Post on 08-Feb-2016
description
Lecture 24
Cryptography
CPE 401 / 601Computer Network Systems
slides are modified from Jim Kurose and Keith Ross and Dave Hollinger
Cryptography Encryption
Scramble data so that only someone with a secret can make sense of the data.
Decryption Descrambling encrypted data.
Cryptography 2
The language of cryptography
symmetric key crypto: sender, receiver keys identicalpublic-key crypto: encryption key public, decryption key
secret (private)
plaintext plaintextciphertext
KA
encryptionalgorithm
decryption algorithm
Alice’s encryptionkey
Bob’s decryptionkey
KB
Cryptography 3
Symmetric key cryptographysubstitution cipher: substituting one thing for another
monoalphabetic cipher: substitute one letter for another
plaintext: abcdefghijklmnopqrstuvwxyz
ciphertext: mnbvcxzasdfghjklpoiuytrewq
Plaintext: bob. i love you. aliceciphertext: nkn. s gktc wky. mgsbc
E.g.:
Q: How hard to break this simple cipher? brute force? other?
Cryptography 4
Symmetric key cryptography
symmetric key crypto: Bob and Alice share know same (symmetric) key: K
e.g., key is knowing substitution pattern in mono alphabetic substitution cipher
Q: how do Bob and Alice agree on key value?
plaintextciphertext
KA-B
encryptionalgorithm
decryption algorithm
A-B
KA-B
plaintextmessage, m K (m)A-B K (m)A-Bm = K ( ) A-B
Cryptography 5
DES: Data Encryption Standard US encryption standard [NIST 1993] 56-bit symmetric key, 64-bit plaintext input
How secure is DES? DES Challenge: 56-bit-key-encrypted phrase
“Strong cryptography makes the world a safer place” decrypted (brute force) in 4 months
no known “backdoor” decryption approach
making DES more secure: use three keys sequentially (3-DES) on each datum use cipher-block chaining
Cryptography 6
DES
initial permutation 16 identical “rounds” of
function application, each using different 48 bits of key
final permutation
DES operation
Cryptography 7
AES: Advanced Encryption Standard symmetric-key NIST standard
replacing DES Nov 2001
processes data in 128 bit blocks 128, 192, or 256 bit keys
brute force decryption (try each key) taking 1 sec on DES, takes 149 trillion years for AES
Cryptography 8
Block Cipher64-bit input
T1
8bits
8 bits
8bits
8 bits
8bits
8 bits
8bits
8 bits
8bits
8 bits
8bits
8 bits
8bits
8 bits
8bits
8 bits
64-bit scrambler
64-bit output
loop for n rounds T2 T3 T4 T6T5 T7 T8
one pass through: input bit affects eight output bits
multiple passes: each input bit afects all output bits
block ciphers: DES, 3DES, AES Cryptography 9
public key cryptography radically different approach
Diffie-Hellman76, RSA78 sender, receiver do not share secret key public encryption key known to all private decryption key known only to
receiver
Public key cryptographysymmetric key crypto requires sender, receiver know shared secret key Q: how to agree on key in first place
particularly if never “met”?
Cryptography 10
Public key cryptography
plaintextmessage, m
ciphertextencryptionalgorithm
decryption algorithm
Bob’s public key
plaintextmessageK (m)B
+
K B+
Bob’s privatekey K B
-
m = K (K (m))B+
B-
Cryptography 11
Public key encryption algorithms
need K ( ) and K ( ) such that
B B. .
given public key K , it should be impossible to compute private key K B
B
Requirements:
1
2
RSA: Rivest, Shamir, Adleman algorithm
+ -
K (K (m)) = m BB- +
+
-
Cryptography 12
RSA: Choosing keys1. Choose two large prime numbers p, q. (e.g., 1024 bits each)2. Compute n = pq, z = (p-1)(q-1)
3. Choose e (with e<n) that has no common factors with z. (e, z are “relatively prime”)4. Choose d such that ed-1 is exactly divisible by z. (in other words: ed mod z = 1 )
5. Public key is (n,e). Private key is (n,d).
K B+ K B
-
Cryptography 13
RSA: Encryption, decryption0. Given (n,e) and (n,d) as computed above
1. To encrypt bit pattern, m, computec = m mod n
e (i.e., remainder when m is divided by n)e
2. To decrypt received bit pattern, c, computem = c mod n
d (i.e., remainder when c is divided by n)d
m = (m mod n)
e mod n
dMagichappens!
c
Cryptography 14
RSA example:Bob chooses p=5, q=7. Then n=35, z=24.
e=5 (so e, z relatively prime).d=29 (so ed-1 exactly divisible by z.
letter m me c = m mod nel 12 1524832 17
c m = c mod nd17 481968572106750915091411825223071697 12
cd letterl
encrypt:
decrypt:
Cryptography 15
RSA: Why is that m = (m mod n)
e mod n
d
(m mod n)
e mod n = m mod n
d ed
Useful number theory result: If p,q prime and n = pq, then:
x mod n = x mod ny y mod (p-1)(q-1)
= m mod n
ed mod (p-1)(q-1)
= m mod n1
= m
(using number theory result above)
(since we chose ed to be divisible by(p-1)(q-1) with remainder 1 )
Cryptography 16
RSA: another important propertyThe following property will be very useful later:
K (K (m)) = m BB- + K (K (m)) BB
+ -=
use public key first, followed by private key
use private key first, followed by public key
Result is the same!
Cryptography 17
Using Keys Private keys are used for decrypting Public keys are used for encrypting
encryptionplaintext ciphertextpublic key
decryptionciphertext plaintextprivate key
Cryptography 18
Transmitting over an insecure channelAlice wants to send Bob a private
message.
Apublic is Alice’s public key.Aprivate is Alice’s private key.Bpublic is Bob’s public key.Bprivate is Bob’s private key.
Cryptography 19
Cryptography 20
Hello Bob,Wanna get together?
AliceAlice BobBob
encrypt using Bpublic decrypt using Bprivate
Cryptography 21
AliceAlice BobBob
decrypt using Aprivate encrypt using Apublic
OK Alice,Your place or mine?
Bob’s Dilemma Nobody can read the message from
Alice, but anyone could produce it.
How does Bob know that the message was really sent from Alice?
Bob may be comforted to know that only Alice can read his reply.
Cryptography 22
Alice can sign her message! Alice can create a digital signature and
prove she sent the message or someone with knowledge of her private
key
The signature can be a message digest encrypted with Aprivate.
Cryptography 23
Message Digest Also known as “hash function” or “one-
way transformation”.
Transforms a message of any length and computes a fixed length string.
We want it to be hard to guess what the message was given only the digest. Guessing is always possible.
Cryptography 24
Digital Signature Public key cryptography is also used to
provide digital signatures
signingplaintext signed message private key
verificationsigned message plaintext public key
Cryptography 25
Alice’s Signature Alice feeds her original message through a
hash function and encrypts the message digest with Aprivate.
Bob can decrypt the message digest using Apublic.
Bob can compute the message digest himself.
If the 2 message digests are identical, Bob knows Alice sent the message.
Cryptography 26
Revised Scheme
Cryptography 27
AliceAlice BobBob
Sign with Aprivate check signature using Apublic
encrypt using Bpublic decrypt using Bprivate
Why the digest? Alice could just encrypt her name, and
then Bob could decrypt it with Apublic. Why wouldn’t this be sufficient?
Suppose Alice denies she sent the message?
Bob can prove that only someone with Alice’s key could have produced the message.
Cryptography 28
Solution? Always start your messages with:
Dear Mehmet,
Create a digest from the encrypted message and sign that digest.
There are many other schemes as well.
Cryptography 29
Speed Secret key encryption/decryption
algorithms are much faster than public key algorithms.
Many times a combination is used: use public key cryptography to share a secret
key. use the secret key to encrypt the bulk of the
communication.
Cryptography 30
Goal: Bob wants Alice to “prove” her identity to him
Authentication
Protocol 1.0: Alice says “I am Alice”
Failure scenario??“I am Alice”
Cryptography 32
Goal: Bob wants Alice to “prove” her identity to him
Authentication
Protocol 1.0: Alice says “I am Alice”
in a network,Bob cannot “see” Alice, so Trudy simply declaresherself to be Alice
“I am Alice”
Cryptography 33
Authentication: another tryProtocol 2.0: Alice says “I am Alice” in an IP packet
containing her source IP address
Failure scenario??“I am Alice”Alice’s
IP address
Cryptography 34
Authentication: another try
Trudy can createa packet “spoofing”Alice’s address“I am Alice”Alice’s
IP address
Protocol 2.0: Alice says “I am Alice” in an IP packetcontaining her source IP address
Cryptography 35
Authentication: another tryProtocol 3.0: Alice says “I am Alice” and sends her
secret password to “prove” it.
Failure scenario??
“I’m Alice”Alice’s IP addr
Alice’s password
OKAlice’s IP addr
Cryptography 36
Authentication: another try
playback attack: Trudy records Alice’s packet and laterplays it back to Bob
“I’m Alice”Alice’s IP addr
Alice’s password
“I’m Alice”Alice’s IP addr
Alice’s password
Protocol 3.0: Alice says “I am Alice” and sends her secret password to “prove” it.
Cryptography 37
OKAlice’s IP addr
Authentication: yet another try
Protocol 3.1: Alice says “I am Alice” and sends her encrypted secret password to “prove” it.
Failure scenario??
“I’m Alice”Alice’s IP addr
encrypted password
OKAlice’s IP addr
Cryptography 38
Authentication: yet another try
Record andplaybackstill works!
“I’m Alice”Alice’s IP addr
encryptedpassword
“I’m Alice”Alice’s IP addr
encryptedpassword
Protocol 3.1: Alice says “I am Alice” and sends her encrypted secret password to “prove” it.
Cryptography 39
OKAlice’s IP addr
Authentication: yet another try
Goal: avoid playback attackNonce: number (R) used only once–in-a-lifetime
4.0: to prove Alice “live”, Bob sends Alice nonce, R. Alice
must return R, encrypted with shared secret key“I am Alice”
RK (R)A-B
Alice is live, and only Alice knows key to encrypt nonce, so it must be Alice!
Cryptography 40
Authentication: ap5.0ap4.0 requires shared symmetric key can we authenticate using public key techniques?ap5.0: use nonce, public key cryptography
“I am Alice”R
Bob computes
K (R)A-
“send me your public key”K A
+
(K (R)) = RA-K A
+
and knows only Alice could have the private key, that encrypted R such that
(K (R)) = RA-K A
+
Cryptography 41
ap5.0: security holeMan (woman) in the middle attack: Trudy poses as Alice (to Bob) and as Bob (to Alice)
I am Alice I am AliceR
TK (R)-
Send me your public key
TK +AK (R)-
Send me your public key
AK +
TK (m)+
Tm = K (K (m))+T
-Trudy gets
sends m to Alice encrypted with Alice’s public key
AK (m)+
Am = K (K (m))+A
-
R
Cryptography 42
ap5.0: security holeMan (woman) in the middle attack: Trudy poses as Alice (to Bob) and as Bob (to Alice)
Difficult to detect: Bob receives everything that Alice sends, and vice versa. (e.g., so Bob, Alice can meet one week later and recall conversation) problem is that Trudy receives all messages as well!
Cryptography 43