.wikimedia.org/wikipedia/commons/thumb/f/f9/Public_key_encryption.svg/2000px-Public_key_encryption.svg.png
- #7: Can, of course, combine both of these … The beauty is there’s no need to exchange secrets. https://upload.wikimedia.org/wikipedia/commons/thumb/1/1e/Public_key_signing.svg/250px-Public_key_signing.svg.png
- #9: We’re going to talk about messages as numeric values. Here is a quick note on the equivalence of numbers and strings of characters
- #10: e is NOT the base of the natural logarithm We are kind of abusing notation here, mod is treated as an operator We claim M = DM
- #11: Numbers are artificially small – These are about 18 bits. Real values would be 1024, or more bits long, so the magnitude would be powers of googol larger If you change d, this will fail Works with any M
- #14: So in general, you calculate phi(n) based off of the prime factorization of n
- #15: Trivial consequence of Lagranges theorem
- #17: Choose two really huge primes. These are not huge
- #18: “Work” in the sense that you can encrypt and decrypt a message By Euler’s Theorem Important that M is coprime with n, but that will almost certainly be true
- #19: At this point, all we’ve shown is you can get the same message back once you decrypt. But so what? The identity function can do the same thing. Can solve in principle, but no known efficient way to solve
- #20: Allows us to ignore certain information about a function We will use capital to refer to magnitude, and lowercase to refer to number of bits. There is a logarithmic relation between them Usually contrast with exponential algorithms
- #21: Here’s an example of a problem that has an efficient solution For our application, N will be greater than the number of particles in the observable universe, so that’s definitely not gonna work
- #23: Only feasible way of calculating is with the prime factorization. Cannot use the direct definition because that would be O(2^n)
- #25: But as we see with this example, it’s still plenty difficult to make it infeasible https://en.wikipedia.org/wiki/Integer_factorization https://en.wikipedia.org/wiki/RSA_numbers#RSA-200 -2005
- #26: https://en.wikipedia.org/wiki/RSA_problem Not to say that
- #27: https://en.wikipedia.org/wiki/Discrete_logarithm
- #31: Generating the prime is dominated by testing its primality
- #32: Using https://en.wikipedia.org/wiki/Sch%C3%B6nhage%E2%80%93Strassen_algorithm multiplication
- #36: Each row rearranges the numbers This is not obvious, it is because it forms a group
- #37: TODO need the simplification justification