CS 6349 - Network Security

Cryptography
Intro to cryptography
 The uses of cryptography
 Privacy
 Transmitting secret data over an insecure channel
 Storing secret data on an insecure media
 Message integrity
 Authentication

plaintext/ encryption decryption plaintext/

ciphertext
cleartext cleartext

key key

 Cryptography vs cryptanalysis
 Cryptography – involves both algorithms and secret value (key)
 Cryptanalysis – involves algorithms, sample plain/crypto text

2
Intro to cryptography
 How secure a crypto algorithm is?
 Not impossible to break
 Depends on how much effort it takes to break
 Can be made more secure by using longer keys
 Crypto algorithms – to publish or not to publish?
 Keeping it secret helps – if others don’t know it !!!
 Publishing it helps
 If good people breaks it, you get to know about it (free testing
service)
 Bad guys will learn the algorithm anyway
 Today
 most commercial algorithms are published and
 most military algorithms are not

3
Breaking an encryption scheme
 Ciphertext only attacks
 Try out all keys to decrypt the ciphertext
 Need to be able to distinguish cleartext from gibberish
 Known plaintext attacks
 Knowing a few <plaintext, ciphertext> pairs can help
mapping of plaintext letters to ciphertext letters
enabling decryption of messages
 Chosen plaintext attacks
 Attacker chooses a plaintext and system tells him back
the corresponding ciphertext

 A cryptosystem should protect against all of these

types of attacks
4
Classification of crypto systems
 Type of operations during transformation
 Substitutions vs permutations
 Number of keys used
 Symmetric / single key / secret key systems
 Asymmetric / two-key / public key systems
 Mode of plaintext processing
 Block cipher – one block (e.g., 64-bits) at a time
 Stream cipher – continuous, no block definition
 Types of cryptographic functions
 Secret key functions – use one key
 Public key functions – use two keys
 Hash functions – use zero or more keys

5
Secret key cryptography
plaintext/ encryption ciphertext decryption plaintext/
cleartext cleartext

key
 Security uses of secret key crypto
 Encryption for privacy
 Transmitting over an insecure channel
 Storing on an insecure media

 Authentication
 Alice and Bob shares a  Integrity check
secret key KAB to verify
plaintext/
each other cleartext
rA Generate Verify
Alice Bob MAC
MAC
MAC
KAB{rA}
rB key
KAB{rB}
6
Public key cryptography
 Two keys per user: private and public keys
 Reverse the effect of each other
 Security uses of public key crypto
 Encryption for privacy A plaintext
Bpublic key
ciphertext
Bprivate key
plaintext B
A B
 Digital signature/integrity plaintext

Generate Signature Verify

 Public key authentication Signature Signature

I am Alice Aprivate key Apublic key

Alice Bob
knows her If so, decrypt {R}Apublic knows Alice’s
private key public key
R
 Non-repudiation
 A msg signed by Alice’s private key proves that it is from Alice
 Difficult to achieve with secret key crypto
7
Hash algorithms (msg digest functions)
 A mathematical transformation from an arbitrary
size message to a fixed-length (short) number
m digest d(m)

 Easier to compute m  d(m)

 Very difficult to compute d(m)  m
 For m1  d(m1), difficult to find m2 s.t. d(m1)=d(m2)
 Message integrity using hash functions
msg | d(msg) msg | d(msg|secret)
Alice Bob Alice Bob

No good! Good!

8
Combining crypto funct’s for performance
 Public key crypto too slow compared to hashes and secret key
crypto
 Public key crypto more convenient and secure in setting up keys
 Algorithms can be combined to improve performance
 Hybrid encryption

 Hybrid signature
Message K: a random number Message
vs +
Encrypt with Alice’s public key Encrypt with Alice’s public key Encrypt with secret key K

 Signed and encrypted message – how to do it???

Message vs Message + Digest(Message)
Signed with Bob’s private key Signed with Bob’s private key

9
More definitions
 Unconditional security
 no matter how much computer power or time is
available, the cipher cannot be broken since the
ciphertext provides insufficient information to uniquely
determine the corresponding plaintext
 Computational security
 given limited computing resources (eg time needed for
calculations is greater than the age of the universe),
the cipher cannot be broken

10
Brute force search
 Always possible to simply try every key
 Most basic attack, proportional to key size
 Assume either know / recognise plaintext

Key Size (bits) Number of Alternative Time required at 1 Time required at 106
Keys decryption/µs decryptions/µs
32 232 = 4.3  109 231 µs = 35.8 minutes 2.15 milliseconds
56 256 = 7.2  1016 255 µs = 1142 years 10.01 hours
128 2128 = 3.4  1038 2127 µs = 5.4  1024 years 5.4  1018 years

168 2168 = 3.7  1050 2167 µs = 5.9  1036 years 5.9  1030 years

26 characters 26! = 4  1026 2  1026 µs = 6.4  1012 years 6.4  106 years
(permutation)

11
 Secret (Symmetric) Key Crypto

12
Secret (symmetric) key crypto

13
Requirements
 Two requirements for secure use of symmetric
encryption:
 A strong encryption algorithm
 A secret key known only to sender / receiver
 Mathematically have:
Y = EK(X)
X = DK(Y)
 Assume encryption algorithm is known (by all)
 Implies a secure channel to distribute key

14
Classical substitution ciphers
 Where letters of plaintext are replaced by other
letters or by numbers or symbols
 Or, if plaintext is viewed as a sequence of bits,
then substitution involves replacing plaintext bit
patterns with ciphertext bit patterns

15
Caesar cipher
 Earliest known substitution cipher
 Used by Romans in military affairs
 Replaces each letter by 3rd letter on
 Example:
meet me after the toga party
PHHW PH DIWHU WKH WRJD SDUWB
Caesar cipher
 Can define transformation as:
a b c d e f g h i j k l m n o p q r s t u v w x y z
D E F G H I J K L M N O P Q R S T U V W X Y Z A B C
 Mathematically give each letter a number
a b c d e f g h i j k l m n o p q r s t u v w x y z
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25
 Then have Caesar cipher as:
c = E(p) = (p + k) mod (26)
p = D(c) = (c – k) mod (26)
Cryptanalysis of Caesar cipher
 Only have 26 possible ciphers
 A maps to A, B, ..., Z
 Could simply try each in turn
 A brute force search
 Given ciphertext, just try all shifts of letters
 Do need to recognize when have plaintext
 E.g., break ciphertext "GCUA VQ DTGCM"
Mono-alphabetic cipher
 Rather than just shifting the alphabet
 Could shuffle the letters arbitrarily
 Each plaintext letter maps to a different random
ciphertext letter
 Hence key is 26 letters long

Plain: abcdefghijklmnopqrstuvwxyz
Cipher: DKVQFIBJWPESCXHTMYAUOLRGZN

Plaintext: ifwewishtoreplaceletters
Ciphertext: WIRFRWAJUHYFTSDVFSFUUFYA
Mono-alphabetic cipher security
 Now have a total of 26! = 4 x 1026 keys
 With so many keys, might think is secure
 But would be !!!WRONG!!!
 Problem is…
 language characteristics
Language redundancy and cryptanalysis
 Letters in an alphabet are not equally commonly
used
 In English, E is by far the most common letter
 Followed by T, R, N, I, O, A, S
 Other letters like Z, J, K, Q, X are fairly rare
 Have tables of single, double & triple letter
frequencies for various languages
English letter frequencies

22
Use in cryptanalysis
 Key concept:
 Mono-alphabetic substitution ciphers do not
change relative letter frequencies
 Discovered by Arabian scientists in 9th century
 Calculate letter frequencies for ciphertext
 Compare counts/plots against known values
 Look for common peaks/troughs
 Peaks at: A-E-I triple, NO pair, RST triple
 Troughs at: JK, X-Z
 For mono-alphabetic, must identify each letter
 Tables of common double/triple letters help

23
Example cryptanalysis
 Given ciphertext:
UZQSOVUOHXMOPVGPOZPEVSGZWSZOPFPESXUDBMETSXAIZ
VUEPHZHMDZSHZOWSFPAPPDTSVPQUZWYMXUZUHSX
EPYEPOPDZSZUFPOMBZWPFUPZHMDJUDTMOHMQ
 Count relative letter frequencies
 Guess P & Z are e and t
 Guess ZW is th and hence ZWP is the
 Proceeding with trial and error finally get:
it was disclosed yesterday that several informal but
direct contacts have been made with political
representatives of the viet cong in moscow
Poly-alphabetic ciphers
 Each occurrence of a character may have a
different substitute. One-to-many relation of
characters in plaintext vs ciphertext
 Avoids language frequency based attacks
 Substitution depends on the plaintext character
and its location in the text
 Examples:
 Fairplay cipher (used in WW I and WW II)
 Vigenere cipher
 Autokey cipher

25
Vigenere cipher – an example poly-alph. cipher
 Use a key stream of length 1≤ m ≤ 26 and repeat
 P=P1P2P3… C=C1C2C3…
 K=[(k1,k2,…,km), (k1,k2,…,km),…]
 Encryption: Ci=(Pi+ki) mod 26
 Decryption: Pi=(Ci-ki) mod 26
 Example
 Key stream: PASCAL -- 6 characters long secret key
 Plaintext: “SHE IS LISTENING”
 Key: “PAS CA LPASCALPA”
 C1=(S+P) mod 26 = (18+15) mod 26 = 7 = H
 C2 = (H+A) mod 26 = (7+0) mod 26 = 7 = H
 C3 = (E+S) mod 26 = (4+18) mod 26 = W
 C4 = (I+C) mod 26 = (8+2) mod 26 = K
 …
26
One-time pad
 If a truly random key as long as the message is
used, the cipher will be secure
 Called a one-time pad
 Is unbreakable
 Ciphertext bears no statistical relationship to the
plaintext
 Problems in generation & safe distribution of
key

27
Transposition Ciphers
 Now consider classical transposition or
permutation ciphers
 These hide the message by rearranging the letter
order
 Without altering the actual letters used

28
Rail Fence cipher
 Write message letters out diagonally over a
number of rows
 Then read off cipher row by row
 E.g., write message out as:
m e m a t r h t g p r y
e t e f e t e o a a t
 Giving ciphertext
MEMATRHTGPRYETEFETEOAAT

29
Product Ciphers
 Ciphers using substitutions or transpositions
are not secure because of language
characteristics
 Hence consider using several ciphers in
succession to make it harder:
 Two substitutions make a more complex substitution
 Two transpositions make more complex
transposition
 But a substitution followed by a transposition makes
a new much harder cipher
 This is bridge from classical to modern ciphers

30
 Modern Secret Key Crypto

31
Modern secret key crypto techniques
 Block vs. stream ciphers
 Block ciphers: process messages in blocks, each of
which is then en/decrypted like a substitution on very
big characters
 64-bits or more
 Stream ciphers: process messages a bit or byte at a
time when en/decrypting
 Many current ciphers are block ciphers
 Broader range of applications

32
 Block cipher encryption algorithms
 Key size
 If too short, then easy to guess
 Block size
 If too short, easy to build <plaintext, ciphertext> table by attacker
 If too long, requires huge space to store mapping table
 Reasonable size: 64 or 128-bit blocks
 Provides one-to-one mapping that looks like random w/o
knowing the key
 Implemented using
 Substitutions – specifies for each of 2k possible input, k-bit output
 Takes about k  2k bits space to store the mapping info
 Permutations – specifies, for each of k input bit, the output bit it
maps to
 Takes about k  log2k bits

33
A sample block encryption
64-bit input

8 bits 8 bits 8 bits 8 bits 8 bits 8 bits 8 bits 8 bits

8-bit
S1 S2 S3 S4 S5 S6 S7 S8
substitutions

8 bits 8 bits 8 bits 8 bits 8 bits 8 bits 8 bits 8 bits

64-bit intermediate

64-bit
permutation
64-bit output

34
Data Encryption Standard (DES)
 Was most widely used block cipher in the world

 Adopted in 1977 by NBS (now NIST)

 As FIPS PUB 46

 Encrypts 64-bit data using 56-bit key

 Had widespread use

 Had considerable controversy over its security

35
DES encryption overview

36
Avalanche effect
 Key desirable property of an encryption algorithm

Changing one input or key bit results in

changing approx. half output bits

 Making attempts to “home-in” by guessing keys

impossible

 DES exhibits strong avalanche

37
DES contraversies
 Design process was not made public
 Any hidden trapdoors?

 56-bit keys too short

 Is it so that NSA can break it?

 Designed for hardware and slow in software

 Independently developed, fast-in-software cipher
needed (in late 1980s)

38
Strength of DES – Key size
 56-bit keys have 256 = 7.2 x 1016 values

 First, brute force search looked hard

 Later on, advances have shown that it is possible

 In 1997 on Internet in a few months
 In 1998 on dedicated h/w (EFF) in a few days
 In 1999 above combined in 22hrs!

 Still must be able to recognize plaintext

 Must now consider alternatives to DES

39
Multiple Encryption & DES
 Clear a replacement for DES was needed
 Theoretical attacks that can break it
 Demonstrated exhaustive key search attacks

 AES is a new cipher alternative

 Prior to AES, the alternative was to use multiple

encryption with DES implementations

 Triple-DES is the chosen form

40
Double-DES?
 Could use 2-DES encrypts on each block
 C = EK2(EK1(P))

 Can have “meet-in-the-middle” attack

 Since X = EK1(P) = DK2(C)
 Attack by encrypting P with all keys and store
 Then decrypt C with keys and match X value
 Can show takes O(256) steps
 A similar attack on DES takes 255 steps only

41
Triple-DES with two-keys
 Hence must use 3 encryptions
 Would seem to need 3 distinct keys

 But can use 2 keys with E-D-E sequence

 C = EK1(DK2(EK1(P)))
 Number of encrypt & decrypt equivalent in security
 Three times slower than DES

 Standardized in ANSI X9.17 & ISO8732

 No current known practical attacks

42
Triple-DES with three-keys
 Although there are no practical attacks on two-key
Triple-DES, there are some indications

 Can use Triple-DES with 3 keys to avoid even

these
 C = EK3(DK2(EK1(P)))

 Has been adopted by some Internet applications,

e.g., PGP, S/MIME

43
AES (Advanced Encryption Standard)
 Clear a replacement for DES was needed
 Have theoretical attacks that can break it
 Have demonstrated exhaustive key search attacks

 Triple-DES – but slow, has small blocks

 US NIST issued call for ciphers in 1997

 15 candidates accepted in Jun 98
 5 were shortlisted in Aug-99
 Rijndael was selected as the AES in Oct-2000
 Issued as FIPS PUB 197 standard in Nov-2001

44
AES requirements
 Secret key symmetric block cipher

 128-bit data, 128/192/256-bit keys

 Stronger & faster than Triple-DES

 Provide full specification & design details

 Both C & Java implementations

 NIST have released all submissions & unclassified

analyses

45
The AES cipher - Rijndael
 Designed by Rijmen-Daemen in Belgium

 Has a variety of block and key sizes

 128/160/192/224/256 bit keys and data

 An iterative rather than feistel cipher

 Processes data as block of 4 columns of 4 bytes
 Operates on entire data block in every round

 Designed to be:
 Resistant against known attacks
 Speed and code compactness on many CPUs
 Design simplicity
46
 Modes of Operation

47
Modes of Operation
How to encrypt messages larger than 64-bits?
 Block ciphers encrypt fixed size blocks
 E.g., DES encrypts 64-bit blocks with 56-bit key
 Need some way to en/decrypt arbitrary
amounts of data in practise
 ANSI X3.106-1983 Modes of Use (now FIPS 81)
defines 4 possible modes
 Subsequently 5 defined for AES & DES
 Have block and stream modes

48
Electronic Codebook Book (ECB)
 Message is broken into independent blocks
which are encrypted
 Each block is a value which is substituted, like
a codebook, hence the name
 Each block is encoded independently of the
other blocks
Ci = DESK1(Pi)
 Uses: secure transmission of single values

49
Electronic Codebook Book (ECB)

50
Advantages and Limitations of ECB
 Propagation error in a ciphertext block does not affect the
other ciphertext blocks
 Can modify a block of ciphertext stored in a disk without
needing to modify all other blocks

 Message repetitions may show in ciphertext

 If aligned with message block
 Particularly with data such as graphics
 Or with messages that change very little, which become a code-
book analysis problem
 Weakness is due to the encrypted message blocks being
independent
 Main use is sending a few blocks of data

51
Cipher Block Chaining (CBC)
 Message is broken into blocks
 Linked together in encryption operation
 Each previous cipher block is chained with
current plaintext block, hence the name
 Use Initial Vector (IV) to start process
Ci = DESK1(Pi XOR Ci-1)
C-1 = IV
 Uses: bulk data encryption, authentication

52
Cipher Block Chaining (CBC)

53
Advantages and Limitations of CBC
 A ciphertext block depends on all blocks before it
 If you modify a plaintext block, you need to re-do
CBC on the rest as it causes change to all following
 Any change to a ciphertext during the transit
affects the corresponding plaintext and the next
one at the receiver
 Need Initialization Vector (IV)
 Which must be known to sender & receiver
 If sent in clear, attacker can change bits of first
block, and change IV to compensate
 Hence IV must either be a fixed value
OR must be sent encrypted in ECB mode before
rest of message

54
An attack on CBC: Modify ciphertext
 Changing a ciphertext block Ci to C’i would cause
a change in Pi+1 which may be desired by the
attacker
 But would also cause Pi to map to a random 64-bit
string where attacker have no control over – D{C’i} XOR
Ci-1 may be anything
 Append a 64-bit CRC to the message to detect
modify attacks
 Decrypted message should pass CRC check to verify
tamper proof message content

55
Output FeedBack (OFB) – stream cipher
 Message is treated as a stream of bits
 Output of cipher is added/XORed to message
 Output is then feed back (hence name)
 Feedback is independent of message
 Can be computed in advance
Ci = Pi XOR Oi
Oi = DESK1(Oi-1)
O-1 = IV
 Uses: stream encryption on noisy channels

56
Output FeedBack (OFB)

57
Advantages and limitations of OFB
 Advantages
 One-time pad can be generated in advance
 Bit errors do not propagate
 Disadvantages
 More vulnerable to message stream modification
 If attacker knows both P and C, can change message to anything
 Sender & receiver must remain in sync
 If a message is lost, rest is garbled

58
Cipher FeedBack (CFB)
 Message is treated as a stream of bits
 Added to the output of the block cipher
 Result is feed back for next stage (hence name)
 Standard allows any number of bit (1,8, 64 or
128 etc) to be feed back
 Denoted CFB-1, CFB-8, CFB-64, CFB-128 etc
 Most efficient to use all bits in block (64 or
128)
Ci = Pi XOR DESK1(Ci-1)
C-1 = IV
 Uses: stream data encryption, authentication

59
Cipher FeedBack (CFB)

60
Advantages and Limitations of CFB
 Appropriate when data arrives in bits/bytes
 Most common stream mode
 Limitation is – need to stall while do block
encryption after every n-bits
 Note that the block cipher is used in encryption
mode at both ends
 What if ciphertext gets corrupted?
 Errors propagate for several blocks after the error
 Work on an example to observe this…
 Compare to CBC and OFB
 What if ciphertext gets loss?
 Compare to CBC and OFB
61
Counter (CTR)
 Similar to OFB but encrypts counter value rather
than any feedback value
 Must have a different key & counter value for
every plaintext block (never reused)
Ci = Pi XOR Oi
Oi = DESK1(i)
 Uses: high-speed network encryptions

62
Counter (CTR)

63
Advantages and limitations of CTR
 Efficiency
 Can do parallel encryptions in h/w or s/w
 Can preprocess in advance of need
 Good for bursty high speed links
 Random access to encrypted data blocks
 Provable security (good as other modes)
 But must ensure never reuse key/counter values,
otherwise could break (cf OFB)

64
Generating Message Auth. Codes (MACs)
 Message authentication codes (MACs) help protect integrity of a message
 If we need integrity only and no privacy, can use CBC as follows

 Send CBC residue along with plaintext

65
Ensuring Both Privacy & Integrity
 Encryption by itself cannot provide integrity
 If the receiver side is a computer writing the content
into a disk, tampered ciphertext would go undetected
 CBC residue with ciphertext msg would not work
 You could tamper w/ ciphertext msg and send the
modified last cipher block as residue (next slide)
 ECBC{Plaintext | CRC} would almost work but short
CRC is a problem
 Encrypt plaintext
 w/K1 for CBC for privacy
 w/K2 for CBC residue for integrity
 Double the work but it is the best we have

66
Ensuring Both Privacy & Integrity
 The approach of using last cipher and encrypting
it again would not work as it gives a zero input to
the encryption algorithm no matter what the
ciphertext (c6) is

67
 Stream Ciphers

68
Stream Ciphers
 Process input one bit/byte at a time instead of in
blocks
 Good for streaming applications
 Have a pseudo random keystream
 Combined (XOR) with plaintext bit by bit
 Randomness of stream key completely destroys
statistical properties in message
 Ci = Mi XOR StreamKeyi
 But must never reuse stream key
 Otherwise, can recover messages

69
Stream Cipher Structure

70
Stream Cipher Properties
 Some design considerations are
 Long period with no repetitions
 Statistically random
 Depends on large enough key
 Large linear complexity
 Faster than block cipher and use far less code
 Requires that keys not be repeated as otherwise
cryptanalysis would be easy

 RC4 – a simple byte oriented and fast (in s/w)

cipher
 Used in SSL/TLS, WEP, WPA

71
 Hashes and Message Digests

72
Uses of hash functions
 Basic use in message integrity verification

 Can be used for signature verification for

authentication
 Can it provide non-repudiation ?

 Can be used to produce pseudo-random key

stream for encryption for privacy

 All of the above uses require a keyed hash

function

73
Hashes and message digests
 Requirements for hash functions
1. Can be applied to any sized message M
2. Produces fixed-length output h (h << M)
3. Is easy to compute h=H(M) for any message M
4. Given h, is infeasible to find x s.t. H(x)=h
• One-way property
5. Given x, is infeasible to find y s.t. H(y)=H(x)
• Weak collision resistance
6. Is infeasible to find any x,y s.t. H(y)=H(x)
• Strong collision resistance
 Desirable properties
 Given inputs M1,…, M1000, outputs h1,…, h1000 look all random
 For consecutive M1,M2, outputs h1,h2 look random

74
Hashes and message digests
 Given a msg M1 with m-bit digest, it takes 2m/2
randomly chosen msgs to find M2 such that
H(M2)=H(M1) w/ 50% probability
 Given m-bit msg digests, it takes 2m/2 randomly chosen
msgs to find two msgs with the same digest
 m=128 requires 264 randomly chosen msgs  difficult
 Birthday Problem
 Given n inputs and k possible outputs
 How many input sample needed s.t. any two input sample maps to
the same output w/ a probability of 50%?
 With n input, we have n(n-1)/2 tuples
 Prob. that both input values in a tuple map to the same o/p is 1/k
 For 50% chance, need k/2 pairs (n(n-1)/2 > k/2)
 Hence, n should be no less than sqrt(k)

75
Birthday Attacks
 Might think a 64-bit hash is secure
 but by Birthday Paradox, it is not
 Birthday attack works thus:
 Opponent generates 2m/2 variations of a valid
message all with essentially the same meaning
 Opponent also generates 2m/2 variations of a desired
fraudulent message
 Two sets of messages are compared to find pair with
same hash (probability > 0.5 by birthday paradox)
 Have user sign the valid message hash, then
substitute the forgery which will have a valid
signature
 Conclusion is that need to use longer
MAC/hash
 Note that this does not apply if use keyed hashes
76
Use of crypto hash functions
 Integrity verification
 MD: message digest or a hash
 Given a msg m, MD(m)  a MAC ???
 No security value in MD(m) as a MAC! Why?
 Would MD(KAB || m) work ?
 Alice creates m, uses KAB to create MD(KAB||m) and sends
m,MD(KAB||m) to Bob
 Carol takes m,MD(KAB||m), changes mm||m’ and
computes MD(KAB|m|m’) starting MD with MD(KAB|m)

 MD(m||KAB) works
 MD(KAB||m||KAB) works too
 HMAC: MDK(m)=H(K1||H(m||K2))

77
Use of crypto hash functions
 Typically used with a secret key
 How are they different from secret key crypto algrs?
 Reversible vs irreversible

 Authentication

78
Use of crypto hash functions
 Encryption w/ a msg digest
 Generate and use one-time pass to XOR with data
 Start with MD(KAB||IV)  b1: first block of bit stream
MD(KAB||b1)  b2
MD(KAB||bi-1)  bi
XOR plaintext with b bit string
 Problem: If you correctly guess plaintext p, you can
get the entire one-time pass string s=p XOR c
 Then can use s to send any message

79
Use of crypto hash functions
 Mixing in with plaintext
 Tie one time pass string to individual msgs
 Break msg p into MD-length chunks p1, p2, …
corr. ciphertext blocks will be c1, c2, …
each MD will use one-time pass block b1, b2, …
compute cipherblock as

 Even if you can guess the entire plaintext, one-time

pass cannot be used to send new msgs as it is
computed for this particular msg only.
80
Popular hash functions
 MD2, MD4, and MD5 used to be popular
 SHA-1 taking over, HMAC also popular

 All produce 128-bit digests (SHA is 160-bits)

 MD2, MD4 broken, MD5 has vulnerabilities

 SHA-1 proposed by US government

 produces 160, 256, 384, or 512 bit digests

81
 Public Key Crypto

82
Public-Key Cryptography
 Probably most significant advance in the 3000
year history of cryptography
 Uses two keys – a public & a private key
 Asymmetric since parties are not equal
 Uses clever application of number theoretic
concepts to function
 Complements rather than replaces private key
crypto

83
Why Public-Key Cryptography?
 Developed to address two main issues:

 Key distribution – how to have secure

communications in general without having to trust a
KDC with your key

 Digital signatures – how to verify a message comes

intact from the claimed sender

 Public invention by Whitfield Diffie & Martin

Hellman at Stanford Univ. in 1976

 Known earlier in classified community

84
Secret-Key Cryptography
 Traditional symmetric/secret/single key
cryptography uses one key

 Shared by both sender and receiver

 If this key is disclosed communications are

compromised

 Also is symmetric, parties are equal

 Hence does not protect sender from receiver forging a
message & claiming is sent by sender

85
Public-Key Cryptography
 Public-key/two-key/asymmetric cryptography
involves the use of two keys:

 A public-key, which may be known by anybody, and

can be used to encrypt messages, and verify
signatures

 A private-key, known only to the recipient, used to

decrypt messages, and sign (generate) signatures

 Is asymmetric because
 Those who encrypt messages or verify signatures
cannot decrypt messages or create signatures

86
Public-Key Cryptography

87
Public-Key Characteristics
 Public-key algorithms rely on two keys where:

 It is computationally infeasible to find decryption key

knowing only algorithm & encryption key

 It is computationally easy to en/decrypt messages

when the relevant (en/decrypt) key is known

 Either of the two related keys can be used for

encryption, with the other used for decryption (for
some algorithms)

88
Public-Key Cryptosystems

for encryption for privacy

for signature
89
Public-Key Applications
 Can classify uses into 3 categories:
 Encryption/decryption (provide secrecy)
 Digital signatures (provide authentication)
 Key exchange (of session keys)
 Some algorithms are suitable for all uses, others
are specific to one

90
Security of Public Key Schemes
 Brute force exhaustive search attack is
always theoretically possible
 But keys used are too large (>512 bits)

 Security relies on a large enough difference

in difficulty between easy (en/decrypt) and
hard (cryptanalysis) problems
 More generally the hard problem is known, but
is made hard enough to be impractical to break

 Requires the use of very large numbers

 Slow compared to symmetric key schemes

91
RSA
 By Rivest, Shamir & Adleman of MIT in 1977
 Best known & widely used public-key scheme
 Based on exponentiation in a finite (Galois)
field over integers modulo a prime
 Number exponentiation takes O((log n)3) operations
(easy)
 Uses large integers (eg. 1024 bits)
 Security due to cost of factoring large numbers
 Number factorization takes O(e log n log log n ) operations
(hard)

92
RSA Key Setup
 Each user generates a public/private key pair
 Select two large primes at random – p,q
 Compute their system modulus n=p.q
 Define ø(n)=(p-1)(q-1) – called Totient function
 ø(n): # of numbers < n and relatively prime to n
 Select at random the encryption key e
 where 1<e<ø(n), gcd(e,ø(n))=1
 Solve following equation to find decryption key d
 e.d=1 mod ø(n) and 0≤d≤n

 Publish their public encryption key: PU={e,n}

 Keep secret private decryption key: PR={d,n}

93
RSA Use
 To encrypt a message M the sender:
 Obtains public key of recipient PU={e,n}
 Computes: C = Me mod n, where 0≤M<n
 To decrypt the ciphertext C, the owner:
 Uses his/her private key PR={d,n}
 Computes: M = Cd mod n
 Note that the message M must be smaller than n
(block if needed)

94
Why RSA Works
 Arithmetic is mod n; n=p.q, p,q are prime
 For any x, xy mod n=x(y mod ø(n))mod n, where
 n is prime or product of two primes
 Thus, for any x, xd.e mod n = x mod n
where de=1 mod ø(n)
 In RSA, we have:
 n=p.q
 ø(n)=(p-1)(q-1)
 Carefully chose e & d to be inverses mod ø(n)
 Then, e.d=1+k.ø(n) for some k
 Hence :
Cd = Me.d = M1+k.ø(n) = M1.(Mø(n))k
= M1.(1)k = M1 = M ...(all in mod n)
95
RSA Example - Key Setup
1. Select primes: p=17 & q=11
2. Compute n = pq =17 x 11=187
3. Compute ø(n)=(p–1)(q-1)=16 x 10=160
4. Select e: gcd(e,160)=1; choose e=7
5. Determine d: de=1 mod 160 and d < 160
Value is d=23 since 23x7=161= 1x160+1
6. Publish public key PU={7,187}
7. Keep secret private key PR={23,187}

96
RSA Example - En/Decryption
 Sample RSA encryption/decryption is:
 Given message M = 88 (nb. 88<187)
 encryption:
C = 887 mod 187 = 11
 decryption:
M = 1123 mod 187 = 88

97
RSA Key Generation
 Users of RSA must:
 Determine two primes at random – p,q
 Select either e or d and compute the other
 Primes p,q must not be easily derived from
modulus n=p.q
 Means must be sufficiently large
 Typically guess and use primality test
 Exponents e, d are inverses, so use Euclid’s
inverse algorithm to compute the other
 Finding multiplicative inverse is easy via Euclid’s algr
 Finding exponential inverse is difficult

98
Generating RSA keys
 Finding big primes – p,q
 No practical way to determine absolutely that a given
large number is prime (until recently)
 But can test if the number is probably prime
Euler’s Theorem: For any a relatively prime to n
aø(n)mod n = 1
Note that if n is prime, ø(n)=(n-1).
Fermat’s Theorem: If n is prime and 0<a<n,
an-1 = 1 mod n.
 Given n a randomly generated 100-digit number,
probability that n is not prime but an-1mod n=1 is
1/1013 for 0<a<n.

99
RSA Security
 Possible approaches to attacking RSA are
 Brute force key search (infeasible given size of
numbers)
 Mathematical attacks (based on difficulty of computing
ø(n), by factoring modulus n)
 Knowing n not easy to find p and q (n = p.q)
 Not knowing p and q, difficult to find ø(n)
 Not knowing ø(n), difficult to find d such that
d.e mod ø(n) = 1
 Timing attacks (on running of decryption)
 Chosen ciphertext attacks (given properties of RSA)

100
Diffie-Hellman key exchange
 Allows two individuals to agree on a secret key
even though they can only communicate in public
 Alice chooses a private number and from that
calculates a public number
 Bob does the same
 Each can use the other’s public number and their own
private number to compute the same secret
 An eavesdropper cannot reproduce it

101
Diffie-Hellman key exchange
 A public-key distribution scheme
 Cannot be used to exchange an arbitrary message
 Rather it can establish a common key
 Known only to the two participants

 Value of key depends on the participants (and

their private and public key information)

 Based on exponentiation in a finite (Galois) field

(modulo a prime or a polynomial) – easy

 Security relies on the difficulty of computing

discrete logarithms (similar to factoring) – hard
102
Diffie-Hellman Setup
 All users agree on global parameters p and g:
 Large prime integer or polynomial p
 g being a primitive root mod p

 Each user (eg. A) generates their key

 Chooses a secret key (number): sA < p
 Compute their public key: TA = gsA mod p

 Each user makes public that key TA

103
 Diffie-Hellman Example
 Alice & Bob agree on prime q=353 and α=3
 select random secret keys:

A chooses xA=97, B chooses xB=233
 compute respective public keys:
97

yA=3 mod 353 = 40 (Alice)
233

yB=3 mod 353 = 248 (Bob)
 compute shared session key as:
xA 97

KAB = yB mod 353 = 248 = 160 (Alice)
xB 233

KAB = y A mod 353 = 40 = 160 (Bob)
Diffie-Hellman Key Exchange
 Shared session key for users A & B is KAB:
KAB = gsA.sB mod p
= TAsB mod p (which B can compute)
= TBsA mod p (which A can compute)

 KAB is used as session key in symmetric-key

encryption scheme between Alice and Bob

 If Alice and Bob subsequently communicate,

they will have the same key as before, unless
they choose new public-keys

105
Diffie-Hellman
 Alice and Bob agree on a prime p and a random
number g
 Alice picks sA at random, Bob sB at random

 Alice computes TBSA mod p, Bob TASB mod p

 Knowing g, p, gx mod p (i.e., TA or TB),

difficult to compute X(i.e., X=sA.sB)
 Attacker needs an X, must solve discrete log

106
Diffie-Hellman Example
 Users Alice & Bob who wish to swap keys:
 Agree on prime p=353 and g=3
 Select random secret keys:
 A chooses sA=97, B chooses sB=233
 Compute respective public keys:
 TA=397 mod 353 = 40 (Alice)
 TB=3233 mod 353 = 248 (Bob)
 Compute shared session key as:
 KAB= TBxA mod 353 = 24897 = 160 (Alice)
 KAB= TAxB mod 353 = 40233 = 160 (Bob)

107
D-H Key Exchange Protocols
 Users could create random private/public D-H
keys each time they communicate

 Users could create a private/public D-H keys;

publish the public key (in a directory) to be
used to securely communicate with them

 Both of these are vulnerable to a meet-in-the-

middle attack
 Authentication of the keys is needed

108
Man in the middle attack on D-H

109
Defending against man in the middle attack
 Published D-H
 Everyone agrees on p and g
 Use PKI to reliable collect other party’s public number Tx

 Authenticated D-H
 Assume pre-established secret key or each others public key

110
Authenticated DH
 If we need RSA signatures to authenticate DH key
exchange, why not just use RSA?

 RSA based key exchange example:

 Pick a random number k
 Encrypt w/ Bob’s public key
 Send it to Bob
 Use k as the session key

 Why not use this instead of Authenticated-DH?

111
Diffie-Hellman for encryption

112