### 21/11/2022. Lecture 10.

### 18 RSA and electronic signature

We briefly discussed an application of the asymmetric encryption (using RSA as the standard example) in a protocol of electronic signature.

### 19 Diffie–Hellman key exchange

In the class we discussed the classical protocol of key exchange suggested by Diffie and Hellman. In this protocol two parties (Alice and Bob) want to agree on a common secret key. To this end, they communicate via an open communication channel. The opponent (eavesdropper) can intercept all the messages sent by Alice and Bob to each other. We assume that the computational resources of the opponent are bounded, and the security of the protocol is based on the assumption that the problem of discrete logarithm (see below) cannot be resolved efficiently.

The public parameters of the protocol of Diffie and Hellman are a prime numberp and an integer numberg such that the degrees of this numbers

g mod p, g^{2} modp, g^{3} mod p, g^{4} mod p, . . . (1)
cover the entier set of all possible non zero residues modulo p. In other
words, for every integer number 1 ≤ y < p there exists an integer x such
that

y=g^{x} mod p

(Such a number g is called a generator of the group ((Z/pZ)^{×},·), which
consists of the elements{1,2, . . . , p−1}with the operation of multiplication
modulop.) The protocol is organised as follows:

• Alice chooses at random an integer number a co-prime with p and
sends the numberm_{a}=g^{a} modp to Bob

• Bob chooses at random an integer numberbco-prime withpand sends
the numberm_{b}=g^{b} mod p to Alice

• Alice computesk= (m_{b})^{a} mod p

• Alice computesk= (m_{a})^{b} mod p

Observe that Alice and Bob end up with the same number
(g^{a})^{b} mod p= (g^{b})^{a} mod p.

This numberkis taken as the secret key.

Observe that the eavesdropper can access the numbers g^{a} mod p sent
by Alice and g^{b} mod p sent by Bob. It is believed in the cryptographic
community that it is computationally hard to obtain (g^{ab} mod p) given
two numbers (g^{a} mod p) and (g^{b} modp). More precisely, it is conjectured
that no algorithm (deterministic or randomised) for a classical computer can
do this task in polynomial time. However, this conjecture remains unproven.

It is known that there exists an algorithm for aquantum computer that
computes in polynomial time the discrete logarithm, i.e., given (p, g, y) it
finds anx such thatg^{x} =y mod p.Using such an algorithm, an eavesdrop-
per could attack the protocol of Diffie–Hellman. This is why inpost-quantum
cryptography the researchers explore possible alternative to the protocol of
Diffie and Hellman (these alternative would become necessary in case if
quantum computers are eventually constructed).

In the class we discussed that the protocol of Diffie and Hellman is vulnerable to the attack of an active adversary that can not only eavesdrop but also spoof the messages that Alice and Bob send to each other (man- in-the-middle attack).

Security of the protocol of Diffie and Hellman depends on the fact that
there are many differenty∈ {1,2, . . . , p−1}that can be represented asy=
g^{x} mod pfor a fixed g. Ideally, all values g^{x} mod p forx= 1,2, . . . , p−1
should be different. Indeed, let us consider the case when the chosengis not
a generator of (Z/pZ)^{×}; assume that the list (1) consists not of all non-zero
elements modulop but only ofk different elements andkp−1.

Exercise 1. Show that the value of k (the number of different elements
in (1)) is equal to the order of g in (Z/pZ)^{×}, i.e., to the minimal natural
numberx such thatg^{x}= 1 modp.

Given the valuesm_{a}andm_{b}, the adversary can find theirdiscrete logarithms
a and b (the numbers such that g^{a} =ma mod p and g^{b} =mb mod p) by
brute force search, by trying all values (g^{x} mod p) in (1) forx= 1,2, . . . , k
one by one. The smaller isk, the faster the brute force search works. Thus,
with small k, the task of the attacher is simpler. This is why we prefer to
use in this protocol a numbergsuch that the list (1) is maximally long (i.e.,
there are (p−1) different elements in this list).

It remains to show that for every prime numberpthere exists an integer
g such that the order ofg in (Z/pZ)^{×} is equal to p−1 (and the number of
different elements in (1) is equal top−1).

In the class we started with a discussion of a few special cases: we
found g generating the groups ((Z/17Z)^{×},·), ((Z/13Z)^{×},·), ((Z/19Z)^{×},·).

(We recommend to do these exercises before reading the proof of the next theorem.) Then we proved the following general theorem.

Theorem 1. If p is a prime number, then there exists an integer numberg
such that the integer powersg^{x} modp produce all elements in (Z/pZ)^{×}.
Proof. The core idea of the proof is the fact that in each field a polynomial
of degreekcannot have more thankroots. Let us explain this proof in some
detail.

Step 1. We begin the proof with a definition. Let us define theorder of
an element x ∈ (Z/pZ)^{×} (denoted Or_{p}(x)) as the minimal integer number
k ≥1 such that x^{k} = 1 mod p. The theorem claims that for every prime
number p there exists a g such that the order of g in (Z/pZ)^{×} is equal to
p−1.

Step 2. Letgbe any element in (Z/pZ)^{×}. Since the set{1,2, . . . , p−1}is
finite, the valuesg mod p, g^{2} mod p, g^{3} mod p, . . .cannot be all different;

starting from some moment, this series begins to repeat. Therefore, this
sequence (powers ofgmodulop) is periodic with some periodk. The length
of the period (the numberk) is in fact equal to the very first position in the
sequence where we obtaing^{k}= 1 mod p. In other words, the period of this
sequence modulop is equal toOrp(g).

We know that for every prime number pand for everyg6= 0 modp we
have g^{p−1} = 1 mod p. Hence, the period of g modulo p must divide the
numberp−1. Our goal is to find agsuch thatOr_{p}(g) not only dividesp−1
butis equal to p−1.

Step 3. We proceed with the following lemma.

Lemma 1. Let k0 be the least common multiple of
Or_{p}(1), Or_{p}(2), Or_{p}(3), . . . , Or_{p}(p−1).

Then all element of the field are roots of the equationx^{k}^{0} = 1 modp
Proof. For every x ∈ {1,2, . . . , p−1} we have, by definition, x^{Or}^{p}^{(x)} = 1
mod p. Sincek_{0} is a multiple of Or_{p}(x), we have k_{0} =`·Or_{p}(x), and

x^{k}^{0} modp=x^{`·Or}^{p}^{(x)} mod p= (x^{Or}^{p}^{(x)})^{`} mod p= 1^{`} modp,

and we are done.

To conclude the proof of the theorem, it remains to find an element g such thatOrp(g) =k0.

Step 4. We need one more lemma:

Lemma 2. For all x, y ∈ (Z/pZ)^{×} there exists an element z ∈ (Z/pZ)^{×}
such that the order of z is the least common multiple of the orders of x
andy.

Proof. At first, we prove the lemma for a special case, assuming that
gcd(Or_{p}(x), Or_{p}(y)) = 1.

SinceOrp(x) andOrp(y) are co-prime, we need a zsuch that Orp(z) =lcm(Orp(x), Orp(y)) =Orp(x)·Orp(y).

We know from the Extended Euclid Algorithm that if the numbersOr_{p}(x)
and Orp(y) are co-prime, then there exist u andv such that

u·Orp(x) +v·Orp(y) = 1.

We letz:= x^{v}·y^{u} mod p. It is easy to see that z^{Or}^{p}^{(x)·Or}^{p}^{(y)} mod p= 1.

It remains to show thatk=Orp(x)·Orp(y) is the minimal natural number
such thatz^{k} = 1 modp.

It is clear that Or_{p}(z) divides Or_{p}(x) ·Or_{p}(y). Hence, if Or_{p}(z) <

Orp(x)·Orp(y), then in the sequence

z mod p, z^{2} mod p, z^{3} mod p, . . . , z^{Or}^{p}^{(x)·Or}^{p}^{(y)} mod p (2)
theones appear in a periodic way, at some positions

k^{0},2k^{0},3k^{0}, . . . , Orp(x)·Orp(y).

Thus, if k^{0} < Or_{p}(x)·Or_{p}(y), then ones appear in (2) (among other posi-
tions) at some positionOrp(x)·`(for some` < Orp(y)) or at some position
Orp(y) ·` (for some ` < Orp(x)). In what follows we show that this is
impossible.

Observe that for the numberz defined above we have

z^{Or}^{p}^{(x)}= 1·y^{u·Or}^{p}^{(x)} mod p=y^{1−v·Or}^{p}^{(y)} mod p=y mod p.

Hence, the numbers

z^{Or}^{p}^{(x)}, z^{2·Or}^{p}^{(x)}, z^{3·Or}^{p}^{(x)}, z^{(Or}^{p}^{(y)−1)·Or}^{p}^{(x)}
coincide with

y, y^{2}, , y^{3}, . . . , y^{(Or}^{p}^{(y)−1)}

modulo p, and they are all not equal to 1 modulo p. A similar argument implies that the numbers

z^{Or}^{p}^{(y)}, z^{2·Or}^{p}^{(y)}, z^{3·Or}^{p}^{(y)}, z^{(Or}^{p}^{(x)−1)·Or}^{p}^{(y)}

are also not equal to 1 modulop. Now it is not hard to show that in the list of numbers

z, z^{2}, z^{3}, . . . , z^{Or}^{p}^{(x)·Or}^{p}^{(y)}
only the very last element is equal to 1 modulop, i.e.,

Orp(z) =Orp(x)·Orp(y).

It remains to consider the case

gcd(Or_{p}(x), Or_{p}(y))6= 1.

We will reduce the general case to the special case discussed above. We use
the following trick. If `is a factor of Or_{p}(y), thenOr_{p}(y^{`}) =Or_{p}(y)/`. So
if we can take`:=gcd(Orp(x), Orp(y)) and let y^{0} =y^{`}, then

gcd(Orp(x), Orp(y^{0})) = 1 andlcm(Orp(x), Orp(y^{0})) =lcm(Orp(x), Orp(y))
(here lcm denote the least common multiplier). It remains to apply the
argument explained above to the numbersx andy^{0}, and we are done.

Step 5. Now we iterate an application of Lemma 2. First of all, we let
x_{1} = 1. Now we apply Lemma 2 and find an x_{2} such that Or_{p}(x_{2}) is the
least common multiple of the orders ofx1 and 2. Then we apply one more
time Lemma 2 and find ax_{3} such thatOr_{p}(x_{3}) is the least common multiple
of the orders of x_{2} and 3. Further, we find a x_{4} such that Or_{p}(x_{4}) is the
least common multiple of the orders ofx3 and 4, and so on. Finally, we find
an element xp−1 such that Or_{p}(xp−1) is the least common multiple of the
orders ofxp−2 andp−1. From this construction it follows that the order of
the last constructed numberxp−1 is the least common multiple of the orders
of all elements 1,2, . . . , p−1. In other words, we found an element xp−1

whose order is equal to the numberk_{0} from Lemma 1.

Step 5. Since all elements in{1, . . . , p−1} satisfy the equation
x^{k}^{0} = 1 modp,

the number k_{0} cannot be smaller than p−1 (a polynomial of degree k_{0}
cannot have more thank0 roots). On the other hand, we know thatOrp(x)
divides p−1 for each x. Thus, k0 is not less than p−1 and not greater
thanp−1. We conclude that k_{0}=p−1, i.e., we have got an elementxp−1

such thatOrp(xp−1) is equal to p−1. This means that x0 is a generating
element of (Z/pZ)^{×}, end we are done.

### References

[1] J. Katz, Y. Lindell. Introduction to modern cryptography, CRC Press, 2021 [sections 9.3.1-9.3.3, 11.3-11.4, 13.4].

[2] B. Martin. Codage, cryptologie et applications. PPUR, 2004 [sections 21.1-21.2, 26.5].