KNAPSACK Algorithms 1 FINITE 2 DEFINITENESS 3 INPUTOUTPUT

KNAPSACK公開金鑰密碼學 Algorithms 1. FINITE 2. DEFINITENESS 3. INPUT/OUTPUT 4. GENERALITY 5. EFFECTIVENESS 1

NP-Complete 問題 • 到目前為止尚未有好的Algorithm， 可在Polynomial time解決。 • 如 0/1 -Knapsack 2

3

4

an 5

6

Simple Knapsack Problem • 為一特例，其問題之解可以在Linear time求得 • 向量A 內之元素呈Supper increasing，即 Example N=5，C=14，及A =(1，3，5，10，22) 則 m 5=0 ----因 14<22 m 4=1 ----因 14>10 m 3=0 ----因 4<5 m 2=1 ----因 4>3 m 1=1 ----因 1=1 M=(1, 1, 0) 8

Merkle-Hellman Knapsack 將Simple Knapsack 轉成一般的0/1 Knapsack 1. 選一個Simple Knapsack A =(a 1, a 2, …, an) 2. 選一整數u，使得 u > 3. 選一整數e為加密金鑰，e和u互質 4. 計算解密金鑰d，e × d=1 mod u 5. 轉換A 為一般的0/1 Knapsack A 6. A=(e × A ) mod u 7. Public Key = A 8. Trapdoor = d 和u (A =d. A mod u) 9. 密文C = M× AT 9

Merkle-Hellman Knapsack方法（續） • 解密步驟 轉換密文C為可用Simple Knapsack求解之值C C =d × C mod u =d×MAT mod u =d×M×(e×A T) mod u =MA T 因A 為Simple Knapsack，故M可以很快求得。 10

Example: Merkle-Hellman Knapsack 設A =(1, 3, 5, 10)，u=20和e=7， 則d=3 A=(7, 1, 15, 10) 設M＝ 13，以二進位法表示(1, 1, 0, 1) C=M×AT=7+1+10=18 解密 C =3× 18 mod 20=14 11

Merkle-Hellman Knapsack方法的保密性 • 原先建議n=100，但Knapsack Problem可在T＝ 0 (2 n/2) 時間解決，n=100，250=1015 • 使用一個processor約11574天可完成，1000個處理機 可在 12天完成，故為安全起見，取n=200 • Merkle-Hellman 建議使用多組e，d來重覆處A=e. A 。 • 雖然 0/1 Knapsack 是NP-complete，但不意味著由 Simple Knapsack轉換之Problem一定是NP-complete 12

Example: Graham-Shamir Knapsacks 設n=5，A 如下所示 j Rj Ij Sj 1 011010 10000 000101 =a 1 2 001001 01000 000011 =a 2 3 0100100 000100 =a 3 4 011000 000111 =a 4 5 000110 00001 000001 =a 5 M=(0, 1, 0, 0, 1) C`=M×A T=a 2 +a 5 =(R 2+R 5, I 2+I 5, S 2+S 5)=001111 01001 000100 恰為明文 14

數位簽章 • RSA Digital Signature (R. L. Rivest, A. Shamir, and L. M. Adleman, 1978) • El. Gamal Digital Signature (T. El. Gamal, 1985) • Blind Signature (D. Chaum, 1983) 15

Introduction q Three Basic Services of Cryptography 1. Secrecy (provided by cryptosystems) 2. Authenticity (provided by digital signature scheme) 3. Integrity (provided by digital signature scheme) q Two Famous Digital Signature Schemes 1. RSA Digital signature scheme (based on the factorization problem) 2. El. Gamal digital signature scheme (based on the discrete logarithm) 16

Introduction q Applications: Blind signature (for electronic commerce) 17

Introduction The Model of Digital Signature Signer’s secret key Verification Function Signature Message Signer’s public key Message Check Message=? Message 18

RSA Public Key Cryptosystem and Digital Signature Scheme q Rivest, Shamir, and Adleman proposed in 1978 q RSA Public Key Cryptosystem ◆ Security Basis: Factorization Problem. ◆ Construction: 1. Choose two large prime numbers P and Q, then compute N=P×Q. 2. Select an integer e such that gcd(e, (N))=1. 3. Compute d such that e×d mod (N)=1. 4. Public key = (N, e). 5. Private key = (P, Q, d). 19

RSA Public Key Cryptosystem and Digital Signature Scheme q RSA Digital Signature Scheme v Sign Function: Signature S=Md mod N. v Verification Function: M=Se mod N. q Example 1. P=11, Q=13, N=143, and (143)=120. 2. e=103, then d=7 (for 103× 7 mod 120=1 ). 3. Sign for M=3: S=37 mod 143=42. 4. Verification: M= Se mod N = 42103 mod 143=3. 20

El. Gamal Public Key Cryptosystem and Digital Signature Scheme q El. Gamal proposed in 1985 q El. Gamal Public Key Cryptosystem ◆ Security Basis: Discrete Logarithm Problem 1. If P is a large prime and g and y are integers, find x such that y=gx mod P. 2. The security restriction on P: P-1 must contain a large prime factor Q. ◆ Construction: 1. Choose a large prime number P and a generator g of GF(P). 2. Private key: a random integer x between 1 and P-1. 3. Public key: y=gx mod P. 21

El. Gamal Public Key Cryptosystem and Digital Signature Scheme q El. Gamal Digital Signature Scheme v Sign Function: Signature (r, s) for message M. 1. Select a random integer k between 1 and p-1 such that gcd(k, P-1)=1. 2. Compute r=gk mod P 3. Compute s=k-1(M-xr) mod (P-1) v. Verification Function: 1. Verify by check whether g. M mod P = (rs) ×(yr) mod P. 2. (rs) ×(yr)=g(M-xr) × gxr = g(M-xr)+xr=g. M mod P 22

El. Gamal Public Key Cryptosystem and Digital Signature Scheme q Example 1. P=23, g=5. 2. x=3, then y=10 (for 53 mod 23=10 ). 3. Sign for the message M=8. 4. Select k=5 between 1 and 22 (P-1). 5. Compute r = gk mod P = 55 mod 23 = 20. 6. Compute s = k-1(M-xr) mod (P-1) = 5 -1(8 -3× 20) mod 22 = 9× 14 mod 22 = 16. 7. Verification: 8. g. M= 58 mod 23 =16 9. (rs)(yr) mod P = 2016 × 1020 mod 23= 13× 3 mod 23 = 16. 23

Blind Signature q D. Chaum proposed in 1983 q D. Chaum’s Blind Signature Scheme ◆ It uses the RSA algorithm. Security Basis: Factorization Problem ◆ Construction: Bob has a public key, e, a private key, d, and a public modulus, N. Alice wants Bob to sign message M blindly. 1. Alice chooses a random integer k between 1 and N. Then she blinds M by computing t = Mke mod N. 2. Bob signs t, td=(Mke)d mod N. 3. Alice unblinds td by computing s=td/k mod N = Md mod N. s is the signature of message M. 24

Blind Signature Property: Untraceable Applications: Blind signature can be used in electronic cash system. Bank 1. t=SN×ke mod N SN: Serial # k: random number 2. t Consumer 4. s=(td)/k mod N=SNd mod N Coin: SN＋s 3. td mod N 5. Coin -signs coins -database 7. Coin Merchant 6. Verify the signature s 25