Section 16.5; Due December 8

Difficult: The steps of the cryptosystems here are all rather difficult to follow, I look forward to seeing examples in class. I'm having trouble understanding how the repeated addition on the elliptic curve should be as difficult to find the coefficient "a" for as it is difficult to solve a discreet log problem. Is there a proof like with the Diffie Helman problem to show that this is the same as solving a discreet log?

Reflective: Wow, last section! This has been a great class, I've really enjoyed all that we have done and learned. It was great to get another practical use out of something as abstract as an elliptic curve. Is there also some RSA type algorithm that you can do with an elliptic curve? I would suppose not since we need to work mod a prime, as in section 16.2, but it seems there might be some other way. Maybe using two elliptic curves mod p_1 and q_1.

Section 16.4; Due December 6

Difficult: The discussion of addition with these elliptic curves was much more confusing than before. In the example, it seemed to say that (0,0)+(1,1) did not have a solution, then it added (0,0) again to get the identity (which I do not see), and then suddenly there was a solution because (0,0)+(1,1) had to be -(0,0)? It also says that elliptic curves with characteristic 2 are important to cryptography, but I didn't really see where it dicussed why these would be best.

Reflective: The mash up of finite fields with the new (to me) group structure on elliptic curves was more difficult to grasp than I thought it would be. It seems not too different that the curves mod p, but it is still difficult. You would think there would be more description in the book, this was a short section.

Section 16.3; Due December 3

Difficult: So we can just pick any elliptic curve and it will probably factor the number? How can we be sure within a good probability that we have a curve that will work? It is interesting that we can just keep picking curves and one may work though, not like the p-1 method. I also did not understand how the singular curves were worked with.

Reflective: So the p-1 and brute force algorithms are just special cases of the elliptic curve algorithm? Never thought of it that way before, of course. Or is it just that there are special cases of the elliptic curve algorithm that are the same as the p-1 and brute force algorithms? The moniker "smooth" for numbers with only small prime factors caught my eye as I have been working with "smooth" functions on manifolds a lot recently. Is there some relation in this terminology? I couldn't think of one.

Section 16.2; Due December 1

Difficult: I do not quite understand the idea of encrypting messages with an elliptic curve mod p. So, you pick your message and then attempt to build your curve based on using your message as a point? Or do you have the curve first and then try to guess a point on the curve based on your message by adding things to your message? If it is the second method, how would the person you are sending the message to know which part is junk? Or even if you did not have to add any junk?

Reflective: The elliptic curve mod p doesn't seem that much more difficult than the elliptic curve without modular arithmetic. The number of points on the curve being so unpredictable is interesting, but I suppose it is just another "finding square roots mod n" problem. If using a prime p, do we need to ensure that p=3 (mod 4) as we did before?

Section 16.1; Due November 29

Difficult: Why do they define addition of points on the curve as the reflection of the third point where the secant line hits the curve? It seems like it would be more natural to just define the sum of two points on the curve to be the point where the secant line hits the curve. Is there some sort of computational benefit to adding in the reflection that I just do not see? The formulas seem to follow easily from the definition given, but it would seem to me just as easy to come up with formulas for the nonreflected point.

Reflective: Putting a group structure on points of a curve is particularly interesting to me in light of the research I have done in topology. This structure does not seem to be quite as natural a structure as what I am used to, so it is more interesting to think of what it all means. For example, I spent some time thinking about the curve with two components (x(x-1)(x+1)) and what the definition of addition does with that group. It looks like the points on the circle would generate the full group, as you can obtain any point on the line from two points on the circle (including the point at infinity). Possibly they do not generate though, since I see no way you could get a point on the circle from one or two points on the circle.

Section 2.12, due November 23

Difficult: I do not fully understand the discussion of the permutations used to break Enigma. The text mentions that letters never mapped to themselves in the machine, but the 1 cycles in the examples seem to indicate that they could. Also, how exactly did deciding the cycles reduce the problem to a substitution cipher? The initial keys were still quite random, so it seems that there would be trouble figuring out the permutations you need. How many messages were needed to work out which permutations you were looking at for a day?

Reflective: This is just an extremely interesting section. I enjoyed learning more about the enigma machines. I had no idea that the British then used them to spy on former colonies, that is quite interesting. Good to see governments haven't changed quite so much as we might think. I was disappointed that the links you posted did not work for me, so I could not read the extra information from the NSA.

Sections 19.1 & 19.2; Due November 19

Difficult: I found it difficult to understand what physicists (and for that matter chemists) believe about photons. Do they really think that a photon does not have a state until it is observed? When did science become a religion? Anyway, that's not really answerable, I just get frustrated when people try to explain something with illogical conclusions. Also, there wasn't much to be confused about in this section really. The theoretical quantum bit key exchange makes sense. They talk about methods to use to transmit these keys (fiber optic etc.) and the distance they can send, does that mean that the method is not really theoretical any more? Also, I remember in my undergraduate chemistry discussing using the chirality of a molecule to encode messages, is there any more information on this method?

Reflective: It seems that just message-sending type cryptography isn't the meat of the quantum computing idea. Isn't the way computers communicate with their internal parts a form of cryptography? They must encode electronic signals and decipher what they mean. Maybe it would be better to be focusing on efficient ways to encode these messages rather than just secure message sending that could be accomplished with a flashlight and some polaroid filters.

Sections 14.1 & 14.2; Due November 17

Difficult: I do not entirely understand the use of the hash function in the zero knowledge protocol. Why is it beneficial to use a hash function here when Peggy will still have to give full numbers for her answers? How would a chip be made unreadable? Wouldn't that mean that the machine that Peggy puts the card in would not be able to read the chip either?

Reflective: More importantly, what is to prevent Eve from using the algorithm with the $5 wrench described on the test to find Peggy's numbers? Seriously though, I think I see the use of these protocols. Since not even Victor will know the answers that Peggy uses (his computer throws them away) he cannot give away that information. It seems like it would be easy to adapt one of these protocols using El Gamal also, which might be easier to compute than RSA types like they used.

Sections 12.1 and 12.2; Due November 15

Difficult: I do not completely understand the Legrange interpolation polynomial, or why it works. It seems like it is not so important anyway, it would be a simple to solve the system that was as it would be to solve the system linearly, as far as I can tell. The rest of these sections made plenty of sense.

Reflective: Yeah, I'd love to see someone work one of these schemes into a spy movie.

--"Quick, we need to launch the nuclear warhead. Get the president, the general, and the secretary of state!"

--"Ok gentlemen, do you remember your point in three space?"

*The next ten minutes are spent setting up a matrix and solving the resulting system of equations by hand because the aliens knocked out the mainframe so only the launch computer works...during this time all of the audience leaves...Except for three kids from a college math class*. It is a neat idea though, I like the ideas on how to have multiple "secret holders" that have to be together to get the secret.

Exam 2 Review Questions; Due November 12

Which topics or ideas do you think are the most important out of those we have studied?

I think that the most important ideas for these sections are the myriad methods we have studied to factor into primes. While I do not think that we can be asked to use the methods in a serious manner on the test, the ability to factor into primes was needed for breaking all of the new crypto systems we learned in these sections, so we will have to at least be able to explain the theory behind each method. Besides that, we have two new encryption methods (three if you count the Diffie Hellman key exchange), many electronic signature methods, and Hash functions. Oh my gosh, the hash functions!

What kinds of questions do you expect to see on the exam?

I think that we will see many theoretical questions. I expect to be asked how to factor into primes by multiple methods, how to find the square root of numbers in modular arithmatic, and how to use these methods to break RSA and other systems. I expect something on the quadratic sieve, probably just having to explain how it works. I expect to have to be able to find simple discrete logarithms (probably ones small enough to list out the powers for) and explain more sophisticated methods to find discrete logs like the Phlig-Hellman algorithm and birthday attacks. I expect questions on probability of the birthday attack succeeding in various (possibly non-cryptographic) situations. Finally, I expect some questions on hash functions and using them for digital signatures. Mainly I expect things like the definition of a hash function and about strongly collision-free and preimage resistance.

What do you need to work on understanding better before the exam?

I need to work on hash functions some more. I have trouble following the diagrams for the one true hash function we have discussed. Also, with so many factoring and discrete logarithm methods, I get mixed up as to what I should be doing where. Oh, and the prime tests. I almost forgot about them, so I need to look over them for sure.

Are there topics you are especially interested in studying during the rest of the semester? What are they?

I was hoping that we could look at some of the applications of these systems we have been studying. We have discussed how DES is used in television transmission and some uses of systems like one-time pads. But how do digital signatures work in the real world? What happens when I buy something online to keep my data safe? Other than that, I don't mind just learning new cryptosystems and how to break them.

Sections 8.3 & 9.5; Due November 10

Difficult: Am I allowed to put "Section 8.3" here and leave it at that? Probably not. SHA-1 is quite confusing though, which is probably its point in the first place. I have a hard time following the steps, partially because of all of the newly defined operations, and partially because of the sudden introduction of Hexadecimal, with which I am only vaguely familiar. The diagrams (8.2 and 8.3) are definitely not clarifying matters. I see that all of the important parts come in step 3 and I understand how they adjust the message to a specified length where it can be split into 512 bit blocks though.

Reflective: While the text does discuss many ways in which the DSA is more secure than ElGamal, it does not mention birthday attacks on this algorithm. I suppose this is because it is assumed to be secure from a birthday attack as long as you choose a large enough prime? Or is it because there are two "coded" parts. You would need to have the right hash first, and then work out the signature from there, so that complicates matters too.

Sections 9.1-9.4, Due November 8

Difficult: I was a little confused by the hash signature. Is the hash function itself the signature (since they are difficult to duplicate), do you take the hash of the message and then sign it, or do you sign the message and then take the hash of the signature? Other than that these sections were pretty accessible. We have discussed all of the encryption algorithms used, and there is only a slight change in usage for signatures. It is all well explained.

Reflective: I appreciated the discussion of how to defend against the birthday attack on hash functions. It seems like such a simple precaution, just change one piece and you probably win. We still haven't really discussed how exactly these functions are used for securing documents (signatures obviously, but I know that I have no personal encryption function to sign things with) so it makes me wonder how these are used when I make a purchase online. Also, I am never given the option of changing a document online, so how can I know that the document hasn't a birthday "double"?

Sections 8.4-8.5 & 8.7; Due November 5

Difficult: First off, they do not explain, but it seems that must stand for concatonation? Possibly this was in a section that was not assigned yet, or maybe I just forgot the notation from an earlier assignment. The Birthday attack seems very interesting, especially the paradox part (that you can find two matching birthdays with high probability but not match a given one). It looks like they violate this paradox with the birthday attack on discrete logarithms, however. I understand how they are using the matching of two different groups instead of trying to match a single value, but I do not understand why a similar method cannot be used in many other situations where you want to match a given value.

Reflective: Frequent discussions of how we cannot truly create a random sequence without natural phenomena has lead me to wonder if they have been working on this problem in a manner besides trying to find more and more random mathematical functions. Most of the natural phenomena mentioned as random are inherently slow (such as flipping coins or counting clicks in a second). However, there are many random natural phenomena that occur quickly that can be read with modern machinery. For example, I seem to remember from my chemistry classes that vibrations in a crystal lattice are random, but happen many times in a millisecond. We can "read" these vibrations even in a small sample of crystal, so why could we not use this as a speedy random sequence generator. If the number of vibrations in a millisecond (or less if you need) is even, you get a 0, odd you get a 1. Small crystals and the equipment to read their vibrations could then be installed in your desktop. I may be wrong with the specific example, but I am sure there are many random, small scale, fast phenomena that we know about now.

Sections 8.1-8.2, Due November 3

Difficult: I do not understand the difference between finding h(m) such that h(m)=y for a given y and finding m' such that h(m)=h(m'). It seems that in both cases, you will first need to decide that h(m)=y, and if you have that what is the point of finding a different m' with h(m')=y? Are we just trying to find a random input that would give an output that we do not know?

Reflective: While I do not see why you would want to find the alternate m', it is a neat idea. The book indicates that hash functions are usually used for electronic signatures. This seems to indicate that for some passwords, I would be able to enter a completely different password and have it work anyway! Does limiting the size of the input (as they do with passwords) help ensure that there is only one solution m such that h(m)=y to avoid duplicate passwords?

Sections 7.3-7.5, Due November 1

Difficult: I found the discussion of the security of ElGamal Ciphertexts to be a bit confusing. It might be from the strange way it is presented, with theoretical machines doing things that the sections just said cannot be done. Also, there are a couple of methods given to find discrete logs under certain conditions, and the chapter discusses that it is difficult to find discrete logs in general, but it doesn't really talk about how difficult. I suppose this sounds silly, but I was wondering. We talked about with the RSA algorithm how adding a couple of digits to your primes increased computation time exponentially to factor n, how does computation increase with discrete logs when adding digits?

Reflective: I wish the author had decided to include Alice's method for predicting the outcome of football games. That would come in handy I think. The way of sending the prediction so that Bob could tell she didn't alter the message and Alice could keep the message secret until she wanted to reveal it was interesting though. It seems similar to the idea of the countries wanting to share information with each being able to read the message, but not being able to alter the message that we discussed with RSA.

Sections 6.5-6.7 and 7.1, Due October 27

Difficult: The more "mathematical" definition for public key cryptosystems is more difficult to understand than the intuitive description. Of course this is usually the case, and describing how RSA fits helped alot. Other than having to think over the definition a bit, these sections did not have much to be difficult in them. Except understanding what a squeamish ossifrage is.

Reflective: I love the sections that talk about the history of cryptography the most. The RSA challenge seems to wrap up what we have talked about well, and I liked seeing the application of the method from 6.4.1. When I read 6.4.1, I thought that the method should not take too long, but this story shows that indeed it can. I found it funny that after all that work, they only had to try 4 numbers to get the factorization! Discrete Logarithms seems to be a promising chapter too. I had not heard about these before, but they seem like they should be accessible. I suppose in this method, the message will be the exponent, alpha will be the public key, and the discrete log base alpha will be the secret decryption function.

Section 6.4.1, Due October 25

Difficult: It mentions on page 185 that the easy way to pick good numbers for this method is to look at numbers of the form root{in}+j for small j, which makes sense as we are looking to cough out powers of small primes. This seems to be pretty reliable, but we have discussed how none of the current methods are sure-fire quick ways to factor a large prime. What is the trouble with this one? Obviously, we have the possibility every time of finding only multiples of n, but it seems that we could just choose more numbers to try and we will get it eventually, and it doesn't seem to take too much time to compute one more row of numbers. Does this method fail if p-1 and q-1 have no small prime factors? I don't see how that would mess things up. Is it possible that for a given n there exists no possible x and y that fit the hypothesis of the Basic Principle? It seems like for large n, there should always be such x and y.

Reflective: This method does not seem difficult or to take much time (except maybe by hand since we are working with large numbers). Clearly it must take more than I am imagining. It is interesting that they can now regularly factor numbers of more than 200 digits easily, but then we can still exponentially increase the difficulty by adding more digits so I suppose that is not terribly encouraging. I noticed we were not required to read section 6.4.2, are these methods not as useful, or not as simple?

Section 6.4 up to 6.4.1, Due October 22

Difficult: I fail to see how the p-1 factoring algorithm is much more useful than Fermat's method. It seems you are still just picking a random number and making a wish. Also, it seems possible that, for p large enough, you can easily miss on picking a B such that p-1 divides B!. While it does also discuss HOW the algorithm works, it doesn't seem to mention much about WHY it works. If I just pick a=2, then it seems that I am hoping that the only small prime factor of p-1 is 2, since if p-1 had another small prime factor then it would not make sense for p-1 to divide a^B!. Maybe I'm just not thinking of it correctly because of the modulus?

Reflective: I'm really excited to learn about new methods of factoring numbers. Up until now, I had only know the conventional method, I had not even been aware of Fermat's method. The p-1 algorithm is confusing though. I do not see why it would work, and why you would not have more success just picking a random number. Also, does it only work on products of two primes, or can it work on products of more than two primes? I would imagine that we could make it work on products of more than one prime by picking larger bounds B to try to get the next largest prime, or simply trying to factor the next number after dividing by the first prime factor that we discover.

Section 6.3, Due October 20

Difficult: I do not understand how this fits in with what we have discussed about RSA so far. It seems that you can use the Miller-Rabin method to "break" RSA pretty readily, since n is definitely composite. Choosing a random number a, it seems that chances are high you would then be able to follow the procedure in the example on page 178 to find one of the primes p or q, and then use that knowledge to find the other. So is RSA not secure after all? I didn't fully understand the discussion of why the test works on page 179, but I think I might after reading it a few more times. It is just hard to follow.

Reflective: I didn't realize how easy it was to find primes. I recognize that neither of these tests prove primality for a number, but they seem to give a pretty sure bet. I notice that they mention strong pseudoprimes for multiple bases, in fact there is even one for all bases that are primes less than 200. Is this psuedoprime also good for nonprime bases less than 200? The statistics are given for the possibility of a number being a psuedoprime for some chosen base, and I'm not well versed in statistics, but it seems to me that picking more than one base to check and making sure some are prime and some are composite will raise the possibility of discovering if the number you are testing is a composite or not by a great deal.

Section 3.10, Due October 18

Difficult: The two methods for deciding if a number is a square mod another number (either prime or a non even composite of primes) is interesting, but does not seem very useful. As it mentions at the end, if we find that the Jacobi symbol of a mod n is +1, then we still do not really know if it is a square root, and should we decide that it is we have no way of finding what square root it is if we cannot factor n. Since the point was to have an n that is difficult to factor, this does not seem very useful. I appreciated that the section came out and said at the end that the Jacobi symbol does not give an answer to whether a is truly a square root or not. As it started that part of the section, it seemed to say that this would tell you whether a was or was not a square root mod n. In fact, even in the last example it seems to say this is true, so I might still be confused about it.

Reflective: We seem to be doing alot with prime numbers that seems to have no practical use in cryptography...yet. I'm holding out hope that we see the use of these symbols as we go on. It is nice to be able to quickly tell if something is a square root, but seems pretty useless in application given how the RSA system works. If I know it is a square root, how does that help me to break the code?