upgrade structures and migrate to nextra v4

content/CSE442T/CSE442T_L10.md

@@ -0,0 +1,210 @@
+# Lecture 10
+
+## Chapter 2: Computational Hardness
+
+### Discrete Log Assumption (Assumption 52.2)
+
+This is collection of one-way functions
+
+$$
+p\gets \tilde\Pi_n(\textup{ safe primes }), p=2q+1
+$$
+
+$$
+a\gets \mathbb{Z}*_{p};g=a^2(\textup{ make sure }g\neq 1)
+$$
+
+$$
+f_{g,p}(x)=g^x\mod p
+$$
+
+$$
+f:\mathbb{Z}_q\to \mathbb{Z}^*_p
+$$
+
+#### Evidence for Discrete Log Assumption
+
+Best known algorithm to always solve discrete log  mod p, $p\in \Pi_n$
+
+$$
+O(2^{\sqrt{2}\sqrt{\log(n)}})
+$$
+
+### RSA Assumption
+
+Let $e$ be the exponents
+
+$$
+P[p,q\gets \Pi_n;N\gets p\cdot q;e\gets \mathbb{Z}_{\phi(N)}^*;y\gets \mathbb{N}_n;x\gets \mathcal{A}(N,e,y);x^e=y\mod N]<\epsilon(n)
+$$
+
+#### Theorem 53.2 (RSA Algorithm)
+
+This is a collection of one-way functions
+
+$I=\{(N,e):N=p\cdot q,p,q\in \Pi_n \textup{ and } e\in \mathbb{Z}_{\phi(N)}^*\}$
+
+$D_{(N,e)}=\mathbb{Z}_N^*$
+
+$R_{(N,e)}=\mathbb{Z}_N^*$
+
+$f_{(N,e)}(x)=x^e\mod N$
+
+Example:
+
+On encryption side
+
+$p=5,q=11,N=5\times 11=55$, $\phi(N)=4*10=40$
+
+pick $e\in \mathbb{Z}_{40}^*$. say $e=3$, and $f(x)=x^3\mod 55$
+
+pick $y\in \mathbb{Z}_{55}^*$. say $y=17$. We have $(55,3,17)$
+
+$x^{40}\equiv 1\mod 55$
+
+$x^{41}\equiv x\mod 55$
+
+$x^{40k+1}\equiv x \mod 55$
+
+Since $x^a\equiv x^{a\mod 40}\mod 55$ (by corollary of Fermat's little Theorem: $a^x\mod N=a^{x\mod \Phi(N)}\mod N$
+s )
+
+The problem is, what can we multiply by $3$ to get $1\mod \phi(N)=1\mod 40$.
+
+by computing the multiplicative inverse using extended Euclidean algorithm we have $3\cdot 27\equiv 1\mod 40$.
+
+$x^3\equiv 17\mod 55$
+
+$x\equiv 17^{27}\mod 55$
+
+On adversary side.
+
+they don't know $\phi(N)=40$
+
+$$
+f(N,e):\mathbb{Z}_N^*\to \mathbb{Z}_N^*
+$$
+is a bijection.
+
+Proof: Suppose $x_1^e\equiv x_2^e\mod n$
+
+Then let $d=e^{-1}\mod \phi(N)$ (exists b/c $e\in\phi(N)^*$)
+
+So $(x_1^e)^d\equiv (x_2^e)^d\mod N$
+
+So $x_1^{e\cdot d\mod \phi(N)}\equiv x_2^{e\cdot d\mod \phi(N)}\mod N$ (Euler's Theorem)
+
+$x_1\equiv x_2\mod N$
+
+So it's one-to-one.
+
+QED
+
+Let $y\in \mathbb{Z}_N^*$, letting $x=y^d\mod N$, where $d\equiv e^{-1}\mod \phi(N)$
+
+$x^e\equiv (y^d)^e \equiv y\mod n$
+
+Proof:
+
+It's easy to sample from $I$:
+
+* pick $p,q\in \Pi_n$. $N=p\cdot q$
+* compute $\phi(N)=(p-1)(q-1)$
+* pick $e\gets \mathbb{Z}^*_N$. If $gcd(e,\phi(N))\neq 1$, pick again ($\mathbb{Z}_{\phi_(N)}^*$ has plenty of elements.)
+
+Easy to sample $\mathbb{\mathbb{Z}_N^*}$ (domain).
+
+Easy to compute $x^e\mod N$.
+
+Hard to invert:
+
+$$
+\begin{aligned}
+&~~~~P[(N,e)\in I;x\gets \mathbb{Z}_N^*;y=x^e\mod N:f(\mathcal{A}((N,e),y))=y]\\
+&=P[(N,e)\in I;x\gets \mathbb{Z}_N^*;y=x^e\mod N:x\gets \mathcal{A}((N,e),y)]\\
+&=P[(N,e)\in I;y\gets \mathbb{Z}_N^*;y=x^e\mod N:x\gets \mathcal{A}((N,e),y),x^e\equiv y\mod N]\\
+\end{aligned}
+$$
+
+By RSA assumption
+
+The second equality follows because for any finite $D$ and bijection $f:D\to D$, sampling $y\in D$ directly is equivalent to sampling $x\gets D$, then computing $y=f(x)$.
+
+QED
+
+#### Theorem If inverting RSA is hard, then factoring is hard.
+
+$$
+\textup{ RSA assumption }\implies \textup{ Factoring assumption}
+$$
+
+If inverting RSA is hard, then factoring is hard.
+
+i.e If factoring is easy, then inverting RSA is easy.
+
+Proof:
+
+Suppose $\mathcal{A}$ is an adversary that breaks the factoring assumption, then
+
+$$
+P[p\gets \Pi_n;q\gets \Pi_n;N=p\cdot q;\mathcal{A}(N)=(p,q)]>\frac{1}{p(n)}
+$$
+
+infinitely often.for a polynomial $p$.
+
+Then we designing $B$ to invert RSA.
+
+Suppose
+
+$p,q\gets \Pi_n;N=p\cdot q;e\gets \mathbb{Z}_{\phi(N)}^*;x\gets \mathbb{Z}^n;y=x^e\mod N$
+
+``` python
+def B(N,e,y):
+    """
+    Goal: find x
+    """
+    p,q=A(N)
+    if n!=p*q:
+        return None
+    phiN=(p-1)*(q-1)
+    # find modular inverse of e \mod N
+    d=extended_euclidean_algorithm(e,phiN)
+    # returns (y**d)%N
+    x=fast_modular_exponent(y,d,N)
+    return x
+```
+
+So the probability of B succeeds is equal to A succeeds, which $>\frac{1}{p(n)}$ infinitely often, breaking RSA assumption.
+
+Remaining question: Can $x$ be found without factoring $N$? $y=x^e\mod N$
+
+### One-way permutation (Definition 55.1)
+
+A collection function $\mathcal{F}=\{f_i:D_i\to R_i\}_{i\in I}$ is a one-way permutation if
+
+1. $\forall i,f_i$ is a permutation
+2. $\mathcal{F}$ is a collection of one-way functions
+
+_basically, a one-way permutation is a collection of one-way functions that maps $\{0,1\}^n$ to $\{0,1\}^n$ in a bijection way._
+
+### Trapdoor permutations
+
+Idea: $f:D\to R$ is a one-way permutation.
+
+$y\gets R$.
+
+* Finding $x$ such that $f(x)=y$ is hard.
+* With some secret info about $f$, finding $x$ is easy.
+
+$\mathcal{F}=\{f_i:D_i\to R_i\}_{i\in I}$
+
+1. $\forall i,f_i$ is a permutation
+2. $(i,t)\gets Gen(1^n)$ efficient. ($i\in I$ paired with $t$), $t$ is the "trapdoor info"
+3. $\forall i,D_i$ can be sampled efficiently.
+4. $\forall i,\forall x,f_i(x)$ can be computed in polynomial time.
+5. $P[(i,t)\gets Gen(1^n);y\gets R_i:f_i(\mathcal{A}(1^n,i,y))=y]<\epsilon(n)$ (note: $\mathcal{A}$ is not given $t$)
+6. (trapdoor) There is a p.p.t. $B$ such that given $i,y,t$, B always finds x such that $f_i(x)=y$. $t$ is the "trapdoor info"
+
+#### Theorem RSA is a trapdoor
+
+RSA collection of trapdoor permutation with factorization $(p,q)$ of $N$, or $\phi(N)$, as trapdoor info $f$.