CSCE 715:Network Systems SecurityChin-Tser Huanghuangct@cse.sc.edu

University of South Carolina

(C) 2003 Chin-Tser Huang

09/02/2010*After DESMore symmetric encryption algorithmsTriple-DESAdvanced Encryption Standards

09/02/2010*Triple DESClearly a replacement for DES was neededtheoretical attacks that can break itdemonstrated exhaustive key search attacksUse multiple encryptions with DES implementationsTriple-DES is the chosen form

09/02/2010*Why Triple-DES?Double-DES may suffer from meet-in-the-middle attackworks whenever use a cipher twiceassume C = EK2[EK1[P]], so X = EK1[P] = DK2[C]given a known pair (P, C), attack by encrypting P with all keys and storethen decrypt C with keys and match X valuecan be shown that this attack takes O(256) steps

09/02/2010*Triple-DES with Two KeysMust use 3 encryptionswould seem to need 3 distinct keysBut can use 2 keys with E-D-E sequenceencrypt & decrypt equivalent in securityC = EK1[DK2[EK1[P]]]if K1=K2 then is compatible with single DESStandardized in ANSI X9.17 & ISO8732No current known practical attacks

09/02/2010*Triple-DES with Three KeysSome proposed attacks on two-key Triple-DES, although none of them practicalCan use Triple-DES with Three-Keys to avoid even theseC = EK3[DK2[EK1[P]]]Has been adopted by some Internet applications, e.g. PGP, S/MIME

09/02/2010*Origins ofAdvanced Encryption StandardTriple-DES is slow with small blocksUS NIST issued call for ciphers in 199715 candidates accepted in Jun 1998 5 were shortlisted in Aug 1999 Rijndael was selected as the AES in Oct 2000Issued as FIPS PUB 197 standard in Nov 2001

09/02/2010*AES RequirementsPrivate key symmetric block cipher 128-bit data, 128/192/256-bit keys Stronger and faster than Triple-DES Active life of 20-30 years (+ archival use) Provide full specification and design details Both C and Java implementationsNIST has released all submissions and unclassified analyses

09/02/2010*AES Evaluation CriteriaInitial criteriasecurity effort to practically cryptanalyzecost computationalalgorithm & implementation characteristicsFinal criteriageneral securitysoftware & hardware implementation easeimplementation attacksflexibility (in en/decrypt, keying, other factors)

09/02/2010*AES ShortlistShortlist in Aug 99 after testing and evaluation MARS (IBM) - complex, fast, high security margin RC6 (USA) - very simple, very fast, low security margin Rijndael (Belgium) - clean, fast, good security margin Serpent (Euro) - slow, clean, very high security margin Twofish (USA) - complex, very fast, high security margin Subject to further analysis and commentContrast between algorithms with few complex rounds verses many simple rounds refined existing ciphers verses new proposals

09/02/2010*The Winner - RijndaelDesigned by Rijmen-Daemen in Belgium Has 128/192/256 bit keys, 128 bit data An iterative rather than feistel ciphertreats data in 4 groups of 4 bytesoperates on an entire block in every roundDesigned to beresistant against known attacksspeed and code compactness on many CPUsdesign simplicityUse finite field

09/02/2010*Abstract Algebra BackgroundGroupRingField

09/02/2010*GroupA set of elements or numbersWith a binary operation whose result is also in the set (closure) Obey the following axiomsassociative law:(a.b).c = a.(b.c) has identity e:e.a = a.e = a has inverses a-1:a.a-1 = eAbelian group if commutative a.b = b.a

09/02/2010*RingA set of elements with two operations (addition and multiplication) which are:an abelian group with addition operation multiplicationhas closureis associativedistributive over addition:a(b+c) = ab + acCommutative ring if multiplication operation is commutativeIntegral domain if multiplication operation has identity and no zero divisors

09/02/2010*FieldA set of numbers with two operationsintegral domainmultiplicative inverse: aa-1 = a-1a= 1Infinite field if infinite number of elementsFinite field if finite number of elements

09/02/2010*Modular ArithmeticDefine modulo operator a mod n to be remainder when a is divided by nUse the term congruence for: a b mod n when divided by n, a and b have same remainder e.g. 100 34 mod 11 b is called the residue of a mod n if 0 b n-1 with integers can write a = qn + b

09/02/2010*DivisorA non-zero number b is a divisor of a if for some m have a=mb (a,b,m all integers) That is, b divides a with no remainder Denote as b|aE.g. all of 1,2,3,4,6,8,12,24 divide 24

09/02/2010*Modular ArithmeticCan do modular arithmetic with any group of integers Zn = {0, 1, , n-1}Form a commutative ring for additionWith a multiplicative identitySome peculiaritiesif (a+b)(a+c) mod n then bc mod nbut (ab)(ac) mod n then bc mod n only if a is relatively prime to n

09/02/2010*Modulo 8 Example

09/02/2010*Greatest Common Divisor (GCD)GCD (a,b) of a and b is the largest number that divides evenly into both a and b e.g. GCD(60,24) = 12Two numbers are called relatively prime if they have no common factors (except 1) e.g. 8 and 15 relatively prime as GCD(8,15) = 1

09/02/2010*Euclid's GCD AlgorithmUse following theorem GCD(a,b) = GCD(b, a mod b) Euclid's Algorithm to compute GCD(a,b) A=a, B=bwhile B>0R = A mod BA = B, B = Rreturn A

09/02/2010*Galois FieldsFinite fields play a key role in cryptographyNumber of elements in a finite field must be a power of a prime pnKnown as Galois fieldsDenoted GF(pn)In particular often use the following formsGF(p)GF(2n)

09/02/2010*Galois Fields GF(p)GF(p) is set of integers {0,1, , p-1} with arithmetic operations modulo prime pForm a finite fieldhave multiplicative inversesHence arithmetic is well-behaved and can do addition, subtraction, multiplication, and division without leaving the field GF(p)

09/02/2010*Arithmetic in GF(7)

09/02/2010*Finding Multiplicative InversesBy extending Euclids algorithm1.(A1, A2, A3)=(1, 0, m); (B1, B2, B3)=(0, 1, b)2. if B3 = 0return A3 = gcd(m, b); no inverse3. if B3 = 1 return B3 = gcd(m, b); B2 = b1 mod m4. Q = A3 div B35. (T1, T2, T3)=(A1 Q B1, A2 Q B2, A3 Q B3)6. (A1, A2, A3)=(B1, B2, B3)7. (B1, B2, B3)=(T1, T2, T3)8. goto 2

09/02/2010*Polynomial ArithmeticCan compute using polynomials

Several alternatives availableordinary polynomial arithmeticpoly arithmetic with coords mod ppoly arithmetic with coords mod p and polynomials mod M(x)

09/02/2010*Ordinary Polynomial ArithmeticAdd or subtract corresponding coefficientsMultiply all terms by each otherE.g.let f(x) = x3 + x2 + 2 and g(x) = x2 x + 1f(x) + g(x) = x3 + 2x2 x + 3f(x) g(x) = x3 + x + 1f(x) x g(x) = x5 + 3x2 2x + 2

09/02/2010*Polynomial Arithmetic with Modulo CoefficientsCompute value of each coefficient as modulo some valueCould be modulo any primeBut we are most interested in mod 2i.e. all coefficients are 0 or 1e.g. let f(x) = x3 + x2, g(x) = x2 + x + 1f(x) + g(x) = x3 + x + 1f(x) x g(x) = x5 + x2

09/02/2010*Modular Polynomial ArithmeticCan write any polynomial in the formf(x) = q(x) g(x) + r(x)can interpret r(x) as being a remainderr(x) = f(x) mod g(x)If no remainder say g(x) divides f(x)If g(x) has no divisors other than itself and 1 say it is irreducible (or prime) polynomialPolynomial arithmetic modulo an irreducible polynomial forms a field

09/02/2010*Polynomial GCDCan find greatest common divisor for polynomialsc(x) = GCD(a(x), b(x)) if c(x) is the poly of greatest degree which divides both a(x), b(x)can adapt Euclids Algorithm to find it:EUCLID[a(x), b(x)]1. A(x) = a(x); B(x) = b(x)2. if B(x) = 0 return A(x) = gcd[a(x), b(x)]3. R(x) = A(x) mod B(x)4. A(x) B(x)5. B(x) R(x)6. goto 2

09/02/2010*Modular Polynomial ArithmeticCan compute in field GF(2n) polynomials with coefficients modulo 2whose degree is less than nhence must reduce modulo an irreducible poly of degree n (for multiplication only)Form a finite fieldCan always find an inversecan extend Euclids Inverse algorithm to find

09/02/2010*Arithmetic in GF(23)

09/02/2010*AES Cipher RijndaelProcess data as 4 groups of 4 bytes (State)Has 9/11/13 rounds in which state undergoes: byte substitution (1 S-box used on every byte) shift rows (permute bytes between groups/columns) mix columns (subs using matrix multiply of groups) add round key (XOR state with key material) Initial XOR key material & incomplete last roundAll operations can be combined into XOR and table lookups, hence very fast and efficient

09/02/2010*AES Encryption and Decryption

09/02/2010*AES Data Structure

09/02/2010*AES Encryption Round

09/02/2010*Byte SubstitutionA simple substitution of each byteUses one table of 16x16 bytes containing a permutation of all 256 8-bit valuesEach byte of state is replaced by byte in corresponding row (left 4 bits) and column (right 4 bits)eg. byte {95} is replaced by row 9 col 5 byte, which is {2A}S-box is constructed using a defined transformation of the values in GF(28)

09/02/2010*Shift RowsCircular byte shift in each row1st row is unchanged2nd row does 1 byte circular shift to left3rd row does 2 byte circular shift to left4th row does 3 byte circular shift to leftDecryption does shifts to rightSince state is processed by columns, this step permutes bytes between the columns

09/02/2010*Mix ColumnsEach column is processed separatelyEach byte is replaced by a value dependent on all 4 bytes in the columnEffectively a matrix multiplication in GF(28) using prime poly m(x) =x8+x4+x3+x+1

09/02/2010*Add Round KeyXOR state with 128 bits of the round keyAgain processed by column (though effectively a series of byte operations)Inverse for decryption is identical since XOR is own inverse, just with correct round keyDesigned to be as simple as possible but ensured to affect every bit of State

09/02/2010*AES Key ExpansionTake 128/192/256-bit key and expand into array of 44/52/60 32-bit wordsStart by copying key into first 4 wordsThen loop creating words that depend on values in previous and 4 places backin 3 of 4 cases just XOR these togetherevery 4th has S-box + rotate + XOR constant of previous before XOR togetherDesigned to resist known attacks

09/02/2010*AES Key Expansion

09/02/2010*AES DecryptionAES decryption is not identical to encryption because steps are done in reverseBut can define an equivalent inverse cipher with steps as for encryptionuse inverses of each stepBut with a different key scheduleWorks since result is unchanged whenswap byte substitution & shift rowsswap mix columns and add (tweaked) round key

09/02/2010*Implementation AspectsCan efficiently implement on 8-bit CPUbyte substitution works on bytes using a table of 256 entriesshift rows is simple byte shiftingadd round key works on byte XORsmix columns requires matrix multiply in GF(28) which works on byte values, can be simplified to use a table lookup

09/02/2010*Implementation AspectsCan efficiently implement on 32-bit CPUredefine steps to use 32-bit wordscan precompute 4 tables of 256-wordsthen each column in each round can be computed using 4 table lookups + 4 XORsat a cost of 16Kb to store tablesDesigners believe this very efficient implementation was a key factor in its selection as the AES cipher

09/02/2010*Next ClassConfidentiality of symmetric encryptionRead Chapters 7, 8, 9

**********************************************