Hacking the Xbox

The RSA Algorithm
Chapter 7 - A Brief Primer on Security 115
The RSA algorithm was patented by the Massachusetts
Institute of Technology and exclusively licensed to RSA Data
Security, Inc in 1983. The patent on the RSA algorithm has
since expired in September 2000. Thus, today RSA is free to
use in any application. Many excellent tutorials and educational
examples using RSA can now be found on the
Internet. Perform a Google search using the keywords “RSA
algorithm” to find some of these examples.
The RSA algorithm is as follows (adapted from http://
world.std.com/~franl/crypto/rsa-guts.html):
1. Find two large (thousands of bits long) prime numbers, “P”
and “Q”.
2. Choose “E” such that E > 1, E < PQ, and E is relatively prime
to (P-1)(Q-1). E does not have to be prime, but it must be
odd. The pair of E and PQ are the public key.
3. Compute “D” such that (DE - 1) is evenly divisible by
(P-1)(Q-1). This can be accomplished by finding an integer
X which causes D = (X(P-1)(Q-1) + 1)/E to be an integer. D is
the private key.
4. Plaintext “T” is encrypted using the function
C = (T E ) mod PQ
5. Ciphertext “C” is decrypted using the function
T = (C D ) mod PQ
Note that T < PQ. Messages larger than PQ must be broken
down into a sequence of smaller messages, and very short
messages must be padded with carefully selected values
to foil dictionary attacks, among other things.
computed hash of the received message. If the decrypted hash sent with
the message and the locally computed hash agree, then the receiver could
conclude that the message is authentic and unaltered. This process is
outlined in Figure 7-4.
If this protocol sounds complex to you, it is. There are a lot of places
where things can go wrong. The receiver could have a false copy of the
sender’s public key. The sender could have had his private key compromised.
The hash could have weaknesses. Employing digital signatures in
an adversarial environment requires attention to detail at all levels of the
system design.
In the Xbox, digital signatures are used to control the distribution and sale
of programs for the console. Microsoft is effectively in control of both the
sender and the receiver of messages. The receivers — Xbox consoles —
are programmed to only run programs that are digitally signed by
Microsoft. In an ideal world, this guarantees that Microsoft has the final