rsa

 

http://en.wikipedia.org/wiki/RSA_(algorithm)

 

The RSA algorithm involves three steps: key generation, encryption and decryption.

Key generation

RSA involves a public key and a private key. The public key can be known to everyone and is used for encrypting messages. Messages encrypted with the public key can only be decrypted using the private key. The keys for the RSA algorithm are generated the following way:

1. Choose two distinct prime numbers p and q.
   • For security purposes, the integers p and q should be chosen at random, and should be of similar bit-length. Prime integers can be efficiently found using aprimality test.
2. Compute n = pq.
   • n is used as the modulus for both the public and private keys
3. Compute φ(n) = (p – 1)(q – 1), where φ isEuler's totient function.
4. Choose an integer e such that 1 < e < φ(n) andgreatest common denominator of (e,φ(n)) = 1, i.e.e and φ(n) arecoprime.
   • e is released as the public key exponent.
   • e having a short bit-length and small Hamming weight results in more efficient encryption - most commonly 0x10001 = 65537. However, small values ofe (such as 3) have been shown to be less secure in some settings.^[4]
5. Determine d = e^–1 mod φ(n); i.e.d is themultiplicative inverse of e mod φ(n).
   • This is more clearly stated as solve for d given (d*e)mod φ(n) = 1
   • This is often computed using the extended Euclidean algorithm.
   • d is kept as the private key exponent.

The public key consists of the modulus n and the public (or encryption) exponente. Theprivate key consists of the modulus n and the private (or decryption) exponentd which must be kept secret.

Notes:

 

The RSA cryptosystem

 

Key generation

• Choose two distinct primes p and q of approximately equal size so that their product n = pq is of the required length.
• Compute φ(n) = (p-1)(q-1).
• Choose a public exponent e, 1 < e < φ(n), which is coprime to φ(n), that is, gcd(e, φ(n))=1.
• Compute a private exponent d that satisfies the congruence ed ≡ 1 (mod &phi(n)).
• Make the public key (n, e) available to others. Keep the private values d, p, q, and φ(n) secret.

RSA Encryption scheme

Encryption rule: ciphertext, c = RsaPublic(m) = m^e mod n, 1 < m < n-1
Decryption rule: plaintext, m = RsaPrivate(c) = c^d mod n
Inverse transformation: m = RsaPrivate(RsaPublic(m))

RSA Signature scheme

Signing: signature, s = RsaPrivate(m) = m^d mod n, 1 < m < n-1
Verification: check, v = RsaPublic(s) = s^e mod n
Inverse transformation: m = RsaPublic(RsaPrivate(m))

 

First, note that the inverse transformations for encryption and signing are equivalent, since

RsaPrivate( RsaPublic(m)) = (m ^e mod n) ^d mod n = m ^ed mod n
RsaPublic( RsaPrivate(m)) = (m ^d mod n) ^e mod n = m ^ed mod n

So we only need to show that the decryption rule works; that is, for (n, e) as defined above,

 

If c = m ^e mod n for 0 < m < n then m = c ^d mod n, where d is the secret exponent that satisfies the relation ed ≡ 1 (mod φ(n)).

 

All proofs of how RSA works boil down to the fact that for any integer x, x^1+kφ(n) ≡ x (mod n).

Note that the algorithm strictly works for 0 ≤ m < n, but we exclude the values m = 0, 1 and m = n-1 from the cryptosystem because there is no secrecy for such messages.

First proof

The first proof is short. It uses the Euler-Fermat Theorem. It works for messages m that are relatively prime to the modulus n, that is where gcd(m, n) = 1.

Proof. Suppose gcd(m, n) = 1. The relation ed ≡ 1 (mod φ(n)) gives that ed = 1 + kφ(n) for some integer k. If c ≡ m^e (mod n) then, working modulo n,

c ^d ≡ m ^ed
   ≡ m ^1+kφ(n)
   ≡ m.(m ^φ(n)) ^k
   ≡ m.1 ^k, since m ^φ(n) ≡ 1 (mod n), by the Euler-Fermat theorem, as gcd(m, n)=1
   ≡ m (mod n).

Hence m = c^d mod n is a unique integer in the range 0 ≤ m < n.   ♦

Second proof

The first proof does not include the special cases where the message m is divisible by one of the prime factors, p or q. There are p numbers where q|m: that is, m = 0, q, 2q, 3q, ..., (p-1)q. Similarly there are q numbers where p|m, and thus p+q-1 possible numbers where gcd(m, n) > 1 (zero occurs twice). Note that p and q cannot both divide m since we restrict m < n = pq.

The second proof specifically considers the case where gcd(m, n) > 1, but it could easily be written to include the first case above (if gcd(q, n)=1 then just say "Similarly for q" after the result mod p). It usesFermat's Little Theorem and the fact that if s and t are coprime and a ≡ b (mod s) and a ≡ b (mod t), then a ≡ b (mod st).

† If s and t are coprime and a ≡ b (mod s) and a ≡ b (mod t), then a ≡ b (mod st).
Proof. a ≡ b (mod s) ⇒ s|a-b. a ≡ b (mod t) ⇒ t|a-b. Since s and t are coprime then st|a-b. Hence a ≡ b (mod st). ♦

Proof. Suppose one of the primes, say q, divides m. Then m ≡ 0 (mod q) and so, trivially, we have

0 ≡ m ^1+kφ(n) ≡ m (mod q).

If q divides m then p cannot also divide m since m < n = pq and so we must have gcd(m, p) = 1. ByFermat's Little Theorem we have

m ^p-1 ≡ 1 (mod p)
m ^(p-1)(q-1) ≡ 1 ^q-1 ≡ 1 (mod p), raising both sides to the power q-1
m ^φ(n) ≡ 1, since φ(n) = φ(pq) = (p-1)(q-1)
m ^kφ(n) ≡ 1 ^k ≡ 1 (mod p), raising both sides to the power k
m ^1+kφ(n) ≡ m (mod p), multiplying both sides by m.

Now since m^1+kφ(n) ≡ m (mod q) and m^1+kφ(n) ≡ m (mod p), and p and q are coprime, then it follows that (see † above)

m ^1+kφ(n) ≡ m (mod pq) ≡ m (mod n), for all integers m.

We have ed ≡ 1 (mod φ(n)) ⇒ ed = 1 + kφ(n). So, if c ≡ m^e (mod n) then c^d ≡ m^ed ≡ m^1+kφ(n) ≡ m (mod n). Hence m = c^d mod n is a unique integer in the range 0 ≤ m < n.   ♦