This design choice is not an accident. It reflects both performance constraints and deep cryptographic realities. Public-key cryptography is expensive and assumption-heavy. Symmetric cryptography is fast, robust, and conservative. The role of public-key cryptography is therefore reduced to a single task: securely establishing a shared secret.

This task is formalized by the notion of a Key Encapsulation Mechanism (KEM).

What Is a Key Encapsulation Mechanism (KEM)?

A Key Encapsulation Mechanism is a cryptographic primitive whose purpose is not to encrypt arbitrary messages, but to securely deliver a randomly generated symmetric key from one party to another.

A KEM is defined by three algorithms:

• KeyGen

• Encaps

• Decaps

Each algorithm plays a precise role, and none of them can be removed without breaking the abstraction.

Key Generation

In the key generation phase, a user—let’s call her Alice—generates a key pair:

• a public encapsulation key ek

• a private decapsulation key dk

The encapsulation key is meant to be distributed freely. It may be embedded in certificates, posted on servers, or hardcoded into protocols. The decapsulation key must remain secret.

At this stage, no shared secret exists yet. The key pair merely enables someone else to establish one later.

Encapsulation

Encapsulation is performed by another party—let’s call him Bob.

Using Alice’s public encapsulation key, Bob:

1. Generates a fresh, uniformly random symmetric key \(K\)

2. Produces a ciphertext \(c\) that encapsulates this key

3. Sends only \(c\) to Alice

The key \(K\) is not transmitted, encrypted, or revealed in any explicit way. It exists only implicitly through the cryptographic structure of \(c\).

This design ensures that:

• even if ciphertexts are public,

• even if they are stored indefinitely,

• the key remains indistinguishable from random to any attacker.

Decapsulation

Using her private decapsulation key, Alice processes the ciphertext \(c\) and deterministically recovers the same symmetric key \(K\).

At this point:

• Alice and Bob share a secret

• no further public-key operations are needed

• symmetric cryptography can be used for all subsequent communication

Why Existing KEMs Are Not Post-Quantum Secure?

Most deployed KEMs today are based on classical hardness assumptions:

• RSA-based KEMs rely on integer factorization

• Diffie–Hellman KEMs rely on discrete logarithms

• Elliptic-curve KEMs rely on elliptic-curve discrete logarithms

All of these assumptions are broken by Shor’s algorithm.

Harvest Now, Decrypt Later

The most dangerous aspect of quantum attacks is not future communication—it is past communication.

An adversary can:

1. Passively record encrypted traffic today

2. Store ciphertexts indefinitely

3. Decrypt everything once quantum capabilities exist

This attack model is known as harvest-now, decrypt-later.

Importantly:

• the attacker does not need to interact with the protocol

• the attacker does not need to break keys today

• the attacker only needs storage and patience

Kyber: A Post-Quantum Secure KEM

Kyber is a lattice-based KEM standardized by NIST as FIPS-203 (ML-KEM).

Its security is based on the Module-Learning With Errors (Module-LWE) problem, a generalization of LWE that balances efficiency and security.

It follows a clean structure:

1. Define a lattice-based public-key encryption scheme (Kyber-PKE)

2. Apply the Fujisaki–Okamoto transform

3. Obtain a CCA-secure KEM

Mathematical Setting and Parameters

Kyber operates over the polynomial ring:

$$R_q = \mathbb{Z}_q[X]/(X^n + 1)$$

For ML-KEM-768, the parameters are:

• \(q=3329\)

• \(n=256\)

• \(k = 3\)

• noise parameters \(\eta_1 = 2, \eta_2 = 2\)

• compression parameters \(d_u = 10, d_v = 4\)

Kyber-PKE Key Generation

Alice performs the following steps:

1. Sample a random seed \(ρ∈\{0, 1\}^{256}\)

2. Deterministically expand \(ρ\) into a matrix

$$A \in R_q^{k \times k}$$

3. Sample secret vector \(s \in R_q^k\) from a centered binomial distribution

4. Sample error vector \(e \in R_q^k\) from the same distribution

5. Compute

$$t = As + e$$

The keys are:

• public key: \((ρ, t)\)

• secret key: \(s\)

Alice’s goal here is to create a sort of mathematical "locked box." By expanding a random seed into a matrix \(A\) and generating a secret vector \(s\), she sets the stage for a Module-LWE instance. The critical step is adding the error vector \(e\). This tiny bit of noise is what makes the system secure; without it, an attacker could use simple linear algebra to solve for \(s\). Instead, they are left with \(t = As + e\), a result that looks like random noise but secretly hides Alice's private key.

Kyber-PKE Encryption

To encrypt a message \(m \in \{0, 1 \}^n\), Bob:

1. Reconstructs \(A\) from \(\rho\).

2. Samples randomness

   1. \(r \sim \chi_{\eta_1}^k\)

   2. \(e_1 \sim \chi_{\eta_2}^k\)

   3. \(e_2 \sim \chi_{\eta_1}\)

3. Computes:

$$u = A^Tr + e_1$$

$$v = t^Tr + e_2 + \Bigl\lfloor\frac{q}{2}\Bigr\rfloor m$$

4. Calculates \(c_1\) by compressing \(u\) to \(d_u \) bits.

5. Calculates \(c_2\) by compressing \(v\) to \(d_v \) bits.

6. Outputs ciphertext \(c = (c_1, c_2)\).

Kyber-PKE Decryption and Correctness

Alice:

1. Decompresses \(u\) and \(v\).

2. Computes:

$$v - s^Tu$$

3. Substituting definitions:

$$v - s^T u = t^T r + e_2 + \Bigl\lfloor\frac{q}{2}\Bigr\rfloor m - s^T(A^T r + e_1)$$

4. Using \(t = As + e\):

$$= r^T A s + r^T e + e_2 + \Bigl\lfloor\frac{q}{2}\Bigr\rfloor m - r^T A s - s^T e_1$$

$$= r^T e + e_2 - s^T e_1 + \Bigl\lfloor\frac{q}{2}\Bigr\rfloor m$$

When she computes \(v - s^T u\), the terms involving the matrix \(A\) cancel out perfectly, leaving her with the scaled message plus a small pile of accumulated noise: \(r^Te + e_2 - s^Te_1\). Because this noise is small relative to the scaling factor, Alice can simply round the result to the nearest bit, effectively "shaking off" the errors to reveal Bob’s original message \(m\).

From Kyber-PKE to Kyber-KEM

Now, let’s see how we can construct Kyber-KEM by utilizing the Kyber-PKE primitives!

Kyber-KEM Key Generation

Alice:

1. Runs Kyber-PKE.KeyGen → \(((\rho, t), s)\).

2. Samples a random value \(z \in \{ 0, 1 \}^{256}\).

3. Sets:

   • encapsulation key: \(ek = (\rho, t)\)

   • decapsulation key:

$$dk = (s, ek, H(ek), z)$$

Kyber-KEM Encapsulation

Bob:

1. Obtains authentic \(ek\).

2. Selects:

$$m \in \{0, 1\}^{256}$$

3. Computes:

$$h = H(ek)$$

$$(K, R) = G(m, h)$$

with \(H\) and \(G\) being some hash functions.

4. Uses Kyber-PKE.Enc to compute

$$c = PKE.Enc_{ek}(m; r)$$

5. Outputs the secret key \(K\) and ciphertext \(c\).

Kyber-KEM Decapsulation

To recover the secret key \(K\) from \(c\) using decapsulation key \(dk\), Alice does:

1. Use the Kyber-PKE to compute \(PKE.Dec_s(c)\) and call it the plaintext \(m'\).

2. Compute:

$$(K', R') = G(m', H(ek))$$

1. Compute fallback \(\bar{K} = J(z, c)\) with J being a hash function.

2. Compute:

$$PKE.Enc_{ek}(m') = c'.$$

1. If \(c \neq c'\), then return \(\bar{K}\).

2. Otherwise, return \(K'\).

In Kyber-KEM Decapsulation, Alice doesn't just trust the recovered message \(m'\). She actually re-encrypts it to see if it produces the exact same ciphertext Bob sent. If even a single bit differs (\(c \neq c'\)), she knows the ciphertext was tampered with and returns a random "fallback" value instead.

Conclusion

The transition to post-quantum cryptography is a practical necessity, especially in the blockchain setting where almost everything as public forever. As we have seen, the security of our current digital infrastructure rests on assumptions—like the hardness of integer factorization or discrete logarithms—that will not hold in a quantum future. Kyber, now officially standardized as ML-KEM by NIST in FIPS 203, represents the most mature and efficient path forward for general-purpose encryption.

As these algorithms begin to integrate into our systems, they will provide the necessary security to protect our data against the potential threats posed by quantum computers. This shift is crucial to ensure that our digital communications remain secure in the face of advancing technology.

Further Reading & Resources

If you want to dive deeper into the world of lattice-based cryptography and the official standards, here are some of the best places to start:

1. The Official Standard

• NIST FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard The definitive technical document for ML-KEM (formerly Kyber), covering the precise mathematical specifications and parameter sets like ML-KEM-768.

2. Lattice Math & LWE Tutorials

• Learning with Errors (LWE) Survey by Oded Regev A foundational paper by the creator of LWE, explaining why adding noise to linear equations makes them so hard to solve.

• A Simple Lattice-Based Encryption Scheme A great "from scratch" walkthrough that builds a simplified version of the math used in Kyber to help you visualize the noise and rounding process.

3. Understanding the FO Transform

• The Fujisaki-Okamoto Transformation Revisited A deep dive into how we turn "weak" encryption into "strong" KEMs through re-encryption checks and hashing.

4. Implementation in the Wild

• PQXDH: Signal's Post-Quantum Protocol Learn how Signal integrated Kyber into their protocol to protect over a hundred million users from future quantum threats.

Key Exchange

What is it and why is it important?

Key exchange is the process of securely sharing cryptographic keys between parties who wish to communicate securely over an insecure channel, such as the internet. These keys are used to encrypt and decrypt messages, ensuring that only the intended recipients can read the information.

Key exchange is important because it forms the foundation of secure communication in various contexts, including online banking, e-commerce transactions, secure messaging applications, and more. Without a secure method of exchanging keys, sensitive information could be intercepted and read by unauthorized parties, leading to privacy breaches, financial losses, and other serious consequences.

By securely exchanging keys, parties can establish a shared secret that enables them to communicate confidentially and authenticate each other's identities. This ensures the confidentiality, integrity, and authenticity of the transmitted data, safeguarding it from eavesdroppers and malicious attackers.

Diffie-Hellman Key Exchange Algorithm

Diffie-Hellman (DH) key exchange is a mathematical method of securely exchanging cryptographic keys over a public channel and named after Whitfield Diffie and Martin Hellman.

Traditionally, secure encrypted communication required that they first exchange keys by some secure physical ways like papers. The Diffie-Hellman key exchange method allows two parties with no prior knowledge of each other to establish a shared secret key over an insecure channel.

How it works?

The original implementation uses a multiplicative group structure over integers modulo \(p\), where \(p\) is a prime and \(g\) is a primitive root modulo \(p\).

1. Alice and Bob publicly agree to use a modulus \(p\) and base \(g\).

2. Alice chooses a private integer \(a\), then sends Bob \(A = g^a \ mod \ p\).

3. Bob chooses a private integer \(b\), then sends Alice \(B = g^b \ mod \ p\).

4. Alice computes \(s = B^a \ mod \ p\).

5. Bob computes \(s = A^b \ mod \ p\).

Alice and Bob now share a secret, the number \(s\).

Example

1. Let \(p = 23\) and \(g = 5\).

2. Alice chooses a secret \(a = 4\) and sends Bob \(A = 5^4 \ mod \ 23 = 4\).

3. Bob chooses a secret \(b = 3\) and sends Alice \(B = 5^3 \ mod \ 23 = 10\).

4. Alice computes \(s = 10^4 \ mod \ 23 = 18.\)

5. Bob computes \(s = 4^3 \ mod \ 23 = 18\).

Alice and Bob have the same secret: \(18\).

What's wrong with DH?

The security of traditional Diffie-Hellman key exchange relies on the difficulty of computing discrete logarithms, which is the process of finding the exponent in the equation \(g^x = y \ mod \ p\). However, quantum computers have the potential to efficiently solve the discrete logarithm problem using algorithms like Shor's algorithm. So traditional Diffie-Hellman key exchange is not quantum-resistant.

Introduction to Quantum Mechanics

What is it?

Quantum mechanics is a branch of physics that dealing with the behavior of matter and light on the atomic and subatomic scale. It aims to explain and understand the characteristics of molecules and atoms, as well as their components—electrons, protons, neutrons, and other particles like quarks and gluons. These characteristics encompass how these particles interact with each other and with electromagnetic radiation, such as light, X-rays, and gamma rays.

Postulates of Quantum Mechanics

1. The state of a quantum system is completely described by a wave function, denoted as \(\psi(x, t)\), which encodes all the probabilistic information about the system's properties.

2. The evolution over time of the wave function of a quantum system is determined by the Schrödinger equation, a linear partial differential equation:

$$i \hbar \frac{\partial \psi}{\partial t} = \left[ - \frac{\hbar^2}{2m} \frac{\partial^2}{\partial x^2} + V(x) \right] \psi.$$

3. Physical quantities, or observables, such as energy, position, and momentum, are represented by operators in quantum mechanics. These operators act on the wave function to extract physical information:

$$\hat{H} \psi = E\psi.$$

4. The act of measurement affects the system being measured. The only possible outcome of measuring a quantifiable property (observable) of a quantum system is one of the eigenvalues of the corresponding operator. Upon measurement, the wave function of the system collapses to an eigenstate associated with the eigenvalue.

Heisenberg's Uncertainty Principle

One of the most famous aspects of quantum mechanics is the Heisenberg Uncertainty Principle. Formulated by Werner Heisenberg in 1927, this principle states that certain pairs of physical properties, like position and momentum, cannot both be precisely measured or known simultaneously. The more precisely one property is measured, the less precisely the other can be controlled or known. This is not due to faults in measurement instruments, but rather a fundamental property of quantum systems.

Mathematically, the principle is expressed as:

$$\Delta x \Delta p \geq \frac{\hbar}{2}$$

where \(\Delta x\) and \(\Delta p\) are the standard deviations of position and momentum, respectively, and \(\hbar\) (h-bar) is the reduced Planck constant.

This principle has very significant implications for the nature of reality and our understanding of the universe, indicating a fundamental limit to what we can know about the properties of particles.

These concepts of quantum mechanics are not just theoretical curiosities but have practical applications, particularly in the field of quantum computing and quantum cryptography, where they enable technologies that would be impossible under classical physics.

Quantum Key Distribution

What is it?

Quantum Key Distribution (QKD) is an unusual approach in secure communication, utilizing principles of quantum mechanics to generate and share cryptographic keys between parties with guaranteed security. The underlying strength of QKD lies in the fundamental aspects of quantum mechanics, such as the Heisenberg Uncertainty Principle and the no-cloning theorem..

QKD allows two parties to produce a shared random secret key known only to them, which can then be used to encrypt and decrypt messages. What makes QKD unique from traditional cryptographic systems is its ability to alert both parties to the presence of any third party trying to gain knowledge of the key. This security feature stems from the principle that measuring quantum data invariably alters it. Thus, an eavesdropper trying to intercept the key would cause detectable disturbances in the system, alerting the legitimate parties to the breach.

It is worth noting that quantum key distribution is used to generate and distribute only a key, not to send / receive any message data. But such a key can be used within any chosen encryption scheme.

The BB84 Protocol

The BB84 protocol, proposed in 1984 by Charles Bennett and Gilles Brassard, is the first and most well-known Quantum Key Distribution scheme. Its security relies on two fundamental principles of quantum mechanics:

1. The impossibility of measuring a quantum state without disturbing it (Heisenberg Uncertainty Principle).

2. The no-cloning theorem, which states that it is impossible to create an identical copy of an unknown quantum state.

The protocol allows two parties, commonly called Alice and Bob, to generate a shared random key in a way that any eavesdropping attempt by an adversary (Eve) is detectable.

Step 1: Preparation and Transmission

Alice prepares a sequence of quantum bits (qubits), each encoded using one of two bases:

• Rectilinear basis (+): \(|0⟩\) and \(|1⟩\)

• Diagonal basis (×): \(|+⟩\) and \(|-⟩\), where

$$|+⟩ = \frac{|0⟩ + |1⟩}{\sqrt{2}}, \quad |−⟩ = \frac{|0⟩ - |1⟩}{\sqrt{2}}.$$

For each bit in a randomly generated string, Alice chooses (a) a random bit value (0 or 1), and (b) a random basis (rectilinear or diagonal). She then sends the corresponding qubits to Bob through a quantum channel.

Step 2: Measurement

For each received qubit, Bob also chooses a random basis (rectilinear or diagonal) to measure it. Because his choice might not match Alice’s, some measurements will be “wrong” (i.e., produce random results). Importantly, Bob does not inform Alice of his measurement results yet—only the bases he used.

Step 3: Basis Reconciliation

After the quantum transmission is complete, Alice and Bob communicate over a classical public channel (which can be eavesdropped on, but not modified).

• Bob announces the basis he used for each bit.

• Alice tells Bob which of his bases matched hers.

They then discard all bits where their bases were different. The remaining bits (where both chose the same basis) form the raw key.

Step 4: Eavesdropping Detection

To check for eavesdropping, Alice and Bob publicly compare a randomly chosen subset of their raw key. If the error rate is above a certain threshold, they assume Eve has intercepted the qubits (since her measurements would have disturbed the states) and abort the protocol.

If the error rate is below the threshold, they proceed, discarding the revealed bits and keeping the rest.

Step 5: Error Correction and Privacy Amplification

The raw key may still contain a small number of errors due to noise in the quantum channel. Alice and Bob use classical error correction protocols to reconcile their keys. Finally, they apply privacy amplification techniques to reduce Eve’s possible knowledge to an arbitrarily small amount, yielding the final secret key.

This final key can then be used in any symmetric encryption scheme (e.g., One-Time Pad or AES), with the guarantee that any eavesdropping attempt would have been noticed during the protocol.

Conclusion

Quantum Key Distribution represents a fundamental shift in how we think about secure communication. Rather than relying on computational assumptions like the hardness of discrete logarithms or factoring, QKD leverages the laws of physics to guarantee security. It is also worth noting that it is more of a complementary method instead of a replacement.

The BB84 protocol is a particularly elegant demonstration of this idea: even if an adversary has infinite computational power, they cannot extract information about the key without introducing detectable disturbances. While real-world implementation still faces technical challenges—such as channel noise, distance limitations, and cost—QKD systems are already being deployed in some specialized networks around the world.

As quantum computers advance and threaten traditional public-key cryptosystems, QKD provides a complementary path forward.

What is it?

In cryptography, Learning-With-Errors (LWE) is a mathematical problem that is widely used to create secure encryption algorithms.

Let \(\mathbb{Z}_q\) denote the ring of integers module \(q\) and \(\mathbb{Z}_q^n\) denote the set of \(n\)-vectors over \(\mathbb{Z}_q\). There exists a certain unknown linear function \(f: \mathbb{Z}_q^n \rightarrow \mathbb{Z_q}\), and the input to the LWE problem is a sample of pairs 

The Learning-With-Errors (LWE) problem presents a computational challenge where solving linear equations becomes difficult due to added noise. Essentially, LWE relies on the idea that when linear equations over a finite field are slightly altered with random errors, finding the solution becomes computationally hard. This approach uses the difficulty of telling apart random noise from structured data to create cryptographic systems that are secure against quantum attacks. The noise is crucial because it hides the connection between the input vectors and their outputs, making it hard to deduce the secret linear function.

LWE Encryption

In the context of LWE-based encryption, the security model revolves around the difficulty of solving the LWE problem. The encryption scheme is constructed around a public and a private key, where the public key is derived from the private key with the addition of noise. This ensures that, while encryption can be performed by anyone possessing the public key, decryption is feasible only with the knowledge of the private key. The essence of this encryption lies in its ability to mask the message with a layer of computational complexity that is impractical to breach without the private key, thus ensuring confidentiality.

To encrypt an encoded message \(m\), we calculate:

$$b = \mathbf{a} \cdot \mathbf{s} + m + \epsilon$$

where \(\mathbf{a} \leftarrow_R \mathbb{Z}^n\) is a randomness, \(\mathbf{s} \in \mathbb{Z}^n\) is our secret key, and \(\epsilon \in \chi\) is a small noise.

LWE on the Torus (TLWE)

What is the torus in our context?

Real torus \(\mathbb{T} = \mathbb{R}/\mathbb{Z}\) is basically the set

In TFHE, we’re working on \(\mathbb{T}_q\), which can be represented as the set of fractions:

$${ \frac{i}{q} \ \text{mod} \ 1 \ | \ i \in \mathbb{Z} } = { \frac{i}{q} \ | \ i \in \mathbb{Z}/q\mathbb{Z} } = { 0, \frac{1}{q}, \frac{2}{q}, ... , \frac{q-1}{q} }$$

This submodule \(\mathbb{T}_q\) is called a discretized torus.

TLWE Ciphertexts

Encryption

The security assumption for TLWE is that a torus element

Basically, to encrypt a message \(m\) with TLWE, we calculate

$$b = \sum_i^n s_i \cdot a_i + m + \epsilon$$

where

Similar to the case in the regular LWE, a TLWE ciphertext is of the form:

$$(a_1, a_2, ..., a_n, b) \in \mathbb{T}_q^{n+1}$$

Decryption

To decrypt a TLWE ciphertext

$$m^* = b - \sum_i^n s_i \cdot a_i$$

and return

$$m = \frac{\lfloor q \ m^* \rceil \text{mod} \ q}{q}$$

Plaintext & Ciphertext Spaces

In most cases, the plaintext and ciphertext spaces are distinct, where the plaintext space is an additive subgroup of \(\mathbb{T}_q\).

We, conventionally denote the plaintext space modulus by \(p\), the ciphertext space modulus by \(q\).

Example

Let’s assume \(p = 4\) and \(q = 64\). So, the plaintext space is \(P = {0, \frac{1}{4}, \frac{2}{4}, \frac{3}{4}}\), where the ciphertext space is \(Q = \mathbb{T}_{64} = { 0, \frac{1}{64}, \frac{2}{64}, ..., \frac{62}{64}, \frac{63}{64} }\).

Notice that if \(\epsilon \in {\frac{-7}{64}, ..., \frac{7}{64}}\), then any noisy message value \(m^* = m + \epsilon\) corresponds to a plaintext message \(m \in P = { 0, \frac{16}{64}, \frac{32}{64}, \frac{48}{64} }\).

Hence, while decrypting, we determine which zone in the plaintext space the noisy message falls into. For example, the closest plaintext message to \(m^* \in { \frac{9}{64}, ..., \frac{23}{64} }\) is \(m = \frac{16}{64} = \frac{1}{4}\).

Ciphertext Compression

Compressing Ciphertexts in TFHE.rs

TFHE.rs lets developers compress ciphertexts at encryption time by calling the CompressedFheUint16::try_encrypt() method:

use tfhe::prelude::*;
use tfhe::{ConfigBuilder, generate_keys, CompressedFheUint16};

fn main() {
    let config = ConfigBuilder::default().build();
    let (client_key, _) = generate_keys(config);

    let clear = 12_837u16;
    let compressed = CompressedFheUint16::try_encrypt(clear, &client_key).unwrap();
    println!(
        "compressed size  : {}",
        bincode::serialize(&compressed).unwrap().len()
    );
    
    let decompressed = compressed.decompress();
    
    println!(
        "decompressed size: {}",
        bincode::serialize(&decompressed).unwrap().len()
    );

    let clear_decompressed: u16 = decompressed.decrypt(&client_key);
    assert_eq!(clear_decompressed, clear);
}

How does it work?

Recall that TLWE ciphertexts are torus vectors with \(n+1\) components.

If we suppose that torus elements are represented with 64 bits where \(n = 630\), a TLWE ciphertext requires

$$631 \times 64 = 40384 \ \text{bits}$$

for its representation.

Instead of representing a ciphertext as

With this setup, the same ciphertext only needs \(128 + 64 = 192\) bits for its representation.

As we use a pseudo-random number generator, we are able to recover our random vector \(a\) deterministically. So, it makes more sense to store the PRNG seed instead of storing the entire randomness. Hence, the ciphertext compression decreases the storage overhead drastically.

References

1. Joye, M. (2022). SoK: Fully homomorphic encryption over the [discretized] torus. IACR Transactions on Cryptographic Hardware and Embedded Systems, 2022(4), 661–692. https://doi.org/10.46586/tches.v2022.i4.661-692

2. Zama AI. (n.d.). Compress. TFHE.rs Fundamentals. Retrieved December 27, 2024, from https://docs.zama.ai/tfhe-rs/fundamentals/compress

Before starting, it is worth noting that this is NOT a paid content.

Hello everyone! Welcome to the new post of my blog. Normally, I'm creating two types content:

1. protocol exploration posts from a developer's perspective and

2. cryptography posts explaining mathematical concepts and their applications.

In this post, I'll try to combine both. We'll explore Zama protocol and the cryptographic concept they utilize: fully homomorphic encryption (FHE).

Contents

1. Fully Homomorphic Encryption (FHE)

   1. What does "homomorphic" mean?

   2. Group Homomorphisms

      1. Example

   3. Homomorphic Encryption

      1. Overview

      2. RSA, Revisited

   4. Then, what is FHE?

2. What is Zama?

   1. Introduction

   2. fhEVM

      1. Overview

      2. How it works?

      3. Use Cases

3. Building Confidential Smart Contracts

   1. Encrypted Types

   2. Operations on Encrypted Types

   3. Decryption & Reencryption

4. Conclusion

Fully Homomorphic Encryption

What does "homomorphic" mean?

The term "homomorphic" emerges from the Greek roots 'homos' (same) and 'morphē' (shape or form). In the context of mathematics, it pertains to the property of a mapping between two algebraic structures (such as groups, rings, or fields) that conserves operations between those structures. This means that operations conducted on transformed data can, after reverting the data back to its original form, yield identical results to those obtained from performing operations on the original data directly.

Group Homomorphisms

To understand the notion of homomorphism, let's see how they work in groups.

Let \(G\) and \(H\) be groups and \(f: G \rightarrow H\) is a mapping (function). \(f\) is called a "group homomorphism" if \(f(g_1 \cdot_G g_2) = f(g_1) \cdot_H f(g_2) \ \forall g_1, g_2 \in G.\)

The purpose here is to create some functions preserving the algebraic structure.

Example

The function \(f: (\mathbb{N}, +) \rightarrow (\mathbb{R}, +)\) be defined by \(f(x) = \sqrt{2}x\). Notice that both \((\mathbb{N}, +)\) and \((\mathbb{R}, +)\) are groups. Let's check if \(f\) is a group homomorphism, or not.

Take two elements from the first group: \(n_1,n_2 \in \mathbb{N}\). It is time to see if the homomorphism axiom is satisfied:

$$f(n_1 + n_2) = \sqrt{2} \ (n_1 + n_2)$$

$$f(n_1 + n_2) = \sqrt{2} \ n_1 + \sqrt{2} \ n_2$$

$$f(n_1 + n_2) = f(n_1) + f(n_2).$$

Hence, \(f\) is a group homomorphism.

I hope this simple example helped you to understand the concept better.

Homomorphic Encryption

Overview

Homomorphic encryption is a form of encryption that allows computations to be performed on ciphertexts, generating an encrypted result which, when decrypted, matches the result of operations performed on the plaintext. This property makes homomorphic encryption highly valuable for privacy-preserving computations, allowing sensitive data to be encrypted and processed without exposing it to the computing entity.

But the ones being discussed in this section are partially homomorphic encryption methods. This type supports either addition or multiplication on ciphertexts, but not both.

For example, the RSA encryption scheme is homomorphic with respect to multiplication.

RSA, Revisited

If you are not familiar with the RSA encryption scheme, you can take a look at my RSA post.

Recall that, in RSA, encryption process takes the public key parameters \((N, e)\) as modulus and exponent, respectively. So if we have a message \(m\) to encrypt, the ciphertext corresponds to that is calculated in the following way:

$$c = m^e \ (mod \ N)$$

where \(c\) is the ciphertext.

Let's now assume we have two different messages \(m_1\) and \(m_2\).

$$Enc(m_1 \cdot m_2) = (m_1 \cdot m_2)^e$$

$$Enc(m_1 \cdot m_2) = m_1^e \cdot m_2^e$$

$$Enc(m_1 \cdot m_2) = Enc(m_1) \cdot Enc(m_2)$$

Therefore, the RSA encryption scheme is homomorphic with respect to multiplication.

Notice that it is NOT homomorphic with respect to addition.

Then, what is FHE?

A cryptosystem that supports arbitrary computation on ciphertexts is known as fully homomorphic encryption (FHE). As computations can be expressed as arithmetic circuits (addition & multiplication), it allows to do computations on ciphertexts in an unlimited way.

What is Zama?

Introduction

Zama is an open source cryptography company building fully homomorphic encryption solutions for blockchain and AI.

As the backbone of artificial intelligence efforts is data (a huge amount of data), a couple of possible problems, such as privacy and confidentiality, may arise. That's why I personally think that combining FHE and AI is quite relevant.

Zama has a couple of products:

• TFHE-rs: Rust implementation of TFHE for boolean and small integer arithmetics over encrypted data.

• Concrete: TFHE compiler that converts Python programs into their FHE equivalent.

• Concrete ML: Privacy-preserving ML framework built on top of Concrete, with bindings to traditional ML frameworks.

• fhEVM: Confidential smart contracts on the EVM using homomorphic encryption.

Even though I'm planning to write another post on TFHE-rs, in this one, we will focus on fhEVM.

fhEVM

Overview

While the transparency provided by blockchains is beneficial in some ways, privacy is necessary at certain points. For instance, you may not want your investments to be public to everyone. Zama, intentionally, preserves one of the key benefits of transparency on blockchains: the computation carried out remains public, while only the data that is being computed on is hidden.

The good news is that fhEVM contracts are built using Solidity, along with some additional types. So they offer a smooth transition for regular smart contract developers.

How it works?

Global FHE Key

First of all, fhEVM is a threshold cryptographic system (I'm planning to write a particular blog post on threshold cryptography btw.) where content is encrypted using the global public key and the private (secret) key is distributed among validators. If more validators than the threshold agrees on decrypting the encrypted content, the key is combined and decryption is executed.

Zama fhEVM relies on a global FHE key under which all inputs and private states are encrypted. This makes it enable both trustlessness and fault-tolerance.

Input Encryption

In order to provide an encrypted input to a transaction or view function, users are required to submit two things to a smart contract:

1. intended input value encrypted using the global public FHE key (ciphertext),

2. corresponding zero-knowledge proof of the plaintext knowledge (ZKPoK).

The second value is needed, because users have to prove if they actually know the underlying plaintext message. Thanks to ZKPoK, produced ciphertext cannot be used in another context. \((Enc_{pk}(m), ZKPoK(M))\) pair is called certified ciphertext.

The receiving smart contract needs fhEVM to verify certified ciphertext.

Use Cases

Encrypted ERC-20 Tokens

Existence of such a standard is important for blockchains. However, by the public nature of blockchain systems, the individual balances of ERC-20 token holders are public and this may lead some security and privacy concerns.

Because the fhEVM allows for the use of encrypted values in smart contracts, we can create an encrypted version of the ERC-20 token standard. To do so, it suffices to change the data type of balances from integers to encrypted integers and replace each operation with their respective FHE counterpart.

Blind Auctions

Blind auctions enable bidders to submit their bids in private, ensuring that no one knows the bid amounts. Once the bidding period ends, the highest bidder is determined and announced as the winner.

These auctions can be seamlessly conducted on-chain using encrypted values. By utilizing an encrypted ERC-20 token, bidders can transfer an encrypted amount to the blind auction smart contract. This contract then compares the bids to identify and announce the winner.

Building Confidential Smart Contracts

Encrypted Types

The Solidity TFHE library provides encrypted integer types and a type system that is checked both at compile time and at runtime:

• euint8,

• euint16,

• euint32.

In the fhEVM implementation, encrypted integers are represented as FHE ciphertexts. The TFHE library simplifies this by offering ciphertext handles to smart contract developers.

When a smart contract receives a certified ciphertext from a user, it must verify its corresponding proof. To do so, it converts the input into a usable euint by calling TFHE.asEuint. For example,

• TFHE.asEuint8(bytes ciphertext) verifies the provided ciphertext and returns an euint8,

• TFHE.asEuint16(bytes ciphertext) verifies the provided ciphertext and returns an euint16,

• TFHE.asEuint32(bytes ciphertext) verifies the provided ciphertext and returns an euint32,

• TFHE.asEbool(bytes ciphertext) verifies the provided ciphertext and returns an ebool.

If the verification is successful, then the fhEVM returns an encrypted value that is ready to use by the smart contract. If not, then execution is reverted.

Example:

function verify(
    bytes calldata _amount
) public returns (euint32) {
    euint32 amount = TFHE.asEuint32(_amount);

    return amount;
}

Encrypted Operations

The fhEVM provides different operations on encrypted data types. These operations are carried out by calling a precompiled smart contract, which then uses the TFHE-rs library.

Some of them are as follows:

• addition:TFHE.add(),

• subtraction:TFHE.sub(),

• multiplication:TFHE.mul(),

• isEqual:TFHE.eq(),

• isNotEqual:TFHE.ne(),

• greaterThan:TFHE.gt(),

• lessThan:TFHE.lt(),

• decrypt:TFHE.decrypt(),

• reencrypt:TFHE.reencrypt().

If you want to see the full list, see the official docs.

Example 1:

Let us see how to perform a basic computation on encrypted integers:

function arithmetic(
    euint32 x,
    euint32 y,
    euint32 z
) public returns (euint32) {
    return TFHE.mul(TFHE.add(x, y), z);
}

This code basically takes 3 encrypted integers \(x, y, z\) and performs the following calculation:

$$(x+y) \cdot z.$$

Example 2:

Now, let's try to write down a transfer() function where the required balance is checked on an encrypted data:

function transfer(
    address from,
    address to,
    euint32 amount
) public {
    ebool condition = TFHE.lte(amount, balances[from]);
    require(TFHE.decrypt(condition));

    balances[from] = TFHE.sub(balances[from], amount);
    balances[to] = TFHE.add(balances[to], amount);
}

The code takes three inputs:

• from: sender's address,

• to: recipient's address,

• amount: transfer amount;

and checks if sender has sufficient balance by decrypting the ebool.

Decryption & Reencryption

Just as we did in the example above, the fhEVM allows explicit decryption requests for any encrypted type. As discussed, the values are decrypted with the global private key if the threshold is exceeded.

Example:

function getTotalSupply() public view returns (uint32) {
    return TFHE.decrypt(totalSupply);
}

This function takes encrypted totalSupply variable and returns its decrypted version.

Zama fhEVM also supports reencrypting. In this process, the ciphertext is first decrypted with the global private key. Next, the decrypted data is encrypted again using a public key provided by the user. This newly encrypted data is then returned to the person who requested it.

Example:

function balanceOf(
    bytes32 publicKey,
) public view returns (bytes memory) {
    return TFHE.reencrypt(balances[msg.sender], publicKey);
}

Conclusion

In wrapping up, Zama's fhEVM introduces a new way to ensure privacy in blockchain through fully homomorphic encryption. It keeps the transparency and trust blockchain is known for, while adding a layer of privacy where it's needed. This step forward in combining privacy with transparency opens up new possibilities for blockchain applications, making it an important development for those looking to balance openness with confidentiality.

Contents

1. Elliptic Curves, Revisited

   1. What was an elliptic curve, again?

2. What is secp256k1?

   1. Parameters & Curve

   2. Why is it important?

3. Key-Pair Generation w/ secp256k1

   1. Key-Pairs

      1. Private Key

      2. Public Key

   2. How to generate a key-pair?

      1. Generating a Private Key

      2. Deriving the Public Key

4. Conclusion

Elliptic Curves, Revisited

What was an elliptic curve, again?

Let \(p\) be a prime number and let \(\mathbb{F}_p\) denote the field of integers modulo \(p\). An elliptic curve\(E\) over \(\mathbb{F}_p\) is defined by an equation of the form

$$y^2 = x^3 + ax + b,$$

where \(a,b \in \mathbb{F}_p\) satisfy \(4a^3+ 27b^2 \neq 0 \ (mod \ p) \) . A pair \((x, y)\) is a point on the curve if it satisfies the equation where \(x,y \in \mathbb{F}_p\). The point at infinity, denoted by \(\infty\) is also said to be on the curve. The set of all points on \(E\) is denoted by \(E(\mathbb{F}_p)\).

For example, if \(E\) is an elliptic curve over \(\mathbb{F}_7\) with equation

$$y^2 = x^3 + 2x + 4,$$

then the points on \(E\) are

$$E(\mathbb{F}_7) = \{ \infty, (0,2), (0,5), (1,0), (2,3), (2,4), (3,3), (3,4), (6,1), (6,6) \}.$$

Notice that, with the point addition rule, the set of points \(E(\mathbb{F}_p)\) forms a group with \(\infty\) serving as the identity element. We call such groups elliptic curve groups.

What is secp256k1?

Parameters & Curve

In order to specify a particular elliptic curve, we need to mention a couple of parameters (domain parameters). Let us see what we have for secp256k1:

• \(a = 0\),

• \(b = 7,\)

• \(p = 2^{256} - 2^{32} - 2^9 - 2^8 - 2^7 - 2^6 - 2^4 - 1,\)

• \(n = 115792089237316195423570985008687907852837564279074904382605163141518161494337,\)

• \(G_x = 55066263022277343669578718895168534326250603453777594175500187360389116729240,\)

• \(G_y = 32670510020758816978083085130507043184471273380659243275938904335757337482424,\)

where \(a\) and \(b\) are the multiples in the curve equation, \(p\) is the order of the finite field which the curve is based on, \(n\) is the order of the elliptic curve group, and finally \(G\) is the base point or generator point of the curve with \(G_x\) as the x-component and \(G_y\) as the y-component.

Notice that all these numbers are quite large and this is the thing making the system so secure.

So our curve equation is as follows:

$$y^2 = x^3 + 7.$$

Notice that neither \(G_x\), nor \(G_y\) is greater than or equal to \(p\).

Why is it important?

The elliptic curve secp256k1 has become a cornerstone in the world of cryptocurrencies, especially for Bitcoin and Ethereum. Its popularity comes from the curve's robust security, which is enhanced by its large prime order, and its operational efficiency. These features make it exceptionally suitable for creating cryptographic keys in decentralized systems.

The curve's parameters are specifically chosen to ensure fast cryptographic processes, which in turn, make transactions not only secure but also swift. This blend of security, effectiveness, and speed is crucial for maintaining the trust and reliability of transactions on the Bitcoin network, significantly contributing to the development and success of blockchain technology.

Key-Pair Generation w/ secp256k1

Key-Pairs

A key-pair consists of two keys:

• private key and

• public key.

Private Key

It is used for signing and, as the name suggests, kept secret. The signer uses their private key to sign the message. The strength of the system lies in the fact that, although the public key is known to all, it is computationally infeasible to derive the private key from it.

Public Key

It is available to everyone and used for signature verification. It's like a digital address shared openly for others to verify signatures if they are actually created by the party that claims the ownership of the signature.

How to generate a key-pair?

Generating a Private Key

A private key in elliptic curve cryptography is a randomly selected integer \(d\) from the range \([1, n-1]\), where \(n\) is the order of the curve.

Let's try it:

use num_bigint::BigInt;
use rand::thread_rng;

// Order of the curve in hexadecimal form
const N: &str = "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141";

fn generate_private_key() -> BigInt {
    let n = BigInt::parse_bytes(N.as_bytes(), 16).unwrap();
    let mut rng = thread_rng();
    // Generate a random BigInt within the range [1, n-1]
    let private_key = rng.gen_bigint_range(&BigInt::one(), &n);
    private_key
}

This short code snippet basically does:

1. import some external libraries to use BigInt format and choose a randomly selected integer,

2. declare a variable called N with the hexadecimal form of \(N\),

3. initialize a function called generate_private_key(),

4. declare a variable called n and initializes it with the result of parsing the hexadecimal form of \(N\),

5. generate a random integer within the range \([1, n-1]\) and assign it to the variable called private_key.

6. finally return private_key.

Deriving the Public Key

The public key \(Q\) is derived from the private key \(d\) by multiplying it with the base point \(G\) of the curve:

$$Q = d \cdot G.$$

Hence, public key \(Q\) is essentially a point on the curve.

use num_bigint::BigInt;

mod utils;

use utils::Point;
use utils::scalar_multiplication;

// Other domain parameters in hexadecimal form
const P: &str = "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F";
const G_X: &str = "79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798";
const G_Y: &str = "483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8";

fn derive_public_key(private_key: &BigInt) -> (BigInt, BigInt) {
    let modulus = BigInt::parse_bytes(P.as_bytes(), 16).unwrap();
    let a = BigInt::from(0); // secp256k1's 'a' parameter is 0
    let g = Point {
        x: BigInt::parse_bytes(G_X.as_bytes(), 16).unwrap(),
        y: BigInt::parse_bytes(G_Y.as_bytes(), 16).unwrap(),
    };
    let public_key = scalar_multiplication(&g, private_key, &a, &modulus);
    (public_key.x, public_key.y)
}

This code basically does:

1. import an external library to use BigInt format,

2. import a struct called Point ,

3. declare the domain parameters as variables in their hexadecimal forms,

4. initialize a function called derive_public_key taking private key as an input,

5. declare a variable called modulus and initializes with the result of parsing the hexadecimal form of \(p\).

6. declare variables for \(a\) and the base point \(G\),

7. perform the scalar multiplication \(d \cdot G\) and assign it to the variable called public_key,

8. finally return the point public_key.

Let us build the main() function before running the code:

fn main() {
    let private_key = generate_private_key();
    println!("Private Key: {}", private_key);

    let public_key = derive_public_key(&private_key);
    println!("Public Key: ({}, {})", public_key.0, public_key.1);

    let ethereum_address = convert_to_ethereum_address(&public_key);
    println!("Ethereum Address: {}", ethereum_address);
}

Time to build and run:

cargo build
cargo run

Output:

Private Key: 41831991390653552422840364716923515177067311217271364429731967099160830113867
Public Key: (16443841179803354550922733760429663760404329023875294123053636149554388604922, 86388970361949805853944014893086285981774181298492291090513927212929981949880)
Ethereum Address: 0x101e2b2e11d2c62f9adcb129de37b2bb36982671

We have successfully generated our key pair and displayed it, along with an Ethereum address as an additional version.

I needed to code some extra utility functions to build this project:

• convert_to_ethereum_address(),

• add_points(),

• double_point(),

• scalar_multiplication(),

• mod_inverse().

You can find the complete code in this GitHub repository.

Conclusion

In this first part of our exploration into the secp256k1 elliptic curve, we've laid the foundational knowledge necessary to understand the basics of elliptic curves and the specifics of secp256k1, including its significance in the world of cryptocurrency. We've also walked through the process of generating a key pair, which is crucial for ensuring secure digital transactions. As we've seen, the combination of a carefully selected private key and its corresponding public key forms the backbone of cryptographic security in blockchain technologies.

Contents

1. Finite Prime Fields

   1. Definition

   2. Example

   3. NIST Primes

   4. Why finite fields?

2. What is an elliptic curve?

   1. Overview

   2. Elliptic Curve Groups

Finite Prime Fields

Before getting into the finite fields, let us recall the general group and field definitions from Wikipedia:

Groups

A group G is a finite or infinite set of elements together with a binary operation (called the group operation) that together satisfy the four fundamental properties of closure, associativity, the identity property, and the inverse property. The operation with respect to which a group is defined is often called the "group operation," and a set is said to be a group "under" this operation. Elements A, B, C, ... with binary operation between A and B denoted AB form a group if

• Closure: If A and B are two elements in G, then the product AB is also in G.

• Associativity: The defined multiplication is associative, i.e., for all A,B,C in G, (AB)C=A(BC).

• Identity: There is an identity element I (a.k.a. 1, E, or e) such that IA=AI=A for every element A in G.

• Inverse: There must be an inverse (a.k.a. reciprocal) of each element. Therefore, for each element A of G, the set contains an element B=A^(-1) such that AA^(-1)=A^(-1)A=I.

Fields

Formally, a field is a setF together with two binary operations on F called addition and multiplication. A binary operation on F is a mapping F × F → F, that is, a correspondence that associates with each ordered pair of elements of F a uniquely determined element of F.The result of the addition of a and b is called the sum of a and b, and is denoted a + b. Similarly, the result of the multiplication of a and b is called the product of a and b, and is denoted ab or a ⋅ b. These operations are required to satisfy the following properties, referred to as field axioms (in these axioms, a, b, and c are arbitrary elements of the field F):

• Associativity of addition and multiplication: a + (b + c) = (a + b) + c, and a ⋅ (b ⋅ c) = (a ⋅ b) ⋅ c.

• Commutativity of addition and multiplication: a + b = b + a, and a ⋅ b = b ⋅ a.

• Additive and multiplicative identity: there exist two distinct elements 0 and 1 in F such that a + 0 = a and a ⋅ 1 = a.

• Additive inverses: for every a in F, there exists an element in F, denoted −a, called the additive inverse of a, such that a + (−a) = 0.

• Multiplicative inverses: for every a ≠ 0 in F, there exists an element in F, denoted by a⁻¹ or 1/a, called the multiplicative inverse of a, such that a ⋅ a⁻¹ = 1.

• Distributivity of multiplication over addition: a ⋅ (b + c) = (a ⋅ b) + (a ⋅ c).

The most popular field examples are:

• \((\mathbb{Q}, +, \cdot)\),

• \((\mathbb{R} , +, \cdot)\), and

• \((\mathbb{C}, +, \cdot)\) with \(\cdot\) operation is defined as

  • \((a+bi) \cdot (c + di) = (ac -bd) + (bc + ad)i\).

Notice that all these fundamental examples are infinite fields. So let's see how finite ones look like!

Definition

Let \(p\) be a prime number. The integers modulo \(p\), consisting of integers \(\{ 0, 1, 2, ... , p-1 \}\) with addition and multiplication performed modulo \(p\), is a finite field of order \(p\). We shall denote this field by \(\mathbb{F}_p\).

Example (\(\mathbb{F}_{29}\))

The elements of \(\mathbb{F}_{29}\) are \(\{ 0, 1, 2, ... , 28 \}\). The followings are some examples of arithmetic operations in \(\mathbb{F}_{29}\):

1. \(17 + 20 = 8\) since \(37 \ mod \ 29 = 8\).

2. \(17 - 20 = 26\) since \(-3 \ mod \ 29 = 26\).

3. \(17 \cdot 20 = 21\) since \(340 \ mod \ 29 = 21.\)

4. \(17^{-1} = 12\) since \(17 \cdot 12 \ mod \ 29 = 1\).

NIST Primes

You can construct a prime field by setting the \(p\) as any prime, but there is a standard recommends elliptic curves over the five prime fields with moduli:

$$p_{192} = 2^{192} - 2^{64} - 1$$

$$p_{224} = 2^{224} - 2^{96} + 1$$

$$p_{256} = 2^{256} - 2^{224} + 2^{192} + 2^{96} - 1$$

$$p_{384} = 2^{384} - 2^{128} - 2^{96} + 2^{32} - 1$$

$$p_{521} = 2^{521} - 1$$

These primes have the property that they can be written as the sum or difference of a small number of powers of 2. Furthermore, except for \(p_{521}\), the powers appearing in these expressions are all multiple of 32. These properties yield reduction algorithms that are especially fast on machines with wordsize 32.

Why finite fields?

Basis of the security of elliptic curve cryptography is formed by the discrete logarithm problem (DLP), which we will cover in upcoming parts with more details, and DLP is more tractable in finite fields compared to infinite fields. This means that elliptic curve cryptography can achieve high levels of security with relatively smaller key sizes compared to other cryptographic schemes, such as RSA.

What is an elliptic curve?

Overview

Let \(p\) be a prime number and let \(\mathbb{F}_p\) denote the field of integers modulo \(p\). An "elliptic curve" \(E\) over \(\mathbb{F}_p\) is defined by an equation of the form

$$y^2 = x^3 + ax + b,$$

where \(a,b \in \mathbb{F}_p\) satisfy \(4a^3+ 27b^2 \neq 0 \ (mod \ p) \) . A pair \((x, y)\), where \(x,y \in \mathbb{F}_p\) is a point on the curve if it satisfies the curve equation. The point at infinity, denoted by \(\infty\), is also said to be on the curve. The set of all points on \(E\) is denoted by \(E(\mathbb{F}_p)\).

For example, if \(E\) is an elliptic curve over \(\mathbb{F}_7\) with defining equation

$$y^2 = x^3 + 2x + 4,$$

then the points on \(E\) are

$$E(\mathbb{F}_7) = \{ \infty, (0,2), (0,5), (1,0), (2,3), (2,4), (3,3), (3,4), (6,1), (6,6) \}.$$

Please see point addition to see how to add 2 points up to obtain another point on the curve.

As we are able to define an addition operation on elliptic curves, we can also construct a group structure on elliptic curves

Elliptic Curve Groups

With the point addition rule, the set of points \(E(\mathbb{F}_p)\) forms a group with \(\infty\) serving as the identity element.

This kind of group structures are called "elliptic curve groups".

Conclusion

In this post, some fundamental concepts and notions are mentioned. In the next post, we will discuss key generation and encryption schemes in elliptic curve cryptography.

Contents

1. Basics of Public-Key Cryptography

   1. What is a key pair?

      1. Private Key

      2. Public Key

   2. How it works?

   3. Real World Applications

2. Mathematical Foundations

   1. Key Generation Principles & Prime Numbers

   2. Euler's Totient Function

   3. Formula of Secrecy

   4. Encryption / Decryption

3. From Theory to Hands-on Practice (Rust Code)

   1. Key Generation

   2. Encryption / Decryption

   3. It is time to test!

4. Conclusion

Basics of Public-Key Cryptography

What is a key pair?

A key pair consists of two keys:

• private key and

• public key.

Public Key

It is available to everyone and used for encryption. It's like a digital address shared openly for others to send encrypted messages. So, anyone can use a recipient's public key to encrypt a message. Once the message is encrypted, it can only be decrypted by the corresponding private key.

Private Key

It is used for decryption and, as the name suggests, kept secret. The recipient uses their private key to decrypt encrypted messages. The strength of the system lies in the fact that, although the public key is known to all, it is computationally infeasible to derive the private key from it.

How it works?

Let's consider a scenario where two close friends, Alice and Bob, wish to communicate secretly. In this situation, Alice and Bob can use public-key cryptography (assuming they have securely shared their keys with each other; we will discuss key sharing methods shortly) to maintain the confidentiality of their messages.

1. Alice encrypts her message using Bob's public key and sends it over to Bob.

2. Bob receives the encrypted message, decrypts it using his own private key, and finally reads it.

Real World Applications

Email

Email encryption serves as a technique to protect the contents of email communications from unauthorized access by external parties. When an email is encrypted, it becomes unreadable to any person. Decryption and restoration of the original message are only possible using your unique private email key.

This encryption process utilizes public-key cryptography.

Social Media

Social media platforms like WhatsApp and Instagram also use public-key cryptography (sometimes private-key cryptography also) for end-to-end encryption.

Blockchains

In almost all the blockchains, public-key cryptography is extensively used.

Where public keys are used as an account number, private keys are used to sign transactions (I will write a particular blog post on digital signatures) and to prove ownership of an address and the assets contained within it.

Mathematical Foundations

In this section, we will discuss the mathematical fundamentals of key generation. You will see that how important prime numbers will be for public-key cryptography.

Key Generation Principles & Prime Numbers

There is more than one approach to key generation in public-key cryptography. Two of them are:

1. RSA cryptography,

2. Elliptic curve cryptography.

Although I'm planning another series of posts regarding elliptic curve cryptography, for the sake of simplicity, we will discuss and practice RSA encryption in this series.

RSA encryption relies on prime factorization of large numbers being computationally difficult. We want the calculation to be easy to perform in one direction, but difficult to invert if you don't have the proper key.

So far, we have discussed how public-key cryptography worked, but we never discussed how were those public and private keys generated.

The main principle in generating public / private key pairs is the use of large prime numbers. Recall from the previous post about prime numbers.

• Unpredictability: Large primes are not easily guessable, adding a layer of security,

• Unique Factorization: The fact that every natural number can be uniquely factored into primes is crucial in algorithms like RSA, where the security relies on the difficulty of factoring the product of two large prime numbers.

Euler's Totient Function

Euler's totient function \(\phi(n)\) is defined as the count of positive integers up to \(n\) that are relatively prime to \(n\). Simply it calculates the number of integers less than \(n\) that do not share any common factors with \(n\), except for the number 1.

Calculation

• For a Prime Number\(p\): \(\phi(p) = p - 1.\) This is because all numbers less than a prime number are coprime to it.

• For a Product of Two Primes\(p\) and \(q\): \(\phi(p \ \times \ q) = (p - 1) \ \times \ (q - 1).\) This results from the fact that none of the numbers less than \(p \ \times \ q\) are divisible by either \(p\) or \(q\), except for the multiples of \(p\) and \(q\).

• General Case: If \(n = p_1^{k_1} \times p_2^{k_2} \times \ ... \ \times p_r^{k_r}\), where \(p_1, p_2, ..., p_r\) are distinct prime numbers and \(k_1, k_2, ..., k_r\) are their respective powers, then

  • \(\phi(n) = n \times (1 - \frac{1}{p_1}) \times (1 - \frac{1}{p_2}) \times \ ... \ \times (1 - \frac{1}{p_r})\).

Formula of Secrecy

It is time to construct the key generation algorithm.

For the algorithm to help Bob communicate with Alice, Bob would need to create a public key for Alice to encrypt messages, and a private key to help Bob decrypt Alice's messages. RSA key generation works as follows:

1. Take two large prime numbers, \(p\) and \(q\), and multiply them to get a number \(N\). Keep \(p\) and \(q\) secret.

2. Calculate the totient of \(N\): \(\phi(N) = (p-1)(q-1)\).

3. Find a positive integer \(e\) that is less than \(\phi(N)\) and is coprime with \(\phi(N)\), meaning the greatest common divisor (GCD) between \(e\) and \(\phi(N)\) is 1.

4. Calculate the number \(d = e^{-1} \ mod \ \phi(N)\). Notice that this means \(e \cdot d \equiv 1 \ mod \ \phi(N)\), so \(d\) and \(e\) are modular inverses of one another.

The pair of integers \((N, e)\) represents Bob's public key and can be shared by everyone who wants to communicate with him. Similarly \((N,d)\) represents Bob's private key that is supposed to be kept as a secret.

Encryption / Decryption

Now, if Alice wants to send a message \(m\) and encrypt it into ciphertext \(c\) to send over to Bob, she would perform the following calculation:

$$Enc(m) = m^{e} \ mod \ N = c.$$

Bob receives the encrypted message and decrypts it by performing the following calculation:

$$Dec(c) = c^{d} \ mod \ N = m.$$

Notice that the aysmmetric encryption correctness property holds:

$$Dec(Enc(m)) = m^{ed} \ mod \ N \equiv m \ mod \ N$$

as \(e\) and \(d\) are multiplicative inverses of each other.

From Theory to Hands-on Practice (Rust Code)

Key Generation

Before starting to write generate_keys() function, let's recall a slightly modified version of mod_inverse() function we have built in the previous post:

fn mod_inverse(e: u64, phi: u64) -> Option<u64> {
    let (mut a, mut b, mut x0, mut x1) = (phi, e, 0u64, 1u64);

    while b > 0 {
        let q = a / b;
        (a, b) = (b, a % b);
        (x0, x1) = (x1, x0.wrapping_sub(x1.wrapping_mul(q)));
    }

    if a > 1 {
        None // No modular inverse if a is not 1
    } else {
        Some(x0.wrapping_add(phi) % phi)
    }
}

We will also need a new function to calculate modular exponents (to perform an exponentiation over a modulus):

fn mod_exp(mut base: u64, mut exp: u64, modulus: u64) -> u64 {
    if modulus == 1 { return 0 }
    let mut result = 1;
    base %= modulus;
    while exp > 0 {
        if exp % 2 == 1 { result = result * base % modulus }
        exp >>= 1;
        base = base * base % modulus;
    }
    result
}

Now, we are ready to construct the key generation function. It will take the tuple\((p, q)\)and will output the triple \((N, e, d)\):

fn generate_keys(p: u64, q: u64) -> (u64, u64, u64) {

}

Let us start by defining the basic variables like

• \(N = p \times q\),

• \(\phi = (p-1)(q-1)\):

let N = p * q;
let phi = (p - 1) * (q - 1);

The most commonly used value for \(e\) in RSA-like systems is 65537 (which is of course a prime number).

let e = 65537;

Now that we have everything we need, all we have to do is calculate \(d\) by calculating the modular inverse of \(e\) in mod \(\phi\) by ensuring such a modular inverse exists:

let d = mod_inverse(e, phi).expect("Modular inverse does not exist!");

Returning the \((N, e, d)\) triple will complete generate_keys() function:

fn generate_keys(p: u64, q: u64) -> (u64, u64, u64) {
    let n = p * q;
    let phi = (p - 1) * (q - 1);
    let e = 65537; // Using 65537 as e
    let d = mod_inverse(e, phi).expect("Modular inverse does not exist.");

    (n, e, d)
}

Encryption / Decryption

Let us recall the encryption and decryption functions:

$$Enc(m) = m^{e} \ mod \ N = c. $$

$$Dec(c) = c^{d} \ mod \ N = m.$$

So, all we need for encryption is to have:

• \(m\) (message) as the base,

• \(e\) as the exponent, and

• \(N\) as the modulus:

fn encrypt(message: u64, e: u64, n: u64) -> u64 {
    mod_exp(message, e, n)
}

Similarly, what we need for decryption is to have:

• \(c\) (ciphertext) as the base,

• \(d\) as the exponent, and

• \(N\) as the modulus:

fn decrypt(ciphertext: u64, d: u64, n: u64) -> u64 {
    mod_exp(ciphertext, d, n)
}

The code is almost ready. We need to define \(p\), \(q\), and the message \(m\). Normally those primes are extremely large to make the system more complicated. But, for the sake of simplicity, let's choose \(p\) and \(q\) a bit small, for example:

• \(p\) = 61,

• \(q\) = 53.

Of course, there are some restrictions we need to be mindful of:

1. They are both prime.

2. \(\phi = (p-1)(q-1) = 3120\) is coprime to \(e = 65537\).

So, we can proceed with these selections. Let's implement it inside the main() function:

fn main() {
    let p: u64 = 61;
    let q: u64 = 53;
    let (n, e, d) = generate_keys(p, q);

    let message = 42;
    let encrypted = encrypt(message, e, n);
    let decrypted = decrypt(encrypted, d, n);
}

It is useful to put some print lines to check if the code is working properly:

fn main() {
    let p: u64 = 61;
    let q: u64 = 53;
    let (n, e, d) = generate_keys(p, q);

    println!("Public Key: (e: {}, n: {})", e, n);
    println!("Private Key: (d: {}, n: {})", d, n);

    let message = 42;
    let encrypted = encrypt(message, e, n);
    let decrypted = decrypt(encrypted, d, n);

    println!("Original message: {}", message);
    println!("Encrypted message: {}", encrypted);
    println!("Decrypted message: {}", decrypted);
}

It is time to test!

Output:

Public Key: (e: 65537, N: 3233)
Private Key: (d: 2753, N: 3233)
Original message: 42
Encrypted message: 2557
Decrypted message: 42

As you can see, we are able to retrieve the original message after completing the encryption and decryption processes. So our code passed the most fundamental test:

$$Dec(Enc(m)) \equiv m \ mod \ N.$$

You can test this code by yourself on Rust Playground.

Don't forget the coprimality condition when setting the primes \(p\) and \(q\).

Conclusion

In this post, we have delved deeper into the world of public-key cryptography, exploring the aspects of public and private keys, and how they are used in RSA encryption. We've discussed the importance of prime numbers in generating these keys and touched on Euler's Totient Function, which plays a crucial role in the process. We've also seen how these concepts are applied in real-world scenarios like email, social media, and blockchains. Lastly, we have taken a practical approach by implementing these concepts in Rust code, demonstrating how to generate keys and encrypt and decrypt messages.

I hope this series of posts has been helpful for you. See you in the next post!

Contents

1. What is a prime number, though?

   1. Definition and Basic Properties

      1. Definition

      2. Unique Factorization

      3. Infinitude of Prime Numbers

   2. History

2. How to find them?

   1. Trial Division

   2. Sieve of Eratosthenes

   3. Probabilistic Tests

3. Modular Arithmetic

   1. Definition

   2. Example

   3. Modular Inverse

   4. Euclidean Algorithm

   5. Extended Euclidean Algorithm

4. From Theory to Hands-On Practice

   1. Rust Code

5. Conclusion

What is a prime number, though?

Definition and Basic Properties

Definition: A natural number is called a prime number (or prime) if it is greater than 1 and cannot be written as the product of two smaller natural numbers.

For example, 13 is prime because the only way of writing it as a product, 1 × 13 or 13 × 1. However, 14 is not prime because it can be written as a product, 7 × 2 or 2 × 7.

Prime Factorization

Writing a natural number as a product of prime numbers is called a prime factorization of the number. For example:

The terms in the expression are called prime factors.

The fundamental significance of prime numbers to number theory in general comes from the fundamental theorem of arithmetic.

Fundamental Theorem of Arithmetic: Every integer larger than 1 can be written as a product of one or more primes.

More strongly, this product is unique in the sense that any two prime factorizations of the same number will have the same numbers of copies of the same primes, although their ordering may differ. So, although there are many different ways of finding a factorization using an integer factorization algorithm, they all must produce the same result. Primes can thus be considered the "basic building blocks" of the natural numbers.

Infinitude of Prime Numbers

There are infinitely many prime numbers, so the following sequence never ends:

We have many proofs for this statement.

Euclid’s Proof: Euclid proposed a proof published in his well-known Elements.

Consider any finite list of prime numbers:

Let P be the product of all the prime numbers in this list:

Now, let q = P + 1. Then q is either prime, or not:

• If q is prime, then there is at least one more prime that is not in the list, q itself.

• If q is not prime, then some prime factor p is supposed to divide q. But p also divides P + 1 = q, as just proposed. If p divides P and also q, then p must also divide the difference (that is equal to 1). Since no prime number divides 1, p cannot be in the list. This means that at least one more prime number exists beyond those in the list.

History

The Rhind Mathematical Papyrus, from around 1550 BC, has Egyptian fraction expansions of different forms for prime and composite numbers. However, the earliest surviving records of the study of prime numbers come from the ancient Greek mathematians, who called them prōtos arithmòs (πρῶτος ἀριθμὸς). Euclid's Elements (c. 300 BC) proves the infinitude of primes and the fundamental theorem of arithmetic, and shows how to construct a perfect number from a Mersenne prime.

Around 1000 AD, the Islamic mathematician Ibn al-Haytham (Alhazen) found Wilson's theorem, characterizing the prime numbers as the numbers n that evenly divide

He also conjectured that all even perfect numbers come from Euclid's construction using Mersenne primes, but was unable to prove it.

In 1640, Pierre de Fermat stated Fermat’s Little Theorem.

Fermat’s Little Theorem: If p is a prime and a is any integer not divisible by p, then a ^{p − 1} − 1 is divisible by p.

In 1742, Christian Goldbach formulated Goldbach’s conjecture:

Goldbach’s Conjecture: Every even natural number greater than 2 is the sum of two prime numbers.

How to find them?

Trial Division

It is the most intuitive and straightforward method to determine if an integer is prime. You basically;

1. begin with the smallest prime number 2,

2. divide the given number by the prime number to check if it’s a divisor,

3. repeat the process by performing the division by the next prime.

As you may notice, this method is effective for small numbers or numbers with small factors. It becomes impractical for large numbers as the number of divisions (and the time required) increase rapidly.

Sieve of Eratosthenes

It is one of the ancient methods to find all prime numbers up to a specified integer. You;

1. start by listing all the numbers from 2 to the maximum number N you' chose,

2. identify the first prime in the list, which is 2,

3. remove all multiples of this prime number from the list except the prime itself (2, 4, 6, 8, …),

4. move to the next number in the list that has not been removed, that is the next prime,

5. repeat the process.

Probabilistic Tests

• Fermat Primality Test,

• Miller-Rabin Primality Test,

• Solovay-Strassen Primality Test.

Modular Arithmetic

Definition: Given an integer n > 1, called a modulus, two integers a and b are said to be congruent modulo n, if n is a divisor of their difference; that is, if there is an integer k such that

Congruence modulo n is denoted as

Example

In modulus 17:

Because the difference is 62 - 28 = 34 = 2 × 17, a multiple of 17.

Equivalently, 62 and 28 have the same remainder when 11 when divided by 17.

Modular Inverse

Notion of modular inverse and finding the modular inverse of an integer are crucially important in cryptography.

A modular inverse of an integer a is an integer b such that the product ab is congruent to 1 with respect to the modulus m.

This congruence is written as

Our goal is to find such b for an integer a for given modulo m.

Euclidean Algorithm

Recall from high school that greatest common divisor (GCD) of two integers x and y is the largest integer that divides both x and y.

The Euclidean algorithm is a technique for finding the GCD of two integers.

1. Given two integers a and b, ensure a\>b. If a<b, swap them.

2. Divide a by b, and take note of the remainder, r.

3. Replace a with b and b with r.

4. Repeat steps 2 and 3 until b becomes 0. The non-zero remainder at this point, which will be in the place of a, is the GCD of the original a and b.

Example:

To find gcd⁡(48,18)gcd(48,18):

• Step 1: 48 divided by 18 gives a remainder of 12 (48=18×2+12).

• Step 2: Replace 48 with 18 and 18 with 12, then divide 18 by 12 giving a remainder of 6 (18=12×1+6).

• Step 3: Replace 18 with 12 and 12 with 6, then divide 12 by 6 giving a remainder of 0 (12=6×2+0).

• Since the remainder is 0, the GCD is the last non-zero remainder, which is 6.

Extended Euclidean Algorithm

The Extended Euclidean algorithm is an extension of the Euclidean Algorithm. It not only finds the GCD of two integers a and b but also finds integers x and y (coefficients) such that ax + by \= gcd(a, b).

Algorithm Steps:

1. Initialize two pairs of coefficients (x1​, y1​)=(1, 0) and (x2​, y2​)=(0, 1). These represent the coefficients for a and b in the equation ax + by \= gcd(a, b).

2. Perform the Euclidean Algorithm steps on a and b. Simultaneously, update the coefficients x1​, y1​, x2​, and y2​ with each division step.

   • After each division a\=bq + r, update a and b as in the Euclidean algorithm.

   • Update x1​ and y1​ to x2​ and y2​, respectively.

   • Update x2​ and y2​ to x1​ − q × x2​ and y1​ − q × y2​, respectively.

3. Continue until b becomes 0. At this point, a is the GCD, and x1​ and y1​ will be the coefficients that satisfy ax + by \= gcd(a, b).

Example:

To find coefficients x and y such that 48x + 18y \= gcd(48, 18):

Following the steps of the algorithm will lead you to calculate the coefficients alongside finding the GCD. For this particular example, you'll end up with specific x and y values that, when multiplied by 48 and 18 respectively and added, equal 6 (the GCD).

From Theory to Hands-On Practice

Rust Code

Let us start by initializing our function with some initial variable assignments:

fn mod_inverse(a: i64, m: i64) -> i64 {
    let (mut m0, mut x0, mut x1) = (m, 0, 1);
    let mut a = a;
}

• m0 is set to m to remember the original value of m throughout the algorithm.

• x0 and x1 are initialized to 0 and 1, respectively. These variables are used to keep track of the coefficients of a and m in the Extended Euclidean algorithm. By the end of the algorithm, x1 will hold the modular inverse of a modulo m.

Before diving deeper, we need to handle an edge case.

    if m == 1 {
        return 0;
    }

• If m is 1, the function immediately returns 0 as the modular inverse does not exist in this case.

Now, we can construct the algorithm using a loop:

    while a > 1 {
        let q = a / m;
        let t = m;
        m = a % m; a = t;
        let t = x0;
        x0 = x1 - q * x0;
        x1 = t;
    }

• The loop will iterate as long as a is greater than 1.

• q is the quotient of the division of a by m.

• The algorithm then updates a and m using the Euclidean algorithm to find the GCD. So m becomes a%m and a takes on the old value of m.

• Simultaneously, it updates x0 and x1, which are tracking the coefficients for a and m that would be used to express the GCD as a linear combination of a and m. The goal here is to keep updating these coefficients until we find the modular inverse.

Before returning the modular inverse, let’s be cool and check if the result needs any sign adjustment:

    if x1 < 0 {
        x1 += m0;
    }

• Once the loop exits, x1 may hold the modular inverse of a modulo m, but it might be negative. In such a case, we just add m0 to ensure the modular inverse is positive.

Now, it’s time to return the modular inverse, which is completing our function:

    return x1

OR

    x1

In Rust, the final expression in the function is used as return value.

So, final version of our code is as follows:

fn mod_inverse(mut a: i64, mut m: i64) -> i64 {
    let (m0, mut x0, mut x1) = (m, 0, 1);

    if m == 1 {
        return 0;
    }

    while a > 1 {
        let q = a / m;
        let t = m;
        m = a % m; a = t;
        let t = x0;
        x0 = x1 - q * x0;
        x1 = t;
    }

    if x1 < 0 {
        x1 += m0;
    }

    x1
}

Let’s see if it’s working. We can try to find the modular inverse of 4 modulo 11:

fn main() {
    println!("{}", mod_inverse(4, 11));
}

Output:

3

It’s correct, right? If you multiply 4 by 3, you obtain 12 that is equivalent to 1 in mod 11.

You can test this code by yourself on Rust Playground.

Conclusion

In this post, we've delved into the world of prime numbers and modular arithmetic, exploring their pivotal roles within the historical evolution of mathematics. We've also discussed the Euclidean algorithm, a cornerstone for understanding how to compute the modular inverse—a critical operation in cryptographic systems. To bridge theory with practice, I've provided a Rust code snippet that demonstrates how to calculate the modular inverse of an integer modulo m.

Looking ahead, the next post will shift focus to cryptographic key pairs. We'll explore their significance in securing digital communication and walk through the process of generating them. This upcoming discussion promises to further demystify the complex yet intriguing field of cryptography, equipping you with the knowledge to understand and apply these concepts in real-world scenarios.

Image Reference

https://en.wikipedia.org/wiki/Rhind_Mathematical_Papyrus#/media/File:Rhind_Mathematical_Papyrus.jpg

https://en.wikipedia.org/wiki/Eratosthenes#/media/File:Eratosthenes_profile.png

• basic understanding of cryptography,

• mathematical fundamentals of public-key cryptography,

• a concise Rust code to generate the keys, apply the relevant mathematical operations, and encrypt/decrypt a message.

Contents

1. What is cryptography?

   1. Terminology

2. Historical Background

   1. Ancient Origins

   2. Middle Ages to Renaissance

   3. The Age of Mechanical Devices

   4. The Modern Era

3. Types of Cryptography

   1. Symmetric Cryptography (Private-Key Encryption)

   2. Aysmmetric Cryptography (Public-Key Encryption)

4. Cryptanalysis

   1. Methods

5. Conclusion

What is cryptography?

Cryptography is a branch of mathematics focusing on the development of techniques for secure communication. Main goal is to protect the privacy and integrity of any information from third parties.

The word comes from Greek kryptós, meaning "secret," and graphein, meaning "to write." It may be translated as “secret writing”.

Terminology

• Plaintext: It is the original, readable, and unencrypted data or message.

• Ciphertext: It refers to the encrypted data or message produced by the encryption process. It’s supposed to be unreadable or unintelligible to unauthorized individuals.

• Key: It is a piece of information, usually a string of characters, that determines the functional output of a cryptographic algorithm.

• Encryption: It is the process of converting plaintext into ciphertext. It involves using a cryptographic algorithm and a key to transform the readable data (plaintext) into an unreadable format (ciphertext).

• Decryption: It is the reverse process of encryption. It involves converting ciphertext back into its original plaintext form.

Historical Background

Ancient Origins

The use of cryptography dates back to ancient civilizations. The earliest known use was in Egypt, around 1900 BCE, where hieroglyphs were used in an unusual way, possibly to hide the actual message.

The Greeks and Romans also advanced some cryptographic techniques. The most popular example is the Caesar cipher which I'll give more details in the upcoming sections of this post.

The Middle Ages to Renaissance

The Arab mathematician, Al-Kindi, in the 9th century, wrote a manuscript on deciphering encrypted messages, introducing frequency analysis to break substitution ciphers.

During the Renaissance, European cryptographers developed more sophisticated methods for encryption like the [Vigenere cipher](https://en.wikipedia.org/wiki/Vigen%C3%A8re_cipher#:~:text=The%20Vigen%C3%A8re%20cipher%20(French%20pronunciation,of%20another%20text%2C%20the%20key.), a method using a series of different Caesar ciphers based on the letters of a keyword.

The Age of Mechanical Devices

The most popular example would be German's Enigma machine that is used during World War II. It employed a complex system of rotors and electrical circuits to encrypt messages.

The Modern Era

Following the advancement in computer technology, science of cryptography had also a major transformation. In the 1970s, the Data Encryption Standard (DES) was developed by IBM.

One of the most groundbreaking development was the introduction of public-key cryptography in the 1970s by Whitfield Diffie and Martin Hellman. It solved the problem of secure key distribution which was significant limitation back then.

Types of Cryptography

Cryptography is mainly divided into two paradigms:

1. Symmetric cryptography (private-key encryption)

2. Asymmetric cryptography (public-key encryption)

Symmetric Cryptography

In symmetric cryptography, the same key is used for both encryption and decryption.

Flow:

1. Alice encrypts her message (plaintext) using the key and sends it to Bob.

2. Bob receives the encrypted message (ciphertext), decrypts it using the same key, and then reads it.

Example: Caesar Cipher

Caesar cipher, also known as the shift cipher, is one of the simplest and most widely known encryption techniques. Each letter in the plaintext message is shifted forward in the alphabet by the key number of places. If the shift takes you past 'Z', you wrap around to the start of the alphabet. For example, with a shift of 3:

• 'HELLO' becomes 'KHOOR'.

• 'CAESAR CIPHER' becomes 'FDHVDU FLSKHU'.

In order to decrypt a ciphertext, the same process is applied backwards.

As you might have noticed;

Encrypting function: Shifting the letters forward:

where

• x = index of the letter in the alphabet,

• n = number of shifting.

Decrypting function: Shifting the letters backwards:

where

• x = index of the letter in the alphabet,

• n = number of shifting.

Key: How many times the number will be shifted:

Limitation

Both parties are responsible with protecting secrecy of the key as well, in addition to the encrypting and decryption functions.

Asymmetric Cryptography

In asymmetric cryptography, different keys are used for encryption and decryption.

Private Key: It is used for decryption. Private keys must be kept secure and confidential by its owner.

Public Key: It is used for encryption and generated from private keys. Public keys can be distributed widely.

We will dive into more details of these in the 3rd post of this series, keys.

Flow

1. Alice encrypts her message (plaintext) using Bob’s public key, and sends it to Bob.

2. Bob receives the encrypted message (ciphertext), decrypts it using his own private key, and then reads it.

Formal Expression

Encryption process:

where

• E: encrypting function,

• pub: public key of the recipient,

• m: message to be encrypted,

• c: encrypted message or ciphertext.

Decryption process:

where

• D: decrypting function,

• priv: private key of the recipient,

• c: ciphertext to be decrypted,

• m: decrypted message (plaintext).

Crucial point here is that the following equation must be satisfied for all messages:

If this equation holds, then the decrypting function can always be used consistently.

Cryptanalysis

Cryptanalysis is the study of analyzing information systems to understand the hidden aspects. It’s primarily used to break cryptographic security systems and gain access to the contents of encrypted messages, even if the cryptographic key is unknown.

Methods

Brute Force Attack: It involves trying every possible key until the correct one is found. Although it’s simple, it can be extremely time-consuming for systems with large key spaces.

Frequency Analysis: Recall the Caesar cipher, which is a type of substitution ciphers, that the letters in the message were shifted according to the key. This method involves studying the frequency of letters or groups of letters in a ciphertext. I't’s effective against simple substitution ciphers where certain letters or patterns occur more frequently.

Side-Channel Attacks: These attacks exploit information gained from the physical implementation of a cryptosystem, such as timing information, power consumption, electromagnetic leaks, or even sound.

Conclusion

In this post, I’ve tried to explain some fundamental concepts in basic cryptography and their historical background.

As progress in this series, we will dive deeper into the mathematical underpinnings of public-key cryptography and explore practical implementations using Rust. My aim is not just to understand the theoretical aspects but also to see how these concepts come to life in code.

Image Reference

https://makeameme.org/meme/crypto-means-cryptography

https://en.wikipedia.org/wiki/Enigma_machine#/media/File:Enigma-plugboard.jpg

https://imgflip.com/tag/brute+force