next up previous
Next: Application of one-way functions Up: An easy problem and Previous: How modular logarithms differ

Modular exponentiation as a one-way function

A one-way function is a function f such that the first problem below is computationally ``easy'' and the second problem is computationally ``hard''.

forward:
Input: an element b of the domain of f.
Output: the value of f(b).
backward:
Input: an element c of the range of f.
Output: an element b of the domain of f such that f(b)=c

Thus a one-way function is one for which it's easy to go from a domain element to its image, but hard to go from a range element to its pre-image.

It is important to realize that a one-way function does not involve a key. It can be assumed that the details of the one-way function are known to everybody, including potential hackers. The security of a system that uses one-way functions should not depend on any mystery surrounding the one-way function but only on the computational difficulty of going backwards.

One example of a one-way function is tex2html_wrap_inline779 where m is a huge odd modulus, say a couple hundred digits. For an input b, a computer can use the repeated-squaring algorithm to calculate tex2html_wrap_inline785 in a few hundred thousand steps--no problem. However, to calculate b from the value y is to solve the modular logarithm problem. We believe that there is no good algorithm for this problem.

Of course, this does not mean that every instance of the backward problem is hard to solve. We have seen in this class, for example, that if the modulus m is very small, finding the modular logarithm is not hard. Even if the modulus m is huge (as it should be), if the value of b is very small then tex2html_wrap_inline797 is the same as tex2html_wrap_inline799 --it's as if we're doing the exponentiation in ordinary arithmetic because the numbers don't get big enough for the modular nature of the arithmetic to have any effect. For such an instance, going backwards involves taking an ordinary (exact) logarithm. This apparent security flaw is subsumed by a more general issue concerning the use of one-way functions. The more general issue arises in both example applications we discuss below.

For some applications, f being one-way is not sufficient. In discussing the second of two applications below, we see that modular exponentiation has at least one weakness that makes it not quite suitable; there is a kind of security defect. In this class, we are ignoring this defect. Use of modular exponentiation as a one-way function also has a usability defect: even though we have a reasonably fast algorithm for modular exponentiation, the repeated-squaring algorithm, for some applications even this is not fast enough. For these two reasons, in practice other, more complicated functions are used as one-way functions. In this class, for the sake of simplicity, we will stick with modular exponentiation as a one-way function.


next up previous
Next: Application of one-way functions Up: An easy problem and Previous: How modular logarithms differ

Lisa Eckstein
Thu Nov 21 01:20:27 EST 1996