RSA Cryptosystem: Key Generation, Encryption, and Decryption

The square and multiply algorithm enables efficient computation of large exponents modulo n by processing the binary representation of the exponent, performing squaring operations for each bit and additional multiplication when the bit is 1, reducing the number of operations from O(e) to O(log e); further optimization using the Chinese Remainder Theorem splits the computation into smaller moduli (p and q) and combines results, providing approximately 4x speedup for RSA decryption while probabilistic primality tests like Fermat's test efficiently verify candidate primes for key generation.

RSA computational complexity centers on modular exponentiation. Efficient computation reduces intermediate results modulo n at each step. Exponentiation optimization uses repeated squaring (binary exponentiation) instead of sequential multiplication, reducing operations from O(e) to O(log e). Key generation requires generating large distinct primes p and q with specific constraints: similar length, large prime factors in p-1 and q-1, and small gcd(p-1, q-1). Public key efficiency selects e in the range 3-17 (commonly 65537). Private key efficiency uses the Chinese Remainder Theorem (CRT) for faster decryption by performing computations modulo p and q separately then combining results.

If GCD(M, n) ≠ 1, then M is divisible by p or q. If M ≡ 0 (mod p), then M^(ed) ≡ 0 (mod p) since ed ≥ 1. Similarly, if M ≡ 0 (mod q), then M^(ed) ≡ 0 (mod q). In both cases, M^(ed) ≡ M (mod p) and M^(ed) ≡ M (mod q). Since p and q are distinct primes, M^(ed) ≡ M (mod n) by the Chinese Remainder Theorem.

To find a number a from its remainders (a1, a2, ..., ak) modulo (m1, m2, ..., mk), use the formula: a = Σ(ai * Mi * yi) mod M, where Mi = M/mi and yi = Mi^(-1) mod mi. For computing large modular exponents a^b mod M, factor M into coprime factors, compute a^b mod mi for each factor using Fermat's Little Theorem or Euler's Theorem, then combine results using CRT. For efficient computation without full exponentiation, use binary exponentiation: express b in binary, compute a^(2^k) mod M by repeated squaring, and multiply results for set bits. This method is essential for cryptographic applications and large number computations.

The Chinese Remainder Theorem enables efficient RSA decryption by breaking down the decryption operation into smaller computations modulo the prime factors of the public modulus n, significantly reducing computational complexity; specifically, instead of computing C^d mod n directly, one computes C^d mod p and C^d mod q separately (where n = p × q), then combines the results using the theorem, with further efficiency gains achieved by reducing exponents modulo φ(p) and φ(q) using Euler's theorem.

This section details the RSA digital signature algorithm: (1) Sender computes hash H(m), (2) Encrypts hash with private key: s = H(m)^d mod n, (3) Sends message and signature, (4) Receiver decrypts with public key: H(m) = s^e mod n, (5) Compares with computed hash. The security relies on the difficulty of factoring n to derive the private key. RSA signatures provide three properties: sender authentication (only private key holder could sign), message integrity (hash changes with any modification), and non-repudiation (sender cannot deny signing). The algorithm is efficient because it signs only the small hash value rather than large documents.

RSA digital signatures provide authentication and non-repudiation. The signing process: (1) Compute hash h = H(M) of the message, (2) Sign by computing S = h^D mod N using the private key. Verification: (1) Compute h' = S^E mod N using the public key, (2) Verify h' = H(M). This ensures only the holder of the private key could have created the signature, while anyone with the public key can verify it. The signature is always created with the private key, unlike encryption which uses the public key.

This section covers digital signatures: (1) Provide authentication, message integrity, and non-repudiation, (2) Three algorithms: key generation, signing (using private key), verification (using public key), (3) RSA signatures: signature = m^d mod n, verification checks if s^e mod n = m, (4) Problem: allows message recovery from signature, (5) Solution: hash the message first to produce shorter digest.

Digital signatures are electronic signatures based on public key cryptography, providing authentication, integrity, and non-repudiation. Each user has a key pair: private key for signing, public key for verification. Unlike encryption (public key encrypts, private key decrypts), digital signatures use private key to sign and public key to verify. The signature is applied to the entire message content, preserving original text. Creation involves hashing the message, encrypting with private key, and attaching the signature. Verification involves decrypting with public key and comparing with original message. RSA digital signature is based on the difficulty of factoring large numbers. Key generation involves selecting two large primes p and q, computing n = p × q, φ(n) = (p-1)(q-1), selecting e coprime to φ(n), and computing d such that e × d ≡ 1 (mod φ(n)). The public key is (n, e) and private key is (n, d). Signing involves computing s = m^d mod n. Verification involves computing s^e mod n and checking if it equals m. For large messages, divide into blocks, sign each separately, and concatenate signatures.

RSA digital signatures provide authentication and integrity through asymmetric cryptography. Unlike standard RSA encryption where public keys encrypt and private keys decrypt, digital signatures reverse these roles: the sender uses their private key to sign the message, and receivers use the sender's public key to verify authenticity. The signing process involves computing the signature s = h^D mod n, where h is the message hash and D is the private exponent. Verification confirms authenticity by computing h' = s^E mod n and comparing it to a freshly generated hash of the received message. If both match, the signature is valid. This mechanism ensures non-repudiation—the sender cannot deny having signed the document—and provides strong evidence that no unauthorized modifications occurred during transmission.

Multiple algorithms attempt to factor RSA moduli: Trial division checks all numbers up to √n sequentially. Fermat's algorithm finds factors near √n by checking differences. Pollard's Rho uses random walks that eventually cycle, revealing factors. The General Number Field Sieve (GNFS) is currently the most efficient classical algorithm. Beyond mathematical attacks, side-channel attacks exploit physical implementations—power analysis monitors CPU consumption variations, timing attacks measure execution delays, and padding attacks exploit formatting vulnerabilities. Lucky 13 targets RSA-OAEP padding mechanisms. These attacks demonstrate that implementation flaws can compromise theoretically secure algorithms.

RSA security relies on the computational difficulty of factoring large composite numbers N = P × Q. Attack methods include: (1) Brute-force attack: Try all factorizations, infeasible for large N. (2) Mathematical attacks: Use algorithms like General Number Field Sieve (GNFS), the best known factoring method. (3) Timing attacks: Side-channel attacks exploiting implementation details. RSA remains secure with sufficiently large key sizes (1024+ bits) and proper implementation protecting against side-channel attacks.

Wiener's attack is a cryptanalytic technique that exploits the mathematical relationship between RSA's public and private keys when the private exponent d is small relative to the modulus n. By using continued fraction expansion on the ratio e/n (where e is the public encoding exponent and n is the modulus), an attacker can efficiently find convergents that approximate the fraction k/d, where k and d satisfy the equation ed - kφ(n) = 1. If d is less than one-third of the fourth root of n, this method can recover the private key d without factoring n, thereby breaking the RSA cryptosystem.

The probabilistic attack finds non-trivial square roots of 1 modulo N. We seek x ≠ ±1 with x² ≡ 1 (mod N). By CRT, there are four solutions: (1,1), (-1,-1), (1,-1), (-1,1). The non-trivial solutions allow factoring N. Using Bezout's identity UP + VQ = 1, solutions are S = VQ mod N and T = UP mod N. Then gcd(S+1, N) = P. The attack is probabilistic because finding such x requires random sampling, with success probability depending on the 2-adic valuations of P-1 and Q-1. Wiener's attack exploits small private keys. If D < N^(1/4)/3, then K/D (where ED - KN = 1) is a very good approximation of E/N. By Legendre's theorem, K/D must be a convergent of E/N's continued fraction. The number of convergents is O(log N), making the attack efficient. For each candidate D, test if M^(ED) ≡ M (mod N) for random M. This attack demonstrates RSA keys must have sufficiently large D.

RSA cryptosystem can be compromised through several attack vectors including using small prime factors (e.g., 512-bit RSA), poor randomness leading to repeated primes or predictable patterns, and mathematical factorization methods like the p-1 method; the security of RSA relies on the difficulty of factoring large numbers, with the number field sieve being the most efficient algorithm for this task, and doubling key length does not proportionally increase security since factorization complexity is sub-exponential rather than exponential.

Elliptic Curve Cryptography (ECC) is a form of asymmetric cryptography that uses the mathematical properties of elliptic curves to provide security equivalent to traditional methods like RSA but with significantly smaller key sizes; for example, a 256-bit ECC key provides the same level of security as a 3072-bit RSA key, making ECC more efficient for many applications despite being newer and sometimes facing patent concerns.

Elliptic curve cryptography (ECC) is a public-key cryptographic system invented independently by Neil Koblitz and Victor Miller in 1985. Unlike RSA which relies on integer factorization (attacked by subexponential number field sieve), ECC relies on the elliptic curve discrete logarithm problem (attacked by exponential Pollard's rho algorithm). This fundamental difference allows ECC to achieve equivalent security with much smaller key sizes. For 128-bit security, RSA requires 3072-bit keys while ECC only needs 256-bit primes. The security advantage comes from the exponential complexity of Pollard's rho attack on elliptic curves, making ECC more efficient for equivalent security levels.

Elliptic Curve Cryptography (ECC) provides an alternative to RSA with equivalent security but smaller key sizes. While RSA uses large prime factorization (1024+ bits), ECC uses elliptic curves over finite fields with operations involving point addition and scalar multiplication. ECC achieves the same security level with keys as small as 256 bits, compared to 3072 bits for RSA. ECC operations are computationally lighter, making it ideal for resource-constrained devices like IoT sensors and mobile devices. The security relies on the elliptic curve discrete logarithm problem (ECDLP), which is believed to be harder than integer factorization.

Elliptic curve cryptography (ECC), introduced by Miller and Koblitz in the mid-1980s, provides cryptographic security comparable to classical systems like RSA but with significantly shorter key lengths—approximately 313-bit ECC keys offer the same security as 496-bit RSA keys—making it more efficient for hardware implementations; ECC relies on the mathematical properties of elliptic curves defined over finite fields, where an elliptic curve consists of all ordered pairs (x, y) satisfying a specific cubic equation along with a special point at infinity, and its security stems from the difficulty of solving the elliptic curve discrete logarithm problem.

Elliptic Curve Cryptography (ECC) is a public-key cryptographic method introduced in 1985 that leverages the mathematical properties of elliptic curves—specifically their horizontal symmetry and the characteristic that any non-vertical line intersects the curve at most three times—to create a trapdoor function where computing nP (point multiplication) is easy but determining n from P and nP is computationally infeasible; ECC provides equivalent security to RSA with significantly smaller key sizes (e.g., 256-bit ECC ≈ 3072-bit RSA), making it faster and more efficient for applications like SSL/TLS, mobile devices, and cryptocurrencies, though it faces challenges including quantum computing threats, trust issues related to NSA/NIST standardization, and patent complications.