DiffieHellman

1
Diffie-Hellman

• Diffie-Hellman is a public key distribution
  scheme
• First public-key type scheme, proposed in 1976.
• W Diffie, M E Hellman, "New directions in
  Cryptography", IEEE Trans. Information Theory,
  IT-22, pp644-654, Nov 1976

2
Diffie-Hellman

• Public-key distribution scheme
• Cannot be used to exchange an arbitrary message
• Exchange only a key, whose value depends on the
  participants (and their private and public key
  information)
• The algorithm is based on exponentiation in a
  finite (Galois) field, either over integers
  modulo a prime, or a polynomial field
• exponentiation takes O((log n)3) operations

3
Diffie-Hellman

• Security relies on the difficulty of computing
  logarithms in these fields
• discrete logarithms takes O(e log n log log n)
  operations
• The algorithm
• two people Alice and Bob who wish to exchange
  some key over an insecure communications channel.
• They select a large prime p (200 digit), such as
  (p-1)/2 should also be prime
• They also select g, a primitive root mod p
• g is a primitive if for each n from 0 to p-1,
  there exists some a where ga n mod p.

4
Diffie-Hellman

• The algorithm
• The values of g and p dont need to be secret
• Alice then chooses a secret number xA
• Bob also chooses a secret number xB
• Alice and Bob compute yA and yB respectively,
  which are then exchanged
• yA gxA mod p yB gxB mod p
• Both Alice and Bob can calculate the key as
• KAB gxA.xB mod p
• yAxB mod p (which B can compute)
• yBxA mod p (which A can compute)
• The key may then be used in a private-key cipher
  to secure communications between A and B

5
Diffie-Hellman

• Can be expanded to be used with many parties
• Can be extended to
• Finite fields
• Elliptic curves
• Galois field
• El Gamal use the same idea for encryption and
  digital signature

6
Knapsack

• The knapsack problem is NP-complete
• Although it comes from a NP-complete problem, the
  knapsack algorithm (Merkle-Hellman) was broken
• The problem is
• Given s1, s2, , sn, T, positive integers.
• Problem Is there a vector in the binary field
  (x1, x2, , xn) such as

7
Knapsack

• The problem is easy to solve for superincreasing
  sets
• for all js
• To solve
• for i 1 down to 1
• If T?si
• T T-si, xi 1
• Else
• xi 0
• The solution will be unique if it exists

8
Knapsack

• The Merkle-Hellman algorithm uses the knapsack
  principle
• Consider a superincreasing sequence
• s (s1, s2, , sn)
• The encryption of x (x1, x2, , xn), in the
  binary field, will be
• Is this a good scheme??

9
Merkle-Hellman

• Solution
• To make it a one way function permute s, so it is
  not superincreasing any more
• Chose a prime p, greater than the sum of the
  sequence
• Chose a linear transformation f
• f(x) ax mod p

10
Merkle-Hellman

• From the superincreasing sequence s (s1, s2, ,
  sn), calculate f(s) (f(s1), f(s2), , f(sn))
• Make f(s) public
• Now, to encrypt x calculate CEf(s)(x)
• To decrypt C you need to know the function f.

11
Merkle-Hellman

• Example
• Consider the superincreasing sequence
• 2, 5, 9, 21, 45, 103, 215, 450, 946
• Define the function f as
• f(x) (1289x) mod 2003
• The public key is then
• 575, 436, 1586, 1030, 1921, 569, 721, 1183, 1570

12
Merkle-Hellman

• Example
• To encrypt x 101100111 we do
• 575 1586 1030 721 1183 1570 6665
• To recover the plaintext we use
• 1289-1 317
• So 3196665 1643 mod 2003
• Knowing the superincreasing sequence we recover x
  101100111

13
El Gamal

• A variant of the Diffie-Hellman key distribution
  scheme, allowing secure exchange of messages
• Published in 1985 by ElGamal in
• T. ElGamal, "A Public Key Cryptosystem and a
  Signature Scheme Based on Discrete Logarithms",
  IEEE Trans. Information Theory, vol IT-31(4),
  pp469-472, July 1985.
• Like Diffie-Hellman its security depends on the
  difficulty of factoring logarithms

14
El Gamal

• Key Generation
• Select a large prime p (200 digit), and g a
  primitive element mod p
• Bob has a secret number xB
• Bob compute yB, which is made public
• yB gxB mod p
• To encrypt a message M into ciphertext C
• Selects a random number k, 0 lt k lt p-1
• Computes the message key K
• K yBk mod p

15
El Gamal

• To encrypt a message M into ciphertext C
• Compute the ciphertext pair C c1,c2
• c1 gk mod p, c2 KM mod p
• To decrypt the message
• Extracts the message key K
• K c1xB mod p gk.xB mod p
• Extracts M by solving for M in the following
  equation
• c2 K.M mod p