Doc.: IEEE 802.11-01/378 Submission July 2001 Phillip RogawaySlide 1 OCB Mode Phillip Rogaway...
-
Upload
melinda-dean -
Category
Documents
-
view
215 -
download
0
Transcript of Doc.: IEEE 802.11-01/378 Submission July 2001 Phillip RogawaySlide 1 OCB Mode Phillip Rogaway...
July 2001
Phillip Rogaway
Slide 1
doc.: IEEE 802.11-01/378
Submission
OCB Mode
Phillip Rogaway
Department of Computer ScienceUC Davis + CMU
[email protected]://www.cs.ucdavis.edu/~rogaway+66 1 530 7620 +1 530 753 0987
802.11 Presentation – Security (TG i) - Portland, Oregon
July 2001
Phillip Rogaway
Slide 2
doc.: IEEE 802.11-01/378
Submission
What am I?• A cryptographer (MIT IBM UCD)• Practice-oriented provable security – 1993 present. Research program jointly envisioned with M. Bellare• Approach applied to many cryptographic problems• Work picked up in various standards & draft standards: (OEAP, DHIES, PSS, PSS-R) by (ANSI, IEEE, ISO, PKCS, SECG)
What am I not ?• An expert in networking• A businessman• An attorney
July 2001
Phillip Rogaway
Slide 3
doc.: IEEE 802.11-01/378
Submission
Two Cryptographic Goals
MM * orinvalid
Adversary
ReceiverSender
C*CNonceKK
Privacy What the Adversary sees tells her nothing of significance about the underlying message M that the Sender sentAuthenticity The Receiver is sure that the string he receives was
sent (in exactly this form) by the Sender
Authenticated Encryption Achieves both privacy and authenticity
July 2001
Phillip Rogaway
Slide 4
doc.: IEEE 802.11-01/378
Submission
• You may or may not care about privacy, but you almost certainly care about authenticity: without it, an adversary can completely disrupt the operation of the network.• The authenticity risk is higher in a wireless environment, as the adversary can easily inject her own packets.• Standard privacy methods do not provide authenticity, and simple ways to modify them (eg, “add redundancy then encrypt”) don't work.
Authenticity is Essential
July 2001
Phillip Rogaway
Slide 5
doc.: IEEE 802.11-01/378
Submission
Generic Composition
MNonce
Kenc
E MIC
Kmic
Tag
C_core
Nonce
Usually called a Message Authentication Code ( MAC )Glue together an Encryption scheme + Message Integrity Code (MIC)
Traditional approach to authenticated encryption
Folklore approach. See [Bellare, Namprempre]
and [Krawczyk]for analysis.
July 2001
Phillip Rogaway
Slide 6
doc.: IEEE 802.11-01/378
Submission
Generically Compose What?
EncryptionMIC
RC4 CBC-AES
CTR-AES
CBCMAC-AES A new MMH- orNMH- based MICUMAC-AES
July 2001
Phillip Rogaway
Slide 7
doc.: IEEE 802.11-01/378
Submission
Characteristics of these Algorithms
RC4 + Good SW speed (on a reliable transport). Existing HW support - PRG: Applicable only over a reliable transport (how is this in WAP?) Serious attacks by [Fluhrer, McGrew], [Mantin, Shamir], [Fluhrer, Mantin, Shamir]
CBC-AES , CTR-AES + Well-known modes. Provable security (if careful) - Possible concern about the newness of AES. Often misused
CBCMAC-AES + Well-known mode. Provable security. OK in SW/HW - Same speed as CBC-AES, CTR-AES. Often misused.
UMAC-AES + Amazing SW speed on SIMD processors- Complex. Bad for dedicated HW. Slow key setup Several parameters. Proof of final version unpublished
new MMH/NMH MIC + Good SW speed. Simpler than UMAC possible
- Slow key setup. Major design undertaking
July 2001
Phillip Rogaway
Slide 8
doc.: IEEE 802.11-01/378
Submission
Generic Composition: Conclusion
At this point in time, in this application domain,CBC-AES / CTR-AES + CBCMAC-AES
is the natural approach for generic composition
Cost of the above, in SW
P3: about: 16 cpb + 16 cpb = 32 cpb Eg: 54 Mb/s, 1GHz processor 22 % of processor
People hate paying 2 the cost to encrypt
July 2001
Phillip Rogaway
Slide 9
doc.: IEEE 802.11-01/378
Submission
Trying to do Better• Numerous attempts to make privacy + authenticity cheaper.• One approach: stick with generic composition, but find cheaper privacy algorithm and cheaper authenticity algorithms.• Make authenticity an “incidental” adjunct to privacy within a conventional-looking mode.
• CBC-with-various-checksums (wrong)• PCBC in Kerberos (wrong)• [Gligor, Donescu 99] (wrong)• [Jutla - Aug 00] First correct solution
• Jutla described two modes, IACBC and IAPM.• A lovely start, but major improvements possible.• OCB: IAPM after an enormous amount of “re-engineering” to get more desirable characteristics.
July 2001
Phillip Rogaway
Slide 10
doc.: IEEE 802.11-01/378
Submission
What is OCB?• Authenticated-encryption: privacy + authenticity in one shot• Uses any block cipher (you’d use AES)• Computational cost cost of CBC• Good in SW or HW (since AES is)• Lots of nice characteristics designed in:
• |M| / 128 + 2 block-cipher calls to encrypt M• Uses any nonce (needn’t be unpredictable)• Works on messages of any length• Creates minimum length ciphertext• Uses only a single AES key, each AES keyed with it• Quick key setup – suitable for single-message sessions• Essentially endian-neutral• Fully parallelizable
• Provably secure: if you break OCB-AES you’ve broken AES
July 2001
Phillip Rogaway
Slide 11
doc.: IEEE 802.11-01/378
Submission
Diagram of OCB
Z[1]
Z[1]
Z[2] Z[m-1] Z[-m]
+ Z[2] Z[m-1]
+ + + +
+ + +
Z[m]+
Tag
len Checksum
tchop
M [1] M [2] M [m-1] M [m]
C[1] C[2] C[m-1] C[m]
... AESK
Pad
L(0)+
Nonce
Z[1]Z[2] . . .
AESK AESKAESKAESKAESK
...
...
July 2001
Phillip Rogaway
Slide 12
doc.: IEEE 802.11-01/378
Submission
Pseudocode for OCB-AESalgorithm OCB-Encrypt K (Nonce, M)L(0) = AESK (0)
L(-1) = lsb(L(0))? (L(0) >> 1) Const43 : (L(0) >>1)for i = 1 to 7 do L(i) = msb(L(i-1))? (L(i) << 1) Const87 : (L(i-1) <<1)
Partition M into M[1] ... M[m] // each 128 bits, except M[m] may be shorter
Offset = AESK (Nonce L(0))
for i=1 to m-1 do Offset = Offset L(ntz(i)) C[i] = AESK (M[i] Offset) Offset
Offset = Offset L(ntz(m))Pad = AESK (len(M[m]) Offset L(-1))C[m] = M[m] (first |M[m] | bits of Pad)
Checksum = M[1] ... M[m-1] C[m]0* PadTag = first t bits of AESK(Checksum Offset)
return C[1] ... C[m] || Tag
July 2001
Phillip Rogaway
Slide 13
doc.: IEEE 802.11-01/378
Submission
Why I like OCB
• Ease-of-correct-use. Reasons: all-in-one approach; any type ofnonce; parameterization limited to block cipher and tag length
• Aggressively optimized: optimal in many dimensions: key length, ciphertext length, key setup time, encryption time, decryption time, available parallelism; SW characteristics; HW characteristics; … • Simple but sophisticated• Ideal setting for practice-oriented provable security
July 2001
Phillip Rogaway
Slide 14
doc.: IEEE 802.11-01/378
Submission
More on Provable Security
• Provable security begins with [Goldwasser, Micali 82]. • Despite the name, one doesn’t really prove security• Instead, one gives reductions: theorems of the form If a certain primitive is secure then the scheme based on it is secure For us: If AES is a secure block cipher then OCB-AES is a secure authenticated-encryption scheme Equivalently: If some adversary A does a good job at breaking OCB-AES then some comparably efficient B does a good job to break AES• Actual theorems quantitative: they measure how much security is “lost” across the reduction.
July 2001
Phillip Rogaway
Slide 15
doc.: IEEE 802.11-01/378
Submission
OCB Theorem
Suppose there is an adversary A that breaks the privacy orthe authenticity of OCB-E (where E is an n-bit block cipher) with:
time = t total-number-of-blocks = advantage =
Then there is an adversary B that breaks block cipher E with:
time t number-of-queries advantage – 1.5 2 / 2n
(Informal version)
• Breaking the privacy of OCB-E: The ability to distinguish OCB-E encrypted strings from random strings. .
• Breaking the authenticity of OCB-E: The ability to produce a forged ciphertext.• Breaking the block cipher E: The ability to distinguish EK,EK
-1 from , -1
July 2001
Phillip Rogaway
Slide 16
doc.: IEEE 802.11-01/378
Submission
Assembly SpeedData from Helger Lipmaa www.tcs.hut.fi/~helger [email protected]
OCB 16.9 cpb (271 cycles) CBC 15.9 cpb (255 cycles) CBCMAC 15.5 cpb (248 cycles)
6.5 % slower
The above data is for 1 Kbyte messages. Code is pure Pentium 3 assembly.The block cipher is AES-128. Overhead so small that AES with a C-code CBCwrapper is slightly more expensive that AES with an assembly OCB wrapper.
// Best Pentium AES code known. Helger’s code is for sale, btw.
July 2001
Phillip Rogaway
Slide 17
doc.: IEEE 802.11-01/378
Submission
- H
MA
C-M
D5
(35
.9)
- C
BC
MA
C-A
ES
(18
.1)
-CB
CM
AC
-DE
S (
48.1
)
- H
MA
C-S
HA
1 (
58.6
)
RC
4 (1
2) -
OC
B-A
ES
(22
.7)
-
CB
C-A
ES
(18
.1)
(est
)-
CB
C-A
ES
+C
BC
MA
C-A
ES
(36
.2)
(est
)-
0
10 20 30 40 706050
CB
CM
AC
-DE
S (
48.1
) -
80
On a Pentium Pro 200 with NT 4.0.HMAC, MD5, SHA-1, DES taken
from OpenSSL 0.9.6; AES/OCB fromthe reference code. RC4 figure does
not account for resetting or keyschedule that is a per packet overhead
C-Language SpeedData courtesy of Jesse Walker, Intel
July 2001
Phillip Rogaway
Slide 18
doc.: IEEE 802.11-01/378
Submission
Do I have a Patent?
• Yes, I did file patent applications covering OCB (12 Oct 00, 9 Feb 01)• I will license the resulting patent(s) under fair and reasonable terms• Letter of Assurance provided to the IEEE (3 May 01). If you want something more or different in the letter, just let me know.• My commitment goes well beyond the IEEE policy:
- Public pricing, public license agreement - One-time fee (paid-in-full license) - I’d be happy to provide you a letter to that effect
- I am committed to making this simple and easy for everyone - For further info, see the “Licensing” on the OCB web page
July 2001
Phillip Rogaway
Slide 19
doc.: IEEE 802.11-01/378
Submission
• At present: No. In the future: No way to know.
Do keep in mind the proviso from slide 2:
I’m not a lawyer!
• Jutla / IBM• Has patent filing before me, including IAPM• IAPM does resemble OCB. • But there are major differences which might have made it difficult to make claims for IAPM that read against OCB.• Asked if they have pending claims that would touch on OCB, IBM answers that can not answer such a question.• My conclusion: IBM could come to hold a relevant patent, if their attorneys were lucky or insightful.
Does Any Else Have a Patent
OCB Would Infringe Upon?
July 2001
Phillip Rogaway
Slide 20
doc.: IEEE 802.11-01/378
Submission
Does Anyone Else Have a Patent, cont• Gligor/VDG
• Has patent filings before me and IBM.• [GD, Aug 00] has an authenticated-encryption scheme, XCBC, but it does not resemble OCB.• Subsequent versions incorporated ideas apparently from [J] and me. No reason to suspect that Gligor knew such methods before.• I know of no idea from [GD] that I used in OCB.• My conclusion: I consider it unlikely that Gligor/VDG will come to hold a valid patent that reads against OCB.
• My overall conclusion • A company would be behaving with appropriate diligence to license from me - and no one else - at this time.• The IEEE would be behaving with appropriate diligence to request patent-assurance letters from IBM and VDG, just in case.
July 2001
Phillip Rogaway
Slide 21
doc.: IEEE 802.11-01/378
Submission
Risks People Worry About• Dealing with three parties - This committee: easy, request two more letters. Companies: possibility of future IP claimants not new, not too threatening here.
• Dealing with an individual - But I’m easy to reach, often rational, and obviously not too motivated by $ or I wouldn’t be a university professor!
• Scheme has changed, could change again - Oct 16 snapshot clearly marked “Preliminary”. Actual OCB (Apr 1) has not and will not change. Good schemes last forever.
• Scheme is new, scheme is buggy - Obviated by provable security. Definition certainly OK. Buggy proof? Has gotten a lot of scrutiny, currently getting more.
• Scheme ok but something else goes haywire - Application domain makes very unlikely. OCB easier to correctly use than generic composition.
• First on the block, publicity-attack - If comfortable with correctness, probably not a concern. 802.11 Not trying to innovate, not considering ad hoc methods.
• NIST does something else - I believe that if NIST standardizes an auth enc scheme it will be OCB. But they might do nothing. If you care, mail them: [email protected]
July 2001
Phillip Rogaway
Slide 22
doc.: IEEE 802.11-01/378
Submission
For More Information• OCB web page www.cs.ucdavis.edu/~rogaway Contains a FAQ, papers, reference code, IP letter, …• My email address and phone numbers on cover slide & web page• Upcoming talks: - NIST modes-of-operation workshop (Aug 24, Santa Barbara) - MIT TOC/Security seminar (Oct ??, Cambridge) - ACM CCS conference (Nov 5-8, Philadelphia)• Grab me now or at CRYPTO (Aug 20-23)
Anything Else ???