Elgamal public key cryptography
This presentation is the property of its rightful owner.
Sponsored Links
1 / 12

ElGamal Public Key Cryptography PowerPoint PPT Presentation


  • 41 Views
  • Uploaded on
  • Presentation posted in: General

ElGamal Public Key Cryptography. CS 303 Alg. Number Theory & Cryptography Jeremy Johnson.

Download Presentation

ElGamal Public Key Cryptography

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -

Presentation Transcript


Elgamal public key cryptography

ElGamal Public Key Cryptography

CS 303 Alg. Number Theory & Cryptography

Jeremy Johnson

Taher ElGamal, "A Public-Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms", IEEE Transactions on Information Theory, v. IT-31, n. 4, 1985, pp469–472 or CRYPTO 84, pp10–18, Springer-Verlag.


Outline

Outline

  • Primitive Element Theorem

  • Diffie Hellman Key Distribution

  • ElGamal Encryption

  • ElGamal Digital Signatures

Goldwasser


Public key cryptography

Public Key Cryptography

  • Let M be a message and let C be the encrypted message (ciphertext). A public key cryptosystem has a separate method E() for encrypting and D() decrypting.

    • D(E(M)) = M

    • Both E() and D() are easy to compute

    • Publicly revealing E() does not make it easy to determine D()

    • E(D(M)) = M - needed for signatures

  • The collection of E()’s are made publicly available but the D()’s remain secret. Called a one-way trap-door function (hard to invert, but easy if you have the secret information)


Order

Order

  • Definition. Let b Zn* The order of b is the smallest positive integer satisfying be 1 (mod n).

  • Theorem 9.1. If b has order e modulo n and if j is a positive integer such that bj 1 (mod n), then e|j.

    Proof. j = qe+r, 0  r < e.

    bj 1  (be)qbr  br(mod n).

    This implies that r = 0, since e is the smallest power of b equivalent to 1 mod n.

  • Corollary 9.2. Let b Zn*. ord(b)|(n).


Primitive element theorem

Primitive Element Theorem

  • Zp* = <>, i.e. ord() = p-1.

  • Example

    • Z7* = <3> 31=3, 32=2, 33=6, 34=4, 35=5, 36=1

    • Z13* = <2> 21=2, 22=4, 23=8, 24=3, 25=6, 26=12, 27=11, 28=9, 29=5, 210=10, 211=7, 212=1

  • Note. ord() = p-1  {1,, 2,…, p-1} distinct.


Discrete logarithms

Discrete Logarithms

  • Discrete log problem

    • Given Zp* = <>

    • log(y) = x, if y = x.

  • Example

    • Z13* = <2> 21=2, 22=4, 23=8, 24=3, 25=6, 26=12, 27=11, 28=9, 29=5, 210=10, 211=7, 212=1

    • Log2(5) = 9.


Properties of primitive elements

Properties of Primitive Elements

  • Theorem 9.4. If b has order e modulo n, then ord(bi) = e/gcd(e,i).

  • Theorem 9.7. Let p be a prime and d a divisor of p-1, then the number of positive integers less than p with order d is (d).

  • Corollary. The number of primitive elements mod p is equal to (p-1) > 1.


Some lemmas

Some Lemmas

  • Lemma 9.6. Let P(x) be a polynomial of degree t and let p be a prime. If p does not divide the coefficient of xt in P(x), then P(x)  0 (mod p), has at most t solutions mod p.

    Proof. By induction on the degree of P(x)=t.

    P(x1) = 0  P(x) = P1(x)(x - x1), and the degree of P1(x) = t-1.

  • Lemma 9.8. The sum of (d) over the divisors of n = n.

    • Example: n=12. (1)+ (2)+ (3)+ (4)+ (6)+ (12)=1+1+2+2+2+4 = 12.


Proof of theorem 9 7

Proof of Theorem 9.7

  • Theorem 9.7. Let p be a prime and d a divisor of p-1, then the number of positive integers less than p with order d is (d).

    Proof. If there is an element a of order d, then by Theorem 9.4, ai, gcd(i,d)=1 is also of order d. By Lemma 9.6, 1, a, a2,…,ad-1 are the roots of P(x)=xd-1, and there (d) elements of order d. Since every elements is of order d|p-1 and p-1 = d|p-1 (d), there must be an element of order d for every d|p-1 and hence exactly (d) of them.


Public key distribution

Public Key Distribution

  • The goal is for two users to securely exchange a key over an insecure channel. The key is then used in a normal cryptosystem

  • Diffie-Hellman Key Exchange

    • Y = X mod q (q prime,  primitive – all elements are powers of )

    • X = log Y mod q [discrete log]

    • Yi = Xi mod q [for each user]

    • Kij = Xi*Xj mod q [shared key]

    • Kij = YiXj mod q = YjXi mod q


Elgamal encryption

ElGamal Encryption

  • Zp* = <>, m  Zp message

    • B encrypts a message to A.

  • A: x random, h = x, public key = (p, ,h)

  • B: y random, k = y, shared key K = hy = xy

    • EA(m) = (c1,c2), c1 = k, c2=mK mod p.

    • DA((c1,c2)) = c2*(1/K) mod p, K = c1 x = xy

  • Security depends on Computational Diffie-Hellman (CDH) assumption: given (, x,y) it is hard to compute xy

  • Do not use same k twice


Elgamal digital signature

ElGamal Digital Signature

  • Zp* = <>, m  Zp message

    • A signs message m.

  • A: h = x, public key = (p, ,h), secret key = x.

  • A: k random with gcd(k,p-1)=1

    • r = k (mod p)

    • s = (m – xr)(1/k) mod p-1 [m = sk + xr (mod p-1)]

    • Signature = (r,s)

    • Verify m=rshr


  • Login