Feynman’s method: Solve the following equation for $t$

and calculate $I(0)$.

The trick here is to differentiate $I(t)$ under the integral sign and solve the differential equation.

And here is the differential equation for $I(t)$

which can be solved by integration, using the substitution method.

We can find the constant $C$ by computing $I(+\infty)$

The final solution for $I(t)$ is

We can now calculate the original integral

These are my notes on the book Cryptography Engineering by
Niels Ferguson, Bruce Schneier, Tadayoshi Kohno
Paperback: 384 pages
Publisher: John Wiley & Sons; March 2010
ISBN: 978-0470474242

“The world is full of bad security systems designed by people who have read Applied Cryptography.” Cryptography Engineering could have the same effect.

1. The Context of Cryptography

Every system can be attacked. There is no such thing as perfect security. The whole point of a security system is to provide access to some people and not the others. In the end, you will always have to trust some people in some way, and these pople may still be able to attack your system.

When someone claims that they’ve secured a system against a generic attack, you know to be sceptical.

The best way to have confidence in building something secure is to keep it simple. Complexity is a measure of how many thing interact at any one point. To make a large, simple system you have to provide a very clear and simple interface between different parts of the system. Programmers call this modularization.

2. Introduction to Cryptography

Kerchoffs’ Principle The security of the encryption scheme must depend only on the secrecy of the key, and not on the secrecy of the algorithm.

With enough effort, any practical cryptographic system can be attacked successfully. The real question is how much work it takes to break a system.

3. Block Ciphers

Ideal Block Cipher For each key value, we want the block cipher to be a random permutation, and the different permutations for the different key values should be chosen independently.

A block cipher with a block size of $k$ bits specifies a permutation on $k$-bit output. The maximum key size (in bits) in this case is

For a security level of $n$ bits, every cryptographic value should be at least $2n$ bits long.

Exercise 3.1 How much space would be required to store a table for an entire idealized block cipher that operates on $k$-bit blocks and that has $n$-bit keys?

Exercise 3.2 DES. 64-bit block size; 16 rounds. 56-bit keys. How does 3DES work as a function of DES?

Exercise 3.3 AES. 128-bit block size. Key length, rounds: (128, 10), (192, 12), (256, 14).

Exercise 3.8 Using an existing cryptography library, decrypt the following ciphertext (in hex)

539B 333B 3970 6D14 9028 CFE1 D9D4 A407

with the following 256-bit key (also in hex)

8000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0001

using AES.

8070 6050 4030 2010 0807 0605 0403 0201

Solution

$ echo "539B333B39706D149028CFE1D9D4A407" | xxd -r -p | openssl enc -aes256 -d -K "8000000000000000000000000000000000000000000000000000000000000001" -iv 0 -nopad | xxd

Exercise 3.9 Using an existing cryptography library, encrypt the following plaintext (in hex)

296C 93FD F499 AAEB 4194 BABC 2E63 561D

with the following 256-bit key (also in hex)

8000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0001

using AES.

8000 0000 0000 0000 0000 0000 0000 0001

Solution

$ echo "296C93FDF499AAEB4194BABC2E63561D" | xxd -r -p | openssl enc -aes256 -e -K "8000000000000000000000000000000000000000000000000000000000000001" -iv 0 -nopad | xxd

Exercise 3.10 Write a program that experimentally demonstrates the complementation property of DES.

Solution in Groovy

4. Block Cipher Modes

The encryption modes in this chapter are only designed to provide confidentiality against eavesdroppers; they do not stop the attacker from changing the data.

Any padding scheme is acceptable, as long as it is reversible.

In practice all padding rules add a minimum of one byte to the length of the plaintext.

An erroneous padding should be treated in the same manner as an authentication failure.

All block cipher modes leak some information.

The best you can do at this point is use CTR or CBC and limit the amount of data you process with any one key. We suggest limiting CBC encryption to $2^{32}$ blocks or so, and CTR encryption to $2^{60}$ blocks.

Exercise 4.3 Suppose you, as an attacker, observe a 32-byte ciphertext $C$ and a 32-byte ciphertext $C’$. Suppose you know these ciphertexts were generated using CTR mode with the same nonce. The nonce is implicit, so it is not included in the ciphertext. You also know the plaintext $P$ corresponding to $C$. Then you can derive the plaintext $P’$ corresponding to $C’$

Verification in Groovy

Exercise 4.4 Decrypt the ciphertext (in hex)

87F3 48FF 79B8 11AF 3857 D671 8E5F 0F91
7C3D 26F7 7377 635A 5E43 E9B5 CC5D 0592
6E26 FFC5 220D C7D4 05F1 7086 70E6 E017

that was generated with 256-bit AES key (also in hex)

8000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0001

using CBC mode with a random IV. The IV is included at the beginning of the ciphertext.

416e 6f74 6865 7220 7365 6372 6574 2120  Another secret! 
2041 6e64 2061 6e6f 7468 6572 2e20 2020  And another.   

Solution

$ echo "7C3D26F77377635A5E43E9B5CC5D05926E26FFC5220DC7D405F1708670E6E017" | xxd -r -p | openssl enc -aes-256-cbc -d -K "8000000000000000000000000000000000000000000000000000000000000001" -iv 87F348FF79B811AF3857D6718E5F0F91 -nopad | xxd

Exercise 4.5 Encrypt the plaintext

626c 6f63 6b20 6369 7068 6572 7320 2020  block ciphers   
6861 7368 2066 756e 6374 696f 6e73 2078  hash functions x
626c 6f63 6b20 6369 7068 6572 7320 2020  block ciphers   

using AES in ECB mode and the key

8000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0001

Answer

9b75 b376 fdc7 83bd 0dff 4ac4 4078 ea8e  .u.v......J.@x..
6655 f422 2c0d 4133 64f7 48e0 8f18 0513  fU.",.A3d.H.....
9b75 b376 fdc7 83bd 0dff 4ac4 4078 ea8e  .u.v......J.@x..

Solution

$ echo "626C6F636B2063697068657273202020686173682066756E6374696F6E732078626C6F636B2063697068657273202020" | xxd -r -p | openssl enc -aes-256-ecb -e -K "8000000000000000000000000000000000000000000000000000000000000001" -nopad | xxd

Do not ever use ECB for anything.

5. Hash Functions

The collision-resistance requirement merely states that, although collisions exist, they cannot be found.

Some might argue that all $n$-bit hash functions provide only $n/2$ bits of security.

Exercise 5.1 Two blocks

d131 dd02 c5e6 eec4 693d 9a06 98af f95c  .1......i=.....\
2fca b587 1246 7eab 4004 583e b8fb 7f89  /....F~.@.X>....
55ad 3406 09f4 b302 83e4 8883 2571 415a  U.4.........%qAZ
0851 25e8 f7cd c99f d91d bdf2 8037 3c5b  .Q%..........7<[
d882 3e31 5634 8f5b ae6d acd4 36c9 19c6  ..>1V4.[.m..6...
dd53 e2b4 87da 03fd 0239 6306 d248 cda0  .S.......9c..H..
e99f 3342 0f57 7ee8 ce54 b670 80a8 0d1e  ..3B.W~..T.p....
c698 21bc b6a8 8393 96f9 652b 6ff7 2a70  ..!.......e+o.*p

and

d131 dd02 c5e6 eec4 693d 9a06 98af f95c  .1......i=.....\
2fca b507 1246 7eab 4004 583e b8fb 7f89  /....F~.@.X>....
55ad 3406 09f4 b302 83e4 8883 25f1 415a  U.4.........%.AZ
0851 25e8 f7cd c99f d91d bd72 8037 3c5b  .Q%........r.7<[
d882 3e31 5634 8f5b ae6d acd4 36c9 19c6  ..>1V4.[.m..6...
dd53 e234 87da 03fd 0239 6306 d248 cda0  .S.4.....9c..H..
e99f 3342 0f57 7ee8 ce54 b670 8028 0d1e  ..3B.W~..T.p.(..
c698 21bc b6a8 8393 96f9 65ab 6ff7 2a70  ..!.......e.o.*p

produce an MD5 collision

$ echo "d131dd02c5e6eec4693d9a0698aff95c2fcab58712467eab4004583eb8fb7f8955ad340609f4b30283e488832571415a085125e8f7cdc99fd91dbdf280373c5bd8823e3156348f5bae6dacd436c919c6dd53e2b487da03fd02396306d248cda0e99f33420f577ee8ce54b67080a80d1ec69821bcb6a8839396f9652b6ff72a70" | xxd -r | openssl dgst -md5
d41d8cd98f00b204e9800998ecf8427e
$ echo "d131dd02c5e6eec4693d9a0698aff95c2fcab50712467eab4004583eb8fb7f8955ad340609f4b30283e4888325f1415a085125e8f7cdc99fd91dbd7280373c5bd8823e3156348f5bae6dacd436c919c6dd53e23487da03fd02396306d248cda0e99f33420f577ee8ce54b67080280d1ec69821bcb6a8839396f965ab6ff72a70" | xxd -r | openssl dgst -md5
d41d8cd98f00b204e9800998ecf8427e

Exercise 5.2 Compute the SHA-512 hash value of the following message in hex:

4865 6C6C 6F2C 2077 6F72 6C64 2E20 2020  Hello, world.    

Solution

$ echo "48656C6C6F2C20776F726C642E202020" | xxd -r | shasum -ba 512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Exercise 5.3 Consider SHA-512-n, a hash function that first runs SHA-512 and then outputs only the first $n$ bits of the result. Write a program that uses a birthday attack to find and output a collision on SHA-512-n, where $n$ is a multiple of 8 between 8 and 48. Your program may use an existing cryptography library. Time how long your program takes when $n$ is 8, 16, 24, 32, 40, and 48, averaged over five runs for each $n$. How long would you expect your program to take for SHA-512-256? ($1.5\cdot 10^{26}$ years) For SHA-512-384? ($2.7\cdot 10^{45}$ years) For SHA-512 itself? ($5.0\cdot 10^{64}$ years)

Solution in Groovy.

Exercise 5.4 Let SHA-512-n be as in the previous exercise. Write a program that finds a message $M$ (a pre-image) that hashes to the following values.

Solution in Groovy

How long would you expect a similar program to take for SHA-512-256? ($8.6\cdot 10^{63}$ years) For SHA-512-384? ($2.9\cdot 10^{102}$ years) For SHA-512 itself? ($9.9\cdot 10^{140}$ years)

Section 5.2.1 Simple but insecure hash function.

Let $K$ be a 256-bit key set to all zeros. To hash the message $m$, first pad it in some way and break it into 128-bit blocks $m_1,…,m_k$. Set $H_0$ to a 128-bit block of all zeros. And now compute $H_i = AES_K(H_{i-1} \oplus m_i)$. Let $H_k$ be the result of the hash function.

Here’s a non-generic attack. Pick a message $m$ such that after padding it splits into two blocks $m_1$ and $m_2$. Let $H_1$ and $H_2$ denote the values computed as part of the hash function’s internal processing; $H_2$ is also the output of the hash function. Now let $m’_1 = m_2 \oplus H_1$ and let $m’_2 = H_2 \oplus m_2 \oplus H_1$, and let $m’$ be the message that splits into $m’_1$ and $m’_2$ after padding.

Exercise 5.5 Show that both $m$ and $m’$ hash to $H_2$

6. Message Authentication Codes

One should never use the same key for both encryption and authentication.

The Horton Principle Authenticate what is meant, not what is said.

Whenever you do authentication, always think carefully about what other information shuold be included in the authentication.

Exercise 6.2 Suppose $c$ is one block long, $a$ and $b$ are strings that are a multiple of the block length, and $M(a \parallel c) = M(b \parallel c)$. Here $M$ is CBC-MAC. Then $M(a \parallel d) = M(b \parallel d)$ for any block $d$.

Exercise 6.3 Suppose $a$ and $b$ are both one block long, and suppose the sender MACs $a$, $b$, and $a \parallel b$ with CBC-MAC. An attacker who intercepts the MAC tags for these messages can now forge the MAC for the message $m = b \parallel (M(b) \oplus M(a) \oplus b)$, which the sender never sent. The forged tag for this message is equal to $M(a \parallel b)$, the tag for $a \parallel b$.

Exercise 6.4 Suppose message $a$ is one block long. Suppose that an attacker has received the MAC $t$ for $a$ using CBC-MAC under some random key unknown to the attacker. Explain how to forge the MAC for a two-block message of your choice.

Answer

with the same MAC $t$

Example

$ echo 4d414373206172652076657279207573 | xxd -r -p | openssl enc -aes-256-cbc -e -K 8000000000000000000000000000000000000000000000000000000000000001 -nopad -iv 0 | xxd -p
e8e9a4ce5d20c4adf552b2c6382e124e
$ echo 4d414373206172652076657279207573a5a8e7bd7d41b6c8d524d7b4410e673d | xxd -r -p | openssl enc -aes-256-cbc -e -K 8000000000000000000000000000000000000000000000000000000000000001 -nopad -iv 0 | xxd -p -c 32 | cut -c 33-64
e8e9a4ce5d20c4adf552b2c6382e124e

Exercise 6.5 Using an existing cryptography library, compute the MAC of the message

4D41 4373 2061 7265 2076 6572 7920 7573  MACs are very us
6566 756C 2069 6E20 6372 7970 746F 6772  eful in cryptogr
6170 6879 2120 2020 2020 2020 2020 2020  aphy!           

using CBC-MAC with AES and the 256-bit key

8000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0001

Answer

0D82 0E3A 1E10 5D30 7216 FC00 C7A5 B449

Solution

$ echo 4d4143732061726520766572792075736566756c20696e2063727970746f677261706879212020202020202020202020 | xxd -r -p | openssl enc -aes-256-cbc -e -K 8000000000000000000000000000000000000000000000000000000000000001 -nopad -iv 0 | xxd -p -c 48 | cut -c 65-96

Exercise 6.6 Using an existing cryptography library, compute the MAC of the message

4D41 4373 2061 7265 2076 6572 7920 7573  MACs are very us
6566 756C 2069 6E20 6372 7970 746F 6772  eful in cryptogr
6170 6879 21                             aphy!

using HMAC with SHA-256 and the key

0b0b 0b0b 0b0b 0b0b 0b0b 0b0b 0b0b 0b0b
0b0b 0b0b 0b0b 0b0b 0b0b 0b0b 0b0b 0b0b

Answer

BE48 C659 EE04 1EDC 12AF 8D47 9607 7618
9902 E011 B1C6 A540 56A5 B10D 9618 FA4A

Solution

$ echo 4d4143732061726520766572792075736566756c20696e2063727970746f67726170687921 | xxd -r -p | openssl dgst -sha256 -mac HMAC -macopt hexkey:0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b

We can verify the answer using the definition of HMAC

m       = 4d4143732061726520766572792075736566756c20696e2063727970746f67726170687921
K       = 0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b
K'      = 0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0000000000000000000000000000000000000000000000000000000000000000
ipad    = 36363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636
opad    = 5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c

K'+ipad = 3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3636363636363636363636363636363636363636363636363636363636363636
K'+opad = 57575757575757575757575757575757575757575757575757575757575757575C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C

$ echo 3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D36363636363636363636363636363636363636363636363636363636363636364d4143732061726520766572792075736566756c20696e2063727970746f67726170687921 | xxd -r -p | shasum -ba 256
7df010140cf808457a1dd8b0cb4a4a35a8708b77c8a27da4cab9fcb3f839e6f1

$ echo 57575757575757575757575757575757575757575757575757575757575757575C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C7df010140cf808457a1dd8b0cb4a4a35a8708b77c8a27da4cab9fcb3f839e6f1 | xxd -r -p | shasum -ba 256
be48c659ee041edc12af8d47960776189902e011b1c6a54056a5b10d9618fa4a

Exercise 6.7 Using an existing cryptography library, compute the MAC of the message

4D41 4373 2061 7265 2076 6572 7920 7573  MACs are very us
6566 756C 2069 6E20 6372 7970 746F 6772  eful in cryptogr
6170 6879 21                             aphy!

using GMAC with AES and the 256-bit key

8000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0001

and the nonce

0000 0000 0000 0000 0000 0001

Answer for 128-bit tag

34B0 25A5 7D99 3151 2091 2DEF BFE3 29C3

Solution in Groovy

7. The Secure Channel

TODO: Implement secure channel between Alice and Bob in Erlang.

Exercise 7.1 In our design of a secure channel, we said that the message numbers must not repeat. What bad things can happen if the message numbers do repeat?

The same bad things can happen as in Exercise 4.3. Repeating message numbers means reusing the same key stream. Suppose an attacker observes two ciphertexts encoded for the same message number

t1 = 12340000 B24FEDC6243553DA6B1DEF32DCB49FA427A597C2FC806B27BB922940B41C009B25B00106C2F8656089FDAAE017
t2 = 12340000 A743FCDA3E711ECC7D0DFC30CD594ECA8BF27A1DDE276A145CE9BA2AB1C74723881354E667761324DF2446D8F5

Since the key streams for both ciphertexts where the same, the attacker can now compute the difference between them

t1 ⊕ t2 = 150C111C1A444D161610130211EDD16EAC57EDDF22A70133E77B936A05DB47B8ADA355E0A58E764456D9EC38E2

Suppose the attacker knows the first message and its authentication tag

m1 = 4669727374206D657373616765
a1 = 572DBB8560675858ECC378B2ED4D3767251B4D0431544DFAB26CFE47BCA0752D

Now she can compute the second message and its authentication tag

t2 = 5365636F6E6420736563726574 BAFCD529378A877A4BC24B5596DE5D62FE5CF5A99201AD5F3C1ABA11654C4DCF
m2 = 5365636F6E6420736563726574
a2 = BAFCD529378A877A4BC24B5596DE5D62FE5CF5A99201AD5F3C1ABA11654C4DCF

Exercise 7.3 Modify the algorithms for the secure channel in this chapter to use the dedicated, single-key mode for providing both encryption and authentication. You can use GCM as a black box.

function SendMessage
input:   S   Secure session state
         m   Message to be sent
         x   Additional data to be authenticated
output:  t   Data to be transmitted to the receiver
    assert MsgCntSend < 2^32 - 1
    MsgCntSend ← MsgCntSend + 1
    i ← MsgCntSend
    {C, T} ← AES_256_GCM_128(K, i, x, m)
    t ← i || C || T
    return t

8. Implementation Issues

Standard implementation techniques are entirely inadequate to create secure code.

Unless you are willing to put real effort into developing a secure implementation, there is little point in bothering with cryptography.

Many systems contain so-called optimizations that are useless, counterproductive, or insignificant because they do not optimize those parts of the system that form the bottleneck. We have become quite conservative about optimizations. Usually we don’t bother with them.

There are some programmers who implement assertion checking in development, but switch it off when they ship the product. This is not the security perspective.

Ideally, one programmer implements the module and a second programmer implements the tests. Both work from the functional specification. Any misunderstanding between the two is a clear indication that the specification have to be clarified.

The test code is about as big as the operational code, and we have not found a way fo significantly improving that.

Writing high-quality code takes about as long as writing low-quality code, if you count the time from start to finished product, rather than from start to first buggy version.

9. Generating Randomness

The more you know about a value, the smaller its entropy is.

Estimates of the amount of entropy per character in English text vary a bit, but are in the neighborhood of 1.5–2 bits per letter.

Generate 16 random bytes

dd if=/dev/urandom bs=16 count=1 2> /dev/null | xxd -p

Generate random base64 URL safe encoded string

dd if=/dev/urandom bs=32 count=1 2> /dev/null | base64 | tr "/+=" "_- "

Exercise 9.1 Investigate the random number generators built into three of your favourite programming languages. Would you use these random number generators for cryptographic purposes?

JVM — yes; ERTS — yes; Racket — yes.

Exercise 9.2 Using an existing cryptography library, write a short program that generates a 256-bit AES ket using a cryptographic PRNG.

bin:bin_to_hexstr(crypto:strong_rand_bytes(32)).

where bin module is defined here

Exercise 9.5 Using a cryptographic PRNG that outputs a stream of bits, implement a random number generator that outputs random integers in the set $0, 1, …, n-1$ for any $n$ between $1$ and $2^{32}$.

-define(MAX, 16#100000000 - 1).

next(N) when 1 =< N, N =< ?MAX ->
  Length = size(binary:encode_unsigned(N)),
  Result = binary:decode_unsigned(crypto:strong_rand_bytes(Length)),
  if
    Result < N -> Result;
    true -> next(N)
  end.

Exercise 9.6 Implement a naive approach for generating random numbers in the set 0,1,…,191. For this naive approach, generate a random 8-bit value, interpret that value as an integer, and reduce that value modulo 192. Experimentally generate a large number of random numbers in the set 0,1,…,191 and report on the distribution of results.

load 'plot'
plot #/.~ /:~ 192 | ? 1e6 # 256

As expected, small numbers appear as twice as often as large numbers in the set

10. Primes

Exercise 10.1 Implement Eratosthenes Sieve. What is the worst-case performance? $O(2^n)$. Generate a graph of the timings for $n=2,4,8,16,…,2^{20}$.

Solution in Erlang.

Here is the graph in logariphmic scale for $k=1,…,20$.

Exercise 10.2 Compute 13635 + 16060 + 8190 + 21363 (mod 29101) in two ways and verify the equivalence: by reducing modulo 29101 after each addition and by computing the entire sum first and then reducing modulo 29101.

s=: 13635 16060 8190 21363
p=: 29101
1046 = p&|@+/ s
1046 = p&|@(+/) s

Exercise 10.3 Compute the result of 12358 * 1854 * 14303 (mod 29101) in two ways and verify the equivalence: by reducing modulo 29101 after each multiplication and by computing the entire product first and then reducing modulo 29101.

q=: 12358 1854 14303
p=: 29101
25392 = p&|@*/ q
25392 = p&|@(*/) q

Exercise 10.4 Is {1,3,4} a subgroup of the multiplicative group of integers modulo 7? No, but {1,2,4} and {1,6} are.

Exercise 10.5 GCD(91261, 117035) = 263.

Exercise 10.6 74$^{-1}$ (mod 167) = 79.

Exercise 10.7 Generate few primes within the range $l=2^{255}$ and $u=2^{256}-1$.

97930216791462598045972883206226108036297956314017330320914377792388523022969
81584374835399266544251931666118226996961716105131490897360674548913013941917
67817200436541682412601222897087873297429605953843518229574841130195287660929

Solution in Erlang

primes:random_prime(maths:pow(2, 255), maths:pow(2, 256) - 1).

Long prime

primes:random_prime(maths:pow(2, 2048), maths:pow(2, 2049) - 1).

44129837063770165553832059107682306619738412373949690544924694569657334347697318
89282384595223880473291549477607931396621136675427472767457004072458644693312251
85702178678741261775298175549211893240790465679089929528914498139387782873637685
80666645668381134591441541906590131473893822013775159412354495643526549278176367
16420639243316759189536141159464748559796000728199658803151427159954563483308188
14969131978928808655813172004950285866534577393792532435966009786326519840221560
87609143247862022593121169632248770931444531492919464625476888424016012399968184
999766493587299104952314827482039660243903052554035019917

Exercise 10.9 Compute 27$^{35}$ (mod 569).

199 = maths:mod_exp(27, 35, 569).

Performed 15 multiplications.

11. Diffie-Hellman

Fermat’s Little Theorem If $p$ is a prime number, then $\forall a \in [1,2,…,p-1] \quad a^{p-1} = 1 \; (\mod p)$.

flt=: | (^~ 1 + i.)@:<:
1 = flt 7

Theorem 11.3 $p=2q + 1$, $p$ is a prime number, then $r$ is a square modulo $p$ $\Leftrightarrow$ $r^q = 1 \; (\mod p)$.

Necessity: $r = s^2 \Rightarrow r^q = s^{2q} = s^{p-1} = 1 \; (\mod p)$ by FLT.

Sufficiency: Suppose $\nexists s \in [1,…,p-1]$ such that $r = s^2$. Then $\nexists s \in [1,…,p-1]$ such that $r^q = s^{2q} = s^{p-1} = 1 \; (\mod p)$, which contradicts FLT.

12. RSA

Generate RSA private key using OpenSSL

openssl genrsa -out private.pem 2048
openssl asn1parse -i -in private.pem

The key consists of the follwing components

n           :C237C98E92CBABA040C59C5295635D8C143473DDBF64D4A1C26924FC6CE52D98335841764FCEFF577BA650E45E7A6BBB137E4D6098E5C936B0778ED3C7E497287CE10E9645AC1504DEF627D2350F83F7F71269B0C337E7A5DBFE50192FB0475B84F774C208E88CD3C57B8EA3410209C47AE0CD1306B8BA8ACAFBCC9D9547486449FCFC2B779753611012CD405C356F1E6ADFCFFFF96FE853A8CECA1F4F7AF824C20071ED35F46AE50907A826DB3C2E1930BB8B34646BCCE29A8FFC4EE56F59B8A6D038804E12B1064DFEEDDF168DF2456A0B02DE6A8BB07819AACD9DE66D6142B8D93EC557E70DEE77D33DE7342DAD38DFDF1478250C044564D47F176C375D3F
e           :010001
d           :AC4B475066E3ADC6858F88E52E47AF26648A3FBB995DFECFDDA2DF3FDBEED7AAECE9BF7110CDE6719A6CE9D81E04666BD89834569C6D453A72042E3DAC581ACCBD33FE77CB2924A0649764AE338A271DA41EBE8A243505187B7839608E90C84CE5418D5FD0FD54694E091579B862F17D4F30FC5C839AFF49BF56EFA76055935E703C307855EEDAAB91317AFA74A49086F1BB1D82ED64B6F2420A0416DD05DAB3B2EAE68CE8FFD125CF811422BB833F13F6B72049B150772B0658F720B2226EBFB36146146D45F7A25C2896937682CE4BE849D782A43564B63E5F82E014B767ABDFD0CBC5CDB9096CB8B93B902153B9F2BDEE75A75A644963394F16B2CD5CF4E9
p           :EF08538F6BB3A906867EB89D4945478CBB2261F86CA52210A3BD2AE080E6BBCDCF4E37C5C37C5420D9F0D41D4AB93262A181173F79E6A75A8A181268F663843124C09439EB1DE38C3FAE67F3A287112ABFC84B5E7BE4D1DFF09C23AB32A2613012E1C9F964C126595B6F5363D8AD9AF92C7EE3CF44DBCDEC83E7E2D6C012CB4D
q           :D001183CFA8C6BDFCD55D5ED247E6566CC3BAA4D0533454A7F1EFD5E9A2D651373D2AF901C18A9480A5EFC5AB0FC533D645BA5027533104D234D15ED7BF3091A99050BA4702E8E52F5E0751960EEE8AEF34FBCF1C53C1BE039335D2063428D0BB728883BFE12BDB68EA8B3C53AFA83F03D86CA6BF188C6907407DEEC2DAA4CBB
d mod (p-1) :C9A991ADCF64ACB687A3C3A75718AEEBA939B1C4000D35772A5D3F1E5741D2B22932C954FCBF18CEFA6FF6D49BA531400B17B900619CDA1645A95766DC704B2796E52E68CAD6D5920E6BDAE1AE7E1B5AA0A0A00D9FA305F9D3AA376188FF7BD52E28F5D8854B7B4A2A1CFB12A2CC9C919A1B97A0D76C460843A4D038F3A52785
d mod (q-1) :7D02EB6A5ABAE26A93A22EFC639E839B10CC1B424709D56F3C8F877FBFF1E0799C76D785291DB93FCEDBDF97321FB47785457F1AC70D7592A6D0C18905A1BFAAF8A48BA6BCB57E5C65E20CFEBFBF56A12F2291504D561EFAD7E602E66041B33B834D1CF3D173BA096A1C024F5B6F0CB4EA85844AF3D35C639D18CDE5EC5C19D9
1/q mod p   :C63721E329520C8B40FB881907FD1712C04653D3D6BA84CCC75102444965157311FC08B8D96DF853366B64F1C0698A99DE35157EDA4806E1DB8D21BD45FF1BEDE9E4F69C0FEAA46B828D48C72326FF17C8FFD79EE6A9B204F4C310FF85F825D5EFD042B115CE43A21C1266913A99381A7D3DE12E50C25EB180A25982B16F8432

Extract RSA public key from the private key

openssl rsa -in private.pem -pubout

Convert RSA public key between PKIX and PKCS#1 formats

openssl rsa -pubin -in public.pem -RSAPublicKey_out
openssl rsa -RSAPublicKey_in -in pkcs1-public.pem -pubout

RSA implementation in Erlang.

Exercise 12.1 Let p = 89, q = 107, n = pq, a = 3, and b = 5. Find x in $\mathbb{Z}_n$ such that a = x (mod p) and b = x (mod q). Anser: 8458.

3 5 = 89 107 | 8458

Exercise 12.2 Let p = 89, q = 107, n = pq, x = 1796, and y = 8931. Compute x + y (mod n) directly. Compute x + y (mod n) using CRT representations. Answer: 1204.

n=: p*q [ q=: 107 [ p=: 89
16 84 = X=: (p,q) | x=: 1796
31 50 = Y=: (p,q) | y=: 8931
47 27 = (p,q) | X + Y
47 27 = (p,q) | n | x + y

Exercise 12.3 Let p = 89, q = 107, n = pq, x = 1796, and y = 8931. Compute xy (mod n) directly. Compute xy (mod n) using CRT representations. Answer: 3344.

n=: p*q [ q=: 107 [ p=: 89
16 84 = X=: (p,q) | x=: 1796
31 50 = Y=: (p,q) | y=: 8931
51 27 = (p,q) | X * Y
51 27 = (p,q) | n | x * y

Exercise 12.4 Let p = 83, q = 101, n = pq, and e = 3. Is (n,e) a valid RSA public key? If so, compute the corresponding private RSA key d.

1 = 1 p: 83 101           NB. both primes
1 = 3 +. t=: 82 *. 100    NB. e and t are relative primes
1 = t | 3 * d=: 1367

Exercise 12.5 Let p = 79, q = 89, n = pq, and e = 3. Is (n,e) a valid RSA public key? No, because t and e are not relatively prime, d does not exist.

1 = 1 p: 79 89            NB. both primes
1 < 3 +. 78 *. 88         NB. GCD(LCM(79-1,89-1),3) = 3

Exercise 12.8 Let p = 71, q = 89, n = pq, and e = 3. First find d: 1027. Then compute the signature on $m_1 = 5416, m_2 = 2397$, and $m_3 = m_1 m_2 (\mod n)$ using the basic RSA operation: 923, 2592, 5086. Show that the third signature is equivalent to the product of the first two signatures.

What does equivalent mean here? $\sigma_1 \sigma_2 (\mod n) = 3834$ is obviously not the same as $\sigma_3$.

{
  "kty":"RSA",
  "n":"GK8",
  "e":"Aw",
  "d":"BAM",
  "p":"Rw",
  "q":"WQ",
  "dp":"Lw",
  "dq":"Ow",
  "qi":"BA"
}

-----BEGIN RSA PRIVATE KEY-----
MB0CAQACAhivAgEDAgIEAwIBRwIBWQIBLwIBOwIBBA==
-----END RSA PRIVATE KEY-----

OpenSSL failed to show it

$ echo '1528' | xxd -r -p | openssl dgst -sha256 -sign my.pem -hex
Error Signing Data
140736496063496:error:04075070:rsa routines:RSA_sign:digest too big for rsa key:rsa_sign.c:122:

13. Introduction to Cryptographic Protocols

The question “Do you trust him?” is incomplete. It should be “Do you trust him with X?”

We talk about trust when we design protocols. Always keep in mind that business people think and talk in terms of risks. You’ll have to convert between the two perspectives if you want to be able to talk to them.

The function of cryptographic protocols is to minimize the amount of trust required.

14. Key Negotiation

Every time a party sends an authentication, the authentication data consist of all the data exchanged so far: all the previous messages, and all the data fields that precede the authentication in the authenticator’s message.

Be very careful with protocol complexity. There are no good modularization notations for protocols, so everything ends up being mixed together.

20. PKI

Create

Create a new key and a self-signed certificate

openssl req -x509 -newkey rsa:2048 -sha256 -keyout key.pem -out certificate.pem -days 730 -subj "/C=CA/ST=Ontario/L=Toronto/O=NDPAR INC./OU=IT/CN=www.ndpar.org"

Inspect

Print first certificate in the file

openssl x509 -in certificate.pem -noout -text

Print specific fields of the certificate

openssl x509 -in certificate.pem -noout -issuer -startdate -enddate
openssl x509 -in certificate.pem -noout -pubkey

Print all certificates in the file using openssl or keytool

openssl crl2pkcs7 -nocrl -certfile certificates.pem | openssl pkcs7 -print_certs -text -noout
keytool -printcert -v -file certificates.pem

Example: Origins of root certificates on macOS 10.12.6

openssl crl2pkcs7 -nocrl -certfile certificates.pem | openssl pkcs7 -print_certs -text -noout | grep 'Issuer:' | grep -oP '(?<=C=)[a-zA-Z]{2}' | tr [a-z] [A-Z] | sort | uniq -c

2 BE, 6 BM (Bermuda), 1 CA, 12 CH, 3 CN, 1 CZ, 6 DE, 1 DK, 1 EE, 4 ES, 4 EU, 3 FI, 4 FR, 5 GB, 1 GR, 1 HK, 2 HU, 1 IE, 6 IL, 1 IT, 4 JP, 1 KR, 3 NL, 2 NO, 4 PL, 1 RO, 2 SE, 2 SK, 1 TR, 4 TW, 63 US, 1 VE (Venezuela)

22. Standards and Patents

The political structure of the committee puts very little emphasis on creating a good technical standard. The most important thing is to reach consensus. The standard is finished when everybody is equally unhappy with the result.

Many standards are internally inconsistent, or even contradict themselves.

For reasons of simplicity and consistency, which are crucial to the overall security, a security system must be designed by a small group of experts.

Generate 33 random bytes (wrapped in 44 characters)

openssl rand -base64 33 -out pass.txt

Output random bytes in hex format

openssl rand -hex 33

Certificate Authority

Create a CA certificate (refer to openssl-ca.cnf file)

openssl req -x509 -config openssl-ca.cnf -newkey rsa:4096 -sha256 -days 3000 -out cacert.pem -keyout cakey.pem -passout file:pass.txt

Inspect the certificate

openssl x509 -in cacert.pem -noout -text
openssl x509 -in cacert.pem -noout -purpose

Create a new (RSA) private key and a corresponding CSR (refer to openssl-server.cnf file)

openssl req -config openssl-server.cnf -newkey rsa:2048 -sha256 -out servercert.csr -keyout serverkey.pem -nodes

Create a CSR for an existing private key

openssl req -new -config openssl-server.cnf -key serverkey.pem -sha256 -out servercert.csr -nodes
openssl req -verify -in servercert.csr -text -noout

Initiate the database for signing certs

touch index.txt
echo '01' > serial.txt
mkdir newcerts

Sign the CSR by the CA certificate

openssl ca -config openssl-ca.cnf -policy signing_policy -extensions signing_req -out servercert.pem -passin file:pass.txt -infiles servercert.csr

PKCS #12 (RFC7292)

Package a PKCS8 private key into PKCS12 keystore

openssl pkcs12 -export -in private.pem -out private.p12 -name mykey -nocerts

Package a private key with a certificate chain into PKCS12 keystore

openssl pkcs12 -export -in servercert.pem -inkey serverkey.pem -out keystore.p12 -name server -CAfile cacert.pem -caname root -chain

Generate a (symmetric AES) secret key and package it into the keystore

keytool -genseckey -alias symkey -keyalg AES -keysize 256 -storetype PKCS12 -keystore symkeystore.p12

Import a secret (password) into the existing keystore

keytool -importpass -alias mypass -keystore keystore.p12

Import a (trusted) certificate into the keystore

keytool -importcert -file cert.cer -keystore keystore.p12 -alias name

Merge multiple PKCS12 keystores

keytool -importkeystore -srckeystore keystore2.p12 -srcstoretype PKCS12 -destkeystore keystore.p12 -deststoretype PKCS12

List the keystore content

keytool -list -keystore keystore.p12

Print private keys and certificates from the keystore (openssl does not support secrets)

openssl pkcs12 -in keystore.p12
openssl pkcs12 -in keystore.p12 -nodes -out keystore.pem

Elliptic Curves (RFC5915)

Generate elliptic curve private key

openssl ecparam -genkey -name prime256v1 -noout -out private.key

Convert elliptic curve private key to PKCS8 PEM format

openssl pkcs8 -topk8 -in private.key -out private.pem -nocrypt

Extract elliptic curve public key from the private key

openssl ec -in private.pem -pubout -out public.pem

PKCS #7 (RFC2315) and CMS (RFC5652)

Encrypt the file for the recipient in CMS format

openssl cms -encrypt -recip servercert.pem -binary -in file -outform der -out file.p7
openssl cms -encrypt -recip servercert.pem -binary -in file -outform pem -out file.pem

Encrypt the file for the recipient in PKCS7 format

openssl smime -encrypt -binary -in file -outform pem -out file.pem servercert.pem

Decrypt the CMS message with the private key

openssl cms -decrypt -inkey serverkey.pem -in file.p7  -inform der -out file
openssl cms -decrypt -inkey serverkey.pem -in file.pem -inform pem -out file

Links

• The most common OpenSSL commands
• OpenSSL config files
• PKCS #1 and PKCS #8 commands

Defines the traditional format for RSA keys. Two structures:

-----BEGIN RSA PRIVATE KEY-----
RSAPrivateKey
-----END RSA PRIVATE KEY-----

and

-----BEGIN RSA PUBLIC KEY-----
RSAPublicKey
-----END RSA PUBLIC KEY-----

Commands

Generate RSA private key

openssl genrsa -out private.pem 2048

Extract public key from RSA private key

openssl rsa -in private.pem -out public.pem -RSAPublicKey_out

RFC5958 (former PKCS #8, aka .p8)

Defines the format for any private key. Two structures:

-----BEGIN PRIVATE KEY-----
PrivateKeyInfo ::= OneAsymmetricKey
-----END PRIVATE KEY-----

and

-----BEGIN ENCRYPTED PRIVATE KEY-----
EncryptedPrivateKeyInfo
-----END ENCRYPTED PRIVATE KEY-----

The corresponding PEM formats are described in RFC7468 Section 10 and Section 11.

Commands

Convert PKCS #1 $\rightarrow$ PKCS #8

openssl pkcs8 -in private-pkcs1.pem -topk8 -out private-pkcs8.pem -nocrypt
openssl pkcs8 -in private-pkcs1.pem -topk8 -out private-pkcs8-enc.pem

Convert PKCS #8 $\rightarrow$ PKCS #1

openssl rsa -in private-pkcs8.pem -out private-pkcs1.pem

RFC5280 (PKI X.509)

Among other things, defines the format for any public key

-----BEGIN PUBLIC KEY-----
SubjectPublicKeyInfo
-----END PUBLIC KEY-----

The PEM format is described in RFC7468.

Commands

Convert RSA public key between X.509 and PKCS #1 formats

openssl rsa -pubin -in public.pem -RSAPublicKey_out
openssl rsa -RSAPublicKey_in -in pkcs1-public.pem -pubout

Extract public key from RSA private key

openssl rsa -in private.pem -out public.pem -pubout

Extract public key from X.509 CSR

openssl req -in cert.csr -pubkey -noout

Extract public key from X.509 certificate

openssl x509 -in cert.crt -inform pem -pubkey -noout
openssl x509 -in cert.cer -inform der -pubkey -noout

Convert X.509 certificate between DER and PEM formats

openssl x509 -in cert.cer -inform der -out cert.crt -outform pem
openssl x509 -in cert.crt -inform pem -out cert.cer -outform der

“What I cannot create, I do not understand” — Richard Feynman

As a fun exercise I wanted to know how to build an RSA private key file from scratch. It turned out that it was not complicated. In fact it was very educational to learn about the PKCS #1 and X.609 standards. By the end of this post you should be able to read DER files without the openssl command, too.

From a mathematical perspective an RSA private key is just a pair of numbers satisfying a few conditions. The first step is to choose two prime numbers. If we want our key to be $k$-bit long then each prime should be $k/2$-bit long. Here are two primes 1024-bit long:

p = 188658351657909995564241240465674883756750911978965594406091265432265641964092435440867010496656290185915042088848864982944624560228571535282140345941898374783486396513112284924130530433476612244870421527834092351771495657957917171265855063528745445693207773620468819387929613829761428627329588653924255089451
q = 314178598271171309643469864042809599136290738797354680579453738873053976803051841787567944451717551290169456210178094252448060684978774667964812128639960504040754248179131205124174037497556941333232996617690501240860884613659741212508891734662698093999296965839284246675187499601986034176733136066305345935229

The product of these primes is a modulus of an RSA key:

n = 59272416476031870310813269456482000649521214839097555249658956878429667033345971911228897520094455477409965068308635488009811551774829628449872899499797577442984988498839316022812024085070921696680719869349925179295023663107587202715785410835479198432493682921268850396489979925015801144167399352584659489661536583643002656464738703092254954684055792766769402010692858706224804514602103071851330570529764510187019367372650739782606640058374679178234229890697709969669187824580807498629684496386911304548122885254757980404399786500026446625957982264789094145961033518145284058963944371890973871992953130981578647169279

To form a public key, we need to select a public exponent. A common choice is

e = 65537

To find the private exponent we need to calculate $t = LCM(p - 1, q - 1)$ and make sure that $t$ and $e$ are relatively prime. In our case

t = 9878736079338645051802211576080333441586869139849592541609826146404944505557661985204816253349075912901660844718105914668301925295804938074978816583299596240497498083139886003802004014178486949446786644891654196549170610517931200452630901805913199738748947153544808399414996654169300190694566558764109914943505624448845595859921831997957745033527125185998846955951218950319914149305826465770482602596898444785155811512270630091202325802194555495831212902685975181807491196648094001430229988075979625161669911184872231135294567704734798040363872577766275101044754796447588498816804543076537734864815067710224841024100

and it is indeed relatively prime with 65537. If it wasn’t we would try another public exponent or different primes.

The private exponent $d$ is a solution of the equation $d e = 1 (\mod t)$:

d = 5713468916051268780132002190819673753298269494741275244475317000371286701232244684486677071989004278539215293013032128257126755518442870024474679399017164287346341262848989717077546426498334823562735569036929683476505833667571970367220374781441535665311810014311952295213788137687613934542118968573398572043557642081710231861001832858546933301048448251370985779305964616826007078677511121329392138316261633140615925043274882325662342756097813929749397956320997349454981862425032501185764338740435657905121325564969361566019276046817336541525431835263330506889244027107578840336789285453607676614980092565853828740673

For cryptographic purposes numbers $n$, $e$, and $d$ is all you need. But for computational efficiency, PKCS #1 requires three more numbers:

dp = 73281896610394353679278716733062018642836992328738378882095081314512206043607445092362352353836446271004764124934396689973927818327643095864587130729861100246627297496594281662474493999496683063272141245923256923555349878154854470435248368894689607565375136076663178588561029330976954828050251588613298774923
dq = 48768464839901517204068219889642523338167534153005007332267007729306774890786065680530520147509386289804139311017314689872196184571907086030883833325515635558640050150698105646096441452349768286357008630113759694878889469685224336708316761779203010669619421601279256624909325014129482974196350049628824697485
qi = 96649294882937985304687069867459392294125861105683721163844518450032271220340037497914128685821080429968806273738795285224909792718537306451785722671106543229818520952472427298015487036380943796651715614555934218685011386800675679145785323478975345929484318504374494139364842881030508783682984009085234707403

That’s all the numbers we need. You can calculate these numbers using any mathematical software that supports arbitrarily long integers. I did it in Erlang

P = primes:random_prime(maths:pow(2, 1024), maths:pow(2, 1025) - 1).
Q = primes:random_prime(maths:pow(2, 1024), maths:pow(2, 1025) - 1).
N = P * Q.
T = maths:lcm(P - 1, Q - 1).
E = 65537.
1 = maths:gcd(E, T).       % make sure e and t are co-primes
D = maths:mod_inv(E, T).
DP = maths:mod(D, P - 1).
DQ = maths:mod(D, Q - 1).
QI = maths:mod_inv(Q, P).

The next step is to convert the numbers to hexadecimal strings. Here is an Erlang one-liner for that

[integer_to_list(X, 16) || X <- [N, E, D, P, Q, DP, DQ, QI]].

 n = 01D58729C5FFE1785360D7A2B532EAA6329C9B8BD95AF105422B40368630F636E1CB0B847D74798BD95249B42A47971BB5903FC87A97B7D541AC599961B8B0EB6CF24F7DFC798434EAE2E3D4E741D4FEC9C696208015205A50258B688A5475751B361C57CAEBE26DB3CF92AA4F4A69DD936E14A7A58072CFF461035ED9D448D1161E2C0DFFDF2A36B42CABC6B2D8FDACB7BC4C113890E69124E4FBD488AF9FBC5550C7586C5412E01A6DE9F2A8966E7C183C5A4CADD93E85FE6B1286211DEE62F29274358F569E20F169F1A2D01259710503AC6AD1DA8FC2C6C4C6933C78D1AE37DE30A0A84676FD11D95D43B5B93C032F52CEC2B1E636FC94E9FEA2F321A668FF
 e = 010001
 d = 2D426781C68B4810AC227274B50119742CD471994A1836EC37446BFD1375D30F2B860E0769D582E837F3BD8235D46DBF5AB5A09AF09FAFD6DCC8E642C7E2DB4EC282172037367498BA60EBD7943E4BDBCCB611514762B9A74577380F32DA54FCD7D7C8E9594397AA358AC0655444502F889F9A696C5AFA3611AE997E0B3B2F0185C60257E90D1955546F0190DF57F1674F0AD912BD8FFEAEAE65A79E0D9783E980E3C5CCC1B18D524296B806BDA4EC28DF028CCDA91FD94A89228EFA1B82A6B0B4C0A142EE7C890BE97C30F58232BEC26E897E25FC61B432CC651F82622132F3BE34E764623E4DD75DD469703C0081DCCE7F58C8A3DC72D46FB2BE548E5AF641
 p = 010CA88D97C90A5544D1CA63A5916B20CA2FC92C5CE2EB43409D953009630B322723D15581610A6CFE7686710A0086776C8929106646A4118CDC937E1B443F32D8B8255F4AB631D11C818D4D3411CF72D41780FC6354E6198BD6BE6D9790C12F6CB596B1C9BAC4F53B34C833375B60E1EC5EF71407FBA5229BDECEE38C8841432B
 q = 01BF67B98C4202D2BF8510B0F84752C26BF6C1E3C464B6678E612904F471A2D9E3A251B39416701F19290EC9957EA1EBB08ADABD3088018E7F81A57F3E287C3387EFDDC6ABBA7CDD446F089930071EDD3D06EB0D69AA334F23C7C7E8648AFC4C3C781BEBE6428949A2841E555B754685C2AAF2BA1E6F7F1A049CABFDC7FD5F577D
dp = 685B5CCCD5F1E69759EA84F47E5D1F9A8A1F59D526EBFDEEAE8791E6438BC8CA7D56462180815D3F26E928259B78A0110FE25C956DE13354052661B8D3B4BCDA84053853BC1BF3BF5FEF744AC2945365614FE039F17383FED6C697A965383564C3D0AA74D2D0C8F55B965C96A72F25F2FC1C7BB272247E220FD54B7C7E3CE38B
dq = 4572D7658335A6FB1DAFAA98CF91742688262EB1E4A43FCCE51E15EBCFDBE490A638A274814B2438A69BEA04AFA478CE6DAF68A0A8EBFCEFA3F3499E1F70B01B10CBCF3406FDACE71B892D263C64B918E9030190FE5F7A9066498CB456B2B52EC9C223CB1956F03C2EDFFA85F8DD5A940E2F215EEA15C3B7258EB9151B2A7A8D
qi = 89A217111B58DD54CCFB00C4873DB4EF6716283AEA77D2B46D85F1D8D47F2C0EC21AA37EBB26781C19EC43EB9583FB47205D83692D7CDCA9528B69C19EEFC100624A31907B33AFB9008C4685EB8AB709B890D7C6A6BD50BD41EE5A373FD31701F516FDB30C694243FBCB0851E237EA31703A2BC2A945EE5B9F12DCD574F3FBCB

Now we need to encode every number according to the ASN.1 DER. Let’s start with $n$. Under the DER, a value has three components: a type tag, a length in octets, and content. Since $n$ is an integer, its type tag is 0x02. The length of $n$ in octets is 257 = 0x0101. Since it’s greater than 127, we use the long format for the length. 0x0101 occupies 2 bytes, hence the length spec value is 2 = 0x02. To indicate that the length format is long we change its leftmost bit to 1, which gives us 0x82. The final length value is then 0x820101 and $n$’s final encoding is (with spaces added for readability)

n = 02 820101 01D58729C5FFE1785360D7A2B532EAA6329C9B8BD95AF105422B40368630F636E1CB0B847D74798BD95249B42A47971BB5903FC87A97B7D541AC599961B8B0EB6CF24F7DFC798434EAE2E3D4E741D4FEC9C696208015205A50258B688A5475751B361C57CAEBE26DB3CF92AA4F4A69DD936E14A7A58072CFF461035ED9D448D1161E2C0DFFDF2A36B42CABC6B2D8FDACB7BC4C113890E69124E4FBD488AF9FBC5550C7586C5412E01A6DE9F2A8966E7C183C5A4CADD93E85FE6B1286211DEE62F29274358F569E20F169F1A2D01259710503AC6AD1DA8FC2C6C4C6933C78D1AE37DE30A0A84676FD11D95D43B5B93C032F52CEC2B1E636FC94E9FEA2F321A668FF

Let’s encode $e$. Again, the tag value is 0x02. The length in octets is 3 = 0x03. Since it’s less than 128, we use the short format, without length spec. The final encoding is

e = 02 03 010001

Analogously we encode $d$, $p$, $q$, $dp$, and $dq$

 d = 02 820100 2D426781C68B4810AC227274B50119742CD471994A1836EC37446BFD1375D30F2B860E0769D582E837F3BD8235D46DBF5AB5A09AF09FAFD6DCC8E642C7E2DB4EC282172037367498BA60EBD7943E4BDBCCB611514762B9A74577380F32DA54FCD7D7C8E9594397AA358AC0655444502F889F9A696C5AFA3611AE997E0B3B2F0185C60257E90D1955546F0190DF57F1674F0AD912BD8FFEAEAE65A79E0D9783E980E3C5CCC1B18D524296B806BDA4EC28DF028CCDA91FD94A89228EFA1B82A6B0B4C0A142EE7C890BE97C30F58232BEC26E897E25FC61B432CC651F82622132F3BE34E764623E4DD75DD469703C0081DCCE7F58C8A3DC72D46FB2BE548E5AF641
 p = 02 8181 010CA88D97C90A5544D1CA63A5916B20CA2FC92C5CE2EB43409D953009630B322723D15581610A6CFE7686710A0086776C8929106646A4118CDC937E1B443F32D8B8255F4AB631D11C818D4D3411CF72D41780FC6354E6198BD6BE6D9790C12F6CB596B1C9BAC4F53B34C833375B60E1EC5EF71407FBA5229BDECEE38C8841432B
 q = 02 8181 01BF67B98C4202D2BF8510B0F84752C26BF6C1E3C464B6678E612904F471A2D9E3A251B39416701F19290EC9957EA1EBB08ADABD3088018E7F81A57F3E287C3387EFDDC6ABBA7CDD446F089930071EDD3D06EB0D69AA334F23C7C7E8648AFC4C3C781BEBE6428949A2841E555B754685C2AAF2BA1E6F7F1A049CABFDC7FD5F577D
dp = 02 8180 685B5CCCD5F1E69759EA84F47E5D1F9A8A1F59D526EBFDEEAE8791E6438BC8CA7D56462180815D3F26E928259B78A0110FE25C956DE13354052661B8D3B4BCDA84053853BC1BF3BF5FEF744AC2945365614FE039F17383FED6C697A965383564C3D0AA74D2D0C8F55B965C96A72F25F2FC1C7BB272247E220FD54B7C7E3CE38B
dq = 02 8180 4572D7658335A6FB1DAFAA98CF91742688262EB1E4A43FCCE51E15EBCFDBE490A638A274814B2438A69BEA04AFA478CE6DAF68A0A8EBFCEFA3F3499E1F70B01B10CBCF3406FDACE71B892D263C64B918E9030190FE5F7A9066498CB456B2B52EC9C223CB1956F03C2EDFFA85F8DD5A940E2F215EEA15C3B7258EB9151B2A7A8D

$qi$ is a bit trickier. Its leftmost bit is 1, so in ASN.1 it would be encoded as a negative integer. To keep it positive we have to prepend one byte of zeros to it. With this additional byte, the octet length becomes 129 = 0x81 and the final encoding is

qi = 02 8181 0089A217111B58DD54CCFB00C4873DB4EF6716283AEA77D2B46D85F1D8D47F2C0EC21AA37EBB26781C19EC43EB9583FB47205D83692D7CDCA9528B69C19EEFC100624A31907B33AFB9008C4685EB8AB709B890D7C6A6BD50BD41EE5A373FD31701F516FDB30C694243FBCB0851E237EA31703A2BC2A945EE5B9F12DCD574F3FBCB

After we encoded all RSA numbers, the only thing left from the PKCS #1 perspective is to encode the RSA version and the ASN.1 sequence. For a two-prime RSA key, the version is 0 which is encoded as

02 01 00

To encode the ASN.1 sequence, we need to calculate the total length of all the values we encoded so far. That will be the sequence’s content. If we concatenate all the values (version and RSA numbers), the total length in octets would be 1187 = 0x04A3. That means the sequence value is encoded as

30 8204A3

We can now put everything together. Here is the hexadecimal representation of our RSA private key (with line breaks added for readability):

308204A30201000282010101D58729C5FFE1785360D7A2B532EAA6329C9B8BD9
5AF105422B40368630F636E1CB0B847D74798BD95249B42A47971BB5903FC87A
97B7D541AC599961B8B0EB6CF24F7DFC798434EAE2E3D4E741D4FEC9C6962080
15205A50258B688A5475751B361C57CAEBE26DB3CF92AA4F4A69DD936E14A7A5
8072CFF461035ED9D448D1161E2C0DFFDF2A36B42CABC6B2D8FDACB7BC4C1138
90E69124E4FBD488AF9FBC5550C7586C5412E01A6DE9F2A8966E7C183C5A4CAD
D93E85FE6B1286211DEE62F29274358F569E20F169F1A2D01259710503AC6AD1
DA8FC2C6C4C6933C78D1AE37DE30A0A84676FD11D95D43B5B93C032F52CEC2B1
E636FC94E9FEA2F321A668FF0203010001028201002D426781C68B4810AC2272
74B50119742CD471994A1836EC37446BFD1375D30F2B860E0769D582E837F3BD
8235D46DBF5AB5A09AF09FAFD6DCC8E642C7E2DB4EC282172037367498BA60EB
D7943E4BDBCCB611514762B9A74577380F32DA54FCD7D7C8E9594397AA358AC0
655444502F889F9A696C5AFA3611AE997E0B3B2F0185C60257E90D1955546F01
90DF57F1674F0AD912BD8FFEAEAE65A79E0D9783E980E3C5CCC1B18D524296B8
06BDA4EC28DF028CCDA91FD94A89228EFA1B82A6B0B4C0A142EE7C890BE97C30
F58232BEC26E897E25FC61B432CC651F82622132F3BE34E764623E4DD75DD469
703C0081DCCE7F58C8A3DC72D46FB2BE548E5AF641028181010CA88D97C90A55
44D1CA63A5916B20CA2FC92C5CE2EB43409D953009630B322723D15581610A6C
FE7686710A0086776C8929106646A4118CDC937E1B443F32D8B8255F4AB631D1
1C818D4D3411CF72D41780FC6354E6198BD6BE6D9790C12F6CB596B1C9BAC4F5
3B34C833375B60E1EC5EF71407FBA5229BDECEE38C8841432B02818101BF67B9
8C4202D2BF8510B0F84752C26BF6C1E3C464B6678E612904F471A2D9E3A251B3
9416701F19290EC9957EA1EBB08ADABD3088018E7F81A57F3E287C3387EFDDC6
ABBA7CDD446F089930071EDD3D06EB0D69AA334F23C7C7E8648AFC4C3C781BEB
E6428949A2841E555B754685C2AAF2BA1E6F7F1A049CABFDC7FD5F577D028180
685B5CCCD5F1E69759EA84F47E5D1F9A8A1F59D526EBFDEEAE8791E6438BC8CA
7D56462180815D3F26E928259B78A0110FE25C956DE13354052661B8D3B4BCDA
84053853BC1BF3BF5FEF744AC2945365614FE039F17383FED6C697A965383564
C3D0AA74D2D0C8F55B965C96A72F25F2FC1C7BB272247E220FD54B7C7E3CE38B
0281804572D7658335A6FB1DAFAA98CF91742688262EB1E4A43FCCE51E15EBCF
DBE490A638A274814B2438A69BEA04AFA478CE6DAF68A0A8EBFCEFA3F3499E1F
70B01B10CBCF3406FDACE71B892D263C64B918E9030190FE5F7A9066498CB456
B2B52EC9C223CB1956F03C2EDFFA85F8DD5A940E2F215EEA15C3B7258EB9151B
2A7A8D0281810089A217111B58DD54CCFB00C4873DB4EF6716283AEA77D2B46D
85F1D8D47F2C0EC21AA37EBB26781C19EC43EB9583FB47205D83692D7CDCA952
8B69C19EEFC100624A31907B33AFB9008C4685EB8AB709B890D7C6A6BD50BD41
EE5A373FD31701F516FDB30C694243FBCB0851E237EA31703A2BC2A945EE5B9F
12DCD574F3FBCB

We just need to convert this octet string to list of bytes and this will give us the RSA private key in DER format

$ xxd -r -p rsa-private.hex rsa-private.der

If you want the key in PEM format, just base64 encode the DER file

$ base64 -b 64 -i rsa-private.der

and encapsulate it with the RSA PRIVATE KEY boundary. Here is the final result

-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEB1Ycpxf/heFNg16K1MuqmMpybi9la8QVCK0A2hjD2NuHLC4R9
dHmL2VJJtCpHlxu1kD/Iepe31UGsWZlhuLDrbPJPffx5hDTq4uPU50HU/snGliCA
FSBaUCWLaIpUdXUbNhxXyuvibbPPkqpPSmndk24Up6WAcs/0YQNe2dRI0RYeLA3/
3yo2tCyrxrLY/ay3vEwROJDmkSTk+9SIr5+8VVDHWGxUEuAabenyqJZufBg8Wkyt
2T6F/msShiEd7mLyknQ1j1aeIPFp8aLQEllxBQOsatHaj8LGxMaTPHjRrjfeMKCo
Rnb9EdldQ7W5PAMvUs7CseY2/JTp/qLzIaZo/wIDAQABAoIBAC1CZ4HGi0gQrCJy
dLUBGXQs1HGZShg27DdEa/0TddMPK4YOB2nVgug3872CNdRtv1q1oJrwn6/W3Mjm
Qsfi207CghcgNzZ0mLpg69eUPkvbzLYRUUdiuadFdzgPMtpU/NfXyOlZQ5eqNYrA
ZVREUC+In5ppbFr6NhGumX4LOy8BhcYCV+kNGVVUbwGQ31fxZ08K2RK9j/6urmWn
ng2Xg+mA48XMwbGNUkKWuAa9pOwo3wKMzakf2UqJIo76G4KmsLTAoULufIkL6Xww
9YIyvsJuiX4l/GG0MsxlH4JiITLzvjTnZGI+Tddd1GlwPACB3M5/WMij3HLUb7K+
VI5a9kECgYEBDKiNl8kKVUTRymOlkWsgyi/JLFzi60NAnZUwCWMLMicj0VWBYQps
/naGcQoAhndsiSkQZkakEYzck34bRD8y2LglX0q2MdEcgY1NNBHPctQXgPxjVOYZ
i9a+bZeQwS9stZaxybrE9Ts0yDM3W2Dh7F73FAf7pSKb3s7jjIhBQysCgYEBv2e5
jEIC0r+FELD4R1LCa/bB48RktmeOYSkE9HGi2eOiUbOUFnAfGSkOyZV+oeuwitq9
MIgBjn+BpX8+KHwzh+/dxqu6fN1EbwiZMAce3T0G6w1pqjNPI8fH6GSK/Ew8eBvr
5kKJSaKEHlVbdUaFwqryuh5vfxoEnKv9x/1fV30CgYBoW1zM1fHml1nqhPR+XR+a
ih9Z1Sbr/e6uh5HmQ4vIyn1WRiGAgV0/JukoJZt4oBEP4lyVbeEzVAUmYbjTtLza
hAU4U7wb879f73RKwpRTZWFP4Dnxc4P+1saXqWU4NWTD0Kp00tDI9VuWXJanLyXy
/Bx7snIkfiIP1Ut8fjzjiwKBgEVy12WDNab7Ha+qmM+RdCaIJi6x5KQ/zOUeFevP
2+SQpjiidIFLJDimm+oEr6R4zm2vaKCo6/zvo/NJnh9wsBsQy880Bv2s5xuJLSY8
ZLkY6QMBkP5fepBmSYy0VrK1LsnCI8sZVvA8Lt/6hfjdWpQOLyFe6hXDtyWOuRUb
KnqNAoGBAImiFxEbWN1UzPsAxIc9tO9nFig66nfStG2F8djUfywOwhqjfrsmeBwZ
7EPrlYP7RyBdg2ktfNypUotpwZ7vwQBiSjGQezOvuQCMRoXrircJuJDXxqa9UL1B
7lo3P9MXAfUW/bMMaUJD+8sIUeI36jFwOivCqUXuW58S3NV08/vL
-----END RSA PRIVATE KEY-----

The flow starts when a user hits localhost:9999/client/resource

GET /client/resource HTTP/1.1
Host: localhost:9999

Client endpoints are protected by Spring Security, therefore it redirects the request to login endpoint

HTTP/1.1 302
Set-Cookie: JSESSIONID=67CB7BD60760EDD84BD0884FF9F09651;path=/client;HttpOnly
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Location: http://localhost:9999/client/login
Content-Length: 0

Browser tries to load login page

GET /client/login HTTP/1.1
Host: localhost:9999
Cookie: JSESSIONID=67CB7BD60760EDD84BD0884FF9F09651

Client delegates the authorization to OAuth server

HTTP/1.1 302
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Location: http://localhost:8080/oauth/authorize?client_id=my-trusted-client&redirect_uri=http://localhost:9999/client/login&response_type=code&state=JUkFF6
Content-Length: 0

OAuth flow technically starts here. state is randomly generated by Spring. client_id is configured in Client’s application properties.

GET /oauth/authorize?client_id=my-trusted-client&redirect_uri=http://localhost:9999/client/login&response_type=code&state=JUkFF6 HTTP/1.1
Host: localhost:8080

Since User is not authenticated yet Spring shows basic dialog asking for user name and password.

HTTP/1.1 401
WWW-Authenticate: Basic realm="Spring"
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Content-Length: 344

User types dave:secret. These are credentials stored in Server database.

Authorization header here contains User credentials.

GET /oauth/authorize?client_id=my-trusted-client&redirect_uri=http://localhost:9999/client/login&response_type=code&state=JUkFF6 HTTP/1.1
Host: localhost:8080
Authorization: Basic ZGF2ZTpzZWNyZXQ=

Server verifies User credentials and creates session.

HTTP/1.1 200
Set-Cookie: JSESSIONID=0517E6F4E263721C8E75A1378D51179F;path=/;HttpOnly
Cache-Control: no-store
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Content-Length: 573

The authorization page gives User a choice to authorize or deny Client.

User clicks Authorize button.

POST /oauth/authorize HTTP/1.1
Host: localhost:8080
Content-Length: 44
Authorization: Basic ZGF2ZTpzZWNyZXQ=
Origin: http://localhost:8080
Content-Type: application/x-www-form-urlencoded
Referer: http://localhost:8080/oauth/authorize?client_id=my-trusted-client&redirect_uri=http://localhost:9999/client/login&response_type=code&state=JUkFF6
Cookie: JSESSIONID=0517E6F4E263721C8E75A1378D51179F

Form item: "user_oauth_approval" = "true"
Form item: "authorize" = "Authorize"

Server creates a new session, generates a random code, and redirects the response to redirect_uri supplied on step 7.

HTTP/1.1 302
Set-Cookie: JSESSIONID=6503F28F4068C83EC7BE0F5EC163D06F;path=/;HttpOnly
Cache-Control: no-store
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Location: http://localhost:9999/client/login?code=WEJz0f&state=JUkFF6
Content-Language: en-US
Content-Length: 0

Browser, with Client and Server sessions saved in cookies, gets the redirected Client URI.

GET /client/login?code=WEJz0f&state=JUkFF6 HTTP/1.1
Host: localhost:9999
Referer: http://localhost:8080/oauth/authorize?client_id=my-trusted-client&redirect_uri=http://localhost:9999/client/login&response_type=code&state=JUkFF6
Cookie: JSESSIONID=67CB7BD60760EDD84BD0884FF9F09651; JSESSIONID=6503F28F4068C83EC7BE0F5EC163D06F

Spring OAuth Client requests access token implementing RFC6749 Section 4.1.3. Client authenticates itself through Authorization header passing credentials configured in Client application properties.

POST /oauth/token HTTP/1.1
Authorization: Basic bXktdHJ1c3RlZC1jbGllbnQ6bXktdHJ1c3RlZC1jbGllbnQtcGFzcw==
Accept: application/json, application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
Cache-Control: no-cache
Pragma: no-cache
User-Agent: Java/1.8.0_112
Host: localhost:8080
Connection: keep-alive
Content-Length: 101

Form item: "grant_type" = "authorization_code"
Form item: "code" = "WEJz0f"
Form item: "redirect_uri" = "http://localhost:9999/client/login"

Server verifies Client credentials stored in the database and exchanges authorization code for access token implementing RFC6749 Section 4.1.4. scope is populated from the corresponding database column.

HTTP/1.1 200
Cache-Control: no-store
Pragma: no-cache
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Frame-Options: DENY
Content-Type: application/json;charset=UTF-8

{
  access_token: 16d91f9e-69c5-41a9-bd0f-df8308589784,
  token_type: bearer,
  refresh_token: 8a283a19-7524-43d7-95bd-bc3a76260f3d,
  expires_in: 59,
  scope: read write trust
}

Although it’s not a part of RFC6749, Client sends access token verification request to Server. Once again Client authenticates itself through Authorization header.

POST /oauth/check_token HTTP/1.1
Accept: application/json, application/*+json
Authorization: Basic bXktdHJ1c3RlZC1jbGllbnQ6bXktdHJ1c3RlZC1jbGllbnQtcGFzcw==
Content-Type: application/x-www-form-urlencoded
User-Agent: Java/1.8.0_112
Host: localhost:8080

Form item: "token" = "16d91f9e-69c5-41a9-bd0f-df8308589784"

Server verifies Client credentials and access token and responds with User/Client metadata.

HTTP/1.1 200
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Type: application/json;charset=UTF-8

{
  exp: 1481467593
  user_name: dave
  authorities: [ROLE_USER]
  client_id: my-trusted-client
  scope: [read, write, trust]
}

Client redirects User browser to the URL requested initially on step 1. It also resets the session.

HTTP/1.1 302
Set-Cookie: JSESSIONID=460BEFFA884E6349212F8D2EA50BF776;path=/client;HttpOnly
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Location: http://localhost:9999/client/resource

This step is the same as step 1 but with valid Client and Server sessions.

GET /client/resource HTTP/1.1
Host: localhost:9999
Referer: http://localhost:8080/oauth/authorize?client_id=my-trusted-client&redirect_uri=http://localhost:9999/client/login&response_type=code&state=JUkFF6
Cookie: JSESSIONID=460BEFFA884E6349212F8D2EA50BF776; JSESSIONID=6503F28F4068C83EC7BE0F5EC163D06F

As a part of business logic Client sends a request to Resource server suppling bearer token as required by RFC6750 Section 2.

GET /me HTTP/1.1
Authorization: bearer 16d91f9e-69c5-41a9-bd0f-df8308589784
Accept: text/plain, application/json, application/*+json, */*
User-Agent: Java/1.8.0_112
Host: localhost:8888

Resource server calls OAuth Server to verify the access token implementing RFC7662 Section 2.1. Resource authenticates itself through Authorization header suppling credentials configured in its application properties.

POST /oauth/check_token HTTP/1.1
Accept: application/json, application/*+json
Authorization: Basic bXktcmVzb3VyY2U6bXktcmVzb3VyY2UtcGFzcw==
Content-Type: application/x-www-form-urlencoded
User-Agent: Java/1.8.0_112
Host: localhost:8080

Form item: "token" = "16d91f9e-69c5-41a9-bd0f-df8308589784"

Server verifies Resource credentials and access token and responds with User/Client metadata.

HTTP/1.1 200
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Type: application/json;charset=UTF-8

{
  exp: 1481467593
  user_name: dave
  authorities: [ROLE_USER]
  client_id: my-trusted-client
  scope: [read, write, trust]
}

Since the access token is valid Resource server replies to Client

HTTP/1.1 200
Set-Cookie: JSESSIONID=4D7F3BE1EFD37A99D9878A0037A0F8A5;path=/;HttpOnly
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Type: application/json;charset=UTF-8

{name:dave}

Client returns the response to User

HTTP/1.1 200
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Type: text/html;charset=UTF-8

Specifications

• RFC6749 The OAuth 2.0 Authorization Framework
• RFC6750 The OAuth 2.0 Authorization Framework: Bearer Token Usage
• RFC6819 OAuth 2.0 Threat Model and Security Considerations
• RFC7009 OAuth 2.0 Token Revocation
• RFC7591 OAuth 2.0 Dynamic Client Registration Protocol
• RFC7636 PKCE by OAuth Public Clients
• RFC7662 OAuth 2.0 Token Introspection

Problem: Given a training set $\langle x^{(i)}, y^{(i)} \rangle$, $1 \le i \le m$, $x \in \mathbb{R}^{n+1}$, $x^{(i)} _ 0 = 0$, $y^{(i)} \in $ {0,1}, find classification function

Gradient Descent

Let’s build function $h_\theta(x)$ as a sigmoid function of $\theta\cdot x$

Sigmoid function has rank infinity, i.e. it operates on scalars, vectors and matrices.

function g = sigmoid(z)
    g = 1 ./ (1 + exp(-z));
end

To find optimal parameter $\theta \in \mathbb{R}^{n+1}$ we are going to use optimized gradient descent method which takes as arguments cost function $J(\theta)$ and its gradient. For logistic regression they are

where $X = (x^{(i)}_j) _{m \times n+1}$ is a matrix of the training examples from the previous lecture.

Analogous to linear regression, logistic regression can be regularized too

function [J, grad] = costFunction(theta, X, y, lambda)
    m = length(y); % number of training examples
    h = sigmoid(X * theta);
    J = (y' * log(h) + (1 - y)' * log(1 - h)) / -m;
    grad = X' * (h - y) / m;

    % Regularization
    th = theta; th(1) = 0;

    J = J + th' * th * lambda / m / 2;
    grad = grad + th * lambda / m;
end

Having computed $\theta$ we can now implement the prediction function

function p = predict(theta, X)
    p = sigmoid(X * theta) >= 0.5;
end

which can be used to classify new examples and check the prediction accuracy on the training set

function a = accuracy(theta, X, y)
    p = predict(theta, X);
    a = mean(double(p == y)) * 100;
end

Multi-class Classification

Logistic regression works for binary $y$. Suppose now that $y^{(i)} \in ${$1,…,K$}, where $K > 2$. In this case we can use One-vs-All variation of this algorithm.

Step 1. Convert vector $y$ into a binary matrix $Y$

where $y^{(i)}_k = \delta _{k y^{(i)}}$, i.e. $y^{(i)}_k = 1$ when $y^{(i)} = k$, otherwise $y^{(i)}_k = 0$.

Step 2. Train logistic classifier on every column of matrix $Y$. The result will be a matrix $\Theta = (\theta_{jk})_{n+1 \times K}$

Step 3. For any given vector $x$ compute vector $h = x^T \Theta$. Then the predicted value $y$ will be

To compute accuracy of the one-vs-all classifier on the training set use accuracy.m script from above with modified predict.m

function p = predict(Theta, X)
    a = sigmoid(X * Theta);
    [v, p] = max(a, [], 2);
end

Problem: Given a training set $\langle x^{(i)}, y^{(i)} \rangle$, $1 \le i \le m$, find the value of $y$ on any input vector $x$.

We solve this problem by constructing a hypothesis funciton $h_\theta(x)$ using one of the methods below.

Notation

Optimization Objective

Step 1. Normalize each feature $(x^{(0)}_j, …, x^{(m)}_j)$, $1 \le j \le n$ by mean $\mu$ and standard deviation $\sigma$

function [X_norm, mu, sigma] = featureNormalize(X)
    mu = mean(X, 1);
    sigma = std(X, 0, 1);
    X_norm = (X - mu) ./ sigma;
end

Step 2. Minimize the cost function

where $\theta = (\theta_0, …, \theta_n)^T$

Step 3. Compute hypothesis function as

where vector $x$ is normalized using the same values of $\mu$ and $\sigma$ as in Step 1.

Gradient Descent

Gradient descent is the method for finding (global) minimum of cost funtion $J(\theta)$. There are few ways to implement this method.

Direct method

Choose small learning rate $\alpha > 0$ and find the fixed point of the function

function [theta] = gradientDescent(X, y, theta, alpha, num_iters)
    m = length(y);
    for iter = 1:num_iters
        h = X * theta;
        delta = h - y;
        theta = theta - X' * delta * alpha / m;
    end
end

Optimized method

Many mathematical software packages already include implementations of gradient descent that compute learning rate $\alpha$ automatically. These methods accept cost function $J(\theta)$ and its gradient $\nabla J(\theta)$ as arguments, which for the linear regression is computed as follows

function [J, grad] = costFunction(theta, X, y)
    m = length(y);
    h = X * theta;
    delta = h - y;
    J = delta' * delta / 2 / m;
    grad = X' * delta / m;
end

function [theta] = gradientDescent(X, y, initial_theta)
    options = optimset('GradObj', 'on', 'MaxIter', 400);
    [theta, cost] = fminunc(@(t)(costFunction(t, X, y)), initial_theta, options);
end

Normal Equation

Unlike Gradient Descent this method does not require feature normalization (Step 1) and convergence loop. Normal equation gives the closed-form solution to linear regression

function [theta] = normalEquation(X, y)
    theta = pinv(X' * X) * X' * y
end

Regularization

In case of overfitting both methods can be tweaked by introducing polynomial features and adjusting equations as follows. Let $\lambda > 0$ and E be the diagonal matrix

Then the cost function for gradient descent becomes

and normal equation

Recently, while reading Surely You’re Joking, Mr. Feynman!, I found that Feynman invented his own notation when he was in school.

While I was doing all this trigonometry, I didn’t like the symbols for sine, cosine, tangent, and so on. To me, $\sin f$ looked like $s$ times $i$ times $n$ times $f$! So I invented another symbol, like a square root sign, that was $\sigma$ with a long arm sticking out of it, and I put the $f$ underneath. For the tangent it was $\tau$ with the top of the tau extended, and for the cosine I made a kind of $\gamma$, but it looked a little bit like the square root sign.

Now the inverse sine was the same sigma, but left-to-right reflected so that it started with the horizontal line with the value underneath, and then the sigma. That was the inverse sine, NOT $\sin^{-1} f$–that was crazy! They had that in books! To me, $\sin^{-1}$ meant $1/\sin$, the reciprocal. So my symbols were better.

I didn’t like $f(x)$–that looked to me like $f$ times $x$. I also didn’t like $dy/dx$–you have a tendency to cancel the d’s–so I made a different sign, something like an & sign. For logarithms it was a big L extended to the right, with the thing you take the log of inside, and so on.

I thought my symbols were just as good, if not better, than the regular symbols–it doesn’t make any difference what symbols you use–but I discovered later that it does make a difference. Once when I was explaining something to another kid in high school, without thinking I started to make these symbols, and he said, “What the hell are those?” I realized then that if I’m going to talk to anybody else, I’ll have to use the standard symbols, so I eventually gave up my own symbols.

The first one is the famous geometric series which sum is equal to 1. The second one seems to be bigger because 1 < n, except for the 0th term, but that 0th term makes a big difference.

First of all, the second series converges. You can prove it by D’Alembert’s theorem

Because the terms are positive, the series converges absolutely, therefore we can rearrange the terms.

Both series are equal.