[PPT] - Symmetric Key Cryptography Introduction to Symmetric Key PowerPoint Presentation

SLIDE 1

Symmetric Key Cryptography

PQCRYPTO Summer School on Post-Quantum Cryptography 2017

Stefan Kölbl June 19th, 2017

DTU Compute, Technical University of Denmark

SLIDE 2

Introduction to Symmetric Key Cryptography

SLIDE 3

Symmetric Key Cryptography

Where does security fail?

User
Implementation
Protocols
Cryptographic Algorithms

Myth ”Cryptographic Algorithms are never the weakest link.”

1

SLIDE 4

Symmetric Key Cryptography

Where does security fail?

User
Implementation
Protocols
Cryptographic Algorithms

RC4 Don’t blame the user! Myth ”Cryptographic Algorithms are never the weakest link.”

1

SLIDE 5

Symmetric Key Cryptography

Where does security fail?

User
Implementation
Protocols
Cryptographic Algorithms

Heartbleed Myth ”Cryptographic Algorithms are never the weakest link.”

1

SLIDE 6

Symmetric Key Cryptography

Where does security fail?

User
Implementation
Protocols
Cryptographic Algorithms

Drown Attack Myth ”Cryptographic Algorithms are never the weakest link.”

1

SLIDE 7

Symmetric Key Cryptography

Where does security fail?

User
Implementation
Protocols
Cryptographic Algorithms

Myth ”Cryptographic Algorithms are never the weakest link.”

1

SLIDE 8

Symmetric Key Cryptography

Hash Function MD5

Not collision resistant [WY05]
Constructing a rogue CA [Ste+09]

Hash Function SHA-1

Not collision resistant [WYY05]
First practical collisions this year

Stream Cipher RC4

Plaintext Recovery in TLS [AlF+13]
...

2

SLIDE 9

Symmetric Key Cryptography

A long list...

MIFARE Classic (Crypto 1)
Keeloq
A5/1, A5/2
DECT
Kindle Cipher
...

3

SLIDE 10

Symmetric Key Cryptography

What can we do?

Encryption
Authentication (MAC)
Hashing
Random Number Generation
Digital Signature Schemes
Key Exchange

4

SLIDE 11

Symmetric Key Cryptography

Digital Signatures

Hash-based Signature Schemes (MSS, XMSS [BDH11],

SPHINCS [Ber+15])

Zero-Knowledge Proof Based (Fish [Cha+17], Picnic [Cha+17])

5

SLIDE 12

Symmetric Key Cryptography

Key Exchange with Merkle Puzzles (1978)

Alice prepares m Puzzles: P1, . . . , Pm.
Solving a puzzle requires n steps.
Reveals an id and key kid.

Alice Bob P1, . . . , Pm Solve Pi → idi, ki idi

Bob needs to compute n steps.
Adversary needs to compute mn.

6

SLIDE 13

Symmetric Key Cryptography

Note We need a shared secret between the parties. Meet on Friday E qgWqNDAdcYgmyOy Meet on Friday qgWqNDAdcYgmyOy E

K K

7

SLIDE 14

Symmetric Key Cryptography

The adversary

Eavesdrop on communication
Modify transmission
Delete/Insert messages
...

...but is bound in

Computational power
Available memory
Time
Data

8

SLIDE 15

Symmetric Key Cryptography

Goals of the attacker

Decrypt a ciphertext
Forge a signature
Recover the secret key
Distinguish output
...

Message E Random

qgWqNDA

? ?

9

SLIDE 16

Symmetric Key Cryptography

How do we achieve security for an algorithm?

Reduce security to a hard problem.
Make it secure against all known attacks.

Note We can not proof security for a primitive.

10

SLIDE 17

Encryption

SLIDE 18

Block Ciphers

Plaintext Ciphertext BC Key

Encrypts blocks of fixed size n with a key of size k.
Requires a mode to encrypt arbitrary messages.

Block cipher is not an encryption scheme

11

SLIDE 19

Symmetric Key

Ideal Block Cipher K = 101010111010... K 001111110000... K 111111001000... Plaintexts Ciphertexts

12

SLIDE 20

Symmetric Key

Ideal Block Cipher K 101010111010... K = 001111110000... K 111111001000... Plaintexts Ciphertexts

12

SLIDE 21

Symmetric Key

Ideal Block Cipher K 101010111010... K 001111110000... K = 111111001000... Plaintexts Ciphertexts

12

SLIDE 22

Block Ciphers

A block cipher can be seen as a family of 2k n-bit bijections. Problem There are 2n! bijections, we ideally want to choose 2k uniformly at random. Goal We need something efficient to mimic this behaviour.

13

SLIDE 23

Block Ciphers

Iterated construction Key Plaintext Ciphertext BC P C f1 f2 f3 fr

K1 K2 K3 Kr

14

SLIDE 24

Symmetric Key Cryptography

The Data Encryption Standard

Developed in 1970s at IBM.
Feistel Network with 16

rounds.

Encrypts 64-bit blocks

with 56-bit keys.

Standardized in 1977.

f1 f2 f3 f4 L0 R0 L4 R4

15

SLIDE 25

Symmetric Key Cryptography

The Advanced Encryption Standard (AES)

Public Competition hosted by NIST (1997-2001)
Must support block size of 128 bits and key size of 128, 192 and

256 bits.

CAST-256
CRYPTON
DEAL
DFC
E2
FROG
HPC
LOKI97
MAGENTA
MARS
RC6
Rijndael
SAFER+
Serpent
Twofish

16

SLIDE 26

Symmetric Key Cryptography

The Advanced Encryption Standard (AES)

Public Competition hosted by NIST (1997-2001)
Must support block size of 128 bits and key size of 128, 192 and

256 bits.

CAST-256
CRYPTON
DEAL
DFC
E2
FROG
HPC
LOKI97
MAGENTA
MARS
RC6
Rijndael
SAFER+
Serpent
Twofish

16

SLIDE 27

Block Ciphers

AES/Rijndael

Blocksize: 128-bit
Keysize: 128/192/256 bits
Iterated block cipher with 10/12/14 rounds
Is part of a wide-range of standards.
Direct support by instructions in modern CPUs.

17

SLIDE 28

Block Ciphers

Update 4 × 4 state of bytes

SubBytes
ShiftRows
MixColumns
AddKey

1,2 a a a a a 1,1 a a a 2,1 a a a a a a 0,0 a 0,1 0,2 0,3 1,0 1,3 2,0 2,2 2,3 3,0 a 3,1 3,2 3,3 b 2,1 1,2 b b b b b b b b b b b b b b b 0,0 0,1 0,2 0,3 1,0 1,1 1,3 2,0 2,2 2,3 3,0 3,1 3,2 3,3 SubBytes S

18

SLIDE 29

Block Ciphers

Update 4 × 4 state of bytes

SubBytes
ShiftRows
MixColumns
AddKey

ShiftRows a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a No change Shift 1 Shift 2 Shift 3 0,0 0,1 0,2 0,3 1,0 1,1 1,2 1,3 1,1 1,2 1,3 1,0 0,0 0,1 0,2 0,3 2,0 2,1 2,2 2,3 2,0 2,1 2,2 2,3 3,0 3,1 3,2 3,3 3,0 3,1 3,2 3,3

18

SLIDE 30

Block Ciphers

Update 4 × 4 state of bytes

SubBytes
ShiftRows
MixColumns
AddKey

1,2 a a a a a 1,1 a a a 2,1 a a a a a a 0,0 a 0,1 0,2 0,3 1,0 1,3 2,0 2,2 2,3 3,0 a 3,1 3,2 3,3 b 1,2 b b b b b b b 2,1 b b b b b 0,0 b0,1 0,2 0,3 1,0 b 1,1 1,3 2,0 2,2 2,3 3,0 b 3,1 3,2 3,3 MixColumns

18

SLIDE 31

Block Ciphers

Update 4 × 4 state of bytes

SubBytes
ShiftRows
MixColumns
AddKey

2,1 1,2 1,1 a a a a a a a a a a a a a a a a 0,0 0,1 0,2 0,3 1,0 1,3 2,0 2,2 2,3 3,0 3,1 3,2 3,3 k k k k k k k k k k 2,1 k k k k k k 0,0 0,1 0,2 0,3 1,0 1,1 1,2 1,3 2,0 2,2 2,3 3,0 3,1 3,2 3,3 b 2,1 1,2 b b b b b b b b b b b b b b b 0,0 0,1 0,2 0,3 1,0 1,1 1,3 2,0 2,2 2,3 3,0 3,1 3,2 3,3 AddRoundKey

18

SLIDE 32

Block Ciphers

Current state of key recovery attacks for AES-128 6 7 8 10 244 [Fer+00] 299 [DFJ13] 2125.34 [BKR11] 2126.18 [BKR11] There are many more attacks with different trade-offs of time/data/memory.

19

SLIDE 33

Stream Ciphers

SLIDE 34

Stream Ciphers

Plaintext Ciphertext Keystream E Key IV

Encrypts individual digits.
IV to have multiple key stream for each K
Requires no padding.
Often used for low-bandwidth communication.

20

SLIDE 35

Stream Ciphers

Widely found in practice

GSM standard (A5/1, A5/2)
LTE (SNOW 3G, ZUC)
Bluetooth (E0)
TLS protocol (RC4, ChaCha20)

21

SLIDE 36

Stream Ciphers

eSTREAM Project (EU) Goal ...promote the design of efficient and compact stream ciphers suitable for widespread adoption... Software Hardware HC-128 Grain v1 Rabbit MICKEY 2.0 Salsa20/12 Trivium SOSEMANUK

22

SLIDE 37

Stream Ciphers

LFSR-based Constructions, e.g. A5/1

Load IV and Key in registers.
Shift registers depending on values in

.

Produces 1-bit output in each iteration.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

23

SLIDE 38

Stream Ciphers

Counter Mode (CTR) N||0 . . . 01 AESK C0, . . . , C127 N||0 . . . 02 AESK C128, . . . , C255 N||0 . . . 03 AESK C256, . . . , C383 … Keystream: Note Reusing nonce and counter gives same keystream.

24

SLIDE 39

Stream Ciphers

Salsa20 / ChaCha20

ARX-based design
512-bit state
Uses 256-bit key
20 rounds
Fast in software
ChaCha20-Poly1305 in TLS

25

SLIDE 40

Stream Ciphers

Current state of key recovery attacks for Salsa20 5 6 7 8 20 28 [CM16] 232 [CM16] 2137 [CM16] 2244.9 [CM16] For ChaCha typically one round less.

26

SLIDE 41

Cryptographic Hash Functions

SLIDE 42

Hash Functions

”There was of course no way of knowing whether you were being watched at any given moment. How often, or

n what system, the Thought Police plugged in on any

individual wire was guesswork. It was even conceivable that they watched everybody all the time. But at any rate they could plug in your wire whenever they wanted

to. You had to live – did live, from habit that became

instinct – in the assumption that every sound you made was overheard, and, except in darkness, every movement scrutinized.”

WqNDAdcYgmyO H

27

SLIDE 43

Hash Functions

”There was of course no way of knowing whether you were being watched at any given moment. How often, or

n what system, the Thought Police plugged in on any

individual wire was guesswork. It was even conceivable that they watched everybody all the time. But at any rate they could plug in your wire whenever they wanted

to. You had to live – did live, from habit that became

instinct – in the assumption that every noise you made was overheard, and, except in darkness, every movement scrutinized.”

a1IMC3mLo9Lx H

28

SLIDE 44

Hash Functions

Applications

Integrity Check
Digital Signature Schemes (this afternoon)
Password Hashing (https://password-hashing.net/)
Message Authentication
Commitment Schemes
...

29

SLIDE 45

Hash Functions

Preimage Resistance

?

H(x) H For n-bit output size

Best attack: 2n

30

SLIDE 46

Hash Functions

Second-Preimage Resistance x H(x) H

̸=

?

H(x) H For n-bit output size

Best attack: 2n

31

SLIDE 47

Hash Functions

Collision Resistance ? h H

̸= =

? h′ H For n-bit output size

Best attack: 2n/2

32

SLIDE 48

Hash Functions

Hardness of finding collision vs. preimages in practice

Algorithm Year n Collision Preimage MD4 1990 128 < 1 sec 278 4 [Guo+10] MD5 1992 128 < 1 sec 2123 4 [SA09] SHA-1 1995 160 263 2151 1 [KK12] 57/80 rounds SHA-256 2001 256 265.5 31/64 rounds 2255 5 [KRS12] 45/64 rounds

33

SLIDE 49

Hash Functions

Hardness of finding collision vs. preimages in practice

Algorithm Year n Collision Preimage MD4 1990 128 < 1 sec 278.4 [Guo+10] MD5 1992 128 < 1 sec 2123.4 [SA09] SHA-1 1995 160 263 2151.1 [KK12] 57/80 rounds SHA-256 2001 256 265.5 31/64 rounds 2255.5 [KRS12] 45/64 rounds

33

SLIDE 50

Hash Functions

Requirements for security and performance can vary on application. Password Hashing should be slow! Performance on long/short mes- sages. Collision resistance not required!

34

SLIDE 51

Hash Functions

Ideal Hash Function M1 M2 M3 Messages Hashes

35

SLIDE 52

Hash Functions

Ideal Hash Function M1 M2 M3 Messages Hashes

35

SLIDE 53

Hash Functions

Ideal Hash Function M1 M2 M3 Messages Hashes

35

SLIDE 54

Hash Functions

How to construct a hash function?

Merkle-Damgård with compression function (SHA-1, SHA-2)

IV f M1 f M2 f Mn g h1 hn+1 h Problem How do we construct the compression function?

36

SLIDE 55

Hash Functions

How to construct a hash function?

Merkle-Damgård with compression function (SHA-1, SHA-2)

hi hi+1 mi BC Solution Use a block cipher! ... but often state is too small.

36

SLIDE 56

Hash Functions

Compression Function Design (MD4)

Ai Bi Ci Di ≪ s Fi Ai+1 Bi+1 Ci+1 Di+1 Mi Ki

37

SLIDE 57

Hash Functions

Compression Function Design (MD5)

Ai Bi Ci Di ≪ s Fi Ai+1 Bi+1 Ci+1 Di+1 Mi Ki

38

SLIDE 58

Hash Functions

Compression Function Design (SHA-1)

Ai Bi Ci Di Ei ≪ 5 ≪ 30 Fi Ei+1 Di+1 Ci+1 Bi+1 Ai+1 Wi Ki

39

SLIDE 59

Hash Functions

Compression Function Design (SHA-2)

Ai Bi Ci Di Ei Fi Gi Hi

If Σ1 Maj Σ0

Hi+1 Gi+1 Fi+1 Ei+1 Di+1 Ci+1 Bi+1 Ai+1 Wt Kt

40

SLIDE 60

Hash Functions

The 2005 Hash Crisis

Wang and Yu show that MD5 is not collision resistant [WY05]...
... and SHA-1 isn’t either [WYY05].
Concerns that SHA-2 will also fail.

MD4 MD5 SHA-1

41

SLIDE 61

Hash Functions

The SHA-3 Competition

Public Competition to find a new standard SHA-3.
From 2007 to 2012
Abacus
ARIRANG
AURORA
Blake
Blender
Blue Midnight Wish
Boole
Cheetah
CHI
CRUNCH
CubeHash
DCH
Dynamic SHA
Dynamic SHA2
ECHO
ECOH
Edon-R
EnRUPT
ESSENCE
FSB
Fugue
Grøstl
Hamsi
HASH 2X
JH
Keccak
Khichidi-1
LANE
Lesamnta
Luffa
LUX
Maraca
MCSSHA-3
MD6
MeshHash
NaSHA
NKS2D
Ponic
SANDstorm
Sarmal
Sgàil
Shabal
SHAMATA
SHAvite-3
SIMD
Skein
Spectral Hash
StreamHash
SWIFFTX
Tangle
TIB3
Twister
Vortex
WaMM
Waterfall
ZK-Crypt

42

SLIDE 62

Hash Functions

The SHA-3 Competition

Public Competition to find a new standard SHA-3.
From 2007 to 2012
Abacus
ARIRANG
AURORA
Blake
Blender
Blue Midnight Wish
Boole
Cheetah
CHI
CRUNCH
CubeHash
DCH
Dynamic SHA
Dynamic SHA2
ECHO
ECOH
Edon-R
EnRUPT
ESSENCE
FSB
Fugue
Grøstl
Hamsi
HASH 2X
JH
Keccak
Khichidi-1
LANE
Lesamnta
Luffa
LUX
Maraca
MCSSHA-3
MD6
MeshHash
NaSHA
NKS2D
Ponic
SANDstorm
Sarmal
Sgàil
Shabal
SHAMATA
SHAvite-3
SIMD
Skein
Spectral Hash
StreamHash
SWIFFTX
Tangle
TIB3
Twister
Vortex
WaMM
Waterfall
ZK-Crypt

42

SLIDE 63

Hash Functions

The SHA-3 Competition

Public Competition to find a new standard SHA-3.
From 2007 to 2012
Abacus
ARIRANG
AURORA
Blake
Blender
Blue Midnight Wish
Boole
Cheetah
CHI
CRUNCH
CubeHash
DCH
Dynamic SHA
Dynamic SHA2
ECHO
ECOH
Edon-R
EnRUPT
ESSENCE
FSB
Fugue
Grøstl
Hamsi
HASH 2X
JH
Keccak
Khichidi-1
LANE
Lesamnta
Luffa
LUX
Maraca
MCSSHA-3
MD6
MeshHash
NaSHA
NKS2D
Ponic
SANDstorm
Sarmal
Sgàil
Shabal
SHAMATA
SHAvite-3
SIMD
Skein
Spectral Hash
StreamHash
SWIFFTX
Tangle
TIB3
Twister
Vortex
WaMM
Waterfall
ZK-Crypt

42

SLIDE 64

Hash Functions

SHA-3 Winner Keccak r c π M0 π M1 π M2 π h0 π h1 h

Based on the sponge construction.
Uses 1600-bit permutation π.
Parameters: rate r and capacity c.
Security claim of 2c/2.

43

SLIDE 65

Hash Functions

SHA3-256 (c = 512) collision resistance 4 5 24 practical [Qia+17] 2115 [DDS13] Practical Attacks for c = 1601:

Collisions for 6 rounds
Preimages for 4 rounds

1http://keccak.noekeon.org/crunchy_contest.html

44

SLIDE 66

Hash Functions

What should you use now? ”We don’t need another slow, secure hash function—we’ve already got SHA-2.” —Adam Langley, Mar. 20172 SHA-3 standard too conservative?3

Use different parameters.
Tree hashing mode for

better performance.

RFC for Kangaroo124

2https://www.imperialviolet.org/2017/05/31/skipsha3.html 3http://keccak.noekeon.org/is_sha3_slow.html 4https://tools.ietf.org/html/draft-viguier-kangarootwelve-00

45

SLIDE 67

Symmetric Key Cryptography

What can we do?

Encryption
Authentication (MAC)
Hashing
Random Number Generation
Digital Signature Schemes
Key Exchange

46

SLIDE 68

Questions?

46

SLIDE 69

References i

Nadhem J. AlFardan et al. “On the Security of RC4 in TLS”. In: Proceedings

f the 22th USENIX Security Symposium. 2013, pp. 305–320.

Johannes A. Buchmann, Erik Dahmen, and Andreas Hülsing. “XMSS - A Practical Forward Secure Signature Scheme Based on Minimal Security Assumptions”. In: Post-Quantum Cryptography - 4th International Workshop, PQCrypto 2011, Taipei, Taiwan, November 29 - December 2, 2011.

Proceedings. 2011, pp. 117–129.

Andrey Bogdanov, Dmitry Khovratovich, and Christian Rechberger. “Biclique Cryptanalysis of the Full AES”. In: Advances in Cryptology - ASIACRYPT 2011. 2011, pp. 344–371. Daniel J. Bernstein et al. “SPHINCS: Practical Stateless Hash-Based Signatures”. In: Advances in Cryptology - EUROCRYPT 2015. 2015,

pp. 368–397.

47

SLIDE 70

References ii

Arka Rai Choudhuri and Subhamoy Maitra. “Significantly Improved Multi-bit Differentials for Reduced Round Salsa and ChaCha”. In: IACR

Trans. Symmetric Cryptol. 2016.2 (2016), pp. 261–287.

Melissa Chase et al. Post-Quantum Zero-Knowledge and Signatures from Symmetric-Key Primitives. Cryptology ePrint Archive, Report 2017/279. http://eprint.iacr.org/2017/279. 2017. Itai Dinur, Orr Dunkelman, and Adi Shamir. “Collision Attacks on Up to 5 Rounds of SHA-3 Using Generalized Internal Differentials”. In: Fast Software Encryption - 20th International Workshop, FSE 2013. 2013,

pp. 219–240.

Patrick Derbez, Pierre-Alain Fouque, and Jérémy Jean. “Improved Key Recovery Attacks on Reduced-Round AES in the Single-Key Setting”. In: Advances in Cryptology - EUROCRYPT 2013. 2013, pp. 371–387. Niels Ferguson et al. “Improved Cryptanalysis of Rijndael”. In: Fast Software Encryption, 7th International Workshop, FSE 2000. 2000, pp. 213–230.

48

SLIDE 71

References iii

Jian Guo et al. “Advanced Meet-in-the-Middle Preimage Attacks: First Results on Full Tiger, and Improved Results on MD4 and SHA-2”. In: Advances in Cryptology - ASIACRYPT 2010. 2010, pp. 56–75. Simon Knellwolf and Dmitry Khovratovich. “New Preimage Attacks against Reduced SHA-1”. In: Advances in Cryptology - CRYPTO 2012. 2012,

pp. 367–383.

Dmitry Khovratovich, Christian Rechberger, and Alexandra Savelieva. “Bicliques for Preimages: Attacks on Skein-512 and the SHA-2 Family”. In: Fast Software Encryption - 19th International Workshop, FSE 2012. 2012,

pp. 244–263.

Kexin Qiao et al. “New Collision Attacks on Round-Reduced Keccak”. In: Advances in Cryptology - EUROCRYPT 2017. 2017, pp. 216–243. Yu Sasaki and Kazumaro Aoki. “Finding Preimages in Full MD5 Faster Than Exhaustive Search”. In: Advances in Cryptology - EUROCRYPT 2009. 2009,

pp. 134–152.

49

SLIDE 72

References iv

Marc Stevens et al. “Short Chosen-Prefix Collisions for MD5 and the Creation of a Rogue CA Certificate”. In: Advances in Cryptology - CRYPTO

2009. 2009, pp. 55–69.

Xiaoyun Wang and Hongbo Yu. “How to Break MD5 and Other Hash Functions”. In: Advances in Cryptology - EUROCRYPT 2005. 2005, pp. 19–35. Xiaoyun Wang, Yiqun Lisa Yin, and Hongbo Yu. “Finding Collisions in the Full SHA-1”. In: Advances in Cryptology - CRYPTO 2005. 2005, pp. 17–36.

50