Based on Lucas functions, an improved version of the Diffie-Hellman distribution key scheme and to the ElGamal public key cryptosystem scheme are proposed, together with an implementation and computational cost. The security relies on the difficulty of factoring an RSA integer and on the difficulty of computing the discrete logarithm

El Fadil, L.

Universitat Autònoma de Barcelona. Centre de Recerca Matemàtica

Centre de Recerca Matemàtica

Diposit Digital de Documents de la UAB

A PUBLIC-KEY CRYPTOSYSTEM BASED ON SECONDORDER LINEAR SEQUENCESL. EL FADILAbstract. Based on Lucas functions, an improved version of theDiffie-Hellman distribution key scheme and to the ElGamal publickey cryptosystem scheme are proposed, together with an implemen-tation and computational cost. The security relies on the difficultyof factoring an RSA integer and on the difficulty of computing thediscrete logarithm.IntroductionIn [1], Diffie and Hellman introduced a practical solution to the key dis-tribution problem, allowing two parties, Alice and Bob never met, to sharea secret key by exchanging information over an open channel. In [2], ElGa-mal used Diffie-Hellman ideas to designe a cryptosystem whose security isbased on the difficulty of solving the discrete logarithm problem. In [3, 5, 6],It was suggested that linear sequences can be used instead of the standardRSA.In this paper, based on second order linear sequences (Lucas functions),an improved version of the Diffie-Hellman distribution key and to the El-Gamal public key cryptosystem method are proposed. This considerablyreduces the computation cost of these methods. The security relies on thedifficulty of factoring an RSA integer. In section 1, an investigation of thecryptographic properties of second order linear sequences, and a computa-tional method to evaluate the kth term of a second order linear sequence aregiven. In section 2, two cryptographic applications are given, their securityand computational cost are analysed.1. Second order linear sequencesIn this section, the main cryptographic properties of second order linearsequences are studied. A computational method to evaluate the kth termof a second order linear sequence are given, together with an analysis of itsKey words and phrases. Second order linear sequence (Lucas functions), Public-KeyCryptosystem.12 L. EL FADILcomputational cost.Let f(X) = X2 − aX + 1 be a polynomial in IF[X], where IF is a field.Denote A = IF[X]/(f(X)) and α = X¯ the class of X modulo the principalideal of IF[X] generated by f(X). For every x ∈ A, let lx be the linear mapof A defined by lx(y) = xy, T (x) = Tr(lx) and N(x) = det(lx) the trace andnorm of x, where det(lx) is the determinant of the linear map lx, and Tr(lx)is its trace. Define a sequence s(a) as follows : sk(a) = T (αk). Since f(α) =0 and the map trace is linear, it follows that sk+2(a) = ask+1(a) − sk(a).So, s(a) is a second order linear sequence, called the characteristic sequencegenerated by a.Remark. Let lk be the endomorphism of A defined by lk(x) = αkx, andMk its matrix with respect to the basis (1, α). Then M0 =(1 00 1),M1 =(0 −11 a), and then s0(a) = 2 and s1(a) = a.1.1. Cryptographic properties. The cryptographic applications of Lu-cas sequences are listed in [3, 4]. For the commodity of the reader, wepresent some of these results in a more accessible form and with simplifiedproofs.Lemma 1. 1. Let f(X) = X2 − aX + 1 be a polynomial in IF[X], α1 andα2 the roots of f(X) in a splitting field of f(X). Then for all integer k,sk(a) = αk1 + αk2 , and sk(a) = s−k(a).Proof. LetK be a splitting field of f(X). Since f(X) is the characteristicpolynomial of M1, and splits in K, there exists an invertible matrix P inM2(K) and x ∈ K such thatM1 = PTP−1, where T =(α1 x0 α2). Let kbe an integer. As Mk =Mk1 , then Mk = PTkP−1 and T k =(αk1 xk0 αk2),where xk ∈ K. Therefore, sk(a) = Tr(Mk) = αk1 + αk2 .Let k be an integer. Since α1α2 = 1, s−k(a) = α−k1 + α−k2 = αk2 + αk1 =sk(a).Corollary 1. 2. Let f(X) = X2− aX +1 be a polynomial in IF[X], α1 andα2 be the roots of f(X) in a splitting field of f(X). For every integer k, letfk(X) = X2 − sk(a)X + 1. Then fk(X) = (X − αk1)(X − αk2).Indeed, sk(a) = αk1 + αk2 and αk1αk2 = 1.A PUBLIC-KEY CRYPTOSYSTEM BASED ON SECOND ORDER LINEAR SEQ. 3Lemma 1. 3. Let f(X) = X2 − aX + 1 be a polynomial in IF[X], and s(a)be the characteristic sequence generated by a. Then for every integers k ande, se(sk(a)) = ske(a).Proof. From Corollary 1.2, the roots of the polynomial fk(X) are αk1and αk2 . So, se(sk(a)) = (αk1)e + (αk2)e = T (αke) = ske(a).Lemma 1. 4. Let f(X) = X2−aX+1 be a polynomial in IFp[X], and s(a)the characteristic sequence generated by a. Then pi = p2 − 1 is a period ofs(a).Proof. Since α is an element of A of norm 1, α is an invertible elementof A. Let 4 = a2− 4 be the disciminant of f(X). Denote (dp ) the Legendresymbol, where d is an integer such that p does not divide d. Then there arethree cases :(1) p divides (a2 − 4). Then a = ∓2 modulo p. If a = 2 modulo p,then for every k, sk(a) = 2. If a = −2 modulo p, then for every k,s2k(a) = 2 and s2k+1(a) = −2, and then 2 is the period of s(a).(2) If (a2−4p ) = 1, then f(X) splits in IFp, and α1 6= α2. Thus A ' IFp×IFp.Hence the exponent of the multiplicative group A∗ is p − 1. So,αp−1 = 1.(3) If (a2−4p ) = −1, then A ' IFp2 . Let σ be a primitive element of themultiplicative group IF∗p2 . Set α = σk. Then N(α) = σk(p+1) = 1.Therefore, p2 − 1 divides k(p + 1), i.e., p − 1 divides k, and thenthere exists an integer l such that α = σl(p−1). So, αp+1 = 1.Consequently, αpi = 1. Let k andm be two integers, sm+kpi(a)=T (αm+kpi) =T (αm(αpi)k) = T (αm) = sm(a). Hence pi is a period of the sequence s(a).Corollary 1. 5. Let f(X) = X2 − aX + 1 be a polynomial in IFp[X], ands(a) the characteristic sequence generated by a. Then for every integer esuch that gcd(e, pi) = 1, the mapLuce : IFp −→ IFpa −→ se(a) is a one-onecorrespondence.Indeed, since gcd(e, pi) = 1, let d be the inverse of e modulo pi. Thenthere exists an integer k such that de = 1+kpi. Hence sd(se(a)) = sde(a) =s1+kpi(a) = s1(a) = a.1.2. Computational Method and Cost.Lemma 1. 6. Let f(X) = X2 − aX + 1 be a polynomial in IFp[X], andsk(a) the characteristic sequence generated by a. Then4 L. EL FADIL{i) s2n(a) = sn(a)2 − 2,ii) s2n+1(a) = sn(a)sn+1(a)− aProof. Let n and m be two integers. sn(a)sm(a) = (αn1 +αn2 )(αm1 +αm2 )= (αn+m1 + αn+m2 ) + (αn−m1 + αn−m2 ) = sn+m(a) + sn−m(a).In particular, we have i) and ii).Let k = 2rm, where m is an odd integer. To compute sk(a), first wecompute sm(a), then s2m(a) = (sm(a))2 − 2, then s4m(a) = (s2m(a))2 −2,...,sk(a) = s2r−1m(a)2 − 2. Then to compute sk(a), we need r multipli-cations modulo p and we need sm(a). Let m =∑l−1i=0 ki2l−1−i. For every0 ≤ i < l − 1, let fi+1 = 2fi + ki+1 and f0 = k0. Then fl−1 = k. For0 ≤ i < l− 1 and assume that, sfi−1(a) and sfi−1+1(a) are computed. Thenif ki = 0, then{sfi(a) = s2fi−1(a) = (sfi−1(a))2 − 2sfi+1(a) = s2fi−1+1(a) = sfi−1(a)sfi−1+1(a)− aif ki = 1, then{sfi(a) = s2fi−1+1(a) = sfi−1(a)sfi−1+1(a)− asfi+1(a) = s2(fi−1+1)(a) = (sfi−1+1(a))2 − 2Computational Algorithm.In put k = 2r∑l−1i=0 ki2i and a, where k0 6= 0 and kl−1 6= 0.Out put sk.Algorithms0 = 2, s1 = a,for i from 0 to l − 1 doif ki = 0 then s1 = s1s0 − a, s0 = s20 − 2else then s0 = s1s0 − a, s1 = s21 − 2Endreturn (s0).s = s0, for i from 1 to r do s = s2 − 2.Endreturn (s).This method ensures that sk can be computed in about the same lengthof time as the kth power is computed in the RSA method. But in the com-putation of sm(a), having to compute two numbers at each stage does slowthe computation down a little, but there are optimizations in the calculationwhich mean that the total amount of computation is only about half morethan the amount needed for the RSA system. Therefore, to compute sk(a),the total number of multiplications modulo p is log2(k).A PUBLIC-KEY CRYPTOSYSTEM BASED ON SECOND ORDER LINEAR SEQ. 52. Main resultIn this section we describe some applications of Lucas functions, in moredetails : Diffie-Hellman distribution key method and the ElGamal encryp-tion scheme.Let n = pq be an RSA integer, f(X) = X2 − aX + 1 a polynomial inZZn = ZZ/nZZ, A = ZZn[X]/(f(X)) and α = X¯ the class of X modulo theprincipal ideal (f(X)). Let s(a) be the characteristic sequence generatedby a, defined in ZZn by : sk(a) = T (αk).Lemma 2. 7. Let pi = (p2 − 1)(p2 − 1). Then αpi = 1 modulo n. Inparticular, αpi = 1 is a period of s(a).Indeed, ααpi= (α(p2−1))(q2−1) = 1 modulo p and ααpi= (α(q2−1))(p2−1) =1 modulo q.2.1. Lucas Diffie-Hellman. Let a be an integer. Suppose that Alice andBob, who both have access to the Lucas function public key data (n, a),want to agree on a shared secret key KAB . recall that in [3], there is aDiffie-Hellman scheme based on lucas functions defined in IFq. Here, we givethe same version but with lucas functions on ZZn.(1) User Alice selects 0 < xA ≤ n as her private key. She then computesyA = sxA(a) as her public key from the system public key n andf(X) = X2 − aX + 1.(2) User Bob selects 0 < xB ≤ n as his private key. He then computesyB = sxB (a) as his public key from the system public key n andf(X) = X2 − aX + 1.(3) Key-Distribution Phase : KAB = sxA(yB) = sxB (yA) is their com-mon secret key.Remarks (1) KAB = sxAxB (a).(2) In each exchange session, the computational cost of each user is 2log2(n).(3) If an attacker tries to compute Alice’s private key x from her public keyy = sx(a), a polynomial fy(X) = X2 − yX + 1 is formed. According toLemma 1.2, αx1 and α−x1 are the roots of fy(X). As a result, once αx1 andα1 are known, solving the exponent x is equivalent to solving the discretlogarithm problem in ZZn. Since ZZn ' IFp × IFq, let α1 = (α11, α12), thenαx1 = (αx11, αx12). Consequently, solving the discret logarithm problem in ZZnis much harder than solving the discret logarithm problem in IFp, and thenthis method improves that presented in [3].2.2. Lucas ElGamal. We now explain our version of the public key sys-tem. It is based on ElGamal system, which is defined by Lucas functions.6 L. EL FADILSuppose Bob is the owner of the Lucas public key data (p, q, a). Bobselects a small integer e such that gcd(d, (p2 − 1)(q2 − 1)) = 1 and a secretinteger 0 < x ≤ n. Computes d the inverse of e modulo (p2− 1)(q2− 1) andy = sx(a), and makes public (e, y).Given Bob’s public data (n, a, e, y), Alice can encrypt a message m, where0 ≤ m < n, intended for Bob using the following Lucas version of theElGamal encryption scheme :Algorithm(1) Public key : (n, a, y, e)(2) Private key : (p, q, d, x).(3) Encryption : For a message 0 ≤ m < n, Alice chooses a (secret)random number 0 < k < n, and she sends Bob the ciphertextc = (c1, c2), where c1 = sk(a) and c2 = K+se(m), whereK = sk(y).(4) Decryption : For a ciphertext c = (c1, c2), Bob computes K =sx(c1), and then m = sd(c2−K), where (p, q, d, x) is its private key.Note that(1) All computations are performed in ZZn.(2) sx(c1) = sx(sk(a)) = sxk(a) = sk(sx(a)) = sk(y) = K, and then c2 −K = se(m).Since ed = 1 modulo (p2 − 1)(q2 − 1), there exists an integer l such thated = 1+l(p2−1)(q2−1). As (p2−1)(q2−1) is a period of s(m), sd(c2−K) =sd(se(m)) = sed(m) = s1+l(p2−1)(q2−1)(m) = s1(m) = m.2.3. Security. If an attacker tries to compute m from c = (c1, c2) and(a, y, e, n), he will compute K and d, i.e., he will compute the secret pa-rameters k and d. The first one is equivalent to braking standard the ElGamal scheme. For the second one, because the properties of Lucas func-tions mirror those of exponentiation, public key and private key processescan be developed in an exactly analogous manner to the RSA system, thisenables us to prove that any successful attack on this system would givea successful attack on the standard RSA system [3]. Thus the security ofthe method relies on the difficulty of factoring an RSA integer and on thedifficulty of computing the discrete logarithm in ZZn.2.4. Computational Cost. As in the standard RSA public key system,Bob chooses a small integer e and Alice chooses a relatively small integerk such that the computational cost for evaluating sk(a) and se(m) are low.For example e = 5, we need 3 multiplications modulo n for computings3(m), log2(k) multiplications modulo n for computing sk(a), i.e., totally,we need 3 + log2(k) multiplications modulo n for enciphering.For deciphering, once d and y are computed, we need log2(x) multiplicationsA PUBLIC-KEY CRYPTOSYSTEM BASED ON SECOND ORDER LINEAR SEQ. 7modulo n for computing K = sx(c1), and log2(d) multiplications modulon for computing sd(c2 − K). As d < n2, we need log2(n) multiplicationsmodulo n for deciphering. Totally, we need 4log2(n) on average.AcknowledgmentsI would like to thanks the “Centre de Recerca Matematica” of Barcelonafor their extraordinary hospitality and facilities for doing this work. As wellas the professor E. Nart for his valuable comments and suggestions.References[1] W. Diffie and M. E. Hellman, New directions in cryptography, IEEE Trans. Inform.Theory, vol. IT-22, pp. 644-654, Nov. 1976.[2] T. ElGamal, ”A public key cryptosystem and a signature scheme based on discretelogarithms,” IEEE Trans. Inform. Theory, vol. IT- 31, pp. 469-472, July 1985.[3] P. Smith et M. J. J. Lennon, LUC : A new public key system. In Proc. of the NinthIFIP Int. Symp. on Computer Security, p. 103-117, 1993.[4] D. H. Lehmer, An extended theory of lucas functions, Annals of Maths, 31 (1930),pp 419-448.[5] G. Castagnos, An efficient probabilistic public-key cryptosystem over quadraticfields quotients., Finite Fields Appl. 13 (2007), no. 3, 563-576.[6] G. Gong et L. Harn : Public-Key Cryptosystems Based on Cubic Finite FieldExtensions. In IEEE Trans. Inform. Theory, vol. 45, p. 2601-2605, 1999.[7] Douglas R. Stinson, Cryptography Theory and Practice, Third edition 2006,Chapman, Hall/CRC, Taylor and Francis Group.Faculte´ Polydisciplinaire de Ouarzazat, PO. Box 638, Ouarzazat-MoroccoE-mail address: lhouelfadil@hotmail.com

A public-key cryptosystem based on second order linear sequences

http://ddd.uab.cat/pub/prepub/2008/hdl_2072_9176/Pr786.pdf

A public-key cryptosystem based on second order linear sequences

Abstract

Similar works

Full text

Available Versions

Diposit Digital de Documents de la UAB