New Directions in Cryptography Invited Paper Whitfield Diffie and Martin E.Hellman Abstract Two kinds of contemporary developments in cryp- communications over an insecure channel order to use cryptog- tography are examined.Widening applications of teleprocess- raphy to insure privacy,however,it currently necessary for the ing have given rise to a need for new types of cryptographic communicating parties to share a key which is known to no systems,which minimize the need for secure key distribution one else.This is done by sending the key in advance over some channels and supply the equivalent of a written signature.This secure channel such a private courier or registered mail.A paper suggests ways to solve these currently open problems. private conversation between two people with no prior acquain- It also discusses how the theories of communication and compu- tance is a common occurrence in business,however,and it is tation are beginning to provide the tools to solve cryptographic unrealistic to expect initial business contacts to be postponed problems of long standing. long enough for keys to be transmitted by some physical means. The cost and delay imposed by this key distribution problem is a major barrier to the transfer of business communications 1 INTRODUCTION to large teleprocessing networks. Section III proposes two approaches to transmitting keying We stand today on the brink of a revolution in cryptography. information over public(i.e.,insecure)channel without compro- The development of cheap digital hardware has freed it from mising the security of the system.In public key cryptosystem the design limitations of mechanical computing and brought enciphering and deciphering are governed by distinct keys,E the cost of high grade cryptographic devices down to where and D,such that computing D from E is computationally infeasi- they can be used in such commercial applications as remote cash dispensers and computer terminals.In turn,such applica- ble (e.g.,requiring 10100 instructions).The enciphering key tions create a need for new types of cryptographic systems E can thus be publicly disclosed without compromising the which minimize the necessity of secure key distribution chan- deciphering key D.Each user of the network can,therefore, nels and supply the equivalent of a written signature.At the place his enciphering key in a public directory.This enables same time,theoretical developments in information theory and any user of the system to send a message to any other user computer science show promise of providing provably secure enciphered in such a way that only the intended receiver is cryptosystems,changing this ancient art into a science. able to decipher it.As such,a public key cryptosystem is The development of computer controlled communication net- multiple access cipher.A private conversation can therefore be works promises effortless and inexpensive contact between peo- held between any two individuals regardless of whether they ple or computers on opposite sides of the world,replacing most have ever communicated before.Each one sends messages to mail and many excursions with telecommunications.For many the other enciphered in the receiver public enciphering key applications these contacts must be made secure against both and deciphers the messages he receives using his own secret eavesdropping and the injection of illegitimate messages.At deciphering key. present,however,the solution of security problems lags well We propose some techniques for developing public key crypt- behind other areas of communications technology.Contempo-osystems,but the problem is still largely open. rary cryptography is unable to meet the requirements,in that Public key distribution systems offer a different approach to its use would impose such severe inconveniences on the system eliminating the need for a secure key distribution channel.In users,as to eliminate many of the benefits of teleprocessing. such a system,two users who wish to exchange a key communi- The best known cryptographic problem is that of privacy: cate back and forth until they arrive a key in common.A third preventing the unauthorized extraction of information from party eavesdropping on this exchange must find it computation- ally infeasible to compute the key from the information over- Manuscript received June 3,1976.This work was partially supported by heard.A possible solution to the public key distribution problem the National Science Foundation under NSF Grant ENG 10173.Portions of this work were presented at the IEEE Information Theory Workshop,Lenox, is given in Section III,and Merkle [1]has a partial solution of MA,June 23-25,1975 and the IEEE International Symposium on Information a different form. Theory in Ronneby,Sweden,June 21-24,1976. A second problem,amenable to cryptographic solution which W.Diffie is with the Department of Electrical Engineering,Stanford Univer- stands in the way ofreplacing contemporary business communi- sity,Stanford,CA,and the Stanford Artificial Intelligence Laboratory,Stanford, CA94305. cations by teleprocessing systems is authentication.In current M.E.Hellman is with the Department of Electrical Engineering,Stanford business,the validity of contracts guaranteed by signatures.A University,Stanford,CA 94305. signed contract serves as gal evidence of an agreement which 29
New Directions in Cryptography Invited Paper Whitfield Diffie and Martin E. Hellman Abstract Two kinds of contemporary developments in cryp- communications over an insecure channel order to use cryptogtography are examined. Widening applications of teleprocess- raphy to insure privacy, however, it currently necessary for the ing have given rise to a need for new types of cryptographic communicating parties to share a key which is known to no systems, which minimize the need for secure key distribution one else. This is done by sending the key in advance over some channels and supply the equivalent of a written signature. This secure channel such a private courier or registered mail. A paper suggests ways to solve these currently open problems. private conversation between two people with no prior acquainIt also discusses how the theories of communication and compu- tance is a common occurrence in business, however, and it is tation are beginning to provide the tools to solve cryptographic unrealistic to expect initial business contacts to be postponed problems of long standing. long enough for keys to be transmitted by some physical means. The cost and delay imposed by this key distribution problem is a major barrier to the transfer of business communications 1 INTRODUCTION to large teleprocessing networks. Section III proposes two approaches to transmitting keying We stand today on the brink of a revolution in cryptography. information over public (i.e., insecure) channel without compro- The development of cheap digital hardware has freed it from mising the security of the system. In public key cryptosystem the design limitations of mechanical computing and brought enciphering and deciphering are governed by distinct keys, E the cost of high grade cryptographic devices down to where and D,such that computing D from E is computationally infeasi- they can be used in such commercial applications as remote ble (e.g., requiring 10100 instructions). The enciphering key cash dispensers and computer terminals. In turn, such applica- E can thus be publicly disclosed without compromising the tions create a need for new types of cryptographic systems deciphering key D. Each user of the network can, therefore, which minimize the necessity of secure key distribution chan- place his enciphering key in a public directory. This enables nels and supply the equivalent of a written signature. At the any user of the system to send a message to any other user same time, theoretical developments in information theory and enciphered in such a way that only the intended receiver is computer science show promise of providing provably secure able to decipher it. As such, a public key cryptosystem is cryptosystems, changing this ancient art into a science. The development of computer controlled communication net- multiple access cipher. A private conversation can therefore be works promises effortless and inexpensive contact between peo- held between any two individuals regardless of whether they ple or computers on opposite sides of the world, replacing most have ever communicated before. Each one sends messages to mail and many excursions with telecommunications. For many the other enciphered in the receiver public enciphering key applications these contacts must be made secure against both and deciphers the messages he receives using his own secret eavesdropping and the injection of illegitimate messages. At deciphering key. present, however, the solution of security problems lags well We propose some techniques for developing public key cryptbehind other areas of communications technology. Contempo- osystems, but the problem is still largely open. rary cryptography is unable to meet the requirements, in that Public key distribution systems offer a different approach to its use would impose such severe inconveniences on the system eliminating the need for a secure key distribution channel. In users, as to eliminate many of the benefits of teleprocessing. such a system, two users who wish to exchange a key communiThe best known cryptographic problem is that of privacy: cate back and forth until they arrive a key in common. A third preventing the unauthorized extraction of information from party eavesdropping on this exchange must find it computationally infeasible to compute the key from the information overManuscript received June 3, 1976. This work was partially supported by heard. A possible solution to the public key distribution problem the National Science Foundation under NSF Grant ENG 10173. Portions of is given in Section III, and Merkle [1] has a partial solution of this work were presented at the IEEE Information Theory Workshop, Lenox, MA, June 23–25, 1975 and the IEEE International Symposium on Information a different form. Theory in Ronneby, Sweden, June 21–24, 1976. A second problem, amenable to cryptographic solution which W. Diffie is with the Department of Electrical Engineering, Stanford Univer- stands in the way of replacing contemporary business communi- sity, Stanford, CA, and the Stanford Artificial Intelligence Laboratory, Stanford, cations by teleprocessing systems is authentication. In current CA 94305. M. E. Hellman is with the Department of Electrical Engineering, Stanford business, the validity of contracts guaranteed by signatures. A University, Stanford, CA 94305. signed contract serves as gal evidence of an agreement which 29
30 DIFFIE AND HELLMAN the holder can present in court if necessary.The use of signa-the unauthorized injection of messages into a public channel, tures,however,requires the transmission and storage of written assuring the receiver of a message of the legitimacy of its sender. contracts.In order to have a purely digital replacement for his A channel is considered public if its security is inadequate paper instrument,each user must be able to produce message for the needs of its users.A channel such as a telephone line whose authenticity can be checked by anyone,but which could may therefore be considered private by some users and public not have been produced by anyone else,even the recipient.by others.Any channel may be threatened with eavesdropping Since only one person can originate messages but many people or injection or both,depending on its use.In telephone commu- can receive messages,this can be viewed as a broadcast cipher. nication,the threat of injection is paramount,since the called Current electronic authentication techniques cannot meet this party cannot determine which phone is calling.Eavesdropping, need. which requires the use of a wiretap,is technically more difficult Section IV discusses the problem of providing a true,digtal,and legally hazardous.In radio,by comparison,the situation message dependent signature.For reasons brought but there,is reversed.Eavesdropping is passive and involves no legal we refer to this as the one-way authentication problem.Some hazard,while injection exposes the illegitimate transmitter to partial solutions are given,and it is shown how any public key discovery and prosecution. cryptosystem can be transformed into a one-way authentica- Having divided our problems into those of privacy and tion system. authentication we will sometimes further subdivide authentica- Section V will consider the interrelation of various crypto-tion into message authentication,which is the problem defined graphic problems and introduce the even more difficult problem above,and user authentication,in which the only task of the of trap doors. system is to verify that an individual is who he claims to be. At the same time that communications and computation have For example,the identity of an individual who presents a credit given rise to new cryptographic problems,their off-ring,infor-card must be verified,but there is no message which he wishes mation theory,and the theory of computation have begun to to transmit.In spite of this apparent absence of a message in supply tools for the solution of important problems in classi- user authentication,the two problems are largely equivalent. cal cryptography. In user authentication,there is an implicit message."I AM The search for unbreakable codes is one of the oldest themes USER X,"while message authentication is just verification of of cryptographic research,but until this century proposed sys-the identity of the party sending the message.Differences in tems have ultimately been broken.In the nineteen twenties,the threat environments and other aspects of these two subpro- however,the "one time pad"was inated,and shown to be blems,however,sometimes make it convenient to distinguish unbreakable [2,pp.398-400].The theoretical basis underlying between them. this and related systems was on a firm foundation a quarter Figure 1 illustrates the flow of information in a conventional century later by information theory [3].One time pads require cryptographic system used for privacy of communications. extremely long days and are therefore prohibitively expensive There are three parties:a transmitter,a receiver,and an eaves- in most applications. dropper.The transmitter generates a plaintext or unenciphered In contrast,the security of most cryptographic systems message p to be communicated over an insecure channel to besides in the computational difficulty to the cryptanalyst dis-the legitimate receiver.In order to prevent the eavesdropper covering the plaintext without knowledge of the key.This prob- from learning P the transmitter perates on P with an invertible lem falls within the domains of computational complexity and transformation Sk to produce the ciphertext or cryptogram C analysis of algorithms,two recent disciples which study the =Sx(P).The key K is transmitted only to the legitimate receiver difficulty of solving computational problems.Using the results via a secure channel,indicated by a shielded path in Figure 1. of these theories,it may be possible to extend proofs of security Since the legitimate receiver knows K.he can decipher C by to more useful classes systems in the foreseeable future.Section operating with Sx-to obtain Sk(C)=Sk(SK(P))=P.the VI explores this possibility. original plaintext message.The secure channel cannot be used Before proceeding to newer developments,we introduce ter- to transmit P itself for reasons of capacity or delay.For example. minology and define threat environments in the next section. 2 CONVENTIONAL CRYPTOGRAPHY Cryptography is the study of"mathematical"systems involving two kinds of security problems:privacy and authentication.A privacy system prevents the extraction information by unautho- rized parties from messages transmitted over a public channel, thus assuring the sender of a message that it is being read only Figure 1:Flow of informatrion in conventional cryptographic by the intended recipient.An authentication system prevents system
30 DIFFIE AND HELLMAN the holder can present in court if necessary. The use of signa- the unauthorized injection of messages into a public channel, tures, however, requires the transmission and storage of written assuring the receiver of a message of the legitimacy of its sender. contracts. In order to have a purely digital replacement for his A channel is considered public if its security is inadequate paper instrument, each user must be able to produce message for the needs of its users. A channel such as a telephone line whose authenticity can be checked by anyone, but which could may therefore be considered private by some users and public not have been produced by anyone else, even the recipient. by others. Any channel may be threatened with eavesdropping Since only one person can originate messages but many people or injection or both, depending on its use. In telephone commucan receive messages, this can be viewed as a broadcast cipher. nication, the threat of injection is paramount, since the called Current electronic authentication techniques cannot meet this party cannot determine which phone is calling. Eavesdropping, need. which requires the use of a wiretap, is technically more difficult Section IV discusses the problem of providing a true, digtal, and legally hazardous. In radio, by comparison, the situation message dependent signature. For reasons brought but there, is reversed. Eavesdropping is passive and involves no legal we refer to this as the one-way authentication problem. Some hazard, while injection exposes the illegitimate transmitter to partial solutions are given, and it is shown how any public key discovery and prosecution. cryptosystem can be transformed into a one-way authentica- Having divided our problems into those of privacy and tion system. authentication we will sometimes further subdivide authenticaSection V will consider the interrelation of various crypto- tion into message authentication, which is the problem defined graphic problems and introduce the even more difficult problem above, and user authentication, in which the only task of the of trap doors. system is to verify that an individual is who he claims to be. At the same time that communications and computation have For example, the identity of an individual who presents a credit given rise to new cryptographic problems, their off-ring, infor- card must be verified, but there is no message which he wishes mation theory, and the theory of computation have begun to to transmit. In spite of this apparent absence of a message in supply tools for the solution of important problems in classi- user authentication, the two problems are largely equivalent. cal cryptography. In user authentication, there is an implicit message. “I AM The search for unbreakable codes is one of the oldest themes USER X,” while message authentication is just verification of of cryptographic research, but until this century proposed sys- the identity of the party sending the message. Differences in tems have ultimately been broken. In the nineteen twenties, the threat environments and other aspects of these two subprohowever, the “one time pad” was inated, and shown to be blems, however, sometimes make it convenient to distinguish unbreakable [2, pp. 398–400]. The theoretical basis underlying between them. this and related systems was on a firm foundation a quarter Figure 1 illustrates the flow of information in a conventional century later by information theory [3]. One time pads require cryptographic system used for privacy of communications. extremely long days and are therefore prohibitively expensive There are three parties: a transmitter, a receiver, and an eavesin most applications. dropper. The transmitter generates a plaintext or unenciphered In contrast, the security of most cryptographic systems message P to be communicated over an insecure channel to besides in the computational difficulty to the cryptanalyst dis- the legitimate receiver. In order to prevent the eavesdropper covering the plaintext without knowledge of the key. This prob- from learning P, the transmitter perates on P with an invertible lem falls within the domains of computational complexity and transformation SK to produce the ciphertext or cryptogram C analysis of algorithms, two recent disciples which study the 5 SK(P). The key K is transmitted only to the legitimate receiver difficulty of solving computational problems. Using the results via a secure channel, indicated by a shielded path in Figure 1. of these theories, it may be possible to extend proofs of security Since the legitimate receiver knows K, he can decipher C by to more useful classes systems in the foreseeable future. Section operating with SK 21 to obtain SK 21 (C) 5 SK 21 (SK(P)) 5 P, the VI explores this possibility. original plaintext message. The secure channel cannot be used Before proceeding to newer developments, we introduce ter- to transmit P itself for reasons of capacity or delay. For example, minology and define threat environments in the next section. 2 CONVENTIONAL CRYPTOGRAPHY Cryptography is the study of “mathematical” systems involving two kinds of security problems: privacy and authentication. A privacy system prevents the extraction information by unauthorized parties from messages transmitted over a public channel, thus assuring the sender of a message that it is being read only Figure 1: Flow of informatrion in conventional cryptographic by the intended recipient. An authentication system prevents system
NEW DIRECTIONS IN CRYPTOGRAPHY 31 the secure channel might be a weekly courier and the insecure added modulo 2 to the bits of the plaintext.Block ciphers act channel a telephone line. in a purely combinatorial fashion on large blocks of text,in A cryptographic system is a single parameter family such a way that a small change in the input block produces a (Sk);ZkEKz)of invertible transformations major change in the resulting output.This paper deals primarily with block ciphers,because this error propagation property is Sx:{P}→{C} (1) valuable in many authentication applications. In an authentication system,cryptography is used to guaran- from a space p)of plaintext messages to a space C of tee the authenticity of the message to the receiver.Not only ciphertext messages.The parameter K is called the key and is must a meddler be prevented from injecting totally new,authen- selected from a finite set (K)called the keyspace.Ifthe message tic looking messages into a channel,but he must be prevented spaces(P)and (C)are equal,we will denote them both by (M).from creating apparently authentic messages by combining,or When discussing individual cryptographic transformations Sk,merely repeating,old messages which he has copied in the we will sometimes omit mention of the system and merely past.A cryptographic system intended to guarantee privacy refer to the transformation K. will not,in general,prevent this latter form of mischief. The goal in designing the cryptosystem {Sk)is to make To guarantee the authenticity of a message,information is the enciphering and deciphering operations inexpensive,but to added which is a function not only of the message and a secret ensure that any successful cryptanalytic operation is too com-key,but of the date and time as well,for example,by attaching plex to be economical.There are two approaches to this prob-the date and time to each message and encrypting the entire lem.A system which is secure due to the computational cost sequence.This assures that only someone who possesses the of cryptanalysis,but which would succumb to an attack with key can generate a message which,when decrypted,will contain unlimited computation,is called computationally secure:while the proper date and time.Care must be taken,however,to use a system which can resist any cryptanalytic attack,no matter a system in which small changes in the ciphertext result in how much computation is allowed,is called unconditionally large changes in the deciphered plaintext.This intentional error secure.Unconditionally secure systems are discussed in [3]and propagation ensures that if the deliberate injection of noise on 4]and belong to that portion of information theory,called the the channel changes a message such as "erase file 7"into a Shannon theory.which is concerned with optimal performance different message such as "erase file 8,"it will also corrupt the obtainable with unlimited computation. authentication information.The message will then be rejected Unconditional security results from the existence of multiple as inauthentic. meaningful solutions to a cryptogram.For example,the simple The first step in assessing the adequacy of cryptographic substitution cryptogram XMD resulting from English text can systems is to classify the threats to which they are to be sub- represent the plaintext messages:now,and,the,etc.A computa-jected.The following threats may occur to cryptographic sys- tionally secure cryptogram,in contrast,contains sufficient tems employed for either privacy or authentication. information to uniquely determine the plaintext and the key. A ciphertext only attack is a cryptanalytic attack in which Its security resides solely in the cost of computing them. the cryptanalyst possesses only ciphertext. The only unconditionally secure system in common use is A known plaintext attack is a cryptanalytic attack in which the the one time pad,in which the plaintext is combined with a cryptanalyst possesses a substantial quantity of corresponding randomly chosen key of the same length.While such a system plaintext and ciphertext. is provably secure,the large amount of key required makes it A chosen plaintext attack is a cryptanalytic attack in which impractical for most applications.Except as otherwise noted, the cryptanalyst can submit an unlimited number of plaintext this paper deals with computationally secure systems since messages of his own choosing and examine the resulting these are more generally applicable.When we talk about the cryptograms. need to develop provably secure cryptosystems we exclude In all cases it is assumed that the opponent knows the general those,such as the one time pad,which are unwieldly to use. system {Sk)in use since this information can be obtained by Rather,we have in mind systems using only a few hundred studying a cryptographic device.While many users of cryptog- bits of key and implementable in either a small amount of raphy attempt to keep their equipment secret,many commercial digital hardware or a few hundred lines of software. applications require not only that the general system be public We will call a task computationally infeasible if its cost as but that it be standard. measured by either the amount of memory used or the runtime A ciphertext only attack occurs frequently in practice.The is finite but impossibly large. cryptanalyst uses only knowledge of the statistical properties Much as error correcting codes are divided into convolutional of the language in use (e.g.,in English,the letter e occurs 13 and block codes,cryptographic systems can be divided into percent of the time)and knowledge of certain"probable"words two broad classes:stream ciphers and block ciphers.Stream (e.g.,a letter probably begins "Dear Sir:").It is the weakest ciphers process the plaintext in small chunks(bits or characters),threat to which a system can be subjected,and any system usually producing a pseudorandom sequence of bits which is which succumbs to it is considered totally insecure
NEW DIRECTIONS IN CRYPTOGRAPHY 31 the secure channel might be a weekly courier and the insecure added modulo 2 to the bits of the plaintext. Block ciphers act channel a telephone line. in a purely combinatorial fashion on large blocks of text, in A cryptographic system is a single parameter family such a way that a small change in the input block produces a {SK};zKP{K;z} of invertible transformations major change in the resulting output. This paper deals primarily with block ciphers, because this error propagation property is SK:{P} → {C} (1) valuable in many authentication applications. In an authentication system, cryptography is used to guaranfrom a space {P} of plaintext messages to a space {C} of tee the authenticity of the message to the receiver. Not only ciphertext messages. The parameter K is called the key and is must a meddler be prevented from injecting totally new, authenselected from a finite set {K} called the keyspace. If the message tic looking messages into a channel, but he must be prevented spaces {P} and {C} are equal, we will denote them both by {M}. from creating apparently authentic messages by combining, or When discussing individual cryptographic transformations SK, merely repeating, old messages which he has copied in the we will sometimes omit mention of the system and merely past. A cryptographic system intended to guarantee privacy refer to the transformation K. will not, in general, prevent this latter form of mischief. The goal in designing the cryptosystem {SK} is to make To guarantee the authenticity of a message, information is the enciphering and deciphering operations inexpensive, but to added which is a function not only of the message and a secret ensure that any successful cryptanalytic operation is too com- key, but of the date and time as well, for example, by attaching plex to be economical. There are two approaches to this prob- the date and time to each message and encrypting the entire lem. A system which is secure due to the computational cost sequence. This assures that only someone who possesses the of cryptanalysis, but which would succumb to an attack with key can generate a message which, when decrypted, will contain unlimited computation, is called computationally secure; while the proper date and time. Care must be taken, however, to use a system which can resist any cryptanalytic attack, no matter a system in which small changes in the ciphertext result in how much computation is allowed, is called unconditionally large changes in the deciphered plaintext. This intentional error secure. Unconditionally secure systems are discussed in [3] and propagation ensures that if the deliberate injection of noise on [4] and belong to that portion of information theory, called the the channel changes a message such as “erase file 7” into a Shannon theory, which is concerned with optimal performance different message such as “erase file 8,” it will also corrupt the obtainable with unlimited computation. authentication information. The message will then be rejected Unconditional security results from the existence of multiple as inauthentic. meaningful solutions to a cryptogram. For example, the simple The first step in assessing the adequacy of cryptographic substitution cryptogram XMD resulting from English text can systems is to classify the threats to which they are to be subrepresent the plaintext messages: now, and, the, etc. A computa- jected. The following threats may occur to cryptographic systionally secure cryptogram, in contrast, contains sufficient tems employed for either privacy or authentication. information to uniquely determine the plaintext and the key. A ciphertext only attack is a cryptanalytic attack in which Its security resides solely in the cost of computing them. the cryptanalyst possesses only ciphertext. The only unconditionally secure system in common use is A known plaintext attack is a cryptanalytic attack in which the the one time pad, in which the plaintext is combined with a cryptanalyst possesses a substantial quantity of corresponding randomly chosen key of the same length. While such a system plaintext and ciphertext. is provably secure, the large amount of key required makes it A chosen plaintext attack is a cryptanalytic attack in which impractical for most applications. Except as otherwise noted, the cryptanalyst can submit an unlimited number of plaintext this paper deals with computationally secure systems since messages of his own choosing and examine the resulting these are more generally applicable. When we talk about the cryptograms. need to develop provably secure cryptosystems we exclude In all cases it is assumed that the opponent knows the general those, such as the one time pad, which are unwieldly to use. system {SK} in use since this information can be obtained by Rather, we have in mind systems using only a few hundred studying a cryptographic device. While many users of cryptogbits of key and implementable in either a small amount of raphy attempt to keep their equipment secret, many commercial digital hardware or a few hundred lines of software. applications require not only that the general system be public We will call a task computationally infeasible if its cost as but that it be standard. measured by either the amount of memory used or the runtime A ciphertext only attack occurs frequently in practice. The is finite but impossibly large. cryptanalyst uses only knowledge of the statistical properties Much as error correcting codes are divided into convolutional of the language in use (e.g., in English, the letter e occurs 13 and block codes, cryptographic systems can be divided into percent of the time) and knowledge of certain “probable” words two broad classes: stream ciphers and block ciphers. Stream (e.g., a letter probably begins “Dear Sir:”). It is the weakest ciphers process the plaintext in small chunks (bits or characters), threat to which a system can be subjected, and any system usually producing a pseudorandom sequence of bits which is which succumbs to it is considered totally insecure
32 DIFFIE AND HELLMAN The system which is secure against a known plaintext attends also protect against the threat of dispute.That is,a message frees its users from the need to keep their past messages secret, may be sent but later repudiated by either the transmitter or or to paraphrase them prior to classification.This is an unreason- the receiver.Or,it may be alleged by either party that a message able burden to place on the systems users,particularly in com- was sent when in fact none was.Unforgeable digital signatures mercial situations where luct announcements or press releases and receipts are needed.For example,a dishonest stockbroker may be sent in typted form for later public disclosure.Similar might try to cover up unauthorized buying and selling for situations in diplomatic correspondence have led to the cracking personal gain by forging orders from clients,or a client might many supposedly secure systems.While a known text attack disclaim an order actually authorized by him but which he later is not always possible,its occurrence is uent enough that a sees will cause a loss.We will introduce concepts which allow system which cannot resist it is not considered secure the receiver to verify the authenticity of a message,but prevent The chosen plaintext attack is difficult to achieve in justice, him from generating apparently authentic messages,thereby but can be approximated.For example,submitted to a proposal protecting against both the threat of compromise of the receiv- to a competitor may result in his enciphering it for transmission er's authentication data and the threat of dispute to his headquarters.A cipher which is secure against a chosen plaintext attack thus frees users from concern over whether their opponents can t messages in their system. 3 PUBLIC KEY CRYPTOGRAPHY For the purpose of certifying systems as secure,it is appro- priate to consider the more formidable cryptanalytic as these As shown in Figure 1,cryptography has been a derivative not only give more realistic models of the caring environment security measure.Once a secure channel exists along which of a cryptographic system,but make assessment of the system's keys can be transmitted,the security can be extended to other strength easier.Many systems which are difficult to analyze channels of higher bandwidth or smaller delay by encrypting using a ciphertext only check can be ruled out immediately the messages sent on them.The effect has been to limit the under known plaining or chosen plaintext attacks. use of cryptography to communications among people who It is clear from these definitions,cryptanalysis is a identifica- have made prior preparation for cryptographic security. tion problem.The known plaintext and even plaintext attacks In order to develop large,secure,telecommunications sys- correspond to passive and active identification problems, tems,this must be changed.A large number of users n results respectively.Unlike many effects in which system identification in an even larger number,(n2-n)/2 potential pairs who may is considered,such automatic fault diagnosis,the goal in cryp- wish to communicate privately from all others.It is unrealistic tography is build systems which are difficult,rather than easy, to assume either that a pair of users with no prior acquaintance to identify. will be able to wait for a key to be sent by some secure physical The chosen plaintext attack is often called an IFF attack means,or that keys for all (n-n)/2 pairs can be arranged in terminology which descends from its origin in the development advance.In another paper [5],the authors have considered a of cryptographic"identification friend or systems after World conservative approach requiring no new development in cryp- War II.An IFF system enables ary radars to distinguish between tography itself,but this involves diminished security,inconve- friendly and enemy es automatically.The radar sends a time- nience,and restriction of the network to a starlike configuration varying enge to the airplane which receives the challenge,pts with respect to initial connection protocol. it under the appropriate key,and sends it back to radar.By We propose that it is possible to develop systems of the type comparing this response with a correctly pted version of the shown in Figure 2,in which two parties communicating solely challenge,the radar can recognize kindly aircraft.While the over a public channel and using only publicly known techniques aircraft are over enemy territory,enemy cryptanalysts can send can create a secure connection.We examine two approaches challenges and expect the encrypted responses in an attempt to this problem,called public key cryptosystems and public key to determine authentication key in use,thus mounting a chosen distribution systems,respectively.The first are more powerful, text attack on the system.In practice,this threat is entered lending themselves to the solution of the authentication prob- by restricting the form of the challenges,which are not be lems treated in the next section.while the second are much unpredictable,but only nonrepeating. closer to realization. There are other threats to authentication systems which can- not be treated by conventional cryptography,and with require recourse to the new ideas and techniques reduced in this paper. The threat of compromise of the ver's authentication data is motivated by the situation multiuser networks where the receiver is often the system itself.The receiver's password tables and other authentication data are then more vulnerable to theft than those of the transmitter(an individual user).As shown later,some techniques for protecting against this threat Figure 2:Flow of information in public key system
32 DIFFIE AND HELLMAN The system which is secure against a known plaintext attends also protect against the threat of dispute. That is, a message frees its users from the need to keep their past messages secret, may be sent but later repudiated by either the transmitter or or to paraphrase them prior to classification. This is an unreason- the receiver. Or, it may be alleged by either party that a message able burden to place on the systems users, particularly in com- was sent when in fact none was. Unforgeable digital signatures mercial situations where luct announcements or press releases and receipts are needed. For example, a dishonest stockbroker may be sent in typted form for later public disclosure. Similar might try to cover up unauthorized buying and selling for situations in diplomatic correspondence have led to the cracking personal gain by forging orders from clients, or a client might many supposedly secure systems. While a known text attack disclaim an order actually authorized by him but which he later is not always possible, its occurrence is uent enough that a sees will cause a loss. We will introduce concepts which allow system which cannot resist it is not considered secure. the receiver to verify the authenticity of a message, but prevent The chosen plaintext attack is difficult to achieve in justice, him from generating apparently authentic messages, thereby but can be approximated. For example, submitted to a proposal protecting against both the threat of compromise of the receivto a competitor may result in his enciphering it for transmission er’s authentication data and the threat of dispute. to his headquarters. A cipher which is secure against a chosen plaintext attack thus frees users from concern over whether their opponents can t messages in their system. 3 PUBLIC KEY CRYPTOGRAPHY For the purpose of certifying systems as secure, it is appro- As shown in Figure 1, cryptography has been a derivative priate to consider the more formidable cryptanalytic as these security measure. Once a secure channel exists along which not only give more realistic models of the caring environment keys can be transmitted, the security can be extended to other of a cryptographic system, but make assessment of the system’s channels of higher bandwidth or smaller delay by encrypting strength easier. Many systems which are difficult to analyze the messages sent on them. The effect has been to limit the using a ciphertext only check can be ruled out immediately use of cryptography to communications among people who under known plaining or chosen plaintext attacks. have made prior preparation for cryptographic security. It is clear from these definitions, cryptanalysis is a identifica- In order to develop large, secure, telecommunications sys- tion problem. The known plaintext and even plaintext attacks tems, this must be changed. A large number of users n results correspond to passive and active identification problems, in an even larger number, (n2 2 n)/2 potential pairs who may respectively. Unlike many effects in which system identification wish to communicate privately from all others. It is unrealistic is considered, such automatic fault diagnosis, the goal in cryp- to assume either that a pair of users with no prior acquaintance tography is build systems which are difficult, rather than easy, will be able to wait for a key to be sent by some secure physical to identify. means, or that keys for all (n The chosen plaintext attack is often called an IFF attack 2 2 n)/2 pairs can be arranged in advance. In another paper [5], the authors have considered a terminology which descends from its origin in the development conservative approach requiring no new development in cryp- of cryptographic “identification friend or systems after World War II. An IFF system enables ary radars to distinguish between tography itself, but this involves diminished security, inconvenience, and restriction of the network to a starlike configuration friendly and enemy es automatically. The radar sends a time- with respect to initial connection protocol. varying enge to the airplane which receives the challenge, pts We propose that it is possible to develop systems of the type it under the appropriate key, and sends it back to radar. By shown in Figure 2, in which two parties communicating solely comparing this response with a correctly pted version of the over a public channel and using only publicly known techniques challenge, the radar can recognize kindly aircraft. While the can create a secure connection. We examine two approaches aircraft are over enemy territory, enemy cryptanalysts can send to this problem, called public key cryptosystems and public key challenges and expect the encrypted responses in an attempt distribution systems, respectively. The first are more powerful, to determine authentication key in use, thus mounting a chosen lending themselves to the solution of the authentication prob- text attack on the system. In practice, this threat is entered lems treated in the next section, while the second are much by restricting the form of the challenges, which are not be closer to realization. unpredictable, but only nonrepeating. There are other threats to authentication systems which cannot be treated by conventional cryptography, and with require recourse to the new ideas and techniques reduced in this paper. The threat of compromise of the ver’s authentication data is motivated by the situation multiuser networks where the receiver is often the system itself. The receiver’s password tables and other authentication data are then more vulnerable to theft than those of the transmitter (an individual user). As shown later, some techniques for protecting against this threat Figure 2: Flow of information in public key system
NEW DIRECTIONS IN CRYPTOGRAPHY 33 A public key cryptosystem is a pair of families (EkKEK)involves a matrix in version which is a harder problem.And and (Dx'kek of algorithms representing invertible it is at least conceptually simpler to obtain an arbitrary pair of transformations. inverse matrices than it is to invert a given matrix.Start with the identity matrix and do elementary row and column opera- Es:{M→{G (2)tions to obtain an arbitrary invertible matrix E.Then starting with do the inverses of these same elementary operations in reverse order to obtain D=E-1.The sequence of elementary Dk:{M0→{M0 (3) operations could be easily determined from a random bit string. Unfortunately,matrix inversion takes only about n opera- on a finite message space {M,such that tions.The ratio of"cryptanalytic"time(i.e.,computing D from E)to enciphering or deciphering time is thus at most n.and 1)for every K (K),Ek is the inverse of DK, 2)for every K {K)and M (M,the algorithms Ex and enormous block sizes would be required to obtain ratios of 106 Dk are easy to compute, or greater.Also,it does not appear that knowledge of the 3)for almost every K (K),each easily computed algo- elementary operations used to obtain E from I greatly reduces the time for computing D.And,since there is no round-off rithm equivalent to D&is computationally infeasible to derive from Ek, error in binary arithmetic,numerical stability is unimportant in 4)for every K (K),it is feasible to compute inverse pairs the matrix inversion.In spite of its lack of practical utility,this Ex and Dk from K. matrix example is still useful for clarifying the relationships necessary in a public key cryptosystem. Because of the third property,a user's enciphering key Ek can A more practical approach to finding a pair of easily com- be made public without compromising the security of his secret puted inverse algorithms E and D:such that D is hard to infer deciphering key D&.The cryptographic system is therefore split from E,makes use of the difficulty of analyzing programs in into two parts,a family of enciphering transformations and a low level languages.Anyone who has tried to determine what family of deciphering transformations in such a way that,given operation is accomplished by someone else's machine language a member ofone family,it is infeasible to find the corresponding program knows that E itself(i.e.,what E does)can be hard to member of the other. infer from an algorithm for E.If the program were to be made The fourth property guarantees that there is a feasible way purposefully confusing through addition of unneeded variables of computing corresponding pairs of inverse transformations and statements,then determining an inverse algorithm could be when no constraint is placed on what either the enciphering or made very difficult.Ofcourse,Emust be complicated enough to deciphering transformation is to be.In practice,the cryptoequip-prevent its identification from input-output pairs. ment must contain a true random number generator (e.g.,a Essentially what is required is a one-way compiler:one which noisy diode)for generating K,together with an algorithm for takes an easily understood program written in a high level generating the Ex-D&pair from its outputs. language and translates it into an incomprehensible program Given a system of this kind,the problem of key distribution in some machine language.The compiler is one-way because is vastly simplified.Each user generates a pair of inverse trans-it must be feasible to do the compilation,but infeasible to formations,E and D,at his terminal.The deciphering transfor- reverse the process.Since efficiency in size of program and mation D must be kept secret,but need never be communicated run time are not crucial in this application,such as compilers on any channel.The enciphering key E can be made public by may be possible if the structure of the machine language can placing it in a public directory along with the user's name and be optimized to assist in the confusion. address.Anyone can then encrypt messages and send them to Merkle [1]has independently studied the problem of distrib- the user,but no one else can decipher messages intended for uting keys over an insecure channel.His approach is different him.Public key cryptosystems can thus be regarded as multiple from that of the public key cryptosystems suggested above, access ciphers. and will be termed a public key distribution system.The goal It is crucial that the public file of enciphering keys be pro- is for two users,4 and B,to securely exchange a key over an tected from unauthorized modification.This task is made easier insecure channel.This key is then used by both users in a by the public nature of the file.Read protection is unnecessary normal cryptosystem for both enciphering and deciphering. and,since the file is modified infrequently,elaborate write Merkle has a solution whose cryptanalytic cost grows as n2 protection mechanisms can be economically employed. where n is the cost to the legitimate users.Unfortunately the A suggestive,although unfortunately useless,example of a cost to the legitimate users of the system is as much in transmis- public key cryptosystem is to encipher the plaintext,represented sion time as in computation,because Merkle's protocol requires as a binary n-vector m.by multiplying it by an invertible binary n potential keys to be transmitted before one key can be decided n X n matrix E.The cryptogram thus equals Em.Letting D= on.Merkle notes that this high transmission overhead prevents E-we have m=Dc.Thus,both enciphering and deciphering the system from being very useful in practice.If a one megabit require about n operations.Calculation of D from E,however,limit is placed on the setup protocol's overhead,his technique
NEW DIRECTIONS IN CRYPTOGRAPHY 33 A public key cryptosystem is a pair of families {EK}KP{K} involves a matrix in version which is a harder problem. And and {DK}KP it is at least conceptually simpler to obtain an arbitrary pair of {K} of algorithms representing invertible transformations, inverse matrices than it is to invert a given matrix. Start with the identity matrix I and do elementary row and column operaEK:{M} → {M} (2) tions to obtain an arbitrary invertible matrix E. Then starting with I do the inverses of these same elementary operations in reverse order to obtain D 5 E21. The sequence of elementary DK:{M} → {M} (3) operations could be easily determined from a random bit string. Unfortunately, matrix inversion takes only about n3 operaon a finite message space {M}, such that tions. The ratio of “cryptanalytic” time (i.e., computing D from E) to enciphering or deciphering time is thus at most n, and 1) for every K P {K}, EK is the inverse of DK, enormous block sizes would be required to obtain ratios of 106 2) for every K P {K} and M P {M}, the algorithms EK and or greater. Also, it does not appear that knowledge of the DK are easy to compute, elementary operations used to obtain E from I greatly reduces 3) for almost every K P {K}, each easily computed algo- the time for computing D. And, since there is no round-off rithm equivalent to DK is computationally infeasible to error in binary arithmetic, numerical stability is unimportant in derive from EK, the matrix inversion. In spite of its lack of practical utility, this 4) for every K P {K}, it is feasible to compute inverse pairs matrix example is still useful for clarifying the relationships EK and DK from K. necessary in a public key cryptosystem. Because of the third property, a user’s enciphering key EK can A more practical approach to finding a pair of easily combe made public without compromising the security of his secret puted inverse algorithms E and D; such that D is hard to infer deciphering key DK. The cryptographic system is therefore split from E, makes use of the difficulty of analyzing programs in into two parts, a family of enciphering transformations and a low level languages. Anyone who has tried to determine what family of deciphering transformations in such a way that, given operation is accomplished by someone else’s machine language a member of one family, it is infeasible to find the corresponding program knows that E itself (i.e., what E does) can be hard to member of the other. infer from an algorithm for E. If the program were to be made The fourth property guarantees that there is a feasible way purposefully confusing through addition of unneeded variables of computing corresponding pairs of inverse transformations and statements, then determining an inverse algorithm could be when no constraint is placed on what either the enciphering or made very difficult. Of course, E must be complicated enough to deciphering transformation is to be. In practice, the cryptoequip- prevent its identification from input—output pairs. ment must contain a true random number generator (e.g., a Essentially what is required is a one-way compiler: one which noisy diode) for generating K, together with an algorithm for takes an easily understood program written in a high level generating the EK 2 DK pair from its outputs. language and translates it into an incomprehensible program Given a system of this kind, the problem of key distribution in some machine language. The compiler is one-way because is vastly simplified. Each user generates a pair of inverse trans- it must be feasible to do the compilation, but infeasible to formations, E and D, at his terminal. The deciphering transfor- reverse the process. Since efficiency in size of program and mation D must be kept secret, but need never be communicated run time are not crucial in this application, such as compilers on any channel. The enciphering key E can be made public by may be possible if the structure of the machine language can placing it in a public directory along with the user’s name and be optimized to assist in the confusion. address. Anyone can then encrypt messages and send them to Merkle [1] has independently studied the problem of distribthe user, but no one else can decipher messages intended for uting keys over an insecure channel. His approach is different him. Public key cryptosystems can thus be regarded as multiple from that of the public key cryptosystems suggested above, access ciphers. and will be termed a public key distribution system. The goal It is crucial that the public file of enciphering keys be pro- is for two users, A and B, to securely exchange a key over an tected from unauthorized modification. This task is made easier insecure channel. This key is then used by both users in a by the public nature of the file. Read protection is unnecessary normal cryptosystem for both enciphering and deciphering. and, since the file is modified infrequently, elaborate write Merkle has a solution whose cryptanalytic cost grows as n2 protection mechanisms can be economically employed. where n is the cost to the legitimate users. Unfortunately the A suggestive, although unfortunately useless, example of a cost to the legitimate users of the system is as much in transmispublic key cryptosystem is to encipher the plaintext, represented sion time as in computation, because Merkle’s protocol requires as a binary n-vector m, by multiplying it by an invertible binary n potential keys to be transmitted before one key can be decided n 3 n matrix E. The cryptogram thus equals Em. Letting D 5 on. Merkle notes that this high transmission overhead prevents E21 we have m 5 Dc. Thus, both enciphering and deciphering the system from being very useful in practice. If a one megabit require about n limit is placed on the setup protocol’s overhead, his technique 2 operations. Calculation of D from E, however