Introduction to Modern Cryptography Lecture 2 Symmetric Encryption

  • Slides: 37
Download presentation
Introduction to Modern Cryptography Lecture 2 Symmetric Encryption: Stream & Block Ciphers

Introduction to Modern Cryptography Lecture 2 Symmetric Encryption: Stream & Block Ciphers

Stream Ciphers • Start with a secret key (“seed”) • Generate a keying stream

Stream Ciphers • Start with a secret key (“seed”) • Generate a keying stream • i-th bit/byte of keying stream is a function of the key and the first i-1 ciphertext bits. • Combine the stream with the plaintext to produce the ciphertext (typically by XOR)

Example of Stream Encryption Key Stream Plaintext = Ciphertext

Example of Stream Encryption Key Stream Plaintext = Ciphertext

Example of Stream Decryption Key Stream Ciphertext = Plaintext

Example of Stream Decryption Key Stream Ciphertext = Plaintext

Real Cipher Streams • • Most pre-WWII machines German Enigma Linear Feedback Shift Register

Real Cipher Streams • • Most pre-WWII machines German Enigma Linear Feedback Shift Register A 5 – encrypting GSM handset to base station communication • RC-4 (Ron’s Code)

Terminology Stream cipher is called synchronous if keystream does not depend on the plaintext

Terminology Stream cipher is called synchronous if keystream does not depend on the plaintext (depends on key alone). Otherwise cipher is called asynchronous.

Current Example: RC-4 • Part of the RC family • Claimed by RSA as

Current Example: RC-4 • Part of the RC family • Claimed by RSA as their IP • Between 1987 and 1994 its internal was not revealed – little analytic scrutiny • Preferred export status • Code released anonymously on the Internet • Used in many systems: Lotus Notes, SSL, etc.

RC 4 Properties • Variable key size stream cipher with byte oriented operations. •

RC 4 Properties • Variable key size stream cipher with byte oriented operations. • Based on using a random looking permutation. • 8 -16 machine operations per output byte. • Very long cipher period (over 10100). • Widely believed to be secure. Used for encryption in SSL web protocol.

RC-4 Initialization 1. j=0 2. S 0=0, S 1=1, …, S 255=255 3. Let

RC-4 Initialization 1. j=0 2. S 0=0, S 1=1, …, S 255=255 3. Let the key be (bytes) k 0, …, k 255 (repeating bits if necessary) 4. For i=0 to 255 • • j = (j + Si+ ki) mod 256 Swap Si and Sj

RC-4 Key-stream Creation Generate an output byte B by: • i = (i+1) mod

RC-4 Key-stream Creation Generate an output byte B by: • i = (i+1) mod 256 • j = (j +Si) mod 256 • Swap Si and Sj • t = (Si + Sj) mod 256 • B = St B is XORed with next plaintext byte

Block Ciphers • Encrypt a block of input to a block of output •

Block Ciphers • Encrypt a block of input to a block of output • Typically, the two blocks are of the same length • Most symmetric key systems block size is 64 • In AES block size is 128 • Different modes for encrypting plaintext longer than a block

Real World Block Ciphers • • DES, 3 -DES AES (Rijndael) RC-2 RC-5 IDEA

Real World Block Ciphers • • DES, 3 -DES AES (Rijndael) RC-2 RC-5 IDEA Blowfish, Cast Gost

ECB Mode Encryption (Electronic Code Book) P 1 P 2 P 3 Ek Ek

ECB Mode Encryption (Electronic Code Book) P 1 P 2 P 3 Ek Ek Ek C 1 C 2 C 3 encrypt each plaintext block separately

Properties of ECB • • Simple and efficient Parallel implementation possible Does not conceal

Properties of ECB • • Simple and efficient Parallel implementation possible Does not conceal plaintext patterns Active attacks are possible (plaintext can be easily manipulated by removing, repeating, or interchanging blocks).

CBC Mode Encryption (Cipher Block Chaining) S 0 P 1 P 2 P 3

CBC Mode Encryption (Cipher Block Chaining) S 0 P 1 P 2 P 3 Ek Ek Ek C 1 C 2 C 3 Previous ciphertext is XORed with current plaintext before encrypting current block. An initialization vector S 0 is used as a “seed” for the process. Seed can be “openly” transmitted.

Properties of CBC • • • Asynchronous stream cipher Errors in one ciphertext block

Properties of CBC • • • Asynchronous stream cipher Errors in one ciphertext block propagate Conceals plaintext patterns No parallel implementation known Plaintext cannot be easily manipulated. Standard in most systems: SSL, IPSec etc.

OFB Mode (Output Feed. Back) An initialization vector s 0 is use as a

OFB Mode (Output Feed. Back) An initialization vector s 0 is use as a ``seed'’ for a sequence of data blocks si

Properties of OFB • • • Synchronous stream cipher Errors in ciphertext do not

Properties of OFB • • • Synchronous stream cipher Errors in ciphertext do not propagate Pre-processing is possible Conceals plaintext patterns No parallel implementation known Active attacks by manipulating plaintext are possible

AES Proposed Modes • CTR (Counter) mode (OFB modification): Parallel implementation, offline preprocessing, provable

AES Proposed Modes • CTR (Counter) mode (OFB modification): Parallel implementation, offline preprocessing, provable security, simple and efficient • OCB (Offset Codebook) mode - parallel implementation, offline preprocessing, provable security (under specific assumptions), authenticity

Strengthening a Given Cipher • Design multiple key lengths – AES • Whitening -

Strengthening a Given Cipher • Design multiple key lengths – AES • Whitening - the DESX idea • Iterated ciphers – Triple DES (3 -DES), triple IDEA and so on

Triple Cipher - Diagram P Ek 1 Ek 2 Ek 3 C

Triple Cipher - Diagram P Ek 1 Ek 2 Ek 3 C

Iterated Ciphers • Plaintext undergoes encryption repeatedly by underlying cipher • Ideally, aach stage

Iterated Ciphers • Plaintext undergoes encryption repeatedly by underlying cipher • Ideally, aach stage uses a different key • In practice triple cipher is usually C= Ek 1(Ek 2(Ek 1(P))) [EEE mode] or C= Ek 1(Dk 2(Ek 1(P))) [EDE mode] EDE is more common in practice

Necessary Condition • For some block ciphers iteration does not enhance security • Example

Necessary Condition • For some block ciphers iteration does not enhance security • Example – substitution cipher • Consider a block cipher: blocks of size b bits, and key of size k • The number of all possible functions b b 2 mapping b bits to b bits is (2 )

(. Necessary Condition (cont • The number of all possible encryption functions (bijections) is

(. Necessary Condition (cont • The number of all possible encryption functions (bijections) is 2 b! • The number of encryption functions in our cipher is at most 2 k. • Claim: The bijections are a group G under the operation (composition) • Claim: If the encryptions of a cipher form a subgroup of G then iterated cipher does not increases security.

Meet in the Middle Attack • Double ciphers are rarely used due to this

Meet in the Middle Attack • Double ciphers are rarely used due to this attack • Attack requires – Known plaintext – 2 k+1 encryptions and decryptions – |k|2|k| storage space • A square root of trivial attacking time at the expense of storage

(. Meet in the Middle (cont • Given a plaintext-ciphertext pair (p, c) –

(. Meet in the Middle (cont • Given a plaintext-ciphertext pair (p, c) – Compute & store the table of Dk 2(c) for all k 2 takes 2 k decryptions, |k|2|k| storage. – For every k 1, test if Ek 1(p) is in table – Every hit gives a possible k 1, k 2 pair – May have to repeat several times • Meet in the middle is applicable to any iterated cipher, reducing the trivial processing time by 2 k encryptions

Two or Three Keys • Sometimes only two keys are used in 3 -DES

Two or Three Keys • Sometimes only two keys are used in 3 -DES • Identical key must be at beginning and end • Legal advantage (export license) due to smaller overall key size • Used as a KEK in the BPI protocol which secures the DOCSIS cable modem standard

Adversary’s Goals • Final goal: recover key • Intermediate goals: – Reduce key space

Adversary’s Goals • Final goal: recover key • Intermediate goals: – Reduce key space – Discover plaintext patterns – Recover portions of plaintext – Change ciphertext to produce meaningful plaintext, without breaking the system (active attack)

Generic Attacks • Exhaustive search – Type: ciphertext only – Time: 2|k| decryptions per

Generic Attacks • Exhaustive search – Type: ciphertext only – Time: 2|k| decryptions per ciphertext – Storage: constant • Table lookup – Type: chosen plaintext – Time: offline 2|k| decryptions, online constant – Storage: 2|k| ciphertexts

The Problem • Break ECB mode (known fixed cleartext header) • The idea: –

The Problem • Break ECB mode (known fixed cleartext header) • The idea: – Define f(k) = Enck(constant) – Invert f(k) • New Problem: Invert f

Time/Space Tradeoffs • 1 st Simple solution: – Time 2|k| - exhaustive search per

Time/Space Tradeoffs • 1 st Simple solution: – Time 2|k| - exhaustive search per message • 2 nd Simple solution: – Precompute all 2|k| values of f(k) – Store in lookup table (hash table) – Requires O(1) time per inversion – Requires space O(2|k|)

Hellman (again): can we do better? • If it so happened that f is

Hellman (again): can we do better? • If it so happened that f is a permutation: – Choose L=2|k|/2 random start points s 1, …, s. L – For every such point, compute ti=f(f(…f(si)…)), repeated L times. – Store a lookup table of values (ti, si), i=1, …, L, indexed by ti.

Searching for k given f(k) • Let s=x = f(k) • Repeat until f(x)

Searching for k given f(k) • Let s=x = f(k) • Repeat until f(x) = s, if f(x) = s then x = k – If x = ti for some i, let x = si – otherwise let x = f(x) • Claim: for an arbitrary permutation and arbitrary k, the probability that this inverts k is constant

? Why • Values of f(k) on a small cycle will be inverted •

? Why • Values of f(k) on a small cycle will be inverted • Consider what happens when we add the i’th chain (si, ti): – If we cover a constant times L new values then we’re done – If not, assume that the previous chains have covered less than a constant of the L 2 values • The uncovered values must themselves lie on chains whose average length is a constant times L (as all values lie on some chain) • Thus, we have a constant probability of covering at least a constant fraction of L new values

All this does not work when f is not a permutation • Hellman’s ingenious

All this does not work when f is not a permutation • Hellman’s ingenious idea: – Don’t invert f(x), invert g(f(x)) for some known random function g. – Obviously, if you can invert g(f(x)) then you can invert f(x). – Note that if f is not a permutation then g(f) is not a permutation either

Inverting g(f(x)) • Not a permutation: – Choose L=2|k|/3 random start points s 1,

Inverting g(f(x)) • Not a permutation: – Choose L=2|k|/3 random start points s 1, …, s. L – For every such point, compute ti=f(f(…f(si)…)), repeated L times. – Store a lookup table of values (ti, si), i=1, …, L, indexed by ti. • Claim: we cover by chains at least a constant fraction of L 2 = 22|k|/3 • Consider the last chain added, we’ve covered at most 22|k|/3 values until now, so with constant probability, the new L=2|k|/3 values on the new chain will be entirely new.

Hellman’s next idea • Use many different g’s – Every g will cover a

Hellman’s next idea • Use many different g’s – Every g will cover a random 22|k|/3 set of values. – So, choose L=2|k|/3 g’s • Space required: L 2 = 22|k|/3 • Time required: L 2 = 22|k|/3