Cryptography - Sage

on the difficulty of factoring n, or on the difficulty of a weaker problem version called theRSA problem. The trapdoor for this function is the knowledge of the factorization of n.ElGamal.The ElGamal function is based on the exponentiation of a fixed multiplicative generatora for F ∗ p, the group of nonzero elements of the finite field of p elements. The map takes mto the power a m mod p:Z/(p − 1)Z F ∗ pm a mThe public data is the generator a and the prime p, and inverting the cryptographic functionis solved by the discrete logarithm problem – finding m given a and a m , or on a weakerproblem called the Diffie Hellman problem.Elliptic Curves.Alternatively, the ElGamal construction can be solved using the discrete logarithm problemon an elliptic curve E over a finite field F q . An elliptic curve is defined by an equationof the formy 2 + (a 1 x + a 3 )y = x 3 + a 2 x 2 + a 4 x + a 6with fixed coefficients a 1 , a 2 , a 3 , a 4 , a 6 in F q . The set E(F q ) of points (x, y) in F 2 q solvingthis equation plus a distiguished point O at infinity forms a group law under an addition,which we denote +. For groups E(F q ) and F ∗ p of comparable size, the discrete logarithmproblem on the elliptic curve is believed to be a harder problem than the classical onein F ∗ p. Elliptic curves will not be a topic of discussion in this book, but are becomingcommonplace in implementations of smart cards and cryptography for low-power devices.8.2 RSA CryptosystemsThe RSA cryptosystem is based on the difficulting of finding an inverse to exponentiationby a fixed e on Z/nZ for composite n, applied for n equal to a product of two largeprimes p and q. An efficient solution to integer factorization, or a solution to the possiblyweaker RSA problem would render the RSA cryptosystem insecure. The trapdoor for RSAencryption is the knowledge of the prime factors of n (which allows the determination ofan inverse deciphering exponent d for any enciphering exponent e).RSA Problem. Given integers e and n = pq such that GCD(e, p−1) = GCD(e, q−1) =1, and an integer c, find an m such that c = m e mod n.Rule: Let p be a prime, then the reduction m x mod p remains unchanged whenever(a) m is changed by a multiple of p, or(b) x is changed by a multiple of p − 1.70 Chapter 8. Public Key Cryptography