密码学整理.docx

Goldwasser-Micali密码系统的安全性是基于判定一个剩余类是否有mod n平方根的困难性。Cleartext space: {0,1} Ciphertext space: Zn*.n is a blum integer. QRA（Quadratic Residue Assumption）：It is hard to distinguish quadratic residues from non-residues mod n (without factorization of n)。●ElGamal基于计算离散对数是困难的。ElGamal Cryptosystem：Pick a large prime p.Pick g from Zp*.（g为生成元）Pick x at random such that 0xp-1.Compute y=gx mod p.Public Key: (p, g, y). Private Key: (p, g, x). Encryption： For m in Zp*, Pick r from (0,p-1) uniformly at random.Compute c1=gr.Compute c2=myr.Ciphertext: c=(c1, c2).DecryptionFor ciphertext c=(c1, c2 ):Compute m= c2 / c1 x.Why does the decryption work?Clearly myr/(gr )x = m (gx)r/(gr )x = m. ●CDH（Computational Diffie-Hellman (CDH) Assumption）：For appropriately chosen random group G, random generator g, and random exponents a, b, the probability of any efficient algorithm computing gab from g, ga, gb is negligible. ●CDH and DLP：The CDH assumption implies that DLP is hard.Clear, since otherwise we could first compute a, b from g, ga, gb and then compute gab using g, a, b.●DDH：（ Decisional Diffie-Hellman Assumption）：For all efficient algorithm A, for all polynomial p(), for all sufficiently large k, for appropriately chosen random group G, for random generator g, and random exponents a, b, c, |Pr[A(g, ga, gb, gc)=1]-Pr[A(g, ga, gb, gab)] =1|1/p(k)●ECDLP（elliptic curve discrete logarithm problem椭圆曲线离散对数问题）：基于一个已知的点来计算任意椭圆曲线元素的离散对数是不可行的。●ECC：Exist sub-exponential algorithms of factoring or solving DLP. Means ECC is more secure than RSA or ElGamal。Or to say, using much smaller key size can achieve the same security as RSA or ElGamal with large key size, so more efficient. y2 = x3 + ax + b, where x, y, a and b are real numbers.●Many cryptosystems can be formed based on Elliptic Curve●Given elliptic curve E and a point (generator)Example 1: ElGamal system:Suppose =b, (E, , ) are public, and b is secret.Encryption: randomly select a k, E(x,k)=(k, x+k)Decryption: D(y1,y2) = y2 - by1.Example 2