Cryptography - Sage

and similarlym 2 = c d 2mod 23 ≡ 6 15 mod 23≡ 6 8 6 4 6 2 6 mod 23 ≡ (−5 · 8) (13 · 6) mod 23≡ 6 · 9 mod 23 ≡ 8 mod 23.Now we can combine m 1 = 6 mod 11 and m 2 = 8 mod 23 by the Chinese remaindertheorem. We expressed the extended GCD of 11 and 23 as:rp + sq = −2 · 11 + 1 · 23 = 1.Setting m = m 2 + kq, we find m 1 = (m 2 + kq) mod p, whences(m 1 − m 2 ) ≡ s(k q) mod p ≡ k(s q) mod p ≡ k mod p.So we have solved for k ≡ s(m 1 − m 2 ) mod p ≡ 1 (6 − 8) ≡ −2 mod p. Therefore m ≡m 1 + kq mod 253 ≡ 6 − 46 mod 253 ≡ 213 mod 253.RSA with exponent 3. A commonly used exponent for RSA encryption is e = 3.This allows efficient enciphering using only two arithmetic operations (two multiplicationsor one squaring and one multiplication). No such gain is achieved for deciphering.However, this presents algorithm presents the following problem for security. Let m be amessage to be sent to three parties, with RSA moduli n 1 , n 2 , and n 3 . The encoding of themessage satisfies 0 ≤ m < n i . By means of the Chinese remainder theorem, we can recoverc = m 3 mod n 1 n 2 n 3 from the three enciphered messages c 1 = m 3 mod n 1 , c 2 = m 3 mod n 2 ,and c 3 = m 3 mod n 3 . While the latter messages c i , as the modular representatives of somehuge integer, appear random. But from the bounds on m, the cube satisfies the bound:0 ≤ m 3 < n 1 n 2 n 3 ,hence the smallest modular representative c equals m 3 , and the cube root can be extractedas an integer to recover m.A valid protocol to overcome this dilemma, for e = 3, is to never send the same messageto more than one party. This is achieved by adding unique random padding to everymessage prior to enciphering. This turns the message m into three distinct messages m 1 ,m 2 , and m 3 . The Chinese remainder theorem then solves for some integer0 ≤ c < n 1 n 2 n 3such that c ≡ m i mod n i , but this integer no longer bears any relation to any cube m 3 .8.3 ElGamal CryptosystemsThe ElGamal Cryptosystem is implicitly based on the difficultly of finding a solution tothe discrete logarithm in F ∗ p: given a primitive element a of F ∗ p and another element b,72 Chapter 8. Public Key Cryptography