Cryptology - Unofficial St. Mary's College of California Web Site

248 CHAPTER 12. RSA
12.11 Authenticity – Proof of Authorship
An important disadvantage of all private key cipher systems is that they do
nothing to help solve the key management problem. How can we secretly exchange
secret keys with people we’ve never met And how can we keep all these
secret keys straight, let alone secret As we have discussed, a Public Key cipher
takes care of these difficulties. To send someone a private message we don’t
have to know them, or have met them, or have agreed on a key or a method.
We just look up and use their RSA information from their Internet site.
This leads to a problem: If anyone can send you a message, there is no direct
way of knowing who sent you that message! It means little for an email to be
signed “Bob” as anyone can type B-o-b. How can we be sure that the person
whose name is at the bottom of the message really sent it With the knapsack
ciphers this is a fairly difficult problem to overcome but with the RSA it’s easy.
As usual, we’ll refer to the two parties exchanging messages as Alice and
Bob. We will use a subscript A to denote “Alice’s”, so N A is the value of N in
Alice’s system. Similarly, e B is the enciphering exponent in Bob’s system. Alice
knows her d A but no one else does. Similarly only Bob knows d B . However,
they both know e A , N A , e B and N B . When Alice sends a message to Bob she
wants to make sure that only he can decipher it, and that he knows it is actually
from her. So she writes her message M and then computes
(
M d A
%N A
) eB
%N B , if N A < N B ,
or (
M e B
%N B
) dA
%N A , if N B < N A ,
and sends this ciphertext to Bob. (Unfortunately, while ( )
M d eB
( )
A and M
e dA B
are equal, they may not be equivalent, that is, when working modulo N A and
N B the order of the moduli matters.)
Bob needs to be similarly careful when deciphering. If N A < N B , he undoes
the e B exponentiation (using d B ) and then undoes the d A exponentiation (with
e A ). When N A > N B , the order must be reversed.
This is quite clever, and so let’s take a moment to see what each party now
knows. Bob receives a ciphertext supposedly from Alice. Since he can look
up her modulus N A he knows which order to apply d B and e A to decipher
the message. So he can read it. Further, since only he knows d B , Bob is the
only person that can decipher this message. Finally, since applying e A led to a
readable message, d A must have been applied to the plaintext, and since Alice
is the only person that knows d A , it really must have been her that sent the
message. Alice can come to quite similar conclusions: Bob is the only person
who can read the message she sent, and she knows he will know it was she who
sent it. (Make sure you understand why she knows these things.) Finally, Ed
the Adversary, even though he knows all of Alice and Bob’s public information,