© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Data Structures for Java William H. Ford William R. Topp Chapter 28 Number Theory and Encryption Bret Ford © 2005, Prentice Hall

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Basic Number Theory Concepts a divides b if b = a * h for some integer h. a divides b if b = a * h for some integer h. An integer p is a prime if p  2 and p has two only two divisors 1 and p. An integer p is a prime if p  2 and p has two only two divisors 1 and p. A composite number is the product of two integers  2 called factors. A composite number is the product of two integers  2 called factors. The greatest common divisor of a and b (gcd(a,b))is the largest integer that divides both a and b. The greatest common divisor of a and b (gcd(a,b))is the largest integer that divides both a and b. gcd(10, 4) = 2 gcd(9, 32) = 1 gcd(54, 30) = 6 gcd(30, 45) = 15 gcd(67, 0) = 67

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Basic Number Theory Concepts (continued) Integers a and b are relatively prime if gcd(a,b) is 1. Integers a and b are relatively prime if gcd(a,b) is 1. The Greek mathematician Euclid provided an elegant recursive algorithm for computing gcd(a,b). The algorithm, called the Euclidean Algorithm, computes gcd(a,b) using the identity gcd(a,b) = gcd(b, a%b) and the stopping condition b = 0 in which case gcd(a,0) = a. The Greek mathematician Euclid provided an elegant recursive algorithm for computing gcd(a,b). The algorithm, called the Euclidean Algorithm, computes gcd(a,b) using the identity gcd(a,b) = gcd(b, a%b) and the stopping condition b = 0 in which case gcd(a,0) = a.

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Basic Number Theory Concepts (continued) EuclidGCD(a,b) Assume a and b are nonnegative integers if (b == 0) gcd(a,b) = a;// stopping condition. else gcd(a,b) = g(b, a% b)// recursive step Examples 1. Let a = 54, b = 30 gcd(54,30) = gcd(30,54 % 30) = gcd(30,24) gcd(30,24) = gcd(24,30 % 24) = gcd(24,6) gcd(24,6) = gcd(6,24 % 6) = gcd(6,0) gcd(6,0) = 6// stop: gcd(54,30) = 6 2.Let a = 45, b = 16 gcd(45,16) = gcd(16,45 % 16) = gcd(16,13) gcd(16,13) = gcd(13,16 % 13) = gcd(13,3) gcd(13,3) = gcd(3,13 % 3) = gcd(3,1) gcd(3,1) = gcd(1,3 % 1) = gcd(1,0) gcd(1,0)= 1// stop: gcd(45,16) = 1

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Basic Number Theory Concepts (continued) An expression of the form b*x + c*y is a linear combination of b and c. An expression of the form b*x + c*y is a linear combination of b and c. An extension of the Euclidean algorithm uses the chain of recursive calls to represent gcd(a,b) as a linear combination of a and b; that is, the algorithm determimes integers i and j such that gcd(a,b) = a * i + b * j for some integers i and j An extension of the Euclidean algorithm uses the chain of recursive calls to represent gcd(a,b) as a linear combination of a and b; that is, the algorithm determimes integers i and j such that gcd(a,b) = a * i + b * j for some integers i and j

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Basic Number Theory Concepts (continued Examples 1. Let a = 54, b = 30. The extended Euclid's algorithm determines that gcd(54, 30) = 6 and finds integers i = -1 and j = 2 such that 6 is a linear combination of 54 and = gcd(54,30) = 54 * * 2 // i = -1, j = 2 = Let a = 45, b = 16. The extended Euclid's algorithm determines that gcd(45, 16) = 1 and finds integers i = 5 and j = -14 such that 1 is a linear combination of 45 and = gcd(45,16) = 45 * * -14 // i = 5, j = -14 =

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Modular Arithmetic A traditional view for the set of integers is a line that marks discrete values centered about 0. The integers are an unbounded linear collection of numbers. A traditional view for the set of integers is a line that marks discrete values centered about 0. The integers are an unbounded linear collection of numbers. Taking the remainder after division by a positive number n, maps the integers into a finite set of integers in the range [0, n). The mapping uses the mod operator % For an integer a, the mapping is a -> a % n. Taking the remainder after division by a positive number n, maps the integers into a finite set of integers in the range [0, n). The mapping uses the mod operator % For an integer a, the mapping is a -> a % n.

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Modular Arithmetic (continued) a = b (mod n) if and only if b - a = n * k for some integer k. We say a is congruent to b modulo n. a = b (mod n) if and only if b - a = n * k for some integer k. We say a is congruent to b modulo n. Example: Assume n = = 3 (mod 15) = 15 = 15 * 1// k = 1 50 = 5 (mod 15) = 45 = 15 * 3// k = 3

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Modular Arithmetic (continued) Define Z(n) = {0,1,2... n-1} with operators +, *, and ^ (exponent). Results are computed modulo n. Define Z(n) = {0,1,2... n-1} with operators +, *, and ^ (exponent). Results are computed modulo n. Arithmetic Operations in Z(n) Add (+): a + b = (a + b) (mod n) Multiply (*):a * b = (a*b) (mod n) Exponent(^):(a) e = (a e ) (mod n) // exponent is e Add(+): = 18 (mod 15) = 3 Multiply(*):7 * 11 = 77 (mod 15) = 2 Exponent(^):7 2 = 49 (mod 15) = 4

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Modular Arithmetic (continued) If a is in Z(n) and gcd(a,n) = 1, then a has a an inverse in Z(n); there exists an i in Z(n) such that a*i = 1 (mod n) If a is in Z(n) and gcd(a,n) = 1, then a has a an inverse in Z(n); there exists an i in Z(n) such that a*i = 1 (mod n) Let a be a number in Z(n), then a has a multiplicative inverse if and only if a and n are relatively prime (gcd(a,n) = 1). Let a be a number in Z(n), then a has a multiplicative inverse if and only if a and n are relatively prime (gcd(a,n) = 1). Examples: Assume n = = gcd(7, 15) = 7 * * -6. Inverse of 7 is = gcd(2, 15) = 2 * * -1 Inverse of 2 is 8.

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Euler's Totient Function Euler totient function  (n) is the number of integers in Z(n) relatively prime to n. Euler totient function  (n) is the number of integers in Z(n) relatively prime to n. Examples: 1.  (5)= 4(numbers 1, 2, 3, and 4 are relatively prime to 5) 2.  (6)= 2(numbers 1 and 5 are relatively prime to 6) 3.  (7)= 6(numbers 1, 2, 3, 4, 5, and 6 are relatively prime to 7) 4.  (15) = 8 (numbers 1, 2, 4, 7, 8, 11, 13, and 14 are relatively prime to 15)

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Euler's Totient Function (continued) If n is prime,  (n) = n-1 If n is prime,  (n) = n-1 If p and q are prime,  (pq) =  (p) *  (q) = (p-1)(q-1). If p and q are prime,  (pq) =  (p) *  (q) = (p-1)(q-1). Euler's Theorem: Euler's Theorem: Let n be a positive integer and let a be an integer such that gcd(a,n) = 1. Then a  (n) = 1 (mod n). Let n be a positive integer and let a be an integer such that gcd(a,n) = 1. Then a  (n) = 1 (mod n).

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Euler's Totient Function (concluded)  (n) a gcd(a,n) = 1 a  (n) (mod n)  (5) = 4 3 gcd(3,5) = =81=1(mod 5)  (6) = 2 5 gcd(5,6) = =25=1(mod 6)  (7) = 6 2 gcd(2,7) = =64=1(mod 7)  (15) = 8 4 gcd(4,15) = =65536=1(mod 15)

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Secure Message Passing View the customer as a client process and the retailer as a server process. To send a message, the client encrypts the information into numeric data and transmits it across the Internet. The retailer decrypts the data back to the original message. The techniques for encryption and decryption are called cryptograpy. View the customer as a client process and the retailer as a server process. To send a message, the client encrypts the information into numeric data and transmits it across the Internet. The retailer decrypts the data back to the original message. The techniques for encryption and decryption are called cryptograpy.

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Secure Message Passing (continued) RSA data encryption uses a public-key and a private-key to encrypt and decrypt a message. RSA data encryption uses a public-key and a private-key to encrypt and decrypt a message. The server retains the secret key but sends the public key to the client who uses it to encrypt a message. The term "public" is meaningful. The server makes no attempt to hide the value from an eavesdropper when sending the key. The client uses the public key even though it may be compromised. The server retains the secret key but sends the public key to the client who uses it to encrypt a message. The term "public" is meaningful. The server makes no attempt to hide the value from an eavesdropper when sending the key. The client uses the public key even though it may be compromised.

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Secure Message Passing (continued)

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Creating Keys for RSA Encryption Begin by selecting (at random) two prime numbers p and q and form the product n = p * q. Begin by selecting (at random) two prime numbers p and q and form the product n = p * q. Let t be the value of the Euler totient function for a product of primes. t =  (n) = (p - 1) * (q - 1) Let t be the value of the Euler totient function for a product of primes. t =  (n) = (p - 1) * (q - 1) Select at random an encryption key e subject to the conditions e < t and gcd(e, t) = 1. The public key is the pair (e,n). Select at random an encryption key e subject to the conditions e < t and gcd(e, t) = 1. The public key is the pair (e,n).

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Creating Keys for RSA Encryption (concluded) Compute the decryption key d which is the inverse of e modulo t. Use the extended Euclidean algorithm to find d. 1 = gcd(e,t) = e * d + t * j for some integers d and j The private key is the pair (d,n). Compute the decryption key d which is the inverse of e modulo t. Use the extended Euclidean algorithm to find d. 1 = gcd(e,t) = e * d + t * j for some integers d and j The private key is the pair (d,n).

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Using Keys for RSA Encryption Theorem (RSA) Theorem (RSA) Let n = p * q where p and q are prime numbers and let e and d be encryption and decryption keys; that is 1 = e * d (mod t) where t = (p - 1) * (q - 1). Then for any integer a in Z(n), a = a e*d (mod n) Let n = p * q where p and q are prime numbers and let e and d be encryption and decryption keys; that is 1 = e * d (mod t) where t = (p - 1) * (q - 1). Then for any integer a in Z(n), a = a e*d (mod n)

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Using Keys for RSA Encryption (continued) Assume M in Z(n) is a numeric representation of a message and let C = M e (mod n). Assume M in Z(n) is a numeric representation of a message and let C = M e (mod n). C d (mod n) = (M e (mod n)) d (mod n) = M e*d (mod n) = M. C d (mod n) = (M e (mod n)) d (mod n) = M e*d (mod n) = M. Using the RSA algorithm securely requires using large primes p and q for n = p*q. It relies on the fact that it is very, very hard to find the factors p, q of n. Using the RSA algorithm securely requires using large primes p and q for n = p*q. It relies on the fact that it is very, very hard to find the factors p, q of n.

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Using Big Integers The class BigInteger allows for the creation and manipulation of integers with an arbitrarily large number of digits. Aside from addition, etc. there are methods that implement modular arithmetic, evaluate the GCD, and generate prime numbers. The static constant ONE defines the BigInteger value 1. The class provides the tools for RSA encryption. The class BigInteger allows for the creation and manipulation of integers with an arbitrarily large number of digits. Aside from addition, etc. there are methods that implement modular arithmetic, evaluate the GCD, and generate prime numbers. The static constant ONE defines the BigInteger value 1. The class provides the tools for RSA encryption.

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Using Big Integers (continued) // convert a String to a BigInteger representation String message; BigInteger bigInt = new BigInteger(message.getBytes()); // convert a BigInteger to a String BigInteger bigInt; String message = new String(bigInt.toByteArray())

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. BigInteger Class // The BigInteger constant one static BigInteger ONE // returns a BigInteger whose value is (this + val) BigInteger add(BigInteger val) // returns a BigInteger value which is the // inverse of this (mod n) BigInteger modInverse(BigInteger n) // returns a BigInteger value this^exp (mod n) BigInteger modPow(BigInteger exp, BigInteger n) // returns a BigInteger whose value is (this * val) BigInteger multiply(BigInteger val) // returns a BigInteger whose value is (this - val) BigInteger subtract(BigInteger val)

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Program 28.1 import java.math.BigInteger; public class Program28_1 { public static void main(String[] args) { // define Z(n) BigInteger p, q, n; // used for keys BigInteger t, e, d; // sent and received messages String clientMsg, serverMsg; // BigInteger variables for data encryption BigInteger strData, encryptedData, decryptedData; // create BigInteger objects p = 5, q = 11 p = new BigInteger("5"); q = new BigInteger("11");

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Program 28.1 (continued) // compute n = p * q n = p.multiply(q); // use BigInteger operations to // compute t = (p-1)*(q-1) t = p.subtract(BigInteger.ONE).multiply( q.subtract(BigInteger.ONE)); // create BigInteger e = 3 which is // relatively prime to t; that is, (e,t)=1 e = new BigInteger("3"); // modInverse() returns d, the inverse // of e (mod t); that is, e*d = 1 (mod t) d = e.modInverse(t);

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Program 28.1 (continued) // convert the single character // string "1" to a BigInteger clientMsg = "1"; strData = new BigInteger(clientMsg.getBytes()); System.out.println("Client message: \"" + clientMsg + "\" Data value: " + strData); // use modPow() to encrypt strData by // raising it to power e mod n encryptedData = strData.modPow(e,n); System.out.println("Encrypted data: " + encryptedData); // decrypt the encrypted data by raising // it to power d mod n decryptedData = encryptedData.modPow(d,n); System.out.println("Decrypted data: " + decryptedData);

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Program 28.1 (concluded) // convert BigInteger back to a string serverMsg = new String(decryptedData.toByteArray()); System.out.println("Server message: \"" + serverMsg + "\""); } Run: Client message: "1" Data value: 49 Encrypted data: 4 Decrypted data: 49 Server message: "1"

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. BigInteger Prime Numbers The BigInteger class has methods that produce random prime numbers of arbitrary size. The static method probablePrime() returns a positive BigInteger object that is probably prime, with a specified bit length. The probability that the integer is prime is ≥ The BigInteger class has methods that produce random prime numbers of arbitrary size. The static method probablePrime() returns a positive BigInteger object that is probably prime, with a specified bit length. The probability that the integer is prime is ≥ public static BigInteger probablePrime(int bitLength, Random rnd)

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. BigInteger Prime Numbers (continued) A brute-force method discovers a number e such that gcd(e,t) = 1. It uses a constructor that creates randomly generated BigInteger prime numbers, which are uniformly distributed over the range 0 to 2 numBits ‑ 1, inclusive. A brute-force method discovers a number e such that gcd(e,t) = 1. It uses a constructor that creates randomly generated BigInteger prime numbers, which are uniformly distributed over the range 0 to 2 numBits ‑ 1, inclusive.

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. BigInteger Prime Numbers (concluded) // returns a number relatively prime to t public static BigInteger randomModValue(BigInteger t) { BigInteger k = null; Random rnd = new Random(); // generate a sequence of random numbers and exit // the loop when the number is relatively prime to t do { // random number k is in the range 0 to k = new BigInteger(64,rnd); } while(!t.gcd(k).equals(BigInteger.ONE)); return k; }

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. RSA Client and Server In the software supplement, you can find RSAServer and RSAClient programs that use encryption for client/server message handling. In the software supplement, you can find RSAServer and RSAClient programs that use encryption for client/server message handling.

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. RSA Client and Server (continued)

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Implementing Euclid's GCD Algorithms // compute the greatest common divisor // of the nonnegative integers a and b // where both a and b cannot be 0 int gcd(int a, int b) { if (b == 0) return a; // a divides a and 0 else return gcd(b, a%b); // recursive step }

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Implementing Euclid's GCD Algorithms (continued) // variables defined outside the scope of extGCD() static int i; static int j;... // computes values i, j such that // gcd(a,b) = a * i + b * j public static void extGCD(int a, int b) { int x, y; // stopping condition corresponds to // gcd(a,0) = a; the linear combination // is gcd(a,b) = a * 1 + b * 0; assign // i = 1 and j = 0 if (b == 0) { i = 1; j = 0; }

© 2005 Pearson Education, Inc., Upper Saddle River, NJ. All rights reserved. Implementing Euclid's GCD Algorithms (continued) else { extGCD(b,a%b); // gcd(b, a%b) = b*i + (a%b)*j; // recompute i and j so gcd(a, b) = a*i + b*j // save i and j in x and y x = i; y = j; // update i and j in terms of x, y, and a/b i = y; j = x - (a/b) * y; }