RSA-PSS – Provably secure RSA Signatures and their ...

11 Really provable SecurityThe concept of provable security we investigated with PSS and OAEP is a verylimited one. It is only possible to provide “provable” security under certainassumptions. It relies on three assumptions: That factoring is a hard problem,that RSA is really as hard as factoring and that well-designed hash functionsbehave like random oracles. One could ask if it is at least theoretically possibleto create provably secure public key cryptography only under provableassumptions.What would that mean? We could define a “provably secure” public keyfunction as one that can only be broken by an attacker that is able to do acertain number of calculations dependent on the key size. Now we can choosea key size high enough to make it implausible that any attacker with humantechnology may be able to break that it within, say, the lifetime of a humanbeing.What we would require is a proof that for any attacker skilled with the bestpossible algorithms, it requires a minimum amount of calculations to forge asignature for a given message and a public key or to get the decrypted messagegiven an encrypted one and a public key. We will need some basic complexitytheory before we can answer such questions.11.1 Complexity Theory, P/NP and FP/FNPComplexity theory defines so-called complexity-classes as sets of problems withcertain properties.The first complexity class we will investigate is P. A problem X is in P ifit is a decision problem (the solution is just “yes” or “no”) and an algorithmexists that solves X for any input with length n with a running time that canbe expressed as a polynomial of n. Such algorithms are usually considered tobe “fast”. An example for a P problem are primality tests: “Given a numberwith n digits, can you decide if it is a prime?” For a long time, it was unknownif a polynomial primality test exists. In 2002, a polynomial primality algorithm– the AKS algorithm – was presented and thus showed that primality tests arein P.The second important complexity class is NP. NP stands for “NondeterministicPolynomial time”, but we will use an easier notion here: NP problemsare all decision problems where a polynomial algorithm exists to verify a resultgiven some extra information.The problems interesting for public key cryptography – like factoring – areusually not decision problems. But it is easily possible to transfer them intodecision problems. A decision problem for factoring could be like this: “Givena large number N and a number X with X < N, is there a factor of N smallerthan X?” A fast algorithm that is able to solve this decision problem can beused with a binary search (which itself is polynomial) to factor large numbers.43