1 / 56

Classical Cryptography

Classical Cryptography. Presented by: Ilya Saverchenko. Agenda. Introduction to cryptography Historical overview Definition of a cryptosystem Historical cryptosystems Monoalphabetic cryptosystems Polyalphabetic cryptosystems Rotor machines Overview of various cryptoanalysis techniques

ronan-huff
Télécharger la présentation

Classical Cryptography

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Classical Cryptography Presented by: Ilya Saverchenko

  2. Agenda • Introduction to cryptography • Historical overview • Definition of a cryptosystem • Historical cryptosystems • Monoalphabetic cryptosystems • Polyalphabetic cryptosystems • Rotor machines • Overview of various cryptoanalysis techniques • Cryptanalysis of several historical cryptosystems Joint Advanced Student School 2005

  3. Historical Overview • Egyptians (4500 years ago) • Military • Religion; Christian New Testament • Romans; Julius Caesar Joint Advanced Student School 2005

  4. Secure Communication Cryptographic Goals • Confidentiality • Data integrity • Authentication • Non-repudiation Joint Advanced Student School 2005

  5. Cryptosystem • Definition: Joint Advanced Student School 2005

  6. Cryptosystem • Description: • The communicating parties are usually referred to as Alice and Bob. The character who is eavesdropping the communication channel is called Eve. The goal of Alice and Bob is to exchange messages in such way that Eve would be unaware of their content. Joint Advanced Student School 2005

  7. Historical Cryptosystems • Monoalphabetic ciphers: • The Shift Cipher • The Substitution Cipher • Polyalphabetic ciphers: • The Vigenére Cipher • The Hill Cipher • The Permutation Cipher • Rotor machines Joint Advanced Student School 2005

  8. Modular Arithmetic • Definition: • For example: 2 ≡ 11(mod 3) as 2 mod 3 = 11 mod 3 = 2 12 ≡ -16(mod 7) as 12 mod 7 = -16 mod 7 = 5 (-16 = -3×7 + 5) Joint Advanced Student School 2005

  9. Modular Arithmetic • Arithmetic modulo m is defined as follows: • This definition satisfy most of the familiar arithmetic rules, e.g. addition is closed, multiplication is commutative, etc. • For example: Joint Advanced Student School 2005

  10. The Equivalence Class • The equivalence class of an integer a is a set of all integers congruent to a mod m. E.g. if m = 7, then 9 and 16 are in the same equivalence class. • If a = nm + r, where 0 ≤ r < m and n ≥ 0, then a ≡ r (mod m). r is called the least residue of a mod m. It can be seen that any integer a congruent modulo m to a unique integer between 0 and m - 1. For example: 13 ≡ 3 (mod 5) 3 is the least residue of 13 mod 5 Joint Advanced Student School 2005

  11. The Shift Cipher • Once a key is chosen, this cipher maps each alphabetic character to a unique alphabetic character. Such ciphers are called monoalphabetic. • The Shift Cipher has only 26 distinct keys! • The famous Caesar Cipher is the Shift Cipher with k = 3. Joint Advanced Student School 2005

  12. The Shift Cipher • In order to encrypt a plaintext string, using a given key, we have to perform the following operations: • Convert the string to a sequence of integers • Add value of the key to each integer, reducing each sum modulo 26 • Convert the sequence of integers to a ciphertext string • Decryption works in a similar way. However to decrypt a ciphertext one should subtract value of the key from each integer instead of adding it. Joint Advanced Student School 2005

  13. The Shift Cipher Example: • We will encrypt “julius” using the Shift Cipher with key k = 3. • First convert the plaintext to a sequence of integers (9 20 11 8 20 18) • Next, we add 3 to each value, reducing each sum modulo 26 if needed (12 23 14 11 23 21) • The last step is to convert the integers to alphabetical characters “MXOLXV” Joint Advanced Student School 2005

  14. The Substitution Cipher • The Substitution Cipher is a monoalphabetic cipher. • It is one of the oldest known ciphers. • 26! possible keys. Yet it is not difficult to break. Especially if the given ciphertext length is greater than 50 symbols. Joint Advanced Student School 2005

  15. The Substitution Cipher • To encrypt a plaintext message one has to substitute all letters in the original text with the corresponding ciphertext letters, using the permutation function. • For decryption the inverse permutation is used. • Using the table above one can encipher “secret” to “VUBTUX”. Joint Advanced Student School 2005

  16. The Vigenère Cipher • The Vigenère Cipher is a polyalphabetic cipher. Thus the cipher can map an alphabetic character to several other characters. • This cipher is named after Blaise de Vigenère (16th century). Yet it was first described by Giovan Batista Belaso in 1553. • The number of possible keywords of length m is 26m. Joint Advanced Student School 2005

  17. The Vigenère Cipher • To encipher a message we again make use of the table • Both the key and the original plaintext have to be written as sequence of integers. • An integer string corresponding to the message is split on n blocks of size m, where m is length of the key. • The keyword is added (modulo 26) to each block. • Decryption is similar, except that the keyword is subtracted (modulo 26) from each ciphertext block. Joint Advanced Student School 2005

  18. The Vigenère Cipher A simple example: • The plaintext is “attackatdawn” and the keyword is “cipher”, thus m = 6. • The numerical equivalent of k is (2 8 15 7 4 17). The plaintext can be written using integers as (0 19 19 0 2 10 0 19 3 14 22 13). • Now we split the plaintext message in two blocks of six, and add the keyword modulo 26 to each of them 0 19 19 0 2 10 0 19 3 14 22 13 2 8 15 7 4 17 2 8 15 7 4 17 2 1 8 7 6 1 2 1 18 21 0 4 • Thus the ciphertext is “CBIHGBCBSVAE”. Joint Advanced Student School 2005

  19. The Vigenère Cipher A simple example (cont.): • To decrypt the ciphertext “CBIHGBCBSVAE”, we follow the same sequence of steps. • The numerical equivalent of k is (2 8 15 7 4 17). The ciphertext can be written using integers as (2 1 8 7 6 1 2 1 18 21 0 4). • Now subtract the keyword modulo 26 from the ciphertext 2 1 8 7 6 1 2 1 18 21 0 4 2 8 15 7 4 17 2 8 15 7 4 17 0 19 19 0 2 10 0 19 3 14 22 13 • We were able to recover the original plaintext, which is “attackatdawn”. Joint Advanced Student School 2005

  20. The Hill Cipher • As well as Vigenère, this cipher is polyalphabetic. • It was invented by Lester S. Hill in 1929. Joint Advanced Student School 2005

  21. The Hill Cipher • To encrypt a message using the Hill Cipher one should perform the following sequence of steps: • Using the table, plaintext message has to be expressed as sequence of integers in such a way that p = (p1, …, pm) • The key is an m×m matrix • The resulting ciphertext c = ek(p) = p×k will be a string (c1, …, cm) of length m • To decrypt the ciphertext one should apply the inverse linear transformation. In other words p = c×k-1, where kk-1mod 26 = I. Joint Advanced Student School 2005

  22. The Hill Cipher Example: • Encrypting a message using the Hill Cipher is very simple. Decryption however is more challenging. • We are given the following ciphertext “CKHUMD”, with • To decrypt the ciphertext produced with the Hill Cipher, one should apply the inverse linear transformation k-1. • After k-1 is found, it is easy to find the corresponding plaintext, which is “matrix” in our case. Joint Advanced Student School 2005

  23. The Permutation Cipher • This cryptosystem is really old. • It was described in book by Giovanni Porta written in 1563. • “Rail-fence” cipher is an example of permutation cipher. Joint Advanced Student School 2005

  24. The Permutation Cipher • In order to use the cipher a permutation has to be defined. Let us use the following permutation as example: • Since m = 6, the original message has to be broken on n groups of six letters each. If last group is shorter, necessary number of dummy letters can be appended to the end. • Each group is rearranged according to the permutation defined previously. • To decrypt a ciphertext message inverse permutation should be applied in a similar way. Joint Advanced Student School 2005

  25. Rotor Machines • In the beginning of twentieth century mechanical encryption devices started to be developed, in order to automate encryption/decryption process. • Rotor machines were using a substitution cipher, which was rotated each cycle. Actually this idea was already used during the American Civil War. • The best well known rotor machine is Enigma. Joint Advanced Student School 2005

  26. Rotor Machines, Enigma • Enigma used three rotors chosen from a set of five. The three rotors were interconnected, so first rotor would turn the second each full iteration, and second would turn the third. • A number of additional mechanisms were used to make the cipher more secure. • However incorrect usage of the device allowed Allies to break the code. Joint Advanced Student School 2005

  27. Cryptanalysis • The general assumption is that an opponent, Eve, knows the cryptosystem being used. This is referred to as Kerchkhoffs’ principle. • Goal of a cryptanalyst is to recover the original plaintext message without knowing the key being used or to deduce the key itself. • Common attack models are: • Ciphertext only attack • Known plaintext attack • Chosen plaintext attack • Adaptive-chose plaintext attack • Chosen ciphertext attack • Adaptive-chosen ciphertext attack Joint Advanced Student School 2005

  28. Ciphertext Only Attack • The cryptanalyst possesses a string of ciphertext. • Given: c = ek(p) Determine: p or k (the key being used) • Any cryptosystem vulnerable to this type of attack is considered to be completely insecure. Joint Advanced Student School 2005

  29. Known Plaintext Attack • The cryptanalyst possesses a plaintext message and corresponding ciphertext. • Given: p and c = ek(p) Determine: k (the key used for encrypting the plaintext message) or a function that would produce correct plaintext for a given ciphertext Joint Advanced Student School 2005

  30. Chosen and Adaptive-chosen Plaintext Attack • The cryptanalyst can choose a message to be encrypted. In case of adaptive-chosen plaintext attack, the cryptanalyst has obtained temporary access to the encryption machine. So he can choose a message to be encrypted based on previously achieved results. • Given: p1, c1 = ek(p1), p2, c2 = ek(p2), …, pn, cn = ek(pn) Determine: k (the key used for encrypting the plaintext message) or a function that would produce correct plaintext for a given ciphertext Joint Advanced Student School 2005

  31. Chosen and Adaptive-chosen Ciphertext Attack • The cryptanalyst can choose a ciphertext and obtain corresponding plaintext message. In case of adaptive-chosen ciphertext attack, the cryptanalyst has obtained temporary access to the decryption machine. So he can select ciphertext based on previously achieved results. • Given: c1, p1 = dk(c1), c2, p2 = dk(c2), …, cn, pn = dk(cn) Determine: k (the key used for encrypting the plaintext message) or a function that would produce correct plaintext for a given ciphertext Joint Advanced Student School 2005

  32. Breaking Historical Cryptosystems • Now we will apply the knowledge acquired and break several cryptosystems described earlier. • Yet before we need to talk about statistical properties of English language, since it is being used by many techniques of cryptanalysis. Joint Advanced Student School 2005

  33. Statistics • Following are statistics for single letters: • Most common digrams are: TH, HE, IN, ER, AN, RE, ED, ON, ES, ST, EN, AT, TO, NT, HA, ND, OU, EA, NG, AS, OR, TI, IS, ET, IT, AR, TE, SE, HI, OF • Most common trigrams are: THE, ING, AND, HER, ERE, ENT, THA, NTH, WAS, ETH, FOR, DTH Joint Advanced Student School 2005

  34. Cryptanalysis of the Substitution Cipher • We will try to break the Substitution Cipher using ciphertext-only attack. • Here is the intercepted ciphertext: BTLDXFETMDGLGMVMYFQEMQAPMVBZQMXZQEGZVXFTL XGUWFVXBFWDYUXUQFQXUBGQZBMYMBBFHQXFPXGU VHISUBXZVCMGQVXGUBFAUITUMCUTVXGZVIFFCXTMBUV BTLDXFETMDGLPTFWZXVZQZXZMYMQAYZWZXUAHVUIL XGUUELDXZMQVVFWUPFHTXGFHVMQALUMTVMEFXFXGU XKUQXZUXGBUQXHTLKGUTUZXDYMLUAMBTHBZMYTFYU ZQXGUFHXBFWUFPIFXGKFTYAKMTVBFWDYUXUAZQ QZQUXUUQVZJXLXGTUUXGUIFFCBFOUTVXGFVUMVDUBXV FPXGUGZVXFTLKGZBGKUTUWFVXVZEQZPZBMQXXFXGU AUOUYFDWUQXFPXGUVHISUBX Joint Advanced Student School 2005

  35. Cryptanalysis of the Substitution Cipher • Statistics for single letter of the ciphertext • Most common digrams are: XG (16), GU (11), XF (8), QX (7), VX (7), BF (6), UX (6), ZQ (6) • Most common trigrams are: XGU (10), BFW, FPX, FXG, GZV, LDX, LXG, MQA, PXG, UBX, UQX, UXU, VXG - all appear three times in the text Joint Advanced Student School 2005

  36. Cryptanalysis of the Substitution Cipher • Now we can make a few assumptions. U and X appear the most often in the ciphertext. We can assume that this letters correspond with E and T in the original message. • The most common digram in the ciphertext is XG. That means X = T and then G = H. THE is the most common trigram in English, so we can conclude that U = E. • XF is a common digrams. We know that X = T. So XF can be TO or TI. O is a bit more frequent in English than I, so F = O. Joint Advanced Student School 2005

  37. Cryptanalysis of the Substitution Cipher • Now our ciphertext looks as follows: BTLDtoETMDhLhMVMYoQEMQAPMVBZQMtZQEhZVtoTL theWoVtBoWDYeteQoQteBhQZBMYMBBoHQtoPthe VHISeBtZVCMhQVtheBoAeITeMCeTVthZVIoCtTMBeV BTLDtoETMDhLPToWZtVZQZtZMYMQAYZWZteAHVeIL theeELDtZMQVVoWePoHTthoHVMQALeMTVMEotothe tKeQtZethBeQtHTLKheTeZtDYMLeAMBTHBZMYToYe ZQtheoHtBoWeFPIothKoTYAKMTVBoWDYeteAZQ QZQeteeQVZJtLthTeetheIooCBFOeTVthFVeMVDeBtV oPthehZVtoTLKhZBhKeTeWoVtVZEQZPZBMQttothe AeOeYoDWeQtoPtheVHISeBt • X = T, G = H, U = E, F = O Joint Advanced Student School 2005

  38. Cryptanalysis of the Substitution Cipher • Let’s analyze QX and UQX. QX can be AT, NT, or IT. However if we consider UQX trigram, we can see that most likely Q = N. • MQA is a common trigram. Taking into account that Q = N, we say that MQA = AND. Hence M = A and A = D. • By now we know that Q = N, M = A, A = D, X = T, G = H, U = E, F = O. Proceeding in the same way it is not difficult to recover the complete message. Joint Advanced Student School 2005

  39. Cryptanalysis of the Substitution Cipher • The recovered plaintext message (with spaces added) is: cryptography has a long and fascinating history the most complete nontechnical account of the subject is kahns the codebreakers this book traces cryptography from its initial and limited use by the egyptians some four thousand years ago to the twentieth century where it played a crucial role in the outcome of both world wars completed in nineteen sixty three the book covers those aspects of the history which were most significant to the development of the subject (Taken from Handbook of Applied Cryptography, by A. Menezes, P. van Oorschot, and S. Vanstone) Joint Advanced Student School 2005

  40. Cryptanalysis of the Vigenère Cipher • The Vigenère Cipher is polyalphabetic, so additional cryptoanalysis techniques should be used. • The ciphertext is: MRGFNIATXZQVFFNUXFFYBTCETYXIIXGZKACJLRGKQYEIX OYYAUAPXYIJLHPRGVTSFPAYNNYURZOPHXWYXLFRNUTZBR FKAHFWFZESYUWZMOLLBSBZBJHFPLXKHVIVMZTZHUIWAET IUEDFGLXDIEXIYJIUXPNNEIXABVCINTVCIEZYYDAZGZIW TYXJIKTRZLMFFKALGZNVKZXIIMXUUNAPGVXFUSMISKHVY VOCRVXRIWTYXZOIRFNUXZNXLDUDPZGVHVOWMOYJERLAUG LVTUXTHRBUQZTYTXORNKBASFFXGHQVDSHUYJSYHDYUWYX YYKHVTUCDACAHXSEVGJIEFZGLXRSBXSYKOEPPNYAKTUAC EFYILFWEAHCIAUALLZNXMVCKLRRHGFNXMOYUESKPM Joint Advanced Student School 2005

  41. Cryptanalysis of the Vigenère Cipher • As mentioned above, the Vigenère Cipher makes use of a keyword of length m. • Our first step is to determine the key. After that decryption of the message is easy. • There are two techniques that can be employed. Namely the Kasiski test and the index of coincidence. Joint Advanced Student School 2005

  42. Cryptanalysis of the Vigenère Cipher • The Kasiski test was introduced in 1863 by a Prussian military officer Friedrich Kasiski. The method is based on the observation that two identical segments of plaintext will be encrypted to the same ciphertext as long as they are δ positions apart (δ ≡ 0 (mod m)). • Our goal is to find several identical pieces of text, each of length at least three, and record the distance between their starting position. m divides all of the distances δ1, δ2, …, δn. Hence m divides the greatest common divisor of the δi’s. • In the ciphertext trigram TYX occurs 3 times. The starting positions are 25, 181, and 235. The distance between the first and the second is 156 symbols, between the first and the third 210. The gcd of these two numbers is 6, so we can assume that the keyword length is also 6. Joint Advanced Student School 2005

  43. Cryptanalysis of the Vigenère Cipher • Now we will use the index of coincidence to see if it gives the same result. • The index of coincidence is defined as follows: • If we denote the frequencies of A, B, C, …, Z in x by f1, f2, f3, …, f25. We can choose two elements of x in ways. There are ways of choosing two same elements. Hence, we have the formula Joint Advanced Student School 2005

  44. Cryptanalysis of the Vigenère Cipher • Index of coincidence of a string written in English is approximately equal to 0.065. • The same reasoning applies if x is a ciphertext string obtained using a monoalphabetic cipher. • Now we rewrite the ciphertext c in the following way • If c1, c2, …, cm are constructed in such a way that m is the keyword length, then each Ic(ci) should be approximately equal to 0.065 Joint Advanced Student School 2005

  45. Cryptanalysis of the Vigenère Cipher • On the other hand, if m is not the keyword length, the strings ci would look much more random. A completely random string would have • Following table contains Ic for different values of m: • This method also shows that m = 6. Joint Advanced Student School 2005

  46. Cryptanalysis of the Vigenère Cipher • To determine the keyword itself we use a method similar to the index of coincidence. • Each substring ci was produced using a monoalphabetic cipher. Thus defining a shift g we can use the following formula where f1, f2, …, fi denotes the frequencies of A, B, …, Z in the substring ci, and n is the length of the substring. • If g is the correct shift value, Mg would be roughly equal to 0.065 • Now we have to the most suitable value of Mg for each of the substrings. Joint Advanced Student School 2005

  47. Cryptanalysis of the Vigenère Cipher • We have found the keyword, which is ARTHUR. Joint Advanced Student School 2005

  48. Cryptanalysis of the Vigenère Cipher • The recovered plaintext message (with spaces added) is: many traces we found of him in the boggirt island where he had hid his savage ally a huge drivingwheel and a shaft halffilled with rubbish showed the position of an abandoned mine beside it were the crumbling remains of the cottages of the miners driven away no doubt by the foul reek of the surrounding swamp in one of these a staple and chain with a quantity of gnawed bones showed where the animal had been confined a skeleton with a tangle of brown hair adhering to it lay among the debris. (Taken from Hound of the Baskervilles, by Arthur Conan Doyle) Joint Advanced Student School 2005

  49. Cryptanalysis of the Hill Cipher • We will break the Hill Cipher using a known plaintext attack, since it can be difficult to break using only ciphertext. • Suppose we possess m distinct plaintext-ciphertext pairs pj = (p1,j, p2,j, …, pm,j) and cj = (c1,j, c2,j, …, cm,j), where m is the key dimension. • Let us define two m×m matrices X = (ci,j) and Y = (pi,j). Then Y = Xk. • Now it is easy to find the key, k = X-1Y, where XX-1 mod 26 = I. Joint Advanced Student School 2005

  50. Cryptanalysis of the Hill Cipher • Assume we have ciphertext “IKNQYB” and we know that the plaintext is “cipher”. • Assume m = 2. ek(2, 8) = (8, 10), ek(15, 7) = (13, 16), and ek (4, 17) = (24, 1). Using the second and the third plaintext-ciphertext pairs, we come up with the following equation in the form Y = Xk • To find the key, we need inverse modulo of X • Now Joint Advanced Student School 2005

More Related