Cryptography: Symmetric Encryption (finish), Hash Functions, Message - - PowerPoint PPT Presentation

▶
cryptography symmetric encryption finish hash functions
SMART_READER_LITE
LIVE PREVIEW

Cryptography: Symmetric Encryption (finish), Hash Functions, Message - - PowerPoint PPT Presentation

Dec 20, 2022 374 likes •817 views

CSE 484 / CSE M 584: Computer Security and Privacy Cryptography: Symmetric Encryption (finish), Hash Functions, Message Authentication Codes Fall 2016 Adam (Ada) Lerner lerner@cs.washington.edu Thanks to Franzi Roesner, Dan Boneh, Dieter

slide-1
SLIDE 1

Fall 2016 Adam (Ada) Lerner lerner@cs.washington.edu

Thanks to Franzi Roesner, Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee, and many others for sample slides and materials ...

CSE 484 / CSE M 584: Computer Security and Privacy

Cryptography:

Symmetric Encryption (finish), Hash Functions, Message Authentication Codes

slide-2
SLIDE 2

More Cheating

10/26/16 CSE 484 / CSE M 584 - Fall 2016 2

slide-3
SLIDE 3

More Cheating

10/26/16 CSE 484 / CSE M 584 - Fall 2016 3

slide-4
SLIDE 4

Dirty COW Vulnerability

  • Race condition involving memory mapped

files which allows user processes to write to root-owned files

10/26/16 CSE 484 / CSE M 584 - Fall 2016 4

slide-5
SLIDE 5

Dirty COW Fixed

commit 19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619 Author: Linus Torvalds torvalds@linux-foundation.org Date: Thu Oct 13 20:07:36 2016 GMT This is an ancient bug that was actually attempted to be fixed once (badly) by me eleven years ago in commit 4ceb5db9757a ("Fix get_user_pages() race for write access") but that was then undone due to problems on s390 by commit f33ea7f404e5 ("fix get_user_pages bug").

10/26/16 CSE 484 / CSE M 584 - Fall 2016 5

slide-6
SLIDE 6

Dirty COW Vulnerability

  • madvise(map,100,MADV_DONTNEED)
  • write(“/proc/self/mem”)
  • Eventually writes to a file in the middle of

page table updates, causing inappropriate file overwriting.

10/26/16 CSE 484 / CSE M 584 - Fall 2016 6

slide-7
SLIDE 7

Recap: Block Ciphers

  • Operates on a single chunk (“block”) of plaintext

– For example, 64 bits for DES, 128 bits for AES – Each key defines a different permutation – Same key is reused for each block (can use short keys)

10/26/16 CSE 484 / CSE M 584 - Fall 2016 7

Plaintext

Ciphertext

block cipher Key

slide-8
SLIDE 8

Electronic Code Book (ECB) Mode

10/26/16 CSE 484 / CSE M 584 - Fall 2016 8

plaintext ciphertext

block cipher block cipher block cipher block cipher block cipher

key key key key key

  • Don’t use ECB mode
slide-9
SLIDE 9

Cipher Block Chaining (CBC) Mode: Encryption

10/26/16 CSE 484 / CSE M 584 - Fall 2016 9

Sent with ciphertext

plaintext ciphertext

block cipher block cipher block cipher block cipher

⊕

Initialization vector (random)

⊕ ⊕ ⊕

key key key key

slide-10
SLIDE 10

CBC Mode: Decryption

10/26/16 CSE 484 / CSE M 584 - Fall 2016 10

plaintext ciphertext

decrypt decrypt decrypt decrypt

⊕

Initialization vector

⊕ ⊕ ⊕

key key key key

slide-11
SLIDE 11

ECB vs. CBC

10/26/16 CSE 484 / CSE M 584 - Fall 2016 11

slide 11

AES in ECB mode AES in CBC mode

Similar plaintext blocks produce similar ciphertext blocks (not good!)

[Picture due to Bart Preneel]

slide-12
SLIDE 12

Counter Mode (CTR): Encryption

ctr ctr+1 ctr+2 ctr+3 block cipher block cipher block cipher block cipher

Initial ctr (random)

⊕ ⊕ ⊕ ⊕

pt pt pt pt Key Key Key Key

ciphertext

10/26/16 CSE 484 / CSE M 584 - Fall 2016 12

slide-13
SLIDE 13

Counter Mode (CTR): Decryption

10/26/16 CSE 484 / CSE M 584 - Fall 2016 13

ct ct ct ct ctr ctr+1 ctr+2 ctr+3 block cipher block cipher block cipher block cipher

Initial ctr

⊕ ⊕ ⊕ ⊕

pt pt pt pt Key Key Key Key

slide-14
SLIDE 14

How Can a Cipher Be Attacked?

  • Attackers knows ciphertext and encryption algthm

– What else does the attacker know? Depends on the application in which the cipher is used!

  • Ciphertext-only attack
  • KPA: Known-plaintext attack (stronger)

– Knows some plaintext-ciphertext pairs

  • CPA: Chosen-plaintext attack (even stronger)

– Can obtain ciphertext for any plaintext of his choice

  • CCA: Chosen-ciphertext attack (very strong)

– Can decrypt any ciphertext except the target

10/26/16 CSE 484 / CSE M 584 - Fall 2016 14

slide-15
SLIDE 15

Ex: Chosen Plaintext Attacks

10/26/16 CSE 484 / CSE M 584 - Fall 2016 15

[wikipedia]

“Let’s plan an attack on AF”

slide-16
SLIDE 16

Ex: Chosen Plaintext Attacks

10/26/16 CSE 484 / CSE M 584 - Fall 2016 16

[wikipedia]

“This is Midway Island, we’re low

  • n supplies”
slide-17
SLIDE 17

Ex: Chosen Plaintext Attacks

10/26/16 CSE 484 / CSE M 584 - Fall 2016 17

[wikipedia]

“AF is low on supplies”

slide-18
SLIDE 18

Ex: Chosen Plaintext Attack

  • When the allies planted mines in the ocean,

the German Navy would send messages about those locations to warn their ships.

10/26/16 CSE 484 / CSE M 584 - Fall 2016 18

[wikipedia]

slide-19
SLIDE 19

Examples of Chosen Ciphertext Attacks

  • Some serious attacks against SSH have been

based on Chosen Ciphertext Attacks

  • Example: send chosen ciphertext to SSH

server, see whether it responds with an error or not.

10/26/16 CSE 484 / CSE M 584 - Fall 2016 19

slide-20
SLIDE 20

Examples of Chosen Ciphertext Attacks

  • Imagine a system with very few commands,

e.g., a military system which responds to the commands (“FIRE”) and (“DON’T FIRE”). Try sending ciphertexts and observe in real life whether the weapon fires or not.

  • The side effects of the command serve as a

“decryption” of your ciphertext.

10/26/16 CSE 484 / CSE M 584 - Fall 2016 20

slide-21
SLIDE 21

Very Informal Intuition

  • Security against chosen-plaintext attack (CPA)

– Ciphertext leaks no information about the plaintext – Even if the attacker correctly guesses the plaintext, he cannot verify his guess – Every ciphertext is unique, encrypting same message twice produces completely different ciphertexts

10/26/16 CSE 484 / CSE M 584 - Fall 2016 21

Minimum security requirement for a modern encryption scheme

slide-22
SLIDE 22

Message Authentication Codes

10/26/16 CSE 484 / CSE M 584 - Fall 2016 22

slide-23
SLIDE 23

So Far: Achieving Privacy

10/26/16 CSE 484 / CSE M 584 - Fall 2016 23

Alice Bob

M C

Encrypt

K

Decrypt

K M K K

Adversary

Message = M Ciphertext = C Encryption schemes: A tool for protecting privacy.

slide-24
SLIDE 24

Now: Achieving Integrity

10/26/16 CSE 484 / CSE M 584 - Fall 2016 24

Integrity and authentication: only someone who knows KEY can compute correct MAC for a given message.

Alice Bob

KEY KEY

message

MAC: message authentication code

(sometimes called a “tag”)

message, MAC(KEY,message) = ? Recomputes MAC and verifies whether it is equal to the MAC attached to the message

Message authentication schemes: A tool for protecting integrity.

slide-25
SLIDE 25

Reminder: CBC Mode Encryption

10/26/16 CSE 484 / CSE M 584 - Fall 2016 25

plaintext ciphertext

block cipher block cipher block cipher block cipher

⊕

Initialization vector (random)

⊕ ⊕ ⊕

key key key key

slide-26
SLIDE 26

10/26/16 CSE 484 / CSE M 584 - Fall 2016 26

TAG plaintext

block cipher block cipher block cipher block cipher

⊕ ⊕ ⊕ ⊕

key key key key

CBC-MAC

slide-27
SLIDE 27

10/26/16 CSE 484 / CSE M 584 - Fall 2016 27

TAG plaintext

block cipher block cipher block cipher block cipher

⊕ ⊕ ⊕ ⊕

key key key key

CBC-MAC

  • Not secure when system may MAC messages of different lengths.
slide-28
SLIDE 28

Hash Functions

10/26/16 CSE 484 / CSE M 584 - Fall 2016 28

slide-29
SLIDE 29

Application: Password Hashing

  • Instead of user password, store hash(password)
  • When user enters a password, compute its hash

and compare with the entry in the password file

– System does not store actual passwords! – Cannot go from hash to password!

  • Why is hashing better than encryption here?
  • Does hashing protect weak, easily guessable

passwords?

10/26/16 CSE 484 / CSE M 584 - Fall 2016 29

slide-30
SLIDE 30

Application: Software Integrity

Goal: Software manufacturer wants to ensure file is received by users without modification. Idea: given goodFile and hash(goodFile), very hard to find badFile such that hash(goodFile)=hash(badFile)

10/26/16 CSE 484 / CSE M 584 - Fall 2016 30

goodFile

BigFirm™ User

VIRUS

badFile

The NYTimes

hash(goodFile)

slide-31
SLIDE 31

Hash Functions: Main Idea

10/26/16 CSE 484 / CSE M 584 - Fall 2016 31

bit strings of any length n-bit bit strings

. . . . .

x’ x’’ x y’ y hash function H

  • Hash function H is a lossy compression function

– Collision: h(x)=h(x’) for distinct inputs x, x’

  • H(x) should look “random”

– Every bit equally likely to be 0 or 1

  • Cryptographic hash function needs a few properties…

message “digest”

message

slide-32
SLIDE 32

Property 1: One-Way

  • The hash should be hard to invert

– “Preimage resistance” – Let h(x’) = y ∈ {0,1}n for random x’ – Given y, it should be hard to find any x such that h(x)=y

10/26/16 CSE 484 / CSE M 584 - Fall 2016 32

slide-33
SLIDE 33

Security Mindset Anecdote

  • A clever example of a
  • ne-way function:

phone books.

10/26/16 CSE 484 / CSE M 584 - Fall 2016 33

slide-34
SLIDE 34

Security Mindset Anecdote

  • A clever example of a
  • ne-way function:

phone books.

  • Hash(name) =

Phone number of person with that name

10/26/16 CSE 484 / CSE M 584 - Fall 2016 34

slide-35
SLIDE 35

Security Mindset Anecdote

  • Easy to compute

forward (phonebook is alphabetical)

  • Hard to invert

backward (must search n/2 pages on average to find person by phone number)

10/26/16 CSE 484 / CSE M 584 - Fall 2016 35

slide-36
SLIDE 36

Security Mindset Anecdote

10/26/16 CSE 484 / CSE M 584 - Fall 2016 36

slide-37
SLIDE 37

Property 2: Collision Resistance

  • Should be hard to find x≠x’ such that h(x)=h(x’)

10/26/16 CSE 484 / CSE M 584 - Fall 2016 37

slide-38
SLIDE 38

Birthday Paradox

  • Expect birthday “collision” half the time with a

room of only 23 people.

  • Approximate: 50% probability = sqrt(365).
  • Why is this important for cryptography?

– 2128 different 128-bit values

  • Pick one value at random. To exhaustively search for this

value requires trying on average 2127 values.

  • Expect “collision” after selecting approximately 264

random values.

  • 64 bits of security against collision attacks, not 128 bits.

10/26/16 CSE 484 / CSE M 584 - Fall 2016 38

slide-39
SLIDE 39

Property 2: Collision Resistance

  • Should be hard to find x≠x’ such that h(x)=h(x’)
  • Birthday paradox (informal)

– Let t be the number of values x,x’,x’’… we need to look at before finding the first pair x,x’ s.t. h(x)=h(x’) – What is probability of collision for each pair x,x’? – How many pairs would we need to look at before finding the first collision? – How many pairs x,x’ total? – What is t, the number of values we need to look at?

  • Brute-force collision search is only O(2n/2), not O(2n)

– For SHA-1, this means O(280) vs. O(2160)

10/26/16 CSE 484 / CSE M 584 - Fall 2016 39

1/2n O(2n) 2n/2 Choose(t,2)=t(t-1)/2 ∼ O(t2)

slide-40
SLIDE 40

Property 2: Collision Resistance

  • Should be hard to find x≠x’ such that h(x)=h(x’)
  • Birthday paradox means that brute-force collision

search is only O(2n/2), not O(2n) – For SHA-1, this means O(280) vs. O(2160)

10/26/16 CSE 484 / CSE M 584 - Fall 2016 40

slide-41
SLIDE 41

Property 3: Weak Collision Resistance

  • Given randomly chosen x, hard to find x’ such that

h(x)=h(x’)

– Attacker must find collision for a specific x. By contrast, to break collision resistance it is enough to find any collision. – Brute-force attack requires O(2n) time

  • Weak collision resistance does not imply collision

resistance.

10/26/16 CSE 484 / CSE M 584 - Fall 2016 41

slide-42
SLIDE 42

Properties of a Cryptographic Hash Function

  • One-wayness

– Given h(x)…

  • Collision resistance

– Hard to find…

  • Weak collision resistance

– Hard to find…

10/26/16 CSE 484 / CSE M 584 - Fall 2016 42

slide-43
SLIDE 43

Properties of a Cryptographic Hash Function

  • One-wayness

– Given h(x): hard to find x

  • Collision resistance

– Hard to find x ≠ x’ s.t. h(x) == h(x’)

  • Weak collision resistance

– Hard to find x ≠ x’ s.t. h(x) == h(x’) for specific, random x

10/26/16 CSE 484 / CSE M 584 - Fall 2016 43