Introduction to Cryptography David Brumley dbrumleycmu edu Carnegie

Introduction to Cryptography David Brumley dbrumley@cmu. edu Carnegie Mellon University Credits: Many slides from Dan Boneh’s June 2012 Coursera crypto class, which is great!

Cryptography is Everywhere Secure communication: – web traffic: HTTPS – wireless traffic: 802. 11 i WPA 2 (and WEP), GSM, Bluetooth Encrypting files on disk: EFS, True. Crypt Content protection: – CSS (DVD), AACS (Blue-Ray) User authentication – Kerberos, HTTP Digest … and much more 2

Goal: Protect Alice’s Communications with Bob Alice E message m = “I {Love, Hate} you” c Public Channel c D Bob Eve is a very powerful, smart person (say any polynomial time alg) 3

History of Cryptography David Kahn, “The code breakers” (1996) 4

Caesar Cipher: c = m + 3 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z Julius Caesar 100 BC- 44 BC 5

How would you attack messages encrypted with a substitution cipher? 6

Attacking Substitution Ciphers Trick 1: Word Frequency Most common: e, t, a, o, i, n Least common: j, x, q, z Trick 2: Letter Frequency image source: wikipedia 7

Jvl mlwclk yr jvl owmwez twp yusl w zyduo pjdcluj mqil zydkplmr. Hdj jvlz tykilc vwkc jy mlwku jvl wkj yr vwsiquo, tvqsv vlmflc mlwc jvlg jy oklwjulpp. Zyd vwnl jvl fyjlujqwm jy cy jvl pwgl. Zydk plsklj fwpptykc qp: JYWPJ http: //picoctf. com 8

Classical Approach: Iterated Design Scheme 1 Broken Scheme 2 Broken Scheme 3 Deploy Broken . . . No way to say anything is secure (and you may not know when broken) 9

Iterated design was only one we knew until 1945 Claude Shannon: 1916 - 2001 10

Claude Shannon • Formally define: – security goals – adversarial models – security of system wrt goals • Beyond iterated design: Proof! 11

Cryptosystem m Alice E ke Var m or error c Description m Message (aka plaintext). From the message space M c Ciphertext. From the ciphertext space C E Encryption Algorithm D Decryption Algorithm ke Encryption key. From the key space K kd Decryption. Also from the key space K c’ D Bob ke 12

Symmetric Cryptography m Alice E ke m or error c c’ D Bob ke • k = ke = kd • Everyone who knows k knows the full secret 13

Asymmetric Cryptography m Alice E m or error c ke c’ D Bob ke • ke != kd • Encryption Example: – Alice generates private (Kd)/public(Kd) keypair. Sends bob public key – To encrypt a message to Alice, Bob computes c = E(m, Ke) – To decrypt, Alice computes m = D(m, Kd) 14

But all is not encryption Message Authentication Code: Only people with the private key k could have sent the message. Alice S Message m “I love you, Bob” s = Sign(m, Ksign) m||s V Bob Verify(m, s, Kverify) =? = true Eve (tries to alter m without detection) 15

An interesting story. . . 16

1974 • A student enrolls in the Computer Security course @ Stanford • Proposes idea for public key crypto. Professor shoots it down Picture: http: //www. merkle. com 17

1975 • Submits a paper to the Communications of the ACM • “I am sorry to have to inform you that the paper is not in the main stream of present cryptography thinking and I would not recommend that it be published in the Communications of the ACM. Experience shows that it is extremely dangerous to transmit key information in the clear. " 18

Today Ralph Merkle: A Father of Cryptography Picture: http: //www. merkle. com 19

Covered in this class everyone shares same secret k Only 1 party has a secret Symmetric Trust Model Asymmetric Trust Model Message Privacy Private key encryption • Stream Ciphers • Block Ciphers Asymmetric encryption (aka public key) Message Authenticity and Integrity Message Authenticity Code (MAC) Digital Signature Scheme Principle 1: All algorithms public Principle 2: Security is determined only by key size Principle 3: If you roll your own, it will be insecure 20

Security Goals m or error m Alice E c Public Channel ke c’ D Bob ke Eve Cryptonium Pipe read access One Goal: Privacy Eve should not be able to learn m. 21

Not even 1 bit. . . Alice M = “I {Love, Hate} you” (read access) Bob Eve Suppose there are two possible messages that differ on one bit, e. g. , guarantees whether Alice Loveshold or Hates Bob. Security should for all messages, not just a particular kind of message. Privacy means Eve still should not be able to determine which message was sent. 22

Alice Bob Eve • • • Eve’s Powers Ciphertext Only Known Plaintext Attack (KPA) Chosen Plaintext Attack (CPA) Known Ciphertext Attack (KCA) Chosen Ciphertext Attack (CCA) 23

Symmetric Cryptography Defn: A symmetric key cipher consists of 3 polynomial time algorithms: 1. Key. Gen(l): A randomized algorithm that returns a key of length l. l is called the security parameter. 2. E(k, m): A potentially randomized alg. that encrypts m with k. It returns a c in C 3. D(k, c): An always deterministic alg. that decrypts c with key k. It returns an m in M. And (correctness condition) Type Signature 24

The One Time Pad Miller, 1882 and Vernam, 1917 M = C = K = {0, 1}n m: k: 0 1 1 0 0 0 c: 1 0 1 1 0 k: m: 1 0 1 1 0 0 25

The One Time Pad Miller, 1882 and Vernam, 1917 Is it a cipher? ü Efficient ü Correct 26

Question Given m and c encrypted with an OTP, can you compute the key? 1. No 2. Yes, the key is k = m ⊕ c 3. I can only compute half the bits 4. Yes, the key is k = m ⊕ m 27

Perfect Secrecy [Shannon 1945] (Information Theoretic Secrecy) Defn Perfect Secrecy (informal): We’re no better off determining the plaintext when given the ciphertext. Alice Bob Eve 1. Eve observes everything but the c. Guesses m 1 2. Eve observes c. Guesses m 2 Goal: 28

Example Alice Bob Eve Suppose there are 3 possible messages Alice may send: • m 1: The attack is at 1 pm. The probability of this message is 1/2 • m 2: The attack is at 2 pm. The probability of this message is 1/4 • m 3: The attack is at 3 pm. The probability of this message is 1/4 M m 1 m 2 m 3 Pr[M=m] ½ ¼ 1/4 29

Perfect Secrecy [Shannon 1945] (Information Theoretic Secrecy) Defn Perfect Secrecy (formal): 30

Question How many OTP keys map m to c? 1. 1 2. 2 3. Depends on m 31

Good News: OTP has Perfect Secrecy Thm: The One Time Pad is Perfectly Secure Must show: where |M| = {0, 1}m Intuition: Say that M = {00, 01, 10, 11}, and m = 11. The adversary receives c = 10. It asks itself whether the plaintext was m 0 or m 1 (e. g. , 01 or 10). It reasons: • if m 0, then k = m 0 c = 01 10 = 11. • if m 1, then k = m 1 c = 10 = 00. But all keys are equally likely, so it doesn’t know which case it could be. 32

Good News: OTP has Perfect Secrecy Thm: The One Time Pad is Perfectly Secure Must show: where |M| = {0, 1}m Proof: 33

Two Time Pad is Insecure Two Time Pad: c 1 = m 1 k c 2 = m 2 k Enough redundancy in ASCII (and english) that m 1 m 2 is enough to know m 1 and m 2 Eavesdropper gets c 1 and c 2. What is the problem? c 1 c 2 = m 1 m 2 34

The “Bad News” Theorem: Perfect secrecy requires |K| >= |M| In practice, we usually shoot for computational security. 35

The OTP provides perfect secrecy. . . . But is that enough? 36

No Integrity Eve enc ( ⊕k ) m m⊕k evil m ⊕? evil dec ( ⊕k ) ⊕ m ⊕ k? ⊕ evil 37

No Integrity Eve enc ( ⊕k ) From: Bob 00 00 00 07 19 07 From: Eve dec ( ⊕k ) ⊕ From: Eve 38

Security Goals m or error m Alice E c Public Channel ke c’ D Bob ke Eve read/write access Goal 2: Integrity Eve should not be able to alter m without detection. 39

Detecting Flipped Bits Alice M = “I {Love, Hate} you” (read/write) Eve Bob Receives M’ Bob should be able to determine if M=M’ Ex: Eve should not be able to flip Alice’s message without detection (even when Eve doesn’t know content of M) 40

m or error m Alice E c Public Channel ke c’ D Bob ke Eve read/write access Goal 3: Authenticity Eve should not be able to forge messages as Alice 41

Detecting Flipped Bits Alice M = “I Love you, signed Alice” (read/write) Bob Eve Bob should be able to determine M wasn’t sent from Alice 42

m or error m Alice E c Public Channel ke c’ D Bob ke Eve read/write access Cryptonium Pipe Goals: Privacy, Integrity, and Authenticity 43

Summary • Cryptography is a awesome tool – But not a complete solution to security – Authenticity, Integrity, Secrecy • Perfect secrecy and OTP – Good news and Bad News 44

Questions? 45

END

Stream Ciphers Continuous stream of data 47

Block Ciphers Block of data Server No eavesdropping No tampering Analogous to secure communication: Alice today sends a message to Alice tomorrow 48

M Alice Public Channel M Bob Cryptonium Pipe Goals: Privacy, Integrity, and Authenticity 49

50

But crypto can do much more • Digital signatures Alice signature 51

But crypto can do much more • Digital signatures • Anonymous communication Who did I just talk to? Bob 52

But crypto can do much more • Digital signatures • Anonymous communication • Anonymous digital cash – Can I spend a “digital coin” without anyone knowing who I am? – How to prevent double spending? 1$ Internet Who was that? (anon. comm. ) 53

Cryptosystem m E ke c kd c’ Alice Bob D m or error E: Encryption Algorithm ke: Encryption Key D: Decryption Algorithm kd: Decryption Key Algorithms: Standardized and Public 54

Cryptosystem m E ke Alice c kd c’ Bob D m or error E: Encryption Algorithm ke: Encryption Key D: Decryption Algorithm kd: Decryption Key Private. Length of key determines security 55

Symmetric and Asymmetric Cryptosystem m E ke Alice c kd c’ Bob D m or error E: Encryption Algorithm ke: Encryption Key D: Decryption Algorithm kd: Decryption Key Symmetric (shared key) : ke = kd Asymmetric (public key) : ke public, kd private 56

Quiz • What were three properties crypto tries to achieve? 1. Privacy 2. Integrity 3. Authenticity 57

A rigorous science The three steps in cryptography: 1. Precisely specify threat model 2. Propose a construction 3. Prove that breaking construction under threat mode will solve an underlying hard problem Mathematical properties in terms of security parameter 58

A rigorous science The three steps in cryptography: 1. Precisely specify threat model Mathematical The #1 Rule 2. Propose a construction properties in Never your own crypto. terms of 3. Prove thatrole breaking security construction underyour own protocol) (including inventing parameter k threat mode will solve an underlying hard problem 59

Computer Security Domain of Security Problems Math Crypto • How do write software that can protect private information like K e, KD? • How do we know implementation of E and D are correct? • How do we build networks that are secure, reliable, and available? • How do we ensure only Alice can access her keys? 60

History of Cryptography David Kahn, “The code breakers” (1996) 61

Early History: Substitution Cipher • Ke = Kd = π: Σ Σ • e. g. , Σ = {a, b, c, . . . } or {1, 2, 3, . . } etc. • π is a permutation σ A π(σ) E B A C Z Complete Insecure! D U Eπ(CAB) = π(C) π(A) π(B) =Z EA Dπ(ZEA) = π-1 (Z) π-1 (E) π-1(A) =CAB 62

Attacking Substitution Ciphers • How would you break a message encrypted with the substitution cipher? • Analyze the ciphertext (CT attack)! • Frequency of letters – “e” 12. 7%, “t” 9. 1%, “a” 8. 1%, . . . • Pairs of letters: “he”, “an”, “in”, “th”, . . . 63

An Example UKBYBIPOUZBCUFEEBORUKBYBHOBBRFESPVKBWFOFERVNBCVBZPRU BOFERVNBCVBPCYYFVUFOFEIKNWFRFIKJNUPWRFIPOUNVNIPUBRNCU KBEFWWFDNCHXCYBOHOPYXPUBNCUBOYNRVNIWNCPOJIOFHOPZRVF ZIXUBORJRUBZRBCHNCBBONCHRJZSFWNVRJRUBZRPCYZPUKBZPUNVP WPCYVFZIXUPUNFCPWRVNBCVBRPYYNUNFCPWWJUKBYBIPOUZBCUIP OUNVNIPUBRNCHOPYXPUBNCUBOYNRVNIWNCPOJIOFHOPZRNCRVNBC UNENVVFZIXUNCHPCYVFZIXUPUNFCPWZPUKBZPUNVR B 36 E NC 11 IN UKB 6 N 34 PU 10 AT U 6 UB 10 P 33 T 32 A RVN UN 9 C 26 digrams THE FZI 4 trigrams 64

WWII: Enigma Broken by an effort led by our friend Alan Turing 65

Classical Approach: Iterated Design Scheme 1 Broken Scheme 2 Broken Scheme 3 Deploy Broken . . . No way to say anything is secure (and you may not know when broken) 66

Iterated design was only one known until 1945 67

Claude Shannon: 1916 - 2001 • Modern Cryptography: 1945 with Shannon • Formally define security goals, adversarial models, and security of system • Beyond iterated design: Proof by reduction that cryptosystem achieves goals 68

Proving Information Theoretic Secrecy Given: Fact: So, if Then perfectly secure. 69

Stream Ciphers PRNG’s and amplifying secrets 70

Amplifying Randomness Problem: Perfect cipher requires |K| >= |M| To make practical: replace “random” key with “pseudo-random” key generated by a pseudo-random (number) generator (PRG) 71

Stream Ciphers: A Practical OTP k PRG expansion G(k) m c 72

Question Can a stream cipher have perfect secrecy? • Yes, if the PRG is secure • No, there are no ciphers with perfect secrecy • No, the key size is shorter than the message 73

PRG Security One requirement: Output of PRG is unpredictable (mimics a perfect source of randomness) Suppose PRG is predictable: Even predicting 1 bit is insecure Then insecure. predict these bits of insecure G gives i bits G(k) From m From c 74

PRG Security Goal: Output of PRG is unpredictable (mimics a perfect source of randomness) Predictable: PRG G is predictable if there is an efficient alg Adv for non-negligible ε (for now, ε> 1/230) Unpredictable: PRG is unpredictable if not predictable for all i 75

Negligible Functions Practical: Something is negligible if it is very small constant. – Non-negligible: 230 (one GB of data) – Negligible: 280 (age of universe in seconds: 260) Formally: A function ε: Z≥ 0 R≥ 0 is negligible if it approaches 0 faster than the reciprocal of any polynomial. 76

Weak PRGs • Linear congruence generators – Look random (see Art of Programming) – But are predictable • GNU libc random() – Kerberos v 4 did and was broken 77

Two Time Pad is Insecure Two Time Pad: c 1 = m 1 k c 2 = m 2 k Enough redundancy in ASCII (and english) that m 1 m 2 is enough to know m 1 and m 2 Eavesdropper gets c 1 and c 2. What is the problem? c 1 c 2 = m 1 m 2 78

Real World Examples • Project Venona (~1942 -1945) – Russians used same OTP twice break by American and British cryptographers • WEP 802. 11 b • Disk Encryption • MS-PPTP (Windows NT) 79

WEP 802. 11 b Only IV changed per message m k Wireless Card crc(m) PRG(IV || k) IV c k Access Point Length of IV: 24 bits – Repeat after 224 ≈ 16 M frames – Some cards reset to 0 after power cycle – Best attacks reduce to 106 80

A better approach PRG(k) k . . . m 1 m 2 Wireless Card PRG output different per message k Access Point Each message has a unique key Best method: use WPA 2 81

Disk Encryption Dear Alice: m 1 You are my sunshine. Dear Grace: m 2 You are my sunshine. m 1 k Dear Alice: You are my sunshine. m 2 k Dear Grace: You are my sunshine. Attacker knows where messages are same, and where different! 82

Two Time Pad Never use the same stream cipher key twice! – Network traffic: Pick a new key each time, and a separate key for client and server – Disk encryption: don’t use stream cipher 83

b Chal. k K m 0 , m 1 M : |m 0| = |m 1| Adv. A c E(k, mb) b’ {0, 1} for b=0, 1: Wb : = [ event that EXP(b)=1 ] Adv. SS[A, E] : = | Pr[ W 0 ] − Pr[ W 1 ] | ∈ [0, 1] Security for: • Chosen Plaintext Attack (CPA) • IND-CPA Game 84

OTP is semantically secure b Chal. k K m 0 , m 1 M : |m 0| = |m 1| c k ⊕m 0 Adv. A or c k⊕m 1 b’ {0, 1} For all A: Adv. SS[A, OTP] = | Pr[ A(k⊕m 0)=1 ] − Pr[ A(k⊕m 1)=1 ] | =0 85