Message authentication and cryptographic hashing 2MMC10 Cryptology - - PowerPoint PPT Presentation

▶
message authentication and cryptographic hashing
SMART_READER_LITE
LIVE PREVIEW

Message authentication and cryptographic hashing 2MMC10 Cryptology - - PowerPoint PPT Presentation

Oct 31, 2023 42 likes •264 views

Message authentication and cryptographic hashing 2MMC10 Cryptology Andreas H ulsing September 20, 2018 A. H ulsing 2MMC10 Cryptology 1 / 12 Message authentication Sometimes we want more than secrecy! Acknowledgement of receipt,

slide-1
SLIDE 1

Message authentication and cryptographic hashing

2MMC10 Cryptology Andreas H¨ ulsing September 20, 2018

  • A. H¨

ulsing 2MMC10 Cryptology 1 / 12

slide-2
SLIDE 2

Message authentication

Sometimes we want more than secrecy! Acknowledgement of receipt, social communication, source of executable, . . . We need integrity and authenticity! Encryption

?

⇒ Authenticity / integrity? PRG-ENC, PRF-ENC, ... any stream cipher allows controlled bit-flips. If format is known this may be disastrous Block ciphers make similar attacks harder but no guarantees. ECB-mode allows to switch order of blocks, repeat blocks, etc.

  • A. H¨

ulsing 2MMC10 Cryptology 2 / 12

slide-3
SLIDE 3

Message authentication

Sometimes we want more than secrecy! Acknowledgement of receipt, social communication, source of executable, . . . We need integrity and authenticity! Encryption

?

⇒ Authenticity / integrity? PRG-ENC, PRF-ENC, ... any stream cipher allows controlled bit-flips. If format is known this may be disastrous Block ciphers make similar attacks harder but no guarantees. ECB-mode allows to switch order of blocks, repeat blocks, etc.

  • A. H¨

ulsing 2MMC10 Cryptology 2 / 12

slide-4
SLIDE 4

Message authentication

Sometimes we want more than secrecy! Acknowledgement of receipt, social communication, source of executable, . . . We need integrity and authenticity! Encryption

?

⇒ Authenticity / integrity? PRG-ENC, PRF-ENC, ... any stream cipher allows controlled bit-flips. If format is known this may be disastrous Block ciphers make similar attacks harder but no guarantees. ECB-mode allows to switch order of blocks, repeat blocks, etc.

  • A. H¨

ulsing 2MMC10 Cryptology 2 / 12

slide-5
SLIDE 5

Message authentication

Sometimes we want more than secrecy! Acknowledgement of receipt, social communication, source of executable, . . . We need integrity and authenticity! Encryption

?

⇒ Authenticity / integrity? PRG-ENC, PRF-ENC, ... any stream cipher allows controlled bit-flips. If format is known this may be disastrous Block ciphers make similar attacks harder but no guarantees. ECB-mode allows to switch order of blocks, repeat blocks, etc.

  • A. H¨

ulsing 2MMC10 Cryptology 2 / 12

slide-6
SLIDE 6

Message authentication codes (MAC)

Definition (message authentication code) A message authentication code or MAC is a tuple of probabilistic polynomial-time algorithms MAC = (Gen, Mac, Vrfy) over a message space M, fulfilling the following:

1 Upon input 1n, the algorithm Gen outputs a key k. The set

  • f possible outputs of Gen is called the key space K.

2 The algorithm Mac receives as input a key k ∈ K and a

message m ∈ M, and outputs a tag t ∈ T . The set of possible outputs of Mac is called tag space T .

3 The algorithm Vrfy receives as input a key k ∈ K, message

m ∈ M, and tag t ∈ T , and outputs a bit b ∈ {0, 1}.

4 Correctness: For every n, every k ←

− Gen(1n), and every m ∈ M it holds that Vrfyk(m, Mack(m)) = 1.

  • A. H¨

ulsing 2MMC10 Cryptology 3 / 12

slide-7
SLIDE 7

Existential unforgeability under (adaptive) chosen message attacks (EU-CMA) -Experiment

Experiment (ExpEU−CMA

A,MAC

(n))

1 k ← Gen(1n) 2 (m, t) ← AMack(·)(1n). Let {mi}q

1 denote A’s queries to

Mack

3 if (Vrfyk(m, t) := 1, and m ∈ {mi}q

1) return 1

4 else return 0.

  • A. H¨

ulsing 2MMC10 Cryptology 4 / 12

slide-8
SLIDE 8

Existential unforgeability under (adaptive) chosen message attacks (EU-CMA) -Definition

Definition (EU-CMA) A message authentication code MAC = (Gen, Mac, Vrfy) over a message space M is existentially unforgeable under an adaptive chosen-message attack, or just secure, if for all probabilistic polynomial-time adversaries A, there exists a negligible function negl such that: Pr

  • ExpEU−CMA

A,MAC

(n) = 1

  • ≤ negl(n)
  • A. H¨

ulsing 2MMC10 Cryptology 5 / 12

slide-9
SLIDE 9

Existential unforgeability under (adaptive) chosen message attacks (EU-CMA) -Definition

Definition (EU-CMA) A message authentication code MAC = (Gen, Mac, Vrfy) over a message space M is (t, ε) existentially unforgeable under an adaptive chosen-message attack, if for all t-time adversaries A Pr

  • ExpEU−CMA

A,MAC

(n) = 1

  • ≤ ε
  • A. H¨

ulsing 2MMC10 Cryptology 6 / 12

slide-10
SLIDE 10

Remarks

There exists a constant time attack with success probability 1/|T | against every MAC ⇒ Tags must not be too short MAC’s do not prevent replay attacks! Replay attacks have to be handled on protocol level (e.g., using sequence numbers).

  • A. H¨

ulsing 2MMC10 Cryptology 7 / 12

slide-11
SLIDE 11

Remarks

There exists a constant time attack with success probability 1/|T | against every MAC ⇒ Tags must not be too short MAC’s do not prevent replay attacks! Replay attacks have to be handled on protocol level (e.g., using sequence numbers).

  • A. H¨

ulsing 2MMC10 Cryptology 7 / 12

slide-12
SLIDE 12

PRF = MAC

Theorem A (t, ε)-secure PRF F leads a (t, ε)-secure MAC with Gen(1n) returns k ←R {0, 1}n. Mack(m) returns t := Fk(m). Vrfyk(m, t) returns 1 if t = Fk(m), and 0 otherwise. Proof see board.

  • A. H¨

ulsing 2MMC10 Cryptology 8 / 12

slide-13
SLIDE 13

CBC-MAC

Construction Let F be an efficient, length-preserving keyed function over {0, 1}n. CBC-MAC has message space M = ({0, 1}ℓn). The algorithms are as follows: Gen(1n) returns k ←R {0, 1}n. Mack(m) upon input key k ∈ {0, 1}n and a message m of length ℓn, do the following:

1 Denote m = m1, . . . , mℓ where each mi is of

length n, and set t0 = 0n.

2 For i = 1 to ℓ, set ti ← Fk(ti−1 ⊕ mi). 3 Output tℓ.

Vrfyk(m, t) returns 1 if t = Mack(m), and 0 otherwise.

  • A. H¨

ulsing 2MMC10 Cryptology 9 / 12

slide-14
SLIDE 14

Variable message length CBC-MAC

CBC-MAC is not secure for variable length messages Solutions for variable ℓ: Derived key: Compute k′ = Fk(ℓ) and use k′ to compute t = Mack′(m) Prepend length: Compute t = Mack(ℓm). Encrypted tag: Use two keys k1, k2 ∈ {0, 1}n, compute t′ = Mack1(m) and output t = Fk2(t′). We can generate k1, k2 from a single key using F as a length-doubling PRG (< k1, k2 >=< Fk(0), Fk(1) >)

  • A. H¨

ulsing 2MMC10 Cryptology 10 / 12

slide-15
SLIDE 15

Variable message length CBC-MAC

CBC-MAC is not secure for variable length messages Solutions for variable ℓ: Derived key: Compute k′ = Fk(ℓ) and use k′ to compute t = Mack′(m) Prepend length: Compute t = Mack(ℓm). Encrypted tag: Use two keys k1, k2 ∈ {0, 1}n, compute t′ = Mack1(m) and output t = Fk2(t′). We can generate k1, k2 from a single key using F as a length-doubling PRG (< k1, k2 >=< Fk(0), Fk(1) >)

  • A. H¨

ulsing 2MMC10 Cryptology 10 / 12

slide-16
SLIDE 16

Padding

What if the message length is not a multiple of the block length: |m| = x · n? Solution: Padding Expand message to match multiple of block length. Usually injective function Pad : {0, 1}∗ → ({0, 1}n)∗. E.g., m → m10∗. Properties depend on cryptographic application:

Encryption - invertible MAC - injective

Often used for additional purposes: Randomization, or encoding message length.

  • A. H¨

ulsing 2MMC10 Cryptology 11 / 12

slide-17
SLIDE 17

Padding

What if the message length is not a multiple of the block length: |m| = x · n? Solution: Padding Expand message to match multiple of block length. Usually injective function Pad : {0, 1}∗ → ({0, 1}n)∗. E.g., m → m10∗. Properties depend on cryptographic application:

Encryption - invertible MAC - injective

Often used for additional purposes: Randomization, or encoding message length.

  • A. H¨

ulsing 2MMC10 Cryptology 11 / 12

slide-18
SLIDE 18

Secrecy + Authenticity

We want a combination of encryption and MAC that provides IND-CCA and EU-CMA security. Options: Encrypt-and-MAC: c = Enck1(m), t = Mack2(m). MAC-then-Encrypt. t = Mack2(m), c = Enck1(mt). Encrypt-then-MAC. c = Enck1(m), t = Mack2(c).

  • A. H¨

ulsing 2MMC10 Cryptology 12 / 12

slide-19
SLIDE 19

Secrecy + Authenticity

We want a combination of encryption and MAC that provides IND-CCA and EU-CMA security. Options: Encrypt-and-MAC: c = Enck1(m), t = Mack2(m). MAC-then-Encrypt. t = Mack2(m), c = Enck1(mt). Encrypt-then-MAC. c = Enck1(m), t = Mack2(c).

  • A. H¨

ulsing 2MMC10 Cryptology 12 / 12

slide-20
SLIDE 20

Secrecy + Authenticity

We want a combination of encryption and MAC that provides IND-CCA and EU-CMA security. Options: Encrypt-and-MAC: c = Enck1(m), t = Mack2(m). Possibly insecure as MAC might leak! MAC-then-Encrypt. t = Mack2(m), c = Enck1(mt). Encrypt-then-MAC. c = Enck1(m), t = Mack2(c).

  • A. H¨

ulsing 2MMC10 Cryptology 12 / 12

slide-21
SLIDE 21

Secrecy + Authenticity

We want a combination of encryption and MAC that provides IND-CCA and EU-CMA security. Options: Encrypt-and-MAC: c = Enck1(m), t = Mack2(m). Possibly insecure as MAC might leak! MAC-then-Encrypt. t = Mack2(m), c = Enck1(mt). Possibly insecure but counter-examples are more involved Encrypt-then-MAC. c = Enck1(m), t = Mack2(c).

  • A. H¨

ulsing 2MMC10 Cryptology 12 / 12

slide-22
SLIDE 22

Secrecy + Authenticity

We want a combination of encryption and MAC that provides IND-CCA and EU-CMA security. Options: Encrypt-and-MAC: c = Enck1(m), t = Mack2(m). Possibly insecure as MAC might leak! MAC-then-Encrypt. t = Mack2(m), c = Enck1(mt). Possibly insecure but counter-examples are more involved Encrypt-then-MAC. c = Enck1(m), t = Mack2(c). Secure! (And a way to turn an IND-CPA secure encryption into an IND-CCA secure one if MAC has unique tags.)

  • A. H¨

ulsing 2MMC10 Cryptology 12 / 12