An Introduction to Cryptography - Purdue Engineeringace/mobility/talks/secure1-crypto.pdf · An Introduction to Cryptography Edward J. Delp Purdue University School of Electrical

EPICS Spring 2003 Slide 1

An Introduction to Cryptography

Edward J. Delp

Purdue University School of Electrical and Computer Engineering

Video and Image Processing Laboratory (VIPER)West Lafayette, Indiana

email: [email protected] http://www.ece.purdue.edu/~ace


Course Goals

• Provide an introduction to modern cryptography and overview its use


Digital Communication System


Cryptography

• Analog Techniques

• Digital Techniques


Cryptography - History

• Very rich history– Mary Queen of Scots– WWII Admiral Yamamoto– WWII Ultra (Enigma Machine)

• “Modern” Cryptography after World War II– NSA

• Popular interest since about 1978http://www.cybercrimes.net/Cryptography/Articles/Hebert.

htmlhttp://www.ics.uci.edu/~ics54/doc/security/pkhistory.html


Goals

• Privacy - protect information from unauthorized users

• Authentication - “are you who you say you are”


“Drivers” of Modern Cryptography

• Prime Number Generation– integer factorization

• Random Number Generation


Why Is It Now Popular

• Driven by everything “digital”

• Most work to date devoted to text-based or character-based data


Export Controls

• The export of encryption software and hardware is controlled by the US government

• Can cause a problem if encryption is included in a product and it is desired to sell it outside the US

http://www.rsasecurity.com/rsalabs/faq/6-4.html

http://www.bxa.doc.gov/Encryption/Default.htm


Cryptography

• Code - exploit the linguistic properties of a language

• Cipher - do not exploit linguistic properties


Cryptography

P - plaintextC - ciphertext


Cryptography

• A special form of computation used to protect a plain-text message

• The “security” of the system is based on the difficulty of the “inverse” computation without special “side information” known as “keys”


Unbreakable Ciphers?

• Are there unbreakable ciphers?– Shannon showed that “unbreakable” systems exists– “one time pad” - form of a stream cipher

• difficult to manage

http://www.ranum.com/pubs/otpfaq/

http://world.std.com/~franl/crypto/one-time-pad.html


Unbreakable Ciphers?

• certificational security– secure because it has withstood the test of time in that

no attacks have been successful• provable security

– successfully attacking a provable system is identical to attacking a classically know “hard” problem

“A Note on the Security of the OAEP-Enhanced RSA Public-Key Encryption Scheme,” RSA Laboratories Bulletin Number 9, February 23, 1999.


Cryptanalysis

• Used to break or attack cipher systems• Attack can be brute force (exhaustive search on the

keyspace)• Exploit vulnerabilities in the cipher system or the way it

is used• “Black bag jobs”• “rubber hose” techniques• “purchase key” technique• “dumpster diving”• social engineering


Cryptanalysis

• Known plaintext• Known ciphertext• Chosen plaintext• Cripping• Differential approaches• Traffic flow analysis• Exploit “poor” use of the encryption system


Cryptanalysis

• How do you know when you have been success in your attack?

• Shannon showed this using the unicity distance:

K - key space, P - plaintext, RL - redundancy in plaintext

PRK

nL 2

2

loglog

=


Cryptanalysis

• Unicity distance indicates much ciphertext is needed to ensure there is only one plaintext that corresponds to this ciphertext - “spurious keys”

• Example - simple letter substitution cipher

• hence given a ciphertext of 25 letters a unique decryption is possible

75.0;!26;26 === LRKP

25=n


Why Use Encryption?

• Enhance ability to conduct global commerce• Privacy• Authentication


Cryptographic Systems

• Protocols describe how encryption system is used

• In many cases the security of the system is compromised by the protocol and NOT the encryption algorithm

– “man in the middle” attack


Types of Cryptographic Systems

C = S(P)S(•) - encryption function

P = H(C)H(•) - decryption function



• Totally Secret– Kerckhoff’s Principle - “The security of any cipher

lies in the key and NOT in the algorithm.”• Public Algorithm (Secret Key)• Public Key System



Totally secret systems - all aspects of the encryption/decryption is secret


Public Algorithm

• Algorithms are known but parameters (keys) are secret

C = Sk(P)P = Hk(C)K ≈ key

• Use same key for enciphering and deciphering• Block Ciphers -- DES, IDEA, Twofish, TEA• Stream Ciphers• Problem: key management


Public Key Cryptography

• Two keysE ~ enciphering keyD ~ deciphering key

C = SE(P)P= HD(C)

• Computationally infeasible to derive D from E• Each user could publish E in a “public key directory”



• No problem with key distribution - really?– fronting attacks– “man in the middle” attack

• Authentication - use private deciphering key to enciphering a message


Authentication

• Two keysE ~ enciphering keyD ~ deciphering key

Ca = SD(P) - encipher with private keyP= HE(Ca) - decipher with public key

The message P has been “signed”



• Must protect public key directory• Application of the use of signatures• Certify the public key with a broker of trust (the US Post

Office?!)


History of Public Key Cryptography

• Diffie, Hellman, and Merkle are credited with being the inventors of public key cryptography

– W. Diffie and M.E. Hellman, “Privacy and Authentication: An Introduction to Cryptography,” Proceedings of the IEEE, Vol. 67, No. 3, March 1979, pp. 397-427.

• British claim they did it in 1970 (http://www.gchq.gov.uk/about/history.html)

• NSA claim they also invented ithttp://www.research.att.com/~smb/nsam-160/


Key Management

• Block Ciphers - how do you distribute keys• Public Key - protect public key directory• Political issue - key recovery


Clipper and CapstoneEscrowed Encryption Standard, also known as “CLIPPER,” is a cryptographic device intended to protect private communications while at the same time permitting government agents to obtain the "keys" upon presentation of "legal authorization." The "keys" would be held by two government "escrow agents" and would enable the government to access the encrypted private communication. (February 4, 1992)Clipper would be used to encrypt voice transmissions, a similar device known as Capstone would be used to encrypt data. Both systems based on the SKIPJACKalgorithm.

http://www.eff.org/pub/Privacy/Clipper/


Encryption Systems

• Trapdoor Functions - easily computable functions with a computationally infeasible inverse (without use of special knowledge)


Public Key Systems

• Trapdoor-Knapsack System (Merkle and Hellman)

• Discrete Log (El Gamal)

• RSA (Rivest, Shamir, Adleman)

• Elliptic Curve Methods


Knapsack System

Subset Sum Problem:

Given positive integers a1, a2, …, an and positive integer c,determine the subset of the integers which sum to c.


“Hard Knapsack”

Assume the source produces binary words of n bits

X = (x1, x2, …, xn)xi ∈ { 0, 1 }

A = (a1, a2, …, an)

c = A • X = ∑=

•n

iii xa

1


“Easy Knapsack”

A′ = (3, 5, 11, 20, 41 ,83, 169, 340, 679, 1358)c′ = A′ • Xc′ = 1260

= 1358 > c′ ⇒ x10 = 0

),,,( 21 naaaA ′′′=′ L

∑−

=

′>′1

1

i

jji aa

10a′


“Easy Knapsack”

= 679 < c′ ⇒ x9 = 11260 - 679 = 581

= 350 < 581 ⇒ x8 =1

X = (0011101110)

“Easy” Knapsack is too easy!

9a′

8a′


“Moderately” Hard Knapsack

Choose two large positive numbers w and m

Example:w = 764m = 2731

= 20a4 = 20 x 764 mod (2731) = 1625

)mod(mwaa ii ′=

4a′


“Moderately” Hard Knapsack

A - public enciphering keyA′ , w, and m - private deciphering key

c = A• Xw-1w mod(m) = 1w-1 = 1605c ′ = cw-1 mod(m)aiw-1 mod(m) =

c ′ ~ easy knapsack

∑ −=′n

iii mwaxc )mod(1

ia′


Knapsack Attack

• Shamir proposed an interesting attack on the Knapsack system:

– A. Shamir and R.E. Zippel, "On the Security of the Merkle-Hellman Cryptographic System," IEEE Transactions on Information Theory, Vol. 26, No. 3, May 1980, pp. 339-340.

– A. Shamir, "A Polynomial-Time Algorithm for Breaking the Basic Merkle-Hellman Cryptosystem," IEEE Transactions on Information Theory, Vol. 30, No. 5, September 1984, pp. 699-704.


Encipher block of x bits using y bits of key to produce x bits of ciphertext

• Message extension

• Substitution cipher

Block Ciphers


Block Cipher

• Think of substitution operation as a permutation

• (2x)! Permutations

• Key requires log2[(2x)!] bits– are all keys equally likely? ⇒ entropy of the key space


Block Ciphers Problems

• Vulnerable to statistical attacks

• Vulnerable to dictionary attacks


Triple Encryption

• Use block cipher three times– Tuchman, W, “Hellman Presents No Shortcut

Solutions to DES”, IEEE Spectrum, vol. 16 no. 7, July 1979, pp. 40-41.

• “Encrypt-Decrypt-Encrypt”– use two or three keys– see RFC 1851

http://www.landfield.com/rfcs/rfc1851.html


Block Ciphers

• Translation Cipherc = m + ti

ti - offset associated with the key• Linear Cipher

c = AimAi - matrix associated with the key

• Affine Cipherc = Am + t


Feistel Cipher

• Plaintext must be even number of bits, 2n• Plaintext, m, split into 2 halves m = (m0, m1)• Key has subkeys (k1, k2, …, kh)• Each subkey describes a transformation fki

of n bits into n bits

• fkiis a block cipher


Feistel Cipher

A message m is enciphered h times or h rounds

1 ⇒ u0 = (m0, m1)u1 = (m1, m2)m2 = m0 + fk1

(m1)2 ⇒ u1 = (m1, m2)

u2 = (m2, m3)m3 = m1 + fk2

(m2)


Feistel Cipher

ith ⇒ ui-1 = (mi-1, mi)ui = (mi, mi+1)mi+1 = mi-1 + fki

(mi)hth ⇒ uh-1 = (mh-1, mh)

uh = (mh, mh+1)

Output ciphertextc = uh


Feistel Cipher

• Note:mi+1 = mi-1 + fki

(mi)can also be written asmi-1 = mi+1 + fki

(mi)• Hence - reverse halves of c and use as input to decipher c• Exact same hardware used for both enciphering and

deciphering, i.e do not need • in fact need not exist!

)(1 •−ikf

)(1 •−ikf


Data Encryption StandardDES 1977

• A Feistel cipher with subkeys that are a function of the round

• Based on the IBM Lucifer cipher• A US standard• Several operational modes - block or feedback mode• 64-bit plaintext• 56-bit key• 16 roundshttp://csrc.nist.gov/cryptval/des.htmhttp://csrc.nist.gov/encryption/tkencryption.html


DES

• Input (L, R) (each 32 bits)• nth round

input Ln-1Rn-1

Ln = Rn-1

Rn = Ln-1 + f(Rn-1, Kn)Kn ~ 48 bits chosen for the 56 bit keyKn = KS(n, key)


DES


DES


DES


DES


DES

• E maps 32-bit input → 48-bit output• S boxes? - 6 bits in / 4 bits out

– MSB and LSB of input form row index– block ciphers (not affine)– middle 4 bits form column index


Cracking DES

http://www.eff.org/descracker.html


DES “Hardware”

90 Billion keys/second - 4.5 days to break a 56 bit single DES key


DES Hacking

• In 1999, new hack broke it in 22 hours –http://www.eff.org//Privacy/Crypto_misc/DESCracker/HTML/19990119_deschallenge3.html

• http://www.cryptography.com/resources/whitepapers/DES.html


DES

• Single DES may still be have security for many applications

• Triple DES is very secure - no known attacks


AES

Advanced Cryptography Standard - new standard to follow on to DES

– 128 bit input– keys 128, 192, and 256 bits– computational requirements

New algorithm announced on October 2, 2000It is known as Rijndael

http://csrc.nist.gov/encryption/aes/


AES Candidates• Rijndael -

http://www.esat.kuleuven.ac.be/~rijmen/rijndael/

• MARS -http://www.research.ibm.com/security/mars.html

• RC6 - http://www.rsasecurity.com/rsalabs/rc6/index.html

• Serpent - http://www.cl.cam.ac.uk/~rja14/serpent.html

• Twofish - http://www.counterpane.com/twofish.html


Rijndael

• Does not use the Feistel structure, instead “layers” are used

• Uses only simple whole byte operations• Variable number of “rounds”

– 9 rounds if both the block and the key are 128 bits long

– 11 rounds if either the block or the key is 192 bits long, and neither of them is longer

– 13 rounds if either the block or the key is 256 bits long.


Rijndael

• To encipher a block of data– Add Round Key step (XORing a subkey with the

block) by itself– the number of rounds mentioned on previous slide

• Byte Sub• Shift Row• Mix Column• Add Round Key

– the final round with the “Mix Column step” omitted• Key Schedule


Rijndael



Byte Sub

• Each byte encrypted by an S-box

99 124 119 123 242 107 111 19748 1 103 43 254 215 171 118

202 130 201 125 250 89 71 240173 212 162 175 156 164 114 192183 253 147 38 54 63 247 20452 165 229 241 113 216 49 214 199 35 195 24 150 5 1547 18 128 226 235 39 178 1179 131 44 26 27 110 90 160

82 59 214 179 41 227 47 13283 209 0 237 32 252 177 91

106 203 190 57 74 76 88 207208 239 170 251 67 77 51 13369 249 2 127 80 60 159 16881 163 64 143 146 157 56 245

188 182 218 33 16 255 243 210205 12 19 236 95 151 68 23196 167 126 61 100 93 25 11596 129 79 220 34 42 144 13670 238 184 20 222 94 11 219

224 50 58 10 73 6 36 92194 211 172 98 145 149 228 121231 200 55 109 141 213 78 169108 86 244 234 101 122 174 8186 120 37 46 28 166 180 198232 221 116 31 75 189 139 138112 62 181 102 72 3 246 1497 53 87 185 134 193 29 158

225 248 152 17 105 217 142 148155 30 135 233 206 85 40 223140 161 137 13 191 230 66 10465 153 45 15 176 84 187 22


Shift Row

For 128 bit input (bytes 1 to 16 are arranged as):from to

1 5 9 13 1 5 9 132 6 10 14 6 10 14 23 7 11 15 11 15 3 74 8 12 16 16 4 8 12


Shift Row

• Inputs that are 192 shifted like this:

from to1 5 9 13 17 21 1 5 9 13 17 212 6 10 14 18 22 6 10 14 18 22 23 7 11 15 19 23 11 15 19 23 3 7 4 8 12 16 20 24 16 20 24 4 8 12


Shift Row

• Inputs that are 256 bits are shifted as:from to

1 5 9 13 17 21 25 29 1 5 9 13 17 21 25 292 6 10 14 18 22 26 30 6 10 14 18 22 26 30 23 7 11 15 19 23 27 31 15 19 23 27 31 3 7 114 8 12 16 20 24 28 32 20 24 28 32 4 8 12 16


Mix Column

• Matrix multiplication is performed: each column is multiplied by the matrix:

2 3 1 11 2 3 11 1 2 33 1 1 2


Add Key Round

• XORs the key round


Rijndael• Hence Rijndael is:

ARK

BSBSRMCARK

BSBSRMCARK...BSBSRMCARK

BSBSRARK


Key Schedule• For 128 and 192 bit keys

– original key, followed by stretches, each the length of the original key, consisting of four-byte words such that each word is the XOR of the preceding four-byte word and either the corresponding word in the previous stretch or a function of it

– first word in a stretch, the word is first rotated one byte to the left, and then its bytes are transformed using the S-box from the Byte Sub step, and then a round-dependent constant is XORedto its first byte

• For 256 bit keys in length, in addition, the S-box from the Byte Sub step alone is applied to the word from the preceding stretch for the fifth word in a stretch


Blowfish

• Blowfish - http://www.counterpane.com/blowfish.html– symmetric block cipher that can be used as a drop-in

replacement for DES– 64 bit block cipher with variable-key length– uses Feistel structure

• Blowfish has two steps– key expansion - key as large as 448 its converted to

subkey array of 4168 bits– encryption - 16 rounds of the Feistel structure– four 32 bit S-boxes that have 256 entries


Blowfish - Block Diagram


Blowfish - F Function


Twofish

• Twofish - http://www.counterpane.com/twofish.html• 128-bit block cipher • 128-, 192-, or 256-bit key • 16 round Feistel structure


Twofish - Block Diagram


Twofish - F Function


IDEA

International Data Encryption Algorithm (IDEA) proposed by Lai and Massey in 1990

– block cipher– used in many applications as a replacement to DES– used in PGP– “seems” to be immune to differential attacks

IDEA is patented:http://www.ascom.ch/systec/idea.html


IDEA• 64 bit input• 128 bit key• 8 rounds • Combinations of:

– XOR– additions, mod 216

– multiplies, mod 216 + 1 (which is prime)

• Appears very secure, but still a new algorithm


• X = plaintext• Y = ciphertext• Z = key• ⊕ = XOR• = ADD• · = MULT

IDEA


Skipjack

• Block cipher proposed by NSA as part of the Clipper Chip

– 64 bit input– 80 bit key– 32 rounds– can be used in different modes

http://csrc.nist.gov/cryptval/des.htm


Tiny Encryption Algorithm (TEA)

• Tiny Encryption Algorithm (TEA) -http://www.vader.brad.ac.uk/tea/tea.shtml

– 64 bit block cipher using a 128-bit key– uses Feistel structure with 8, 16, 32 rounds

• Computationally very efficient

• Assumed to be secure - no known attacks


RC5

• RC5 - http://www.rsasecurity.com/rsalabs/faq/3-6-4.html– block size 32 bits , 64 bits (for use a drop-in

replacement for DES), and 128 bits– number of rounds can range from 0 to 255 – the key can range from 0 bits to 2040 bits in size


Primitive OperationsA + B Addition modulo 2w

A - B Subtraction modulo 2w

A ⊕ B Exclusive-OrA <<< B Rotate A left by amount in

low-order lg(w ) bits of BA >>> B Rotate A right, similarly

(A,B,C,D) = (B,C,D,A) Parallel assignment

A x B Multiplication modulo 2w


RC5

Two plaintext block A and B, r is the number of roundsRC5 encryption inner loop:

for i = 1 to r do{

A = ( ( A ⊕ B ) <<< B ) + S[ i ]( A, B ) = ( B, A )

}

S[i] is generated by the key


RC5 Key Expansion

• Input: array L[ 0 … c-1 ] of input key words• Output: array S[ 0 … 43 ] of round key words• Procedure:

S[ 0 ] = 0xB7E15163for i = 1 to 43 do S[i] = S[i-1] + 0x9E3779B9A = B = i = j = 0for s = 1 to 132 do

{ A = S[ i ] = ( S[ i ] + A + B ) <<< 3B = L[ j ] = ( L[ j ] + A + B ) <<< ( A + B )i = ( i + 1 ) mod 44j = ( j + 1 ) mod c }


RC6• RC6-w/r/b parameters:

– Word size in bits: w ( 32 )( lg(w) = 5 )– Number of rounds: r ( 20 )– Number of key bytes: b ( 16, 24, or 32 )

• Key Expansion: – Produces array S[ 0 … 2r + 3 ] of w-bit round keys.

• Encryption and Decryption:– Input/Output in 32-bit registers A,B,C,D


RC6 Primitive OperationsA + B Addition modulo 2w

A - B Subtraction modulo 2w

A ⊕ B Exclusive-OrA <<< B Rotate A left by amount in

low-order lg(w ) bits of BA >>> B Rotate A right, similarly

(A,B,C,D) = (B,C,D,A) Parallel assignment

A x B Multiplication modulo 2w


RC6 Encryption (Generic)

B = B + S[ 0 ]D = D + S[ 1 ]for i = 1 to r do

{t = ( B x ( 2B + 1 ) ) <<< lg( w )u = ( D x ( 2D + 1 ) ) <<< lg( w )A = ( ( A ⊕ t ) <<< u ) + S[ 2i ]C = ( ( C ⊕ u ) <<< t ) + S[ 2i + 1 ](A, B, C, D) = (B, C, D, A)

}A = A + S[ 2r + 2 ]C = C + S[ 2r + 3 ]


One Round of RC6

55

ff

A B C D

<<<<<<

<<< <<<

S[2i] S[2i+1]

A B C D

t u


RC6 Encryption (for AES)

B = B + S[ 0 ]D = D + S[ 1 ]for i = 1 to 20 do

{t = ( B x ( 2B + 1 ) ) <<< 5u = ( D x ( 2D + 1 ) ) <<< 5A = ( ( A ⊕ t ) <<< u ) + S[ 2i ]C = ( ( C ⊕ u ) <<< t ) + S[ 2i + 1 ](A, B, C, D) = (B, C, D, A)

}A = A + S[ 42 ]C = C + S[ 43 ]


RC6 Decryption (for AES)

C = C - S[ 43 ]A = A - S[ 42 ]for i = 20 downto 1 do

{(A, B, C, D) = (D, A, B, C)u = ( D x ( 2D + 1 ) ) <<< 5 t = ( B x ( 2B + 1 ) ) <<< 5C = ( ( C - S[ 2i + 1 ] ) >>> t ) ⊕ uA = ( ( A - S[ 2i ] ) >>> u ) ⊕ t

}D = D - S[ 1 ] B = B - S[ 0 ]


Key Expansion (Same as RC5’s)

• Input: array L[ 0 … c-1 ] of input key words• Output: array S[ 0 … 43 ] of round key words• Procedure:

S[ 0 ] = 0xB7E15163for i = 1 to 43 do S[i] = S[i-1] + 0x9E3779B9A = B = i = j = 0for s = 1 to 132 do

{ A = S[ i ] = ( S[ i ] + A + B ) <<< 3B = L[ j ] = ( L[ j ] + A + B ) <<< ( A + B )i = ( i + 1 ) mod 44j = ( j + 1 ) mod c }



RSA (1978)Rivest, Shamir, and Adleman

Problem: factor a large integer into the product of two integers


RSA

• Public key: choose integers h and n• Plaintext block: m• Encipher: • Decipher:• h - public enciphering key (known)• d - private deciphering key• n - known

)mod(nmc h=)mod(ncm d=


RSA

• Generate d and h - choose two prime numbers p and q such that pq = n

• p and q are secret• Choose d such that

GCD(d, φ(n)) = 1φ(n) = (p-1)(q-1)φ(n) ~ Euler’s Totient Function


RSA

Example:p = 61q = 53n = 3233φ(n) = 3120choose d = 37 ⇒ h = 253dh = 1 mod φ(n)


RSA• How to attack RSA

– factor n ⇒ p and q ⇒ d from h– n ~ 300 digits

• ~ 1.5 x 1029 operations to factor n• 1 µs/operation ⇒ 4 x 1015 years

– Determine φ(n) ⇒ factor n• Operational Protocol for RSA - plaintext padding

protocol known as the Optimal Asymmetric Encryption Padding (OAEP)

M. Bellare and P. Rogaway, “Optimal Asymmetric Encryption - How to Encrypt with RSA,” Eurocrypt1994, pp.92-111.



Discrete Log ProblemEl Gamal Cipher

• p - prime number• α and β intergers• Find a such that αa = β mod (p)


El Gamal Cipher

• Discrete Log Problem - αa = β mod (p)– p, α, and β are public key– a is secret (deciphering key)

• Chose k• x - plaintext

y1 = αk mod (p)y2 = xβk mod(p)c = (y1, y2)


El Gamal Cipher

• Plaintext masked by βk

• decryption - compute βk from αk and then divide to obtain x

x = y2 (y1a)-1 mod (p)

y1a = (αk )a mod (p)

y1a = βk mod (p)

x = x βk (βk )-1 mod (p)• To attack the cipher must solve the discrete log problem

for a


Diffie-Hellman Key Exchange• Choose prime number n and integer g - can be made

public• User 1 ⇒ A = gx mod n (x random integer); send A to

User 2• User 2 ⇒ B = gy mod n (y random integer): send B to

User 1• User 1 ⇒ k = Bx mod n• User 2 ⇒ h = Ay mod n• k = h = gxy use as the keyillegal user knows: n, g, A, and B ⇒ to find key - solve the

discrete log


Other Public Key Techniques

• Elliptic Curve Systems• Cellular Automata• DES Variants• Ong-Schnorr-Shamir• ESIGN


Elliptic Curve Cryptosystems

• Elliptic Curve Systems - generalization of the discrete log problem and RSA systems to a Galois Field which modular multiplication is replaced by the elliptic curve addition operation, for example:

y2 = x3 + ax + b (mod p) (p is prime)Find points solutions to curve (x, y) pairs• PKCS #13: Elliptic Curve Cryptography Standard -

http://www.rsasecurity.com/rsalabs/pkcs/pkcs-13/

http://world.std.com/~dpj/elliptic.html


Stream Ciphers

• Key generator - generate random sequence– Can it really be random?

• Can produce “error resilient” cipher


Stream Cipher

• Another way to look at:

Pi i=1, 2, 3, … plaintextRi i=1, 2, 3, … random numbers used as the key

sequence

Ci = Pi ⊕ Ri ciphertext


Key Generator

• Shift Register sequence

• Linear Shift Register Sequence


LSR Sequences

f(•) = c0s0 + c1s1 + … + cn-1sn-1

ci ~ feedback coefficients

• Output is function of the ci’s and the initial fill

• Output sequence is periodic, maximum period 2n-1

• How do you choose the feedback coefficeints?

– use m-sequences (nice correlation properties)

– also known as pseudo-random sequences


Linear Shift Register

• Not very secure• know 2n bits ⇒ can obtain the entire 2n - 1 bits• use non-linear sequences• random number generation


RC4

• Stream cipher - Ci = Pi ⊕ Ri

• To generate Ri: one 8x8 s-box of bytes Si i=0, 1, …, 255i=0, j=0i=(i+1) mod 256j= (j+ Si ) mod 256swap Si and Sj

t= (Si + Sj) mod 256R = St


RC4

• Generation of the s-box - 8x8 matrix– initially fill it with 0, 1, 2, …, 255– take key and fill another array, repeat key to fill the

entire array, call this K0, K1, …, K255

for i=0 to 255j = (j+ Si + Ki) mod 256swap Si and Sj


RC4

• RSA claims the RC4 is immune to short cycles and other attacks and is very nonlinear – it has been broken!

• can extend to larger s-box

• Lots of controversy when RC4 was leaked to the public• RC4 used in Cellular Digital Packet Data (CDPD) and

WEP

• See Airsnort - http://airsnort.shmoo.com/


Authentication Signature Schemes

• Who are you?• Are you who you say you are?• Signing a document


Signatures

• Digital Signatures vs. Conventional Signatures• “Signing” a document

– Conventional Signature - physically part of the document

– Digital Signature - must have a “binding” operation to bind signature to message

• Verification– Conventional - compare to other authentic document– Digital - public algorithm anyone can verify the

signature


Signatures

• A copy of signed digital document is identical to the original

• Problem with document reuse (time-stamping)


Signatures - RSA

M - messagekd - private deciphering keyke - piblic enciphering key

c = dkd(m)

m = eke(c)

c - signed messageProblems with forgery - use hash functions


Signature Algorithm

• Signing Algorithm sigk(•)• Verification Algorithm verk(•)• El Gamal Signature Algorithm• DSS (December 1, 1994)• Difference in Encryption and Signature Systems

– Signature System must be stronger– Problems with signing long messages


Signing and Encryption

• Always better to sign and then encryptm - plaintexts = dkd

(m)c = eke

(m, s)c - ciphertext

• Encrypt the signc´ = eke

(m)c = dkd

(c´)Another user could remove your signature add their

signature


Hash Functions

• Hash functions convert arbitrary-length binary strings to a fixed length output, H = H(P)

• Useful properties:– trivial to produce H, given P– extremely difficult to obtain P from H– very difficult to find two inputs, P1 and P2, that

yield the same H (collision resistance)


Hash Functions• Produce Message Digest by “hashing” the message

– check sum– map large message into n bit hash

• Sign message digest• MD4 Hash (Rivest 1990)• MD5 Hash (Rivest 1991) 128 bit hash• Secure Hash Standard (SHS) (May 11, 1993) 160 bit hash

– SHA-1– http://csrc.nist.gov/cryptval/shs.html– SHA-1 will be replaced - new hash work better with

AES


SHA-1


Time Stamps• Time stamps use hash functions to verify a digital work’s

time of creation, ownership and content:– When was this data created or last modified?

• Two procedures:– certification - the author of the data can "sign" the

record, or a user can fix data in time. The result is a certificate

– verification - any user can check data and its certificate to make sure it is correct

• Time stamping is a form of authentication and requires a “trusted” third party escrow agent

• http://www.surety.com/


Other Standards

• Digital Signature Standard

• Digital Time Stamp Standard


Pretty Good Privacy - PGP

• Uses RSA, IDEA, and MD5 hash• Message encrypted using IDEA

– 64 bit plaintext, 128 bit key• RSA used to encrypt IDEA key• Hash used for signing

http://www.pgp.com/


E-Commerce

• This almost always means selling and/or buying something using the Internet

– cryptography (be careful of US export laws)– authentication (signing and time stamping)

• The key management problem - who is your trusted escrow agent (US government?)


Certificates and Digital I.D.

• Use to certify that your public key is correct - trusted third party signs your public key and issues a certificate or “digital I.D”

• Used – web browsers– secure email– smart cards


Certification Authority (Trusted Agents)

• VeriSign - www.verisign.com• Baltimore CyberTrust Solutions -

http://www.baltimore.com/cybertrust/• Entrust - www.entrust.com

All use the Public Key Infrastructure (PKI)http://csrc.nist.gov/pki/


Web Based Security

• Lots of potential problems using the web - it is easy to do something dumb!

– cgi scripts– serve side includes – running the server as root– TCP/IP problems (spoofing and packet flooding)

http://www.w3.org/Security/Faq/www-security-faq.html


Digital Millennium Copyright Act

Will it be illegal to remove security features from a data element?

http://lcweb.loc.gov/copyright/

http://www.dfc.org/


Reference Books

• D. R. Stinson, Cryptography: Theory and Practice, CRC Press, 2nd Edition.

• B. Schneier, Applied Cryptography, (2nd edition) Wiley, 1996.

• D. Kahn, The Codebreakers, Scribner, 1996.• K. W. Dam and H. S. Lin, Cryptography’s Role In

Securing The Information Society, National Academy Press, 1996.


Web Resources• RSA Security -- http://www.rsa.com (RSA Labs -

http://www.rsasecurity.com/rsalabs/index.html excellent FAQ)

• International Association for Cryptologic Research http://www.swcp.com/~iacr

• Ron Rivest's Cryptography and Security Page http://theory.lcs.mit.edu/~rivest/crypto-security.html

• Dorothy Denning's Cryptography Project http://www.cosc.georgetown.edu/~denning/crypto

• Bruce Schneier’s Counterpane http://www.counterpane.com/

• NIST’s Cryptographic Toolkit http://csrc.nist.gov/encryption/

An Introduction to Cryptography - Purdue Engineeringace/mobility/talks/secure1-crypto.pdf · An Introduction to Cryptography Edward J. Delp Purdue University School of Electrical

Documents