PART VII Security Mc GrawHill 1 The Mc

PART VII Security Mc. Graw-Hill 1 ©The Mc. Graw-Hill Companies, Inc. , 2004

Security Topics Mc. Graw-Hill 2 ©The Mc. Graw-Hill Companies, Inc. , 2004

Chapters Chapter 29 Cryptography Chapter 30 Message Authentication, User Authentication, and Key Management Chapter 31 Security Protocols in The Internet Mc. Graw-Hill 3 ©The Mc. Graw-Hill Companies, Inc. , 2004

Chapter 29 Cryptography Mc. Graw-Hill 4 ©The Mc. Graw-Hill Companies, Inc. , 2004

Cryptography n n n Cryptography refers to the science and art of transforming messages to make them secure and immune to attacks. Original message before being transformed is called plaintext. After the message is transformed, is called ciphertext. An encryption algorithm transforms the plaintext to ciphertext; a decryption algorithm transforms the ciphertext back to plaintext. The term cipher is used to refer to encryption and decryption algorithms. Mc. Graw-Hill 5 ©The Mc. Graw-Hill Companies, Inc. , 2004

Encryption and Decryption n n A key is a number (value) that the cipher, as an algorithm, operates on. To encrypt a message, we need an encryption algorithm, an encryption key, and the plaintext. These create the ciphertext. To decrypt a message, we need a decryption algorithm, a decryption key, and the ciphertext. These reveal the plaintext. In cryptography, the encryption/decryption algorithms are public; but the keys are secret. Mc. Graw-Hill 6 ©The Mc. Graw-Hill Companies, Inc. , 2004

Types of Cryptography Algorithms n Symmetric-Key Cryptography n n Asymmetric-key Cryptography n Mc. Graw-Hill Also known as Secret-key Also Known as public-key 7 ©The Mc. Graw-Hill Companies, Inc. , 2004

Symmetric-key cryptography n n n In symmetric-key cryptography, the same key is used by the sender (for encryption) and the receiver (for decryption). The key is shared. In symmetric-key cryptography, the same key is used in both directions The algorithm used for decryption is the inverse of the algorithm used for encryption. It takes less time to encrypt a message using a symmetric-key algorithm than it takes to encrypt using a public-key algorithm. Symmetric-key cryptography is often used for long messages Dis-adv: Each pair of users must have a unique symmetric key. Mc. Graw-Hill 8 ©The Mc. Graw-Hill Companies, Inc. , 2004

Traditional Ciphers n Substitution Cipher n n Transpositional Cipher Block Cipher n Mc. Graw-Hill Monoalphabetic Substitution Polyalphabetic Substitution Data Encryption Standard (DES) 9 ©The Mc. Graw-Hill Companies, Inc. , 2004

Monoalphabetic Substitution n n Mc. Graw-Hill A cipher using the substitution method substitutes one symbol with another. Monoalphabetic: A character in the plaintext is always changed to the same character in the ciphertext regardless of its position in the text. Example: Caesar Cipher. Here, shifting of key is used. Easy to attack. 10 ©The Mc. Graw-Hill Companies, Inc. , 2004

Example of Monoalphabetic substitution n Mc. Graw-Hill In monoalphabetic substitution, the relationship between a character in the plaintext to the character in the ciphertext is always one-to-one 11 ©The Mc. Graw-Hill Companies, Inc. , 2004

Polyalphabetic Substitution n n n In polyalphabetic substitution, the relationship between a character in the plaintext and a character in the ciphertext is one-to-many Each occurrence of a character can have a different substitute Key is like: Take the position of the character in the text, divide the number by 10, and let the remainder be the shift value. Ex. Vigenere Cipher. Difficult to attack when compared to Monoalphabetic. Although the encryption changes the frequency of the characters, the character relationships are still preserved. So, good trial-and-error attack can break the code. Mc. Graw-Hill 12 ©The Mc. Graw-Hill Companies, Inc. , 2004

Transpositional cipher n n n The characters retain their plaintext form but change their positions to create the ciphertext. The text is organized into a two-dimensional table, and the columns are interchanged according to a key. The character frequencies are reserved, and the attacker can find the plaintext through trial and error. Mc. Graw-Hill 13 ©The Mc. Graw-Hill Companies, Inc. , 2004

Block cipher n n n Mc. Graw-Hill Traditional ciphers used a character or symbol as the unit of encryption/decryption. Modern ciphers use a block of bits as the unit of encryption/decryption. P-box (P for permutation) performs a transposition at the bit level. It can be implemented in hardware or software, but hardware is faster. Both the plaintext and ciphertext have the same number of 1 s and 0 s. 14 ©The Mc. Graw-Hill Companies, Inc. , 2004

Block cipher P-box n n S-box (S for substitution) performs a substitution at the bit level. The S-box substitutes one decimal digit with another. The S-box normally has three components: an encoder, a decoder, and a P-box. The decoder changes an input of n bits to an output of 2 n bits. This output has one single 1 (the rest are 0 s) located at a position determined by the input. The P-box permutes the output of decoder, and the encoder changes the output of the P-box backs to a binary number in the same way as the decoder, but inversely. Mc. Graw-Hill 15 ©The Mc. Graw-Hill Companies, Inc. , 2004

Product block n n P-boxes and S-boxes can be combined to get a more complex cipher block, called Product block. Data Encryption Standard (DES) uses an algorithm that encrypts a 64 -bit plaintext using a 56 -bit key. The text is put through 19 different and complex procedures to create a 64 -bit ciphertext. Mc. Graw-Hill 16 ©The Mc. Graw-Hill Companies, Inc. , 2004

General scheme of DES n n n DES has two transposition blocks, one swapping block, and 16 complex blocks called iteration blocks. The 16 iterative blocks are conceptually the same, but each uses a different key derived from the original key. DES works on 8 characters (bytes) at a time. Mc. Graw-Hill 17 ©The Mc. Graw-Hill Companies, Inc. , 2004

Figure 29. 14 n Iteration block In each block, the previous right 32 bits become the next left 32 bits (swapping). The next right 32 bits, however, come from first applying an operation (a function) on the previous right 32 bits and then XORing the result with the left 32 bits. Mc. Graw-Hill 18 ©The Mc. Graw-Hill Companies, Inc. , 2004

Figure 29. 15 n n n Mc. Graw-Hill Triple DES To lengthen the key and at the same time keep the new block compatible with that of the original DES. The DES cipher uses the same concept as the Caesar cipher, but the encryption/decryption algorithm is much more complex due to the sixteen 48 -bit keys derived from a 56 -bit key Triple DES uses three DES blocks and two 56 -bit keys. 19 ©The Mc. Graw-Hill Companies, Inc. , 2004

Operation Modes n n n Mc. Graw-Hill DES and triple DES are actually long substitution ciphers that operate on eight-character segments (sometimes called long characters). To encrypt and decrypt long messages (1000 characters), several modes are used. In Electronic code block (ECB) mode, we divide the long message into 64 -bit blocks and encrypt each block separately. Encryption of each block is independent of other blocks in ECB mode. 20 ©The Mc. Graw-Hill Companies, Inc. , 2004

CBC mode n n n Mc. Graw-Hill In cipher block chaining (CBC) mode, the encryption (or decryption) of a block depends on all previous blocks. To encrypt the second plaintext block (P 2), we first XOR it with the first cipher block (C 1) and then pass it through the encryption process. In this way, C 2 depends on C 1. A 64 -bit random number, called the initialization vector (IV) is used. The IV is sent with the data so that the receiver can use it in decryption. 21 ©The Mc. Graw-Hill Companies, Inc. , 2004

CFM n n Mc. Graw-Hill Cipher feedback mode (CFM) was created for those situations in which we need to send or receive data 1 byte at a time, but still want to use DES (or triple DES). One solution is to make a 1 -byte CN dependent on a 1 -byte PN and another byte, which depends on 8 previous bytes itself. 22 ©The Mc. Graw-Hill Companies, Inc. , 2004

CSM n n Mc. Graw-Hill To encrypt/decrypt 1 bit at a time and at the same time be independent of the previous bits, we can use cipher stream mode (CSM). In this mode, data are XORed bit by bit with a long, one-time bit stream that is generated by an initialization vector in a looping process. 23 ©The Mc. Graw-Hill Companies, Inc. , 2004

Public-key cryptography n n Two keys: a private key and a public key. The private key is kept by the receiver and the public key is for public use. Public-key that is used for encryption is different from the private key that is used for decryption. Adv: n n n Public-key algorithms are more efficient for short messages. Disadv: n n Mc. Graw-Hill Removes the restriction of a shared symmetric key between two entities who need to communicate with each other. Each shared key is used by two parties only. The number of keys needed is reduced tremendously. Complexity of the algorithm; To be effective we need large numbers Association between an entity and its public key must be verified [Certification authority]. 24 ©The Mc. Graw-Hill Companies, Inc. , 2004

Public-key cryptography Mc. Graw-Hill 25 ©The Mc. Graw-Hill Companies, Inc. , 2004

RSA Algorithm n n n n RSA (Rivest, Shamir, Adleman) is the most common public-key algorithm. Private key is a pair of numbers (N, d) = (119, 77). Public key is a pair of numbers (N, e) = (119, 5). Note that N is common to the private and public keys. Sender algorithm to encrypt: C=Pe mod N P is plaintext, which is represented as a number; C is the number that represents the ciphertext. The two numbers e and N are components of the public key. Receiver algorithm to decrypt: P=Cd mod N Mc. Graw-Hill 26 ©The Mc. Graw-Hill Companies, Inc. , 2004

Selecting Public and Private Keys n n Numbers like d and e are very large numbers (on the scale of tens of digits). Thus using trial and error method to get these numbers will take a very long time. Procedure to choose three numbers N, d, and e. n n Mc. Graw-Hill Choose two large prime numbers p and q. Compute N = p * q Choose e (less than N) such that e and (p-1)(q-1) are relatively prime (having no common factor other than 1) Choose d such that (e*d) mod [(p-1)(q-1)] is equal to 1. 27 ©The Mc. Graw-Hill Companies, Inc. , 2004