Part 1 Instruction of Network Security 3 3

Part 1 網路安全概論 Instruction of Network Security 3

3. 網路安全需求 • 四大需求： 資料的保密性 (Confidentiality) 資料的完整性 (Integrity) 確認性 (Authentication) 不可否認性 (Nonrepudiation) 18

4. 加密技術 1. 對稱加密法 l （私密金匙加密法，單一金匙加密法） 主要技術： 替代（Substitution）、置換（permutation） 主要 具： DES (Data Encryption System)、 IDEA (International Data Encryption Algorithm)、 AES (Advanced Encryption Standard) 23

5. 雜湊函數(Hash Function) 是一種單向函數(one way Function) 主要技術： X, Y, one way function H 1. H(X) Y is easy But give Y to get X, H-1(Y) X is computing infeasibility. 2. X is variable length, but Y is fixed length (128 bits, 160 bits or more) 29

5. 雜湊函數-1 主要 具： DES, MD 5, SHA-1, SHA-256 主要方法： 明文M=M 1, M 2, M 3…Mn, Mn is padded to m bits m is the size of Mi, 64, 128, or 160 bits Initial Key (Vector) k 1, Digest D Ki+1=Hki(Mi), i=1~n, D=kn+1 30

7. 電子證書 主要技術： X. 509 Certificates issued by the Trust Third Party (TTP) or Certification Authority (CA) 37

Part 2 網路安全技術 The Technology of Network Security 40

Substitution Cipher l Caesar Cipher (Julius Caesar) l 最早的替代碼，用在軍令傳遞。 l 方法：每個字母以後面第三個字母代替。 每個字母由 0~25代表 l C=E(P)=(P+K) mod 26，K為密碼，安全性 容易破解，試 25次就可破解。 meet me after the toga party PHHW PH DIWHU WKH WRJD SDUWB 43

Substitution Cipher l Mono-alphabetic Cipher l 用對照表，將A~Z以唯一之随急對應對照之。 Plain: abcdefghijklmnopqrstuvwxyz Cipher: DKVQFIBJWPESCXHTMYAUOLRGZN Plaintext: ifwewishtoreplaceletters Ciphertext: WIRFRWAJUHYFTSDVFSFUUFYA 44

English Letter Frequencies 46

Substitution Cipher l 例: 密碼為 MONARCHY 密碼盒為 MONAR CHYBD EFGIK LPQST UVWXZ 48

Substitution Cipher MONAR CHYBD EFGIK LPQST UVWXZ 50

Substitution Cipher l Vigenere Cipher: l 最簡單的polyalphabetic Cipher. The keys: K 1, K 2, K 3, …. , , Km The plain text: P 1, P 2, P 3, …. , Pn The cipher text: C 1, C 2, C 3, …, Cn The rule of cipher is Ci = (Pi + Kj) mod 25, j = (i mod m ) + 1 53

Substitution Cipher l using keyword deceptive key: deceptivedeceptive plaintext: wearediscoveredsaveyourself ciphertext: ZICVTWQNGRZGVTWAVZHCQYGLMGJ 54

Substitution Cipher l 解決方法： l 密碼字串不重覆使用，若密碼不夠用時將 明文接在密碼串後，可增加破解困難度。 given key deceptive key: deceptivewearediscoveredsav plaintext: wearediscoveredsaveyourself Ciphertext: ZICVTWQNGKZEIIGASXSTSLVVWLA 56

Permutation (Transposition) Cipher l 換位技術、Permutation (Transposition) Cipher l 將明文之字母位置打亂, 使密文變成不可讀; 但不改變字母 57

Permutation (Transposition) Cipher l Rai 1 Fence Cipher: 最簡單的換位技術 l 將明文中之奇數位置字母與偶數字母分開 後再合併。 l write message out as: m e m a t r h t g p r y e t e f e t e o a a t l giving ciphertext MEMATRHTGPRYETEFETEOAAT 安全性：太簡單 58

Permutation (Transposition) Cipher l Row transposition ciphers l 設定一個N*M之格子，將明文一列列由上到 下寫入，讀出時依特定之順序（key）一行 一行讀出。 Key: 4 3 1 2 5 6 7 Plaintext: a t t a c k p o s t p o n e d u n t i l t w o a m x y z Ciphertext: TTNAAPTMTSUOAODWCOIXKNLYPETZ 59

63

Data Encryption Standard (DES) l most widely used block cipher in world l adopted in 1977 by NBS (now NIST) ¡ as FIPS PUB 46 l encrypts 64 -bit data using 56 -bit key l has widespread use l has been considerable controversy over its security 73

DES History l IBM developed Lucifer cipher ¡ by team led by Feistel ¡ used 64 -bit data blocks with 128 -bit key l then redeveloped as a commercial cipher with input from NSA and others l in 1973 NBS issued request for proposals for a national cipher standard l IBM submitted their revised Lucifer which was eventually accepted as the DES 74

DES Design Controversy l although DES standard is public l was considerable controversy over design ¡ in choice of 56 -bit key (vs Lucifer 128 -bit) ¡ and because design criteria were classified l subsequent events and public analysis show in fact design was appropriate l DES has become widely used, especially in financial applications 75

DES Encryption 76

Initial Permutation IP l first step of the data computation l IP reorders the input data bits l even bits to LH half, odd bits to RH half l quite regular in structure (easy in h/w) l see text Table 3. 2 l example: IP(675 a 6967 5 e 5 a 6 b 5 a) = (ffb 2194 d 004 df 6 fb) 77

78

DES Round Structure See fig. 3. 8 l uses two 32 -bit L & R halves l as for any Feistel cipher can describe as: l Li = Ri– 1 Ri = Li– 1 xor F(Ri– 1, Ki) l takes 32 -bit R half and 48 -bit subkey and: ¡ ¡ expands R to 48 -bits using perm E adds to subkey passes through 8 S-boxes to get 32 -bit result finally permutes this using 32 -bit perm P 79

80

DES Round Structure 81

Substitution Boxes S l have eight S-boxes which map 6 to 4 bits l each S-box is actually a 4 X 16 box ¡ outer bits 1 & 6 (row bits) select one rows ¡ inner bits 2 -5 (col bits) select one column, the content (4 bits) in this column is the substituted value (output) of this 6 bits input. ¡ result is 8 lots of 4 bits, or 32 bits See table 3. 3 l row selection depends on both data & key ¡ feature known as autoclaving (autokeying) l example: S(18 09 12 3 d 11 17 38 39) = 5 fd 25 e 03 82

83

DES Key Schedule l forms subkeys used in each round l consists of: ¡ initial permutation of the key (PC 1) which selects 56 -bits in two 28 -bit halves ¡ 16 stages consisting of: selecting 24 -bits from each half l permuting them by PC 2 for use in function f, l rotating each half separately either 1 or 2 places depending on the key rotation schedule K l See fig. 3. 7 and table 3. 4 84

85

86

DES Decryption l l l l l decrypt must unwind steps of data computation with Feistel design, do encryption steps again using subkeys in reverse order (SK 16 … SK 1) note that IP undoes final FP step of encryption 1 st round with SK 16 undoes 16 th encrypt round …. 16 th round with SK 1 undoes 1 st encrypt round then final FP undoes initial encryption IP thus recovering original data value 87

Avalanche Effect l key desirable property of encryption alg l where a change of one input or key bit results in changing approx half output bits l making attempts to “home-in” by guessing keys impossible l DES exhibits strong avalanche see table 3. 5 88

89

Strength of DES – Key Size l 56 -bit keys have 256 = 7. 2 x 1016 values l brute force search looks hard l recent advances have shown is possible ¡ in 1997 on Internet in a few months ¡ in 1998 on dedicated h/w (EFF) in a few days ¡ in 1999 above combined in 22 hrs! l still must be able to recognize plaintext l now considering alternatives to DES 90

Modes of Operation l l l block ciphers encrypt fixed size blocks eg. DES encrypts 64 -bit blocks, with 56 -bit key need way to use in practise, given usually have arbitrary amount of information to encrypt five were defined for DES in ANSI standard ANSI X 3. 106 -1983 Modes of Use have block and stream modes ECB, CBC, CFB, OFB, CTR 5 Modes 91

92

Electronic Codebook Book (ECB) 93

Cipher Block Chaining (CBC) 94

Cipher Feed. Back (CFB) 95

Output Feed. Back (OFB) 96

Counter (CTR) 97

Advanced Encryption Standard (AES) "It seems very simple. " "It is very simple. But if you don't know what the key is it's virtually indecipherable. " —Talking to Strange Men, Ruth Rendell 98

Advanced Encryption Standard (AES) l clear a replacement for DES was needed ¡ ¡ l l l have theoretical attacks that can break it have demonstrated exhaustive key search attacks can use Triple-DES – but slow with small blocks US NIST issued call for ciphers in 1997 15 candidates accepted in Jun 98 5 were short-listed in Aug-99 Rijndael was selected as the AES in Oct-2000 issued as FIPS PUB 197 standard in Nov-2001 99

AES Requirements l private key symmetric block cipher l 128 -bit data, 128/192/256 -bit keys l stronger & faster than Triple-DES l active life of 20 -30 years (+ archival use) l provide full specification & design details l both C & Java implementations l NIST have released all submissions & unclassified analyses 100

AES Shortlist l after testing and evaluation, shortlist in Aug-99: ¡ ¡ ¡ MARS (IBM) - complex, fast, high security margin RC 6 (USA) - v. simple, v. fast, low security margin Rijndael (Belgium) - clean, fast, good security margin Serpent (Euro) - slow, clean, v. high security margin Twofish (USA) - complex, v. fast, high security margin then subject to further analysis & comment l saw contrast between algorithms with l ¡ ¡ few complex rounds verses many simple rounds which refined existing ciphers verses new proposals 101

The AES Cipher - Rijndael l designed by Rijmen-Daemen in Belgium l has 128/192/256 bit keys, 128 bit data l an iterative rather than feistel cipher ¡ treats data in 4 groups of 4 bytes ¡ operates an entire block in every round l designed to be: ¡ resistant against known attacks ¡ speed and code compactness on many CPUs ¡ design simplicity 102

Rijndael processes data as 4 groups of 4 bytes (state) l has 9/11/13 rounds in which state undergoes: l ¡ ¡ byte substitution (1 S-box used on every byte) shift rows (permute bytes between groups/columns) mix columns (subs using matrix multiply of groups) add round key (XOR state with key material) initial XOR key material & incomplete last round l all operations can be combined into XOR and table lookups - hence very fast & efficient l 103

104

105

Public-Key Cryptography 110

111

112

Public-Key Cryptosystems 113

RSA by Rivest, Shamir & Adleman of MIT in 1977 l best known & widely used public-key scheme l based on exponentiation in a finite (Galois) field over integers modulo a prime l ¡ nb. exponentiation takes O((log n)3) operations (easy) uses large integers (eg. 1024 bits) l security due to cost of factoring large numbers l ¡ nb. factorization takes O(e log n) operations (hard) 114

RSA Key Setup each user generates a public/private key pair by: l selecting two large primes at random - p, q l computing their system modulus N=p. q l ¡ l note ø(N)=(p-1)(q-1) selecting at random the encryption key e l l where 1<e<ø(N), gcd(e, ø(N))=1 solve following equation to find decryption key d ¡ e. d=1 mod ø(N) and 0≤d≤N publish their public encryption key: KU={e, N} l keep secret private decryption key: KR={d, N} l 115

RSA Use l to encrypt a message M the sender: ¡ obtains public key of recipient KU={e, N} ¡ computes: C=Me mod N, where 0≤M<N l to decrypt the ciphertext C the owner: uses their private key KR={d, p, q} ¡ computes: M=Cd mod N ¡ l note that the message M must be smaller than the modulus N (block if needed) 116

Why RSA Works l l because of Euler's Theorem: aø(n)mod N = 1 ¡ l in RSA have: ¡ ¡ l where gcd(a, N)=1 N=p. q ø(N)=(p-1)(q-1) carefully chosen e & d to be inverses mod ø(N) hence e. d=1+k. ø(N) for some k hence : Cd = (Me)d = M 1+k. ø(N) = M 1. (Mø(N))q = M 1. (1)q = M 1 = M mod N 117

118

119

RSA Example 1. 2. 3. 4. 5. 6. 7. Select primes: p=17 & q=11 Compute n = pq =17× 11=187 Compute ø(n)=(p– 1)(q-1)=16× 10=160 Select e : gcd(e, 160)=1; choose e=7 Determine d: de=1 mod 160 and d < 160 Value is d=23 since 23× 7=161= 10× 160+1 Publish public key KU={7, 187} Keep secret private key KR={23, 17, 11} 120

RSA Example cont. l sample RSA encryption/decryption is: l given message M = 88 (nb. 88<187) l encryption: C = 887 mod 187 = 11 l decryption: M = 1123 mod 187 = 88 121

Part 3 The Applications of Network Security 149

確認性協定X. 509 A{t. A, r. A, IDb, sgn. Data, EKUb[Kab]} A B A{t. A, r. A, IDB, sgn. Data, EKUb[Kab]} A B B{t. B, r. B, IDA, r. A, sgn. Data, EKUa[Kba]} A{t. A, r. A, IDB, sgn. Data, EKUb[Kab]} A B{t. B, r. B, IDA, r. A, sgn. Data, EKUa[Kba]} B 157 A{r. B}

�安全通道層 (SSL) • SSL所使用的協定共有四種，分別是SSL紀錄協 定(SSL Record Protocol)、SSL握手協定(SSL Handshake Protocol)、SSL改變特定加密器協 定(SSL Change Cipher Spec Protocol)以及 SSL警報協定(SSL Alert Protocol) SSL是兩層 的協定 159