Cryptography

1. Cryptography Tuomas Aura CSE-C3400 Information security Aalto University, autumn 2014

2. Outline • Symmetric encryption • Public-key encryption • Cryptographic authentication Most important! This lecture is intended for those who are not taking a cryptography course yet User’s or engineer’s view of cryptography, and some hints about what is below the bonnet

3. Symmetric encryption

4. Encryption • Message encryption based on symmetric cryptography • Endpoints share a secret key K • Block ciphers, stream ciphers • Protects confidentiality, not integrity

5. Ideal encryption: random permutation • Ideal encryption is a random 1-to-1 function i.e. permutation of the set of all strings (up to some maximum length) • Decryption is the reverse function • Impossible to store and share large random permutation functions plaintexts Secret random permutation ciphertexts

6. Practical encryption: pseudorandom permutation • Random permutation cannot be implemented. What to do? • Block cipher: string length fixed to 64..128..256 bits • Choose the pseudorandom permutation from a family of permutation functions based on a secret key • Pseudorandom = indistinguishable from random unless you know the algorithm (or key) • Kerckhoff’s principle: public algorithm, secret key 2128 plaintexts Secret key K Pseudorandom permutation (Block length 128-bits) 2128 ciphertexts

7. Substitution-permutation network • One way to implement a key-dependent pseudorandom permutation • Substitution-permutation network: • S-box = substitution is a small (random) 1-to-1 function for a small block, e.g. 24…216 values • P-box = bit-permutation mixes bits between the small blocks • Repeat for many rounds, e.g. 8…100 • Mix key bits with data in each round • Decryption is the reverse • Cryptanalysis tries to detect differences between this and a true random permutation [Wikimedia Commons]

8. AES • Advance Encryption Standard (AES) • Standardized by NIST in 2001 • 128-bit block cipher • 128, 192 or 256-bit key • 10, 12 or 14 rounds • AES round: • SubBytes: 8-byte S-box, not really random, based on finite-field arithmetic, multiplication in GF(28) • ShiftRows and MixColumn: reversible linear combination of S-box outputs (mixing effect similar to P-box) • AddRoundKey: XOR bits from expanded key with data • Key schedule: expands key to round keys

9. Cipher modes • When message is longer than one block, cannot just chop it into blocks and encrypt them independently of each other (why?) • Need a block-cipher mode, e.g. cipher-block chaining (CBC) • Random initialization vector (IV) makes ciphertexts different even if the message repeats (IV is also sent to the receiver, it is not secret) • Padding to expand text to full blocks [Wikimedia Commons]

10. Public-key encryption

11. Public-key encryption • Message encryption based on asymmetric cryptography • Key pair: public key and private key • Protectssecrets, notintegrity

12. RSA encryption • RSA encryption, published 1978 • Based on modulo arithmetic with large intergers • Simplified description of the algorithm: • p,q = large secret prime numbers (512…2024 bits) • Public modulus n = pq • Euler totient function ϕ(n) = (p-1)(q-1) (number of integers 1...n that are relatively prime with n) • Public exponent e, typically e=17 or e=216+1 • ed ≡ 1 (mod ϕ(n)), solve for secret exponent d • Encryption C = Me mod n • Decryption M = Cd mod n • Why does it work? Proof based on Euler’s theorem:xϕ(n)≡ 1 (mod n) • This is not all; for complete details, see PKCS#1 • Never implement RSA without following such a standard!

13. Example: RSA public key ASN.1 typetags 2048-bit modulus • 30 82 01 0a 02 82 01 01 00 c7 3a 73 01 f3 2e a8 72 25 3c 6b a4 14 54 24 e7 e0 ab 47 2e 9f 38 a7 12 77 dc cf 62 bc de 47 a2 55 34 a6 47 9e d6 13 90 3d 9f 72 aa 42 32 45 c4 4a b7 88 cc 7b c5 a6 18 4f d5 86 a4 9e fb 42 5f 37 47 53 e0 ff 10 2e cd ed 4a 4c a8 45 d9 88 09 cd 2f 5f 7d b6 9b 40 41 4f f7 a9 9b 7a 95 d4 a4 03 60 3e 3f 0b ff 83 d5 a9 3b 67 11 59 d7 8c aa be 61 91 d0 9d 5d 96 4f 75 39 fb e7 59 caca a0 63 47 bd b1 7c 32 27 1b 04 35 5a 5e e3 29 1a 06 98 2d 5a 47 d4 05 b3 22 3f fd 43 38 51 20 01 ad 1c 9e 4e ad 39 f4 d1 ae 90 7d f9 e0 81 89 d2 b7 ba cd 68 2e 62 b3 d7 ad 00 4c 52 24 29 97 37 8c 6e 36 31 bd 9d 3d 1d 4c 4c cc b0 b0 94 86 06 9c 13 02 27 c5 7c 1e 2e f6 e3 f6 13 37 d9 fb 23 9d e7 c7 d5 ce 94 54 7d efefdf 7b 7b 79 2e f9 75 37 8a c1 ef a5 c1 2a 01 e0 05 36 26 6a 98 bb d3 02 03 01 00 01 publicexponent (216+1)

14. Key distribution • Main advantage of public-key cryptography is easier key distribution • Shared secret keys, symmetric cryptography: • O(N2) pairwise keys for N participants → does not scale • Keys must be kept secret → hard to distribute safely • Public-key protocols, asymmetric cryptography: • N key pairs needed, one for each participant • Keys are public → can be posted on the Internet • BUT… both shared and public keys must be authentic • How does Alice know it shares KAB with Bob, not with Trent? • How does Alice know PKB is Bob’s public key, not Trent’s?

15. Cryptographic authentication

16. Cryptographic hash functions • Message digest, fingerprint • Hash function: arbitrary-length input, fixed-length output e.g. 160 bits • One-way = pre-image resistant: given only output, impossible to guess input • Second-pre-image resistant: given one input, impossible to find a second input that produces the same output • Collision-resistant: impossible to find any two inputs that produce the same output • Examples: MD5, SHA-1, SHA-256 • Notation: h(M), hash(M)

17. Hash collisions • 160...256-bit hash values to prevent birthday attack • If am N-bit hash value is safe against brute-force reversal, need 2·N bits to withstand birthday attack • Recent research has found collisions in standard hash functions (MD5, SHA-1) • Currently, any protocol that depends on collision-resistance needs a contingency plan in case collisions are found • Security proofs for many cryptographic protocols and signature schemes depend on collision resistance because it is part of the standard definition for hash functions • However, most network-security applications of hash functions do not really need collision resistance, only second-pre-image resistance

18. Message authentication code (MAC) • Message authentication and integrity protection based on symmetric cryptography • Endpoints share a secret key K • MAC appended to the original message M • Common implementations: HMAC-SHA1, HMAC-SHA256

19. Digital signature (1) • Message authentication and integrity protection with public-key crypto • Verifier has a public key PK; signer has the private key PK-1 • Messages are first hashed and then signed • Examples: DSS, RSA + SHA-256

20. How strong is cryptography? • Cryptographer: requires continuous analysis and improvement • Engineer: unbreakable if you use strong standard algorithms and 128-bit symmetric keys • May need to upgrade algorithms over decades • Avoid using algorithms in a creative way, different from their original purpose • Weak crypto is worse than no crypto • Hardly any excuse to use a relatively weak algorithm, even in resource constrained devices • Which algorithms can be trusted? • Block ciphers have withstood time well • Hash functions were considered safe until recently • Quantum computers might break public-key cryptography • Almost no absolute proofs of security exist! • Proving lower bounds on computational complexity is difficult

21. Remember that cryptography alone does not solve all security problems:“Whoever thinks his problem can be solved using cryptography, doesn’t understand the problem and doesn’t understand cryptography.” — attributed to Roger Needham and Butler Lampson

22. Reading material • Stallings and Brown: Computer security, principles and practice, 2008, chapters 2,19,20 • Ross Anderson: Security Engineering, 2nd ed., chapter 5 • Dieter Gollmann: Computer Security, 2nd ed., chapter 11; 3rd ed. chapter 14 • Stallings: Cryptography and Network Security: Principles and Practices, 3rd or 4th edition, Prentice Hall, chapters 2-3

23. Exercises • Confidentiality, integrity, availability – which can be protected with cryptography? • What kind of cryptography would you use to • protect files stored on disk • store client passwords on server disk • implement secure boot • protect email in transit • publish an electronic book • implement an electronic bus ticket • identify friendly and enemy aircraft (“friend or foe”) • sign an electronic contract • transmit satellite TV • protect software updates • send pseudonymous letters • timestamp an invention • Which applications require strong collision resistance of hash functions? What attacks have resulted from collisions in MD5? • Find out about DES cracking; why is DES vulnerable and how much security would it give today?