1. cryptography Readings Encryption, Decryption, & Digital Certificates

2. R IVEST S HAMIR A DLEMAN Problem Exchanging Key for encryption securely Signing a message (proving the true-party sent it) Solution (confidentiality) M^e mod n = Ciphertext n = (p * q) where p & q are 2 very large ‘random’ prime numbers e is derived from p and q C^d mod n = M d is derived from p and q Anyone can know (e,n) d must be secret Solution (signing) S = D B (M) (D = decrypt with private key = encrypt plaintext with private key) E(S) = E A (S) (E A = Encrypt with public) S = D A (E(S) M = E B (S)

3. Requirements For RSA to be Secure You can decrypt an encrypted message back to its original plaintext. Encryption for Confidentiality Both the public (e) and private (d) keys are easy to compute. By making the (e) key public, there is no easy way to compute (d). You can encrypt a decrypted message back to its original plaintext. Encryption for Authentication (Integrity)

4. PROBLEM How do you exchange the key(s) necessary for encryption? Solution: Diffie-Hellman math – don’t ask me to explain Requirements: p and q Two random very large numbers 100’s of digits long or longer n = p * q if p and q are sufficiently large it is almost impossible to factor n and come up with p and q; thus almost impossible to determine d! d = private key; derived from p and q (see wikipedia)see wikipedia e = public key; derived from p and q (see wikipedia)see wikipedia

5. THE MATH Plaintext Message = M Convert PlainText to number (binary) = M M^e (mod n) = CipherText(C) e and n are publicly known, either sent to party for communication or stored publicly (CA’s) C^d (mod n) = M

6. An Example An Example

7. Its all about key size Digits # of Operations Time* 501.4 x 10^103.9 hours 759.0 x 10^12104 days 1002.3 x 10^1574 years 2001.2 x 10^233.8 x 10^9 years 3001.5 x 10^294.9 x 10^15 years 5001.3 x 10^394.2 x 10^25 years * 1 operation = 1 microsecond (1 millionth of a second)

8. WEAKEST LINK FAILURE What is the weakest link in RSA?

9. FEBRUARY 2012 What did security researchers allege? Were they right? What is a Pseudo-Random Number Generator? What size keys should be in use today?

10. Digital Certificates & SSL/TLS

11. What does SSL/TLS Assure? Encrypted message between browser and server Authentication of server Depends on..... What are root certificate authorities? How are they used? Can the system be made more secure? If so, How?

12. Using Certificates to Authenticate Software