Lecture 3 Encryption Suggested Readings: Chs 3 & 4 in KPS - - PowerPoint PPT Presentation
Lecture 3 Encryption Suggested Readings: Chs 3 & 4 in KPS (recommended) Ch 3 in Stinson (optional) 1 Encryp Enc yption n Princ ncipl ples A cryptosystem has (at least) five ingredients: Plaintext Secret Key
1
2
– Plaintext – Secret Key – Ciphertext – Encryption Algorithm – Decryption Algorithm
key, not the secrecy of the algorithms
3
4
Key Size (bits) Number of Alternative Keys Time required at 106 Decr/µs 32 232 = 4.3 x 109 2.15 milliseconds 56 256 = 7.2 x 1016 10 hours 128 2128 = 3.4 x 1038 5.4 x 1018years 168 2168 = 3.7 x 1050 5.9 x 1030years
5
is evident free of any (computational/hardness) assumptions
some common (often unproven) assumptions, e.g., the conjectured difficulty of factoring large integers
Take a look at:
http://www.ciphersbyritter.com/GLOSSARY.HTM
6
– cost of breaking it (via brute force) exceeds the value of the encrypted information; or – time required to break it exceeds useful lifetime of the encrypted information
secure
– Usually rely on very large key-space, impregnable to brute force
algorithms for certain hard problems, not on a proven inexistence
– Such as: factoring, discrete logarithms, etc.
7
Classified along three dimensions:
ciphertext
– Binary arithmetic: shifts, XORs, ANDs, etc.
– Integer arithmetic
– Symmetric or conventional (single key used) – Asymmetric or public key (2 keys: 1 to encrypt, 1 to decrypt)
– One bit at a time – A string of any length – A block of bits
upon (how?)
8
plaintext ciphertext
K AB
encryption algorithm decryption algorithm
K AB
plaintext m K (m)
AB
K (m)
AB
m = K (
)
AB
without revealing it:
secret key cryptography
9
10
K AB
challenge
K AB
challenge reply
challenge challenge reply
11
Ø Advantages
l high data throughput l relatively short key size l primitives to construct various cryptographic
mechanisms
Ø Disadvantages
l key must remain secret at both ends l key must be distributed securely and efficiently l relatively short key lifetime
“encrypt” message digest/hash -- h(m) -- with private key
12
14
plaintext message, m ciphertext encryption algorithm decryption algorithm
Bob’s public key
plaintext message PK (m)
B
PK
B
Bob’s private key
SK
B
m = SK (PK (m))
B B
SKb.
decrypt with own private key
person one communicates with
repudiation)
15
16
Ø Advantages
l only the private key must be kept secret l relatively long life time of the key l more security services l relatively efficient digital signatures mechanisms
Ø Disadvantages
l low data throughput l much larger key sizes l distribution/revocation of public keys l security based on conjectured hardness of certain
computational problems
17
Ø Public Key
l Encryption, signatures (esp., non-repudiation) and key
management
Ø Conventional
l Encryption and some data integrity applications
Ø Key Sizes
l Keys in public key crypto must be larger (e.g., 2048 bits for RSA)
than those in conventional crypto (e.g., 112 bits for 3-DES or 256
bits for AES)
search (brute force)
factoring large numbers in RSA)
Ge Generic ic Ex Exampl mple of
k Encryp yption
20
including DES, have a structure first described by Horst Feistel of IBM in 1973
choice of the following parameters and features:
20
security
lead to greater difficulty of cryptanalysis
the algorithm becomes a concern
21
22
“Round Keys” are generated from
subkey generation algorithm
23
banking security systems
bit key and block size
to be reversible
greater the security (to a point)
24
25
26
64 Bit Plaintext Initial Permutation 32 Bit L0 32 Bit R0 F(R0,K1) + 32 Bit L1 32 Bit R1 32 Bit L15 32 Bit R15 F(R15,K16) + 32 Bit L16 32 Bit R16 Final Permutation 64 Bit Ciphertext
Encryption Process
64 Bit Key Permutation Choice 1 56 Bit Key 28 Bit C0 28 Bit D0 Left Shift Right Shift C1 D1 Building Blocks Permuted Choice 2 K1(48 bits) C16 D16 Permuted Choice 2
Key Schedule
K16(48 bits)
27
Li-1 32 bits Ri-1 32 bits
S-Box Substitution choses 32 bits
P-box Permutation Li 32 bits Ri 32 bits 56 bits Key Permuted Choice 48 bits
Expansion (E) Permutation 48 bits
28
30
29
31
30
32 31
33 32
DES Key size = 56 bits
8 * ~5-bit chars = 40 bits
33
Differential Cryptanalysis
Linear Cryptanalysis
Related-key Cryptanalysis
input/output Differential cryptanalysis discovered in 1990; virtually all block ciphers from before that time are vulnerable... ... except DES. IBM (and the NSA) knew about it 15 years earlier
34
ENCRYPTION
http://en.wikipedia.org/wiki/Block_cipher_mode_of_operation
35
Electronic Code-Book (ECB) Mode
Ci = E ( K, Pi ) Pi = D ( K, Ci )
36
Cipher-Block Chaining (CBC) Mode
preceding ciphertext block:
Ci = E ( K, Pi XOR Ci-1 ) C0=IV Pi = D ( K, Ci ) XOR Ci-1
37
39
Output Feedback (OFB) Mode
Ci = E ( K, Vi-1 ) XOR Pi V0=IV Pi = E ( K, Vi-1 ) XOR Ci
39
Cipher Feedback (CFB) Mode
Ci = Pi XOR E (K, Ci-1) C0=IV Pi = E ( K, Ci-1 ) XOR Ci
40
Counter (CTR) Mode
Ci = E ( K, CTRi ) XOR Pi CTRi = CTRi-1 + 1 Pi = E ( K, CTRi ) XOR Ci
41
Message Authentication Code (MAC) Mode
Ci = E ( K, Pi XOR Ci-1 ) C0=IV What is sent or stored: P1, . . ., Pn, Cn = MAC Receiver recomputes Cn with K and compares
42
Meet-in-the-middle (or Rendesvouz) ATTACK:
I. For each possible K’i (where 0 < i < 256) 1. Compute C’i= DES ( K’i , P ) 2. Store: [ K’i, C’i ] in table T (sorted by C’i) II. For each possible K”i (where 0 < i < 256) 1. Compute C”i = DES-1 ( K”i , C ) 2. Lookup C”i in T ç not expensive! 3. If lookup succeeds, output: K1=K’i, K2=K”i TOTAL COST: O(256) operations + O(256) storage
43
NOTE: The same variants can be constructed out of any cipher
44
Why does 3-DES (or generally n-DES) work? Because, as a function, DES is not a group…
A “group” is an algebraic structure. One of its properties is that, taking any 2 elements of the group (a,b) and applying an operator F() yields another element c in the group. Suppose: C = DES(K1,DES(K2,P)) There is no K, such that: for each possible plaintext P, DES(K,P) = C
45
46
Skipjack
sponsored Clipper chip
GOST
47
48
49
x=y=0; while( length-- ) { /* state[0-255] contains key bytes */ sx = state[ ++x & 0xFF ]; y += sx & 0xFF; sy = state[ y ]; state[ y ] = sx; state[ x ] = sy; *data++ ^= state[ ( sx+sy ) & 0xFF ]; } Takes about a minute to implement from memory
50
52
52
55
standardization in the US
strong commercial-grade encryption
selecting a new encryption algorithm suitable for encrypting (non-classified non-military) government documents
56
RC4/RC5 algorithm and “R” in RSA
57
The Winner: Rijndael
Katholieke Universiteit Leuven).
combinations of key-block length possible.
implementations
58
P
r1
Key
r2 Rn-1 rn r3
C
Rn-2 k1 k2 Kn-1 kn k3 Kn-2
K KE Key Expansion Round Keys Encryption Rounds r1 … rn
state) of round i from round i+1 without the round key.
59
Detailed view of round n
key
ByteSub ShiftRow MixColumn AddRoundKey
Kn
Result from round n-1 Pass to round n+1 60
cryptographic attacks: Rijndael provides “full diffusion” after
round keys in common
61
Each byte at the input of a round undergoes a non-linear byte substitution according to the following transform: Substitution (“S”)-box
62
Depending on the block length, each “row” of the block is cyclically shifted according to the above table
63
Each column is multiplied by a fixed polynomial C(x) = ’03’*X3 + ’01’*X2 + ’01’*X + ’02’ This corresponds to matrix multiplication b(x) = c(x) Ä a(x):
Not XOR
64
Each word is simply XOR’ed with the expanded round key
KeyExpansion(int* Key[4*Nk], int* EKey[Nb*(Nr+1)]) { for(i = 0; i < Nk; i++) EKey[i] = (Key[4*i],Key[4*i+1],Key[4*i+2],Key[4*i+3]); for(i = Nk; i < Nb * (Nr + 1); i++) { temp = EKey[i - 1]; if (i % Nk == 0) temp = SubByte(RotByte(temp)) ^ Rcon[i / Nk]; EKey[i] = EKey[i - Nk] ^ temp; } }
Key Expansion algorithm:
65
(important for “Smart Cards”)
in ROM (e.g., < 256 bytes).
rotates
machines with 32-bit or higher word lengths
state, all four component transforms act on individual parts of the block
parallelism, it only needs to be performed once until the two parties switch keys.
66
performance is required (e.g., server and VPN applications).
implemented efficiently in hardware when absolute speed is required
straightforward inverse and the operations simply need to be undone in the reverse order.
encrypts a block can also decrypt the same block simply by changing certain tables and polynomials for each layer. The rest of the operation remains identical.
67
secure algorithm
and sw; requires no special instructions to obtain good performance on any computing platform
is expected to be common for the foreseeable future.
68
69
For each character:
0 1 1 1 0 0 1 0 1 1 0
pad
(key)
1 0 1 1 0 1 0 1 1 0 0
ciphertext
(encrypted msg)
1 1 0 0 0 1 1 1 0 1 0
msg
(plaintext)
70
so sending the pad is just as hard as sending the msg
71