Prime Numbers

390 Chapter 8 THE UBIQUITY OF PRIME NUMBERS
Alice receives encrypted message y;
x = y DA mod NA; // Alice recovers the original x.
It is not hard to see that, as required for Algorithm 8.1.3 to work, we must
have
x DE ≡ x (mod N).
This, in turn, follows from the fact that DE =1+kϕ by construction of D
itself, so that x DE = x(x ϕ ) k ≡ x · 1 k = x (mod N), when gcd(x, N) = 1. In
addition, it is easy to see that x DE ≡ x (mod N) continues to hold even when
gcd(x, N) > 1.
Now with the RSA scheme we envision a scenario in which a great
number of individuals all have their respective public keys (Ni,Ei) literally
published—as one might publish individual numbers in a telephone book.
Any individual may thereby send an encrypted message to individual j by
casually referring to the public (Nj,Ej) and doing a little arithmetic. But
can the recipient j know from whom the message was encrypted and sent? It
turns out, yes, to be quite possible, using a clever digital signature method:
Algorithm 8.1.4 (RSA signature: Simple version). We assume that Alice
possesses a private key DA and public key (NA,EA) from Algorithm 8.1.2. Here
we show how another individual (Bob) having private key DB and public key
(NB,EB) can “sign” a message x (thought of as an integer in [0, min{NA,NB})).
1. [Bob encrypts with signature]
s = x DB mod NB; // Bob creates signature from message.
y = s EA mod NA; // Bob is using here Alice’s public key.
Bob then sends y to Alice;
2. [Alice decrypts]
Alice receives signed/encrypted message y;
s = y DA mod NA; // Alice uses her private key.
x = s EB mod NB; // Alice recovers message using Bob’s public key.
Note that in the final stage, Alice uses Bob’s public key, the idea being that—
up to the usual questions of difficulty or breakability of the scheme—only Bob
could have originated the message, because only he knows private key DB.But
there are weaknesses in this admittedly elegant signature scheme. One such
is this: If a forger somehow prepares a “factored message” x = x1x2, and
somehow induces Bob to send Alice the signatures y1,y2 corresponding to the
component messages x1,x2, then the forger can later pose as Bob by sending
Alice y = y1y2, which is the signature for the composite message x. In a sense,
then, Algorithm 8.1.4 has too much symmetry. Such issues can be resolved
nicely by invoking a “message digest,” or hash function, at the signing stage
[Schneier 1996], [Menezes et al. 1997]. Such standards as SHA-1 provide such
a hash function H, whereifx is plaintext, H(x) is an integer (often much
smaller, i.e., having many fewer bits, than x). In this way certain methods
for breaking signatures—or false signing—would be suppressed. A signature
scheme involving a hash function goes as follows: