Prime Numbers

8.1 Cryptography 391
Algorithm 8.1.5 (RSA encrypt-with-signature: More practical version).
We assume that Bob possesses a private key DB and public key (NB,EB) from
Algorithm 8.1.2. Here we show how Alice can recover Bob’s plaintext message
x (thought of as an integer in some appropriate interval) and also verify Bob’s
signature. We assume the existence of message digest function H, such as from
the SHA-1 standard.
1. [Bob encrypts with signature]
y = xEA mod NA; // Bob encrypts, using Alice’s public key.
y1 = H(x); // y1 is the “hash” of plaintext x.
s = y DB
1 mod NB; // Bob creates signature s.
Bob sends (y, s) (i.e., combined message/signature) to Alice;
2. [Alice decrypts]
Alice receives (y, s);
x = y DA mod NA; // Alice decrypts to recover plaintext x.
3. [Alice processes signature]
y2 = s EB mod NB;
if(y2 == H(x)) Alice accepts signature;
else Alice rejects signature;
We note that there are practical variants of this algorithm that do not
involve actual encryption; e.g., if plaintext security is not an issue while only
authentication is, one can simply concatenate the plaintext and signature, as
(x, s) for transmission to Alice. Note also there are alternative, yet practical
signature schemes that depend instead on a so-called redundancy function, as
laid out, for example, in [Menezes et al. 1997].
8.1.3 Elliptic curve cryptosystems (ECCs)
The mid-1980s saw the emergence of yet another fascinating cryptographic
idea, that of using elliptic curves in cryptosystems [Miller 1987], [Koblitz
1987]. Basically, elliptic curve cryptography (ECC) involves a public curve
Ea,b(F )whereF is a finite field. Prevailing choices are F = Fp for prime p,
and F = F 2 k for suitable integers k. We shall focus primarily on the former
fields Fp, although much of what we describe works for finite fields in general.
The central idea is that given points P, Q ∈ E such that the relation
Q =[k]P
holds for some integer k, it should be hard in general to extract the elliptic
discrete logarithm (EDL), namely a value for the integer multiplier k. There
is by now a considerable literature on the EDL problem, of which just one
example work is [Lim and Lee 1997], in which it is explained why the group
order’s character (prime or composite, and what kind of factorization) is
important as a security matter.
The Diffie–Hellman key exchange protocol (see Algorithm 8.1.1) can be
used in a cyclic subgroup of any group. The following algorithm is Diffie–
Hellman for elliptic-curve groups.