Score:0

How does the public key cryptography algorithm generate a public key based on the private key?

im flag

Because of the need of the project, I want to develop a simple public key cryptography algorithm, but I have doubts when generating the key pair.

I have learned about the key generation process of RSA. It is to prepare two coprime numbers (p, q), multiply them to obtain N, and then calculate L (that is, L=lcm (p-1, q-1)), calculate the public key (pk is a number larger than 1 and smaller than L, and the maximum common divisor of pk and L is 1), and calculate the private key (sk is a number larger than 1 and smaller than L, and the public key multiplied by sk modulus L is 1).


This is a simplified version of my algorithm (to better explain it to you):
The encryption process is "C = M * PK^3 mod 65537", and the decryption process is "M = C * SK^3 mod 65537".
I want to know how to quickly find the public key based on the private key after generating the private key.
This is the nature of public and private keys:
Both public and private keys are greater than 1 and less than 65537.
The encryption and decryption process has been given above.

I used a simple random algorithm to generate a private key (greater than 1, less than 65537), and then used a loop to try to find the value of the public key corresponding to the private key.
like this(This is a piece of pseudocode):

#define E(m, k) ((m * k^3) mod 65537)
#define D(c, k) ((c * k^3) mod 65537)

sk = 18392;

for(int i = 2; i < 65537; ++i) {
    if (D(E(3, i), sk) == 3) {
        pk = i;
        break;
    }
}

As you can see, this is a very bad way to find the public key.
So I want to know what is the right way? (That is, the key pair can be generated more quickly like RSA)

Daniel S avatar
ru flag
You need to solve (PK)*(SK)=1 mod 65537 which can be done via the extended Euclidean algorithm. Also note that the secret key can be recovered from the public key in exactly the same way (which is a bad thing).
Score:2
ng flag

The question gets some facts wrong about RSA; refer to PKCS#1 for a reference. 1, 5, 6, 7, 8, 9, 10, 12, 13 are show-stoppers. The answer to the question is in 11 and 12.

  1. The correct condition for $p$ and $q$ is they are prime, large (several hundreds of decimal digits), randomly seeded, distinct, and kept secret. That implies $p$ and $q$ are coprime, but coprime integers are not necessarily prime.
  2. What's designated as $\mathrm{pk}$ is usually noted $e$, and is the public exponent, not the public key. The public key must also include $N$; it's typically $(N,e)$.
  3. What's designated as $\mathrm{sk}$ is usually noted $d$, and is the private exponent, not the private key. The private key must include other things; it can be $(N,d)$, or $(p,q,e)$, or some combination or superset of that.
  4. $1<e<L$ is not the most typical specified range for $e$. More common ones are $1<e<n$ or $2^{(2^4)}<e<2^{(2^8)}$. Mathematically there's no need for a limit. $e=n$ is fine except for speed, and was actually first proposed (see reference 2s there), before RSA was re-discovered.
  5. Textbook RSA encryption goes $M\mapsto C=M^e\bmod N$, not "C = M * PK^3 mod 65537". The integers $3$ and $65537$ are possible value for $e$, and not part of the general formula.
  6. Textbook RSA decryption can go $C\mapsto M=C^d\bmod N$, not "M = C * SK^3 mod 65537"
  7. $65537$ is not adequate for the public modulus $N$, for it's prime rather than divisible by distinct primes $p$ and $q$. It's no adequate either for $L$ (commonly noted $\lambda$, as the Carmichael function for $N$), which is even. Also, both $N$ and $L$ must be large for security: several hundred digits.
  8. The C or C++ language has no built-in support for integers large enough for serious use of RSA. You'll need to write or obtain libraries for addition, multiplication, Euclidean division, modular exponentiation, random integer generation…; or switch to a language with that build-in (Python) or in standard libraries (Java); or be stuck with entirely insecure RSA parameters.
  9. In #define E(m, k) ((m * k^3) mod 65537) the ^ sign would be understood by the C or C++ compiler as exclusive-OR, not exponentiation. Also operator precedence might be a surprise.
  10. The code proposed chooses sk (that is $d$) even, and that can't work: RSA exponents are odd, that's a consequence of $\gcd(e,L)=1$. Also $d$ must be random and secret, and large: a barely safe minimum is $\sqrt[3]N$.
  11. The code attempts to find pk (that is $e$) from $d$. That's as in the original RSA article, but long out of fashion because it does not allow a small $e$, which is desirable for speed of encryption. The usual way now is to choose the public exponent $e$ before $d$, and choose it small. The most popular choice is to fix $e=2^{(2^4)}+1=65537$ (but $e=3$ also is common); then it's chosen (often, probable) primes $p$ and $q$ such that $\gcd(e,p-1)=1$ and $\gcd(e,q-1)=1$. When $e$ is prime (as $65537$ and $3$ are), $\gcd(e,q-1)=1$ reduces to $p\bmod e\ne 1$.
  12. The code attempts to find one exponent from the other by enumeration. Even with the correct test, that won't work for practical parameters, because they must be large. The most standard method to compute $d$ is as $e^{-1}\bmod\lambda$ using the (half) extended Euclidean algorithm, where $\lambda=\operatorname{lcm}(p-1,q-1)$ is your $L$.
  13. Textbook RSA is not proper RSA encryption (in particular, when encrypting something in a small set, like a name on the class roll, it's entirely insecure, because a guess of the message can be checked). See RSAES-OAEP for something secure, or use hybrid encryption.
  14. When manipulating secret data (private key or plaintext), there are implementation issues, including side channels and fault attacks.
SN-Grotesque avatar
im flag
Thank you for pointing out my mistakes. I will refer to the answers you gave me carefully.
NB_1907 avatar
us flag
@fgrieu I think "public" statements in third item should be changed as "private".
fgrieu avatar
ng flag
@NB_1907 now fixed, thanks.
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.