Diffie-Hellman-Key-Exchange-and-ElGamal

Chapter 4: Public Key Cryptography:Diffie-Hellman key-exchange protocol(Week 6)8 The Diffie-Hellman Key Exchange protocolThis was invented by Whitfield Diffie and Martin Hellman 8 in 1976.It is a method for creating a shared secret numeric key over an open channel with potentialeavesdroppers. The two protagonists don’t have any (real) control over what actual numbertheir secret key is. (The key will then be used in a symmetric key 9 algorithm such as DESand AES—see next week’s lectures).Let G = (Z/pZ) ∗ be the multiplicative elements mod p. It is a cyclic group of order p − 1.Since it is cyclic, it has a generator g, which means(Z/pZ) ∗ = {g, g 2 , g 3 , . . . , g p−1 }.Example. A generator for (Z/11Z) ∗ is g = 2. We have{2, 2 2 , 2 3 , 2 4 , 2 5 , 2 6 , 2 7 , 2 8 , 2 9 , 2 10 } = {2, 4, 8, 5, 10, 9, 7, 3, 6, 1}which is all the invertible elements mod 11.Remark. To say a number g is a primitive root modulo p is the same as saying g is a generatorfor (Z/pZ) ∗ .The algorithm works as follows:• Fix a prime p and a primitive root g. Publish these.• Alice secretly chooses an exponent a, and sends A = g a (mod p) to Bob.• Bob secretly chooses an exponent b and sends B = g b (mod p) to Alice.• Alice and Bob now share a secret, K = g ab (mod p), since Bob can calculate K =A b = g ab and Alice can calculate K = B a = g ab but Eve only knows g a and g b .• They use this key to seed a traditional symmetric cipher, like DES or AES etc.The key to this protocol is that exponentiating numbers is easy, whereas taking discretelogarithms is (believed to be) hard—at least for certain primes.Definition. Given a generator of g and a number A ∈ (Z/pZ) ∗ , we say that a is the discretelog of A with respect to g modulo p, if A ≡ g a (mod p).8 New directions in cryptography, IEEE Transactions on Information Theory 22 (1976), 644-6549 A symmetric key algorithm is one where the same key is used to encode and decode. Asymptoticalgorithms, such as PKC, are where different keys are needed for encoding and decoding.29

8 The Diffie-Hellman Key Exchange protocol Diffie-HellmanExample. Let p = 9967 (a prime) and g = 3 (a primitive root modulo 9967). Alice secretlychooses 34 = (100010) 2 = 2 5 + 2 1 , and works outso3 2 = 9She send 6366 to Bob.3 4 = 9 2 = 813 8 = 81 2 = 65613 16 = 6561 2 = 43046721 ≡ 9215 (mod 9967)3 32 ≡ 9215 2 (mod 9967) = 84916225 ≡ 7352 (mod 9967)3 34 = 3 32 × 3 2 ≡ 7352 × 9 ≡ 6366 (mod 9967)Meanwhile, Bob secretely chooses 37 = 2 5 + 2 2 + 1, and, calculating the same table as Alice,works out3 37 = 3 32 × 3 4 × 3 ≡ 7352 × 81 × 3 ≡ 2443 (mod 9967)and he sends 2443 to Alice.Public SecretAlice 6366 34Bob 2443 37Alice now takes the number Bob sent her, 2443, and raises it to her secret number, 34, usingthe fast exponentiation method. She obtainsk = 2443 34 ≡ 7782 (mod 9967)Bob takes the number Alice sent him, 6366, and raises it to his secret number 37, and obtainsThe two keys match!k = 6366 37 ≡ 7782 (mod 9967)Public Secret SharedAlice 6366 34 7782Bob 2443 37 7782The reason this works is because Alice knows a and g b (sent to her from Bob). She calculates(g b ) a = g ab .Whereas Bob knows b and g a (sent to him by Alice), and calculates (g a ) b = g ab .Remark. Given p = 9967 and g = 3, and knowing the number 6366, it is hard to find the xsuch that 3 x ≡ 6366 (mod 9967). Such an x is known as the discrete log of 6366 in base 3modulo 9967. (In this case we know the discrete log equals 34).30

Diffie-Hellman 8 The Diffie-Hellman Key Exchange protocolRemark. Currently the only way known to decrypt such secrets is to find discrete logarithms,in the sense of seeing Alice’s g a find her a. However, that might not be necessary. The “Diffie-Hellman-problem” or DHP is as follows: If you know g and p (which is public) and you canfind g a and g b (from tapping into telephone lines) can you find g ab without first finding aand b?Remark. Note that in this system Alice and Bob have no real control over what the sharedkey will be. Therefore, this approach cannot be used to send messages.Remark (Historical). Martin Hellman, in “An Overview of Public Key Cryptography” 50 thAnniversary Commemorative Issue (May 2002) of the IEEE Communications Magazine, said:The system I called the ax1x2 system in this paper has since become known asDiffie-Hellman key exchange. While that system was first described in a paperby Diffie and me, it is a public key distribution system, a concept developedby Merkle, and hence should be called “Diffie-Hellman-Merkle key exchange” ifnames are to be associated with it. I hope this small pulpit might help in thatendeavor to recognize Merkles equal contribution to the invention of public keycryptography. Space does not permit an explanation of the quirk of fate thatseems to have deprived Merkle of the credit he deserves, but a quirk it is.8.1 ElGamalThis was invented in 1985 by Taher Elgamal. (His surname is all lowercase after the firstletter, but his cryptosystem traditionally has a capital G in the middle). It uses the sametechnology as Diffie-Hellman, but allows Alice and Bob to exchange messages, rather thenjust keys.Assume the prime p and generator g are known.• Alice wishes to send a message m to Bob. We will assume that the message is numeric(else convert it to one) and satisfies 0 ≤ m < p (else break the message into smallerpieces).• Bob secretly chooses an exponent b, finds B ≡ g b (mod p) and sends B to Alice.• Alice chooses an a and finds A = g a . She also finds t = B a m. She sends (t, A) to Bob.• Bob finds t · A −b ≡ g ba m · (g a ) −b ≡ m (mod p), and hence has Alice’s message.Remark. Although not essential, it will be good if Bob’s b can be chosen coprime to p − 1.This is because B = g b will then also be a primitive root mod p, and so B a can then takeany and every value in (Z/pZ) ∗ with equal probability, and thus all the information in m islost in t = B a m.If Alice sends two messages m 1 and m 2 , say, to Bob using the same a, and if Eve can findthe plaintext m 1 somehow, then she can also decode the message to read m 2 too. This is31

8 The Diffie-Hellman Key Exchange protocol Diffie-Hellmanbecause if Eve knows m 1 then from t 1 = m 1 B a she can find B a . From that, knowing onlyt 2 = m 2 B a she can find m 2 = t 2 (B a ) −1 .Such a scenario isn’t as unlikely as it seems. For example, the first message might be a pressrelease still under embargo. Once the embargo has passed, Eve can find out m 1 simply fromreading the papers.The conclusion is that to increase the security of messages, Alice should use a different a foreach message sent. Therefore a is called an ephemeral key.8.2 Equivalence between Diffie-Hellman and ElGamalClearly both these cryptosystems can be broken if one can find discrete logs. However, itmight be that a system could still be broken without actually being able to find discrete logsin general. If one has a system that can break either ElGamal or Diffie-Hellman than onecan break the other.Let M 1 be a machine that solves the ElGamal problem, in the sense that its input is all theavailable public data, and its output is the secret message, that isM 1 : (p, g, g a , g b , mg ab ) ↦−→ mthen M 1 (p, g, g a , g b , 1) = g −ab and inverting this mod p (possible using Euclid’s algorithm,for example) solves the Diffie-Hellman problem, since K = g ab .Similarly if M 2 is a device that can solve a Diffie-Hellman problem, then it can be used tosolve ElGamal. That is, letM 2 : (p, q, g a , g b ) ↦−→ g abthen given g b (from Bob) and (t, g a ) (from Alice), use the machine to find K = g ab , find itsinverse (via Euclid’s algorithm) and calculate m = tK −1 .8.3 Bit commitment with Diffie-HellmanSuppose Alice and Bob wish to bet on the outcome of a coin toss, but without actuallymeeting. Clearly Alice cannot toss the coin and have Bob call, for then Alice has theopportunity to lie and say coin-toss was the opposite of Bob’s declaration. But equally,Alice cannot tell Bob the outcome of the coin toss before he has called what he thinks it willbe, for then Bob can simply make his call be the result of the toss.There exists a Diffie-Hellman-like approach which solves this problem, and means Alicecan toss the coin, and send the result to Bob in such a way that he cannot tell what theoutcome was and Alice is committed to the outcome. (This assumes Bob cannot find discretelogarithms).Alice and Bob agree the following protocol. The agree on a prime p and a generator g. Alicewill toss the coin, and will then choose a random a whose 7 th bit is 1 if the toss was headsand 0 if it was tails. She sends A ≡ g a (mod p) to Bob. Bob then declares to Alice his call32

Diffie-Hellman 8 The Diffie-Hellman Key Exchange protocolof heads or tails. Alice can then let him know if he has won or lost, and sends him a. Bobcan look at the 7 th bit of a and check it really does equal 0 or 1 (depending on the coin tossoutcome Alice informed him of) and can check that g a really does equal A, so Alice cannotcheat by changing the result after hearing Bob’s call.This works because once A is fixed, Alice is fixed into her choice of a, and so is fixed intothe result of the coin toss. This method assumes Bob cannot deduce the 7 th bit of a fromknowing g a , but this is a good assumption, because 7 is arbitrary (if you could find anyarbitrary bit of a knowing only A, you could find the discrete logarithm of A with respectto g).Remark. Choosing the least-significant bit of a to be the result of the coin toss is a bad idea,because that can be found from knowing A. Note that a is even if and only if g a is thesquare of ±g a/2 , which happens if and only if g a is a quadratic residue mod p. But checkingwhether A is a quadratic residue mod p can be done easily using Legendre symbols.8.4 Finding primitive roots modulo pWhen p is a prime, a primitive root modulo p is a number whose powers yield every non-zeronumber mod p.Thus we see that g being a generator for (Z/pZ) ∗ is equivalent to g being a primitive rootmodulo p.Primitive roots have two very useful properties:Proposition. Let g be a primitive root mod p, and let n, j and k be integers. Then• g n ≡ 1 (mod p) if and only if n ≡ 0 (mod p − 1).• g j ≡ g k (mod p) if and only if j ≡ k (mod p − 1).Proof. This was properly covered in Introduction to Number Theory. Here’s a sketch of theproof. For the first bullet point assume that n ≡ 0 (mod p − 1), which means n = a(p − 1).Theng n ≡ ( g p−1) a≡ 1 a ≡ 1 (mod p).by Fermat’s Little Theorem. Conversely, assume that g n ≡ 1 (mod p) and write n =a(p − 1) + r with 0 ≤ r < p − 1. Note that, by Fermat’s Little Theorem again,1 ≡ g n ≡ g a(p−1) g r ≡ g r (mod p).Hence if r ≥ 1 we have{g, g 2 , g 3 , . . . , g r , g r+1 , g r+2 , . . . , g p−1} = { g, g 2 , g 3 , . . . , g r , g 1 , g 2 , . . . }(here we used the fact that g r = 1). This is cyclic, repeating after every r terms, and thusthe set contains only r elements. This contradicts the assumption that g is a primitive root,since its powers must yield every non-zero number mod p (of which there are p − 1 terms)33

8 The Diffie-Hellman Key Exchange protocol Diffie-Hellmanand this set has yielded only r terms. The only way for this not to be a contradiction is ifr = 0, which means (p − 1) | n or n ≡ 0 (mod p − 1).For the second bullet point, note that g j ≡ j k =⇒ g j−k ≡ 1 and by the results of the firstbullet point, this happens if and only if j − k ≡ 0 (mod p − 1), so j ≡ k (mod p − 1).Remark. Primitive roots are not unique.Proposition. If g is a primitive root modulo p, then so is g x for any x coprime to p − 1.Proof. A corollary of Fermat’s Little Theorem is that exponents work modulo p − 1. If x iscoprime to p − 1 then {x, 2x, 3x, . . . , (p − 1)x} ≡ {1, 2, 3, . . . , p − 1} (mod p − 1), which saysthat multiplying by x mod p − 1 simply rearranges the set. (It is crucial x has an inversemod p − 1 for this statement to be true). Thus{g x , g 2x , g 3x , . . . , g (p−1)x} ≡ { g, g 2 , g 3 , . . . , g p−1} ≡ {1, 2, 3, . . . , p − 1} (mod p)and so g x is also a primitive root modulo p.Corollary. For a given prime p, there are φ(p − 1) primitive roots modulo p.Example. Assuming 2 is a primitive root modulo 13, find all the primitive roots mod 13.Solution. The numbers coprime to 12 are 1,5,7, and 11. Since 2 is a primitive root mod 13,and we have2 5 ≡ 62 7 ≡ 112 11 ≡ 7we see that the four primitive roots mod 13 are 2, 6, 7 and 11.Now, if the prime factorization of p − 1 is known, one can quickly check a number to see if itis a primitive root. I’ll demonstrate with an example of finding primitive roots modulo 13.Note that 13 − 1 = 12 = 2 2 × 3.Now every element of (Z/13Z) ∗ has an order, which is the smallest k such that a k ≡ 1(mod 13). This order divides the order of the group (12 in this case), so the possible ordersare 1, 2, 3, 4, 6, and 12. The following tables show which values equal 1.order \ power 1 2 3 4 5 6 7 8 9 10 11 1212 16 1 14 1 1 13 1 1 1 12 1 1 1 1 1 11 1 1 1 1 1 1 1 1 1 1 1 134

Diffie-Hellman 8 The Diffie-Hellman Key Exchange protocolNote that every element which is not a primitive root (that is, every number which does nothave order 12) equals 1 when raised to a power of either 6(= 12/2) or 4(= 12/3).Hence, if you wished to check whether 2 is a primitive root modulo 13, rather than raisingit to every power between 1 and 12 and ensuring they yield all possible numbers, one simplyneeds to show that both 2 6 and 2 4 are not congruent to 1 mod 13 to conclude that its orderis 12, and hence 2 is a primitive root mod 13. We haveand so 2 is is a primitive root.2 6 ≡ 12 ≢ 1 (mod 13)2 4 ≡ 3 ≢ 1 (mod 13)This method also shows that 3 is not a primitive root. To see this note that 3 6 ≡ 1 (mod 13).Example. Show that 3 is a primitive root modulo 101.Solution. Note that 100 = 2 2 × 5 2 and so we only need to check powers equal to 100/2 = 50and 100/5 = 20. One can check that3 50 ≡ 100 (mod 101)3 20 ≡ 84 (mod 101)and since neither of these are 1, we conclude that 3 is a primitive root mod 101.The general algorithm is as follows: To find primitive roots modulo p, find the prime factorsof p − 1. Say it equalsp − 1 = q a 11 q a 22 · · · q a kkwith q i all primes, and a i ≥ 1.For the g you wish to test, simply evaluate g (p−1)/q 1, g (p−1)/q 2, . . . , g (p−1)/q k , and if they areall not equal to 1, then g is a primitive root. If one of them equals 1, then that g is not aprimitive root. Simply chose another value of g to test.35

8 The Diffie-Hellman Key Exchange protocol Diffie-Hellman36