TEXT 68
Diffiehellman_cryptography.pdf Guest on 5th June 2020 10:45:06 AM
  1. New Directions in Cryptography
  2. Invited Paper
  3. Whitfield Diffie and Martin E. Hellman
  4. Abstract Two kinds of contemporary developments in cryp- communications over an insecure channel order to use cryptogtography are examined. Widening applications of teleprocess- raphy to insure privacy, however, it currently necessary for the
  5. ing have given rise to a need for new types of cryptographic communicating parties to share a key which is known to no
  6. systems, which minimize the need for secure key distribution one else. This is done by sending the key in advance over some
  7. channels and supply the equivalent of a written signature. This secure channel such a private courier or registered mail. A
  8. paper suggests ways to solve these currently open problems. private conversation between two people with no prior acquainIt also discusses how the theories of communication and compu- tance is a common occurrence in business, however, and it is
  9. tation are beginning to provide the tools to solve cryptographic unrealistic to expect initial business contacts to be postponed problems of long standing. long enough for keys to be transmitted by some physical means.
  10. The cost and delay imposed by this key distribution problem
  11. is a major barrier to the transfer of business communications
  12. 1 INTRODUCTION to large teleprocessing networks.
  13. Section III proposes two approaches to transmitting keying We stand today on the brink of a revolution in cryptography. information over public (i.e., insecure) channel without compro- The development of cheap digital hardware has freed it from mising the security of the system. In public key cryptosystem the design limitations of mechanical computing and brought enciphering and deciphering are governed by distinct keys, E the cost of high grade cryptographic devices down to where and D,such that computing D from E is computationally infeasi- they can be used in such commercial applications as remote ble (e.g., requiring 10100 instructions). The enciphering key cash dispensers and computer terminals. In turn, such applica- E can thus be publicly disclosed without compromising the tions create a need for new types of cryptographic systems deciphering key D. Each user of the network can, therefore, which minimize the necessity of secure key distribution chan- place his enciphering key in a public directory. This enables nels and supply the equivalent of a written signature. At the any user of the system to send a message to any other user same time, theoretical developments in information theory and enciphered in such a way that only the intended receiver is computer science show promise of providing provably secure able to decipher it. As such, a public key cryptosystem is cryptosystems, changing this ancient art into a science.
  14. The development of computer controlled communication net- multiple access cipher. A private conversation can therefore be
  15. works promises effortless and inexpensive contact between peo- held between any two individuals regardless of whether they
  16. ple or computers on opposite sides of the world, replacing most have ever communicated before. Each one sends messages to
  17. mail and many excursions with telecommunications. For many the other enciphered in the receiver public enciphering key
  18. applications these contacts must be made secure against both and deciphers the messages he receives using his own secret
  19. eavesdropping and the injection of illegitimate messages. At deciphering key.
  20. present, however, the solution of security problems lags well We propose some techniques for developing public key cryptbehind other areas of communications technology. Contempo- osystems, but the problem is still largely open.
  21. rary cryptography is unable to meet the requirements, in that Public key distribution systems offer a different approach to
  22. its use would impose such severe inconveniences on the system eliminating the need for a secure key distribution channel. In
  23. users, as to eliminate many of the benefits of teleprocessing. such a system, two users who wish to exchange a key communiThe best known cryptographic problem is that of privacy: cate back and forth until they arrive a key in common. A third preventing the unauthorized extraction of information from party eavesdropping on this exchange must find it computationally infeasible to compute the key from the information overManuscript received June 3, 1976. This work was partially supported by heard. A possible solution to the public key distribution problem the National Science Foundation under NSF Grant ENG 10173. Portions of is given in Section III, and Merkle [1] has a partial solution of this work were presented at the IEEE Information Theory Workshop, Lenox,
  24. MA, June 23–25, 1975 and the IEEE International Symposium on Information a different form.
  25. Theory in Ronneby, Sweden, June 21–24, 1976. A second problem, amenable to cryptographic solution which
  26. W. Diffie is with the Department of Electrical Engineering, Stanford Univer- stands in the way of replacing contemporary business communi- sity, Stanford, CA, and the Stanford Artificial Intelligence Laboratory, Stanford, cations by teleprocessing systems is authentication. In current CA 94305.
  27. M. E. Hellman is with the Department of Electrical Engineering, Stanford business, the validity of contracts guaranteed by signatures. A
  28. University, Stanford, CA 94305. signed contract serves as gal evidence of an agreement which
  29. 29
  30. 30 DIFFIE AND HELLMAN
  31. the holder can present in court if necessary. The use of signa- the unauthorized injection of messages into a public channel,
  32. tures, however, requires the transmission and storage of written assuring the receiver of a message of the legitimacy of its sender.
  33. contracts. In order to have a purely digital replacement for his A channel is considered public if its security is inadequate
  34. paper instrument, each user must be able to produce message for the needs of its users. A channel such as a telephone line
  35. whose authenticity can be checked by anyone, but which could may therefore be considered private by some users and public
  36. not have been produced by anyone else, even the recipient. by others. Any channel may be threatened with eavesdropping
  37. Since only one person can originate messages but many people or injection or both, depending on its use. In telephone commucan receive messages, this can be viewed as a broadcast cipher. nication, the threat of injection is paramount, since the called
  38. Current electronic authentication techniques cannot meet this party cannot determine which phone is calling. Eavesdropping,
  39. need. which requires the use of a wiretap, is technically more difficult
  40. Section IV discusses the problem of providing a true, digtal, and legally hazardous. In radio, by comparison, the situation
  41. message dependent signature. For reasons brought but there, is reversed. Eavesdropping is passive and involves no legal
  42. we refer to this as the one-way authentication problem. Some hazard, while injection exposes the illegitimate transmitter to
  43. partial solutions are given, and it is shown how any public key discovery and prosecution.
  44. cryptosystem can be transformed into a one-way authentica- Having divided our problems into those of privacy and
  45. tion system. authentication we will sometimes further subdivide authenticaSection V will consider the interrelation of various crypto- tion into message authentication, which is the problem defined
  46. graphic problems and introduce the even more difficult problem above, and user authentication, in which the only task of the
  47. of trap doors. system is to verify that an individual is who he claims to be.
  48. At the same time that communications and computation have For example, the identity of an individual who presents a credit
  49. given rise to new cryptographic problems, their off-ring, infor- card must be verified, but there is no message which he wishes
  50. mation theory, and the theory of computation have begun to to transmit. In spite of this apparent absence of a message in
  51. supply tools for the solution of important problems in classi- user authentication, the two problems are largely equivalent.
  52. cal cryptography. In user authentication, there is an implicit message. “I AM
  53. The search for unbreakable codes is one of the oldest themes USER X,” while message authentication is just verification of
  54. of cryptographic research, but until this century proposed sys- the identity of the party sending the message. Differences in
  55. tems have ultimately been broken. In the nineteen twenties, the threat environments and other aspects of these two subprohowever, the “one time pad” was inated, and shown to be blems, however, sometimes make it convenient to distinguish
  56. unbreakable [2, pp. 398–400]. The theoretical basis underlying between them.
  57. this and related systems was on a firm foundation a quarter Figure 1 illustrates the flow of information in a conventional
  58. century later by information theory [3]. One time pads require cryptographic system used for privacy of communications.
  59. extremely long days and are therefore prohibitively expensive There are three parties: a transmitter, a receiver, and an eavesin most applications. dropper. The transmitter generates a plaintext or unenciphered
  60. In contrast, the security of most cryptographic systems message P to be communicated over an insecure channel to
  61. besides in the computational difficulty to the cryptanalyst dis- the legitimate receiver. In order to prevent the eavesdropper
  62. covering the plaintext without knowledge of the key. This prob- from learning P, the transmitter perates on P with an invertible
  63. lem falls within the domains of computational complexity and transformation SK to produce the ciphertext or cryptogram C
  64. analysis of algorithms, two recent disciples which study the 5 SK(P). The key K is transmitted only to the legitimate receiver
  65. difficulty of solving computational problems. Using the results via a secure channel, indicated by a shielded path in Figure 1.
  66. of these theories, it may be possible to extend proofs of security Since the legitimate receiver knows K, he can decipher C by
  67. to more useful classes systems in the foreseeable future. Section operating with SK
  68. 21 to obtain SK
  69. 21
  70. (C) 5 SK
  71. 21
  72. (SK(P)) 5 P, the
  73. VI explores this possibility. original plaintext message. The secure channel cannot be used
  74. Before proceeding to newer developments, we introduce ter- to transmit P itself for reasons of capacity or delay. For example,
  75. minology and define threat environments in the next section.
  76. 2 CONVENTIONAL CRYPTOGRAPHY
  77. Cryptography is the study of “mathematical” systems involving
  78. two kinds of security problems: privacy and authentication. A
  79. privacy system prevents the extraction information by unauthorized parties from messages transmitted over a public channel,
  80. thus assuring the sender of a message that it is being read only Figure 1: Flow of informatrion in conventional cryptographic
  81. by the intended recipient. An authentication system prevents system.
  82. NEW DIRECTIONS IN CRYPTOGRAPHY 31
  83. the secure channel might be a weekly courier and the insecure added modulo 2 to the bits of the plaintext. Block ciphers act
  84. channel a telephone line. in a purely combinatorial fashion on large blocks of text, in
  85. A cryptographic system is a single parameter family such a way that a small change in the input block produces a
  86. {SK};zKP{K;z} of invertible transformations major change in the resulting output. This paper deals primarily
  87. with block ciphers, because this error propagation property is
  88. SK:{P} → {C} (1) valuable in many authentication applications.
  89. In an authentication system, cryptography is used to guaranfrom a space {P} of plaintext messages to a space {C} of tee the authenticity of the message to the receiver. Not only
  90. ciphertext messages. The parameter K is called the key and is must a meddler be prevented from injecting totally new, authenselected from a finite set {K} called the keyspace. If the message tic looking messages into a channel, but he must be prevented
  91. spaces {P} and {C} are equal, we will denote them both by {M}. from creating apparently authentic messages by combining, or
  92. When discussing individual cryptographic transformations SK, merely repeating, old messages which he has copied in the
  93. we will sometimes omit mention of the system and merely past. A cryptographic system intended to guarantee privacy
  94. refer to the transformation K. will not, in general, prevent this latter form of mischief.
  95. The goal in designing the cryptosystem {SK} is to make To guarantee the authenticity of a message, information is
  96. the enciphering and deciphering operations inexpensive, but to added which is a function not only of the message and a secret
  97. ensure that any successful cryptanalytic operation is too com- key, but of the date and time as well, for example, by attaching
  98. plex to be economical. There are two approaches to this prob- the date and time to each message and encrypting the entire
  99. lem. A system which is secure due to the computational cost sequence. This assures that only someone who possesses the
  100. of cryptanalysis, but which would succumb to an attack with key can generate a message which, when decrypted, will contain
  101. unlimited computation, is called computationally secure; while the proper date and time. Care must be taken, however, to use
  102. a system which can resist any cryptanalytic attack, no matter a system in which small changes in the ciphertext result in
  103. how much computation is allowed, is called unconditionally large changes in the deciphered plaintext. This intentional error
  104. secure. Unconditionally secure systems are discussed in [3] and propagation ensures that if the deliberate injection of noise on
  105. [4] and belong to that portion of information theory, called the the channel changes a message such as “erase file 7” into a
  106. Shannon theory, which is concerned with optimal performance different message such as “erase file 8,” it will also corrupt the
  107. obtainable with unlimited computation. authentication information. The message will then be rejected
  108. Unconditional security results from the existence of multiple as inauthentic.
  109. meaningful solutions to a cryptogram. For example, the simple The first step in assessing the adequacy of cryptographic
  110. substitution cryptogram XMD resulting from English text can systems is to classify the threats to which they are to be subrepresent the plaintext messages: now, and, the, etc. A computa- jected. The following threats may occur to cryptographic systionally secure cryptogram, in contrast, contains sufficient tems employed for either privacy or authentication.
  111. information to uniquely determine the plaintext and the key. A ciphertext only attack is a cryptanalytic attack in which
  112. Its security resides solely in the cost of computing them. the cryptanalyst possesses only ciphertext.
  113. The only unconditionally secure system in common use is A known plaintext attack is a cryptanalytic attack in which the
  114. the one time pad, in which the plaintext is combined with a cryptanalyst possesses a substantial quantity of corresponding
  115. randomly chosen key of the same length. While such a system plaintext and ciphertext.
  116. is provably secure, the large amount of key required makes it A chosen plaintext attack is a cryptanalytic attack in which
  117. impractical for most applications. Except as otherwise noted, the cryptanalyst can submit an unlimited number of plaintext
  118. this paper deals with computationally secure systems since messages of his own choosing and examine the resulting
  119. these are more generally applicable. When we talk about the cryptograms.
  120. need to develop provably secure cryptosystems we exclude In all cases it is assumed that the opponent knows the general
  121. those, such as the one time pad, which are unwieldly to use. system {SK} in use since this information can be obtained by
  122. Rather, we have in mind systems using only a few hundred studying a cryptographic device. While many users of cryptogbits of key and implementable in either a small amount of raphy attempt to keep their equipment secret, many commercial
  123. digital hardware or a few hundred lines of software. applications require not only that the general system be public
  124. We will call a task computationally infeasible if its cost as but that it be standard.
  125. measured by either the amount of memory used or the runtime A ciphertext only attack occurs frequently in practice. The
  126. is finite but impossibly large. cryptanalyst uses only knowledge of the statistical properties
  127. Much as error correcting codes are divided into convolutional of the language in use (e.g., in English, the letter e occurs 13
  128. and block codes, cryptographic systems can be divided into percent of the time) and knowledge of certain “probable” words
  129. two broad classes: stream ciphers and block ciphers. Stream (e.g., a letter probably begins “Dear Sir:”). It is the weakest
  130. ciphers process the plaintext in small chunks (bits or characters), threat to which a system can be subjected, and any system
  131. usually producing a pseudorandom sequence of bits which is which succumbs to it is considered totally insecure.
  132. 32 DIFFIE AND HELLMAN
  133. The system which is secure against a known plaintext attends also protect against the threat of dispute. That is, a message
  134. frees its users from the need to keep their past messages secret, may be sent but later repudiated by either the transmitter or
  135. or to paraphrase them prior to classification. This is an unreason- the receiver. Or, it may be alleged by either party that a message
  136. able burden to place on the systems users, particularly in com- was sent when in fact none was. Unforgeable digital signatures
  137. mercial situations where luct announcements or press releases and receipts are needed. For example, a dishonest stockbroker
  138. may be sent in typted form for later public disclosure. Similar might try to cover up unauthorized buying and selling for
  139. situations in diplomatic correspondence have led to the cracking personal gain by forging orders from clients, or a client might
  140. many supposedly secure systems. While a known text attack disclaim an order actually authorized by him but which he later
  141. is not always possible, its occurrence is uent enough that a sees will cause a loss. We will introduce concepts which allow
  142. system which cannot resist it is not considered secure. the receiver to verify the authenticity of a message, but prevent
  143. The chosen plaintext attack is difficult to achieve in justice, him from generating apparently authentic messages, thereby
  144. but can be approximated. For example, submitted to a proposal protecting against both the threat of compromise of the receivto a competitor may result in his enciphering it for transmission er’s authentication data and the threat of dispute.
  145. to his headquarters. A cipher which is secure against a chosen
  146. plaintext attack thus frees users from concern over whether
  147. their opponents can t messages in their system. 3 PUBLIC KEY CRYPTOGRAPHY
  148. For the purpose of certifying systems as secure, it is appro- As shown in Figure 1, cryptography has been a derivative priate to consider the more formidable cryptanalytic as these security measure. Once a secure channel exists along which not only give more realistic models of the caring environment keys can be transmitted, the security can be extended to other of a cryptographic system, but make assessment of the system’s channels of higher bandwidth or smaller delay by encrypting strength easier. Many systems which are difficult to analyze the messages sent on them. The effect has been to limit the using a ciphertext only check can be ruled out immediately use of cryptography to communications among people who under known plaining or chosen plaintext attacks. have made prior preparation for cryptographic security. It is clear from these definitions, cryptanalysis is a identifica- In order to develop large, secure, telecommunications sys- tion problem. The known plaintext and even plaintext attacks tems, this must be changed. A large number of users n results correspond to passive and active identification problems, in an even larger number, (n2 2 n)/2 potential pairs who may respectively. Unlike many effects in which system identification wish to communicate privately from all others. It is unrealistic is considered, such automatic fault diagnosis, the goal in cryp- to assume either that a pair of users with no prior acquaintance tography is build systems which are difficult, rather than easy, will be able to wait for a key to be sent by some secure physical to identify. means, or that keys for all (n The chosen plaintext attack is often called an IFF attack 2 2 n)/2 pairs can be arranged in
  149. advance. In another paper [5], the authors have considered a terminology which descends from its origin in the development conservative approach requiring no new development in cryp- of cryptographic “identification friend or systems after World
  150. War II. An IFF system enables ary radars to distinguish between tography itself, but this involves diminished security, inconvenience, and restriction of the network to a starlike configuration friendly and enemy es automatically. The radar sends a time- with respect to initial connection protocol. varying enge to the airplane which receives the challenge, pts We propose that it is possible to develop systems of the type it under the appropriate key, and sends it back to radar. By shown in Figure 2, in which two parties communicating solely comparing this response with a correctly pted version of the over a public channel and using only publicly known techniques challenge, the radar can recognize kindly aircraft. While the can create a secure connection. We examine two approaches aircraft are over enemy territory, enemy cryptanalysts can send to this problem, called public key cryptosystems and public key challenges and expect the encrypted responses in an attempt distribution systems, respectively. The first are more powerful, to determine authentication key in use, thus mounting a chosen lending themselves to the solution of the authentication prob- text attack on the system. In practice, this threat is entered lems treated in the next section, while the second are much by restricting the form of the challenges, which are not be closer to realization. unpredictable, but only nonrepeating.
  151. There are other threats to authentication systems which cannot be treated by conventional cryptography, and with require
  152. recourse to the new ideas and techniques reduced in this paper.
  153. The threat of compromise of the ver’s authentication data is
  154. motivated by the situation multiuser networks where the
  155. receiver is often the system itself. The receiver’s password
  156. tables and other authentication data are then more vulnerable
  157. to theft than those of the transmitter (an individual user). As
  158. shown later, some techniques for protecting against this threat Figure 2: Flow of information in public key system.
  159. NEW DIRECTIONS IN CRYPTOGRAPHY 33
  160. A public key cryptosystem is a pair of families {EK}KP{K} involves a matrix in version which is a harder problem. And
  161. and {DK}KP it is at least conceptually simpler to obtain an arbitrary pair of {K} of algorithms representing invertible
  162. transformations, inverse matrices than it is to invert a given matrix. Start with
  163. the identity matrix I and do elementary row and column operaEK:{M} → {M} (2) tions to obtain an arbitrary invertible matrix E. Then starting
  164. with I do the inverses of these same elementary operations in
  165. reverse order to obtain D 5 E21. The sequence of elementary
  166. DK:{M} → {M} (3) operations could be easily determined from a random bit string.
  167. Unfortunately, matrix inversion takes only about n3 operaon a finite message space {M}, such that tions. The ratio of “cryptanalytic” time (i.e., computing D from
  168. E) to enciphering or deciphering time is thus at most n, and 1) for every K P {K}, EK is the inverse of DK, enormous block sizes would be required to obtain ratios of 106
  169. 2) for every K P {K} and M P {M}, the algorithms EK and or greater. Also, it does not appear that knowledge of the DK are easy to compute, elementary operations used to obtain E from I greatly reduces 3) for almost every K P {K}, each easily computed algo- the time for computing D. And, since there is no round-off rithm equivalent to DK is computationally infeasible to error in binary arithmetic, numerical stability is unimportant in derive from EK, the matrix inversion. In spite of its lack of practical utility, this 4) for every K P {K}, it is feasible to compute inverse pairs matrix example is still useful for clarifying the relationships EK and DK from K. necessary in a public key cryptosystem.
  170. Because of the third property, a user’s enciphering key EK can A more practical approach to finding a pair of easily combe made public without compromising the security of his secret puted inverse algorithms E and D; such that D is hard to infer
  171. deciphering key DK. The cryptographic system is therefore split from E, makes use of the difficulty of analyzing programs in
  172. into two parts, a family of enciphering transformations and a low level languages. Anyone who has tried to determine what
  173. family of deciphering transformations in such a way that, given operation is accomplished by someone else’s machine language
  174. a member of one family, it is infeasible to find the corresponding program knows that E itself (i.e., what E does) can be hard to
  175. member of the other. infer from an algorithm for E. If the program were to be made
  176. The fourth property guarantees that there is a feasible way purposefully confusing through addition of unneeded variables
  177. of computing corresponding pairs of inverse transformations and statements, then determining an inverse algorithm could be
  178. when no constraint is placed on what either the enciphering or made very difficult. Of course, E must be complicated enough to
  179. deciphering transformation is to be. In practice, the cryptoequip- prevent its identification from input—output pairs.
  180. ment must contain a true random number generator (e.g., a Essentially what is required is a one-way compiler: one which
  181. noisy diode) for generating K, together with an algorithm for takes an easily understood program written in a high level
  182. generating the EK 2 DK pair from its outputs. language and translates it into an incomprehensible program
  183. Given a system of this kind, the problem of key distribution in some machine language. The compiler is one-way because
  184. is vastly simplified. Each user generates a pair of inverse trans- it must be feasible to do the compilation, but infeasible to
  185. formations, E and D, at his terminal. The deciphering transfor- reverse the process. Since efficiency in size of program and
  186. mation D must be kept secret, but need never be communicated run time are not crucial in this application, such as compilers
  187. on any channel. The enciphering key E can be made public by may be possible if the structure of the machine language can
  188. placing it in a public directory along with the user’s name and be optimized to assist in the confusion.
  189. address. Anyone can then encrypt messages and send them to Merkle [1] has independently studied the problem of distribthe user, but no one else can decipher messages intended for uting keys over an insecure channel. His approach is different
  190. him. Public key cryptosystems can thus be regarded as multiple from that of the public key cryptosystems suggested above,
  191. access ciphers. and will be termed a public key distribution system. The goal
  192. It is crucial that the public file of enciphering keys be pro- is for two users, A and B, to securely exchange a key over an
  193. tected from unauthorized modification. This task is made easier insecure channel. This key is then used by both users in a
  194. by the public nature of the file. Read protection is unnecessary normal cryptosystem for both enciphering and deciphering.
  195. and, since the file is modified infrequently, elaborate write Merkle has a solution whose cryptanalytic cost grows as n2
  196. protection mechanisms can be economically employed. where n is the cost to the legitimate users. Unfortunately the
  197. A suggestive, although unfortunately useless, example of a cost to the legitimate users of the system is as much in transmispublic key cryptosystem is to encipher the plaintext, represented sion time as in computation, because Merkle’s protocol requires
  198. as a binary n-vector m, by multiplying it by an invertible binary n potential keys to be transmitted before one key can be decided
  199. n 3 n matrix E. The cryptogram thus equals Em. Letting D 5 on. Merkle notes that this high transmission overhead prevents
  200. E21 we have m 5 Dc. Thus, both enciphering and deciphering the system from being very useful in practice. If a one megabit
  201. require about n limit is placed on the setup protocol’s overhead, his technique 2 operations. Calculation of D from E, however,
  202. 34 DIFFIE AND HELLMAN
  203. can achieve cost ratios approximately 10 000 to 1, which are as their key. User i obtains Kij by obtaining Yj from the public
  204. too small for most applications. If inexpensive, high bandwidth file and letting
  205. data links come available, ratios of a million to one or greater
  206. could achieved and the system would be of substantial practi- Kij 5 Yj
  207. Xi mod q (9)
  208. cal value.
  209. We now suggest a new public key distribution system which
  210. has several advantages. First, it requires only one ‘‘key’’ to 5 (aXj
  211. )
  212. Xi mod q (10) be exchanged. Second, the cryptanalytic effort bears to grow
  213. exponentially in the effort of the legitimate users. And, third,
  214. its use can be tied to a public file of user information which 5 aXjXi 5 aXjXi mod q. (11) serves to authenticate user A to user B vice versa. By making the
  215. public file essentially a read memory, one personal appearance User j obtains Kij in the similar fashion allows a user to authenticate his identity many times to many
  216. users. rkle’s technique requires A and B to verify each other’s
  217. Kij 5 Yi
  218. Xj mod q. (12) activities through other means.
  219. The new technique makes use of the apparent difficulty
  220. Another user must compute Kij from Yi and Yj computing logarithms over a finite field GF , for example, (q) with a one
  221. number q of elements. Let by computing
  222. Kij 5 Yi Y 5 a (logaYj) mod q. (13) x mod q, for 1 # X # q 2 1, (4)
  223. Here a is a fixed primitive element of GF(q), then X is arranged We thus see that if logs mod q are easily computed the system
  224. to as the logarithm of Y to the base a, mod q: can be broken. While we do not currently have a proof of the
  225. converse (i.e., that the system is secure if logs mod q are
  226. X 5 loga Y mod q, for 1 # Y # q 2 1. (5) difficult to compute), neither do we see any way to compute
  227. Kij from Yi and Yj without first obtaining either Xi or Xj.
  228. Calculation of Y from X is easy, taking at most 2 3 log2 q If q is a prime slightly less than 2b
  229. , then all quantities are
  230. multiplications [6, pp. 398–422]. For example, for X 5 representable as b bit numbers. Exponentiation then takes at
  231. most 2b multiplications mod q, while by hypothesis taking logs
  232. Y 5 a18 5 (((a2
  233. )
  234. 2
  235. )
  236. 2
  237. )
  238. 2 3 a2
  239. . (6) requires q1/2 5 21/2 operations. The cryptanalytic effort therefore
  240. grows exponentially relative to legitimate efforts. If b 5 200,
  241. Computing X from Y, on the other hand can be much more cult then at most 400 multiplications are required to compute Yi
  242. and, for certain carefully chosen values of q, requires on the from Xi, or Kij from Yi and Xj, yet taking logs mod q requires
  243. order of q1/2 operations, using the best known ithm [7, pp. 9, 2100 or approximately 1030 operations.
  244. 575–576], [8].
  245. The security of our technique depends crucially on the seculty
  246. of computing logarithms mod q, and if an algorithm whose 4 ONE-WAY AUTHENTICATION
  247. complexity grew as log2q were to be found, our m would be
  248. broken. While the simplicity of the problem statement might The problem of authentication is perhaps an even more serious
  249. allow such simple algorithms, right instead allow a proof of barrier to the universal adoption of telecommunications for
  250. the problem’s difficulty. How we assume that the best known business transactions than the problem of key distribution.
  251. algorithm for uting logs mod q is in fact close to optimal and Authentication is at the heart of any system involving contracts
  252. hence q1/2 is a good measure of the problem’s complexity, and billing. Without it, business cannot function. Current elecproperly chosen q. tronic authentication systems cannot meet the need for a purely
  253. Such user generates an independent random number chosen digital, unforgeable, message dependent signature. They prouniformly from the set of integers {1,2, ???, q—such keeps vide protection against third party forgeries, but do not protect
  254. Xi secret, but places against disputes between transmitter and receiver.
  255. In order to develop a system capable of replacing the current
  256. Y written contract with some purely electronic form of communi- i 5 aXi mod q (7)
  257. cation, we must discover a digital phenomenon with the same
  258. Public file with his name and address. When users i wish to properties as a written signature. It must be easy for anyone to
  259. communicate privately, they use recognize the signature as authentic, but impossible for anyone
  260. other than the legitimate signer to produce it. We will call any
  261. K such technique one-way authentication. Since any digital signal ij 5 aXiXj mod q (8)
  262. NEW DIRECTIONS IN CRYPTOGRAPHY 35
  263. can be copied precisely, a true digital signature must be recog- a value y and knowledge of f, to calculate any x whatsoever
  264. nizable without being known. with the property that f(x) 5 y. Indeed, if f is noninvertible in
  265. Consider the “login” problem in a multiuser computer sys- the usual sense, it may make the task of finding an inverse
  266. image easier. In the extreme, if f(x) [ y0 tem. When setting up his account, the user chooses a password for all x in the domain,
  267. which is entered into the system’s password directory. Each then the range of f is {y0}, and we can take any x as f
  268. 21
  269. (y0).
  270. time he logs in, the user is again asked to provide his password. It is therefore necessary that f not be too degenerate. A small
  271. By keeping this password secret from all other users, forged degree of degeneracy is tolerable and, as discussed later, is
  272. logins are prevented. This, however, makes it vital to preserve probably present in the most promising class of one-way
  273. the security of the password directory since the information it functions.
  274. contains would allow perfect impersonation of any user. The Polynomials offer an elementary example of one-way funcproblem is further compounded if system operators have legiti- tions. It is much harder to find a root x0 of the polynomial
  275. mate reasons for accessing the directory. Allowing such legiti- equation p(x) 5 y than it is to evaluate the polynomial p(x) at
  276. mate accesses, but preventing all others, is next to impossible. x 5 x0. Purdy [11] has suggested the use of sparse polynomials
  277. This leads to the apparently impossible requirement for a of very high degree over finite fields, which appear to have
  278. new login procedure capable of judging the authenticity of very high ratios of solution to evaluation time. The theoretical
  279. passwords without actually knowing them. While appearing to basis for one-way functions is discussed at greater length in
  280. be a logical impossibility, this proposal is easily satisfied. When Section VI. And, as shown in Section V, one-way functions
  281. the user first enters his password PW, the computer automati- are easy to devise in practice.
  282. cally and transparently computes a function f(PW) and stores The one-way function login protocol solves only some of
  283. this, not PW, in the password directory. At each successive the problems arising in a multiuser system. It protects against
  284. login, the computer calculates f(X), where X is the proffered compromise of the system’s authentication data when it is not
  285. password, and compares f(X) with the stored value f(PW). If in use, but still requires the user to send the true password to
  286. and only if they are equal, the user is accepted as being authen- the system. Protection against eaves-dropping must be provided
  287. tic. Since the function f must be calculated once per login, its by additional encryption, and protection against the threat of
  288. computation time must be small. A million instructions (costing dispute is absent altogether.
  289. approximately $0.10 at bicentennial prices) seems to be a rea- A public key cryptosystem can be used to produce a true
  290. sonable limit on this computation. If we could ensure, however, one-way authentication system as follows. If user A wishes to
  291. that calculation of f send a message M to user B, he “deciphers” it in his secret 21 required 1030 or more instructions, someone who had subverted the system to obtain the password deciphering key and sends DA(M). When user B receives it, he
  292. directory could not in practice obtain PW from f(PW), and can read it, and be assured of its authenticity by “enciphering”
  293. could thus not perform an unauthorized login. Note that f(PW) it with user A’s public enciphering key EA. B also saves DA(M)
  294. is not accepted as a password by the login program since it as proof that the message came from A. Anyone can check this
  295. will automatically compute f(f(PW)) which will not match the claim by operating on DA(M) with the publicly known operation
  296. entry f(PW) in the password directory. EA to recover M. Since only A could have generated a message
  297. We assume that the function f is public information, so that with this property, the solution to the one-way authentication
  298. it is not ignorance of f which makes calculation of f problem would follow immediately from the development of 21 difficult.
  299. Such functions are called one-way functions and were first public key cryptosystems.
  300. employed for use in login procedures by R.M. Needham [9, p. One-way message authentication has a partial solution sug91]. They are also discussed in two recent papers [10], [11] gested to the authors by Leslie Lamport of Massachusetts Comwhich suggest interesting approaches to the design of one- puter Associates. This technique employs a one-way function
  301. way functions. f mapping k-dimensional binary space into itself for k on the
  302. More precisely, a function f is a one-way function if, for order of 100. If the transmitter wishes to send an N bit message
  303. any argument x in the domain of f, it is easy to compute the he generates 2N, randomly chosen, k-dimensional binary vectors x1,X1,x2,X2 corresponding value f(x), yet, for almost all y in the range of , ???, xN,XN which he keeps secret. The receiver
  304. f, it is computationally infeasible to solve the equation y 5 f(x) is given the corresponding images under f, namely y1,Y1,y2,Y2
  305. ???,yN,YN. Later, when the message m 5 (m1,m2 for any suitable argument x. , ???,mN) is to
  306. It is important to note that we are defining a function which be sent, the transmitter sends x1 or X1 depending on whether
  307. is not invertible from a computational point of view, but whose m1 5 0 or 1. He sends x2 or X2 depending on whether m2 5
  308. noninvertibility is entirely different from that normally encoun- 0 or 1, etc. The receiver operates with f on the first received
  309. tered in mathematics. A function f is normally called “nonin- block and sees whether it yields y1 or Y1 as its image and thus
  310. vertible” when the inverse of a point y is not unique, (i.e., there learns whether it was x1 or X1, and whether m1 5 0 or 1. In a
  311. similar manner the receiver is able to determine m2,m3 exist distinct points x ,...,mN. 1 and x2 such that f(x1) 5 y 5 f(x2)). We
  312. emphasize that this is not the sort of inversion difficulty that But the receiver is incapable of forging a change in even one
  313. is required. Rather, it must be overwhelmingly difficult, given bit of m.
  314. 36 DIFFIE AND HELLMAN
  315. This is only a partial solution because of the approximately As indicated in Fig. 3, take the cryptosystem {SK:{P} →
  316. 100-fold data expansion required. There is, however, a modifi- KP{K} which is secure against a known plaintext attack, P 5
  317. cation which eliminates the expansion problem when N is P0 and consider the map
  318. roughly a megabit or more. Let g be a one-way mapping from
  319. binary N-space to binary n-space where n is approximately 50. f:{K} → {C} (14)
  320. Take the N bit message m and operate on it with g to obtain
  321. the n bit vector m8. Then use the previous scheme to send m8. defined by
  322. If N 5 106
  323. , n 5 50, and 100, this adds kn 5 5000 authentication
  324. bits to the message. It thus entails only a 5 percent data expan- f(X) 5 SX(P0) (15)
  325. sion during transmission (or 15 percent if the initial exchange
  326. y1,Y1, ???, yN,YN is included). Even though there are large This function is one-way because solving for X given f(X) is
  327. number of other messages (2N2n on the average) with the same equivalent to the cryptanalytic problem of finding the key from
  328. authentication sequence, the one-wayness makes them compu- a single known plaintext-cryptogram pair. Public knowledge
  329. of f is now equivalent to public knowledge of {SK} and P0 tationally infeasible to find and us to forge. Actually g must .
  330. be somewhat stronger than normal one-way function, since an While the converse of this result is not necessarily true, it
  331. opponent has not only but also one of its inverse images m. It is possible for a function originally found in the search for
  332. must be hard even given m to find a different inverse image one-way functions to yield a good cryptosystem. This actually
  333. of m8. Finding such functions appears to offer little trouble (see happened with the discrete exponential function discussed in
  334. Section V). Section III [8].
  335. There is another partial solution to the one-way user authenti- One-way functions are basic to both block ciphers and key
  336. cation problem. The user generates a password which he keeps generators. A key generator is a pseudorandom bit generator
  337. secret. He gives the system f whose output, the keystream, is added modulo 2 to a message T(X), where is a one-way function.
  338. At time t the appropriate authenticator is f T2t
  339. (X), which can be represented in binary form, in imitation of a one-time pad. The
  340. checked by the system by applying ft
  341. (X). Because of the one- key is used as a “seed” which determines the pseudorandom
  342. wayness of f, responses are of no value in forging a new keystream sequence. A known plaintext attack thus reduces to
  343. response. The problem with this solution is that it can require the problem of determining the key from the keystream. For
  344. a fair amount of computation for legitimate login (although the system to be secure, computation of the key from the keysany orders of magnitude less than for forgery). If for example tream must be computationally infeasible. While, for the system
  345. t is incremented every second and the system must work for to be usable, calculation of the keystream from the key must
  346. one month on each password then T 5 2.6 million. Both the be computationally simple. Thus a good key generator is, almost
  347. user and the system must then iterate f average of 1.3 million by definition, a one-way function.
  348. times per login. While not insurmountable, this problem obvi- Use of either type of cryptosystem as a one way function
  349. ously limits use of the technique. The problem could be over- suffers from a minor problem. As noted earlier, if the function
  350. come if a simple method of calculating f f is not uniquely invertible, it is not necessary (or possible) to (2Fn), for n 5 1,2, ???
  351. could be found, much of X8 5 ((X2
  352. )
  353. 2
  354. )
  355. 2
  356. . For then binary decom- find the actual value of X used. Rather any X with the same
  357. positions of T—and t would allow rapid computation of f image will suffice. And, while each mapping SK in a cryptosys- T2t
  358. and ft
  359. . It may be, however, that rapid computation of f n pre- tem must be bijective, there is no such restriction on the function
  360. cludes from being one-way. f from key to cryptogram defined above. Indeed, guaranteeing
  361. that a cryptosystem has this property appears quite difficult. In
  362. a good cryptosystem the mapping f can be expected to have
  363. the characteristics of a randomly chosen mapping (i.e., f(Xi) is 5 PROBLEM INTERRELATIONS AND chosen uniformly from all possible Y, and successive choices
  364. TRAP DOORS are independent). In this case, if X is chosen uniformly and
  365. there are an equal number of keys and messages (X and Y),
  366. In this section, we will show that some of the cryptographic then the probability that the resultant Y has k 1 1 inverses is
  367. problems presented thus far can be reduced to others, thereby
  368. defining a loose ordering according to difficulty. We also introduce the more difficult problem trap doors.
  369. In Section II we showed that a cryptographic system tended
  370. for privacy can also be used to provide authentication against
  371. third party forgeries. Such a system can used to create other
  372. cryptographic objects, as well.
  373. A cryptosystem which is secure against a known maintext
  374. attack can be used to produce a one-way function. Figure 3: Secure cryptosystem used as one-way function.
  375. NEW DIRECTIONS IN CRYPTOGRAPHY 37
  376. approximately e21
  377. /k! for k 5 0,1,2,3,??? . This is a Poisson be no better off than anyone else. The situation is precisely
  378. distribution with mean l 5 1, shifted by 1 unit. The expected analogous to a combination lock. Anyone who knows the comnumber of inverses is thus only 2. While it is possible for f bination can do in seconds what even a skilled locksmith would
  379. to be more degenerate, a good cryptosystem will not be too require hours to accomplish. And yet, if he forgets the combinadegenerate since then the key is not being well used. In the tion, he has no advantage.
  380. worst case, if f(X) [ Y0 for some Y0, we have SK(P0) [ C0, A trap-door cryptosystem can be used to produce a public and encipherment of P0 would not depend on the key at all! key distribution system. While we are usually interested in functions whose domain
  381. and range are of comparable size, there are exceptions. In the For A and B to establish a common private key, chooses a
  382. previous section we required a one-way function mapping long key at random and sends an arbitrary plaintext-cryptogram pair
  383. strings onto much shorter ones. By using a block cipher whose to B. B, who made the trap-door cipher public, but kept the
  384. key length is larger than the blocksize, such functions can be trap-door information secret uses the plaintext-cryptogram pair
  385. obtained using the above technique. to solve for the key. A and B now have a key in common.
  386. Evans et al. [10] have a different approach to the problem There is currently little evidence for the existence of trapof constructing a one-way function from a block cipher. Rather door ciphers. However they are a distinct possibility and should
  387. than selecting a fixed P0 as the input, they use the function be remembered when accepting a cryptosystem from a possible
  388. opponent [12].
  389. f(X) 5 SX(X) (16) By definition, we will require that a trap-door problem be
  390. one in which it is computationally feasible to devise the trap
  391. This is an attractive approach because equations of this form door. This leaves room for yet a third type of entity for which
  392. are generally difficult to solve, even when the family S is we shall use the prefix “quasi.” For example a quasi one-way
  393. comparatively simple. This added complexity, however, function is not one-way in that an easily computed inverse
  394. destroys the equivalence between the security of the system S exists. However, it is computationally infeasible even for the
  395. under a known plaintext attack and the one-wayness of f. designer, to find the easily computed inverse. Therefore a quasi
  396. Another relationship has already been shown in Section IV. one-way function can be used in place of a one-way function
  397. with essentially no loss in security. A public key cryptosystem can be used to generate a one- Losing the trap-door information to a trap-door one-way way authentication system. function makes it into a quasi one-way function, but there may
  398. The converse does not appear to hold, making the construc- also be one-way functions not obtainable in this manner.
  399. tion of a public key cryptosystem a strictly more difficult prob- It is entirely a matter of definition that quasi one-way funclem than one-way authentication. Similarly, a public key tions are excluded from the class of one-way functions. One
  400. cryptosystem can be used as a public key distribution system, could instead talk of one-way functions in the wide sense or
  401. but not conversely. in the strict sense.
  402. Since in a public key cryptosystem the general system in Similarly, a quasi secure cipher is a cipher which will successwhich E and D are used must be public, specifying E specifies fully resist cryptanalysis, even by its designer, and yet for which
  403. a complete algorithm for transforming input messages into there exists a computationally efficient cryptanalytic algorithm
  404. output cryptograms. As such a public key system is really a (which is of course computationally infeasible to find). Again,
  405. set of trap-door one-way functions. These are functions which from a practical point of view, there is essentially no difference
  406. are not really one-way in that simply computed inverses exist. between a secure cipher and a quasi secure one.
  407. But given an algorithm for the forward function it is computa- We have already seen that public key cryptosystems imply
  408. tionally infeasible to find a simply computed inverse. Only the existence of trap-door one-way functions. However the
  409. through knowledge of certain trap-door information (e.g., the converse is not true. For a trap-door one-way function to be
  410. random bit string which produced the E-D pair) can one easily usable as a public key cryptosystem, it must be invertible (i.e.,
  411. find the easily computed inverse. have a unique inverse.)
  412. Trap doors have already been seen in the previous paragraph
  413. in the form of trap-door one-way functions, but other variations
  414. exist. A trap-door cipher is one which strongly resists crypt- 6 COMPUTATIONAL COMPLEXITY
  415. analysis by anyone not in possession of trap-door information
  416. used in the design of the cipher. This allows the designer to Cryptography differs from all other fields of endeavor in the
  417. break the system after he has sold it to a client and yet falsely ease with which its requirements may appear to be satisfied.
  418. to maintain his reputation as a builder of secure systems. It is Simple transformations will convert a legible text into an apparimportant to note that it is not greater cleverness or knowledge ently meaningless jumble. The critic, who wishes to claim that
  419. of cryptography which allows the designer to do what others meaning might yet be recovered by cryptanalysis, is then faced
  420. cannot. If he were to lose the trap-door information he would with an arduous demonstration if he is to prove his point of
  421. 38 DIFFIE AND HELLMAN
  422. view correct. Experience has shown, however, that few systems the NP includes the class P, and one of the great open sections
  423. can resist the concerted attack of skillful cryptanalysts, and in complexity theory is whether the class NP is directly larger.
  424. many supposedly secure systems have subsequently been Among the problems known to be solvable in NP time, not
  425. broken. known to be solvable in P time, are versions of the eling
  426. In consequence of this, judging the worth of new systems salesman problem, the satisfiability problem for positional calhas always been a central concern of cryptographers. During culus, the knapsack problem, the graph ring problem, and many
  427. the sixteenth and seventeenth centuries, mathematical argu- scheduling and minimization problems [13, pp. 363–404], [14].
  428. ments were often invoked to argue the strength of cryptographic We see that it is not lack of interest or effort which has prevented
  429. methods, usually relying on counting methods which showed people from finding solutions in P time for these problems. It
  430. the astronomical number possible keys. Though the problem is thus strongly believed that at least one of these problems
  431. is far too difficult to laid to rest by such simple methods, even must not be in the class P, and that therefore the class NP is
  432. the noted alraist Cardano fell into this trap [2, p. 145]. As strictly larger.
  433. systems those strength had been so argued were repeatedly Karp has identified a subclass of the NP problems, called
  434. broken, the notion of giving mathematical proofs for the secu- NP complete, with the property that if any one of them is in
  435. rity of systems fell into disrepute and was replaced by certica- P, then all NP problems are in P. Karp lists 21 problems which
  436. tion via crypanalytic assault. are NP complete, including all of the problems mentioned During this century, however, the pendulum has begun swing above [14].
  437. back in the other direction. In a paper intimately connected While the NP complete problems show promise for crypto- with the birth of information theory, Shannon showed that the graphic use, current understanding of their difficulty includes one time pad system, which had been use since the late twenties only worst case analysis. For cryptographic purposes, typical offered “perfect secrecy” (a summ of unconditional security). computational costs must be considered. If, however, we replace The probably secure terms investigated by Shannon rely on the worst case computation time with average or typical computa- use of either they whose length grows linearly with the length tion time as our complexity measure, the current proofs of the of the usage or on perfect source coding and are therefore equivalences among the NP complete problems are no longer too provideldy for most purposes. We note that neither public valid. This suggests several interesting topics for research. The cryptosystems nor one-way authentication systems can uncon- ensemble and typicality concepts familiar to information theo- ditionally secure because the public information always deter- rists have an obvious role to play. mines the secret information uniquely among members of a We can now identify the position of the general cryptanalytic finite set. With unlimited computation, problem could therefore problem among all computational problems. be solved by a straightforward touch. The cryptanalytic difficulty of a system whose encryption The past decade has seen the rise of two closely related and decryption operations can be done in P time cannot be deciplines devoted to the study of the costs of computation greater than NP. computational complexity theory and the analysis of loga- To see this, observe that any cryptanalytic problem can be rithms. The former has classified known problems in computing solved by finding a key, inverse image, etc., chosen from a into broad classes by difficulty, while the latter concentrated on finite set. Choose the key nondeterministically and verify in P finding better algorithms and lying the resources they consume. time that it is the correct one. If there are M possible keys to After a brief discussion into complexity theory, we will examine choose from, an M-fold parallelism must be employed. For its application to cryptography, particularly the analysis of one- example in a known plaintext attack, the plaintext is encrypted way functions. simultaneously under each of the keys and compared with the The function is said to belong to the complexity class P (for cryptogram. Since, by assumption, encryption takes only P polynomial) if it can be computed by a deterministic making
  438. Machine in a time which is bounded above by some polynomial time, the cryptanalysis takes only NP time.
  439. We also observe that the general cryptanalytic problem is function of the length of its input. One might think of this as
  440. NP complete. This follows from the breadth of our definition the class of easily computed functions, but more accurate to
  441. say that a function not in this class must be hard to compute of cryptographic problems. A one-way function with an NP
  442. complete inverse will be discussed next. for at least some inputs. There problems which are known not
  443. Cryptography can draw directly from the theory of NP com- to be in the class P [13,405–425].
  444. There are many problems which arise in engineering which plexity by examining the way in which NP complete problems
  445. cannot be solved in polynomial time by any known uniques, can be adapted to cryptographic use. In particular, there is an
  446. unless they are run on a computer with an submited degree of NP complete problem known as the knapsack problem which
  447. parallelism. These problems may or not belong to the class P, lends itself readily to the construction of a one-way function.
  448. but belong to the class NP (nondeterministic, polynomial) of Let Y 5 f(x) 5 a ??? x where a is a known vector of n
  449. intergers (a1,a2, ???, an problems solvable polynomial time on a “nondeterministic” ) and x is a binary n-vector. Calculation
  450. computer (i.e., with an unlimited degree of parallelism). Clearly of y is simple, involving a sum of at most n integers. The
  451. NEW DIRECTIONS IN CRYPTOGRAPHY 39
  452. problem of inverting f is known as the knapsack problem and calculations which could be carried out by hand or with simple
  453. requires finding a subset of the {a slide-rule-like devices. The period immediately after World War i} which sum to y.
  454. Exhaustive search of all 2n subsets grows exponentially and I saw the beginning of a revolutionary trend which is now
  455. is computationally infeasible for n greater than 100 or so. Care coming to fruition. Special purpose machines were developed
  456. must be exercised, however, in selecting the parameters of the for enciphering. Until the development of general purpose digiproblem to ensure that shortcuts are not possible. For example tal hardware, however, cryptography was limited to operations
  457. if n 5 100 and each ai is 32 bits long, y is at most 39 bits which could be performed with simple electromechanical syslong, and f is highly degenerate; requiring on the average only tems. The development of digital computers has freed it from
  458. 238 tries to find a solution. Somewhat more trivially, if ai 5 the limitations of computing with gears and has allowed the
  459. 2 search for better encryption methods according to purely crypto- i21 then inverting f is equivalent to finding the binary decomposition of y. graphic criteria.
  460. This example demonstrates both the great promise and the The failure of numerous attempts to demonstrate soundness
  461. considerable shortcomings of contemporary complexity theory. of cryptographic systems by mathematical proof led to the
  462. The theory only tells us that the knapsack problem is probably paradigm of certification by cryptanalytic attack set down by
  463. difficult in the worst case. There is no indication of its difficulty Kerchoffs [2, p. 234] in the last century. Although some general
  464. for any particular array. It appears, however, that choosing the rules have been developed, which aid the designer in avoiding
  465. {ai} uniformly from {0,1,2, ??? .2n21
  466. } results in a hard problem obvious weaknesses, the ultimate test is an assault on the system
  467. with probability one as n → `. by skilled cryptanalysts under the most favorable conditions
  468. Another potential one-way function, of interest in the analysis (e.g., a chosen plaintext attack). The development of computers
  469. of algorithms, is exponentiation mod q, which was suggested has led for the first time to a mathematical theory of algorithms
  470. to the authors by Prof. John Gill of Stanford University. The which can begin to approach the difficult problem of estimating
  471. one-wayness of this functions has already been discussed in the computational difficulty of breaking a cryptographic system.
  472. Section III. The position of mathematical proof may thus come full circle
  473. and be reestablished as the best method of certification.
  474. The last characteristic which we note in the history of cryp7 HISTORICAL PERSPECTIVE tography is the division between amateur and professional cryptographers. Skill in production cryptanalysis has always been
  475. While at first the public key systems and one-way authentication heavily on the side of the professionals, but innovation, particusystems suggested in this paper appear to be unportended by larly in the design of new types of cryptographic systems,
  476. past cryptographic developments, it is possible to view them has come primarily from the amateurs. Thomas Jefferson, a
  477. as the natural outgrowth of trends in cryptography stretching cryptographic amateur, invented a system which was still in
  478. back hundreds of years. use in World War II [2, pp. 192–195], while the most noted
  479. Secrecy is at the heart of cryptography. In early cryptography, cryptographic system of the twentieth century, the rotor
  480. however, there was a confusion about what was to be kept machine, was invented simultaneously by four separate people,
  481. secret. Cryptosystems such as the Caesar cipher (in which each all amateurs [2, pp. 415, 420, 422–424]. We hope this will
  482. letter is replaced by the one three places further on, so A is inspire others to work in this fascinating area in which participacarried to D, B to E, etc.) depended for their security on keeping tion has been discouraged in the recent past by a nearly total
  483. the entire encryption process secret. After the invention of the government monopoly.
  484. telegraph [2, p. 191], the distinction between a general system
  485. and a specific key allowed the general system to be compromised, for example by theft of a cryptographic device, without REFERENCES
  486. compromising future messages enciphered in new keys. This
  487. principle was codified by Kerchoffs [2, p. 235] who wrote in [1] R. Merkle, “Secure communication over an insecure
  488. 1881 that the compromise of a cryptographic system should channel,” submitted to Communications of the ACM.
  489. cause no inconvenience to the correspondents. About 1960, [2] D. Kahn, The Codebreakers, The Story of Secret Writing.
  490. New York: Macmillan, 1967. cryptosystems were put into service which were deemed strong [3] C. E. Shannon, “Communication theory of secrecy sys- enough to resist a known plaintext cryptanalytic attack, thereby tems,” Bell Syst. Tech. J., vol. 28, pp. 656–715, Oct. 1949. eliminating the burden of keeping old messages secret. Each [4] M. E. Hellman, “An extension of the Shannon theory of these developments decreased the portion of the system approach to cryptography,” submitted to IEEE Trans. which had to be protected from public knowledge, eliminating Inform. Theory, Sept. 1975. such tedious expedients as paraphrasing diplomatic dispatches [5} W. Diffie and M. E. Hellman, “Multiuser cryptographic
  491. before they were presented. Public key systems are a natural techniques, presented at National Computer Confercontinuation of this trend toward decreasing secrecy. ence, New York, June 7–10, 1976.
  492. Prior to this century, cryptographic systems were limited to [6] D. Knuth, The Art of Computer Programming, Vol. 2,
  493. 40 DIFFIE AND HELLMAN
  494. Semi-Numerical Algorithms. Reading, MA.: Addison- [11] G. B. Purdy, “A high security log-in procedure,” CommuWesley, 1969. nication of the ACM, vol. 17, pp. 442–445, Aug. 1974.
  495. [7] ———, The Art of Computer Programming, Vol. 3, Sort- [12] W. Diffie and M. E. Hellman, “Cryptanalysis of the NBS
  496. ing and Searching. Reading, MA.: Addison-Wesley, 1973. data encryption standard” submitted to Computer,
  497. [8] S. Pohlig and M. E. Hellman, “An improved algorithm May 1976.
  498. for computing algorithms in GF(p) and its cryptographic [13] A. V. Aho, J. E. Hopcroft, and J. D. Ullman, The Design
  499. significance,” submitted to IEEE Trans. Inform. Theory. and Analysis of Computer Algorithms. Reading, MA.:
  500. [9] M. V. Wilkes, Time-Sharing Computer Systems. New Addison-Wesley, 1974.
  501. York: Elsevier, 1972. [14] R. M. Karp, “Reducibility among combinatorial prob-
  502. [10] A. Evans, Jr., W. Kantrowitz, and E. Weiss, “A user lems,” Complexity of Computer Computations. R. E.
  503. authentication system not requiring secrecy in the com- Miller and J. Thatcher, Eds. New York: Plenum, 1972,
  504. puter,” Communication of the ACM, vol. 17, pp. 437–442, pp. 85–104.
  505. https://download.tuxfamily.org/0x109/crypto/diffiehellman_cryptography.pdf

Paste is for source code and general debugging text.

Login or Register to edit, delete and keep track of your pastes and more.

Raw Paste

Login or Register to edit or fork this paste. It's free.