Lecture 9. Public Key Cryptography: Algorithms, Key Sizes, & Standards. Public-Key Cryptography

Transcription

1 Lecture 9 Public Key Cryptography: Algorithms, Key Sizes, & Standards Public-Key Cryptography 1

2 Bases of the public cryptosystems security Factorization Discrete Logarithm Elliptic Curve Discrete Logarithm Given: N = p q y = g x mod p = = g g g... g Q = x P = = P+P+ +P x times x times constants p, g P - point of an elliptic curve Unknown: p, q x x Elliptic Curve over GF(p) y 2 =x 3 +x 2

3 Elliptic Curve Addition over GF(p) Y 2 = X 3 + X mod 23 Y 25 Points fullfiling the equation of the curve P=(3,13) P=(6,19) Q=(7,12) A D 2P=P+P=(7,11) Addition Doubling R=P+Q=(13,7) + special point J (point at infinity) such that: P+ J = J+ P = P X Scalar Multiplication Q = k. P = P + P + P P point number (scalar) point k- times 3

4 Alice Diffie-Hellman g - generator of Z p * Bob A s private key: x A A s public key: y A = g x A Secret derivation B s private key: x B B s public key: y B = g x B Secret derivation z AB = y B x A = g x Bx A zba = y A x B = g x Ax B Alice Elliptic Curve Diffie-Hellman P - generator of E(GF(q)) Bob A s private key: x A A s public key: Q A = x A P Secret derivation B s private key: x B B s public key: Q B = x B P Secret derivation Z AB = x A Q B = x A (x B P) Z BA = x B Q A = x B (x A P) 4

5 Elliptic Curve Cryptosystems - ECC Advantages a family of public key cryptosystems, rather than a single cryptosystem strong alternative for RSA several times shorter keys fast and compact implementations, in particular in hardware Elliptic Curve Cryptosystems - ECC Disdvantages complex mathematical description shorter period of research on the cryptanalysis 5

6 Best known attacks Basis of the cryptosystem security Factorization Discrete Logarithm Elliptic Curve Discrete Logarithm Best known attack General Number Field Sieve 1. General Number Field Sieve 2. Parallel collision search 2. Parallel collision search Complexity of the attack: subexponential 1. subexponential 2. exponential exponential Best Algorithm to Factor Large Numbers NUMBER FIELD SIEVE Complexity: Sub-exponential time and memory Execution time N = Number to factor, k = Number of bits of N Exponential function, e k Sub-exponential function, e k1/3 (ln k) 2/3 Polynomial function, a k m k = Number of bits of N 6

7 Factoring 1024-bit RSA keys using Number Field Sieve (NFS) Polynomial Selection Relation Collection Sieving 200 bit & 350 bit smooth numbers Minifactoring (Cofactoring, Norm Factoring) ECM, p-1 method, rho method Linear Algebra Square Root number decimal digits Factorization records date time (phase 1) algorithm C MIPS years mpqs RSA VI MIPS years mpqs RSA IV MIPS years mpqs RSA IV MIPS years gnfs RSA II MIPS years gnfs RSA VIII MIPS years gnfs C I Pentium 1GHz CPU years gnfs RSA III Pentium 1GHz CPU years gnfs RSA XII Pentium 1GHz CPU years gnfs C V Pentium 1GHz CPU years gnfs RSA V Pentium 1GHz CPU years gnfs RSA XII ,400 Opteron 1 GHz CPU years gnfs 7

8 When? Who? Factoring RSA bits = 232 decimal digits Aug Dec Multiple researchers from EPFL, NTT, Bonn University, INRIA, MS Research, CWI Effort? Sieving time Total time 3,300 Opteron 1 GHz CPU years 4,400 Opteron 1 GHz CPU years Factorization records He who has absolute confidence in linear regression will expect a 1024-bit RSA number to be factored on December 17,

9 For the most recent records see Factorization Announcements & Records at TWIRL February 2003 Adi Shamir & Eran Tromer, Weizmann Institute of Science Hardware implementation of the sieving phase of Number Field Sieve (NFS) Assumed technology: CMOS, 0.13 µm clock 1 GHz 30 cm semiconductor wafers at the cost of $5,000 each 9

10 TWIRL A. Shamir, E. Tromer Crypto 2003 Tentative estimations (no experimental data): 512-bit RSA: 1024-bit RSA: < 10 minutes $ 10 k < 1 year $ 10 million Theoretical Designs for Sieving (1) Mesh Based Sieving / YASD (Geiselmann & Steinwandt, PKC 2003 Geiselmann & Steinwandt, CT-RSA 2004) - not suitable for 1024 bit numbers 2005 SHARK (Franke et al., SHARCS & CHES 2005) - relies on an elaborate butterfly switch connecting large number of chips - difficult to realize using current technology 10

11 2007 Theoretical Designs for Sieving (2) Non-Wafer-Scale Sieving Hardware (Geiselmann & Steinwandt, Eurocrypt 2007) - based on moderate size chips (2.2 x 2.2 cm) - communication among chips seems to be realistic - 2 to 3.5 times slower than TWIRL - supports only linear sieving, and not more optimal lattice sieving Estimated recurring costs with current technology (US$ year) by Eran Tromer, May 2005 Traditional PC-based 768-bit 1024-bit TWIRL Mesh-based SHARK But: non-recurring costs, chip size, chip transport networks 11

12 However None of the theoretical designs ever built. Just analytical estimations, no real implementations, no concrete numbers First Practical Implementation of the Relation Collection Step in Hardware 2007 Japan Tetsuya Izu and Jun Kogure and Takeshi Shimoyama (Fujitsu) CHES CAIRN 2 machine, September 2007 SHARCS 2007 CAIRN 3 machine, September

13 First large number factored using FPGA support Factored number: N = P Q 423-bits 205 bits 218 bits Time of computations: One month of computations using a PC supported by CAIRN 2 for a 423-bit number Problems: CAIRN 3 about 40 times faster than CAIRN 2 Time of sieving with CAIRN 3 for a 768-bit key estimated at 270 years - Speed up vs. one PC (AMD Opteron): only about 4 times - Limited scalability Workshop Series SHARCS - Special-purpose Hardware for Attacking Cryptographic Systems 1 st edition: Paris, Feb , nd edition: Cologne, Apr. 3-4, rd edition: Vienna, Sep. 9-10, th edition: Lausanne, Sep. 9-10, th edition: Washington, Mar , 2012 See 13

14 CERG Team Organizing SHARCS 2012 in Washington D.C., Mar , 2012 Keylengths in public key cryptosystems that provide the same level of security as AES and other secret-key ciphers Arjen K. Lenstra, Eric R. Verheul Selecting Cryptographic Key Sizes Journal of Cryptology, 2001 Arjen K. Lenstra Unbelievable Security: Matching AES Security Using Public Key Systems ASIACRYPT

15 Keylengths in RSA providing the same level of security as selected secret-key cryptosystems 0 DES The same cost The same number of operations DES (2 keys) 3 DES (3 keys) AES-128 AES-192 AES Keylengths in RSA providing the same level of security as selected secret-key cryptosystems 0 AES-256 AES-192 AES DES (3K) 3 DES (2K) DES year 15

16 Recommendations of RSA Security Inc. May 6, 2003 Validity period Minimal RSA key length (bits) Equivalent symmetric key length (bits) Five security levels allowed by American government NIST SP , Rev. 4, Jan

17 Comprehensive Recommendations Regarding Key Lengths Public-Key Cryptography Standards unofficial industry standards RSA Labs PKCS PKCS industry standards IEEE P1363 bank standards ANSI ANSI X9 international standards ISO ISO federal standards NIST FIPS 17

18 PKCS Public-Key Cryptography Standards Informal Industry Standards developed by RSA Laboratories in cooperation with Apple, Digital, Lotus, Microsoft, MIT, Northern Telecom, Novell, Sun First, except PGP, formal specification of RSA and formats of messages. IEEE P1363 Working group of IEEE including representatives of major cryptographic companies and university centers from USA, Canada and other countries Part of the Microprocessors Standards Committee Modern, open style Quarterly meetings + multiple teleconferences + + discussion list + very informative web page with the draft versions of standards 18

19 IEEE P1363 Combined standard including the majority of modern public key cryptography Several algorithms for implementation of the same function Tool for constructing other, more specific standards Specific applications or implementations may determine a profile (subset) of the standard ANSI X9 American National Standards Institute Work in the subcommittee X9F developing standards for financial institutions Standards for the wholesale (e.g., interbank) and retail transactions (np. bank machines, smart card readers) ANSI represents U.S.A. in ISO 19

20 ISO International Organization for Standardization International standards Common standards with IEC - International Electrotechnical Commission ISO/IEC JTC1 SC 27 Joint Technical Committee 1, Subcommitte 27 ISO: International Organization for Standardization Long and laborious process of the standard development Minimum 3 years Study period NP - New Proposal WD - Working Draft CD - Committee Draft DIS - Draft International Standard IS - International Standard Review of the standard after 5 years = ratification, corrections or revocation 20

21 NIST FIPS National Institute of Standards and Technology Federal Information Processing Standards American Federal Standards Required in the government institutions Original algorithms developed in cooperation with the National Security Agency (NSA), and algorithms developed in the open research adapted and approved by NIST. Most known public key cryptosystems Based on the difficulty of Factorization Discrete logarithm Elliptic curve discrete logarithm Signature RSA DSA, N-R EC-DSA Encryption RSA El-Gamal EC-El-Gamal Key agreement RSA Diffie-Hellman (DH) EC-DH 21

22 Notes for users of cryptographic products (1) Agreement with a standard does not guarantee the security of a cryptographic product! Security = secure algorithms (guaranteed by standards) proper choice of parameters secure implementation proper use Notes for users of cryptographic products (2) Agreement with the same standard does not guarantee the compatibility of two cryptographic products! compatibility = the same algorithm (guaranteed by standards) the same protocol the same subset of algorithms the same range of parameters 22

23 Modern Cryptography RSA DH DSA ECC Isogeny-based Identity-based Encryption Scheme PKG s Public key Private Key Generator (PKG) PKG s Private key Bob s Private key (encrypted) Bob s ID Alice ENCRYPT Message Ciphertext Bob s ID (Authenticated) Bob DECRYPT Message 23

24 Identity-based Signature Scheme Alice s Private key (encrypted) Alice Message SIGN Private Key Generator (PKG) PKG s Private key M SGN Alice s ID PKG s Public key VERIFY Bob Accept or Reject Promising PQC Families Family Encryption Signature Key Agreement Hash-based XX Code-based XX X Lattice-based XX X Multivariate X XX Supersingular Elliptic Curve Isogeny XX XX high-confidence candidates, X medium-confidence candidates 48 24

25 Post-Quantum Cryptography NIST Project NIST Call for Proposals and Request for Nominations for Public-Key Post-Quantum Cryptographic Algorithms: Dec Deadline for submitting candidates: November 30, 2017 Source: Moody, NIST