In the previous videos, we have seen plain versions
of RSA encryption and signature.
And we understood why they are correct and
secure.
However, we cannot choose This Plane versions
directly in reroute applications.
As we have seen in the last video for instance
plane RSA signature suffers from
several vulnerabilities.
In this video, we will see how we move from
a plane RSA algorithms to more practical and
secure versions that become the
RSS standards.
We'll start by looking at RSA encryption standard then
we will cover RSA signature standard.
First what are the limitations of plane RC encryptions?
The first limitation is the fact
that with plane RSA the input to
encrypt the x is an integer module
n but in real world applications, the
messages can be anything. It's not
necessarily an integer module way.
Next limitations are more religious security.
Let me cover the first limitation first. The
first is due to what we call the homomorphic
property of RSA.
the moving property means that
by having two ciphertexts
of two plain texts x and x
Prime the attacker is able to apply some
processing on the ciphertext some operation
of the ciphertext.
And that operation will be translated on the plaintext.
So for RSA encryption, we have
two separate X Y and Y Prime by multiplying them
the up the attacker obtains ciphertext corresponding
to the product
X and X Prime.
So this is in some situation you heard
probably about homomorphic encryption. It's
very useful, but in general encryption scheme
having such property can be dangerous in
some use cases.
The second security limitation is related
to CPA security.
So security is an ocean of security that we expect
encryption schemes to be
CPA secure.
So let me maybe explain first. What
is this CPA security? So it's basically sort
of a game or challenge that we
make an attacker do and if
the attacker succeeds in this challenge, then
we know that the encryption scheme that we used is
not a CPA secure.
So in CPA security channel, the attacker gets
to choose two different plain text messages to be
encrypted.
And then he receives one of them encrypted and
he needs to guess which one it is.
The attacker can do that with probability significantly higher than
one half which is just random guessing we say
that the encryption system is not cpsq.
Because plane RSA encryption is deterministic.
Because it's also public key, which means that everybody including the
attacker knows the public key and is able to encrypt messages.
We need the CPA game
or challenge against playing RSA
is trivial.
The flu will be as follows. Okay, so
the attacker chooses to distinct plain
text messages. Let's say A and
B and submits them to the Challenger.
And then he receives an encrypted ciphertext
see from their Challenger.
And what he can do using these I mean
using the public key, which is known he encrypts.
The original plain text A and B.
To obtain two separatex and he checks which one
is equal to the ciprotec that he
received from the Challenger and because the encryption
scheme is deterministic then one of them should match.
So to make RSA secure against such
attacks, we need to introduce some Randomness
in the encryption mechanism, and
that's what we'll see in the
next slide.
Okay, this is the RSA encryption Standard
pkcs 1 and
it is the version 1.5. There
are other versions of the encryption
if the RC
encryption standard, but I found for
educational purpose that looking at this version is
interesting and the other
reference are publicly available. So if
you are interested to look at
The evolution of those versions and what are
the changes? You can look at that on Internet
by just Googling a PCS? Okay, so
I'll pkcs works first. We have
PCS version 1.5. We have
a modulus of our RSA algorithm, which
is n and that modulus is
of length K bytes.
With this I say encryption a standard we
can encrypt any message of length
at most K minus 11
bytes. So we see that there will
be some 11 bytes that are dedicated to
other.
Information and K minus 11
will be at most are dedicated for
the message.
Okay, so for the encryption processes as follows
first, we generate episode random string.
Called PS such that the concussion concatenation
of PS and the bytes of
the message is of length k-3
bytes.
So the PS is at least 8 bytes if
the the message fits in
K minus 11 bytes exactly. Then the PS is
8 bytes if it is less than
the PS will have a more additional
by.
Then we construct a string of length
exactly kbites. This string is
as follows. We first byte is zero zero then the
second is 02 then we have the bytes of
PS.
Then we have a null byte 0 0.
and then we have the bytes of the plaintext
and this byte string
is exactly of land Key by so
we can convert it as an integer module n
we compute the plane RSA encryption that
we have seen in the previous videos.
We convert then the result into a string
of K bytes.
Okay. So with this RSA version,
we fixed all
the limitations that we have seen previously. So
first we can now encrypt any
data as log as it is represented by.
K minus 11 it can be represented as
a k minus 11 bytes.
We don't have any more the homomorphism property.
You can this is can be a good exercise. You
can try to see why we don't have that.
And we introduced some Randomness in the process
by through this string PS.
So the attacker cannot
trivial manner The ncpa Challenge and
this algorithm is CPA secure.
Okay, this is the process of the decryption.
So we receive a ciphertext.
When we receive it, we need to convert it into an integer. We expect
that integer to be greater than the model to
be a smaller than the modulus if it is greater than
the modulus then we should reject this ciphertext. We
know that something wrong happened.
We perform plane RC decryption on that
integer and we obtain another
integer.
The output it integer is then converted back
as a byte string?
And if everything was fine, there was
no error or no malicious modification of the
ciphertext. Then the string that
you obtained should have the expected format with zero
zero zero first and
zero two Etc and bytes of PS. So
if it is not of this format, we should discard the
we should reject the self text.
If this is this format, we extract
the bytes of M and that
will be our original plaintext.
Is now switch to the RSA signature standard first.
Let's have a reminder
of the security concerns of
playing RSA signature.
So we have covered that in the previous video
feel free to stop the video and
look at the details of the security concerns, which
were mainly the capability of
the attacker to forge new signatures, or you
can even return to video 5.1.
So the previous video and study again
what what are the security
Concepts?
We saw in the previous video that
we can use the hash and
sign approach to fix the security concerns.
So instead of directly signing the message X
we hash it first to obtain
a digest H. And we send the pair X and
S to the receiver and the
receiver first has to recompute the digest
H from X before verifying that S and
H is a valid version and this
Action Sign approach fix the
forgially vulnerabilities that we
discussed previously.
Okay, let's see in detail. Now the RSA signature
standard that implements the hash and
sign approach similar to encryption will be
looking at the version 1.5 of
the pkcs one. So
we start by assuming
that we have modulus and modulus n of
K bytes.
The first separation is to Hash the message to obtain a
message digest obviously here.
We have to use a secure cryptographic hash
function for example, lush256 or
share 3 then we encode the
message digest and the identifier of
the hash in the field D. So we can
imagine that the first byte of of D
is for the identifier of the
hash algorithm. For example, we can
use any Convention of identifiers.
So for example, zero one
is for
shawan02 is Porsche 256
with the first length Etc.
But anyway, the message Ledges and this identifier go
into the filthy.
Then we pad with 0 byte to
the left and as many bytes
FF to reach K minus
2 bytes, then we add the
bytes 0 1 and
the byte 0 0.
So the format is actually very similar to the format that
we had for the encryption the difference
is that for the encryption the we have a random
a bit string PS. Now this random bit
string is just a string of
FF.
Then this now string of
length Okay bytes is converted as an integer module
n we compute the plane RSA signature
on that integer to obtain another
integer the result.
That result is converted back as a string of
kbites.
Okay, the verification is as follows.
First we convert the signature into an
integer.
We rejected if it is greater than
the modulus.
We perform the plane RSA verification.
On that integer to obtain another integer.
The output it integer is then
converted as a byte string?
We check that. It has the correct format. So
with the 0001 then different
bytes of FF then
noodle bite, then probably the identifier
of the hash.
We decode so the D as I
said with identifier and the bytes of message Digest.
And if the hash algorithm is acceptable then
we know this is a valid signature.
And we extract the bytes and
then we hash the
message and we check that we have the
matching message.
So we reach the end of our video in
this video. We covered the RC standards
for encryption and signature and we also
discussed. What are the limitations of the
plane or say encryption signature
and why it cannot be used.
So with this video we finish
these section and this video
is also the last study material.
So see you in the next section where
we'll conclude the
course, we'll review briefly what we have learned
together and we will discuss
what are the other topics
of cryptography that
now you can look at as
you acquired good understanding
of conventional cryptography. So
see you in the next video.