1. Cryptography
Lecture 19

2. Q and A; bring the written answers to TA before the class
1. Corollary 8.17 and corollary 8.21 are at the center of RSA. Remember them.
2. What is a cyclic group? What is the generator?
3. Understand examples 8.57 – Come with questions.
4. What are RSA assumption and Discrete log assumption, respectively? What kind of groups are they working on?

3. Cyclic groups
Let G be a finite group of order q (written multiplicatively)
Let g be some element of G
Consider the set <g> = {g0, g1, …}
We know gq = 1 = g0, so the set has ≤ q elements
If the set has q elements, then it is all of G !
In this case, we say g is a generator of G
If G has a generator, we say G is cyclic

4. Examples ℤN
Cyclic (for any N); 1 is always a generator: {0, 1, 2, …, N-1} ℤ8
Is 3 a generator? {0, 3, 6, 1, 4, 7, 2, 5} – yes!
Is 2 a generator? {0, 2, 4, 6} – no!

5. Example ℤ*11 Is 3 a generator? {1, 3, 9, 5, 4} – no!
Is 2 a generator? {1, 2, 4, 8, 5, 10, 9, 7, 3, 6} – yes!
Is 8 a generator? {1, 8, 9, 6, 4, 10, 3, 2, 5, 7} – yes! Note that elements appear in a different order from above…

6. Example
ℤ*13
<2> = {1, 2, 4, 8, 3, 6, 12, 11, 9, 5, 10, 7}, so 2 is a generator
<8> = {1, 8, 12, 5}, so 8 is not a generator

7. Important examples
Theorem: Any group of prime order is cyclic, and every non-identity element is a generator
Theorem: If p is prime, then ℤ*p is cyclic
Note: the order is p-1, which is not prime for p > 3

8. Uniform sampling
Given cyclic group G of order q along with generator g, easy to sample a uniform hG:
Choose uniform x{0, …, q-1}; set h := gx

9. Discrete-logarithm problem
Fix cyclic group G of order q, and generator g
We know that {g0, g1, …, gq-1} = G
For every hG, there is a unique xℤq s.t. gx = h
Define loggh to be this x – the discrete logarithm of h with respect to g (in the group G)

10. Examples In ℤ*11 In ℤ*13 What is log2 9? What is log8 9?
<2> = {1, 2, 4, 8, 5, 10, 9, 7, 3, 6}, so log2 9 = 6
What is log8 9?
<8> = {1, 8, 9, 6, 4, 10, 3, 2, 5, 7}, so log8 9 = 2
In ℤ*13
<2> = {1, 2, 4, 8, 3, 6, 12, 11, 9, 5, 10, 7}, so log2 9 = 8

11. Discrete-logarithm problem (informal)
Dlog problem in G: Given generator g and element h, compute loggh
Dlog assumption in G: Solving the discrete log problem in G is hard

12. Example
In ℤ*
What is log ?

13. Discrete-logarithm problem
Let G be a group-generation algorithm
On input 1n, outputs a (description of a) cyclic group G, its order q (with ǁqǁ=n), and a generator g
For algorithm A, define exp’t DlogA,G(n):
Compute (G, q, g)  G(1n)
Choose uniform hG
Run A(G, q, g, h) to get x
Experiment evaluates to 1 if gx = h

14. Discrete-logarithm problem
The discrete-logarithm problem is hard relative to G if for all PPT algorithms A, Pr[DlogA,G(n) = 1] ≤ negl(n)

15. Diffie-Hellman problems
Fix cyclic group G and generator g
Define DHg(h1, h2) = DHg(gx, gy) = gxy

16. Example
In ℤ*11
<2> = {1, 2, 4, 8, 5, 10, 9, 7, 3, 6}
So DH2(7, 5) = ?
In ℤ*
What is DH2( , )?
Is the answer, or is it just a random element of ℤ* ?

17. Diffie-Hellman assumptions
Computational Diffie-Hellman (CDH) problem:
Given g, h1, h2, compute DHg(h1, h2)
Decisional Diffie-Hellman (DDH) problem:
Given g, h1, h2, distinguish DHg(h1, h2) from a uniform element of G

18. DDH problem Let G be a group-generation algorithm
On input 1n, outputs a cyclic group G, its order q (with ǁqǁ=n), and a generator g
The DDH problem is hard relative to G if for all PPT algorithms A: | Pr[A(G, q, g, gx, gy, gz)=1] – Pr[A(G, q, g, gx, gy, gxy)=1] | ≤ (n)

19. Relating the Diffie-Hellman problems
Relative to G:
If the discrete-logarithm problem is easy, so is the CDH problem
If the CDH problem is easy, so is the DDH problem
I.e., the DDH assumption is stronger than the CDH assumption
I.e., the CDH assumption is stronger than the dlog assumption

20. Group selection The discrete logarithm is not hard in all groups!
For example, it is easy in ℤN (for any N, and for any generator)
Nevertheless, there are certain groups where the problem is believed to be hard
Note: since all cyclic groups of the same order are isomorphic, the group representation matters!

21. Group selection
For cryptographic applications, best to use prime-order groups
The dlog problem becomes easier if the order of the group has small prime factors
Prime-order groups have several nice features
E.g., every element except identity is a generator
Two common choices of groups…

22. Group selection: choice 1
Prime-order subgroup of ℤ*p, p prime
E.g., p = tq + 1 for q prime
Take the subgroup of tth powers, i.e., G = { [xt mod p]| x  ℤ*p }
This is a group
It has order (p-1)/t = q
Since q is prime, the group must be cyclic
Generalizations based on finite fields also used

23. Group selection: choice 2
Prime-order subgroup of an elliptic curve group
See book for details…

24. Group selection We will describe algorithms in “abstract” groups
Can ignore details of the underlying group in the analysis
Can instantiate with any (appropriate) group for an implementation