An Improvement of the Basic El-Gamal Public Key Cryptosystem

Transcription

1 Iteratioal Joural of Computer Applicatios Techology ad Research A Improvemet of the Basic El-Gamal Public Key Cryptosystem W.D.M.G.M. Dissaayake (PG/MPhil/2015/09 Departmet of Computer Egieerig Faculty of Egieerig, Uiversity of Peradeiya, Sri Laaka Abstract: I this paper a improvemet of the El-Gamal public key cryptosystem is preseted. The public key of the El-Gamal system is ot chaged i this method. But, the sedig structure of message ad the decryptio process are chaged. The El-Gamal cryptosystem is ot secure uder adaptive chose ciphertext attack. That meas El-Gamal cryptosystem ca be ciphertext attacked without kowig ay key. Therefore chagig keys of El-Gamal cryptosystem are ot useful. This improvemet cryptosystem immues agaist CPA ad CCA attacks. This cryptosystem is practical ad very simple. The importace of this modified cryptosystem is ay adversary ca t fid the sedig message i easily. Keywords: public key cryptosystem, RSA public key cryptosystem, El-Gamal public key cryptosystem, Elliptic Curves Cryptosystem, chose ciphertext attack, chose plaitext attack 1 INTRODUCTION Sice the public key cryptography was itroduced by Diffie ad Hellma i 1976, desigig Public Key Crypto Systems is very importat research area i world. RSA cryptosystem, El-Gamal cryptosystem ad Elliptic Curves cryptosystem are famous public key cryptosystems. But, there is o guaratee for the security of ay cryptosystem yet. For a example ayoe ca attack to the ciphertext of El-Gamal cryptosystem without kowig ay keys. May coutries are tryig to fid a better cryptosystem ad fud more to research projects based o cryptography. There are may public key cryptosystems have bee developed i world. But, we ca t trust 100% oe of those systems. I describe here briefly the defiitio of public key cryptosystem ad two famous public key cryptosystems i world, the RSA public key cryptosystem ad the El-Gamal public key cryptosystem. 1.1 Defiitio: A public key cryptosystem is a tuple of probabilistic polyomial time algorithm (Kge, Ec, Dec such that: 1. Kge is a probabilistic key geeratio algorithm that takes as iput 1 k for a security parameter k N ad returs a public key pk ad a secret key sk. The public key pk defies a space M, called message space. 2. Ec is a probabilistic algorithm that takes as iput a public key pk ad a message m M ad returs a ciphertext c. 3. Dec is a determiistic algorithm that takes as iput a secret key sk ad a ciphertext c, ad returs a message m or the reject symbol. Moreover a further fudametal property is required: correctess. We wat that for every k N, every pair (pk, sk Kge(1 k, ad for every message m M, the followig equatio holds: Pr[Dec(sk, Ec(pk, m = m] = RSA public key cryptosystem This public key cryptosystem was itroduced by R.L. Rivest, A. Shamir ad L. Adlema i This system was the first practical public key cryptosystem. Followig is the RSA scheme. 1. Two large prime umbers are geerated. Let p ad q. 2. Modulus is geerated by multiplyig p ad q. 3. The totiet of is ф( = (p-1.(q-1 is calculated. 4. Public Key: A prime umber e is selected. where 3 e ф( ad gcd [e, ф(] = 1; gcd meas greatest commo divisor. 5. Private Key: The iverse of e with respect to mod ф( is calculated. The RSA fuctio for message m ad key k is, F (m, k m k mod Ecryptio: m e mod c Decryptio: c d mod m Example: Let p = 7 ad q = 11. The = 77 ad ф( = 60 Choose e = 13. gcd [e, ф(] = 1, The the secret key d ca fid easily. e.d 1 mod ф( i.e = 1 mod 60, Hece, d = 37. Let the message is m = 6 Ecryptio: m e mod 6 13 mod c Decryptio: c d mod mod 77 6 m The security of RSA is based o the ifeasibility of factorizatio large. 1.3 The El-Gamal cryptosystem This public key cryptosystem was itroduced by Taher Elgamal i Step 01: Global elemets: Let ay large prime umber p ad a primitive root g of p. Step 02: Decryptio key: x private, Calculate g x mod p, Publish ( p, g, g x mod p. Step 03: Ecryptio: Let the message is m; ( 0 < m < p ad choose y - Compute b = g y mod p. The, c m. a y mod p. Sed (b, c. Step 04: Decryptio: Compute b x mod p a y. The, m a y 1. c mod p. Example: Step 01: Select p = 23 ad a primitive root of p = 23 is g = 5. Step 02: Let, x = 8. Calculate g x mod p 5 8 mod Publish ( 23, 5, 16. Step 03: Ecryptio: Let the message is m = 6; ad choose y =

2 Iteratioal Joural of Computer Applicatios Techology ad Research Compute b g y mod p 5 3 mod The, c m. a y mod p mod Sed (10, 12. Step 04: Decryptio: Compute b x mod p 10 8 mod The, mod 23 6 m. The security of El-Gamal cryptosystem is depeded o the discrete logarithm problem. 1.4 A chose ciphertext attack o El- Gamal public key cryptosystem The El-Gamal system is ot secure uder Chose Ciphertext Attack. Ayoe ca easily get the message. Example: Global elemets: Large prime umber p ad a primitive root g of p. Decryptio key: x private, Calculate a g x mod p, Publish ( p, g, a. Ecryptio: Let the message is m; ( 0 < m < p ad choose y - Compute b = g y mod p. The, c m. a y mod p. Sed (b, c. k ad m are chose at radomly by the attacker. Note that all are cosidered i mod p. Let the ciphertext is C = (b, c. C = (b, c = (g y, m. a y Now calculate C by the attacker as follows: C = ( g y g k, a y. m. a k. m C = (g y+k, (m. m. a y+k Give, C to the decryptio oracle. m will be retur. Now we ca get m from m. C = (m. m. a y+k m = m. m m = m. m 1 Therefore we ca get the message easily without ay keys. 2 PROPOSED IMPROVEMENT OF THE EL-GAMAL PUBLIC KEY CRYPTOSYSTEM I proposed a improvemet for the El-Gamal public key cryptosystem. I this paper, I get the message i umerical form. But, we ca get ay stadard represetatio for a large message. Cosider we have to ecrypt a message m. I this method, the public ecryptio key is ( p, g, g x mod p. Here p is ay large prime umber ad g is a primitive root of p. The public ecryptio key is similar to the public ecryptio key of the El- Gamal public key cryptosystem. The structure of the ciphertext C has chaged o the improvemet system. Write m = p 1 p 2 p 3 p i ; Where p i is prime. (0 < i < P. That meas we eed i- prime umbers as products to get m. The (g x mod p y mod p is multiplied by the umber of prime umbers which eeds to get m. c is calculated by the i th power of the message m. The we sed (g y mod p, m i, i. g x.y mod p. I decryptio process first g xy mod p = (g x mod p y is calculated. The i. (g x mod p y mod p. is divided by (g x mod p y. Now we have i. The takig the iverse of i o c we ca get the message m. You ca use this system with followig steps. Step 01: Global elemets: Let ay large prime umber p ad a primitive root g of p. Step 02: Decryptio key: x private, Calculate g x mod p, Publish ( p, g, g x mod p. Step 03: Ecryptio Process: Let the message is m; ( 0 < m < p ad choose y - Compute b = g y mod p. Write m = p 1 p 2 p 3 p i ; Where p i is prime. (0 < i < p Calculate = i. a y mod p Calculate c = m i Sed (b, c, Step 04: Decryptio: Compute b x mod p a y. The, Calculate b x mod p (Note : = i b x mod p m = c 1 i 2.1 Proof The exteded El-Gamal system decryptio expressio is c bx mod p g y.x mod p = ci.a y mod p = c g y.x mod p i.g x.y mod p = c 1 i = (m i 1 i = m. 2.2 Procedure.Let the public key is (g, a, p ad the ciphertext is (b, c,. See the figure Key Geeratio for the Exteded El- Gamal system Key geeratio of the exteded El-Gamal system is same as the El-Gamal public key cryptosystem. Exteded_ElGamal_Key_Geeratio Select a large prime p Select x to be a member of the group (Z p, ; 1 x p 2 Select g to be a primitive root i (Z p, a g x mod p Public_key (g, a, p Private_key d retur Public_key ad Private_key } 2.4 Exteded El-Gamal Ecryptio Exteded_ElGamal_Ecryptio (g, a, p, i, m Select a radom iteger y i the group (Z p, b g y mod p i. a y mod p c m i 41

3 Iteratioal Joural of Computer Applicatios Techology ad Research retur b, ad c } 2.5 Exteded El-Gamal Decryptio Exteded_ElGamal_Decryptio (x, p, b,, c m c bx mod p retur m } Compute b g y mod p 7 9 mod Write m = 3* 3 * 3; The, i = 3 Calculate = i. a y mod P mod Calculate c = m i Sed (b, c, = (47, 19683, 69 Step 04: Decryptio: Compute b x mod p mod The, Public key (g, a, p Key Geeratio Bob Alice (g, a, p Select p (very large prime Select g (primitive root Select x a = g x mod p Plaitext-m b = g y mod p = i. a y mod p c = m i Ecryptio Ciphertext:(b,,c Private Key -x m = c bx mod p Plaitext-m Decryptio Figure 01- Procedure of the improved system 2.6 Computatioal complexity If we use the fast expoetial algorithm the ecryptio ad decryptio of the exteded system ca be doe i polyomial time. 2.7 Examples for the improved system Example 01: Step 01: Select p = 23 ad a primitive root of p = 23 is g = 5. Step 02: Let, x = 8. Calculate g x mod p 5 8 mod Publish ( 23, 5, 16. Step 03: Ecryptio: Let the message is m = 6; ad choose y = 3. Compute a = b g y mod p 5 3 mod Write m = 2 * 3; The, i = 2 Calculate = i. a y mod P mod 23 4 Calculate c = m i Sed (b, c, = (10, 36, 4 Step 04: Decryptio: Compute b x mod p 10 8 mod The, Calculate = 4 = 2 b x mod P 2 (Note : = i b x mod P m = c 1 i = = 6 Example 02: Step 01: Select p = 71 ad a primitive root of p = 71 is g = 7. Step 02: Let, x = 25. Calculate a = g x mod p 7 25 mod Publish ( 71, 7, 41. Step 03: Ecryptio: Let the message is m = 27; ad choose y = 9.. Calculate = 69 = 3 b x mod P 23 (Note : m = c 1 i = = 27 b x mod P = i 3 THE IMMUNITY FOR A CHOSEN CYPHERTEXT ATTACK Global elemets: Let ay large prime umber p ad a primitive root g of p. Decryptio key: x private, Calculate g x mod p, where x Z. Publish ( p, g, g x mod p. Ecryptio Process: Let the message is m; ( 0 < m < p ad choose y - Compute b = g y mod p. Write m = p 1 p 2 p 3 p i ; Where p i is prime. ( 0 < i < p Calculate = i. a y mod p Calculate c = m i Sed (b, c, Now the attacker gets the ciphertext C = (b, c, Attacker chooses values k, m ad t radomly. (Accordig to previous attack to the El-Gamal public key cryptosystem, the attacker chooses oly two radom values. From two values he ca ever attack to this exteded system. So, the attacker chooses 3 values to attack to this exteded system. C = (b, c, = (g y, m i, i. a y mod p 42

4 Iteratioal Joural of Computer Applicatios Techology ad Research Now calculate C by the attacker as follows: C = ( g y. g k, m i. m t,. a y mod p. t. a k mod p. C = (g y+k, m i. m t, (i. t. (a y mod p. (a k mod p Give, C to the decryptio oracle. m will be retur. m = m i. m t m = ( m 1 i m t The attacker does ot kow the value of i. Therefore he ca t get m from m. So, above ciphertext attack will be failure i this exteded El- Gamal system. 4 SECURITY OF THE IMPROVED PUBLIC KEY CRYPTOSYSTEM 4.1 Notios of Security Sematic Security (idistiguishability of Ecryptios/ IND: This otio was itroduced by Goldwasser ad Micali [12]. This property captured the idea accordig to which a adversary should ot be able to get ay iformatio about a plaitext, its legth excepted give its ecryptio. Chose Plaitext Attack (CPA: The adversary ca access a ecryptio oracle ad hece to the ecryptio of ay plaitext. No-Adaptive Chose Ciphertext Attack (CCA1/ Luchtime Attack/ Midight Attack: The adversary ca access a decryptio oracle before beig give the challege ciphertext. Adaptive Chose Ciphertext Attack (CCA2: Accordig to Rackoff ad Simo [13], the adversary queries the decryptio oracle before ad after beig challeged. But, the adversary may ot feed the oracle with the challege ciphertext itself. 4.2 IND-CPA security of the improved El- Gamal cryptosystem This improved cryptosystem is IND-CPA secure as IND-CPA security of El-Gamal public key cryptosystem. Discrete Diffie-Hellma Assumptio: The tuple (g x, g y, g xy is computatioally idistiguishable from (g x, g y, g z $ for x, y, z Z q. Theorem: If the Discrete Diffie-Hellma problem is hard the the improved El-Gamal cryptosystem is IND-CPA secure. Proof: (By cotradictio. Assume that a adversary ca break the improved El-Gamal cryptosystem, That is, it has sigificat advatage by a real or radom defiitio, AdvA = Pr[A E pk (pk = 1] Pr [A E pk 0$ (pk = 1]. Sice improved cryptosystem is a public key ecryptio scheme, if it is secure agaist a sigle query it is secure agaist q queries, so we oly eed to show that it is (t, q, ε secure for q = 1; we ca thus assume that the adversary A makes exactly oe query. The adversary A that rus i time t ad has advatage δ, we ca costruct aother adversary B for DDH that rus i time t + O(1 ad has advatage δ. B(a, b, c is as follows: 1. Ru A E B (a, where B s versio of the ecryptio oracle E B aswers its oe query m with (b, c. m. 2. Output the same result as A does. I the case where B is called o a triple of the form (g x, g r, g xr, what A sees is idetical to iteractig with a real ecryptio oracle B(g x, g r, g xr = A E pk(pk. I the case where B is called o a tuple of the form(g x, g r, g z, A sees the values a = g x ad (b, c. m = (g r, g z. m. Sice g z is selected uiformly at radom, g z. m is also a uiform radom value ad is thus completely idistiguishable from g zr x. $(m ad (g r, g z. m is the same distributio as g r, g r x. $(m. This makes B a perfect simulator of a radom oracle ad i this case B(g x, g r, g z = A E pk 0$ (pk. This costructio thus turs a adversary that breaks Exteded El-Gamal cryptosystem ito oe that breaks DDH with the same advatage, addig costat time complexity. 5 CONCLUSIONS AND FUTURE WORKS A improvemet of El-Gamal public key cryptosystem has preseted. The security of this improved system depeds o i. If ayoe gets i the he ca fid the message easily. I this system the ecryptio icreases the size of a message. Therefore this improved system is very suitable for small messages or key exchages. I try to solve the problem that is the ecryptio icreases the size of a message of above itroduced system, usig modular expoetiatio methods. 6 ACKNOWLADGEMENT I would like to thak Dr. Sadirigama, M. (Departmet of Computer Egieerig, Faculty of Egieerig, Uiversity of Peradeiya, Sri Laka, Dr. Ishak, M.I.M. (Departmet of Egieerig Mathematics, Faculty of Egieerig, Uiversity of Peradeiya, Sri Laka ad Dr. Alawathugoda, J. (Departmet of Computer Egieerig, Faculty of Egieerig, Uiversity of Peradeiya, Sri Laka for their very useful advice i my research work. 7 REFERENCES [1] [1] Rivest, R., Shamir, A., Adlema, L A method for obtaiig digital sigature ad public key cryptosystems. Commuicatios of the ACM, Vol.21 (1978, [2] Diffie, W., Hellma, M New directios i Cryptography, IEEE Traslatios, Iformatio Theory 22 (1976, [3] ElGamal, T A public key cryptosystem ad a sigature scheme based o discrete logarithms, IEEE Trasactios o Iformatio Theory 31 (1985, [4] Das, A. Public Key Cryptography Theory ad Practice Chapter 3: Algebraic ad Number-theoretic Computatios, [5] Cramer, R., Shoup. V A Practical Public Key Cryptosystem Provably Secure agaist Adaptive Chose Ciphertext Attack, I Crypto 98, Spriger- Verlag (1998, LNCS 1462, [6] Naor, M., Yug, M Public-Key Cryptosystems Provably Secure agaist Chose Ciphertext Attacks. I Proc. of the 22d STOC, ACM Press (1990, [7] Poitcheval, D New Public Key Cryptosystems based o the Depedet-RSA Problem, Advaces i 43

5 Iteratioal Joural of Computer Applicatios Techology ad Research Cryptology Proceedigs of EUROCRYPT 99, J. Ster Ed. Spriger Verlag, LNCS 1592 (1999, [8] Forouza, A.B., Mukhopadhyay, D. Cryptography ad Network Security, Special Idia Editio, , [9] Liu, Z., Yag, X., Zhog, W., Ha, Y A Efficiet ad Practical Public Key Cryptosystem with CCA-Security o Stadard Model, Tsighua Sciece ad Techology, ISSN /13, Vol.19 (2014, [10] Bellare, M., Desai, A., Poitcheval, D., Rogaway, P Relatios amog otios of security for public key ecryptio schemes, Lecture Notes i Computer Sciece, vol (1998, [11] Tsiouis, Y., Yug, M O the security of ElGamal based ecryptio. I H. Imai ad Y. Zheg, editors, Public Key Cryptography, Spriger, vol of Lecture Notes i Computer Sciece (1998, [12] Goldwasser, S., Micali, S Probabilistic Ecryptio, Joural of Computer ad System Scieces 28 (1984, [13] Racko, C., Simo, D.R No-Iteractive Zero- Kowledge Proof of Kowledge ad Chose Ciphertext Attack, Crypto '91, LNCS 576, Spriger- Verlag (1992,