1 / 12

# ElGamal Public Key Cryptography - PowerPoint PPT Presentation

ElGamal Public Key Cryptography. CS 303 Alg. Number Theory & Cryptography Jeremy Johnson.

I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.

## PowerPoint Slideshow about ' ElGamal Public Key Cryptography' - maya-glass

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.

- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript

### ElGamal Public Key Cryptography

CS 303 Alg. Number Theory & Cryptography

Jeremy Johnson

Taher ElGamal, "A Public-Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms", IEEE Transactions on Information Theory, v. IT-31, n. 4, 1985, pp469–472 or CRYPTO 84, pp10–18, Springer-Verlag.

• Primitive Element Theorem

• Diffie Hellman Key Distribution

• ElGamal Encryption

• ElGamal Digital Signatures

Goldwasser

• Let M be a message and let C be the encrypted message (ciphertext). A public key cryptosystem has a separate method E() for encrypting and D() decrypting.

• D(E(M)) = M

• Both E() and D() are easy to compute

• Publicly revealing E() does not make it easy to determine D()

• E(D(M)) = M - needed for signatures

• The collection of E()’s are made publicly available but the D()’s remain secret. Called a one-way trap-door function (hard to invert, but easy if you have the secret information)

• Definition. Let b Zn* The order of b is the smallest positive integer satisfying be 1 (mod n).

• Theorem 9.1. If b has order e modulo n and if j is a positive integer such that bj 1 (mod n), then e|j.

Proof. j = qe+r, 0  r < e.

bj 1  (be)qbr  br(mod n).

This implies that r = 0, since e is the smallest power of b equivalent to 1 mod n.

• Corollary 9.2. Let b Zn*. ord(b)|(n).

• Zp* = <>, i.e. ord() = p-1.

• Example

• Z7* = <3> 31=3, 32=2, 33=6, 34=4, 35=5, 36=1

• Z13* = <2> 21=2, 22=4, 23=8, 24=3, 25=6, 26=12, 27=11, 28=9, 29=5, 210=10, 211=7, 212=1

• Note. ord() = p-1  {1,, 2,…, p-1} distinct.

• Discrete log problem

• Given Zp* = <>

• log(y) = x, if y = x.

• Example

• Z13* = <2> 21=2, 22=4, 23=8, 24=3, 25=6, 26=12, 27=11, 28=9, 29=5, 210=10, 211=7, 212=1

• Log2(5) = 9.

• Theorem 9.4. If b has order e modulo n, then ord(bi) = e/gcd(e,i).

• Theorem 9.7. Let p be a prime and d a divisor of p-1, then the number of positive integers less than p with order d is (d).

• Corollary. The number of primitive elements mod p is equal to (p-1) > 1.

• Lemma 9.6. Let P(x) be a polynomial of degree t and let p be a prime. If p does not divide the coefficient of xt in P(x), then P(x)  0 (mod p), has at most t solutions mod p.

Proof. By induction on the degree of P(x)=t.

P(x1) = 0  P(x) = P1(x)(x - x1), and the degree of P1(x) = t-1.

• Lemma 9.8. The sum of (d) over the divisors of n = n.

• Example: n=12. (1)+ (2)+ (3)+ (4)+ (6)+ (12)=1+1+2+2+2+4 = 12.

• Theorem 9.7. Let p be a prime and d a divisor of p-1, then the number of positive integers less than p with order d is (d).

Proof. If there is an element a of order d, then by Theorem 9.4, ai, gcd(i,d)=1 is also of order d. By Lemma 9.6, 1, a, a2,…,ad-1 are the roots of P(x)=xd-1, and there (d) elements of order d. Since every elements is of order d|p-1 and p-1 = d|p-1 (d), there must be an element of order d for every d|p-1 and hence exactly (d) of them.

• The goal is for two users to securely exchange a key over an insecure channel. The key is then used in a normal cryptosystem

• Diffie-Hellman Key Exchange

• Y = X mod q (q prime,  primitive – all elements are powers of )

• X = log Y mod q [discrete log]

• Yi = Xi mod q [for each user]

• Kij = Xi*Xj mod q [shared key]

• Kij = YiXj mod q = YjXi mod q

• Zp* = <>, m  Zp message

• B encrypts a message to A.

• A: x random, h = x, public key = (p, ,h)

• B: y random, k = y, shared key K = hy = xy

• EA(m) = (c1,c2), c1 = k, c2=mK mod p.

• DA((c1,c2)) = c2*(1/K) mod p, K = c1 x = xy

• Security depends on Computational Diffie-Hellman (CDH) assumption: given (, x,y) it is hard to compute xy

• Do not use same k twice

• Zp* = <>, m  Zp message

• A signs message m.

• A: h = x, public key = (p, ,h), secret key = x.

• A: k random with gcd(k,p-1)=1

• r = k (mod p)

• s = (m – xr)(1/k) mod p-1 [m = sk + xr (mod p-1)]

• Signature = (r,s)

• Verify m=rshr