CS682– AdvancedSecurityTopics

Lecture2AppliedCryptography

EliasAthanasopouloseliasathan@cs.ucy.ac.cy

2

TheNeedforCryptography

• Peoplehadalwayssecrets• Ordinaryapplicationsarebasedonsecrecy– e.g.,elections(ore-voting)

• Machinesneedtoverifyinformation– detecterrors

• Unforgeableinformation– ordinarysignaturesvsdigitalsignatures

• Manynewapplications– Fromcarkeystosmartcards,andcellphones

3

CryptoRoadmap

• BasicConcepts• SymmetricCiphers• AsymmetricCiphers• CryptographicHashFunctions• DigitalSignatures• RandomNumbers

4

BasicConcepts

5

CryptoSystemPlainText CipherText

Secret

Secret

PublicPublic

SecurityviaObscurity

• Allcryptoalgorithmsareassumedtobeknown

• Securityisbasedon– Secrecyofthekey– Hardtoinfertheplaintextviatheciphertext

• Cryptanalysis– Infertheplaintextfromciphertext withoutknowingthekey

6

SimpleExample

7

Xà X+key(i.e.,‘a’becomes‘d’)

a simplemessage

dcwlpsohcphwwdjh

3

InventedbyJuliusCaesar!

C=P+Kmod26

(assuminganalphabetof26letters!)

Monoalphabetic ciphers

• Assumeanalphabet– abcdefghijklmnopqrstuvwxyz_

• Indextheletters– a is1,b is2,c is3,…,z is26,_ is27

• Selectakey(secret),whichshifts theorder– Assumingthekeyis3,thena isshiftedthreelettersandbecomesd,andz becomesb (wrapsaroundthealphabet)

8

MultipleandRunningKeys

• Vigenere Cipher– PolyalphabeticSubstitutionCiphers

9

Key = r, u, n (three Caesar’s keys)

tobeornottobethatisthequestionrunrunrunrunrunrunrunrunrunrunKIOVIEEIGKIOVNURNVJNUVKHVMGZIA

SecureEnough?

• Vigenere Cipher– PolyalphabeticSubstitutionCiphers

10

Key = r, u, n (three Caesar’s keys)

tobeornottobethatisthequestionrunrunrunrunrunrunrunrunrunrunKIOVIEEIGKIOVNURNVJNUVKHVMGZIA

FrequencyAnalysis

11

Attheciphertext:

FrequencyAnalysis

12

Englishtext:

Example

13

Repeat

14

One-TimePad

• PushingVigenere totheextreme!– Sizeofkeyissizeofplaintext– Avoidrepeatedpatterns

15

Plain: helpsnowdenKey: jitwojsktuwCipher: qmelgwggwyj

One-TimePad

16

Plain: helpsnowdenKey: jitwojsktuwCipher: qmelgwggwyj

Cipher: qmelgwggwyjKey: kejhopsktuwPlain: givesnowden

Key: jitwojsktuwCipher: pqoagwggwyjPlain: givesnowden

KeyIntegrity

MessageIntegrity

One-TimePad

• PushingVigenere totheextreme!– Sizeofkeyissizeofplaintext– Avoidrepeatedpatterns

17

Plain: heilhitlerKey: wclnbtdefjCipher:DGTYIBWPJA

One-TimePad

18

Plain: heilhitlerKey: wclnbtdefjCipher:DGTYIBWPJA

Cipher:DGTYIBWPJAKey: wggsbtdefjPlain: hanghitler

Cipher:DCYTIBWPJAKey: wclnbtdefjPlain: hanghitler

KeyIntegrityMessageIntegrity

One-timePad

• Pros– PerfectSecrecy

• Cons– Impracticallongkey– Keyintegrity, givenacipheryoucanselectanotherkeythatproducesadifferentvalidplaintext

–MessageIntegrity,givenakeyyoucanselectaciphertextthatproducesthedesiredplaintext

19

BlockCiphers

• Sofar,we:– Treatthemessageasone-dimensionstream– Useonlysubstitution–Wejustshift letters(i.e.,C=P+Kmod26)

• BlockCiphers– Splitmessagetoequallysizedblocks– Encrypteachblock

20

Playfair (rule1)

P A L M E

R S T O N

B C D F G

H I K Q U

V W X Y Z

21

Iftwolettersareinthesamerow(orcolumn)theyarereplacedbythesucceeding

letters:am becomesLE

Playfair (rule2)

P A L M E

R S T O N

B C D F G

H I K Q U

V W X Y Z

22

Otherwisethetwolettersstandattwoofthecornersoftherectangleinthetable,andwereplacethemwiththelettersat

theothertwocornersofthisrectangle:lo becomesMT

Playfair Algorithm

• Replaceallj withi inplaintext• Splitplaintextintwo-letterblocks• Doublelettersareseparatedbyx• z isused(conditionally)forpadding• ApplyRule1and2

23

Example

Lord Granville

lo rd gr an vi lx le sl et te rz

MT TB BN ES WH TL MR TA LN NL NV

24

SYMMETRICCIPHERS

25

26

HillCipher

• Eachletterisinterpretedasanumber(0-25)• Messageiswrittenasamatrix– CATbecomes:

• Forencryption– C=KM–M =K-1 C

27

2

M = 0

19

Transposition

• Producesanewpermutation ofthemessage• Doesnotchangethestatisticsofthemessage• Easiestwaytoimplementitisbymatrixmultiplication

28

Transposition

• Initialorder:[1,2,3,4,5]• Ifyouwanttoproduce[3,1,2,5,4]youneedtomultiplyitusing

29

0 1 0 0 0

0 0 1 0 0

1 0 0 0 0

0 0 0 0 1

0 0 0 1 0

BasicOperations

• Substitution(αντικατάσταση)– Changesthestatisticsofthemessagebysubstitutingletterswithotherletters

• Transposition (μετάθεση)– Reordersthelettersofthemessage

• Botharelinearoperations(reversible)

30

SymmetricCiphers

• Relativelyfast• Onekeyencryptsanddecrypts• Block-basedorStream-based• Severalrounds– SubstitutionsandTranspositions– Notonletters,butonbits(orbytes)

• Majorweakness– Keydistribution

31

PlainText

32

SymmetricCryptographicEncryption

PlainText CipherText

SymmetricCryptographicDecryption

CipherText

ModernSymmetricCiphers

• DES,3DES,andAES– AESisthedominantone,today

• Basedon– Substitutionsandtranspositions

• Verycomplex• Type– Block– Stream

33

BlockvsStream

• Blockcipher– A blockofplaintextistreatedasawholeandusedtoproduceablockofciphertext ofequallength

– Typically,ablocksizeof64or128bitsisused• Streamcipher– Plaintextistreatedasadatastream andonebitoronebyteisprocessedatatime

34

Blockcipher

• Plaintextof n bitsproducesaciphertext ofnbits– Blocksize:nbits

• Spaceofdifferentplaintextblocks:2^n– Eachblockmustbeunique

35

Reversibility

36

REVERSIBLEMAPPING IRREVERSIBLEMAPPING

Plaintext Ciphertext Plaintext Ciphertext

00 11 00 11

01 10 01 10

10 00 10 01

11 01 11 01

IdealSubstitutionCipher

37

Mapping:key4bitsx16rows

=64bits!

Problems

• Vulnerabletostatisticalattacks– Smallblockscantakelimitedtransformations– Largeblocks(increasen)areimpractical

• Keysize:4bitsx16rows– Ingeneral:nx2n

– Approximatetheidealcase– Example:64-bitblockrequiresakeyof64x264=1021bits(!!)

38

PracticalCiphers• Goal– Approximatetheidealcipher– Reducestatisticalpropertiesbetweenplaintext,ciphertext,andkey(s)

• CombiningSubstitutionsandTranspositions– Substitution:Eachplaintextelementorgroupofelementsisuniquelyreplacedbyacorrespondingciphertextelementorgroupofelements

– Transposition:Asequenceofplaintextelementsisreplacedbyapermutationofthatsequence;noelementsareaddedordeletedorreplacedinthesequence,rathertheorderinwhichtheelementsappearinthesequenceischanged

39

40

41

InformationTheoryApproach

• Confusion– Obscurestherelationshipbetweentheplaintextandtheciphertext

– Theeasiestwaytodothisisthroughsubstitution• Diffusion– Reducesrepeatedplaintextpatternsbyspreadingouttheplaintextovertheciphertext

– Theeasiestwaytodothisisthroughtransposition

42

RealizingSubstitution(S-box)

• Mapping6bitsofinputto4bits(takenfromDES)

• Example:011011

43

S-boxMiddle 4 bits of input

0000 0001 0010 0011 0100 0101 0110 0111 1000 1001 1010 1011 1100 1101 1110 1111

Outer bits

00 0010 1100 0100 0001 0111 1010 1011 0110 1000 0101 0011 1111 1101 0000 1110 1001

01 1110 1011 0010 1100 0100 0111 1101 0001 0101 0000 1111 1010 0011 1001 1000 0110

10 0100 0010 0001 1011 1010 1101 0111 1000 1111 1001 1100 0101 0110 0011 0000 1110

11 1011 1000 1100 0111 0001 1110 0010 1101 0110 1111 0000 1001 1010 0100 0101 0011

SuperComplicated!

44

http://www.moserware.com/2009/09/stick-figure-guide-to-advanced.html

Properties

• Blocksize:– Largerblocksizesmeangreatersecuritybutreducedencryption/decryptionspeedforagivenalgorithm

– Ablocksizeof64bitsisreasonabletradeoff– AESusesa128-bitblocksize

• Keysize:– Largerkeysizemeansgreatersecuritybutmaydecreaseencryption/decryptionspeed

– Keysizesof64bitsorlessarenowwidelyconsideredtobeinadequate,and128bitshasbecomeacommonsize

45

Properties

• Numberofrounds:– Severalroundsareinvolved– Atypicalsizeis16rounds

• Subkey generationalgorithm:– Greatercomplexityinthisalgorithmshouldleadtogreaterdifficultyofcryptanalysis

46

Extra(desired)properties

• Fastsoftwareencryption/decryption:– Inmanycases,encryptionisembeddedinapplicationsorutilityfunctionsinsuchawayastoprecludeahardwareimplementation

• Easeofanalysis:– Thereisgreatbenefitinmakingthealgorithmeasytoanalyze

– Itiseasiertoanalyzethatalgorithmforcryptanalyticvulnerabilitiesandthereforedevelopahigherlevelofassuranceastoitsstrength

– DES,forexample,doesnothaveaneasilyanalyzedfunctionality

47

Blockmodes

48

Mode Description TypicalApplication

ElectronicCodebook(ECB) Eachblockof64plaintextbitsisencodedindependentlyusingthesamekey.

•Securetransmissionofsinglevalues(e.g.,anencryptionkey)

CipherBlockChaining(CBC)

TheinputtotheencryptionalgorithmistheXORofthenext64bitsofplaintextandthepreceding64bitsofciphertext.

•General-purposeblock-orientedtransmission•Authentication

Andsomemore:PCBC,CFB,OFB,CTR

Blockmodeisimportant

49

Original ECBencryption Non-ECBencryption

AdvancedEncryptionStandard(AES)

• SubsetofRijndael– Developedin1998bytwoBelgiancryptographers,JoanDaemen andVincentRijmen

• MostwidelyusedSymmetricCiphertoday• BlockSize– 128bits

• Keysize– 128,192,or256bits

50

AdvancedEncryptionStandard(AES)• 10rounds• Roundtypes– SubBytes,anS-boxsubstitutionstep– ShiftRows,apermutationstep–MixColumns,amatrixmultiplication(likeHillcipher)

– AddRoundKey,aXOR-basedoperationthatproducesanewkeybasedontheinitialone

51

AESS-box:-)

52

00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f

00 63 7c 77 7b f2 6b 6f c5 30 01 67 2b fe d7 ab 76

10 ca 82 c9 7d fa 59 47 f0 ad d4 a2 af 9c a4 72 c0

20 b7 fd 93 26 36 3f f7 cc 34 a5 e5 f1 71 d8 31 15

30 04 c7 23 c3 18 96 05 9a 07 12 80 e2 eb 27 b2 75

40 09 83 2c 1a 1b 6e 5a a0 52 3b d6 b3 29 e3 2f 84

50 53 d1 00 ed 20 fc b1 5b 6a cb be 39 4a 4c 58 cf

60 d0 ef aa fb 43 4d 33 85 45 f9 02 7f 50 3c 9f a8

70 51 a3 40 8f 92 9d 38 f5 bc b6 da 21 10 ff f3 d2

80 cd 0c 13 ec 5f 97 44 17 c4 a7 7e 3d 64 5d 19 73

90 60 81 4f dc 22 2a 90 88 46 ee b8 14 de 5e 0b db

a0 e0 32 3a 0a 49 06 24 5c c2 d3 ac 62 91 95 e4 79

b0 e7 c8 37 6d 8d d5 4e a9 6c 56 f4 ea 65 7a ae 08

c0 ba 78 25 2e 1c a6 b4 c6 e8 dd 74 1f 4b bd 8b 8a

d0 70 3e b5 66 48 03 f6 0e 61 35 57 b9 86 c1 1d 9e

e0 e1 f8 98 11 69 d9 8e 94 9b 1e 87 e9 ce 55 28 df

f0 8c a1 89 0d bf e6 42 68 41 99 2d 0f b0 54 bb 16

Thecolumnisdeterminedbytheleastsignificant 4bits,andtherowisdeterminedbytheotherhalf(0x9a becomes0xb8)

OpenSSL

• OpenSSL isanOpenSourcelibraryforcryptographicoperations

• WritteninC,availableinmanylanguages– Java,Python,Ruby,etc.

53

STREAMCIPHERS

54

Theneedforrandomness

• Replayattacks– Addingarandomsecret(nonce)helpsagainstattackersthatreplay encryptedmessages

• Sessionkeygeneration– Sessionkeysarecryptographickeysthathaveashortlife

• GenerationofkeysfortheRSApublic-keyencryptionalgorithm– RSAisbasedonselectinglargeprimenumbersrandomly

• Streamciphers– Theirsecurityisentirelybasedonrandomness

55

Randomness

• Uniformdistribution– Thedistributionofbitsinthesequenceshouldbeuniform

– Thefrequencyofoccurrenceofonesandzerosshouldbeapproximatelyequal

• Independence– Nosubsequenceinthesequencecanbeinferredfromtheothers

• Securityrequirement– Unpredictability

56

RandomGeneratorTypes

• TrueRandomNumberGenerators(TRNGs)• Pseudo-randomNumberGenerators(PRNGs)

57

Converttobits Algorithm

Sourceoftruerandomness

Seed

Randombits Pseudo-randombits

TRNGs

58

PRNGs

r = f(seed);

59

Requirements• Uniformity– Occurrenceofazerooroneisequallylikely– Theexpectednumberofzeros(orones)isn/2,wheren=thesequencelength

• Scalability– Anytestapplicabletoasequencecanalsobeappliedtosubsequencesextractedatrandom

– Ifasequenceisrandom,thenanysuchextractedsubsequenceshouldalsoberandom

• Consistency– Thebehaviorofageneratormustbeconsistentacrossstartingvalues(seeds)

60

Tests• Frequencytest– Determinewhetherthenumberofonesandzerosinasequenceisapproximatelythesameaswouldbeexpectedforatrulyrandomsequence

• Runs test– Determinewhetherthenumberofrunsofonesandzerosofvariouslengthsisasexpected forarandomsequence

• Maurer’suniversalstatisticaltest– Detectwhetherornotthesequencecanbesignificantlycompressedwithoutlossofinformation

– Asignificantlycompressiblesequenceisconsideredtobenon-random

61

Unpredictability

• Forwardunpredictability– Iftheseedisunknown,thenextoutputbitinthesequenceshouldbeunpredictableinspiteofanyknowledgeofpreviousbitsinthesequence

• Backward unpredictability– Itshouldalsonotbefeasibletodeterminetheseedfromknowledgeofanygeneratedvalues

– Nocorrelationbetweenaseedandanyvaluegeneratedfromthatseedshouldbeevident

– Eachelementofthesequenceshouldappeartobetheoutcomeofanindependentrandomeventwhoseprobabilityis1/2

62

Seed

63

Converttobits

Algorithm

Sourceoftruerandomness

Seed

Pseudo-randombits

CryptographicPRNGs

• Existingcryptographicalgorithms– Streamciphers– Asymmetricciphers(RSA,computeprimes)

• Hashfunctions• MessageAuthenticationCodes(MACs)

64

Xn+1=(aXn+c) mod m

• X0 istheseed (assumeX0=1)• Selection ofa,c,andm,iscritical– a=7, c=0, m=32• 7, 17, 23, 1, 7, ...

– a=5• 5, 25, 29, 17, 21, 9, 13, 1, 5, ...

• Intheorym should be very large(2^31)

65

StreamCiphers

66

⊕11001100 plaintext

01101100 key stream

10100000 ciphertext

67

Pseudo-randomByteGenerator(keystream)

Key/Seed

Pseudo-randomByteGenerator(keystream)

⊕ ⊕plaintextstream ciphertext stream plaintextstream

Encryption Decryption

Key/Seed

RC4

• DesignedbyRonRivest in1987• UsedtodayinTLS– TLSistheciphersuitebehindHTTPS

• UsedinWEP– Gotbroken

• ThereareconcernsaboutthesecurityofRC4• Basedonrandompermutations• Periodisbelievedtobegreaterthan10100• 8to16machineoperationsarerequiredperbyteoftheciphertext

68

RC4– Initialization

/* Initialization */ for i = 0 to 255 do S[i] = i;T[i] = K[i mod keylen];

/* Initial Permutation of S */ j = 0;for i = 0 to 255 do j = (j + S[i] + T[i]) mod 256; Swap (S[i], S[j]);

69

RC4– StreamGeneration

i, j = 0;while (true)

i = (i + 1) mod 256;j = (j + S[i]) mod 256; Swap (S[i], S[j]);t = (S[i] + S[j]) mod 256; k = S[t];

70

Encryption:XORthenextbyteofplaintextwithkDecryption:XORthenextbyteofciphertext withk

RC4

71

RC4

72

/* Initialization */ for i = 0 to 255 do S[i] = i;T[i] = K[i mod keylen];

RC4

73

/* Initialization */ for i = 0 to 255 do S[i] = i;T[i] = K[i mod keylen];

/* Initial Permutation of S */ j = 0;for i = 0 to 255 do j = (j + S[i] + T[i]) mod 256;

Swap (S[i], S[j]);

RC4

74

/* Initialization */ for i = 0 to 255 do S[i] = i;T[i] = K[i mod keylen];

/* Initial Permutation of S */ j = 0;for i = 0 to 255 do j = (j + S[i] + T[i]) mod 256;

Swap (S[i], S[j]);

/* Stream Generation */ i, j = 0;while (true) i = (i + 1) mod 256;j = (j + S[i]) mod 256; Swap (S[i], S[j]);t = (S[i] + S[j]) mod 256; k = S[t];

AdditionalReading

OntheSecurityofRC4inTLS. NadhemAlFardan, etal. InUsenix Security2013.https://www.usenix.org/conference/usenixsecurity13/technical-sessions/paper/alFardan

75

BlockciphertoStreamcipher• Cipher-feedbackmode(CFB)– Ci =EK (Ci-1)⊕ Bi– Theencryptionofablock,Ci,istheencryptionofthepreviousblock,Ci-1,XORed withthecurrentplaintextblock,Bi

• Reducingtheblocksize– 1byte(orless)– Blockcipherbehaveslikeastreamcipher– Highoverhead

76

CryptographicAttacks• Ciphertext-only– Attackerhasaccesstociphertext ofoneormoremessages,encryptedallwiththesamekey

• Known-plaintext– Attackerhasaccesstooneormoreplaintext-ciphertextpairs,encryptedallwiththesamekey

• Chosen-plaintext– Attackercanchoseoneormoreplaintextmessagesandreceivetheirciphertext (eitheroff-lineoron-line)

• Chosen-ciphertext– Attackercanchoseoneormorechiphertext messagesandreceivetheirplaintext(eitheroff-lineoron-line)

77

ASYMMETRICENCRYPTION

78

ModularArithmetic

(10+13)mod12=23mod12=11mod12

Or,wecouldsay:11and23areequivalent,modulo12

Anotherwaytowritethis:10+13≡11(mod12)

79

ModularArithmetic

a ≡b (modn)ifa=b+kn,forsomeintegerk

Fortheexample:23≡11(mod12),since23=11+12,k=1

Anotherexample:82 ≡ 2(mod20),since82=2+4·20,k=4

80

ModularInverse

• Themultiplicativeinverseof4is1/4,since4·1/4=1• Inmodulararithmetic

4 ·x≡1(mod7),translatesto4·x=7·k+1,wherebothxandkareintegers

• Generalform1=(a ·x)modna-1 ≡x(modn)

• Notalwayssolvable– Theinverseof5,modulo14,is3– 2hasnoinversemodulo14

81

Primenumber

• Anintegerp >1isaprimenumberifandonlyifitsonlydivisorsare:1,p (and–p)

• Noothernumberevenlydividesit• Primes– 5,7,13,19,2521

• Nonprimes– 4,8,39,125

82

Relativeprimes(co-primes)• Twonumbersarerelativeprimewhentheysharenofactorsincommonotherthan1

• 15and28arerelativeprimes• 15and27arenotrelativeprimes• 13and500arerelativeprimes

83

Euler’sTotientFunction,φ(n)

• φ(n) isthenumberofpositivesintegerslessthannthatarerelativeprimeton

• φ(1)is1,bydefinition• Ifn=pq,wherep andqareprimes– φ(n)=(p-1)(q-1)– Superimportant!

84

Recipe1/3

• Supposeyouwanttoencryptthemessage:2– Let’ssaythatAmapsto0,Bmapsto1,andCmapsto2;youwanttomapCtoanotherletter

• Picktwoprimenumbers– p =2andq=7

• Multiplythem– n=pq =2·7=14

85

Recipe2/3

• Calculateφ(n),or φ(14)– φ(n)=(p-1)(q-1)=(2-1)(7-1)=6

• Pickanumberthatisrelativeprimeto6andsmallerthan6– e=5

• Solvetheequationx ·5≡1(mod6)– Findanintegerxthatifmultipliedwith5theresultis1mod6

– x=11,because55mod6=1mod6– let’scallthatd=11

86

Recipe3/3

• Forencryption25 mod14=32mod14=4(so2becomes4)

• Fordecryption– 411 mod14=4194304mod14=2

87

Whatdidjusthappen?

• Weencrypted2to4• Wedecrypted4backto2• Nosubstitution• Notransposition• Nosinglekey

88

RSA

89

Properties

• 2keys– PublicKey(nosecrecy)– PrivateKey(ifstoleneverythingislost)

• Easyalgorithm,buthard toreverse– Computationallyhardtoinferp andq fromn=pq– Computationallyhardmeanssolvableinnon-polynomialtime

90

RSA

• Encryption– C=Me modn

• Decryption–M=Cd modn=(Me modn)d=Med modn

• Keys– PublicKey ={e,n}– PrivateKey ={d,n}– ed ≡1modφ(n)

91

RSASteps• p,q,twoprimenumbers

– Private• n =pq

– n canbepublic,butrecallthatitishard toinferp andqbyjustknowingn

• e isrelativeprimetoφ(n)– Public– Recallφ(n)=(p-1)(q-1)

• dfrome,andφ(n)– Private

• ed ≡1modφ(n)– Canbecomputedsinceweknowp andq

92

RSAexample

1. Select p =17andq =112. Then, n =pq =17·11=1873. φ(n) = (p-1)(q-1) = 16·10 = 1604. Select e relativelyprimetoφ(n)=160and

lessthanφ(n); e =75. Determine d

- de ≡ 1(mod160) and d <160,- d =23,because23·7=161=(1·160)+1;

93

ComputationalAspects

• RSAbuildsonexponents• Intensiveoperation• Side channels

94

CRYPTOGRAPHYANDAPPLICATIONS

95

96

97

p(bigrandomprime)

q(bigrandomprime)

n=p· qcomputingpandqfromn requiressuper-polynomialtime inthenumberofdigits

Compute φ(n),φ(n)=(p-1)(q-1)onlyifncanbeexpressedasn=p· q,

wherepandqareprimes

Selecte whichisrelativeprimeto(p-1)(q-1)

Selectd fromd ·e≡1mod(p-1)(q-1)

PrivateKey{e,n}

PublicKey{d,n}

Bothkeys{e,n} and{d,n} areequivalent,anyofthemcanbeusedastheprivatekeyandtheotheroneasthepublickey

PlainText

RecallSymmetricCiphers

98

SymmetricCipher(Encryption)

PlainText CipherText

SymmetricCipher(Decryption)

CipherText

PlainText

AsymmetricEncryptionMode1

99

AsymmetricCipherPlainText CipherText

AsymmetricCipherCipherText

PublicKey

PrivateKey

PlainText

AsymmetricEncryptionMode2

100

AsymmetricCipherPlainText CipherText

AsymmetricCipherCipherText

PrivateKey

PublicKey

PlainText

RSA

101

(plaintext)e modnPlainText CipherText

(ciphertext)d modnCipherText

e,n

d,n

AsymmetricCiphers

• RSA– primefactorization

• ElGamal– Computingdiscretelogarithms

• Ellipticcurves–Morecomplicated,butsmallerkeysizes

102

CryptographicHashFunctions

103

message1(Nbits)

message2(Nbits)

HashValueA(256bits)

CryptographicHashFunction

HashValueB(256bits)

CryptographicHashFunction

Ideally:Ifmessage1andmessage2differbyonebit,thenAandBdifferin50%oftheirbits

High-levelProperties

• Complicatedone-wayfunctions• One-way– Hardtocomputethemessagebyhavingjustthehashvalue(ordigest)

– Nocryptographickeys– Shouldnotbeconfusedwithinvertiblefunctions(1-1)

• Collision– FindamessagethatcryptographicallyhashestoagivendigestH

104

Requirements

Requirement Description

Variableinputsize Hcanbeappliedtoablockofdataofanysize

Fixedoutput size Hproduces fixed-lengthoutput(calledhashvalue ormessagedigest)

Efficiency H(x)isrelatively easytocomputeforanygivenx(intermsofbothsoftware/hardwareimplementations)

Preimage resistant(one-wayproperty) Foranygivenhashvalueh, itiscomputationallyinfeasibletofindysuchthatH(y)=h

Second preimageresistant(weakcollisionresistant) For anygivenblockx,itiscomputationallyinfeasibletofindy<>xwithH(y)=H(x)

Collisionresistant (strongcollisionresistant) Itiscomputationallyinfeasible tofindanypair(x,y)suchthatH(x)=H(y)

Pseudorandomness OutputofHmeetsstandard testsforpseudorandomness

105

Lifetimesofcryptographichashfunctions

106

More:http://valerieaurora.org/hash.html

SHA256isconsideredcurrentlysafe

ModernApplications

• Ciphersuites– TransportLayerSecurity(TLS),encryptedsockets

• SymmetricKeydistribution• DigitalSignatures• Passwords

107

SymmetricKey

SymmetricKeyDistribution

108

(symmetrickey)dmodn

SymmetricKey CipherText

(symmetrickey)emodn

CipherText

d,n(publickey)

e,n

Theneedforsignatures

• Confidentialityisnotalwaysthekeyrequirementforcryptography

• Communicationbetweenuntrustedparties– BobmayforgeamessageandclaimthatitcamefromAlice

– Bobcandenysendingamessage

• Example– Anelectronicfundstransfertakesplace,andthereceiverincreasestheamountoffundstransferred

109

Requirements• Thesignaturemustbeabitpatternthatdependsonthe

messagetobesigned• Thesignaturemustusesomeinformationuniquetothe

sender,topreventbothforgeryanddenial• Itmustberelativelyeasytoproducethedigitalsignature• Itmustberelativelyeasytorecognizeandverifythedigital

signature• Itmustbecomputationallyinfeasibletoforgeadigital

signature,eitherbyconstructinganewmessageforanexistingdigitalsignatureorbyconstructingafraudulentdigitalsignatureforagivenmessage

• Itmustbepracticaltoretainacopyofthedigitalsignatureinstorage

110

DigitalSigning

111

Document(ArbitrarySize)

CryptographicHashKey(FixedSize)

MessageSignature

Public-KeyCryptography

(RSA)PrivateKey

SignedDocument

(ArbitrarySize+signature)

MessageSignature

VerifyingDigitalSignatures

112

Document(ArbitrarySize+signature) MessageSignature

DocumentHashKey

Public-KeyCryptography

(RSA)PublicKey

MessageSignature

Document(ArbitrarySize+signature)

DocumentHashKey

CryptographicHashFunction

Passwords

• Services– Storecryptographichashesofpasswords– Passwordsinplaintextaredeleted

• Authentication– Servicescheckonlycryptographichashesandnotplaintextpasswords

• Encryptingpasswordsisabadidea– Attackercanleakthekey

• Passwordsaresalted– Identicalplaintextpasswordsproducedifferenthashkeys

113

AttackingPasswords

• Bruteforce• Dictionaryattacks• Rainbowtables– Saltcanmakethisextremelyhard

• GPUs

114

115

116

OriginalFile

EncryptedFile

WannaCryHeader

AttackerRSAPublicKey(fixed),PuK

ComputedRSAPublicKey,Sub-PuK

ComputedRSAPrivateKey,Sub-PrK

ComputedAESKey(perfile),

EncK

1. EncryptfilewithEncK (per-fileencryption)

2. EncryptEncK withSub-PuK andstoreittoWannaCryHeader(per-hostencryption)

3. EncryptSub-PrKwithPuK andsendittoattacker(attackerhasadifferentdecryptionkeyperhost)

Readmore:WannaKey,https://github.com/aguinet/wannakey