Pass in HW6 now Can use up to 2 late days Can use up to 2 late days But one incentive not to burn them all: teams will get to pick their presentation day in the order But one incentive not to burn them all: teams will get to pick their presentation day in the orderAnnouncements: 1. HW7 posted. Questions? This week: Discrete Logs, Diffie-Hellman, ElGamal Discrete Logs, Diffie-Hellman, ElGamal Hash Functions Hash Functions DTTF/NB479: DszquphsbqizDay 26

Plus-delta feedback Thanks for some great feedback! My eyes are opened.

Discrete Logs Find x We denote this as Why is this hard? Given

Diffie-Hellman Key Exchange Publish large prime p, primitive root  Alice’s secret exponent: x Bob’s secret exponent: y 0 < x,y < p-1 0 < x,y < p-1 Alice sends  x (mod p) to Bob Bob sends  y (mod p) to Alice Each know key K=  xy Eve sees p,  x,  y ; why can’t she determine  xy ?

Diffie-Hellman Key Exchange Publish large prime p, primitive root  Alice’s secret exponent: x Bob’s secret exponent: y 0 < x,y < p-1 0 < x,y < p-1 Alice sends  x (mod p) to Bob Bob sends  y (mod p) to Alice Each know key K=  xy Eve sees , p,  x,  y ; why can’t she determine  xy ? Computational Diffie-Hellman problem: “Given , p,  x (mod p),  y (mod p), find  xy (mod p)” Not harder than problem of finding discrete logs Is it easier? No one knows! Decision Diffie-Hellman problem: “Given , p,  x (mod p),  y (mod p), and c != 0 (mod p). Verify that c=  xy (mod p)” What’s the relationship between the two? Which is harder?

ElGamal Cryptosystem Another public-key cryptosystem like RSA. Bob publishes ( , p,  ), where 1 < m < p and  =  a Alice chooses secret k, computes and sends to Bob the pair (r,t) where r=  k (mod p) r=  k (mod p) t =  k m (mod p) t =  k m (mod p) Bob calculates: tr -a =m (mod p) Why does this decrypt?

ElGamal Cryptosystem Bob publishes ( , p,  ), where 1 < m < p and  =  a Alice chooses secret k, computes and sends to Bob the pair (r,t) where r=  k (mod p) r=  k (mod p) t =  k m (mod p) t =  k m (mod p) Bob finds: tr -a =m (mod p) Why does this work? Multiplying m by  k scrambles it. Eve sees , p, , r, t. If she only knew a or k! Knowing a allows decryption. Knowing k also allows decryption. Why? Can’t find k from r or t. Why?

ElGamal Bob publishes ( , p,  ), where 1 < m < p and  =  a Alice chooses secret k, computes and sends to Bob the pair (r,t) where r=  k (mod p) t =  k m (mod p) Bob finds: tr -a =m (mod p) 1.Show that Bob’s decryption works 2.Eve would like to know k. Show that knowing k allows decrpytion. Why? 3.Why can’t Eve compute k from r or t? 4.Challenge: Alice should randomize k each time. If not, and Eve gets hold of a plaintext / ciphertext (m 1, r 1, t 1 ), she can decrypt other ciphertexts (m 2, r 2, t 2 ). Show how. 5.If Eve says she found m from (r,t), can we verify that she really found it, using only m,r,t, and the public key (and not k or a)? Explain. 6.If time allows, send a friend a public key ( , p,  ), have him encrypt a message as (r,t), and decrypt it. Otherwise, you can run through the cycle on your own. Name: ______________________ Notes: