Digital Signatures

Anononymity and the Internet

Potential For Mischief Microsoft You Hacker Controlled Website

Signature Signature - verifies identity What could go wrong?

Signature Bank Record of signatures

Physical Signature Sign a message by locking with a key you own

Physical Key Back Still need a trusted entity to manage keys

Asymmetric Cryptography Symmetric cryptography: Key for encoding same as key for decoding – Shift three letters Asymmetric cryptography: Key for encoding different than for decoding

Simple Example Encryption Key : – Multiply by 6, clock size 11 – Encode 5 = 5 * 6 clock 11 = 30 clock 11 = 8

Decoding If x * 6 clock 11 = y then y * 2 clock 11 = x

Decryption Key 2 is the decryption Key for encryption key 6 and clock size 11

Picking Keys Pick clock size C – Prime clock sizes work best Find x and y such that x * y clock C = 1

Public / Private One key is kept private Other key made public – Give to anyone who wants it

Private Key Any message encrypted with a private key MUST have been written by the person who signed it Anyone can decrypt the message – Encryption for authentication not secrecy

How Do We Know Public Key Is Good? Ravi You Hacker Controlled Website

Authenticating a Key Official key bank??

Can't Really Trust a Bank Key Bank You Hacker Controlled Website

Authenticating a Key Key bank "signs" people's public keys by encrypting them

Authenticating a Key Browsers come with public keys of known banks called Certification Authorities

2 Part Message Send two things: – Message encrypted with private key – Public key encrypted by trusted authority

Chain Of Trust Reality may involve chain of locks

Encrypting With Public Key Anyone can use public key to secretly send message to holder of private key Locked with Private Key Authentication Locked with Public Key Secrecy

Web Security HTTPS : Secure web connection – Browser asks server for public key – Browser picks shared secret, encrypts with public key, sends to server

RSA Multiplication keys too easy to break…

RSA Multiplication keys too easy to break… …use exponents RSA (Rivest, Shamir, Adelman) invented algorithm in 1977

RSA Math Private key : raise to x power, clock size C Public key : raise to y power, clock size C Message: clock 22 = 64 clock 22 = 20 Encrypted: clock 22 = 4

Picking Keys Start with two prime numbers p, q – multiply to make clock size Pick private key, calculate public key from private, p and q using multiplication trick

Picking Keys Start with two prime numbers p, q – multiply to make clock size Pick private key, calculate public key from private, p and q using multiplication trick If anyone figures out p and q they can figure out your private key

Factoring Factoring large numbers is hard – But we are getting faster

Factoring Factoring large numbers is hard – But we are getting faster Larger keys : 2048 bits (prime numbers with 100's of digits)

Factoring Factoring large numbers is hard – But we are getting faster Larger keys : 2048 bits (prime numbers with 100's of digits) May need to move to different kinds of math: relatively-easy-to-understand-primer-on- elliptic-curve-cryptography/2/ relatively-easy-to-understand-primer-on- elliptic-curve-cryptography/2/

Two messages: My public key: exponent 3, clock 34 encrypted ^ exponent mod clock = message Which 1 of these messages is NOT from me? – Three should check out, one should not Message Encrypted Version