Blum–Goldwasser cryptosystem

The BG cryptosystem is semantically secure based on the assumed intractability of integer factorization; specifically, factoring a composite value $N = p q$ where $p, q$ are large primes. BG has multiple advantages over earlier probabilistic encryption schemes such as the Goldwasser–Micali cryptosystem. First, its semantic security reduces solely to integer factorization, without requiring any additional assumptions (e.g., hardness of the quadratic residuosity problem or the RSA problem). Secondly, BG is efficient in terms of storage, inducing a constant-size ciphertext expansion regardless of message length. BG is also relatively efficient in terms of computation, and fares well even in comparison with cryptosystems such as RSA (depending on message length and exponent choices). However, BG is highly vulnerable to adaptive chosen ciphertext attacks (see below).

Because encryption is performed using a probabilistic algorithm, a given plaintext may produce very different ciphertexts each time it is encrypted. This has significant advantages, as it prevents an adversary from recognizing intercepted messages by comparing them to a dictionary of known ciphertexts.

Operation

The Blum–Goldwasser cryptosystem consists of three algorithms: a probabilistic key generation algorithm which produces a public and a private key, a probabilistic encryption algorithm, and a deterministic decryption algorithm.

Key generation

The public and private keys are generated as follows:

Choose two large distinct prime numbers $p$ and $q$ such that $p \equiv 3 mod 4$ and $q \equiv 3 mod 4$ .
Compute $n = p q$ .

Then $n$ is the public key and the pair $(p, q)$ is the private key.

Encryption

A message $M$ is encrypted with the public key $n$ as follows:

Compute the block size in bits, $h = ⌊ l o g_{2} (l o g_{2} (n)) ⌋$ .
Convert $M$ to a sequence of $t$ blocks $m_{1}, m_{2}, \dots, m_{t}$ , where each block is $h$ bits in length.
Select a random integer $r < n$ .
Compute $x_{0} = r^{2} mod n$ .
For i from 1 to t
1. Compute $x_{i} = x_{i - 1}^{2} mod n$ .
2. Compute $p_{i} =$ the least significant $h$ bits of $x_{i}$ .
3. Compute $c_{i} = m_{i} \oplus p_{i}$ .
Finally, compute $x_{t + 1} = x_{t}^{2} mod n$ .

The encryption of the message $M$ is then all the $c_{i}$ values plus the final $x_{t + 1}$ value: $(c_{1}, c_{2}, \dots, c_{t}, x_{t + 1})$ .

Decryption

An encrypted message $(c_{1}, c_{2}, \dots, c_{t}, x)$ can be decrypted with the private key $(p, q)$ as follows:

Compute $d_{p} = ((p + 1) / 4)^{t + 1} mod (p - 1)$ .
Compute $d_{q} = ((q + 1) / 4)^{t + 1} mod (q - 1)$ .
Compute $u_{p} = x^{d_{p}} mod p$ .
Compute $u_{q} = x^{d_{q}} mod q$ .
Using the Extended Euclidean Algorithm, compute $r_{p}$ and $r_{q}$ such that $r_{p} p + r_{q} q = 1$ .
Compute $x_{0} = u_{q} r_{p} p + u_{p} r_{q} q mod n$ . This will be the same value which was used in encryption (see proof below). $x_{0}$ can then used to compute the same sequence of $x_{i}$ values as were used in encryption to decrypt the message, as follows.
For i from 1 to t
1. Compute $x_{i} = x_{i - 1}^{2} mod n$ .
2. Compute $p_{i} =$ the least significant $h$ bits of $x_{i}$ .
3. Compute $m_{i} = c_{i} \oplus p_{i}$ .
Finally, reassemble the values $(m_{1}, m_{2}, \dots, m_{t})$ into the message $M$ .

3 more chapters are free with a Lably account.

Example

Let $p = 19$ and $q = 7$ . Then $n = 133$ and $h = ⌊ l o g_{2} (l o g_{2} (133)) ⌋ = 3$ . To encrypt the six-bit message $101001_{2}$ , we break it into two 3-bit blocks $m_{1} = 101_{2}, m_{2} = 001_{2}$ , so $t = 2$ . We select a random $r = 36$ and compute $x_{0} = 36^{2} mod 1 33 = 99$ . Now we compute the $c_{i}$ values as follows:

\begin{matrix} x_{1} & = 99^{2} mod 1 33 = 92 = 1011100_{2}; p_{1} = 100_{2}; c_{1} = 101_{2} \oplus 100_{2} = 001_{2} \\ x_{2} & = 92^{2} mod 1 33 = 85 = 1010101_{2}; p_{2} = 101_{2}; c_{2} = 001_{2} \oplus 101_{2} = 100_{2} \\ x_{3} & = 85^{2} mod 1 33 = 43 \end{matrix}

So the encryption is $(c_{1} = 001_{2}, c_{2} = 100_{2}, x_{3} = 43)$ .

To decrypt, we compute

\begin{matrix} d_{p} & = 5^{3} mod 1 8 = 17 \\ d_{q} & = 2^{3} mod 6 = 2 \\ u_{p} & = 43^{17} mod 1 9 = 4 \\ u_{q} & = 43^{2} mod 7 = 1 \\ (r_{p}, r_{q}) & = (3, - 8) since 3 \cdot 19 + (- 8) \cdot 7 = 1 \\ x_{0} & = 1 \cdot 3 \cdot 19 + 4 \cdot (- 8) \cdot 7 mod 1 33 = 99 \end{matrix}

It can be seen that $x_{0}$ has the same value as in the encryption algorithm. Decryption therefore proceeds the same as encryption:

\begin{matrix} x_{1} & = 99^{2} mod 1 33 = 92 = 1011100_{2}; p_{1} = 100_{2}; m_{1} = 001_{2} \oplus 100_{2} = 101_{2} \\ x_{2} & = 92^{2} mod 1 33 = 85 = 1010101_{2}; p_{2} = 101_{2}; m_{2} = 100_{2} \oplus 101_{2} = 001_{2} \end{matrix}

Proof of correctness

We must show that the value $x_{0}$ computed in step 6 of the decryption algorithm is equal to the value computed in step 4 of the encryption algorithm.

In the encryption algorithm, by construction $x_{0}$ is a quadratic residue modulo $n$ . It is therefore also a quadratic residue modulo $p$ , as are all the other $x_{i}$ values obtained from it by squaring. Therefore, by Euler's criterion, $x_{i}^{(p - 1) / 2} \equiv 1 \mod p$ . Then

x_{t + 1}^{(p + 1) / 4} \equiv (x_{t}^{2})^{(p + 1) / 4)} \equiv x_{t}^{(p + 1) / 2} \equiv x_{t} (x_{t}^{(p - 1) / 2}) \equiv x_{t} \mod p

Similarly,

x_{t}^{(p + 1) / 4} \equiv x_{t - 1} \mod p

Raising the first equation to the power $(p + 1) / 4$ we get

x_{t + 1}^{((p + 1) / 4)^{2}} \equiv x_{t}^{(p + 1) / 4} \equiv x_{t - 1} \mod p

Repeating this $t$ times, we have

x_{t + 1}^{(p + 1) / 4)^{t + 1}} \equiv x_{0} \mod p

x_{t + 1}^{d_{p}} \equiv u_{p} \equiv x_{0} \mod p

And by a similar argument we can show that $x_{t + 1}^{d_{q}} \equiv u_{q} \equiv x_{0} \mod q$ .

Finally, since $r_{p} p + r_{q} q = 1$ , we can multiply by $x_{0}$ and get

x_{0} r_{p} p + x_{0} r_{q} q = x_{0}

from which $u_{q} r_{p} p + u_{p} r_{q} q \equiv x_{0}$ , modulo both $p$ and $q$ , and therefore $u_{q} r_{p} p + u_{p} r_{q} q \equiv x_{0} \mod n$ .

Security and efficiency

The Blum–Goldwasser scheme is semantically-secure based on the hardness of predicting the keystream bits given only the final BBS state $y$ and the public key $N$ . However, ciphertexts of the form $\vec{c}, y$ are vulnerable to an adaptive chosen ciphertext attack in which the adversary requests the decryption $m^{'}$ of a chosen ciphertext $\vec{a}, y$ . The decryption $m$ of the original ciphertext can be computed as $\vec{a} \oplus m^{'} \oplus \vec{c}$ .

Depending on plaintext size, BG may be more or less computationally expensive than RSA. Because most RSA deployments use a fixed encryption exponent optimized to minimize encryption time, RSA encryption will typically outperform BG for all but the shortest messages. However, as the RSA decryption exponent is randomly distributed, modular exponentiation may require a comparable number of squarings/multiplications to BG decryption for a ciphertext of the same length. BG has the advantage of scaling more efficiently to longer ciphertexts, where RSA requires multiple separate encryptions. In these cases, BG may be significantly more efficient.