Coin Flipping Protocol CS 303 Alg Number Theory

Coin Flipping Protocol CS 303 Alg. Number Theory & Cryptography Jeremy Johnson Manuel Blum, Coin Flipping by Telephone: A Protocol for Solving Impossible Problems, ACM SIGACT, Vol. 15, No. 1, 1983, pp. 23 -27.

Outline Coin flipping protocol n Completely secure vs. normally secure one-way functions n Some protocols that do not work n Blum Protocol n Goldwasser-Micali Probabilistic Encryption n 12/10/2008 Goldwasser 1

Coin Tossing Protocol n Want to flip a coin over the telephone Fair and verifiable n Not subject to cheating n 2

Public Key Cryptography n Let M be a message and let C be the encrypted message (ciphertext). A public key cryptosystem has a separate method E() for encrypting and D() decrypting. n n n D(E(M)) = M Both E() and D() are easy to compute Publicly revealing E() does not make it easy to determine D() E(D(M)) = M - needed for signatures The collection of E()’s are made publicly available but the D()’s remain secret. Called a one-way trap-door function (hard to invert, but easy if you have the secret information) 3

Attempt 1 n Generate Encryption/Decryption Keys A: Randomly select flip = “heads” or “tails” n A B EA(flip) n B A guess heads or tails n A B DA() to check result n n What’s wrong 4

One-Way Functions n Normally Secure One-Way Function n n Efficiently computable function whose inverse can not be computed efficiently Completely Secure One-Way Function n Normally secure plus knowledge of f(x) does not give more than 50 -50 chance of efficiently guessing some non-trivial property such as parity 5

Solution with a Completely Secure One-Way Function A: randomly select x n A B f(x) n B A guess x even/odd n A B send x to verify result n 6

Attempt 2 (RSA) n Generate Keys: N = PQ, gcd(e, (N))=1, ed 1(mod (N)), E = (e, N), D = (d, N) A: Randomly select x (use parity) n A B E(x) n B A guess parity of x n A B D() to check parity of result n n What could be wrong 7

Attempt 3 (Discrete Log) n Zp = < >, p 1 (mod 4) prime A: Randomly select x (use parity) n A B y = x n B A guess parity of x n A B send x to verify guess n n Probability is correct. What is wrong? 8

Blum Protocol 1. Bob generates n=pq where p and q are both primes equivalent to 3 mod 4 and sends n to Alice 2. Alice generates a random x and computes y = x 2 (mod n) and sends y to Bob [this is the coin flip] 3. Bob guesses heads b = 1 or tails b = -1 and sends the guess to Alice 4. Alice sends x to Bob and Bob computes J(x, n) and checks to see if J(x, n)=b If so he wins otherwise he loses. 9

Correctness of Blum Protocol n Four solutions x 2 a (mod N) [use CRT] n n P Q 3 (mod 4) J(-1, P) =J(-1, Q) = -1 § n (±b)2 a (mod P), (±c)2 a (mod Q) Half with J(x, N) = 1, half with J(x, N)= -1 Knowing solutions x 1 and x 2 gives P, Q x 1 b (mod P), x 1 = c (mod Q) n x 2 = b (mod P), x 2 = c (mod Q) gcd(x 1 -x 2, N)=Q n 10

Public Key Cryptography n Let M be a message and let C be the encrypted message (ciphertext). A public key cryptosystem has a separate method E() for encrypting and D() decrypting. n n n D(E(M)) = M Both E() and D() are easy to compute Publicly revealing E() does not make it easy to determine D() E(D(M)) = M - needed for signatures The collection of E()’s are made publicly available but the D()’s remain secret. Called a one-way trap-door function (hard to invert, but easy if you have the secret information) 11

Goldwasser-Micali Probabilistic Encryption n Goldwasser-Micali (Quadratic Redisuosity) n N = pq, x a non-residue such that n m = m 1 mt, mi {0, 1} c = c 1 ct, ci = yixmi mod N, yi random quadratic residue n Shafi Goldwasser and Silvio Micali. Probabilistic Encryption. Journal of Computer and System Sciences (JCSS), 28(2): 270299, April 1984. 12