1. Breaking Cryptosystems Joshua Langford University of Texas at Tyler Fall 2007 Advisor: Dr. Ramona Ranalli Alger

2. Users of the System Bob and Alice Bob and Alice Malice Malice

3. What Malice Can Do Attain any message passing through the network. Attain any message passing through the network. Be a legitimate user of the network. Be a legitimate user of the network. Become a receiver to any user. Become a receiver to any user. Send messages to any user by impersonating any other user. Send messages to any user by impersonating any other user.

4. What Malice Cannot Do Guess a random number from lots of numbers. Guess a random number from lots of numbers. Retrieve plaintext without the correct private key. Retrieve plaintext without the correct private key. Have control of private computers. Have control of private computers. Find the private key matching a given public key. Find the private key matching a given public key.

5. Some Standard Attacks The Message Replay Attack The Message Replay Attack. Man-in-the-Middle Attack. There are many, many, many others.

6. Problem It would be really nice if Malice didn’t have to follow the rule that says he cannot find the private key matching a given public key. It would be really nice if Malice didn’t have to follow the rule that says he cannot find the private key matching a given public key.

7. Solution Find a way to break that rule. Find a way to break that rule. So how do you find the private key if all you know is the public key? So how do you find the private key if all you know is the public key?

8. RSA Pick two random prime numbers p and q. Compute N = pq and Φ(N) = (p - 1) (q - 1). Choose a random e є Z such that 0 < e < Φ(N) and gcd(e, Φ(N)) = 1. Compute the integer d such that ed ≡ 1 mod Φ(N) and 0 < e < Φ(N).

9. RSA Continued Alice gives Bob her public key, (N, e), and keeps d as her private key. Bob converts his message text into an integer 0 < m < N and encrypts it by computing c = m^e mod N and sends c to Alice. Alice decrypts the message by computing m = c^d mod N.

10. Breaking RSA But N is such a big number! In order to facilitate his laziness, he comes up with a better way. Use brute force to find every possible factor of N to get p and q. But N is such a big number! In order to facilitate his laziness, he comes up with a better way.

11. Breaking RSA Continued Because p is multiplied by q, either p = q and N = p 2 or p > q which means that 0 < p < √(N) rounded up. This means Malice only needs to try √(N) numbers. Unfortunately, if N is really big, √(N) is also very big!

12. Breaking RSA Continued Notice he only needs to try the odd numbers. Now Malice only needs to check √(N) /2 numbers!

13. Cracking RSA p = 256,203,221 p = 256,203,221 q = 275,604,541 q = 275,604,541 pq = pq = 70,610,771,126,426,561

14. Why Does it Work? Today's RSA algorithms use primes that have upwards of 500 digits. Here is a 300 digit prime: 203956878356401977405765866929034577280 193993314348263094772646453283062722701 277632936616063144088173312372882677123 879538709400158306567338328279154499698 366071906766440037074217117805690872792 848149112022286332144876183376326512083 574821647933992961249917319836219304274 280243803104015000563790123 203956878356401977405765866929034577280 193993314348263094772646453283062722701 277632936616063144088173312372882677123 879538709400158306567338328279154499698 366071906766440037074217117805690872792 848149112022286332144876183376326512083 574821647933992961249917319836219304274 280243803104015000563790123