Tài liệu Thuật toán Algorithms (Phần 31) docx

FlLE COMPRESSION 293 the message: this means that we need to save the tree along with the message in order to decode it. Fortunately, this does not present any real difficulty. It is actually necessary only to store the code array, because the radix search trie which results from inserting the entries from that array into an initially empty tree is the decoding tree. Thus, the storage savings quoted above is not entirely accurate, because the message can’t be decoded without the trie and we must take into account the cost of storing the trie (i.e., the code array) along with the message. Huffman encoding is therefore only effective for long files where the savings in the message is enough to offset the cost, or in situations where the coding trie can be precomputed and used for a large number of messages. For example, a trie based on the frequencies of occurrence of letters in the English language could be used for text documents. For that matter, a trie based on the frequency of occurrence of characters in Pascal programs could be used for encoding programs (for example, “;” is likely to be near the top of such a trie). A Huffman encoding algorithm saves about 23% when run on the text for this chapter. As before, for truly random files, even this clever encoding scheme won’t work because each character will occur approximately the same number of times, which will lead to a fully balanced coding tree and an equal number of bits per letter in the code. I 294 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. Exercises Implement compression and expansion procedures for the run-length en- coding method for a fixed alphabet described in the text, using Q as the escape character. Could “QQ” occur somewhere in a file compressed using the method described in the text? Could “QQ&” occur? Implement compression and expansion procedures for the binary file en- coding method described in the text. The letter “q” given in the text can be processed as a sequence of five- bit characters. Discuss the pros and cons of doing so in order to use a character-based run-length encoding method. Draw a Huffman coding tree for the string “ABRACADABRA.” How many bits does the encoded message require? What is the Huffman code for a binary file? Give an example showing the maximum number of bits that could be used in a Huffman code for a N-character ternary (three-valued) file. Suppose that the frequencies of the occurrence of all the characters to be encoded are different. Is the Huffman encoding tree unique? Huffman coding could be extended in a straightforward way t,o encode in two-bit characters (using 4-way trees). What would be the main advantage and the main disadvantage of doing so? What would be the result of breaking up a Huffman-encoded string into five-bit characters and Huffman encoding that string? Implement a procedure to decode a Huffman-encoded string, given the code and len arrays. 23. Cryptology In the previous chapter we looked at methods for encoding strings of characters to save space. Of course, there is another very important reason to encode strings of characters: to keep them secret. Cryptology, the study of systems for secret communications, consists of two competing fields of study: cryptography, the design of secret communica- tions systems, and cryptanalysis, the study of ways to compromise secret com- munications systems. The main application of cryptology has been in military and diplomatic communications systems, but other significant applications are becoming apparent. Two principal examples are computer file systems (where each user would prefer to keep his files private) and “electronic funds transfer” systems (where very large amounts of money are involved). A com- puter user wants to keep his computer files just as private as papers in his file cabinet, and a bank wants electronic funds transfer to be just as secure as funds transfer by armored car. Except for military applications, we assume that cryptographers are “good guys” and cryptanalysts are “bad guys”: our goal is to protect our computer files and our bank accounts from criminals. If this point of view seems some- what unfriendly, it must be noted (without being over-philosophical) that by using cryptography one is assuming the existence of unfriendliness! Of course, even “good guys” must know something about cryptanalysis, since the very best way to be sure that a system is secure is to try to compromise it yourself. (Also, there are several documented instances of wars being brought to an end, and many lives saved, through successes in cryptanalysis.) Cryptology has many close connections with computer science and al- gorithms, especially the arithmetic and string-processing algorithms that we have studied. Indeed, the art (science?) of cryptology has an intimate relation- ship with computers and computer science that is only beginning to be fully understood. Like algorithms, cryptosystems have been around far longer 295 296 CHAPTER 23 than computers. Secrecy system design and algorithm design have a common heritage, and the same people are attracted to both. It is not entirely clear which branch of cryptology has been affected most by the availability of computers. The cryptographer now has available a much more powerful encryption machine than before, but this also gives him more room to make a mistake. The cryptanalyst has much more powerful tools for breaking codes, but the codes to be broken are more complicated than ever before. Cryptanalysis can place an incredible strain on computational resources; not only was it among the first applications areas for computers, but it still remains a principal applications area for modern supercomputers. More recently, the widespread use of computers has led to the emergence of a variety of important new applications for cryptology, as mentioned above. New cryptographic methods have recently been developed appropriate for such applications, and these have led to the discovery of a fundamental relationship between cryptology and an important area of theoretical computer science that we’ll examine briefly in Chapter 40. In this chapter, we’ll examine some of the basic characteristics of cryp- tographic algorithms because of the importance of cryptography in modern computer systems and because of close relationships with many of the algo- rithms we have studied. We’ll refrain from delving into detailed implementa- tions: cryptography is certainly a field that should be left to experts. While it’s not difficult to “keep people honest” by encrypting things with a simple cryptographic algorithm, it is dangerous to rely upon a method implemented by a non-expert. Rules of the Game All the elements that go into providing a means for secure communications between two individuals together are called a cryptosystem. The canonical structure of a typical cryptosystem is diagramed below: “attack at dawn” The sender (S) wishes to send a message (called the plaintezt) to the receiver (R). To do so, he transforms the plaintext into a secret form suitable CRYPTOLOGY for transmission (called the ciphertext) using a cryptographic algorithm (the encryption method) and some key (K) parameters. To read the message, the receiver must have a matching cryptographic algorithm (the decryption method) and the same key parameters, which he can use to transform the ciphertext back into the plaintext, the message. It is usually assumed that the ciphertext is sent over insecure communications lines and is available to the cryptanalyst (A). It also is usually assumed that the encryption and decryption methods are known to the cryptanalyst: his aim is to recover the plaintext from the ciphertext without knowing the key parameters. Note that the whole system depends on some separate prior method of communication between the sender and receiver to agree on the key parameters. As a rule, the more key parameters, the more secure the cryptosystem is but the more inconvenient it is to use. This situation is akin to that for more conventional security systems: a combination safe is more secure with more numbers on the combination lock, but it is harder to remember the combination. The parallel with conventional systems also serves as a reminder that any security system is only as secure as the trustworthiness of the people that have the key. It is important to remember that economic questions play a central role in cryptosystems. There is an economic motivation to build simple encryption and decryption devices (since many may need to be provided and complicated devices cost more). Also, there is an economic motivation to reduce the amount of key information that must be distributed (since a very secure and expensive method of communications must be used). Balanced against the cost of implementing cryptographic algorithms and distributing key information is the amount of money the cryptanalyst would be willing to pay to break the system. For most applications, it is the cryptographer’s aim to develop a low-cost system with the property that it would cost the cryptanalyst much more to read messages than he would be willing to pay. For a few applications, a “provably secure” cryptosystem may be required: one for which it can be ensured that the cryptanalyst can never read messages no matter what he is willing to spend. (The very high stakes in some applications of cryptology naturally imply that very large amounts of money are used for cryptanalysis.) In algorithm design, we try to keep track of costs to help us choose the best algorithms; in cryptology, costs play a central role in the design process. Simple Methods Among the simplest (and among the oldest) methods for encryption is the Caesar cipher: if a letter in the plaintext is the Nth letter in the alphabet, replace it by the (N + K)th letter in the alphabet, where K is some fixed integer (Caesar used K = 3). For example, the table below shows how a message is encrypted using this method with K = 1: 298 CHAPTER 23 Plaintext: ATTACK AT DAWN Ciphertext: BUUBDLABUAEB X 0 This method is weak because the cryptanalyst has only to guess the value of K: by trying each of the 26 choices, he can be sure that he will read the message. A far better method is to use a general table to define the substitution to be made: for each letter in the plaintext, the table tells which letter to put in the ciphertext. For example, if the table gives the correspondence ABCDEFGHI JKLMNOPQRSTUVWXYZ THE QUICKBROWNFXJMPDVRLAZYG then the message is encrypted as follows: Plaintext: ATTACK AT DAWN Ciphertext: HWH OTHVTQHAF This is much more powerful than the simple Caesar cipher because the crypt- analyst would have to try many more (about 27! > 1028) tables to be sure of reading the message. However, “simple substitution” ciphers like this are easy to break because of letter frequencies inherent in the language. For ex- ample, since E is the most frequent letter in English text, the cryptanalyst could get good start on reading the message by looking for the most frequent letter in the ciphertext and assuming that it is to be replaced by E. While this might not be the right choice, he certainly is better off than if he had to try all 26 letters. He can do even better by looking at two-letter combinations (“digrams”): certain digrams (such as QJ) never occur in English text while others (such as ER) are very common. By examining frequencies of letters and combinations of letters, a cryptanalyst can very easily break a simple substitution cipher. One way to make this type of attack more difficult is to use more than one table. A simple example of this is an extension of the Caesar cipher called the Vigenere cipher: a small repeated key is used to determine the value of K for each letter. At each step, the key letter index is added to the plaintext letter index to determine the ciphertext letter index. Our sample plaintext, with the key ABC, is encrypted as follows: Key: ABCABCABCABCAB Plaintext: ATTACK AT DAWN Ciphertext: BVWBENACWAFDX P CRYPTOLOGY 299 For example, the last letter of the ciphertext is P, the 16th letter of the alphabet, because the corresponding plaintext letter is N (the 14th letter), and the corresponding key letter is B (the 2nd letter). The Vigenere cipher can obviously be made more complicated by using different general tables for each letter of the plaintext (rather than simple offsets). Also, it is obvious that the longer the key, the better. In fact, if the key is as long as the plaintext, we have the V&am cipher, more commonly called the one-time pad. This is the only provably secure cryptosystem known, and it is reportedly used for the Washington-Moscow hotline and other vital applications. Since each key letter is used only once, the cryptanalyst can do no better than try every possible key letter for every message position, an obviously hopeless situation since this is as difficult as trying all possible messages. However, using each key letter only once obviously leads to a severe key distribution problem, and the one-time pad is only useful for relatively short messages which are to be sent infrequently. If the message and key are encoded in binary, a more common scheme for position-by-position encryption is to use the “exclusive-or” function: to encrypt the plaintext, “exclusive-or” it (bit by bit) with the key. An attractive feature of this method is that decryption is the same operation as encryption: the ciphertext is the exclusive-or of the plaintext and the key, but doing another exclusive-or of the ciphertext and the key returns the plaintext. Notice that the exclusive-or of the ciphertext and the plaintext is the key. This seems surprising at first, but actually many cryptographic systems have the property that the cryptanalyst can discover the key if he knows the plaintext. Encryption/Decryption Machines Many cryptographic applications (for example, voice systems for military communications) involve the transmission of large amounts of data, and this makes the one-time pad infeasible. What is needed is an approximation to the one-time pad in which a large amount of “pseudo-key” can be generated from a small amount of true key to be distributed. The usual setup in such situations is as follows: an encryption machine is fed some cryptovariables (true key) by the sender, which it uses to generate a long stream of key bits (pseudo-key). The exclusive-or of these bits and the plaintext forms the ciphertext. The receiver, having a similar machine and the same cryptovariables, uses them to generate the same key stream to exclusive-or against the ciphertext and to retrieve the plaintext. Key generation in this context is obviously very much like random number generation, and our random number generation methods are appropriate for key generation (the cryptovariables are the initial seeds of the random number 300 CHAPTER 23 generator). In fact, the linear feedback shift registers that we discussed in Chapter 3 were first developed for use in encryption/decryption machines such as described here. However, key generators have to be somewhat more complicated than random number generators, because there are easy ways to attack simple linear feedback shift registers. The problem is that it might be easy for the cryptanalyst to get some plaintext (for example, silence in a voice system), and therefore some key. If the cryptanalyst can get enough key that he has the entire contents of the shift register, then he can get all the key from that point on. Cryptographers have several ways to avoid such problems. One way is to make the feedback function itself a cryptovariable. It is usually assumed that the cryptanalyst knows everything about the structure of the machine (maybe he stole one) except the cryptovariables, but if some of the cryptovariables are used to “configure” the machine, he may have difficulty finding their values. Another method commonly used to confuse the cryptanalyst is the product cipher, where two different machines are combined to produce a complicated key stream (or to drive each other). Another method is nonlinear substitution; here the translation between plaintext and ciphertext is done in large chunks, not bit-by-bit. The general problem with such complex methods is that they can be too complicated for even the cryptographer to understand and that there always is the possibility that things may degenerate badly for some choices of the cryptovariables. Public-Key Cryptosystems In commercial applications such as electronic funds transfer and (real) com- puter mail, the key distribution problem is even more onerous than in the traditional applications of cryptography. The prospect of providing long keys (which must be changed often) to every citizen, while still maintain- ing both security and cost-effectiveness, certainly inhibits the development of such systems. Methods have recently been developed, however, which promise to eliminate the key distribution problem completely. Such systems, called public-key cryptosystems, are likely to come into widespread use in the near future. One of the most prominent of these systems is based on some of the arithmetic algorithms that we have been studying, so we will take a close look at how it works. The idea in public-key cryptosystems is to use a “phone book” of encryp- tion keys. Everyone’s encryption key (denoted by P) is public knowledge: a person’s key could be listed, for example, next to his number in the telephone book. Everyone also has a secret key used for decryption; this secret key (denoted by S) is not known to anyone else. To transmit a message M, the sender looks up the receiver’s public key, uses it to encrypt the message, and then transmits the message. We’ll denote the encrypted message (ciphertext) CRYPTOLOGY by C=P(M). The receiver uses his private decryption key to decrypt and read the message. For this system to work we must have at least the following properties: (4 S(P(M))=M for every message M. (ii) All (S,P) pairs are distinct. (iii) Deriving S from P is as hard as reading M. (iv) Both S and P are easy to compute. The first of these is a fundamental cryptographic property, the second two provide the security, and the fourth makes the system feasible for use. This general scheme was outlined by W. Diffie and M. Hellman in 1976, but they had no method which satisfied all of these properties. Such a method was discovered soon afterwards by R. Rivest, A. Shamir, and L. Adleman. Their scheme, which has come to be known as the RSA public- key cryptosystem, is based on arithmetic algorithms performed on very large integers. The encryption key P is the integer pair (N,p) and the decryption key S is the integer pair (N,s), where s is kept secret. These numbers are intended to be very large (typically, N might be 200 digits and p and s might be 100 digits). The encryption and decryption methods are then simple: first the message is broken up into numbers less than N (for example, by taking lg N bits at a time from the binary string corresponding to the character encoding of the message). Then these numbers are independently raised to a power modulo N: to encrypt a (piece of a) message M, compute C = P(M) = MPmod N, and to decrypt a ciphertext C, compute M = S(C) = C”mod N. This computation can be quickly and easily performed by modifying the elementary exponentiation algorithm that we studied in Chapter 4 to take the remainder when divided by N after each multiplication. (No more than 2 log N such operations are required for each piece of the message, so the tot,al number of operations (on 100 digit numbers!) required is linear in the number of bits in the message.) Property (iv) above is therefore satisfied, and property (ii) can be easily enforced. We still must make sure that the cryptovariables N, p, and s can be chosen so as to satisfy properties (i) and (iii). To be convinced of these requires an exposition of number theory which is beyond the scope of this book, but we can outline the main ideas. First, it is necessary to generate three large (approximately loo-digit) “random” prime numbers: the largest will be s and we’ll call the other two x and y. Then N is chosen to be the product of x and y, and p is chosen so that ps mod (x - l)(y - 1) = 1. It is possible to prove that, with N, p, and s chosen in this way, we have Mps mod N = M for all messages M. More specifically, each large prime can be generated by generating a large random number, then testing successive numbers starting at that point until 302 CHAPTER 23 a prime is found. One simple method performs a calculation on a random number that, with probability l/2, will “prove” that the number to be tested is not prime. (A number which is not prime will survive 20 applications of this test less than one time out of a million, 30 applications less than 1 time out of a billion.) The last step is to compute p: it turns out that a variant of Euclid’s algorithm (see Chapter 1) is just what is needed. Furthermore, s seems to be difficult to compute from knowledge of p (and N), though no one has been able to prove that to be the case. Apparently, finding p from s requires knowledge of x and y, and apparently it is necessary to factor N to calculate x and y. But factoring N is thought to be very difficult: the best factoring algorithms known would take millions of years to factor a 200-digit number, using current technology. An attractive feature of the RSA system is that the complicated com- putations involving N, p, and s are performed only once for each user who subscribes to the system, which the much more frequent operations of encryp- tion and decryption involve only breaking up the message and applying the simple exponentiation procedure. This computational simplicity, combined with all the convenience features provided by public-key cryptosystems, make this system quite attractive for secure communications, especially on computer systems and networks. The RSA method has its drawbacks: the exponentiation procedure is ac- tually expensive by cryptographic standards, and, worse, there is the linger- ing possibility that it might be possible to read messages encrypted using the method. This is true with many cryptosystems: a cryptographic method must withstand serious cryptanalytic attacks before it can be used with confidence. Several other methods have been suggested for implementing public-key cryptosystems. Some of the most interesting are linked to an important class of problems which are generally thought to be very hard (though this is not known for sure), which we’ll discuss in Chapter 40. These cryptosystems have the interesting property that a successful attack could provide insight on how to solve some well-known difficult unsolved problems (as with factoring for the RSA method). This link between cryptology and fundamental topics in computer science research, along with the potential for widespread use of public-key cryptography, have made this an active area of current research. rl . computer science and al- gorithms, especially the arithmetic and string-processing algorithms that we have studied. Indeed, the art (science?) of cryptology has. computers and computer science that is only beginning to be fully understood. Like algorithms, cryptosystems have been around far longer 295 296 CHAPTER 23 than