Symmetric Key Cryptography Introduction to Symmetric Key - PowerPoint PPT Presentation

PQCRYPTO Summer School on Post-Quantum Cryptography 2017 Stefan Kölbl June 19th, 2017 DTU Compute, Technical University of Denmark Symmetric Key Cryptography

Introduction to Symmetric Key Cryptography

Myth Where does security fail? • User • Implementation • Protocols • Cryptographic Algorithms ”Cryptographic Algorithms are never the weakest link.” 1 Symmetric Key Cryptography

Myth Where does security fail? • User • Implementation • Protocols • Cryptographic Algorithms ”Cryptographic Algorithms are never the weakest link.” 1 Symmetric Key Cryptography RC4 Don’t blame the user!

Myth Where does security fail? • User • Implementation • Protocols • Cryptographic Algorithms Heartbleed ”Cryptographic Algorithms are never the weakest link.” 1 Symmetric Key Cryptography

Myth Where does security fail? • User • Implementation • Protocols • Cryptographic Algorithms Drown Attack ”Cryptographic Algorithms are never the weakest link.” 1 Symmetric Key Cryptography

Where does security fail? • User • Implementation • Protocols • Cryptographic Algorithms ”Cryptographic Algorithms are never the weakest link.” 1 Symmetric Key Cryptography Myth

Hash Function MD5 • Not collision resistant [WY05] • Constructing a rogue CA [Ste+09] • Not collision resistant [WYY05] • First practical collisions this year • Plaintext Recovery in TLS [AlF+13] • ... 2 Symmetric Key Cryptography Hash Function SHA-1 Stream Cipher RC4

A long list... • MIFARE Classic (Crypto 1) • A5/1, A5/2 • DECT • Kindle Cipher • ... 3 Symmetric Key Cryptography • Keeloq

What can we do? • Encryption • Authentication (MAC) • Hashing • Random Number Generation • Digital Signature Schemes 4 Symmetric Key Cryptography • Key Exchange

Digital Signatures • Hash-based Signature Schemes (MSS, XMSS [BDH11], SPHINCS [Ber+15]) • Zero-Knowledge Proof Based (Fish [Cha+17], Picnic [Cha+17]) 5 Symmetric Key Cryptography

Key Exchange with Merkle Puzzles (1978) • Reveals an id and key k id . Alice Bob id i • Bob needs to compute n steps. 6 Symmetric Key Cryptography • Alice prepares m Puzzles: P 1 , . . . , P m . • Solving a puzzle requires n steps. P 1 , . . . , P m Solve P i → id i , k i • Adversary needs to compute mn .

We need a shared secret between the parties. Meet on Friday qgWqNDAdcYgmyOy Meet on Friday qgWqNDAdcYgmyOy K K 7 Symmetric Key Cryptography Note E E

The adversary • Eavesdrop on communication • Modify transmission • Delete/Insert messages • ... ...but is bound in • Computational power • Available memory • Time • Data 8 Symmetric Key Cryptography

Goals of the attacker • Decrypt a ciphertext • Forge a signature • Recover the secret key • Distinguish output • ... Message Random qgWqNDA ? ? 9 Symmetric Key Cryptography E

How do we achieve security for an algorithm? • Reduce security to a hard problem. • Make it secure against all known attacks. 10 Symmetric Key Cryptography Note We can not proof security for a primitive.

Encryption

Plaintext Ciphertext BC Key • Encrypts blocks of fixed size n with a key of size k . • Requires a mode to encrypt arbitrary messages. Block cipher is not an encryption scheme 11 Block Ciphers

Ideal Block Cipher K 001111110000... K 111111001000... Plaintexts Ciphertexts 12 Symmetric Key K = 101010111010...

Ideal Block Cipher K 101010111010... K 111111001000... Plaintexts Ciphertexts 12 Symmetric Key K = 001111110000...

Ideal Block Cipher K 101010111010... K 001111110000... Plaintexts Ciphertexts 12 Symmetric Key K = 111111001000...

random. 13 Block Ciphers A block cipher can be seen as a family of 2 k n-bit bijections. Problem There are 2 n ! bijections, we ideally want to choose 2 k uniformly at Goal We need something efficient to mimic this behaviour.

14 f 2 K r K 3 K 2 K 1 f r f 3 f 1 Iterated construction C P BC Ciphertext Plaintext Key Block Ciphers

15 f 2 R 4 L 4 R 0 L 0 f 4 f 3 f 1 The Data Encryption Standard • Standardized in 1977. • Encrypts 64-bit blocks rounds. • Feistel Network with 16 • Developed in 1970s at IBM. Symmetric Key Cryptography with 56-bit keys.

16 • HPC • Twofish • Serpent • SAFER+ • Rijndael • RC6 • MARS • MAGENTA • LOKI97 • FROG The Advanced Encryption Standard (AES) • E2 • DFC • DEAL • CRYPTON • CAST-256 256 bits. • Must support block size of 128 bits and key size of 128, 192 and • Public Competition hosted by NIST (1997-2001) Symmetric Key Cryptography

16 • HPC • Twofish • Serpent • SAFER+ • Rijndael • RC6 • MARS • MAGENTA • LOKI97 • FROG The Advanced Encryption Standard (AES) • E2 • DFC • DEAL • CRYPTON • CAST-256 256 bits. • Must support block size of 128 bits and key size of 128, 192 and • Public Competition hosted by NIST (1997-2001) Symmetric Key Cryptography

AES/Rijndael • Blocksize: 128-bit • Keysize: 128/192/256 bits • Iterated block cipher with 10/12/14 rounds • Is part of a wide-range of standards. • Direct support by instructions in modern CPUs. 17 Block Ciphers

18 b b b b b b b b b b b b b b 1,2 b 0,0 b 2,3 S SubBytes 3,3 3,2 3,1 3,0 2,2 0,1 2,0 1,3 1,1 1,0 0,3 0,2 2,1 3,3 a a 1,2 a a a a a 1,1 a a a 2,1 a 3,2 a • MixColumns a a 0,0 • ShiftRows 0,2 0,3 1,0 1,3 2,0 2,2 2,3 3,0 • SubBytes • AddKey Block Ciphers Update 4 × 4 state of bytes a 0,1 a 3,1

18 1,1 1,0 1,3 1,2 1,1 1,3 1,2 1,0 0,1 0,3 0,2 0,1 0,0 Shift 3 Shift 2 Shift 1 0,0 0,2 No 3,0 3,3 3,2 3,1 3,0 3,3 3,2 3,1 2,3 0,3 2,2 2,1 2,0 2,3 2,2 2,1 2,0 change a a a a a a a a a a a a a a ShiftRows • AddKey • MixColumns a a • SubBytes a a a a a a a a a a a a a a a a • ShiftRows Block Ciphers Update 4 × 4 state of bytes

18 2,1 3,3 3,2 3,3 b 1,2 b b b b b b b b 2,3 b b b b 0,0 b0,1 0,2 0,3 1,0 3,2 1,3 2,0 2,2 3,0 2,2 3,0 a • SubBytes • ShiftRows • MixColumns • AddKey 1,2 a a a a a 1,1 a a 2,0 2,1 a a a a a a 0,0 MixColumns 0,2 0,3 1,0 1,3 2,3 Block Ciphers Update 4 × 4 state of bytes a 0,1 b 1,1 a 3,1 b 3,1

18 3,0 b b b b 1,2 2,1 b 3,3 3,2 3,1 2,3 b 2,2 2,0 1,3 1,2 1,1 1,0 0,3 0,2 0,1 0,0 b b k 1,0 AddRoundKey 3,3 3,2 3,1 3,0 2,3 2,2 2,0 1,3 1,1 0,3 b 0,2 0,1 0,0 b b b b b b b k k 0,1 a a a a a a a a a a a k a a a a a 1,1 1,2 2,1 • AddKey 0,0 0,2 • ShiftRows k k k • SubBytes k k k k k k k 0,3 k 3,3 3,2 3,1 3,0 2,3 2,2 2,0 1,3 1,0 • MixColumns Block Ciphers Update 4 × 4 state of bytes k 2,1

Current state of key recovery attacks for AES-128 0 6 7 8 10 There are many more attacks with different trade-offs of time/data/memory. 19 Block Ciphers 2 126 . 18 [BKR11] 2 44 [Fer+00] 2 99 [DFJ13] 2 125 . 34 [BKR11]

Stream Ciphers

Plaintext Ciphertext Keystream • Encrypts individual digits . • IV to have multiple key stream for each K • Requires no padding. • Often used for low-bandwidth communication. 20 Stream Ciphers Key IV E

Widely found in practice • GSM standard (A5/1, A5/2) • LTE (SNOW 3G, ZUC) • Bluetooth (E0) • TLS protocol (RC4, ChaCha20) 21 Stream Ciphers

eSTREAM Project (EU) ...promote the design of efficient and compact stream ciphers suitable for widespread adoption... Software Hardware HC-128 Grain v1 Rabbit MICKEY 2.0 Salsa20/12 Trivium SOSEMANUK 22 Stream Ciphers Goal

23 1 4 5 6 7 8 0 2 LFSR-based Constructions, e.g. A5/1 3 4 5 6 7 8 3 2 1 2 • Load IV and Key in registers. • Shift registers depending on values in . • Produces 1-bit output in each iteration. 0 1 3 0 4 5 6 7 8 Stream Ciphers 9 10 11 12 13 14 15 16 17 18 9 10 11 12 13 14 15 16 17 18 19 20 21 9 10 11 12 13 14 15 16 17 18 19 20 21 22

Counter Mode (CTR) AES K AES K AES K … Keystream: Reusing nonce and counter gives same keystream. 24 Stream Ciphers N || 0 . . . 01 N || 0 . . . 02 N || 0 . . . 03 C 0 , . . . , C 127 C 128 , . . . , C 255 C 256 , . . . , C 383 Note

Salsa20 / ChaCha20 • ARX-based design • 512-bit state • Uses 256-bit key • 20 rounds • Fast in software • ChaCha20-Poly1305 in TLS 25 Stream Ciphers

Current state of key recovery attacks for Salsa20 0 5 6 7 8 20 For ChaCha typically one round less. 26 Stream Ciphers 2 8 [CM16] 2 244 . 9 [CM16] 2 32 [CM16] 2 137 [CM16]

Cryptographic Hash Functions

”There was of course no way of knowing whether you were being watched at any given moment. How often, or on what system, the Thought Police plugged in on any individual wire was guesswork. It was even conceivable that they watched everybody all the time. But at any rate they could plug in your wire whenever they wanted to. You had to live – did live, from habit that became instinct – in the assumption that every sound you made was overheard, and, except in darkness, every movement scrutinized.” WqNDAdcYgmyO 27 Hash Functions H