Breaking the direct RSA-implementation of MIXes (1)
{"Image DocumentName": "Breaking the direct RSA-implementation of MIXes (1)", "Image ImageDescription": "Implementation of MIXes using RSA without redundancy predicate and with contiguous bit strings (David Chaum, 1981) is insecure: |z|=b |M|=B. c. (z,M) MIX. attacker. observes, chooses factor f. and generates. M. c. d. attacker multiplies M with factor f and compares. ((x,y) ) = x,y (mod n) outputs y. M \u2022 f. c. c. (z,M) \u2022 f. Unlinkability, if many factors f are possible. 2b\u20222B \u2264 n-1 hold always and normally b << B. If the random bit strings are the most significant bits, it holds. (z,M) = z\u20222B+M and. (z,M)\u2022f \uf0ba (z\u20222B + M)\u2022f \uf0ba z\u20222B\u2022f + M\u2022f. every asym encrpytion system ok? special problem for mixes? note: mix pushes security of crypto system to ist limits: because known-plaintext attacks possible. adaptive chosen ciphertex-plaintext attacks! in 1981: RSA was the main crypto algorithm\u2026 remeber: usual active attack on rsa: x^c y^c\u2026. = x y. same strategy for mixes\u2026 problem \u2013 random number ist not output \uf0e0 tehrefore direct multiplicatevie attack does not work\u2026. but: is output \u201erelated enought to m f\u2026? notation: length of random number: b (=128) length of message: B (=1900) attack: take ciphertext, multiply by small factor (2, 10, 30)^c. put it into same batch. look at all outputs \uf0e0 try to find input pair\u2026 check for roughly differten by factor of f\u2026. What does \u201eroughly times f mean ? (Note: mix can not check for \u201ef because he does not know f \u2013 many possibilities\u2026.) 2^b 2^B < n (message need to find into rsa block\u2026) (modulus) assumption: random is prepend (most significant bits\u2026) so: (z,M) = z 2^B+M. and same for factor f\u2026 (next slide)", "Image XResolution": "37", "Image YResolution": "37", "Image ResolutionUnit": "Pixels/Centimeter", "Image Software": "SlidePlayer", "Image YCbCrPositioning": "Centered"}