Innovation and Cryptoventures Digital Signatures Campbell R Harvey

Innovation and Cryptoventures Digital Signatures Campbell R. Harvey Duke University and NBER February 11, 2018

Campbell R. Harvey 2018 2

Definition Cryptography is the science of communication in the presence of an adversary. Part of the field of cryptology. Campbell R. Harvey 2018 3

Goals of Adversary • Alice sends message to Bob • Eve is the adversary Campbell R. Harvey 2018 4

Goals of Adversary Eve’s goals could be: 1. 2. 3. 4. Eavesdrop Steal secret key so that all future messages can be intercepted Change Alice’s message to Bob Masquerade as Alice in communicating to Bob Campbell R. Harvey 2018 5

Symmetric Keys Early algorithms were based on symmetric keys. • This meant a common key encrypted and decrypted the message • You needed to share the common key and this proved difficult Campbell R. Harvey 2018 6

Symmetric Keys • Early methods relied on a shared key or code • A message would be encrypted and sent but the receiver needed to decode with a key or a special machine • Example: The “Lektor” in James Bond, From Russia with Love. Campbell R. Harvey 2018 7

Symmetric Keys • However, you needed to securely share the key or decoder. Campbell R. Harvey 2018 8

Symmetric Keys • However, you needed to securely share the key or decoder. The “adversary” Campbell R. Harvey 2018 9

Symmetric Keys • Nazi Enigma Machine is an earlier version of the “Lektor” https: //www. youtube. com/watch? v=G 2_Q 9 Fo. D-o. Q https: //www. youtube. com/watch? v=V 4 V 2 bp. Zlqx 8 Recommended videos! Campbell R. Harvey 2018 10

Secret Keys Symmetric key • DES (Data Encryption Standard) was a popular symmetric key method, initially used in SET (first on-line credit card protocol) • DES has been replaced by AES (Advanced Encryption Standard) Campbell R. Harvey 2018 11

Diffie-Hellman Key Exchange • Breakthrough in 1976 with Diffie-Hellman-Merkle key exchange • There is public information that everyone can see. Each person, say Alice and Bob, have secret information. • The public and secret information is combined in a way to reveal a single secret key that only they know https: //www. youtube. com/watch? v=YEBfamv-_do Campbell R. Harvey 2018 12

Diffie-Hellman Key Exchange • Will use prime numbers and modulo arithmetic • We already encountered one example of modular arithmetic simple ciphers (also the SHA-256 which uses mod=232 or 4, 294, 967, 296) https: //www. youtube. com/watch? v=YEBfamv-_do Campbell R. Harvey 2018 13

Key Exchange Numerical example • “ 5 mod 2” = 1 • Divide 5 by 2 the maximum number of times (2) • 2 is the modulus • The remainder is 1 • Remainders never larger than (mod-1) so for mod 12 (clock) you would never see remainders greater than 11. • EXCEL function = mod(number, divisor) e. g. , mod(329, 17) = 6 “mod” Campbell R. Harvey 2018 14

Key Exchange Alice and Bob decide on two public pieces for information • A modulus (say 17) • A generator (or the base for an exponent) (say 3) • Alice has a private key (15) • Bob has a private key (13) • Is it possible for them to share a common secret that is unlikely to be intercepted? Campbell R. Harvey 2018 https: //www. khanacademy. org/computing/computer-science/cryptography/modern-crypt/v/diffie-hellman-key-exchange-part-2 15

Key Exchange Alice: Calculates 315 mod 17 = 6 (i. e. , =mod(3^(15), 17)) • Alice send the message “ 6” to Bob Campbell R. Harvey 2018 16

Key Exchange Alice: Calculates 315 mod 17 = 6 (i. e. , =mod(3^(15), 17)) • Alice send the message “ 6” to Bob • Eve intercepts the message! Campbell R. Harvey 2018 17

Key Exchange Bob: Calculates 313 mod 17 = 12 (i. e. , =mod(3^(13), 17)) • Bob send the message “ 12” to Alice Campbell R. Harvey 2018 18

Key Exchange Bob: Calculates 313 mod 17 = 12 (i. e. , =mod(3^(13), 17)) • Bob send the message “ 12” to Alice • Eve intercepts the message! Now Eve has the 6 and the 12. Campbell R. Harvey 2018 19

Key Exchange Alice: She takes Bob’s message of 12 and raises it to the power of her private key. Calculates 1215 mod 17 = 10 (i. e. , =mod(12^(15), 17))* • This is their common secret *EXCEL only does 15 digits so this will not work Campbell R. Harvey 2018 20

Key Exchange Bob: He takes Alice’s message of 6 and raises it to the power of his private key. Calculates 613 mod 17 = 10 (i. e. , =mod(6^(13), 17)) • This is their common secret Campbell R. Harvey 2018 21

Key Exchange Eve She has intercepted their message. However, without the common secret key, there is little chance she can recover the shared secret. Campbell R. Harvey 2018 22

Key Exchange Common secret • Alice can now encrypt a message with the common secret and Bob can decrypt it with the common secret. • Notice this is a common secret. • Next we will talk private/public keys. That is, both and Alice have separate public keys and separate private keys. Campbell R. Harvey 2018 23

Key Exchange (Optional slide) Why does this work They are solving the same problem. • Alice sent Bob 315 mod 17 = 6. • Bob raises the to power of 13. This is the same as 613 mod 17 = [315]^(13) mod 17 =10 Alice’s original calculation Campbell R. Harvey 2018 24

Key Exchange (Optional slide) Why does this work They are solving the same problem. • Bob sent Alice 313 mod 17 = 12. • Alice raises the to power of 15. This is the same as 1215 mod 17 = [313]^(15) mod 17 =10 Bob’s original calculation Campbell R. Harvey 2018 25

Key Exchange (Optional slide) Why does this work They are solving the same problem. The modular arithmetic is crucial. • See! [313]^(15) = [315]^(13) Campbell R. Harvey 2018 26

Asymmetric keys Public and private keys • A message needs to go from Sender to Receiver • Receiver gives the Sender a lock • Sender locks the message (ciphertext) and transmits to Receiver • Only the Receiver can decrypt because they have the key The lock is the public key The key to open the lock is the private key Campbell R. Harvey 2018 27

Asymmetric keys RSA • RSA stands for Rivest, Shamir and Adleman. Note discovered earlier by UK Communications-Electronics Security Group (CESG) – but kept secret. • Receiver generates two public pieces of information and a private key • One piece of public information is just the product of two prime numbers, N=p*q (called “max”) • The other is the public key, e, is just another prime that is greater than 2 and less than the product, N • The prime numbers, p and q, that are used are huge. The private key is mathematically linked to public keys. • Sender encrypts with the two public keys • Receiver can easily decrypt Campbell R. Harvey 2018 28

RSA: High Level Overview See my Cryptography 101 (linked) deck for much more detail. • Two prime numbers are chosen and they are secret (say 7 and 13, p, q). • Multiply them together. The product (N=91) is public but people don’t know the prime numbers used to get it. • A public key, e, is chosen (say 5). • Given the two prime numbers, 7 and 13, and the public key, we can derive the private key, which is 29. Campbell R. Harvey 2018 29

RSA Issues with RSA • RSA relies on factoring • N is public (our example was 91) as is e • If you can guess the factors, p, q, then you can discover the private key Campbell R. Harvey 2018 30

RSA Issues with RSA • Factoring algorithms have become very efficient • To make things worse, the algorithms become more efficient as the size of the N increases • Hence, larger and larger numbers are needed for N (moving to 2, 048 bits) • This creates issues for mobile and low power devices that lack the computational power Campbell R. Harvey 2018 31 http: //www. slate. com/articles/health_and_science/2016/01/the_world_s_largest_prime_number_has_22_338_618_digits_here_s_why_you_should. html

Elliptic Curve Cryptography Mathematics of elliptic curves • Does not rely on factoring • Curve takes the form of y 2 = x 3 + ax + b Note that diagram is “continuous” but we will be using discrete versions of this arithmetic Note: 4 a 3 + 27 b 2 ≠ 0 Bitcoin uses a=0 and b=7 Campbell R. Harvey 2018 32

Elliptic Curve Cryptography Properties • Symmetric in x-axis • Any non-vertical line intersects in three points • Algebraic representation Campbell R. Harvey 2018 33

Elliptic Curve Cryptography Properties: Addition R P Q Denote Elliptic Curve as E P+Q Campbell R. Harvey 2018 34

Elliptic Curve Cryptography Properties: Doubling P Denote Elliptic Curve as E 2 P Campbell R. Harvey 2018 35

Elliptic Curve Cryptography (Optional slide) Properties: Other (a) P + O = O + P = P for all P ∈ E. (existence of identity) (b) P + (−P) = O for all P ∈ E. (existence of inverse) (c) P + (Q + R) = (P + Q) + R for all P, Q, R ∈ E. (associative) (d) P + Q = Q + P for all P, Q ∈ E (communativity) Denote Elliptic Curve as E Campbell R. Harvey 2018 36

Elliptic Curve Cryptography Why use in cryptography? • Suggested by Koblitz and Miller in 1985 • Implemented in 2005 • Key insight: • Adding and doubling on the elliptic curve is easy but undoing the adding is very difficult • 256 bit ECC public key provides about the same security as 3, 072 bit RSA public key • Bitcoin uses a particular type of ECC known as secp 256 k 1 http: //www. nicolascourtois. com/bitcoin/groups_ECC_7 B. pdf Campbell R. Harvey 2018 37

Elliptic Curve Cryptography Do not confuse ECC in bitcoin with Dual_EC_DRBG (cryptotrojan) • August 2007 paper presented that suggested the possibility of a backdoor in government approved encryption standard • 2013 New York Times reveals information from Edward Snowden confirming the backdoor via project Bullrun • NSA paid $10 million to make it the standard https: //www. wired. com/2013/09/nsa-backdoor/ https: //www. wired. com/images_blogs/threatlevel/2013/09/15 -shumow. pdf Campbell R. Harvey 2018 38

Elliptic Curve Cryptography Modulo arithmetic on EC • Example of modulo 67 (means only points are between 0 and 66 • Notice the symmetry Campbell R. Harvey 2018 http: //www. coindesk. com/math-behind-bitcoin/# 39

Elliptic Curve Cryptography Modulo arithmetic on EC • Notice the symmetry (reflection in the red line) Campbell R. Harvey 2018 http: //www. coindesk. com/math-behind-bitcoin/# 40

Elliptic Curve Cryptography Modulo arithmetic on EC • Example of modulo 67 • Addition of (2, 22) and (6, 25) • Note (2, 22) called the “base point” • The dashed blue line wraps around and intersects at (47, 39) and the reflection is (47, 28)* Note: (2, 22)+(6, 25) ≠ (8, 47) because we are adding on elliptic curve. See for review https: //www. voltage. com/math-2/adding-points-on-an-elliptic-curve/ http: //www. coindesk. com/math-behind-bitcoin/# Campbell R. Harvey 2018 41

Elliptic Curve Cryptography (Optional slide) Four choices: • Form of elliptic curve • Prime modulo • Base point • Order Campbell R. Harvey 2018 http: //www. coindesk. com/math-behind-bitcoin/# 42

Elliptic Curve Cryptography (Optional slide) Four choices: • Form of elliptic curve: y 2 = x 3 + 7 • Prime modulo: 2256 – 232 – 29 – 28 – 27 – 26 – 24 - 1 = FFFFFFFF FFFFFFFFE FFFFFC 2 F • Base point: 04 79 BE 667 E F 9 DCBBAC 55 A 06295 CE 870 B 07 029 BFCDB 2 DCE 28 D 9 59 F 2815 B 16 F 81798 483 ADA 77 26 A 3 C 465 5 DA 4 FBFC 0 E 1108 A 8 FD 17 B 448 A 6855419 9 C 47 D 08 F FB 10 D 4 B 8 • Order: FFFFFFFF FFFFFFFE BAAEDCE 6 AF 48 A 03 B BFD 25 E 8 C D 0364141 Campbell R. Harvey 2018 http: //www. coindesk. com/math-behind-bitcoin/# 43

Elliptic Curve Cryptography (Optional slide) How it works: • Private key is a random number chosen between 1 and the order • Public key = private key*base point • Maximum number of private keys (and bitcoin addresses) is equal to the order. • It is straightforward to go from private key to a public key – but brutally difficult to go from public key to private key. Campbell R. Harvey 2018 http: //www. coindesk. com/math-behind-bitcoin/# 44

Elliptic Curve Cryptography (Optional slide) How it works: 1. Choose private key and derive public key • Let prime modulus = m • Let base point (x, y) = G • Let order = n • Let private key = d (which is just a number) Public key Q(x, y) = d*G [operations on the elliptic curve with prime modulus m] Campbell R. Harvey 2018 http: //www. coindesk. com/math-behind-bitcoin/# 45

Elliptic Curve Cryptography (Optional slide) How it works: 2. Sign • Let data = z (which could be a SHA-256 of the data you are signing) • Generate a random number k • Calculate k*G which leads to particular coordinates (x, y)* • Calculate r = x mod n [Note n=order] • Calculate s = (z + r*d)/k mod n Private key Digital Signature (DS) = (r, s) is just a set of coordinates Campbell R. Harvey 2018 http: //www. coindesk. com/math-behind-bitcoin/# 46 *I am not sure what modulus is used for this EC operation.

Elliptic Curve Cryptography (Optional slide) How it works: 3. Verify • Calculate w = s-1 mod n Base point • Calculate u = z*w mod n • Calculate v = r*w mod n • Calculate the point (x’, y’) = u. G + v. Q • Verify that r = x’ mod n If yes, verified. Public key Remember DS = (r, s) Campbell R. Harvey 2018 http: //www. coindesk. com/math-behind-bitcoin/# 47

Elliptic Curve Cryptography (Optional slide) How it works: 4. Intuition • Anyone can encrypt something with a public key • The digital signature algorithm uses the data, a random number, and both the private and public keys • Verification shows that only the owner of both the private and public key could have signed. Verification is a “yes” or a “no”. Campbell R. Harvey 2018 http: //www. coindesk. com/math-behind-bitcoin/# 48

ECDSA • Private key is a number called “signing key” (SK). It is secret. • Public key is the “verification key” and is mathematically linked to the private key SK Private key: (number) VK EC Elliptic curve operations: Need base point, modulus, order Public key: coordinate (x, y) Note: Easy to generate a public key with a private key. Not easy to go the other way. Campbell R. Harvey 2018 49

ECDSA • Digital signature Nonce: (random number) Nonce Message DS EC SK Private key: (number) Elliptic curve operations: Need base point, modulus, order (n) Campbell R. Harvey 2018 Digital signature: coordinate (r, s) 50

ECDSA • Verification DS coordinates Yes (verified) r s EC (x’, y’) r = x’ mod n ? Message VK No (rejected) Elliptic curve operations: Need base point, order (n) Derive new point on elliptic curve Check x coordinate of new point and DS Public key: (x, y) Note r not used until verification step Campbell R. Harvey 2018 51

How DSAs Work Notice • Proves that the person with the private key (that generated the public key) signed the message. • Interestingly, digital signature is different from a usual signature in that it depends on the message, i. e. , the signature is different for each different message. • In practice, we do not sign the message, we sign a cryptographic hash of the message. This means that the size of the input is the same no matter how long the message is. Campbell R. Harvey 2018 52

ECDSA in Action https: //kjur. github. io/jsrsasign/sample-ecdsa. html Campbell R. Harvey 2018 53

ECDSA in Action OP_CHECKSIG uses Public Key + Digital Signature + Hash of Transaction Verifies whether this transaction has been signed by the owner of the Private Key https: //www. youtube. com/watch? v=ir 4 d. DCJhd. B 4 (advanced by Matt Thomas) Campbell R. Harvey 2018 54

Application: PGP Email My public key for secure email • You can encrypt an email to me with my public key and only I can decrypt with my private key. Campbell R. Harvey 2018 55

Application: PGP Email Steps 1. Message compressed 2. Random session key (based on mouse movements and keystrokes) is generated. 3. Message encrypted with session key 4. Session key is encrypted with receiver’s public key 5. Encrypted message + encrypted session key sent via email 6. Recipient uses their private key to decrypt the session key 7. Session key is used to decrypt the message 8. Message decompressed http: //www. pgpi. org/doc/pgpintro/ Campbell R. Harvey 2018 56

References • The Math Behind Bitcoin [recommended] • Elliptic Curve Digital Signature Algorithm (Bitcoin) • What does the curve used in Bitcoin, secp 256 k 1, look like? • Elliptic Curve Digital Signature Algorithm (Wikipedia) • Elliptic Curve Cryptography (UCSB) • Elliptic Curve Cryptography and Digital Rights Management (Purdue) • Zero to ECC in 30 minutes (Entrust) • The Elliptic Curve Cryptosystem • Goldwasser, Shaffi and Mihir Bellare, 2008, Lecture Notes on Cryptography • Dan Boneh, Stanford University, Introduction to Cryptography • Dan Boneh, Stanford University, Cryptography II • https: //arstechnica. com/security/2013/10/a-relatively-easy-to-understand-primer-on-elliptic-curve-cryptography/ Campbell R. Harvey 2018 57