1. Asymmetric Key Signatures David Evans and Samee Zahur CS4501, Fall 2015

2. Please pay $1000 to my employee --TheBoss You have money!

3. Real-life Signatures Easy to verify Bank has your signature Forging unlikely Legal consequences of forging Checkbooks are well-guarded Copying it requires physical access Hard to repudiate Bank keeps a copy for few months

4. Digital Signatures

5. Topics Asymmetric cryptography Digital signatures Elliptic curve cryptography Implementation pitfalls

6. Ordinary (or symmetric) crypto Message key

7. Whitfield Diffie Martin Hellman New Directions in Cryptography, 1976

8. Diffie-Hellman Key Exchange

9. Discrete Logarithm Problem

11. Random element out of …?

12. Mod 5 Exponentiation 0123456… 0-000000… 11111111… 21243124… 31342134… 41414141… Order 1 Order 2

13. Exponent Modulus

16. Public-key Cryptography

17. Man-in-the-Middle (MITM)

18. Digital Signature

19. Recall

20. Discrete-log based signature

21. ElGamal Signature Scheme

22. Bitcoin Payment Sign it like a check!

23. Recap 1.We want to sign transactions digitally on the bitcoin network, such that they are: a)Easy to verify b)Hard to forge c)Hard to repudiate 2.Discrete exponentiation is easy, logarithm is hard 3.We used it to make asymmetric (aka. public) key crypto 4.Same principle used for digital signatures

24. Avoiding (overly) long numbers

26. Informal Requirements

27. Group

28. Additional Cryptographic Properties Discrete logarithm should be hard Group operation should be efficient Implies small key sizes

29. Elliptic Curve Cryptography (ECC) Group elements: points on the curve, P, Q, and R Point “addition”: using “geometry”. P+Q=R P Q R

30. Elliptic “Curve” Image from: http://www.coindesk.com/math-behind-bitcoin/http://www.coindesk.com/math-behind-bitcoin/

31. Elliptic Curve Digital Signature Algorithm (ECDSA) ECDSA Inputs: message, private key 1.Pick random k 2.Compute a), let 3.Send with message Verification If, check

34. Please pay $1000 to my employee --TheBoss You have money! Jason Benjamin

35. Logistics Next class: hash functions and Bitcoin consensus Checkup 1 on Monday. Includes everything till today