Introduction to Computer Security - uni-tuebingen.de · Introduction to Computer Security...
Transcript of Introduction to Computer Security - uni-tuebingen.de · Introduction to Computer Security...
Introduction to Computer SecurityFoundations of Cryptography
Pavel LaskovWilhelm Schickard Institute for Computer Science
Secret communication
Encryption
Alice Bob
Decryption
key
unitue
plaintext
I love you
plaintext
I love you
ciphertext
C ywoy cih
key
unitue
Cryptography and security objectives
Which security objectives are addressed by cryptography?
Confidentialitysymmetric cryptographyasymmetric cryptography
Integrityhashing
Authentication and non-repudiationdigital signatures
Cryptography and security objectives
Which security objectives are addressed by cryptography?
Confidentialitysymmetric cryptographyasymmetric cryptography
Integrityhashing
Authentication and non-repudiationdigital signatures
Symmetric cryptography
Encryption
Alice Bob
Decryption
shared key
unitue
plaintext
I love you
plaintext
I love you
ciphertext
C ywoy cih
shared key
unitue
any valid key
Early permutation cipher: scytale
Encryption:Wrap a parchment strip over a woodenrod of a fixed diameter and write lettersalong the rod.
Decryption:Wrap a received strip over a wooden rodof the same diameter and read off thetext.
Example:troopsheadingnorthsendmorefood
−→ thgsr renee oaonf odrdo pitmo snhod
Monoalphabetic substitution cipher: Caesar
EncryptionReplace each letter with the one threepositions to the right in the alphabet.
DecryptionReplace each letter with the one threepositions to the left in the alphabet.
Example:
HABES OPINIONIS MEAE TESTIMONIUM
MDEHV RSNQNRQNV PHDH XHVXNPRQNZP
Polyalphabetic substitution cipher: Vigenere
EncryptionWrite the key over a message,repeating as necessary.Substitute each letter with the onefrom an appropriate column in theVigenere tableau.
DecryptionSame as encryption, use a rowinstead of a column.
Example:unitueuniloveyou
−→ cywoycih
Polyalphabetic substitution: Enigma
Operating principle: electromechanicalvarying map substitutionMain components:
3–5 rotors with pre-defined connectivityinter-rotor rings: mapping between letters andconnectionsletter swap by jumper cables
Key definition: rotor types, ring positions,jumper settingsTag UKW Walzenlage Ringstellung ---- Steckerverbindungen ----
31 B I IV III 16 26 08 AD CN ET FL GI JV KZ PU QY WX
30 B II V I 18 24 11 BN DZ EP FX GT HW IY OU QV RS
29 B III I IV 01 17 22 AH BL CX DI ER FK GU NP OQ TY
One-time pad ciphers
Encryption:Generate a random key sequence.Add a key to a message usingmodular arithmetic.
Decryption:Subtract a key from a message usingmodular arithmetic.
Example:7 (H) 4 (E) 11 (L) 11 (L) 14 (O) message
+ 23 (X) 12 (M) 2 (C) 10 (K) 11 (L) key
= 30 16 13 21 25 message + key
= 4 (E) 16 (Q) 13 (N) 21 (V) 25 (Z) mod 26
Feistel cipher: S and P boxes
S-boxComplex substitution controlled by a keySecure if enough internal statesUnrealizable for a large number of states
P-box
Block-wise permutation of digitsSimple transformation with maximalentropyInsecure against a “tickling attack”
Feistel network
Revival of the idea of a product cipherStrong polyalphabetic substitution via multiple roundsFollows theoretical principles of Shannon
A practical Feistel cipher
A multiple-round scheme withseparate keysEncryption:
Li+1 = Ri Ri+1 = Li ⊕ f (Ki, Ri)
Decryption: reverse the key order
Li+1 = Ri Ri+1 = Li⊕ f (Kn−i, Ri)
3 rounds suffice to achieve apseudorandom permutation
DES: Digital Encryption Standard
Adopted in 1977 after two rounds of proposalsWon by IBM’s Lucifer cipher based on Feistel’s designKey length reduced by NIST from 128 bits to 56 bitsSubject to extensive cryptanalysis research in 1990s’Broken by specialized hardware crackers in 1997–1999(fastest result: 22 hours 15 minutes by Deep Crack)Still widely used in practice (as 3DES)Replaced by Advanced Encryption Standard (AES) in 2000
DES overview
PermutedChoice 1
64 bit plaintext 56 bit key
InitialPermutation
Iteration 1PermutedChoice 2
Left CircularShift / 2
K1
Iteration 2PermutedChoice 2
Left CircularShift / 2
K2
Iteration 16PermutedChoice 2
Left CircularShift / 2
K16
32 bit Swap
Inverse InitialPermutation
64 bit ciphertext
...
DES round structure
Li-1 Ri-1
ExpansionPermutation
Ci-1 Di-1
Left Shift Left Shift
Permutation Contraction(Perm. Choice 2)+
4848 Ki
S-Box: Choice Substitution
Permutation
+
Li Ri Ci Di
48
32
32 bit 32 bit 28 bit 28 bit
32
Data to be encrypted Key used for encryption
Other symmetric ciphers
Block ciphersAlgorithm Key size Block size Rounds Applications3DES 112/168 64 48 Finance, PGP, S/MIMEAES 128/192/256 128 10/12/14 Repl. for DES/3DESIDEA 128 64 8 PGPBlowfish up to 448 64 16 Various softwareRC5 up to 2048 64 up to 255 Various software
Stream ciphersAlgorithm Key size IV State ApplicationsA5/2 54 114 64 GSMRC4 40-256 8 2064 WEP, WPA, SSL, SSH, Kerberos, etc.
Resume of symmetric cryptography
Provides (with some exceptions) a reliable means forenforcing confidentialityHighly efficientKey distribution is a major problem!
Asymmetric cryptography
Encryption
Alice Bob
Decryption
Bob’s public key
unitue
plaintext
I love you
plaintext
I love you
ciphertext
C ywoy cih
Bob’s private key
zxtr9y
specially generatedkeypair
Prime numbers
An integer p is a prime number if its only divisors are ±1 and±p.A positive integer c is said to be the greatest common divisorof a and b if
c is a divisor of a and of b;any divisor of a and of b is a divisor of c.
Integers a and b are said to be relatively prime if
gcd(a, b) = 1.
Euler’s totient function
A totient φ(n) of an integer n is the number of integers lessthan n that are relatively prime to n.Example:
φ(9) = 6 : {1, 2, 4, 5, 7, 8}
Two integers a and b are congruent modulo n, written asa ≡ b mod n, if
(a mod n) = (b mod n)
Euler’s Theorem: If a and n are relatively prime, then
aφ(n) ≡ 1 mod n.
RSA overview
Alice sends her love message to Bob via RSA:
Alice BobGenerate a keypair Ku / Kr
Send Ku to AliceEncrypt plaintext M with Ku
Send ciphertext C to BobDecrypt C with Kr
RSA key generation
Step ConditionSelect p, q p, q prime, p 6= qCompute n = p× qCompute φ(n) = (p− 1)(q− 1)Select 1 < e < φ(n) gcd(φ(n), e) = 1Compute d (de) mod φ(n) = 1 (∗)Public key Ku = {e, n}Private key Kr = {d, n}
RSA encryption and decryption
Encryption:
Plaintext: M < nCiphertext: C = Me mod n
Decryption:
Ciphertext: CPlaintext: M = Cd mod n
Correctness of RSA encryption
By the property (∗),
(de) mod φ(n) = 1 ⇒ ∃k : (de) = 1 + kφ(n).
Then,
M?≡ Cd mod n
≡ (Me)d mod n
≡ M(ed) mod n
≡ M1+kφ(n) mod n?≡ M mod n
Correctness of RSA encryption (ctd.)
For prime numbers p,
φ(p) = (p− 1).
By the key generation algorithm and the multiplicative property ofthe totient function,
φ(n) = φ(p) · φ(q) = (p− 1) · (q− 1).
By Euler’s Theorem, if p does not divide M,
M(p−1) = 1 mod p
and since (p− 1) divides φ(n)
M1+kφ(n) ≡ M mod p.
Similar argument holds for q and hence for n = pq.
What’s secret in RSA?
An attacker needs to know d to decrypt C.To find d, an attacker needs to solve (∗):
(de) mod φ(n) = 1.
For this, he needs to know φ(n).If p and q are known, then finding φ(n) is trivial:
φ(n) = (p− 1) · (q− 1)
However p and q are discarded during key generation.Factoring n into a product of two prime numbers is anintractable problem!Finding φ(n) directly is likewise intractable.
Other asymmetric ciphers
Algorithm E/D D.S. KEX HardnessRSA Yes Yes Yes FactorizationElGamal Yes No No DLPDSS No Yes No DLPDiffie-Hellmann No No Yes DLPElliptic curve Yes Yes Yes EC DLP
Summary
Cryptographic methods provide solutions for variousconfidentiality, integrity and authentication tasks.Symmetric cryptography is based on a single key that mustbe shared between the communication parties and keptsecret.Asymmetric cryptography is based two related keys; onlyone of them (private key) must be kept secret, the other one(public key) can be distributed over insecure media.
Next lecture
Cryptographic hash functionsDigital signatures