Cryptography Tuomas Aura T110 4206 Information security technology

Cryptography Tuomas Aura T-110. 4206 Information security technology Aalto University, autumn 2012

Outline § Symmetric encryption § Public-key encryption § Cryptographic authentication Most important! Brief introduction to encryption and authentication for those who do not plan to take a specialized course on cryptography. 2

Security vs. cryptography § Cryptography: mathematical methods for encryption and authentication § In this course, we use cryptography as one building block for security mechanisms § However: “Whoever thinks his problem can be solved using cryptography, doesn’t understand the problem and doesn’t understand cryptography. ” — attributed to Roger Needham and Butler Lampson 3

SYMMETRIC ENCRYPTION 4

Encryption § Message encryption based on symmetric cryptography – Endpoints share a secret key K – Block ciphers, stream ciphers § Notations: EK(M), E(K; M) , {M}K, K{M} § Protects confidentiality, not integrity 5

Pseudoradom permutation Key K 2128 plaintexts Pseudorandom permutation 2128 ciphertexts § Ideal encryption is a random 1 -to-1 function (i. e. permutation) of the set of all strings (up to some maximum length) § Decryption is the reverse function § Impossible to store random permutation functions. What to do? – Block cipher: limit string length to 64– 256 bits – Choose the permutation from a family of permutation functions based on a secret key § Kerckhoff’s principle: public algorithm, secret key 6

Substitution-permutation network § One way to implement a keydependent pseudorandom permutation § Substitution-permutation network: – S-box = substitution is a small (random) 1 -to-1 function for a small block, e. g. 24… 216 values – P-box = bit-permutation mixes bits between the small blocks – Repeat for many rounds, e. g. 8… 100 – Mix key bits with data in each round – Decryption is the reverse § Cryptanalysis tries to detect differences between this and a true pseudorandom permutation [Wikimedia Commons] 7

AES § Advance Encryption Standard (AES) – Standardized by NIST in 2001 – 128 -bit block cipher – 128, 192 or 256 -bit key – 10, 12 or 14 rounds § AES round: – Sub. Bytes: 8 -byte S-box, not really random, based on finite-field arithmetic, multiplication in GF(28) – Shift. Rows and Mix. Column: reversible linear combination of S-box outputs (mixing effect similar to P-box) – Add. Round. Key: XOR bits from expanded key with data § Key schedule: expands key to round keys 9

Cipher modes § When message is longer than one block, cannot just chop it into blocks and encrypt them independently of each other (why? ) § Need a block-cipher mode, e. g. cipher-block chaining (CBC) § Random initialization vector (IV) makes ciphertexts different even if the message repeats § Message is padded to full blocks, or longer to hide plaintext length [Wikimedia Commons] 10

PUBLIC-KEY ENCRYPTION 12

Public-key encryption § Message encryption based on asymmetric crypto – Key pair: public key and private key § Notation: PK, SK, PK-1, K+, K- ; EB(M), PK{M}, {M}PK 13

RSA encryption § RSA encryption, published 1978 – Based on modulo arithmetic with large intergers § Slightly simplified description of the algorithm: – – – – p, q = large secret prime numbers (512… 1024 bits) Public modulus n = pq Euler totient function ϕ(n) = (p-1)(q-1) Public exponent e, e. g. e=2^16+1 ed ≡ 1 (mod ϕ(n)), solve for secret exponent d Encryption C = Me mod n Decryption M = Cd mod n Why does it work? Proof based on Euler’s theorem about the totient function § This is not all; for complete details, see PKCS#1 14

ASN. 1 type tags § 30 a 8 38 9 e cc 53 2 f 03 aa ca 29 51 e 0 52 cc e 3 ef 2 a Example: RSA public key 82 72 a 7 d 6 7 b e 0 5 f 60 be a 0 1 a 20 81 24 b 0 f 6 ef 01 01 25 12 13 c 5 ff 7 d 3 e 61 63 06 01 89 29 b 0 13 df e 0 0 a 3 c 77 90 a 6 10 b 6 3 f 91 47 98 ad d 2 97 94 37 7 b 05 02 6 b dc 3 d 18 2 e 9 b 0 b d 0 bd 2 d 1 c b 7 37 86 d 9 7 b 36 82 a 4 cf 9 f 4 f cd 40 ff 9 d b 1 5 a 9 e ba 8 c 06 fb 79 26 01 14 62 72 d 5 ed 41 83 5 d 7 c 47 4 e cd 6 e 9 c 23 2 e 6 a 01 54 bc aa 86 4 a 4 f d 5 96 32 d 4 ad 68 36 13 9 d f 9 98 00 24 de 42 a 4 4 c f 7 a 9 4 f 27 05 39 2 e 31 02 e 7 75 bb c 7 e 7 47 32 9 e a 8 a 9 3 b 75 1 b b 3 f 4 62 bd 27 c 7 37 d 3 3 a e 0 a 2 45 fb 45 9 b 67 39 04 22 d 1 b 3 9 d c 5 d 5 8 a 02 73 ab 55 c 4 42 d 9 7 a 11 fb 35 3 f ae d 7 3 d 7 c ce c 1 03 01 47 34 4 a 5 f 88 95 59 e 7 5 a fd 90 ad 1 d 1 e 94 ef 01 2048 -bit modulus f 3 2 e a 6 b 7 37 09 d 4 d 7 59 5 e 43 7 d 00 4 c 2 e 54 a 5 00 2 e 9 f 47 88 47 cd a 4 8 c ca e 3 38 f 9 4 c 4 c f 6 7 d c 1 01 public exponent (216+1) 15

Hybrid encryption § Symmetric encryption is fast; asymmetric is convenient § Hybrid encryption = symmetric encryption with random session key + asymmetric encryption of the session key 16

Key distribution § Main advantage of public-key cryptography is easier key distribution § Shared keys, symmetric cryptography: – O(N 2) pairwise keys needed for N participants → does not scale – Keys must be kept secret → hard to distribute safely § Public-key protocols, asymmetric cryptography: – N key pairs needed, one for each participant – Keys are public → can be posted on the Internet § Both kinds of keys must be authentic – How does Alice know it shares KAB with Bob, not with Trent? – How does Alice know PKB is Bob’s public key, not Trent’s? 17

Formal security definitions § Cryptographic security definitions for asymmetric encryption § Semantic security (security against passive attackers) – Computational security against a ciphertext-only attack § Ciphertext indistinguishability (active attackers) – IND-CPA — attacker submits two plaintexts, receives one of them encrypted, and is challenged to guess which it is ⇔ semantic security – IND-CCA — indistinguishability under chosen ciphertext attack i. e. attacker has access to a decryption oracle before the challenge – IND-CCA 2 — indistinguishability under adaptive chosen ciphertext attack i. e. attacker has access to a decryption oracle before and after the challenge (except to decrypt the challenge) § Non-malleability – Attacker cannot modify ciphertext to produce a related plaintext – NM-CPA ⇒ IND-CPA; NM-CCA 2 ⇔ IND-CCA 2 § Nontrivial to choose the right kind of encryption for your application; ask a cryptographer! 18

CRYPTOGRAPHIC AUTHENTICATION 19

Cryptographic hash functions § Message digest, fingerprint § Hash function: arbitrary-length input, fixed-length output § One-way = pre-image resistant: given only output, impossible to guess input § Second-pre-image resistant: given one input, impossible to find a second input that produces the same output § Collision-resistant: impossible to find any two inputs that produce the same output § Examples: MD 5, SHA-1, SHA-256 § Notation: h(M), hash(M) 20

Hash collisions § 128– 160– 256 -bit hash values to prevent birthday attack § Recent research has found collisions in standard hash functions (MD 5, SHA-1) § Currently, any protocol that depends on collisionresistance needs a contingency plan in case collisions are found § Security proofs for many cryptographic protocols and signature schemes depend on collision resistance because it is part of the standard definition for hash functions § However, most network-security applications of hash functions do not really need collision resistance, only second-pre-image resistance 21

Message authentication code (MAC) § Message authentication and integrity protection based on symmetric cryptography – Endpoints share a secret key K – MAC appended to the original message M – Common implementations: HMAC-SHA 1, HMAC-MD 5 § Notations: MACK(M), MAC(K; M), HMACK(M) 22

HMAC § HMAC is commonly used in standards: – Way of deriving MAC from any cryptographic hash function h HMACK(M) = h((K ⊕ opad) ‖ h((K ⊕ ipad) ‖ M)) – Hash function h is instantiated with SHA-1, MD 5 etc. to produce HMAC-SHA-1, HMAC-MD 5, … – ⊕ is XOR; ‖ is concatenation of byte strings – ipad and opad are fixed bit patterns – Details: [RFC 2104][Bellare, Canetti, Krawczyk Crypto’ 96] * § HMAC is theoretically stronger than simpler constructions: h(M ‖ K), h(K ‖ M ‖ K) § HMAC is efficient for long messages; optimized for precomputation § Discussion: does h need to be collision resistant? 23

Digital signature (1) § Message authentication and integrity protection with public-key crypto – – Verifier has a public key PK ; signer has the private key PK-1 Key pair is often associated with a user: PKA , PK-1 A Messages are first hashed and then signed Examples: DSS, RSA + SHA-256 24

Message size § Authentication increases the message size: – MAC takes 16– 32 bytes – 1024 -bit RSA signature is 128 bytes § Encryption increases the message size: – In block ciphers, messages are padded to nearest full block – IV for block cipher takes 8– 16 bytes – 1024 -bit RSA encryption of the session key is 128 bytes § Overhead of headers, type tags etc. § Size increase ok for most applications; possible exceptions: – Signing individual IP packets (1500 bytes) – Authenticating data on wireless connections – Encrypting file system sector by sector 26

How strong is cryptography? § Cryptographer: continuous analysis and improvement § Engineer: unbreakable if you use strong standard algorithms and 128 -bit symmetric keys – Weak crypto is worse than no crypto – May need to upgrade algorithms over decades – Hardly any excuse to use a relatively weak algorithm, even in resource constrained devices – Avoid using algorithms in a creative way, different from their original purpose § Which algorithms can be trusted? – Block ciphers have withstood time well – Hash functions were considered safe until… – Quantum computers could break public-key crypto § Almost no absolute proofs of security exist! 27

Reading material § Stallings and Brown: Computer security, principles and practice, 2008, chapters 2, 19, 20 § Ross Anderson: Security Engineering, 2 nd ed. , chapter 5 § Dieter Gollmann: Computer Security, 2 nd ed. , chapter 11; 3 rd ed. chapter 14 § Stallings: Cryptography and Network Security: Principles and Practices, 3 rd or 4 th edition, Prentice Hall, chapters 2 -3 28

Exercises § What kind of cryptography would you use to – – – protect files stored on disk store client passwords on server disk implement secure boot protect email in transit publish an electronic book implement an electronic bus ticket identify friendly and enemy aircraft (“friend or foe”) sign an electronic contract transmit satellite TV protect software updates send pseudonymous letters timestamp an invention § Which applications require strong collision resistance of hash functions? What attacks have resulted from collisions in MD 5? § Find out about DES cracking; why is DES vulnerable and how much security would it give today? 29