1. Copyright © Zeph Grunschlag, 2001-2002. RSA Encryption Zeph Grunschlag

2. L132 Agenda RSA Cryptography A useful and basically unbreakable method for encoding messages Needed for implementing RSA: Fast Exponentiation Extended Euler’s Algorithm Modular inverses F L T (Fermat’s Little Theorem) CRT (Chinese Remainder Theorem)

3. L133 RSA Cryptography N = 4559, e = 13. Smiley Transmits: “Last name Smiley”  L A S T N A M E S M I L E Y  1201 1920 0014 0113 0500 1913 0912 0525  1201 13 mod 4559, 1920 13 mod 4559, …  2853 0116 1478 2150 3906 4256 1445 2462 m e mod N

4. L134 RSA Cryptography FrogsRUs.com receives the encrypted blocks n = m e mod N. They have a private decryption exponent d which when applied to n recovers the original blocks m : (m e mod N ) d mod N = m For N = 4559, e = 13 the decryptor d = 3397.

5. L135 RSA Cryptography N = 4559, d = 3397  2853 0116 1478 2150 3906 4256 1445 2462  2853 3397 mod 4559, 0116 3397 mod 4559, …  1201 1920 0014 0113 0500 1913 0912 0525  L A S T N A M E S M I L E Y

6. L136 RSA Cryptography The key to security of RSA cryptosystem: The public key (N,e) must be such that it is very difficult for Snoop Snoopy Snoop to figure out what d is, yet very simple for FrogsRUs.com to come up with.

7. L137 Fast Modular Exponentiation In order to implement RSA exponentiation relative some modulo needs to be done a lot. So this operation better be doable, and fast. Q: How is it even possible to compute 2853 3397 mod 4559 ? After all, 2853 3397 has approximately 3397·4 digits!

8. L138 Fast Modular Exponentiation A: By taking the mod after each multiplication. EG, a more lucid example: 23 3 mod 30  -7 3 (mod 30)  (-7) 2 ·(-7) (mod 30)  49 · (-7) (mod 30)  19·(-7) (mod 30)  -133 (mod 30)  17 (mod 30)

9. L139 Fast Modular Exponentiation Therefore, 23 3 mod 30 = 17. Q: What if had to figure out 23 16 mod 30. Same way tedious: need to multiply 15 times. Is there a better way?

10. L1310 Fast Modular Exponentiation A: Better way. Notice that 16 = 2·2·2·2 so that 23 16 = 23 2·2·2·2 = (((23 2 ) 2 ) 2 ) 2 Therefore: 23 16 mod 30  (((-7 2 ) 2 ) 2 ) 2 (mod 30)  (((49) 2 ) 2 ) 2 (mod 30)  (((-11) 2 ) 2 ) 2 (mod 30)  ((121) 2 ) 2 (mod 30)  ((1) 2 ) 2 (mod 30)  (1) 2 (mod 30)  1(mod 30) Which implies that 23 16 mod 30 = 1. Q: How ‘bout 23 25 mod 30 ?

11. L1311 Fast Modular Exponentiation A: The previous method of repeated squaring works for any exponent that’s a power of 2. 25 isn’t. However, we can break 25 down as a sum of such powers: 25 = 16 + 8 + 1. Apply repeated squaring to each part, and multiply the results together. Previous calculation: 23 8 mod 30 = 23 16 mod 30 = 1 Thus: 23 25 mod 30  23 16+8+1 (mod 30) 

12. L1312 Fast Modular Exponentiation A: The previous method of repeated squaring works for any exponent that’s a power of 2. 25 isn’t. However, we can break 25 down as a sum of such powers: 25 = 16 + 8 + 1. Apply repeated squaring to each part, and multiply the results together. Previous calculation: 23 8 mod 30 = 23 16 mod 30 = 1 Thus: 23 25 mod 30  23 16+8+1 (mod 30)  23 16 ·23 8 ·23 1 (mod 30)  1·1·23 (mod 30) Final answer: 23 25 mod 30 = 23

13. L1313 Fast Modular Exponentiation Q: How could we have figured out the decomposition 25 = 16 + 8 + 1 from the binary (unsigned) representation of 25?

14. L1314 Fast Modular Exponentiation A: 25 = (11001) 2 This means that 25 = 1·16+1·8+0·4+0·2+1·1 = 16+8+1 Can tell which powers of 2 appear by where the 1’s are. This follows from the definition of binary representation.