RSA Algorithm

Introduction Algorithm Usage Correctness Security

RSA algorithm

Adrian Spataru

Department of Computer Science,West University of Timisoara

October 30, 2013

Adrian Spataru Department of Computer Science, West University of Timisoara

RSA algorithm


1 Introduction

2 Algorithm

3 Usage

4 Correctness

5 Security


RSA algorithm


About

What is it?

an algorithm for public key cryptographybased on the difficulty of factoring large integers.

Where does the name come from?Ron RivestAdi ShamirLeonard Adleman


RSA algorithm


About

What is it?an algorithm for public key cryptography

based on the difficulty of factoring large integers.



RSA algorithm


About

What is it?an algorithm for public key cryptographybased on the difficulty of factoring large integers.



RSA algorithm


About


Where does the name come from?

Ron RivestAdi ShamirLeonard Adleman


RSA algorithm


About


Where does the name come from?Ron Rivest

Adi ShamirLeonard Adleman


RSA algorithm


About


Where does the name come from?Ron RivestAdi Shamir

Leonard Adleman


RSA algorithm


About




RSA algorithm


Introduction

Where it’s being used?

CommunicationBanksSignaturesIdentity Certificates


RSA algorithm


Introduction

Where it’s being used?Communication

BanksSignaturesIdentity Certificates


RSA algorithm


Introduction

Where it’s being used?CommunicationBanks

SignaturesIdentity Certificates


RSA algorithm


Introduction

Where it’s being used?CommunicationBanksSignatures

Identity Certificates


RSA algorithm


Introduction

Where it’s being used?CommunicationBanksSignaturesIdentity Certificates


RSA algorithm


Algorithm

1 Take p and q large prime numbers

2 Compute n = p × qn is called the modulus and it is publicIts length denotes the key length

3 Compute ϕ(n) = (p − 1)(q − 1)ϕ is Euler’s totient function.

4 Choose e, s.t. 1 < e < ϕ(n) and gcd(e, ϕ(n)) = 1e is released as public exponent

5 Compute d as d−1 ≡ e(modϕ(n)) ord × e ≡ 1(modϕ(n))


RSA algorithm


Algorithm







RSA algorithm


Algorithm


2 Compute n = p × q

n is called the modulus and it is publicIts length denotes the key length





RSA algorithm


Algorithm


2 Compute n = p × qn is called the modulus and it is public

Its length denotes the key length





RSA algorithm


Algorithm







RSA algorithm


Algorithm



3 Compute ϕ(n) = (p − 1)(q − 1)

ϕ is Euler’s totient function.




RSA algorithm


Algorithm







RSA algorithm


Algorithm




4 Choose e, s.t. 1 < e < ϕ(n) and gcd(e, ϕ(n)) = 1

e is released as public exponent



RSA algorithm


Algorithm







RSA algorithm


Algorithm





5 Compute d as d−1 ≡ e(modϕ(n))

ord × e ≡ 1(modϕ(n))


RSA algorithm


Algorithm





5 Compute d as d−1 ≡ e(modϕ(n)) or

d × e ≡ 1(modϕ(n))


RSA algorithm


Algorithm







RSA algorithm


Computing d

Let x = ϕ(n) + 1.If x divides e → d = x/eelse x becomes x + ϕ(n)repeat


RSA algorithm


Example

Suppose p = 17 and q = 23.

Then n (modulus) = 391ϕ(n) = (16× 22) = 352Let’s choose e = 3.d = 1(modϕ(n))

e= 235.


RSA algorithm


Example

Suppose p = 17 and q = 23.Then n (modulus) = 391

ϕ(n) = (16× 22) = 352Let’s choose e = 3.d = 1(modϕ(n))

e= 235.


RSA algorithm


Example

Suppose p = 17 and q = 23.Then n (modulus) = 391ϕ(n) = (16× 22) = 352

Let’s choose e = 3.d = 1(modϕ(n))

e= 235.


RSA algorithm


Example

Suppose p = 17 and q = 23.Then n (modulus) = 391ϕ(n) = (16× 22) = 352Let’s choose e = 3.

d = 1(modϕ(n))e

= 235.


RSA algorithm


Example

Suppose p = 17 and q = 23.Then n (modulus) = 391ϕ(n) = (16× 22) = 352Let’s choose e = 3.d = 1(modϕ(n))

e= 235.


RSA algorithm


Scenario

Traian wants to communicate with Angela via RSA encryptedmessages.Both of them generate a RSA key-pair.Traian gives to Angela his public key, and Angela gives toTraian hers.


RSA algorithm


Encryption

Angela wants to send Traian the message M .

The message is turned into an integer m, 0 ≤ m < n.based on a padding schemeAngela computes c = me(modn) (e from Traian’s public key,and sends this to Traian.


RSA algorithm


Encryption

Angela wants to send Traian the message M .The message is turned into an integer m, 0 ≤ m < n.based on a padding schemeAngela computes c = me(modn) (e from Traian’s public key,and sends this to Traian.


RSA algorithm


Decryption

Traian can recover the message with the formulam = cd(modn).Reverse the padding scheme to get the message.


RSA algorithm


Tricks

For encryption, exponentiation by squaring can save a lotof time.

For decryption, the Chinese remainder algorithm can beused.This algorithm stores in the private key severalprecomputed values (dP , dQ , qinv ).

dP = d(modp − 1)

dQ = d(modq − 1)

qinv = q−1(modp)

m1 = cdP (modp);m2 = cdQ (modq);

h = qinv (m1−m2)(modp)

m = m2 + hq


RSA algorithm


TricksFor encryption, exponentiation by squaring can save a lotof time.


dP = d(modp − 1)

dQ = d(modq − 1)

qinv = q−1(modp)



m = m2 + hq


RSA algorithm



For decryption, the Chinese remainder algorithm can beused.

This algorithm stores in the private key severalprecomputed values (dP , dQ , qinv ).

dP = d(modp − 1)

dQ = d(modq − 1)

qinv = q−1(modp)



m = m2 + hq


RSA algorithm




dP = d(modp − 1)

dQ = d(modq − 1)

qinv = q−1(modp)



m = m2 + hq


RSA algorithm




dP = d(modp − 1)

dQ = d(modq − 1)

qinv = q−1(modp)



m = m2 + hq


RSA algorithm




dP = d(modp − 1)

dQ = d(modq − 1)

qinv = q−1(modp)



m = m2 + hq


RSA algorithm




dP = d(modp − 1)

dQ = d(modq − 1)

qinv = q−1(modp)



m = m2 + hq


RSA algorithm




dP = d(modp − 1)

dQ = d(modq − 1)

qinv = q−1(modp)



m = m2 + hq


RSA algorithm




dP = d(modp − 1)

dQ = d(modq − 1)

qinv = q−1(modp)



m = m2 + hq


RSA algorithm


Fermat’s little theorem

Theorem

Let p be a prime number∀a - integer number, ap − a is multiple of p.

ap ≡ a(modp)If a is not divisible by p, thenap−1 ≡ 1(modp).


RSA algorithm



Theorem

Let p be a prime number∀a - integer number, ap − a is multiple of p.ap ≡ a(modp)

If a is not divisible by p, thenap−1 ≡ 1(modp).


RSA algorithm



Theorem

Let p be a prime number∀a - integer number, ap − a is multiple of p.ap ≡ a(modp)If a is not divisible by p, then

ap−1 ≡ 1(modp).


RSA algorithm



Theorem

Let p be a prime number∀a - integer number, ap − a is multiple of p.ap ≡ a(modp)If a is not divisible by p, thenap−1 ≡ 1(modp).


RSA algorithm


Fermat’s little theorem generalization

Theorem

If p is prime and m and n are positive integers s.t.

m ≡ n(modϕ(p)), then ∀a, we have am ≡ an(modp).

m = b(p − 1) + nam = ab(p−1) × an ≡ 1b × an ≡ an(modp)

q.e.d.


RSA algorithm



Theorem

If p is prime and m and n are positive integers s.t.m ≡ n(modϕ(p)),

then ∀a, we have am ≡ an(modp).


q.e.d.


RSA algorithm



Theorem

If p is prime and m and n are positive integers s.t.m ≡ n(modϕ(p)), then ∀a, we have am ≡ an(modp).


q.e.d.


RSA algorithm



Theorem


m = b(p − 1) + n

am = ab(p−1) × an ≡ 1b × an ≡ an(modp)

q.e.d.


RSA algorithm



Theorem



q.e.d.


RSA algorithm



Theorem



q.e.d.


RSA algorithm


Security

Integer factorization and the RSA problem:The task of taking eth roots modulo a composite n,recovering m, s.t. c ≡ me(modn). For now, the mostpromising approach is to factorize n

Faulty key generation:p and q should not be to close.if p − q < 2n1/4(3× 1077) - for a 1024-bit key, Fermatfactorization will make it trivial.


RSA algorithm


Security

Integer factorization and the RSA problem:

The task of taking eth roots modulo a composite n,recovering m, s.t. c ≡ me(modn). For now, the mostpromising approach is to factorize n



RSA algorithm


Security

Integer factorization and the RSA problem:The task of taking eth roots modulo a composite n,recovering m, s.t. c ≡ me(modn).

For now, the mostpromising approach is to factorize n



RSA algorithm


Security




RSA algorithm


Security


Faulty key generation:

p and q should not be to close.if p − q < 2n1/4(3× 1077) - for a 1024-bit key, Fermatfactorization will make it trivial.


RSA algorithm


Security


Faulty key generation:p and q should not be to close.

if p − q < 2n1/4(3× 1077) - for a 1024-bit key, Fermatfactorization will make it trivial.


RSA algorithm


Security




RSA algorithm


Strong number generator

p and q should be generated using a properly seeded withadequate entropy random generator. This can be done seedingthe RNG with:

key stroke timings

electronic diode noise

atmospheric noise from a radio receiver tuned betweenstations.


RSA algorithm


Breaking the RSA

Several RSA moduli have been factored:

RSA-768 (232 decimal digits) - 2009, December.RSA-704 (212 decimal digits) - 2012, July.

Prizes for breaking the keys:RSA-896 → $75, 000RSA-1024 → $100, 000RSA-1536 → $150, 000RSA-2048 → $200, 000. - not really possible in nearfuture.


RSA algorithm


Breaking the RSA

Several RSA moduli have been factored:RSA-768 (232 decimal digits) - 2009, December.

RSA-704 (212 decimal digits) - 2012, July.



RSA algorithm


Breaking the RSA

Several RSA moduli have been factored:RSA-768 (232 decimal digits) - 2009, December.RSA-704 (212 decimal digits) - 2012, July.



RSA algorithm


Breaking the RSA


Prizes for breaking the keys:

RSA-896 → $75, 000RSA-1024 → $100, 000RSA-1536 → $150, 000RSA-2048 → $200, 000. - not really possible in nearfuture.


RSA algorithm


Breaking the RSA


Prizes for breaking the keys:RSA-896 → $75, 000

RSA-1024 → $100, 000RSA-1536 → $150, 000RSA-2048 → $200, 000. - not really possible in nearfuture.


RSA algorithm


Breaking the RSA


Prizes for breaking the keys:RSA-896 → $75, 000RSA-1024 → $100, 000

RSA-1536 → $150, 000RSA-2048 → $200, 000. - not really possible in nearfuture.


RSA algorithm


Breaking the RSA


Prizes for breaking the keys:RSA-896 → $75, 000RSA-1024 → $100, 000RSA-1536 → $150, 000

RSA-2048 → $200, 000. - not really possible in nearfuture.


RSA algorithm


Breaking the RSA




RSA algorithm


Thank you!

Questions?


RSA algorithm

RSA Algorithm

Education

key length compute n

eulers totient function