1. Campbell R. Harvey Duke University and NBER
Innovation and Cryptoventures
Digital Signatures
Campbell R. Harvey
Duke University and NBER
February 3, 2018

2. Campbell R. Harvey 2018

3. Definition
Cryptography is the science of communication in the presence of an adversary. Part of the field of cryptology.
Campbell R. Harvey 2018

4. Goals of Adversary Alice sends message to Bob Eve is the adversary
Campbell R. Harvey 2018

5. Goals of Adversary Eve’s goals could be: Eavesdrop
Steal secret key so that all future messages can be intercepted
Change Alice’s message to Bob
Masquerade as Alice in communicating to Bob
Campbell R. Harvey 2018

6. Symmetric Keys Early algorithms were based on symmetric keys.
This meant a common key encrypted and decrypted the message
You needed to share the common key and this proved difficult
Campbell R. Harvey 2018

7. Symmetric Keys Early methods relied on a shared key or code
A message would be encrypted and sent but the receiver needed to decode with a key or a special machine
Example: The “Lektor” in James Bond, From Russia with Love.
Campbell R. Harvey 2018

8. Symmetric Keys
However, you needed to securely share the key or decoder.
Campbell R. Harvey 2018

9. Symmetric Keys The “adversary”
However, you needed to securely share the key or decoder.
The “adversary”
Campbell R. Harvey 2018

10. Symmetric Keys
Nazi Enigma Machine is an earlier version of the “Lektor”
Campbell R. Harvey 2018
Recommended videos!

11. Secret Keys Symmetric key
DES (Data Encryption Standard) was a popular symmetric key method, initially used in SET (first on-line credit card protocol)
DES has been replaced by AES (Advanced Encryption Standard)
Campbell R. Harvey 2018

12. Diffee-Hellman Key Exchange
Breakthrough in 1976 with Diffie-Hellman-Merkle key exchange
There is public information that everyone can see. Each person, say Alice and Bob, have secret information.
The public and secret information is combined in a way to reveal a single secret key that only they know
Campbell R. Harvey 2018

13. Diffee-Hellman Key Exchange
Will use prime numbers and modulo arithmetic
We already encountered one example of modular arithmetic simple ciphers (also the SHA-256 which uses mod=232 or 4,294,967,296)
Campbell R. Harvey 2018

14. Key Exchange Numerical example “5 mod 2” = 1
Divide 5 by 2 the maximum number of times (2)
2 is the modulus
The remainder is 1
Remainders never larger than (mod-1) so for mod 12 (clock) you would never see remainders greater than 11.
EXCEL function = mod(number, divisor) e.g., mod(329, 17) = 6
“mod”
Campbell R. Harvey 2018

15. Key Exchange Alice and Bob decide on two public pieces for information
A modulus (say 17)
A generator (or the base for an exponent) (say 3)
Alice has a private key (15)
Bob has a private key (13)
Is it possible for them to share a common secret that is unlikely to be intercepted?
Campbell R. Harvey 2018

16. Key Exchange Alice: Calculates 315 mod 17 = 6 (i.e., =mod(3^(15), 17))
Alice send the message “6” to Bob
Campbell R. Harvey 2018

17. Key Exchange Alice: Calculates 315 mod 17 = 6 (i.e., =mod(3^(15), 17))
Alice send the message “6” to Bob
Eve intercepts the message!
Campbell R. Harvey 2018

18. Key Exchange Bob: Calculates 313 mod 17 = 12 (i.e., =mod(3^(13), 17))
Bob send the message “12” to Alice
Campbell R. Harvey 2018

19. Key Exchange Bob: Calculates 313 mod 17 = 12 (i.e., =mod(3^(13), 17))
Bob send the message “12” to Alice
Eve intercepts the message! Now Eve has the 6 and the 12.
Campbell R. Harvey 2018

20. Key Exchange
Alice:
She takes Bob’s message of 12 and raises it to the power of her private key.
Calculates 1215 mod 17 = 10 (i.e., =mod(12^(15), 17))*
This is their common secret
Campbell R. Harvey 2018
*EXCEL only does 15 digits so this will not work

21. Key Exchange
Bob:
He takes Alice’s message of 6 and raises it to the power of his private key.
Calculates 613 mod 17 = 10 (i.e., =mod(6^(13), 17))
This is their common secret
Campbell R. Harvey 2018

22. Key Exchange
Eve
She has intercepted their message. However, without the common secret key, there is little chance she can recover the shared secret.
Campbell R. Harvey 2018

23. Key Exchange Common secret
Alice can now encrypt a message with the common secret and Bob can decrypt it with the common secret.
Notice this is a common secret.
Next we will talk private/public keys. That is, both and Alice have separate public keys and separate private keys.
Campbell R. Harvey 2018

24. Key Exchange (Optional slide)
Why does this work
They are solving the same problem.
Alice sent Bob 315 mod 17 = 6.
Bob raises the to power of 13.
This is the same as
613 mod 17 = [315]^(13) mod 17 =10
Alice’s original calculation
Campbell R. Harvey 2018

25. Key Exchange (Optional slide)
Why does this work
They are solving the same problem.
Bob sent Alice 313 mod 17 = 12.
Alice raises the to power of 15.
This is the same as
1215 mod 17 = [313]^(15) mod 17 =10
Bob’s original calculation
Campbell R. Harvey 2018

26. Key Exchange (Optional slide)
Why does this work
They are solving the same problem. The modular arithmetic is crucial.
See!
[313]^(15) = [315]^(13)
Campbell R. Harvey 2018

27. Key Exchange RSA and ECC Now we will introduce key pairs.
The basic idea of modular arithmetic provides the foundation for RSA private/public key cryptography.
The prime numbers that are used are huge. Private keys are mathematically linked to public keys.
Campbell R. Harvey 2018

28. RSA: High Level Overview
See my Cryptography 101 deck for much more detail.
Two prime numbers are chosen and they are secret (say 7 and 13, called p, q).
Multiply them together. The product (N=91) is public but people don’t know the prime numbers used to get it.
A public key is chosen (say 5).
Given the two prime numbers, 7 and 13, and the public key, we can derive the private key, which is 29.
Campbell R. Harvey 2018

29. RSA Issues with RSA RSA relies on factoring
N is public (our example was 91)
If you can guess the factors, p, q, then you can discover the private key
Campbell R. Harvey 2018

30. RSA Issues with RSA Factoring algorithms have become very efficient
To make things worse, the algorithms become more efficient as the size of the N increases
Hence, larger and larger numbers are needed for N
This creates issues for mobile and low power devices that lack the computational power
Campbell R. Harvey 2018

31. Elliptic Curve Cryptography
Mathematics of elliptic curves
Does not rely on factoring
Curve takes the form of
y2 = x3 + ax + b
Note that diagram is “continuous” but we
will be using discrete versions of this arithmetic
Note: 4a3 + 27b2 ≠ 0
Bitcoin uses a=0 and b=7
Campbell R. Harvey 2018

32. Elliptic Curve Cryptography
Properties
Symmetric in x-axis
Any non-vertical line intersects in three points
Algebraic representation
Campbell R. Harvey 2018

33. Elliptic Curve Cryptography
Properties: Addition
Define a system of “addition”. To add “P” and
“Q” pass a line through and intersect at third point
“R”. Drop a vertical line down to symmetric part.
This defines P+Q (usually denoted 𝑃⊕𝑄) R P Q
P+Q
Denote Elliptic Curve
as E
Campbell R. Harvey 2018

34. Elliptic Curve Cryptography
Properties: Doubling
Define a system of “addition”. To add “P” and
“P” use a tangent line and intersect at third point.
Drop a vertical line down to symmetric part.
This definite 2P (usually denoted 𝑃⊕𝑃) P
Denote Elliptic Curve
as E 2P
Campbell R. Harvey 2018

35. Elliptic Curve Cryptography (Optional slide)
Properties: Other
P + O = O + P = P for all P ∈ E.
(existence of identity)
(b) P + (−P) = O for all P ∈ E.
(existence of inverse)
(c) P + (Q + R) = (P + Q) + R for all P, Q, R ∈ E.
(associative)
(d) P + Q = Q + P for all P, Q ∈ E
(communativity)
Denote Elliptic Curve
as E
Campbell R. Harvey 2018

36. Elliptic Curve Cryptography (Optional slide)
Why use in cryptography?
Suggested by Koblitz and Miller in 1985
Implemented in 2005
Key insight:
Adding and doubling on the elliptic curve is easy but undoing the adding is very difficult
Campbell R. Harvey 2018

37. Elliptic Curve Cryptography (Optional slide)
Modulo arithmetic on EC
Example of modulo 67 (means only points are between 0 and 66
Notice the symmetry
Campbell R. Harvey 2018

38. Elliptic Curve Cryptography (Optional slide)
Modulo arithmetic on EC
Notice the symmetry (reflection in the red line)
Campbell R. Harvey 2018

39. Elliptic Curve Cryptography (Optional slide)
Modulo arithmetic on EC
Example of modulo 67
Addition of (2,22) and (6,25)
Note (2,22) called the “base point”
The dashed blue line wraps around and intersects at (47,39) and the reflection is (47,28)
Campbell R. Harvey 2018

40. Elliptic Curve Cryptography (Optional slide)
Modulo arithmetic on EC
Example of modulo 67
Addition of (2,22) and (6,25)
Note (2,22) called the “base point”
The dashed blue line wraps around and intersects at (47,39) and the reflection is (47,28)
Campbell R. Harvey 2018

41. Elliptic Curve Cryptography (Optional slide)
Four choices:
Form of elliptic curve
Prime modulo
Base point
Order
Campbell R. Harvey 2018

42. Elliptic Curve Cryptography (Optional slide)
Four choices:
Form of elliptic curve: y2 = x3 + 7
Prime modulo: 2256 – 232 – 29 – 28 – 27 – 26 – 24 - 1 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F
Base point: 04 79BE667E F9DCBBAC 55A06295 CE870B07 029BFCDB 2DCE28D9 59F2815B 16F81798 483ADA77 26A3C465 5DA4FBFC 0E1108A8 FD17B448 A  9C47D08F FB10D4B8
Order: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D
Campbell R. Harvey 2018

43. Elliptic Curve Cryptography (Optional slide)
How it works:
Private key is a random number chosen between 1 and the order
Public key = private key*base point
Maximum number of private keys (and bitcoin addresses) is equal to the order.
It is straightforward to go from private key to a public key – but brutally difficult to go from public key to private key.
Campbell R. Harvey 2018

44. Elliptic Curve Cryptography (Optional slide)
How it works:
1. Choose private key and derive public key
Let prime modulus = m
Let base point (x,y) = G
Let order = n
Let private key = d (which is just a number)
Public key Q(x,y) = d*G [operations on the elliptic curve with prime modulus m]
Campbell R. Harvey 2018

45. Elliptic Curve Cryptography (Optional slide)
How it works:
2. Sign
Let data = z (which could be a SHA-256 of the data you are signing)
Generate a random number k
Calculate k*G which leads to particular coordinates (x,y)*
Calculate r = x mod n [Note n=order]
Calculate s = (z + r*d)/k mod n
Digital Signature (DS) = (r, s) is just a set of coordinates
Private key
Campbell R. Harvey 2018
*I am not sure what modulus is used for this EC operation.

46. Elliptic Curve Cryptography (Optional slide)
How it works:
3. Verify
Calculate w = s-1 mod n
Calculate u = z*w mod n
Calculate v = r*w mod n
Calculate the point (x’, y’) = uG + vQ
Verify that r = x’ mod n If yes, verified.
Remember DS = (r, s)
Base point
Public key
Campbell R. Harvey 2018

47. Elliptic Curve Cryptography (Optional slide)
How it works:
4. Intuition
Anyone can encrypt something with a public key
The digital signature algorithm uses the data, a random number, and both the private and public keys
Verification shows that only the owner of both the private and public key could have signed. Verification is a “yes” or a “no”.
Campbell R. Harvey 2018

48. ECDSA Private key is a number called “signing key” (SK). It is secret.
Public key is the “verification key” and is mathematically linked to the private key EC SK VK
Private key:
(number)
Elliptic curve operations:
Need base point, modulus, order
Public key:
coordinate (x, y)
Note: Easy to generate a public key with a private key. Not easy to go the other way.
Campbell R. Harvey 2018

49. ECDSA Digital signature EC DS SK Private key: (number)
Nonce:
(random number)
Nonce EC
Message DS SK
Private key:
(number)
Elliptic curve operations:
Need base point, modulus, order (n)
Digital signature:
coordinate (r, s)
Campbell R. Harvey 2018

50. ECDSA Verification s EC (x’, y’) VK Elliptic curve operations:
coordinates r
Yes (verified) s EC
(x’, y’)
r = x’ mod n ?
Message No
(rejected) VK
Elliptic curve operations:
Need base point, order (n)
Derive new point
on elliptic curve
Check x coordinate
of new point and DS
Public key:
(x, y)
Campbell R. Harvey 2018

51. How DSAs Work
Notice
Proves that the person with the private key (that generated the public key) signed the message.
Interestingly, digital signature is different from a usual signature in that it depends on the message, i.e., the signature is different for each different message.
In practice, we do not sign the message, we sign a cryptographic hash of the message. This means that the size of the input is the same no matter how long the message is.
Campbell R. Harvey 2018

52. ECDSA in Action https://kjur.github.io/jsrsasign/sample-ecdsa.html
Campbell R. Harvey 2018

53. ECDSA in Action
OP_CHECKSIG uses Public Key + Digital Signature + Hash of Transaction
Verifies whether this transaction has been signed by the owner of the Private Key
Campbell R. Harvey 2018

54. Application: PGP Email
My public key for secure
You can encrypt an to me with my public key and only I can decrypt with my private key.
Campbell R. Harvey 2018

55. Application: PGP Email
Steps
Message compressed
Random session key (based on mouse movements and keystrokes) is generated.
Message encrypted with session key
Session key is encrypted with receiver’s public key
Encrypted message + encrypted session key sent via
Recipient uses their private key to decrypt the session key
Session key is used to decrypt the message
Message decompressed
Campbell R. Harvey 2018

56. References The Math Behind Bitcoin [recommended]
Elliptic Curve Digital Signature Algorithm (Bitcoin)
What does the curve used in Bitcoin, secp256k1, look like?
Elliptic Curve Digital Signature Algorithm (Wikipedia)
Elliptic Curve Cryptography (UCSB)
Elliptic Curve Cryptography and Digital Rights Management (Purdue)
Zero to ECC in 30 minutes (Entrust)
The Elliptic Curve Cryptosystem
Goldwasser, Shaffi and Mihir Bellare, 2008, Lecture Notes on Cryptography
Dan Boneh, Stanford University, Introduction to Cryptography
Dan Boneh, Stanford University, Cryptography II
Campbell R. Harvey 2018