Kriptografija zasnovana na asimetri nim klju evima eng

Kriptografija zasnovana na asimetri č nim ključ evima (eng. public-key or asymmetric cryptography) Mario Čagalj mcagalj@fesb. hr FESB

Kriptografski sustav Plaintext Encryption ke Key Channel Ciphertext Message Channel Decryption Plaintext kd Key Generation : : 2: :

Public-Key Cryptosystems m PUB Source A o c Encryption Key Channel Message Channel m Decryption PRB Key Generation Destination B Entitet B generira par enkripcijskih ključeva (PUB, PRB) o o o PUB – javni kljuc (public key), PRB – privatni kljuc (private key) PUB javna je informacija (dostupna i poznata entitetu A) PRB zna samo entitet B (B čuva PRB kao tajnu, nikad ga ne otkriva) : : 3: :

Public-Key Cryptosystems o Entitet B generira par enkripcijskih kljuceva (PUB, PRB) o Primjer RSA: openssl genrsa -out private. pem 2048 -----BEGIN PUBLIC KEY----MIIBIj. ANBgkqhki. G 9 w 0 BAQEFAAOCAQ 8 AMIIBCg. KCAQEAvx 5 jz 0 h. Uerbgt 6 Kumq/P 7 Wg 48 x. Ec. Kz 9 h. IOKHa. Sh. QP 572 GO 54 l. Ac. UHBSaipe 2 fz. Ym 2 P 3 GETi. Tqspo+e. Pa 46 ma i 56 Lq. WUpkd. Exbp 5 Pm. BPNo. IQ 95 w+erxai. YWd. WOe. YRULEQJw. Az. G 3 PAFUEOGRhlp. L 7 j SIPZb 7 TCK/b+Dq. IBw 3 Sppu 11 Xq. Lcf. Vj. LVK 1 d. DM 7+kmdot 5 sr. Ri. U 97 VTpdy. QL 5 RXK Lyr. Kn. LIj. Rfn+L 2 Oy. X 0 brhf. X 7 Pgzp/1 P 896 Y 6 Zahz. FBPw 5 JAg. HQyq. CXQ 6 q. DZ 5 KDdc m. AYe. Lvnu. G 6 Gk. Xef 4 ww. HZ 4 Dabm. Ep 9 d. ZDCAp 2 qv. AGp. C 1 j 6 Dd. V 45 q. Tfu 1 eti. FNn. AWjg KQIDAQAB -----END PUBLIC KEY-----BEGIN RSA PRIVATE KEY----MIIEow. IBAAKCAQEAvx 5 jz 0 h. Uerbgt 6 Kumq/P 7 Wg 48 x. Ec. Kz 9 h. IOKHa. Sh. QP 572 GO 54 l. Ac. UHBSaipe 2 fz. Ym 2 P 3 GETi. Tqspo+e. Pa 46 mai 56 Lq. WUpkd. Exbp 5 Pm. BPNo. IQ 95 w+e rxai. YWd. WOe. YRULEQJw. Az. G 3 PAFUEOGRhlp. L 7 j. SIPZb 7 TCK/b+Dq. IBw 3 Sppu 11 Xq. Lc f. Vj. LVK 1 d. DM 7+kmdot 5 sr. Ri. U 97 VTpdy. QL 5 RXKLyr. Kn. LIj. Rfn+L 2 Oy. X 0 brhf. X 7 Pgzp /1 P 896 Y 6 Zahz. FBPw 5 JAg. HQyq. CXQ 6 q. DZ 5 KDdcm. AYe. Lvnu. G 6 Gk. Xef 4 ww. HZ 4 Dabm. Ep 9 d. ZDCAp 2 qv. AGp. C 1 j 6 Dd. V 45 q. Tfu 1 eti. FNn. AWjg. KQIDAQABAo. IBAAFw. DBYq. GCCYMZa. Q Dboy. Km. FB 0 HPbp. Beb. MXLa 4 WPk. Hr 5 rxr. Qn. Txbl+ru/V+5 E 9+V 7 Fc 26 Evxc. LZgy. T 5 n. Z of. Lmergk. KC 7 NCQQEy 9 dm. L 3 k. YZQq. ZFBIh 5 v. Kw. O+Z 5 r. Ydf+K 9 ft. Zxlfvzs 4 Pw. H 8 k. A 0 E 8 eqe/E 2 t. LMHb. BKCm. CSq. CVNc. FE 6 i. JVIVM 0 y. G/Tfz. Bx. Ieg 2 B 0 g 1 T 6 bsw. POot 7 sga. A 1 e. Sq 1 RLmz. Zt 6 Va 19 Bghu. Ij. DWHz. B 8/ujt 4 Xi. Z 0 jt. Tv. Bt+e. ALFupa. Oqqiosyd 5 G 6 v. D KEFYd 60 dqj. Bo 4 vbo/txbj 1 ONXe. Om. D 4 z. Envnd+6 S/rzdlvi. Jlpn. T 3 o. GXAAD 7 YDERd h. Pz. Y 7 RECg. YEA 8 BPa 8 l. PBd. FB 9 d 1 a. Iqym 4 k. Hxim 2 VWTUq 0 Lbnl. ZU 2 Tiez 9 WB 2 l. LLZt YUw. DJG 2 Ok. Clz. Duonva 0 JU 6 Vefuty 5 AQp. NUSUAMP 71 Of 5+Edf. Px. Ew 7 bi. Nzjv. Jv 8 i. C +IMxmgca. NSNhh. GRTC 0 l. R+u. Vpos 533 w. TW/Tm. TYDSe/Ir. YQE 6 Bz 1 D 2 w. RUCg. YEAy 8 t. K DZ 09 Hn. Kp 6 k 8 n 81 x. HGexq. Am. GS 6 P 7 u 4 QYDx. HLIf. KHJe 7 J 9 C 2 xk 4 K 1 JYld. Vrq. Wh 32 KL Ia+bw. SF 8 e. ORc. Pe 5 Ms. A 1 r. Iktg 5 ah. Z/WH 37 ojjo. XVcof. S 063 HHCJ 7 HJpg 8 Di. Qxau. Ty 58 spveg. RQgsoa. Nlxcm. H 5 uo. MU 8 tkbq 1 Law. Y 9 B 38 UCg. YAXUu. Z/in. GN+k/m. Kys. F 7 fy 3 VM 5 Dq. Jm 00 q. Akn. R 3 TNLEzwiluy. Rq. F+Icx 36+id 15 VVSGPfm. I 0 BD 6 Wu. Mcwb 3 Fv. A 5 R 5 T 1 t. No 7 ywl 4 Tqg. Qy. Y 1 PO 69 KYa. Nib. Ikh. Nf. T 2 ef. Pjdmm. DRe. J 10 GCK 6 FQIp 9 va 9 Zp. F+6 p. EBUJWi. Ywmh 1/uq. Pm. J 8 Qb. QKBg. Ee. BXctn. F 3 Heg 7 X 97 i. Oahiw. XYp 7 RQ 63 S/Vgh. Ny. Mv rx 7 j 2 YE 4 g. F 2 Iu+CFj. NEfma. W 84 g 4 y. Um. UQa 9 MY/8 af. Qap. NOc. Uw. AB 45 Wpda. Ob. EJNeg. R Se. V 1+3 ms. Ferish. ZZN 8 FX+w. Jv. Op. Oq. H 3 yr. MUs 76 Qp. GRfh 8 Cy 06 KVi. C 88+909 KKMM 1 n i. ZKNAo. GBAKqxcz. B 1 I 4 m. Ddlm 8 NI 36 l. Fql. NX 8 lbr 7 k. Sfe. I 6 yur. Uf. Ul. KBi. Ml. U 2 n. RXei 48 n 7 E 5+Ez. Z 5 ex 8 r 0 biq. Gcoq. C 9 Gwq. DSk 3 a. NEJRv. QXU 06 yj. SSo. TXo. IE 6 c 0 w. Lxdf. SWc 8 q/ZHKld. Jk. WB 3 QPKocv. ALVv. Tfoyusk. Zk. Mcjk 6 j. Wrtr 3 v. Lq 7 Rut. RK -----END RSA PRIVATE KEY----- : : 4: :

Public-Key Cryptosystems o Entitet B generira par enkripcijskih kljuceva (PUB, PRB) o Primjer RSA: openssl rsa –in private. pem -text -----BEGIN PUBLIC KEY (2048 bit)----modulus: 00: bf: 1 e: 63: cf: 48: 54: 7 a: b 6: e 0: b 7: a 2: ae: 9 a: af: cf: ed: 68: 38: f 3: 11: 1 c: 2 b: 3 f: 61: 20: e 2: 87: 69: 28: 50: 3 f: 9 e: f 6: 18: ee: 78: 94: 07: 14: 1 c: 14: 9 a: 8 a: 97: b 6: 7 f: 36: 26: d 8: fd: c 6: 11: 38: 93: aa: ca: 68: f 9: e 3: da: e 3: a 9: 9 a: 8 b: 9 e: 8 b: a 9: 65: 29: 91: d 1: 31: 6 e: 9 e: 4 f: 98: 13: cd: a 0: 84: 3 d: e 7: 0 f: 9 e: af: 16: a 2: 61: 67: 56: 39: e 6: 11: 50: b 1: 10: 27: 00: 33: 1 b: 73: c 0: 15: 41: 0 e: 19: 18: 65: a 4: be: e 3: 48: 83: d 9: 6 f: b 4: c 2: 2 b: f 6: fe: 0 e: a 2: 01: c 3: 74: a 9: a 6: ed: 75: 5 e: a 2: dc: 7 d: 58: cb: 54: ad: 5 d: 0 c: ce: fe: 92: 67: 68: b 7: 9 b: 2 b: 46: 25: 3 d: ed: 54: e 9: 77: 24: 0 b: e 5: 15: ca: 2 f: 2 a: ca: 9 c: b 2: 23: 45: f 9: fe: 2 f: 63: b 2: 5 f: 46: eb: 85: fb: 3 e: 0 c: e 9: ff: 53: fc: f 7: a 6: 3 a: 65: a 8: 73: 14: 13: f 0: e 4: 90: 20: 1 d: 0 c: aa: 09: 74: 3 a: a 8: 36: 79: 28: 37: 5 c: 98: 06: 1 e: 2 e: f 9: ee: 1 b: a 1: a 4: 5 d: e 7: f 8: c 3: 01: d 9: e 0: 36: 9 b: 98: 4 a: 7 d: 75: 90: c 2: 02: 9 d: aa: bc: 01: a 9: 0 b: 58: fa: 0 d: d 5: 78: e 6: a 4: df: bb: 57: ad: 88: 53: 67: 01: 68: e 0: 29 public. Exponent: 65537 (0 x 10001) -----END PUBLIC KEY-----BEGIN RSA PRIVATE KEY (2048 bit)----modulus: 00: bf: 1 e: 63: cf: 48: 54: 7 a: b 6: e 0: b 7: a 2: ae: 9 a: af: cf: ed: 68: 38: f 3: 11: 1 c: 2 b: 3 f: 61: 20: e 2: 87: 69: 28: . . . fa: 0 d: d 5: 78: e 6: a 4: df: bb: 57: ad: 88: 53: 67: 01: 68: e 0: 29 private. Exponent : 01: 70: 0 c: 16: 2 a: 18: 20: 98: 31: 96: 90: 0 d: ba: 32: 2 a: 61: 41: d 0: 73: db: a 4: 17: 9 b: 31: 72: da: e 1: 63: e 4: 1 e: be: 6 b: c 6: b 4: 27: 4 f: 16: e 5: fa: bb: bf: 57: ee: 44: f 7: e 5: 7 b: 15: cd: ba: 12: fc: 5 c: 2 d: 98: 32: 4 f: 99: d 9: a 1: f 2: e 6: 7 a: b 8: 24: 28: 2 e: cd: 09: 04: cb: d 7: 66: 2 f: 79: 18: 65: 0 a: 99: 14: 12: 21: e 6: f 2: b 0: 3 b: e 6: 79: ad: 87: 5 f: f 8: af: 5 f: b 5: 9 c: 65: 7 e: fc: e 0: fc: 07: f 2: 40: 34: 13: c 7: aa: 7 b: f 1: 36: b 4: b 3: 07: 6 c: 12: 82: 98: 24: aa: 09: 53: 5 c: 14: 4 e: a 2: 25: 52: 15: 33: 4 c: 86: fd: 37: f 3: 07: 12: 1 e: 83: 60: 74: 83: 54: fa: 6 e: cc: 0 f: 3 a: 8 b: 7 b: b 2: 06: 80: d 5: e 4: aa: d 5: 12: e 6: cd: 9 b: 7 a: 55: ad: 7 d: 06: 08: 6 e: 22: 30: d 6: 1 f: 30: 7 c: fe: e 8: ed: e 1: 78: 99: d 2: 3 b: 53: bc: 1 b: 7 e: 78: 02: c 5: ba: 96: 8 e: aa: a 8: b 3: 27: 79: 1 b: ab: c 3: 28: 41: 58: 77: ad: 1 d: aa: 30: 68: e 2: f 6: e 8: fe: dc: 5 b: 8 f: 53: 8 d: 5 d: e 3: a 6: 0 f: 8 c: c 4: 9 e: f 9: dd: fb: a 4: bf: af: 37: 65: be: 22: 65: a 6: 74: f 7: a 0: 65: c 0: 00: 3 e: d 8: 0 c: 44: 5 d: 84: fc: d 8: ed: 11 -----END RSA PRIVATE KEY----- : : 5: :

Public-Key Cryptosystems m PUB Source A o c Encryption Key Channel Message Channel m Decryption PRB Key Generation Destination B A želi poslati B tajnu poruku m (zaštita povjerljivosti) o o o A enkriptira poruku m javnim kljucem PUB: c = E(PUB, m) B dekriptira ciphertext c privatnim kljucem PRB: m = D(PRB, c) Samo entitet B moze dekriptirati ciphertext c (samo B poznaje PRB) : : 6: :

Public-Key Cryptosystems o A zeli poslati B tajnu poruku m (zastita povjerljivosti) o Primjer RSA const fs = require('fs') path = require('path') crypto = require('crypto') debug = require('debug')('cryptor') const PRIVATE_KEY = fs. read. File. Sync(path. join(__dirname, 'private. pem')) const PUBLIC_KEY = fs. read. File. Sync(path. join(__dirname, 'public. pem')) const plaintext = 'Hello world!' const ciphertext = crypto. public. Encrypt(PUBLIC_KEY, Buffer. from( plaintext)) const decrypted_plaintext = crypto. private. Decrypt(PRIVATE_KEY, ciphertext) debug('Plaintext: ', plaintext) debug('Ciphertext: ', ciphertext. to. String('hex')) debug('Decrypted: ', decrypted_plaintext. to. String ()) Plaintext : Hello world! Ciphertext: 12 fbc 6 d 3 dff 2767 f 39 b 647 f 794 a 6 fe 3 f 99 c 950 ec 3 ea 3 cc 47392 eeb 5 f 203 d 18 e 1 dad 02299 fff 613 fbd 7 e df 78 c 1 d 9283 f 3 a 6 af 71843 b 7 f 615411 cbf 1561 dcd 94 c 8904271 ae 1 b 5 addd 39867167513 de 91 d 4863039 d 52 fce 3 ae 3 f 7 a 2011 fcf 22 a 1 ccc 33473 a 70709 bf 8 b 53936 e 2 c 747 c 8 be 8 bf 1449 c 1294 fef 600 fc 0 eeabd efddc 86878 fa 5 b 8 a 4883 eb 21 a 159790840 dd 7587 f 521 baf 3504 ab 5 f 2 abbabd 58 a 49393443 c 4 b 36 c 6383 45 a 9 c 3 e 13 ffc 95 cd 0 ac 4164 bda 1 f 8951 c 504 bf 625 b 6141 de 8 da 4878 f 672821 d 5729 e 5440 ea 57 d 796 d 30 4 fa 9 e 048506998 e 056 b 7 fc 4 bf 70 e 374 d 0 d 2 e 3 aafff 991520 f 1086 bd 5 df 534107 ae 706 e 6 c 1 a 2 e 287 f 160 2 bd 40598 c 6 aecf (2048 bit) Decrypted : Hello world! : : 7: :

Public-Key Cryptosystems m Encryption PRA Source A o (m, c) Message Channel Key Generation m’ Decryption Key Channel PUA Destination B A želi zaštititi integritet poruke i pošiljatelja (autentikacija) o o o A enkriptira m svojim privatnim kljucem PRA: c = E(PRA, m) B prima (m, c), dekriptira c javnim kljucem PUA : m’ = D (PUA, c) B provjerava vrijedi li m’ = m? : : 8: :

Public-Key Cryptosystems o A želi zaštititi integritet poruke i pošiljatelja (autentikacija) o Primjer RSA let sign = crypto. create. Sign('RSA-SHA 256') let verify = crypto. create. Verify('RSA-SHA 256') sign. write('Hello world!') sign. end() let digital_signature = sign(PRIVATE_KEY, 'hex') verify. write('Hello world!') verify. end() let is_signature_ok = verify(PUBLIC_KEY, digital_signature, 'hex') debug('Signature: ', digital_signature) debug('Verification: ', is_signature_ok) Plaintext : Hello world! Signature : 5455 b 9 dbfcac 61 a 8 b 63 dc 7 e 994 e 7 c 12 ec 45 a 0 d 0 e 7 b 8 e 58 a 94 d 2 a 098428 d 06 c 9 aca 89198 ba 75 d 24 e 81298 ce a 209 c 0 aafa 696260 a 4108625419 aa 4 b 739 d 9485 f 97 be 87 b 51 d 93 a 10 e 0 d 8 e 64529 c 5641672 a 4 ddb 58 ec 5 c 4 c 51 b 7 db 7 aa 861 f 0857 d 62 fdacc 7 ca 05 d 450 a 5 b 5 f 5 c 4717 f 5 e 48491413 cc 30 b 7856 bd 1598645 c 717 c 81 bf 6 c 8 3 a 26 f 784 e 3132 f 648 e 31 e 43 f 44 ad 1344 f 92 d 1 fc 7 eac 3 c 80 fc 659 fb 158 ad 4 e 17 e 3 b 817 af 3 f 4 b 17 d 16 d 6 be 5 a 896 a 75 d 2 bd 698 a 7 a 8 ed 03 bb 5 b 13482 a 7 b 8 aae 8804 cc 8 ed 4 ed 33 c 16 cac 260493 f 2920 bc 77 b 2 aa 21 ed 9 e 3 a 4 e 4 fc 747825 db 4260 b 9 da 34 a 6 c 322 f 905 c 9 cc 036367 c 140 c 3 f 86 ff 5 e 4028 c 39589 d 2 fc 137228 ed 3 e 7 (2048 bit) Verification : true : : 9: :

Public-Key Cryptosystems o A želi zaštititi integritet poruke i pošiljatelja (autentikacija) o Primjer RSA let sign = crypto. create. Sign('RSA-SHA 256') let verify = crypto. create. Verify('RSA-SHA 256') sign. write('Hello world!') sign. end() let digital_signature = sign(PRIVATE_KEY, 'hex') verify. write('hello world!') verify. end() let is_signature_ok = verify(PUBLIC_KEY, digital_signature, 'hex') debug('Signature: ', digital_signature) debug('Verification: ', is_signature_ok) Plaintext : Hello world! Signature : 5455 b 9 dbfcac 61 a 8 b 63 dc 7 e 994 e 7 c 12 ec 45 a 0 d 0 e 7 b 8 e 58 a 94 d 2 a 098428 d 06 c 9 aca 89198 ba 75 d 24 e 81298 ce a 209 c 0 aafa 696260 a 4108625419 aa 4 b 739 d 9485 f 97 be 87 b 51 d 93 a 10 e 0 d 8 e 64529 c 5641672 a 4 ddb 58 ec 5 c 4 c 51 b 7 db 7 aa 861 f 0857 d 62 fdacc 7 ca 05 d 450 a 5 b 5 f 5 c 4717 f 5 e 48491413 cc 30 b 7856 bd 1598645 c 717 c 81 bf 6 c 8 3 a 26 f 784 e 3132 f 648 e 31 e 43 f 44 ad 1344 f 92 d 1 fc 7 eac 3 c 80 fc 659 fb 158 ad 4 e 17 e 3 b 817 af 3 f 4 b 17 d 16 d 6 be 5 a 896 a 75 d 2 bd 698 a 7 a 8 ed 03 bb 5 b 13482 a 7 b 8 aae 8804 cc 8 ed 4 ed 33 c 16 cac 260493 f 2920 bc 77 b 2 aa 21 ed 9 e 3 a 4 e 4 fc 747825 db 4260 b 9 da 34 a 6 c 322 f 905 c 9 cc 036367 c 140 c 3 f 86 ff 5 e 4028 c 39589 d 2 fc 137228 ed 3 e 7 (2048 bit) Verification : false : : 10: :

Public-Key Cryptosystems m Encryption PRA Source A o (m, c) Message Channel Decryption Key Channel Key Generation m’ PUA Destination B Svojstva enkripcije privatnim kljucem o Source integrity - samo A zna PRA, stoga je samo A mogla pripremiti poruku m o Data integrity - bez PRA nemoguće promjeniti m (A će detektirati promjenu) o Digital signature - ciphertext c služi kao digitalni potpis Ova svojstva prvi puta opisana u radu: “New Directions in Cryptography. ” W. Diffie and M. Hellman, IEEE Transactions on Information Theory, 1976 : : 11: :

Public-Key Cryptosystems m Encryption PRA c Encryption PUB c’ Decryption c Decryption PRB m PUA Key Generation o Source A Destination B A želi poslati autentičnu i tajnu poruku m entitetu B o A enkriptira m kako slijedi: c = E(PRA, m), c’ = E(PUB, E(PRA, m)) o B dekriptira poruku c’: c = D (PRB, c’), m = D (PUA, c) o Primjetite da koristimo 4 ključa (2 para asimetričnih ključeva) : : 12: :

Klasifikacija public-key kriptosustava o o o Enkripcija/dekripcija (zaštita povjerljivosti) o Pošiljalac enkriptira poruku koristeći javni ključ primaoca o U praksi se koriste tzv. digitalne omotnice (digital envelope) Digitalni potpis (zaštita integriteta) o Pošiljalac “potpisuje” poruku koristeći svoj privatni ključ o U praksi se poruka ne potpisuje izravno već njena hash vrijednost Razmjena kljuceva (key exchange) o Dva entiteta (korisnika, računala) žele uspostaviti sesijski (tajni) ključ za upotrebu u simetričnom kriptosustavu o Najpoznatiji protokol iz ove kategorije: Diffie-Hellman Key Exchange Protocol o Diffie-Hellman osigurava perfect forward secrecy svojstvo (npr. u TLS/https, SSH, . . . ) : : 13: :

Kriptografija asimetri č nog (javnog) ključ a RSA (Rivest, Shamir and Adleman)

RSA u praksi: raspored. fesb. hr

Modularna aritmetika: zbrajanje o o Primjer: zbrajanje modulo 10 (a + b mod 10) + 0 1 2 3 4 5 6 7 8 9 0 0 1 2 3 4 5 6 7 8 9 1 1 2 3 4 5 6 7 8 9 0 2 2 3 4 5 6 7 8 9 0 1 3 3 4 5 6 7 8 9 0 1 2 4 4 5 6 7 8 9 0 1 2 3 5 5 6 7 8 9 0 1 2 3 4 6 6 7 8 9 0 1 2 3 4 5 7 7 8 9 0 1 2 3 4 5 6 8 8 9 0 1 2 3 4 5 6 7 9 9 0 1 2 3 4 5 6 7 8 Q: Zbrajanje modulo 10 s tajnom konstantom k daje sifru. Koju? : : 16: :

Modularna aritmetika: množenje o o Primjer: mnozenje modulo 10 (a x b mod 10) x 0 1 2 3 4 5 6 7 8 9 0 0 0 1 2 3 4 5 6 7 8 9 2 0 2 4 6 8 3 0 3 6 9 2 5 8 1 4 7 4 0 4 8 2 6 5 0 5 0 5 0 5 6 0 6 2 8 4 7 0 7 4 1 8 5 2 9 6 3 8 0 8 6 4 2 9 0 9 8 7 6 5 4 3 2 1 Q: Samo množenje s 1, 3, 7 ili 9 može raditi kao šifra. Zasto? : : 17: :

Modularna aritmetika: množenje o Primjer: m = 3, k = 7 o Enkripcija: o Dekripcija: o Multiplikativni inverzni broja a (multiplicative inverse) po modulu n (pisano a-1) je broj b za koji vrijedi: o U našem primjeru (prethodna tablica) samo brojevi 1, 3, 7 i 9 imaju odgovarajuće multiplikativne inverzne brojeve modulo 10 o Q: Nadjite 9 -1 i 1 -1 modulo 10. : : 18: :

Modularna aritmetika: množenje o U našem primjeru (prethodna tablica) samo brojevi 1, 3, 7 i 9 imaju multiplikativne inverzne brojeve modulo 10 o o Q: Nadjite 9 -1 i 1 -1 modulo 10. Računanje inverznih brojeva po modulu n primjenom brute-force metode nije praktično za veliki n (npr. n 600 -znamenkasti broj) o Prošireni Euklidov algoritam vrlo efikasan za određivanje inverza po modulu o Euklidov algoritam razvijen za racunanje najveceg zajednickog djelitelja (gcd) def xgcd(b, a): x 0, x 1, y 0, y 1 = 1, 0, while a != 0: q, b, a = b // a, x 0, x 1 = x 1, x 0 y 0, y 1 = y 1, y 0 return (b, x 0, y 0) def mulinv(b, n): g, x, _ = xgcd(b, n) if g == 1: return x % n 0, 1 a, b % a q * x 1 q * y 1 >>> mulinv(1, 10) 1 >>> 1 * 1 % 10 = 1 >>> mulinv(3, 10) 7 >>> 3 * 7 % 10 = 1 >>> mulinv(7, 10) 3 >>> 7 * 3 % 10 = 1 >>> mulinv(9, 10) 9 >>> 9 * 9 % 10 = 1 : : 19: :

Modularna aritmetika: množenje o : : 20: :

Modularna aritmetika: potenciranje o o Primjer: potenciranje po modulu 10 ( ab mod 10 ) ab 0 1 2 3 4 5 6 7 8 9 10 11 12 0 - 0 0 0 1 1 1 1 2 1 2 4 8 6 3 1 3 9 7 1 4 6 4 6 5 1 5 5 5 6 1 6 6 6 7 1 7 9 3 1 8 4 2 6 9 1 9 1 Eksponent b=3 moze se koristiti za enkripciju, ali b=2 ne moze. Q: Zasto? : : 21: :

Modularna aritmetika: potenciranje o : : 22: :

Modularna aritmetika: potenciranje o : : 23: :

RSA algoritam o Ron Rivest, Adi Shamir i Len Adlemam. MIT, 1977. o RSA je blok sifra gdje su plaintext i ciphertext cijeli brojevi iz {1, . . . , n-1} o Tipicna velicina za n je 2048 bita (> 600 dekatskih znamenki) Generiranje kljuceva Odaberi brojeve p i q ( p q ) p i q su prosti i razliciti (p q) Izracunaj n = pq Izracunaj Φ(n) = (p-1)(q-1) Odaberi cijeli broj e e i Φ(n) su relativno prosti; 1 < e < Φ(n) ed 1 (mod Φ(n)), d je multiplikativan inverz od e Izracunaj d Javni kljuc (public key) PU = {e, n} Privatni kljuc (private key) PR = {d, n} Enkripcija Plaintext: Ciphertext: Dekripcija M<n C Me (mod n) Ciphertext: Plaintext: C M Cd (mod n) : : 24: :

Ispravnost RSA algoritma o M < n, javni kljuc PU = {e, n}, privatni kljuc PR = {d, n} o Enkripcija: C Me (mod n) o Dekripcija: Cd (Me)d Med mod Φ(n) M 1 mod Φ(n) M (mod n) : : 25: :

Textbook RSA-based digital signature o Digitalan potpis o M < n, javni kljuc PU = {e, n}, privatni kljuc PR = {d, n} o Entitet A potpiše M svojim privatnim kljucem PR={d, n}: Σ Md (mod n) o Entitet B prima (M, Σ) te provjerava je li zadovoljeno: M Σe (mod n)? o Ciphertext Σ predstavlja digitalni potpis poruke M o Entitet B koristi javni kljuc PU={e, n} entiteta A za provjeru potpisa Σ : : 26: :

RSA: Toy Example 1. p = 17 i q = 11 2. n = p ∙ q = 17 ∙ 11 = 187 3. Φ(n) = Φ(187) = (p - 1) ∙ (q - 1) = 16 ∙ 10 = 160 4. Odaberi e < Φ(n), tako da je gcd(e, Φ(n)) = 1: e = 7 5. Odredi d < 160, tako da vrijedi e ∙ d 1 (mod Φ(n)): d = 23 6. PU = {7, 187} i PR = {23, 187} Encryption plaintext 88 887 mod 187 PU = {e, n} ciphertext 11 Decryption 1123 mod 187 plaintext 88 PR = {d, n} : : 27: :

Sigurnost RSA algoritma o Ako napadac moze rastaviti n na proste faktore p i q o Moze izracunati Φ(n) = (p-1)(q-1), te naci privatni kljuc d o Poznavajci Φ(n) i javni kljuc e, napadac moze odrediti privatni kljuc d e-1 (mod Φ(n)) primjenom Euklidovog algoritma o Postojeci algoritmi za faktorizaciju ne mogu napraviti faktorizaciju u polinomnom vremenu ako je n velik o o Jako tezak problem za npr. 2048 -bitni n Slično, ako napadač zna Φ(n) i n može napraviti sljedeće o n - Φ(n) = p + q o q = n/p o Then, p + n/p – (n - Φ(n)) = 0 and p 2 – (n - Φ(n)) ∙ p + n = 0 : : 28: :

Sigurnost RSA algoritma o RSA šifra (u izvornom obliku) je deterministicka funkcija o Isti plaintext daje isti ciphertext (za fiksan javni kljuc) o Plaintext vrijednosti 0 i 1 daju identicne ciphertext vrijednosti (0 i 1) o Plaintext male entropije (visoki stupanj predvidivosti) podlozan bruteforce napadu (Q. Opišite takav napad) : : 29: :

Sigurnost RSA algoritma o RSA enkripcija u izvornom obliku zadovoljava sljedeću jednakost EPu(M 1) x EPu(M 2) = EPu(M 1 x M 2) o o Primjer: Pu = {7, 187}, Pr = {23, 187}, M=88, M 1=8 i M 2=11 o EPu(M) = 11, EPu(M 1) = 134 i EPu(M 2) = 88 o EPu(M 1) x EPu(M 2) = 134 x 88 11 (mod 187) = EPu(M) Moguć napad: napadač ne zna {d} a zeli dekriptirati C Me (mod n) 1. Napadač izračuna: X (C x 2 e) (mod n) 2. Traži od žrtve da digitalno potpiše poruku X 3. Žrtva potpisuje X i vraća napadaču potpis Σx Xd (mod n) 4. Napadač prima potpis Σx i računa: M = ½Σx ½ (C x 2 e)d ½ (Me x 2 e)d ½ (2 M)ed M (mod m) : : 30: :

RSA enkripcija u praksi o RSA šifra (u izvornom obliku) deterministicka je funkcija o o Mnogi sigurnosni problemi U praksi se zbog navedenih problema plaintextu dodaje slučajna vrijednost prije enkripcije (eng. random padding) : : 31: :

RSA enkripcija u praksi o Public Key Cryptography Standard #1 (PKCS #1) o o o Definira nacin enkodiranja poruka koje ce biti potpisane odnosno enkriptirane upotrebom RSA algoritma Enkodiranje poruka za RSA enkripciju o PKCS 1 -v 1_5 (nesigurno, ali često u uporabi) o Optimal Asymmetric Encryption Padding (OAEP) (sigurno, koristite u praksi) Enkodiranje poruka za RSA potpisivanje o PKCS 1 -v 1_5 (sigurno ali vidi u nastavku) o Probabilistic Signature Scheme (PSS) (sigurno, koristite u praksi) : : 32: :

RSA enkripcija u praksi o Enkodiranje poruka za RSA enkripciju o PKCS 1 -v 1_5: Encoded Message = 0 x 00 || 0 x 02 || PS || 0 x 00 || M plaintext = 'abcd. ABCD 0000' let key = {key: PUBLIC_KEY, padding: crypto. constants. RSA_PKCS 1_PADDING} ciphertext = crypto. public. Encrypt(key, Buffer. from(plaintext)) key = {key: PRIVATE_KEY, padding: crypto. constants. RSA_NO_PADDING} decrypted_plaintext = crypto. private. Decrypt(key, ciphertext) Plaintext : abcd. ABCD 0000 Ciphertext: 1 a 8 a 9 c 8263 e 342727967 b 7 b 742516 ab 545522 bfb 865 ff 8 bbb 4808 ddd 7 a 24 b 6178 f 150 aeb 42 a 9 b 8 a 47 f 73 b 7 f 25747 f 5 e 3023 c 426 bd 4 b 1595 c 2 ca 3 fa 9940 a 74061 bf 1 e 093 b 5328 ab 2 a 6 b 6 cf 7 da 2 e 7602 c 6 c 990 c 3706078 3 d 44 e 0274 b 5 fcc 1 a 1 e 83181 f 4893 b 96015955 c 526 b 56 cce 15 bbd 05 e 1 d 459 d 0 bd 9 e 1 fbfd 0 e 6 af 51428 a 5211 bf 6 dd 0 f 26 cadbfbde 0 a 3 f 1 f 6 a 4 b 54905 e 854 b 893 e 19 f 38 ae 40214338 a 9078 d 42 d 369506 f 9460684 a 038547 dea 4 e 475 eceb 95 c 5887 ee 54 b 56 b 5 f 81 da 37681 afb 4 f 7070206 ee 6664 dabb 09 eb 8 a 1 b 122 ad 1557 b 0 af 1668 e eb 00 cbab 72 e 9 db 6 da 822419059 cb 90 d 95 a 28948 e 9 d 64 e 7 b 564 c 7 b 29 ac 862547 e 7 ad 144 c 01 f 5485 b 523 Decrypted: 0002 c 1 c 9395 dc 67385 c 8 ffab 541171 a 9 df 57 a 519 fdee 0 c 6 f 35 d 97 eb 225993 c 9 f 4 ea 83 ea 8 ea 4 c 867591 bb 9 f 91 ddc 83 c 156 d 73 f 6 d 2926 a 8 b 464 d 6178 f 02237 cdf 2711 c 6 a 61 ff 2 be 38195 c 1 f 23278747 adb 2 abcb 70 b 7276 520 c 3 ee 7 c 162 e 54 e 4 df 0 d 1 be 026966 dc 9 b 7 db 63808431 dee 466 daf 42 baf 389 f 7 ea 33 fb 3 b 5 ae 59 ed 3 d 3 e 344 92 a 4719 fe 2 ea 28 c 174 e 026 a 5331 b 5 abe 76 a 3062 a 3 dfe 0881 fd 480 b 475 bf 00 cce 0 e 027 b 8 defece 021 ad 7 b 18 b 4 b 519 a 6017545 cc 1 c 2 e 1 a 27 c 8187 a 9 afc 37 bf 1 e 84 cc 1034 a 35102776560651166 e 63 a 3315 cdbb 1 de 68 c 9 f 6 c 269 ee 2489 f 823 f 0 c 5147270 ee 42 cf 2 a 7997 ea 5 c 78985 d 1 eb 0 b 6475 0061626364414243443030 : : 33: :

RSA enkripcija u praksi o Probabilistička RSA enkripcija: ista poruka više puta plaintext = 'abcd. ABCD 0000' let key = {key: PUBLIC_KEY, padding: crypto. constants. RSA_PKCS 1_PADDING} ciphertext 1 = crypto. public. Encrypt(key, Buffer. from(plaintext)) ciphertext 2 = crypto. public. Encrypt(key, Buffer. from(plaintext)) ciphertext 3 = crypto. public. Encrypt(key, Buffer. from(plaintext )) Ciphertext 1: 1 a 8 a 9 c 8263 e 342727967 b 7 b 742516 ab 545522 bfb 865 ff 8 bbb 4808 ddd 7 a 24 b 6178 f 150 aeb 42 a 9 b 8 a 47 f 73 b 7 f 25747 f 5 e 3023 c 426 bd 4 b 1595 c 2 ca 3 fa 9940 a 74061 bf 1 e 093 b 5328 ab 2 a 6 b 6 cf 7 da 2 e 7602 c 6 c 990 c 370607 83 d 44 e 0274 b 5 fcc 1 a 1 e 83181 f 4893 b 96015955 c 526 b 56 cce 15 bbd 05 e 1 d 459 d 0 bd 9 e 1 fbfd 0 e 6 af 51428 a 521 1 bf 6 dd 0 f 26 cadbfbde 0 a 3 f 1 f 6 a 4 b 54905 e 854 b 893 e 19 f 38 ae 40214338 a 9078 d 42 d 369506 f 9460684 a 03854 7 dea 4 e 475 eceb 95 c 5887 ee 54 b 56 b 5 f 81 da 37681 afb 4 f 7070206 ee 6664 dabb 09 eb 8 a 1 b 122 ad 1557 b 0 af 1668 eeb 00 cbab 72 e 9 db 6 da 822419059 cb 90 d 95 a 28948 e 9 d 64 e 7 b 564 c 7 b 29 ac 862547 e 7 ad 144 c 01 f 5485 b 523 Ciphertext 2: 9 b 692 f 169 a 2 f 990 babedd 5 d 5 de 92 d 7 c 902 bd 762 b 12275 f 967 dc 347 a 43 ee 89 dc 9 e 019 d 7 cb 22 c 57 bf 81 c 6 a 8 3 bb 257 be 275 b 6081134 bc 1 f 836 a 933 dff 1 b 72 d 9 e 31 bc 27 f 6 f 4 e 79335 ebfe 24 f 23 aa 2 ce 4 a 4 dd 1 aaff 5 c 224 f c 83600 b 1 f 5 c 168 b 4 beb 2 d 41 bc 26 eeada 1 add 74 bf 57351190 ee 0351 fef 8 ed 04602 e 0 d 8 dc 4 f 4042 cbf 1 d 2969 06 a 3 cd 20902 df 53 e 7 cca 2 d 549 f 5 c 4 dc 06 f 5 eadb 22 fc 0091 e 38 e 8 eafd 6 c 898 eeeb 85 bac 5 ede 68 ef 1 cfe 6 e 87 6077831676 f 55746 fa 045658 f 359 aff 41145 e 0 b 91 bdba 8 d 19 bf 4 f 6 a 664 c 8 c 65400716495 e 24 ec 9 e 7 ef 7148 8 ec 1 dc 0 c 4 e 6 ef 2092 e 73 fecac 8 e 78386 b 1 e 62 c 1032 ac 0 a 913691 aee 9 e 4 d 556 ed 61383 a 973 a 32 f 30 dd 01 Ciphertext 3: 08 e 6 b 9 d 4 cab 011 c 6 d 01 ae 35 c 25 c 546 e 211 e 24 f 459 c 4 e 9 c 762 aaad 36 d 5 e 40089 a 2 b 385 f 9 cb 71 dfaed 4 f 90 a ef 785 ae 7 ff 3 b 7 cd 5 bfb 14 fb 338 d 946 db 74126 d 66 cf 3 e 0343 df 11 cd 8 bb 6 dfd 16771 a 8 ce 1 cfac 20773523 d 6 c 6 c 32366 fe 7928 bff 0 bbdb 19 d 1042 e 5 dcf 18 fa 91 c 64 deb 5523 dec 91445920 eb 347 d 4 b 9 e 3 a 7818 ff 1 a 08 e 348 932 c 524 d 5 e 8 c 68 d 230 d 4677380 e 262 c 1 dbadec 8 c 2 f 86 f 5 e 27 f 10 c 021281 ceb 48 de 518 b 7212 e 068 b 107 e 5 ec 0 aa 64 dc 5 a 5 ee 04 a 287 e 6 dda 88072 e 0032 a 8 a 2 b 298 bbac 37 d 1 d 6017 c 8 c 895 fa 95 a 6563 cff 7 e 0 c 44 da 10388 e f 15 eef 4 b 7160 c 37 c 16 cf 0 ebc 34 e 329717 de 5528 fd 93 c 00 f 332 b 704 aef 36 e 61142 c 37455 d 207 e 86647 b 1 : : 34: :

RSA enkripcija u praksi o Public Key Cryptography Standard #1 (PKCS #1) o Definira nacin enkodiranja poruka koje ce biti potpisivane ili enkriptirane upotrebom RSA algoritma o OAEP enkodiranje prema PKCS #1 v 2. 2 standardu: hashed some 0 x 00 label bytes 0 x 01 message to be encrypted random seed MGF + 0 x 00 masked seed + MGF – Mask Generating Function (a hash function, e. g. , SHA-1) MGF masked message : : 35: :

RSA enkripcija u praksi o Enkodiranje poruka za RSA enkripciju o Primjer OAEP (default encoding in Nodejs crypto module) plaintext = 'abcd. ABCD 0000' let key = {key: PUBLIC_KEY, padding: crypto. constants. RSA_PKCS 1_OAEP_PADDING} ciphertext = crypto. public. Encrypt(key, Buffer. from(plaintext)) key = {key: PRIVATE_KEY, padding: crypto. constants. RSA_NO_PADDING} decrypted_plaintext = crypto. private. Decrypt(key, ciphertext) Plaintext : abcd. ABCD 0000 Ciphertext: 62 d 6146 d 4 ba 7 daa 7 d 8 b 1 f 778 af 237 c 6 f 24244 bc 89 ff 6 f 612 dadaefc 755 ab 0608 cb 448 b 5 d 963 f 2581 d 41 bde 6 fd 60 f 6 f 6 cd 68 b 4 cf 8 aa 813 f 1656 a 5 a 4 d 8 fe 8686 b 9 c 171 e 9147 a 85836953 cb 13 ac 49 a 82 a 4 ef 550 b 9 b 65 a 4 f 55 df 45 e 4 ba 43466 a 8 a 1 e 8567 fe 0 a 89 cac 48362 f 79 e 7 ad 4 b 856 b 5 dcd 45 d 6321029 e 67 b 054 c 78 a 9 ac 1 b 7 a 9 e 6 d 2872 ca 331567 e 03 ad 15 fd 3 aa 4746 ffc 4 f 27 e 150784 c 6 c 170 c 5 f 854 d 53 b 041 f 1 fdc 73 d 622 cbf 89976 cace 0 0 ea 8 a 9090 d 3205 fb 4 bec 70 d 1 fa 8119277 afdfa 236 e 59 f 16 a 4011792 b 3 fb 424 c 704 f 2 cc 58 ff 68 d 0674 b 044 c 1 f 92 fa 3 b 630 df 13 ddd 5316 f 92 cfbbad 03 c 755 efae 1 faaa 1377 f 5 b 3375 dea 1 e 95 aee 2 d 6 f 089 a 938 ee 6 f Decrypted: 00 f 5 a 88 c 4 fbbbacbc 6 ac 9 eb 884 e 85773 c 3658 f 02 e 101289 d 237 b 61 b 4 f 63 db 1 bb 8 e 349504263 ea 942 e 8 efaf 30 d 14973 ff 91 ac 329 b 41 deb 5 ec 28 f 532907 ce 4 d 67570 d 34 d 0092 c 8 bc 9 e 722 b 83 f 0 ba 5 f 22 e 0 c 8 aa 279 b 8525 beda 92525529 d 7 d 8 a 87 c 526 f 8358519 f 681 a 33 e 298 d 5 d 94 aee 2546 d 7 c 93 a 6 bd 6 a 332 c 59747 b 3 fdfd 1 ade 22 7 ad 7 c 6 b 4 bc 539 a 3 e 2819211 f 54091708825 b 84 b 6 ddae 4 f 59 ec 72 cab 3087 f 1074809 f 2 c 6621318891 f 5 cba 5 fe 73269 fe 4 f 625219 c 3928977 d 458385 de 9 f 88 f 90 db 3 da 0 aa 5 a 9 c 7 b 61 d 9538 d 44800 da 879 dc 5661897 ad 1 e e 35 b 494 b 9 b 095 b 72 dd 3 fc 2 ac 1 ea 71 fb 10 ae 4 a 3 a 9151 cdf 1 d 4 e 5907321715 b 8249 e 47 ef 773922 e 6 a 0 ae : : 36: :

Encrypt ing and Decrypting Efficiently o RSA relies on modular exponentiations for encryption and decryption Decryption Ciphertext: Plaintext: o o C M Cd (mod n) Straightforward approach o Multiply C by itself d times o For k-bit integers C, d and n, the number of multiplications ~2 k o It we don’t “reduce mod n”, memory requirements ~2 k o For security reasons, n must be large (e. g. , k=2048 bits long) o Clearly, this approach does not work (or is inefficient) Efficient approach utilizes the square and multiply algorithm : : 37: :

RSA with Square and Multiply Decryption Ciphertext: Plaintext: C 20 = (C 10)2 C M Cd (mod n) C 25 = C 24 x C = ((C 5)2)2 = (C 12)2 x C = (((C 4 x C)2)2 = ((C 6)2)2 x C = (((C 2)2 x C))2)2 = (((C 3)2)2)2 x C (only 5 multiplications vs. 19) 2010 = 101002 (1, 100, 1010, 10100) (1, 2, 4, 5, 10, 20) = (((C 2 x C)2)2)2 x C (only 6 multiplications vs. 24) 2510 = 110012 (1, 10, 110, 11000, 11001) (1, 2, 3, 6, 12, 24, 25) : : 38: :

RSA with Square and Multiply Decryption Ciphertext: Plaintext: C M Cd (mod n) RSA k-bits decryption key: d = d 1, …, dk M=1 for i = 1 to k M M x M (mod n) if di == 1 M M x C (mod n) return M (square and reduce mod n) (multiply and reduce mod n) o Complexity: at most 2 • log 2 d = 2 • k multiplications and divisions o Important: the decryption execution time depends on the key : : 39: :

Simple Timing Attack on RSA o o Timing attacks o Measure the time of the decryption execution o The measured time corresponds to the number of 1 s in the key o In other words, time leaks the Hamming weight (w) of the key Simple attack o Key search complexity is reduced from 2 k to o In other words, from all possible k-bit combinations to those with w bits equal to 1 o The best case for the attacker: w=1, the search space only k keys o The worst case for the attacker: w=k/2 : : 40: :

Simple Power Analysis o (Kocher 1998) Attacker directly uses power consumption to learn bits of secret key o Many implementations of modern cryptosystems (DES, AES, RSA) vulnerable to timing and power analysis attacks o Side-channel attacks : : 41: :

Experiment: SPA on Exponentiation o Attack on the square and multiply exponentiation algorithm during signing or decryption o Record a power trace of the operation o Visually confirm if multiplications were executed in each step : : 42: :

Experiment: SPA on exponentiation o If a squaring is followed by another squaring, this bit of the exponent is zero o If the squaring is followed by a multiplication, this bit of the exponent is one : : 43: :

Experiment: SPA on exponentiation o If a squaring is followed by another squaring, this bit of the exponent is zero o If the squaring is followed by a multiplication, this bit of the exponent is one : : 44: :

RSA timing attacks over the network o “Remote timing attacks are practical”, by D. Boneh and D. Brumley, Usenix Security Symposium, 2003 http: //crypto. stanford. edu/~dabo/papers/ssl-timing. pdf o The attack was performed over the campus network o The attacks extracts the bits of the prime factor q (n=pq) o Time measurement indicates if a bit of q is 1 or 0 measure time Attacker c RSAK(c) Server : : 45: :

Kriptografija asimetri č nog (javnog) ključ a Diffie-Hellman kriptografski sustav

Diffie-Hellman: uvod o o o Prvi algoritam zasnovan na javnom ključu objavili su Diffie i Hellman 1976. godine (u javnoj domeni) o “New Directions in Cryptography. ” W. Diffie and M. Hellman, IEEE Transactions on Information Theory, 1976 o Ovaj rad prvi je uveo pojam asimetrične kriptografije Diffie-Hellman (DH) algoritam omogućuje “sigurnu” uspostavu simetričnog ključa između dva korisnika preko javnog kanala o Diffie-Hellman Key Exchange (Agreement) Protocol o Postoje eksenzije za uspostavu simetričnih ključeva između više od dva entiteta tzv. Group Key Agreement DH algoritam zasniva se na problemu određivanja (računanja) diskretnog logaritma (discrete logarithm problem) : : 47: :

Discrete Logarithm Problem for Zp* oznacava (za dani prosti broj p) konacnu multiplikativnu grupu velicine |Zp*| = p-1 (i. e. , Zp* = {1, 2, . . . , p-1} ) o Broj g Zp*, cije potencije “mod p” generiraju sve cijele brojeve grupe Zp* nazivamo primitivan element ili generator grupe Zp* o Za generator grupe Zp* vrijedi: 1. (gi mod p) Zp*, (i = 1, 2, . . . , p-1) 2. (gi mod p) (gj mod p), za i j o Primjer: p = 7, g = 3 generira grupu Z 7* o Z 7* = { 31 3, 32 2, 33 6, 34 4, 35 5, 36 1 } : : 48: :

Discrete Logarithm Problem for Zp* o Za danu grupu Zp*, generator te grupe g Zp* i drugi član/element y Zp*, discrete logarithm problem (DLP) je problem odredjivanja cijelog broja x Zp* takovog da vrijedi: y gx (mod p) o Racunanje diskretnih logaritama vrlo je težak problem za veliki i siguran p (e. g. , https: //tools. ietf. org/html/rfc 3526) o Za razliku od potenciranja (za koje postoje efikasni algoritmi) o Diffie-Hellman algoritam koristi ovu činjenicu : : 49: :

Diffie-Hellman algoritam u Zp* Dijeljeni javni elementi p prosti broj (siguran) g Korisnik A generira kljuceve Odaberi privatan kljuc XA Izracunaj javni kljuc YA Korisnik B generira kljuceve Odaberi privatan kljuc XB Izracunaj javni kljuc YB Korisnik A generira tajni (simetricni) kljuc Korisnik B generira tajni (simetricni) kljuc : : 50: :

Ispravnost Diffie-Hellman algoritma o KAB (YB) XA (g XB mod p) XA (g XB) XA g XBXA (mod p) KBA (YA) XB (g XA mod p) XB (g XA) XB g XAXB (mod p) : : 51: :

Diffie-Hellman: Toy Example 1. p = 353, g = 3 2. A izabere privatan (tajan) kljuc XA = 97 3. B izabere privatan (tajan) kljuc XB = 233 4. A racuna javan kljuc YA = 397 mod 353 = 40 5. B racuna javan kljuc YB = 3233 mod 353 = 248 6. A racuna zajednicki tajni kljuc K = 24897 mod 353 = 160 7. B racuna zajednicki tajni kljuc K = 40233 mod 353 = 160 o Sigurnosni aspekti: o o Potencijalan napadac poznaje p = 353, g = 3, YA = 40, te YB = 248 Traži npr. rjesenje jednadzbe 3 a mod 353 = 40 o Provjerava vrijedi li 3 a mod 353 = 40 za a = 1, 2, . . . o Za velike brojeve XA, XB i p (npr. , 2048 -bitni), napad je nepraktičan : : 52: :

DH: Some practical pointers o A prime p is safe if p = 2 q + 1 and q is prime o o In other words, both p and (p-1)/2 must be primes RFC 3526: More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key (IKE) o Eg. , 3072 -bit MODP Group Prime: p = 2^3072 - 2^3008 - 1 + 2^64 * { [2^2942 pi] + 1690314 } (FFFFFFFF C 90 FDAA 2 2168 C 234 C 4 C 6628 B 80 DC 1 CD 1. . . B 5 BFC E 0 FD 108 E 4 B 82 D 120 A 93 AD 2 CA FFFFFFFF) Group generator: g = 2 o RFC 3526 groups supported by Node. js crypto module o crypto. get. Diffie. Hellman('modp 15') // 3072 -bit MODP Group o o crypto. create. Diffie. Hellman(prime_length[, generator]) crypto. create. ECDH(curve_name) // Elliptic Curve Diffie-Hellman : : 53: :

Diffie-Hellman Key Exchange Protocol Alice Bob odaberi slucajan XA izracunaj g. XA mod p g. XB mod p K = (g XB)XA mod p odaberi slucajan XB izracunaj g. XB mod p K = (g XA)XB mod p o Protokol nije autenticiran -> Man-In-The-Middle (MITM) napad o Q: Opisite MITM napad na DH protokol : : 54: :

Diffie-Hellman protokol: MITM napad 1. Mallory za napad pripremi dva privatna kljuca XBM i XAM te izracuna odgovarajuce DH javne kljuceve YBM i YAM 2. Alice transmitira YA Bobu 3. Mallory zamjeni YA s YAM. Mallory izracuna KAM = (YA) XBM = g XA XBM 4. Bob primi YAM te izracuna KBM = (YAM) XB = g XAM XB 5. Bob transmitira YB Alice 6. Mallory zamjeni YB s YBM. Mallory izracuna KBM = (YB) XAM = g XB XAM 7. Alice primi YBM te izracuna KAM = (YBM) XA = g XBM XA o Posljedice MITM napada: o Alice i Bob misle da dijele zajednicki kljuc, ali zapravo Alice i Mallory dijele kljuc KAM, dok Bob i Mallory dijele kljuc KBM o Sada Malice moze dekriptirati i modificirati sve poruke koje Alice i Bob salju jedno drugome (preko Mallory) : : 55: :

Diffie-Hellman protokol: MITM napad Alice Mallory Bob g. XA mod p g. XAM mod p g. XB mod p KAM = (g XBM)XA mod p KBM = (g XAM)XB mod p KAM = (g XA)XBM mod p KBM = (g XB)XAM mod p KAM KBM : : 56: :

The Station-to-Station Protocol o Rjesava problem neautenticiranog Diffie-Hellman protokola o Mutual entity authentication, mutual explicit key authentication Alice Bob odaberi slucajan XA izracunaj g. XA mod p odaberi slucajan XB izracunaj g. XB mod p K = (g. XA )XB mod p g. XB mod p, EK( EPR_B(g. XB, g. XA) ) K = (g. XB )XA mod p digitalni potpis EK( EPR_A(g. XB, g. XA) ) o Pretpostavka je da Alice i Bob posjeduju autenticirane javne kljuceve PUB odnosno PUA (npr. , RSA javni kljucevi) : : 57: :

Forward secrecy : : 58: :

RSA i Diffie-Hellman: primjene o SSL/TLS (https) o SSH, SFTP (secure remote access) o IPSec (Internet Key Exchange - IKE) o PGP (e-mail) o . . . : : 59: :