Pass in HW6 now

1
DTTF/NB479 Dszquphsbqiz Day 26

• Pass in HW6 now
• Can use up to 2 late days
• But one incentive not to burn them allteams
  will get to pick their presentation day in the
  order
• Announcements
• HW7 posted.
• Questions?
• This week
• Discrete Logs, Diffie-Hellman, ElGamal
• Hash Functions

2
Plus-delta feedback

• Thanks for some great feedback! My eyes are
  opened.

3
Discrete Logs
Given
Find x We denote this as Why is this hard?
4
Diffie-Hellman Key Exchange

• Publish large prime p, primitive root a
• Alices secret exponent x
• Bobs secret exponent y
• 0 lt x,y lt p-1
• Alice sends ax (mod p) to Bob
• Bob sends ay (mod p) to Alice
• Each know key Kaxy
• Eve sees p, ax , ay why cant she determine axy?

5
Diffie-Hellman Key Exchange

• Computational Diffie-Hellman problem
• Given a, p, ax (mod p), ay (mod p), find axy
  (mod p)
• Not harder than problem of finding discrete logs
• Is it easier? No one knows!
• Decision Diffie-Hellman problem
• Given a, p, ax (mod p), ay (mod p), and c ! 0
  (mod p). Verify that caxy (mod p)

• Publish large prime p, primitive root a
• Alices secret exponent x
• Bobs secret exponent y
• 0 lt x,y lt p-1
• Alice sends ax (mod p) to Bob
• Bob sends ay (mod p) to Alice
• Each know key Kaxy
• Eve sees a, p, ax , ay why cant she determine
  axy?

Whats the relationship between the two? Which is
harder?
6
ElGamal Cryptosystem

• Another public-key cryptosystem like RSA.
• Bob publishes (a, p, b), where 1 lt m lt p and baa
• Alice chooses secret k, computes and sends to Bob
  the pair (r,t) where
• rak (mod p)
• t bkm (mod p)
• Bob calculates tr-am (mod p)
• Why does this decrypt?

7
ElGamal Cryptosystem

• Bob publishes (a, p, b), where 1 lt m lt p and baa
• Alice chooses secret k, computes and sends to Bob
  the pair (r,t) where
• rak (mod p)
• t bkm (mod p)
• Bob finds tr-am (mod p)
• Why does this work?

• Multiplying m by bk scrambles it.
• Eve sees a, p, b, r, t. If she only knew a or k!
• Knowing a allows decryption.
• Knowing k also allows decryption. Why?
• Cant find k from r or t. Why?

8
ElGamal
Name ______________________

1. Show that Bobs decryption works
2. Eve would like to know k. Show that knowing k
   allows decrpytion. Why?
3. Why cant Eve compute k from r or t?
4. Challenge Alice should randomize k each time. If
   not, and Eve gets hold of a plaintext /
   ciphertext (m1, r1, t1), she can decrypt other
   ciphertexts (m2, r2, t2). Show how.
5. If Eve says she found m from (r,t), can we verify
   that she really found it, using only m,r,t, and
   the public key (and not k or a)? Explain.

• Bob publishes (a, p, b), where 1 lt m lt p and baa
• Alice chooses secret k, computes and sends to Bob
  the pair (r,t) where
• rak (mod p)
• t bkm (mod p)
• Bob finds tr-am (mod p)

Notes