1. Computer and Network Security- Cryptography – Dr. Hwajung Lee Radford University

2. References References: Kaufman, C., Perlman, R. and Speciner, M., Network Security (Private Communication in a Public World), 2nd edition, Prentice Hall 2002. William Stalling, Cryptography and Network Security, 2nd edition, Prentice Hall 1999. Class notes: Computer Security, Pennsylvania State University http://www.cse.psu.edu/~cg543/

3. Cryptography (1) • Cryptography is the art (and sometimes science) of secret writing – Less well know is that it is also used to guarantee other properties, e.g., authenticity of data – This is an enormously deep and important field – However, much of our trust in cryptographic systems is based on faith (particularly in efficient secret key algorithms) • This set of lectures will provide the intuition and some specifics of modern cryptography,

4. Cryptography (2) • Cryptography (cryptographer) – Creating ciphers • Cryptanalysis (cryptanalyst) – Break ciphers • The history of cryptography is an arms race between cryptographers and cryptanalysts

5. K K A B The language of cryptography plaintext plaintext symmetric key crypto: sender, receiver keys identical public-key crypto: encrypt key public, decrypt key secret ciphertext Figure 7.3 goes here

6. Encryption Algorithm • Algorithm used to make content unreadable by all but the intended receivers Ekey(plaintext) = ciphertext Dkey(ciphertext) = plaintext • Algorithm is public, key is private • Block vs. Stream Ciphers – Block: input is fixed blocks of same length – Stream: stream of input

7. ? ? ? ? Hardness • Functions – Plaintext P – Ciphertext C – Encryption key ke – Decryption key kd Dkd(Eke(P)) = P Q: Hard or Easy? • Computing C from P is hard, computing C from P with ke is easy • Computing P from C is hard, computing P from C with kd is easy

8. Symmetric key cryptography (ex 1) substitution cipher: substituting one thing for another • monoalphabetic cipher: substitute one letter for another plaintext: abcdefghijklmnopqrstuvwxyz ciphertext: mnbvcxzasdfghjklpoiuytrewq E.g.: Plaintext: bob. i love you. alice ciphertext: nkn. s gktc wky. mgsbc

9. (ex 2) Caesar cipher • Substitution cipher • Every character is replaced with the character three slots to the right - If key = 3, meaning ROT3, A B C D E F G H I J K L M N O P Q R S T U V W X Y Z D E F G H I J K L MN O P Q R S T U V W X Y Z A B C Q: What is the ciphertext of the following plaintext? (assumption: ROT3, key = 3) S E C U R I T Y A N D P R I V A C Y  V H F X U L W B D Q G S U L Y D F B

10. Cyptanalyze this this …. Q: What is the key and the plaintext of the following ciphertext? (hint. think ROTx, key = x) “v yvxr pelcgbtencul n ybg”  I like cryptography a lot

11. Cryptanalysis of ROTx Ciphers • Goal: to find plaintext of encoded message • Given: ciphertext • How: simply try all possible keys – Known as a brute force attack 1 T F D V S J U Z B M E Q S J W B D Z 2 U G E W T K V A C N F R T H X C E A 3 V H F X U L W B D Q G S U L Y D F B S E C U R I T Y A N D P R I V A C Y

12. Symmetric key crypto: DES DES: Data Encryption Standard • US encryption standard [NIST] • 56-bit symmetric key, 64 bit plaintext input

13. DES operation Symmetric key crypto: DES initial permutation 16 identical “rounds” of function application, each using different 48 bits of key final permutation

14. Cryptanalysis of DES • DES has an effective 56-bit key length – Wiener: 1,000,000$ - 3.5 hours (never built) – July 17, 1998, the EFF DES Cracker, which was built for less than $250,000 < 3 days – January 19, 1999, Distributed.Net (w/EFF), 22 hours and 15 minutes (over many machines) – We all assume that NSA and agencies like it around the world can crack (recover key) DES in seconds (Note: EFF (Electronic Frontier Foundation) is a nonprofit group working to protect your digital rights.) • What now? Give up on DES?

15. Variants of DES • DESX (two keys ~= 120-bits) • http://www.rsasecurity.com/rsalabs/node.asp?id=2232 • Triple DES (two keys ~= 112-bits) • http://www.rsasecurity.com/rsalabs/node.asp?id=2231 - keys k1, k2, k3 c = Ek3( Dk2( Ek1( p ) ) )

16. Advanced Encryption Standard (AES) • Result of international NIST bakeoff between cryptographers – Intended as replacement for DES – Rijndael (pronounced “Rhine-dall”) = Rijman + Daemen – Currently implemented in many devices and software, but not yet fully embraced – Cryptography community is actively vetting the theory and implementations (stay tuned) • http://csrc.nist.gov/CryptoToolkit/aes/rijndael/ • http://csrc.nist.gov/CryptoToolkit/aes/rijndael/misc/nissc2.pdf

17. Public Key Cryptography symmetric key crypto • requires sender, receiver know shared secret key • Q: how to agree on key in first place (particularly if never “met”)? public key cryptography • radically different approach [Diffie-Hellman76, RSA78] • sender, receiver do notshare secret key • Publickey (known to all) • Privatekey (known only to receiver)

18. Public key cryptographyConfidentiality Figure 7.7 goes here

19. d (e (m)) = m B B 1 2 Public key encryption algorithms Two inter-related requirements: need d ( ) and e ( ) such that . . B B need public and private keys for d ( ) and e ( ) . . B B RSA: Rivest, Shamir, Adelson algorithm

20. RSA: Choosing keys 1. Choose two large prime numbers p, q. (e.g., 1024 bits each) 2. Compute n = pq, z = (p-1)(q-1) 3. Choose e (with e<n) that has no common factors with z. (e, z are “relatively prime”). 4. Choose d such that ed-1 is exactly divisible by z. (in other words: ed mod z = 1 ). 5.Public key is (n,e).Private key is (n,d).

21. 1. To encrypt bit pattern, m, compute d e m = c mod n c = m mod n e (i.e., remainder when m is divided by n) Magic happens! d e m = (m mod n) mod n RSA: Encryption, decryption 0. Given (n,e) and (n,d) as computed above 2. To decrypt received bit pattern, c, compute d (i.e., remainder when c is divided by n)

22. d e c = m mod n m = c mod n d c RSA example: Bob chooses p=5, q=7. Then n=35, z=24. e=5 (so e, z relatively prime). d=29 (so ed-1 exactly divisible by z). e m m letter encrypt: l 17 248832 12 c letter decrypt: 17 12 l 481968572106750915091411825223072000

23. e d ed (m mod n) mod n = m mod n ed mod (p-1)(q-1) 1 = m mod n = m = m mod n Number theory result: If p,q prime, n = pq, then y y mod (p-1)(q-1) d e x mod n = x mod n m = (m mod n) mod n RSA: Why: (using number theory result above) (since we choseed to be divisible by (p-1)(q-1) with remainder 1 )

24. Authentication Goal: Bob wants Alice to “prove” her identity to him Protocol ap1.0:Alice says “I am Alice” Failure scenario??

25. Authentication: another try Protocol ap2.0:Alice says “I am Alice” and sends her IP address along to “prove” it. Failure scenario??

26. Authentication: another try Protocol ap3.0:Alice says “I am Alice” and sends her secret password to “prove” it. Failure scenario?

27. Authentication: yet another try Protocol ap3.1:Alice says “I am Alice” and sends her encrypted secret password to “prove” it. I am Alice encrypt(password) Failure scenario?

28. Authentication: yet another try Goal:avoid playback attack Nonce:number (R) used only once in a lifetime ap4.0:to prove Alice “live”, Bob sends Alice nonce, R. Alice must return R, encrypted with shared secret key Figure 7.11 goes here Failures, drawbacks?

29. Authentication: ap5.0 ap4.0 requires shared symmetric key • problem: how do Bob, Alice agree on key • can we authenticate using public key techniques? ap5.0: use nonce, public key cryptography Figure 7.12 goes here

30. ap5.0: security hole Man (woman) in the middle attack: Trudy poses as Alice (to Bob) and as Bob (to Alice) Figure 7.14 goes here Need “certified” public keys (more later …)

31. Cryptographic technique analogous to hand-written signatures. Sender (Bob) digitally signs document, establishing he is document owner/creator. Verifiable, nonforgeable: recipient (Alice) can verify that Bob, and no one else, signed document. Simple digital signature for message m: Bob encrypts m with his public key dB, creating signed message, dB(m). Bob sends m and dB(m) to Alice. Digital Signatures

32. Suppose Alice receives msg m, and digital signature dB(m) Alice verifies m signed by Bob by applying Bob’s public key eB to dB(m) then checks eB(dB(m) ) = m. If eB(dB(m) ) = m, whoever signed m must have used Bob’s private key. Alice thus verifies that: Bob signed m. No one else signed m. Bob signed m and not m’. Non-repudiation: Alice can take m, and signature dB(m) to court and prove that Bob signed m. Digital Signatures (more)