C. Edward Chow
CS691 Chapter 9 of Matt Bishopz
Chapter 8 of Tanenbaum
cs691
chow
Topics to be Covered
cs691
Introduction to Cryptography Substitution Ciphers Transposition Ciphers One-Time Pads: Quantum Cryptography Two Fundamental Cryptographic Principles Symmetric-Key Algorithms Public-Key Algorithms Key Management: Digital Signatures
2 chow
Cryptography
Greek words for Secret Writing. Cipher vs. Code 1. Cipher: a character-to-character or bit-to-bit transformation without regard to linguistic sturcture of the msg. 2. Code: replace one word woth another word or symbol. e.g., Navajo code WWII (chay-da-gahi-nailtsaidi(tortoise killer). The art of devising ciphers is called cryptography The art of breaking ciphers is called cryptanalysis Cryptography and cryptanalysis is collectively known as Cryptology.
cs691
chow
Cryptosystem
A cryptosystem is a 5-tuple (E,D,M,K,C), where M a set of plaintexts (some use P as symbol); K the set of keys; C the set of ciphertexts; E: M x K C the set of enciphering functions; D: C x K M the set of deciphering functions; Caesar cipher example: M = { all sequences of Roman letters } K = { i | i an integer such that 0 i 25 } E = { Ek | k K and m M, Ek(m)=(m+k) mod 26 } D = { Dk | k K and c C, Dk(c)=(26+c-k) mod 26 } E.g., the word m=HELLO c=KHOOR what is k?
4 chow
cs691
Adapted from Tanenbaum Computer Networks Figure 8.2 Here P=M, and key is moved as subscript of functions.
cs691
5 chow
Two categories: Substitution Ciphers: each letter or group of letters is replaced by another letter or another group of letters. It preserves the order of the plaintext symbol but disguise them. E.g., Caesar cipher; mono-alphabetic substitution (each letter map onto another letter; 26!=4x10^26 possible keys) Transposition Ciphers: Reorder the letters but do not disguise them. E.g., Rail Fence cipher m=HELLOWORLD distribute the letter up and down between two rows from left to right; then output row-wise. HLOOL c=HLOOLELWRD ELWRD
6 chow
cs691
Kerckhofs Principle
All crypto algorithms must be public; only the keys are secret --- La Cryptographie Militaire, J. des Sciences Militaires, vol. 9, pp.5-38, Jan. 1883 and pp. 161-191, Feb. 1883. Trying to keep the algorithm secret (security by obscurity principle?) never works. Reasons: Logistic issue: Too much effort to invent, test, and install new algorithm Publish the algorithm and let academic cryptologists to break the system. If no one succeeded in 5 years, it must be pretty solid. Real secrecy in the key, its length a major design issue
cs691
7 chow
cs691
chow
Ciphertext-only: cryptoanalyst has some ciphertext; no (does not know the corresponding) plaintext; no key; no E or D functions. Known plaintext: some matched ciphertext and plaintext. (no key; may/may not know the E or D functions) Chosen plaintext: has the ability to encrypt pieces of plaintext of his own choosing. (know the E or D function; does not know the keys used).
cs691
chow
Use statistical properties of natural languages. Rank of Frequency of appearance of Unigrams (single letter): e, t, o, a, n, i etc Digrams (two-letter): th, in, er, re, an, etc Trigrams (three-letter): the, ing, and , ion, etc Counting the frequencies of letters in ciphertext. Tentatively assign the most common one to e; next to t... Then look at the trigrams of decipher text, if tXe appears, it should be the! Original deciphering function should be changed to map from X to h. Similarly, what should we do if we see thYt? How about aZW?
10 chow
cs691
Ciphertext from accounting firm CTBMN BYCTC BTJDS QXBNS GSTJC BTSWX CTQTZ CQVUJ QJSGS TJQZZ MNQJS VLNSX VSZJU JDSTS JQUUS JUBXJ DSKSU JSNTK BGAQJ ZBGYQ TLCTZ BNYBN QJSW A likely word is financial. Based on two i are separated by four letters, we look for same pattern in ciphertext. There are 12 hits, position 6, 15, 27, 31, 42, 48, 56. 66, 70, 71, 76, and 82. Only 31 and 42 has the next letter n (ana) separated by one letter. i C and J; nT and S respectively.
11 chow
cs691
A transposition cipher. Keyed by a phrase such as MEGABUCK. The letter in the key indicated the order of columns to be output. Plaintext horizontally read in, ciphertext read out column by column.
cs691
12
chow
Check if the frequency distribution of unigrams are the same in the ciphertext. If it is, then this is a transposition cipher. Guess the number of columns. Assume we suspect milliondollars appear in ciphertext Analyze keylength: Observe digrams MO, IL, LL, LA, IR, and OS in ciphertext as wrapping around effect keylength = 8. Analyze order of columns. If keylength is small, column pairs (k(k-1) of them) of ciphertext can be examined and see if the patterns of digrams in the deciphered text match those of the language frequency distribution.
cs691
13 chow
One-Time Pads
Unbreakable Cipher. Choose long random bit string as key (same length of the text?) Use Bit XOR as E and D. Problem: How to distribute and protect the key.
The use of a one-time pad for encryption and the possibility of getting any possible plaintext from the ciphertext by the use of some other pad.
cs691
14 chow
Quantum Cryptography
Can be used to transfer one-time pad over networks. Here Fiber channel is assumed. Light comes as little packets called Photons Photons can be polarized using filter such as sunglass. The photons after the polarized filters will be polarized in the direction of the filters axis. If the beam goes through the 2nd filter and 1. the two filters are perpendicular, no photons get through. 2. The light intensity after the 2n filter is proportion to the square of the cosine of the angle between the two filter axes.
cs691
15 chow
Alice and Bob each has two set of filters. One with vertical and horizontal filters called rectilinear basis. The other set rotate 45 degree called diagonal basis. Alice assigns vertical as 0 and horizontal as 1; lower left to upper right as 0 and upper left to lower right as 1. Send this assignment in plain text to Bob. Alice pick a one-time pad. 1001110010100110 Transfer them bit by bit to Bob using one of the two bases at random. See Figure 8-5(a) Bob does not know which bases to use, he randomly pick one. See Figure 8-5(b). If he picks right, he gets correct bits. If not, he gets random bit. A photon hit a filter with 45 degree to photons polarization, will randomly jump to the axis of the filter or perpendicular to that. Figure 8-5(c). Bob tells Alice the axes he used in plaintext. Alice tells him which are right/wrong in plaintext. Figure 8-5(d). Now both have a correct bit string. Figure 8-5(e). Trudys choices of bases Figure 8-5(f). Trudys bit pattern with Unknown bits.
16 chow
cs691
Quantum Cryptography
cs691
17
chow
Redundancy: Messages must contains some redundancy. E.g., Last three bytes of encrypted packet content are product # and quantity. Recent fired employee can capture the packet replace the last three byte quantity field with a random number. How redundancy can help? Freshness Some method is needed to foil replay attacks. How to defense reply attacks? Timestamp alone?
18 chow
cs691
Symmetric-Key Algorithms
DES The Data Encryption Standard AES The Advanced Encryption Standard Cipher Modes Other Ciphers Cryptanalysis
cs691
19
chow
Product Ciphers
(a)
P-box. (b) S-box. (c) Product. Hardware implementation. P: permutation (transpose). S: Substitution; 01234567 in, 24506713 out. Software implementation: through iterations called rounds
20 chow
cs691
Ri-1 expand to 48 bit; exclusive or with Ki Divide into 8 groups 6bit each Each group goes through S-Box; output is 4 bits.
The data encryption standard 1977/IBM (12856 bits key) for unclassified info. (a) General outline. (b) Detail of one iteration. The circled + means exclusive OR. 21 chow
cs691
Triple DES
IS8732; two keys (a) Triple encryption using DES. (b) Decryption.
Compatible with old DES. If we use the same key instead a different K2. 128 bit key2^128=3*10^38keys; evaluate one key per picoseconds it takes 10^10 years.
22 chow
cs691
Rules for AES proposals The algorithm must be a symmetric block cipher. The full design must be public. Key lengths of 128, 192, and 256 bits supported. Both software and hardware implementations required The algorithm must be public or licensed on nondiscriminatory terms.
http://csrc.nist.gov/CryptoToolkit/aes/rijndael/
23 chow
cs691
AES (2)
cs691
24
chow
AES (3)
cs691
25
chow
AES/DES are monoalphabetic substitution cipher. Same plaintext with same key in, same ciphertext out. Cipher Attack: Just substitute 12th block with 4th block and Leslie has a Merry Christmas.
26 chow
cs691
Use the chaining mode to defeat the above attack. C1 depends on C0. Cipher block chaining. (a) Encryption. (b) Decryption.
cs691
27
chow
For terminal type application, wait for 8 characters before sending the ciphertext is not an option. Use Character Chaining mode with a shift register. (a) Encryption. (b) Decryption.
cs691
28
chow
In previous modes, one bit Tx error messing whole block. In Stream cipher mode, early ciphertext does not involve with later encryption and one bit Tx error one bit plaintext error A stream cipher. (a) Encryption. (b) Decryption.
cs691
29
chow
Counter Mode
Except electronic code book mode, previous modes requires first decrypting all the blocks ahead the current block. Make it difficult to do random access of encrypted files. (problem is reuse attack, when same key is used. Encryption using counter mode.
cs691
30
chow
Cryptanalysis
Rijndael got adopted as AES . Serpent(cambridge) 2nd. http://csrc.nist.gov/CryptoToolkit/aes/rijndael/ http://www.esat.kuleuven.ac.be/~rijmen/rijndael/ Some common symmetric-key cryptographic algorithms.
cs691
31
chow
Public-Key Algorithms
1976 Dillfie and Hellman proposed crypto scheme with two keys; public key and private key. Requirement: Must be computationally easy to encipher/decipher msg using these keys. Must be computationally infeasible to derive the private key from public key. Mulst be computationally infeasible to determine the private key from a chosen plaintext attack. Symmetric key exchange protocol RSA Other Public-Key Algorithms
cs691
32
chow
It is based on discrete logarithm problem. Alice and Bob chooses a prime p=53 and g=17 which is not 0, 1, or p-1=52. Alice chooses private key=5, public key=175 mod 53 =40. Bob choose private key=7, public key=177 mod 53=6. Bob would like to send msg to alice. Bob compute the shared secret key by enciphering Alices public key using his private key: 407 mod 53 = 38 Encipher the msg with key=38. Alice computes the shared secret key as 65 mod 53=38. Then decipher the msg with key=38.
33 chow
cs691
RSA
An exponentiation cipher. Choose two prime numbers p and q. Let n = pq. The totient (n) of n is the number of numbers less than n with no factors in common with n. (n)=(p-1)(q-1)? E.g., (10) =4; since 1,3, 7, 9 are relative prime of 10. Choose e <n; e be relative prime to (n). Find d such that ed mod (n) = 1. The public key is (e,n), private key is d. C=me mod n M=cd mod n
cs691
34 chow
Let p=7 and q = 11. n=77 and (n) =60. Alice choose e=17, a relative prime to 60 private key is d=53 where e*d mod (n) =1; 17*53 mod 60 = 1 If we represent 07 as and 25 as Z, 26 as blank, then HELLO WORLD will be 07 04 11 11 14 26 22 14 17 11 03. Using Alice public key the cipher text is: 07^17 mod 77 = 28 04^17 mod 77 = 16 11^17 mod 77 = 44 03^17 mod 77 = 75. Only Alice can decipher with private key 53.
35 chow
cs691
cs691
36
chow
Encrypted using Senders Private key and the recipients private key Bobs public key 37, private key 13. Alices public key 17, private key 53. Encipherment: (07^53 mod 77)^37 mod 77 = 07 (04^53 mod 77)^37 mod 77 = 37 (11^53 mod 77)^37 mod 77 = 44 (03^53 mod 77)^37 mod 77 = 47 Decipherment: decipher with recipients private key and autenticate with senders public key. (07^13 mod 77)^17 mod 77 = 07 (37^13 mod 77)^17 mod 77 = 04 (44^13 mod 77)^17 mod 77 = 11 (47^13 mod 77)^17 mod 77 = 03
37 chow
cs691
Simplified example, character as block. NO can be swapped and interpreted as ON. (Attack is on or not?) Defense: 6 bits for block # followed by 8 bit character. The rest 1010 bits contains random data. Rearrange of blocks can be detected by checking the block # field. This is an application of the Redundancy principle.
cs691
38
chow
RSA
Actual RSA primes should be at least 512 bits modulus at least 1024 bits. RSA combined with hash to prevent reordering attack. An example of the RSA algorithm. Here p=3, q=11, n=33, z=(p-1)*(q-1)=20, choose d=7, which is relative primve of z. choose e=3 where e*d mod 20 = 1. Here (3, 20) is public key. (7,20) is private key. C=Pe mod n; P=Cd mod n;
cs691
39
chow
Digital Signatures
Symmetric-Key
cs691
40
chow
Symmetric-Key Signatures
Digital signatures with Big Brother (BB: a central authority trust by everyone; knows everything!). Everyone (i) carries secret key Ki to BBs office. Alice enciphers the following data with her secret key KA (B:Bobs ID, RA: a random number chosen by Alice, t: timestamp, P: plaintext msg.); send it to BB. BB deciphers with KA; encrypted the data together with a signed msg KBB(A, t, P) using Bs secret key.
cs691
41
chow
BB will not accept a msg from Alice unless it is encrypted with KA. KBB(A, t, P) contains the proof that A sent P at time t. Against replay attack: Against instant replay: Within some time period, Bob can check if RA has been reuse; drop those packet. Against old replay: Based on the timestamp, Bob can discard old messages. Disadvantage: BB needs to be trusted by everyone. BB gets to read all signed msgs.
42 chow
cs691
Public-Key Signatures
1991, NIST proposed Digital Signature Standard (DSS) using variant of the EL Gamal public key algorithm (discrete logarithm). But it is too secret (NSA designed); too slow (10-40 times slower than RSA for checking signature); to new (not yet thoroughly analyzed); to insecure (fixed 512bits; later changed to 1024 bits)
43 chow
cs691
Message Digests
Authentication without encrypting the entire msg. 4 properties of Message Digest (MD hash function: arbitrarily long plaintext fixed-length bit string. Given P, it is easy to compute MD(P). Given MD(P), it is effectively impossible to find P. Given P no one can find P such that MD(P)=MD(P). A change to the input of even 1 bit produces a very different output. For example, Instead of KBB(A, t, P) , we have KBB(A, t, MD(P))
cs691
44
chow
MD5
Designed by Ronald Rivest 1992. 5th of a series of MD. Pre-computation Step: First pad the msg a length of 448 bits (mod 512). Original msg is then appended with 64 bit integer; make it a multiple of 512 bits. Initialize 128-bit buffer to a fixed value. Computation step: Take 512 bit block of input, perform 4 round of mixing, thoroughly with 128 bit buffer (with sine function and table look up) Process continues until all input consume. The content of 128-bit buffer form the message digest. You can access it on our CS Unix machines using OpenSSL pacckage openssl md5 For example, the following yield a pretty good random key: bash-2.05a# (date; ps auxg) | openssl md5 7741348ddf1371aefc921d504fa51e6a bash-2.05a# (date; ps auxg) | openssl md5 7c56744bb2440abcc2de7a492ae32d06
cs691
45
chow
SHA-1
Developed by NSA and blessed by NIST in FIP 180-1 It generates 160 bit message digest. Use of SHA-1 and RSA for signing nonsecret messages.
cs691
SHA-1 (2)
(a) A message padded out to a multiple of 512 bits. (b) The output 32 bit variables. (c) The word array.
cs691
47
chow
SHA1
Copy 16 work block input to w0 to w15. Scramble them to w16 to w79 with Wi= S1(Wi-3 XOR Wi-8 XOR Wi-14 XOR Wi-16) (16 <=i<= 79) Sb(W) represent the left circular rotation of 32-bit word W by b bits. Actual step in pseudo-C code: for (i = 0; i < 80; i++) { temp = S5(A) + fi (B, C, D) + E + Wi + Ki; E=D; D=C; C = S30 (B); B=A; A =temp;} f (B, C, D) = (B AND C) OR (NOT B AND D) ( 0<= i <=19) f (B, C, D) = B XOR C XOR D (20 <= i <= 39) f (B, C, D) = (B AND C) OR (B AND D) OR (C AND D) (40 <= i <= 59) f (B, C, D) = B XOR C XOR D (60<= i <= 79) At the end of 80 iterations, A-E added to H0-H4 respectively. Continue the rest of the input blocks. Work ongoing for 256, 384, 512bit hashes.
cs691
48
chow
cs691
49
chow
Official Letter 1
Dear Dean Smith, This [letter I message] is to give my [honest I frank] opinion of Prof. Tom Wilson, who is [a candidate I up] for tenure [now I this year]. I have [known I worked with] Prof. Wilson for [about I almost] six years. He is an [outstanding I excellent] researcher of great [talent I ability] known [worldwide I internationally] for his [brilliant I creative] insights into [many I a wide variety of] [difficult I challenging] problems. He is also a [highly I greatly] [respected I admired] [teacher I educator]. His students give his [classes I courses] [rave I spectacular] reviews. He is [our I the Department's] [most popular I best-loved] [teacher I instructor]. [In addition I Additionally] Prof. Wilson is a [gifted I effective] fund raiser. His [grants I contracts] have brought a [large I substantial] amount of money into [the I our] Department. [This money has I These funds have] [enabled I permitted] us to [pursue I carry out] many [special I important] programs, [such as I for example] your State 2000 program. Without these funds we would [be unable I not be able] to continue this program. which is so [important I essential] to both of us. I strongly urge you to grant him tenure.
cs691
50 chow
Fake Letter
Dear Dean Smith. This [letter I message] is to give my [honest I frank] opinion of Prof. Tom Wilson, who is [a candidate I up] for tenure [now I this year]. I have [known I worked with] Tom for [about I almost] six years. He is a [poor I weak] researcher not well known in his [field I area]. His research [hardly ever I rarely] shows [insight in I understanding of] the [key I major] problems of [the I our] day. Furthermore, he is not a [respected I admired] [teacher I educator]. His students give his [classes I courses] [poor I bad ] reviews. He is [our I the Department's] least popular [teacher I instructor], known [mostly I primarily] within [the I our] Department for his [tendency I propensity] to [ridicule I embarrass] students [foolish I imprudent] enough to ask questions in his classes. [In addition I Additionally] Tom is a [poor I marginal] fund raiser. His [grants I contracts] have brought only a [meager I insignificant] amount of money into [the I our] Department. Unless new [money is I funds are] quickly located, we may have to cancel some essential programs, such as your State 2000 program. Unfortunately, under these [conditions I circumstances] I cannot in good [conscience I faith] recommend him to you for [tenure I a permanent position].
cs691
51
chow
Now Ellen programs her computer to compute the 232 message digests of each letter overnight. Chances are. one digest of the first letter will match one digest of the second letter. If not. she can add a few more options and try again during the weekend. Suppose that she finds a match. Call the "good" letter A and the "bad" one B. Ellen now e-mails letter A to Marilyn for her approval. Letter B she keeps completely secret, showing it to no one. Marilyn, of course. approves, computes her 64-bit message digest. signs the digest. and e-mails the signed digest off to Dean Smith. Independently, Ellen e-mails letter B to the Dean (not letter A, as she is supposed to). After getting the letter and signed message digest. the Dean runs the message digest algorithm on letter B, sees that it agrees with what Marilyn sent him, and fires Tom. The Dean does not realize that Ellen managed to generate two letters with the same message digest and sent her a different one than Marilyn saw and approved. (Optional ending: Ellen tells Dick what she did. Dick is appalled and breaks off with her. Ellen is furious and confesses to Marilyn. Marilyn calls the Dean. Tom gets tenure after all.) With MD5 the birthday attack is difficult because even at 1 billion digests per second, it would take over 500 years to compute all 264 digests of two letters with 64 variants each, and even then a match is not guaranteed. Of course, with 5000 computers working in parallel, 500 years becomes 5 weeks. SHA-1 is better (because it is longer).
cs691
52
chow
Key Infrastructures
cs691
53
chow
cs691
54
chow
Certificates
cs691
55
chow
X.509
cs691
56
chow
Public-Key Infrastructures
cs691
57
chow
Communication Security
IPsec
Firewalls Virtual
cs691
58
chow
IPsec
cs691
59
chow
IPsec (2)
cs691
60
chow
Firewalls
cs691
61
chow
cs691
62
chow
802.11 Security
cs691
63
chow
Authentication Protocols
Authentication Based on a Shared Secret Key Establishing a Shared Key: Diffie-Hellman Authentication Using a Key Distribution Center Authentication Using Kerberos Authentication Using Public-Key Cryptography
cs691
64 chow
cs691
66
chow
cs691
67
chow
cs691
68
chow
cs691
69
chow
cs691
70
chow
cs691
71
chow
cs691
72
chow
cs691
73
chow
cs691
74
chow
cs691
75
chow
cs691
76
chow
E-Mail Security Pretty Good Privacy PEM Privacy Enhanced Mail S/MIME
PGP
cs691
77
chow
cs691
78
chow
A PGP message.
cs691
79
chow
Web Security
Threats Secure
cs691
80
chow
Secure Naming
(a) Normal situation. (b) An attack based on breaking into DNS and modifying Bob's record.
cs691
81
chow
cs691
82
chow
Secure DNS
An example RRSet for bob.com. The KEY record is Bob's public key. The SIG record is the top-level com server's signed has of the A and KEY records to verify their authenticity.
cs691
83
chow
Self-Certifying Names
cs691
cs691
85
chow
SSL (2)
cs691
86
chow
SSL (3)
cs691
87
chow
Applets inserted into a Java Virtual Machine interpreter inside the browser.
cs691
88
chow
Social Issues
cs691
89
chow
Anonymous Remailers
Users who wish anonymity chain requests through multiple anonymous remailers.
cs691
90
chow
Freedom of Speech
1.
2.
3. 4. 5.
Possibly banned material: Material inappropriate for children or teenagers. Hate aimed at various ethnic, religious, sexual, or other groups. Information about democracy and democratic values. Accounts of historical events contradicting the government's version. Manuals for picking locks, building weapons, encrypting messages, etc.
cs691
91 chow
Steganography
(a) Three zebras and a tree. (b) Three zebras, a tree, and the complete text of five plays by William Shakespeare.
cs691
92
chow