The libpqcrypto software library for post-quantum cryptography
|
|
|
- Mark Morrison
- 5 years ago
- Views:
Transcription
1 The libpqcrypto software library for post-quantum cryptography and many contributors
2 Context
3 Redesigning crypto for security New requirements for crypto software engineering to avoid real-world crypto disasters: No data flow from secrets to array indices. Stops, e.g., 2016 CacheBleed attack.
4 Redesigning crypto for security New requirements for crypto software engineering to avoid real-world crypto disasters: No data flow from secrets to array indices. Stops, e.g., 2016 CacheBleed attack. No data flow from secrets to branch conditions. Stops, e.g., 2018 RSA key-generation attack by Aldaya García Tapia Brumley.
5 Redesigning crypto for security New requirements for crypto software engineering to avoid real-world crypto disasters: No data flow from secrets to array indices. Stops, e.g., 2016 CacheBleed attack. No data flow from secrets to branch conditions. Stops, e.g., 2018 RSA key-generation attack by Aldaya García Tapia Brumley. No padding oracles. Stops, e.g., 2017 ROBOT attack.
6 Redesigning crypto for security But wait, there s more: Centralizing randomness: system has one central audited fast PRNG. Stops, e.g., Juniper fiasco discovered in Avoiding unnecessary randomness: use audited deterministic functions. Stops, e.g., 2017 ROCA attack. Eliminate low-security options. Stops, e.g., 2015 Logjam attack.
7 Curve25519, Ed25519, etc. Secure (and fast enough) crypto: Much simpler if we upgrade crypto primitives and protocols.
8 Curve25519, Ed25519, etc. Secure (and fast enough) crypto: Much simpler if we upgrade crypto primitives and protocols. Example: Upgrading signatures. Use ECC, not RSA. Does the user really need RSA signatures? Or is the goal high-security signatures?
9 Curve25519, Ed25519, etc. Secure (and fast enough) crypto: Much simpler if we upgrade crypto primitives and protocols. Example: Upgrading signatures. Use ECC, not RSA. Does the user really need RSA signatures? Or is the goal high-security signatures? Use Curve25519, not NSA (NIST) curves. Simpler (and faster!) secure implementations. Use EdDSA (Ed25519), not NSA signatures. Avoid, e.g., hassle of implementing inversion.
10 A modern cryptographic API Most libraries provide simple all-in-one hashing: const unsigned char m[...]; unsigned long long mlen; unsigned char h[crypto_hash_bytes]; crypto_hash_sha256(h,m,mlen);
11 A modern cryptographic API Most libraries provide simple all-in-one hashing: const unsigned char m[...]; unsigned long long mlen; unsigned char h[crypto_hash_bytes]; crypto_hash_sha256(h,m,mlen); Why not the same simplicity for, e.g., signing? crypto_sign_ed25519(sm,&smlen,m,mlen,sk);
12 A modern cryptographic API Most libraries provide simple all-in-one hashing: const unsigned char m[...]; unsigned long long mlen; unsigned char h[crypto_hash_bytes]; crypto_hash_sha256(h,m,mlen); Why not the same simplicity for, e.g., signing? crypto_sign_ed25519(sm,&smlen,m,mlen,sk); Huge impact of API upon usability: see 2017 Acar Backes Fahl Garfinkel Kim Mazurek Stransky.
13 Implementation and deployment Curve25519: ios starting 2010; WhatsApp starting 2016; formal verif in Firefox starting 2017; etc. NaCl software library (forks: TweetNaCl, libsodium): Curve25519, audited implementations, modern API. Competitions: Modern API required for submissions to CAESAR, NIST PQC, NIST Lightweight Crypto. SUPERCOP benchmarking framework: Modern API, no requirement of constant-time etc. Currently 2330 implementations of 633 primitives.
14 All done?
15
16 The PQCRYPTO consortium
17 The PQCRYPTO portfolio PQCRYPTO consortium, with many collaborators, submitted 22 proposals to NIST. Status: 0 broken.
18 The PQCRYPTO portfolio PQCRYPTO consortium, with many collaborators, submitted 22 proposals to NIST. Status: 0 broken. 2 of these: gigabyte RSA encryption + signatures; submitted as baseline, not part of portfolio.
19 The PQCRYPTO portfolio PQCRYPTO consortium, with many collaborators, submitted 22 proposals to NIST. Status: 0 broken. 2 of these: gigabyte RSA encryption + signatures; submitted as baseline, not part of portfolio. 47 non-pqcrypto proposals. Many now broken, usually broken by PQCRYPTO with collaborators.
20 The PQCRYPTO portfolio PQCRYPTO consortium, with many collaborators, submitted 22 proposals to NIST. Status: 0 broken. 2 of these: gigabyte RSA encryption + signatures; submitted as baseline, not part of portfolio. 47 non-pqcrypto proposals. Many now broken, usually broken by PQCRYPTO with collaborators. Some broken systems in traditional PQ categories: Compact LWE, lattice-based encryption scheme. Edon-K, code-based encryption scheme. Giophantus, multivariate signature scheme. Need detailed security analysis, not buzzwords.
21 50 signature systems in libpqcrypto crypto_sign_dilithium{2,3,4} crypto_sign_gui{184,312,448} crypto_sign_luov{863256,890351, , , , } crypto_sign_mqdss{48,64} crypto_sign_picnicl{1,3,5}{fs,ur} crypto_sign_qtesla{128,192,256} crypto_sign_rainbow{1a,1b,1c, 3b,3c,4a,5c,6a,6b} crypto_sign_sphincs{f,s}{128,192,256} {haraka,sha256,shake256}
22 27 encryption systems in libpqcrypto crypto_kem_bigquake{1,3,5} crypto_kem_mceliece{ , } crypto_kem_kyber{512,768,1024} crypto_kem_dags{3,5} crypto_kem_frodokem{640,976} crypto_kem_kindi{256342,256522, ,512241,512321} crypto_kem_newhope{512,1024}cca crypto_kem_ntruhrss701 crypto_kem_{ntrulpr,sntrup} crypto_kem_ramstakers{216091,756839} crypto_kem_{lightsaber,saber,firesaber}
23 NIST submissions vs. libpqcrypto Each NIST submission includes software: a reference C implementation; in many cases, also fast implementations. libpqcrypto integrates this software with a unified compilation framework;
24 NIST submissions vs. libpqcrypto Each NIST submission includes software: a reference C implementation; in many cases, also fast implementations. libpqcrypto integrates this software with a unified compilation framework; an automatic test framework;
25 NIST submissions vs. libpqcrypto Each NIST submission includes software: a reference C implementation; in many cases, also fast implementations. libpqcrypto integrates this software with a unified compilation framework; an automatic test framework; automatic selection of fastest implementations;
26 NIST submissions vs. libpqcrypto Each NIST submission includes software: a reference C implementation; in many cases, also fast implementations. libpqcrypto integrates this software with a unified compilation framework; an automatic test framework; automatic selection of fastest implementations; a unified C interface, modern API;
27 NIST submissions vs. libpqcrypto Each NIST submission includes software: a reference C implementation; in many cases, also fast implementations. libpqcrypto integrates this software with a unified compilation framework; an automatic test framework; automatic selection of fastest implementations; a unified C interface, modern API; a unified Python interface;
28 NIST submissions vs. libpqcrypto Each NIST submission includes software: a reference C implementation; in many cases, also fast implementations. libpqcrypto integrates this software with a unified compilation framework; an automatic test framework; automatic selection of fastest implementations; a unified C interface, modern API; a unified Python interface; command-line sig/verif/enc/dec tools;
29 NIST submissions vs. libpqcrypto Each NIST submission includes software: a reference C implementation; in many cases, also fast implementations. libpqcrypto integrates this software with a unified compilation framework; an automatic test framework; automatic selection of fastest implementations; a unified C interface, modern API; a unified Python interface; command-line sig/verif/enc/dec tools; command-line benchmarking tools.
30 C interface unsigned char pk[pqcrypto_sign_gui184_publickeybytes]; unsigned char sk[pqcrypto_sign_gui184_secretkeybytes]; #define mlen 7 unsigned char m[mlen] = "hello\n"; unsigned char sm[pqcrypto_sign_gui184_bytes + mlen]; unsigned long long smlen; unsigned char t[sizeof sm]; unsigned long long tlen; int main() { if (pqcrypto_sign_gui184_keypair(pk,sk)) abort(); if (pqcrypto_sign_gui184(sm,&smlen,m,mlen,sk)) abort(); if (pqcrypto_sign_gui184_open(t,&tlen,sm,smlen,pk)) abort(); if (tlen!= mlen) abort(); if (memcmp(t,m,mlen)) abort(); return 0; }
31 Python interface Generate key pair: pk,sk = pqcrypto.sign.gui184.keypair() Sign message m: sm = pqcrypto.sign.gui184.sign(m,sk) Recover message from signed message: m = pqcrypto.sign.gui184.open(sm,pk) If verification fails: exception and no output.
32 A larger Python example Test script to sign and recover a message under a random key pair: import pqcrypto sig = pqcrypto.sign.gui184 pk,sk = sig.keypair() m = b"hello world" sm = sig.sign(m,sk) assert m == sig.open(sm,pk)
33 Command-line signature interface Generate key pair: pq-keypair-gui184 5>publickey 9>secretkey (Shell uses numbers to identify multiple outputs. Also makes tool easy to use from other languages.) Sign message: pq-sign-gui184 <message 8<secretkey >sm Recover message from signed message: pq-open-gui184 <sm 4<publickey >message
34 Benchmarking one system $ pq-size-gui184 gui184 size publickey secretkey signature 45 $ pq-speed-gui184 gui184 speed keypair sign open $ pq-notes-gui184 gui184 implementation crypto_sign/gui184/pclmulqdq gui184 version - gui184 compiler gcc -fpic -Wall -march=native -mtune=native -O3 -fomit-frame-pointer -fwrapv
35 Benchmarking all systems $ pq-size-all dilithium2 size publickey 1184 secretkey 2800 signature 2044 dilithium3 size publickey 1472 secretkey 3504 signature 2701 dilithium4 size publickey 1760 secretkey 3856 signature 3366 gui184 size publickey secretkey signature 45 gui312 size publickey secretkey signature 63 gui448 size publickey secretkey signature 83 luov size publickey 7536 secretkey 32 signature 1746 luov size publickey secretkey 32 signature 3184 luov size publickey secretkey 32 signature 4850 luov size publickey secretkey 32 signature 521 luov size publickey secretkey 32 signature 319 luov size publickey secretkey 32 signature 441 mqdss48 size publickey 62 secretkey 32 signature mqdss64 size publickey 88 secretkey 48 signature picnicl1fs size publickey 33 secretkey 49 signature 34004
36 Benchmarking all systems picnicl1ur size publickey 33 secretkey 49 signature picnicl3fs size publickey 49 secretkey 73 signature picnicl3ur size publickey 49 secretkey 73 signature picnicl5fs size publickey 65 secretkey 97 signature picnicl5ur size publickey 65 secretkey 97 signature qtesla128 size publickey 4128 secretkey 2112 signature 3104 qtesla192 size publickey 8224 secretkey 8256 signature 6176 qtesla256 size publickey 8224 secretkey 8256 signature 6176 rainbow1a size publickey secretkey signature 64 rainbow1b size publickey secretkey signature 78 rainbow1c size publickey secretkey signature 104 rainbow3b size publickey secretkey signature 112 rainbow3c size publickey secretkey signature 156 rainbow4a size publickey secretkey signature 92 rainbow5c size publickey secretkey signature 204 rainbow6a size publickey secretkey signature 118
37 Benchmarking all systems rainbow6b size publickey secretkey signature 147 sphincsf128haraka size publickey 32 secretkey 64 signature sphincsf128sha256 size publickey 32 secretkey 64 signature sphincsf128shake256 size publickey 32 secretkey 64 signature 169 sphincsf192haraka size publickey 48 secretkey 96 signature sphincsf192sha256 size publickey 48 secretkey 96 signature sphincsf192shake256 size publickey 48 secretkey 96 signature 356 sphincsf256haraka size publickey 64 secretkey 128 signature 4921 sphincsf256sha256 size publickey 64 secretkey 128 signature 4921 sphincsf256shake256 size publickey 64 secretkey 128 signature 49 sphincss128haraka size publickey 32 secretkey 64 signature 8080 sphincss128sha256 size publickey 32 secretkey 64 signature 8080 sphincss128shake256 size publickey 32 secretkey 64 signature 808 sphincss192haraka size publickey 48 secretkey 96 signature sphincss192sha256 size publickey 48 secretkey 96 signature sphincss192shake256 size publickey 48 secretkey 96 signature 170
38 Benchmarking all systems sphincss256haraka size publickey 64 secretkey 128 signature 2979 sphincss256sha256 size publickey 64 secretkey 128 signature 2979 sphincss256shake256 size publickey 64 secretkey 128 signature 29 bigquake1 size publickey secretkey ciphertext 201 se bigquake3 size publickey secretkey ciphertext 406 se bigquake5 size publickey secretkey ciphertext 492 s dags3 size publickey secretkey ciphertext 2144 ses dags5 size publickey secretkey ciphertext 2144 ses firesaber size publickey 1312 secretkey 3040 ciphertext 1472 ses frodokem640 size publickey 9616 secretkey ciphertext 9736 frodokem976 size publickey secretkey ciphertext 1576 kindi size publickey 1184 secretkey 1472 ciphertext 1824 s kindi size publickey 1984 secretkey 2304 ciphertext 2752 s kindi size publickey 1456 secretkey 1712 ciphertext 2544 s kindi size publickey 1728 secretkey 2112 ciphertext 2752 s kindi size publickey 2368 secretkey 2752 ciphertext 3392 s
39 Benchmarking all systems kyber1024 size publickey 1440 secretkey 3168 ciphertext 1504 ses kyber512 size publickey 736 secretkey 1632 ciphertext 800 sessio kyber768 size publickey 1088 secretkey 2400 ciphertext 1152 sess lightsaber size publickey 672 secretkey 1568 ciphertext 736 sess mceliece size publickey secretkey ciphertex mceliece size publickey secretkey ciphertex newhope1024cca size publickey 1824 secretkey 3680 ciphertext 220 newhope512cca size publickey 928 secretkey 1888 ciphertext 1120 ntruhrss701 size publickey 1138 secretkey 1418 ciphertext 1278 s ntrulpr size publickey 1047 secretkey 1238 ciphertext 117 ramstakers size publickey secretkey ciphertext ramstakers size publickey secretkey ciphertex saber size publickey 992 secretkey 2304 ciphertext 1088 sessionk sntrup size publickey 1218 secretkey 1600 ciphertext 1047
40 Signature size (y) vs. public-key size (x)
41 The future Various libpqcrypto goals and ongoing work: Following constant-time rules. Already done for some implementations.
42 The future Various libpqcrypto goals and ongoing work: Following constant-time rules. Already done for some implementations. More tests, audits. Everything already passes Valgrind and ASan except NTRU-HRSS-KEM.
43 The future Various libpqcrypto goals and ongoing work: Following constant-time rules. Already done for some implementations. More tests, audits. Everything already passes Valgrind and ASan except NTRU-HRSS-KEM. Formal verification.
44 The future Various libpqcrypto goals and ongoing work: Following constant-time rules. Already done for some implementations. More tests, audits. Everything already passes Valgrind and ASan except NTRU-HRSS-KEM. Formal verification. Faster installation. Less CPU time. Already many speedups.
45 The future Various libpqcrypto goals and ongoing work: Following constant-time rules. Already done for some implementations. More tests, audits. Everything already passes Valgrind and ASan except NTRU-HRSS-KEM. Formal verification. Faster installation. Less CPU time. Already many speedups. Reducing code volume: e.g., SHA-3 merge.
46 The future Various libpqcrypto goals and ongoing work: Following constant-time rules. Already done for some implementations. More tests, audits. Everything already passes Valgrind and ASan except NTRU-HRSS-KEM. Formal verification. Faster installation. Less CPU time. Already many speedups. Reducing code volume: e.g., SHA-3 merge. Long term: Reduce number of primitives.
The libpqcrypto software library for post-quantum cryptography
The libpqcrypto software library for post-quantum cryptography and many contributors Context Redesigning crypto for security New requirements for crypto software engineering to avoid real-world crypto
POST-QUANTUM CRYPTOGRAPHY VIENNA CYBER SECURITY WEEK DR. DANIEL SLAMANIG
POST-QUANTUM CRYPTOGRAPHY VIENNA CYBER SECURITY WEEK 2018 02.02.2018 DR. DANIEL SLAMANIG WHAT IS POST-QUANTUM CRYPTOGRAPHY? Also called quantum safe/resistant cryptography NOT quantum cryptography (= quantum
8/30/17. Introduction to Post-Quantum Cryptography. Features Required from Today s Ciphers. Secret-key (Symmetric) Ciphers
CERG @ GMU http://cryptography.gmu.edu Introduction to Post-Quantum Cryptography 10 PhD students 3 MS students Features Required from Today s Ciphers Secret-key (Symmetric) Ciphers STRENGTH PERFORMANCE
Introduction to Post-Quantum Cryptography
Introduction to Post-Quantum Cryptography CERG @ GMU http://cryptography.gmu.edu 10 PhD students 3 MS students Features Required from Today s Ciphers STRENGTH PERFORMANCE software hardware FUNCTIONALITY
Introduction to Post-Quantum Cryptography
Introduction to Post-Quantum Cryptography CERG @ GMU http://cryptography.gmu.edu 10 PhD students 3 MS students 1 Features Required from Today s Ciphers STRENGTH PERFORMANCE software hardware FUNCTIONALITY
The transition to post-quantum cryptography. Peter Schwabe February 19, 2018
The transition to post-quantum cryptography Peter Schwabe peter@cryptojedi.org https://cryptojedi.org February 19, 2018 About me Assistant professor at Radboud University Working on high-speed high-security
NIST Post-Quantum Cryptography- A Hardware Evaluation Study
NIST Post-Quantum Cryptography- A Hardware Evaluation Study Kanad Basu 1, Deepraj Soni 1, Mohammed Nabeel 2 and Ramesh Karri 1 1 New York University, kb150,dss545,rkarri@nyu.edu 2 New York University,
HACL* in Mozilla Firefox Formal methods and high assurance applications for the web
HACL* in Mozilla Firefox Formal methods and high assurance applications for the web B. Beurdouche K. Bhargavan J. Protzenko J-K. Zinzindohoué (Project Everest) F. Kiefer E. Rescorla T. Taubert M. Thomson
Keep your fingers off my keys today & tomorrow
SIGS SE February 2017 Keep your fingers off my keys today & tomorrow Marcel Dasen VP Engineering Securosys SA Keys? Encryption keys asymmetric e.g. RSA, ECC public/private key pairs for wrapping symmetric
Update on NIST Post-Quantum Cryptography Standardization. Lily Chen National Institute of Standards and Technology USA
Update on NIST Post-Quantum Cryptography Standardization Lily Chen National Institute of Standards and Technology USA Where we are? Dec 2016 NIST Announcement of Call for Proposals on post-quantum cryptography
Sorting integer arrays: security, speed, and verification. D. J. Bernstein
Sorting integer arrays: security, speed, and verification 1 D. J. Bernstein Bob s laptop screen: 2 From: Alice Thank you for your submission. We received many interesting papers, and unfortunately your
SAFEcrypto: Secure Architectures of Future Emerging cryptography
SAFEcrypto: Secure Architectures of Future Emerging cryptography Máire O Neill Queen s University Belfast This project has received funding from the European Union H2020 research and innovation programme
Quantum-safe hybrid handshake for TLS 1.3
Quantum-safe hybrid handshake for TLS 1.3 Recent updates Sep 2015 Zhenfei Zhang Security Innovation QSH_TLS Run a classical key exchange as usual and obtain a classical premaster secret c; In parallel,
Benchmarking benchmarking, and optimizing optimization. Daniel J. Bernstein. University of Illinois at Chicago & Technische Universiteit Eindhoven
Benchmarking benchmarking, and optimizing optimization 1 Daniel J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven Bit operations per bit of plaintext 2 (assuming precomputed
Advanced Security for Systems Engineering VO 09: Applied Cryptography
Advanced Security for Systems Engineering VO 09: Applied Cryptography Clemens Hlauschek Lukas Brandstetter Christian Schanes INSO Industrial Software Institute of Computer Aided Automation Faculty of Informatics
Example: Adding 1000 integers on Cortex-M4F. Lower bound: 2n + 1 cycles for n LDR + n ADD. Imagine not knowing this : : :
Cryptographic software engineering, part 2 1 Daniel J. Bernstein Last time: General software engineering. Using const-time instructions. Comparing time to lower bound. Example: Adding 1000 integers on
McBits: fast constant-time code-based cryptography. (to appear at CHES 2013)
McBits: fast constant-time code-based cryptography (to appear at CHES 2013) D. J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven Joint work with: Tung Chou Technische Universiteit
CSE 127: Computer Security Cryptography. Kirill Levchenko
CSE 127: Computer Security Cryptography Kirill Levchenko October 24, 2017 Motivation Two parties want to communicate securely Secrecy: No one else can read messages Integrity: messages cannot be modified
Classic McEliece: conservative code-based cryptography
Classic McEliece: conservative code-based cryptography 1 D. J. Bernstein classic.mceliece.org Fundamental literature: 1962 Prange (attack) + many more attack papers. 1968 Berlekamp (decoder). 1970 1971
Post-Quantum Cryptography
Post-Quantum Cryptography Professor Máire O Neill www.csit.qub.ac.uk CSIT is a Research Centre of the ECIT Institute 1 Rationale What happens if/when quantum computers become a reality? Commonly used Public-key
Optimizing Post-Quantum Cryptographic Algorithms for Modern and Future Processor Architectures
Post-quantum cryptography for long-term security PQCRYPTO ICT-645622 PQCrypto Review Meeting / Workshop, Utrecht, the Netherlands, June 28, 2016 Optimizing Post-Quantum Cryptographic Algorithms for Modern
Towards Post-Quantum Cryptography Standardization. Lily Chen and Dustin Moody National Institute of Standards and Technology USA
Towards Post-Quantum Cryptography Standardization Lily Chen and Dustin Moody National Institute of Standards and Technology USA First mile - Towards PQC standardization After about four years of preparation,
Public-Key Encryption, Key Exchange, Digital Signatures CMSC 23200/33250, Autumn 2018, Lecture 7
Public-Key Encryption, Key Exchange, Digital Signatures CMSC 23200/33250, Autumn 2018, Lecture 7 David Cash University of Chicago Plan 1. Security of RSA 2. Key Exchange, Diffie-Hellman 3. Begin digital
NIST Post- Quantum Cryptography Standardiza9on
NIST Post- Quantum Cryptography Standardiza9on Lily Chen Cryptographic Technology Group Computer Security Division, Informa9on Technology Lab Na9onal Ins9tute of Standards and Technology (NIST) NIST Crypto
A Roadmap for High Assurance Cryptography
A Roadmap for High Assurance Cryptography Harry Halpin harry.halpin@inria.fr @harryhalpin (Twitter) NEXTLEAP (nextleap.eu) Harry Halpin Prosecco Thanks to Peter Schwabe (Radboud University) Harry.halpin@inria.fr
Slides by Kent Seamons and Tim van der Horst Last Updated: Oct 7, 2013
Digital Signatures Slides by Kent Seamons and Tim van der Horst Last Updated: Oct 7, 2013 Digital Signatures Diagram illustrating how to sign a message Why do we use a one-way hash? How does a collision
9/30/2016. Cryptography Basics. Outline. Encryption/Decryption. Cryptanalysis. Caesar Cipher. Mono-Alphabetic Ciphers
Cryptography Basics IT443 Network Security Administration Slides courtesy of Bo Sheng Basic concepts in cryptography systems Secret cryptography Public cryptography 1 2 Encryption/Decryption Cryptanalysis
Cryptography Basics. IT443 Network Security Administration Slides courtesy of Bo Sheng
Cryptography Basics IT443 Network Security Administration Slides courtesy of Bo Sheng 1 Outline Basic concepts in cryptography systems Secret key cryptography Public key cryptography Hash functions 2 Encryption/Decryption
Lecture 1 Applied Cryptography (Part 1)
Lecture 1 Applied Cryptography (Part 1) Patrick P. C. Lee Tsinghua Summer Course 2010 1-1 Roadmap Introduction to Security Introduction to Cryptography Symmetric key cryptography Hash and message authentication
Security: Cryptography
Security: Cryptography Computer Science and Engineering College of Engineering The Ohio State University Lecture 38 Some High-Level Goals Confidentiality Non-authorized users have limited access Integrity
Winter 2011 Josh Benaloh Brian LaMacchia
Winter 2011 Josh Benaloh Brian LaMacchia Symmetric Cryptography January 20, 2011 Practical Aspects of Modern Cryptography 2 Agenda Symmetric key ciphers Stream ciphers Block ciphers Cryptographic hash
18-642: Cryptography 11/15/ Philip Koopman
18-642: Cryptography 11/15/2017 Cryptography Overview Anti-Patterns for Cryptography Using a home-made cryptographic algorithm Using private key when public key is required Not considering key distribution
Botan s Implementation of the McEliece PKC
Botan s Implementation of the McEliece PKC Falko Strenzke cryptosource GmbH 1 1 Introduction The cryptographic C++ library Botan [1] features an implementation of the McEliece public key cryptosystem (PKC)
The H2020 PQCRYPTO project
The H2020 PQCRYPTO project Andreas Hülsing 05 October 2015 3rd ETSI/IQC Workshop on Quantum-Safe Cryptography Post-Quantum Cryptography for Long-term Security Project funded by EU in Horizon 2020. Starting
Post-Quantum Cryptography. Dr. Thomas Pöppelmann Infineon Technologies AG
Post-Quantum Cryptography Dr. Thomas Pöppelmann Infineon Technologies AG Agenda 1 Introduction 2 Post-Quantum Cryptography 3 Lattice-Based Cryptography 4 Hash- and Code-Based Cryptography 5 Outlook 2 Agenda
Introduction to Network Security Missouri S&T University CPE 5420 Data Integrity Algorithms
Introduction to Network Security Missouri S&T University CPE 5420 Data Integrity Algorithms Egemen K. Çetinkaya Egemen K. Çetinkaya Department of Electrical & Computer Engineering Missouri University of
CS 6324: Information Security More Info on Key Establishment: RSA, DH & QKD
ERIK JONSSON SCHOOL OF ENGINEERING & COMPUTER SCIENCE Cyber Security Research and Education Institute CS 6324: Information Security Dr. Junia Valente Department of Computer Science The University of Texas
Introduction to Cryptographic Systems. Asst. Prof. Mihai Chiroiu
Introduction to Cryptographic Systems Asst. Prof. Mihai Chiroiu Vocabulary In cryptography, cyphertext is the result of encryption performed on plaintext using an algorithm, called a cipher. Decryption
Computer Security: Principles and Practice
Computer Security: Principles and Practice Chapter 2 Cryptographic Tools First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Cryptographic Tools cryptographic algorithms
An Analysis of Special Microprocessor Instructions from Intel, Texas Instruments, and Atmel Supporting AES and Other Cryptographic Algorithms
An Analysis of Special Microprocessor Instructions from Intel, Texas Instruments, and Atmel Supporting AES and Other Cryptographic Algorithms Final Design Specification Shawn Wilkinson ECE646 Fall 2015
Asymmetric Cryptography. kprv. kpub. used in digital signature
Digital Signature logical representation: Asymmetric Cryptography plaintext plaintext kpub E kpub () kprv E kprv () ciphertext ciphertext kprv E -1 kprv () kpub E -1 kpub () used in digital envelope plaintext
Public-Key Cryptography
Computer Security Spring 2008 Public-Key Cryptography Aggelos Kiayias University of Connecticut A paradox Classic cryptography (ciphers etc.) Alice and Bob share a short private key using a secure channel.
Preparing for post-quantum cryptography in TLS
Preparing for post-quantum cryptography in TLS Douglas Stebila Funding acknowledgements: TLS:DIV workshop April 30, 2017 TLS:DIV 2017-04-30 Preparing for post-quantum cryptography in TLS Douglas Stebila
Public Key Algorithms
Public Key Algorithms 1 Public Key Algorithms It is necessary to know some number theory to really understand how and why public key algorithms work Most of the public key algorithms are based on modular
Initial recommendations of long-term secure post-quantum systems
Initial recommendations of long-term secure post-quantum systems Tanja Lange 07 September 2015 Dagstuhl Workshop on Quantum Cryptanalysis Post-Quantum Cryptography for Long-term Security Project funded
: Practical Cryptographic Systems March 25, Midterm
650.445: Practical Cryptographic Systems March 25, 2010 Instructor: Matthew Green Midterm Name: As with any exam, please do not collaborate or otherwise share information with any other person. You are
Cryptographic Concepts
Outline Identify the different types of cryptography Learn about current cryptographic methods Chapter #23: Cryptography Understand how cryptography is applied for security Given a scenario, utilize general
The State of Post- Quantum Cryptography. Presented by the Quantum Safe Security Working Group
The State of Post- Quantum Cryptography Presented by the Quantum Safe Security Working Group 2018 Cloud Security Alliance All Rights Reserved. You may download, store, display on your computer, view, print,
Lecture 10. Public Key Cryptography: Algorithms, Key Sizes, & Standards. Public-Key Cryptography. Elliptic Curve over GF(p) y 2 =x 3 +x
Lecture 10 Public Key Cryptography: Algorithms, Key Sizes, & Standards Public-Key Cryptography Bases of the public cryptosystems security Factorization Discrete Logarithm Elliptic Curve Discrete Logarithm
Hash-based Signatures
Hash-based Signatures IETF/IRTF CFRG Draft on XMSS Fraunhofer Workshop Series 01 Post-Quantum Cryptography in Practice Speaker: Dr. Bernhard Jungk 1 extended Merkle Signature Scheme 2 extended Merkle Signature
Implementing Cryptography: Good Theory vs. Bad Practice
Implementing Cryptography: Good Theory vs. Bad Practice Viet Pham Information Security Group, Department of Mathematics Royal Holloway, University of London Outline News report What is cryptography? Why
Computer Security CS 526
Computer Security CS 526 Topic 4 Cryptography: Semantic Security, Block Ciphers and Encryption Modes CS555 Topic 4 1 Readings for This Lecture Required reading from wikipedia Block Cipher Ciphertext Indistinguishability
Cryptography (Overview)
Cryptography (Overview) Some history Caesar cipher, rot13 substitution ciphers, etc. Enigma (Turing) Modern secret key cryptography DES, AES Public key cryptography RSA, digital signatures Cryptography
Vikram Hegde, Hanqing Zhao, Kefeng Shi, and Yi Yang Fontbonne University St. Louis, Missouri
SECURE MOBILE APPS BASED ON NTRU Vikram Hegde, Hanqing Zhao, Kefeng Shi, and Yi Yang Fontbonne University St. Louis, Missouri The need for mobile security The inefficiency of traditional algorithms in
Introduction to Public-Key Cryptography
Introduction to Public-Key Cryptography Nadia Heninger University of Pennsylvania June 11, 2018 We stand today on the brink of a revolution in cryptography. Diffie and Hellman, 1976 Symmetric cryptography
Cryptography and the Common Criteria (ISO/IEC 15408) by Kirill Sinitski
Cryptography and the Common Criteria (ISO/IEC 15408) by Kirill Sinitski About CygnaCom FIPS and Common Criteria Services Accredited testing laboratories NIAP, NIST, CSEC Professional Services PKI infrastructure
CHAPTER - 4 FRAMEWORK FOR ENHANCING SECURITY AND RUN TIME OPTMIZATION IN CRYPTOGRAPHIC ALGORITHMS
CHAPTER - 4 FRAMEWORK FOR ENHANCING SECURITY AND RUN TIME OPTMIZATION IN CRYPTOGRAPHIC ALGORITHMS High achievement always takes place in the framework of high expectation -Charles Kettering 4.1 Background
Chapter 9 Public Key Cryptography. WANG YANG
Chapter 9 Public Key Cryptography WANG YANG wyang@njnet.edu.cn Content Introduction RSA Diffie-Hellman Key Exchange Introduction Public Key Cryptography plaintext encryption ciphertext decryption plaintext
Hashes, MACs & Passwords. Tom Chothia Computer Security Lecture 5
Hashes, MACs & Passwords Tom Chothia Computer Security Lecture 5 Today s Lecture Hashes and Message Authentication Codes Properties of Hashes and MACs CBC-MAC, MAC -> HASH (slow), SHA1, SHA2, SHA3 HASH
symmetric cryptography s642 computer security adam everspaugh
symmetric cryptography s642 adam everspaugh ace@cs.wisc.edu computer security Announcement Midterm next week: Monday, March 7 (in-class) Midterm Review session Friday: March 4 (here, normal class time)
Public Key Cryptography
graphy CSS322: Security and Cryptography Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 29 December 2011 CSS322Y11S2L07, Steve/Courses/2011/S2/CSS322/Lectures/rsa.tex,
Lecture 1: Perfect Security
CS 290G (Fall 2014) Introduction to Cryptography Oct 2nd, 2014 Instructor: Rachel Lin 1 Recap Lecture 1: Perfect Security Scribe: John Retterer-Moore Last class, we introduced modern cryptography and gave
Computer Security. 08. Cryptography Part II. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 08. Cryptography Part II Paul Krzyzanowski Rutgers University Spring 2018 March 23, 2018 CS 419 2018 Paul Krzyzanowski 1 Block ciphers Block ciphers encrypt a block of plaintext at a
Computer Security 3/23/18
s s encrypt a block of plaintext at a time and produce ciphertext Computer Security 08. Cryptography Part II Paul Krzyzanowski DES & AES are two popular block ciphers DES: 64 bit blocks AES: 128 bit blocks
Encryption. INST 346, Section 0201 April 3, 2018
Encryption INST 346, Section 0201 April 3, 2018 Goals for Today Symmetric Key Encryption Public Key Encryption Certificate Authorities Secure Sockets Layer Simple encryption scheme substitution cipher:
Cryptography Introduction
Cryptography Introduction Last Updated: Aug 20, 2013 Terminology Access Control o Authentication Assurance that entities are who they claim to be o Authorization Assurance that entities have permission
Lecture 18 Message Integrity. Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Slides from Miller & Bailey s ECE 422
Lecture 18 Message Integrity Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Slides from Miller & Bailey s ECE 422 Cryptography is the study/practice of techniques for secure communication,
Recommendation to Protect Your Data in the Future
Recommendation to Protect Your Data in the Future Prof. Dr.-Ing. Tim Güneysu Arbeitsgruppe Technische Informatik / IT-Sicherheit (CEITS) LEARNTEC Karlsruhe 27.01.2016 Long-Term Security in the Real World
A roadmap to migrating the internet to quantum-safe cryptography
A roadmap to migrating the internet to quantum-safe cryptography William Whyte, Security Innovation 2013-09-26 Conditions for successful deployment Post-quantum crypto must be: Agreed Standardized in core
ESP Egocentric Social Platform
ESP Egocentric Social Platform T. J. Purtell, Ian Vo, Monica S. Lam With: Kanak Biscuitwala, Willem Bult, Dan Boneh, Ben Dodson, Steve Fan, and Frank Wang, Global Social Platforms Ideal for Meeting strangers
COMP4109 : Applied Cryptography
COMP4109 : Applied Cryptography Fall 2013 M. Jason Hinek Carleton University Applied Cryptography Day 2 information security cryptographic primitives unkeyed primitives NSA... one-way functions hash functions
CS408 Cryptography & Internet Security
CS408 Cryptography & Internet Security Lectures 16, 17: Security of RSA El Gamal Cryptosystem Announcement Final exam will be on May 11, 2015 between 11:30am 2:00pm in FMH 319 http://www.njit.edu/registrar/exams/finalexams.php
Public-Key Cryptanalysis
http://www.di.ens.fr/ pnguyen INRIA and École normale supérieure, Paris, France MPRI, 2010 Outline 1 Introduction Asymmetric Cryptology Course Overview 2 Textbook RSA 3 Euclid s Algorithm Applications
Cryptography Today. Ali El Kaafarani. Mathematical Institute Oxford University. 1 of 44
Cryptography Today Ali El Kaafarani Mathematical Institute Oxford University 1 of 44 About the Course Regular classes with worksheets so you can work with some concrete examples (every Friday at 1pm).
Part VI. Public-key cryptography
Part VI Public-key cryptography Drawbacks with symmetric-key cryptography Symmetric-key cryptography: Communicating parties a priori share some secret information. Secure Channel Alice Unsecured Channel
Table of Contents. Preface... vii Abstract... vii Kurzfassung... x Acknowledgements... xiii. I The Preliminaries 1
Preface............................................ vii Abstract............................................ vii Kurzfassung.......................................... x Acknowledgements......................................
SIDH on ARM: Faster Modular Multiplications for Faster Post-Quantum Supersingular Isogeny Key Exchange.
SIDH on ARM: Faster Modular Multiplications for Faster Post-Quantum Supersingular Isogeny Key Exchange. Hwajeong Seo (Hansung University), Zhe Liu (Nanjing University of Aeronautics and Astronautics),
Lecture 6: Symmetric Cryptography. CS 5430 February 21, 2018
Lecture 6: Symmetric Cryptography CS 5430 February 21, 2018 The Big Picture Thus Far Attacks are perpetrated by threats that inflict harm by exploiting vulnerabilities which are controlled by countermeasures.
Chapter 18: wolfcrypt API Reference
Chapter 18: wolfcrypt API Reference Table of Contents March, 2016 Version 3.9.0 18.1 AES 18.2 Arc4 18.3 ASN 18.4 Blake2 18.5 Camellia 18.6 ChaCha 18.7 ChaCha20 with Poly1305 18.8 Coding 18.9 Compression
Cryptography CS 555. Topic 1: Course Overview & What is Cryptography
Cryptography CS 555 Topic 1: Course Overview & What is Cryptography 1 Administrative Note Professor Blocki is traveling and will be back on Wednesday. E-mail: jblocki@purdue.edu Thanks to Professor Spafford
Lecture 2 Applied Cryptography (Part 2)
Lecture 2 Applied Cryptography (Part 2) Patrick P. C. Lee Tsinghua Summer Course 2010 2-1 Roadmap Number theory Public key cryptography RSA Diffie-Hellman DSA Certificates Tsinghua Summer Course 2010 2-2
Introduction. CSE 5351: Introduction to cryptography Reading assignment: Chapter 1 of Katz & Lindell
Introduction CSE 5351: Introduction to cryptography Reading assignment: Chapter 1 of Katz & Lindell 1 Cryptography Merriam-Webster Online Dictionary: 1. secret writing 2. the enciphering and deciphering
Test Conditions. Closed book, closed notes, no calculator, no laptop just brains 75 minutes. Steven M. Bellovin October 19,
Test Conditions Closed book, closed notes, no calculator, no laptop just brains 75 minutes Steven M. Bellovin October 19, 2005 1 Form 8 questions I m not asking you to write programs or even pseudo-code
Public Key Cryptography
Public Key Cryptography Giuseppe F. Italiano Universita` di Roma Tor Vergata italiano@disp.uniroma2.it Motivation Until early 70s, cryptography was mostly owned by government and military Symmetric cryptography
Distributed Systems. 26. Cryptographic Systems: An Introduction. Paul Krzyzanowski. Rutgers University. Fall 2015
Distributed Systems 26. Cryptographic Systems: An Introduction Paul Krzyzanowski Rutgers University Fall 2015 1 Cryptography Security Cryptography may be a component of a secure system Adding cryptography
Analysis, demands, and properties of pseudorandom number generators
Analysis, demands, and properties of pseudorandom number generators Jan Krhovják Department of Computer Systems and Communications Faculty of Informatics, Masaryk University Brno, Czech Republic Jan Krhovják
A Guide to the ECCelerate Library 5.0
A Guide to the ECCelerate Library 5.0 3 y 2 1 1 1 2 x 1 2 3 Elliptic Curve Cryptography by IAIK July 12, 2018 ECCelerate Tutorial IAIK, Graz University of Technology Contents 1 Introduction 1 2 Features
Elliptic Curve Public Key Cryptography
Why? Elliptic Curve Public Key Cryptography ECC offers greater security for a given key size. Why? Elliptic Curve Public Key Cryptography ECC offers greater security for a given key size. The smaller key
RSA (algorithm) History
RSA (algorithm) RSA is an algorithm for public-key cryptography that is based on the presumed difficulty of factoring large integers, the factoring problem. RSA stands for Ron Rivest, Adi Shamir and Leonard
PQ-Crypto Standardization Preparing today for the future of cryptography
PQ-Crypto Standardization Preparing today for the future of cryptography Workshop Quantum-Safe Cryptography for Industry (QsCI) Aline Gouget Principal researcher, Advanced Cryptography team Manager Embedded
Dyadic Security Enterprise Key Management
Dyadic Security Enterprise Key Management The Secure-as-Hardware Software with a Mathematical Proof Dyadic Enterprise Key Management (EKM) is the first software-only key management and key protection system
CSCI 454/554 Computer and Network Security. Topic 5.2 Public Key Cryptography
CSCI 454/554 Computer and Network Security Topic 5.2 Public Key Cryptography Outline 1. Introduction 2. RSA 3. Diffie-Hellman Key Exchange 4. Digital Signature Standard 2 Introduction Public Key Cryptography
The use of Elliptic Curve Cryptography in DNSSEC
The use of Elliptic Curve Cryptography in DNSSEC Francis Dupont Internet Systems Consortium fdupont@isc.org 3 may 2013 Abstract The RFC 6605 introduced the modern cryptography based on elliptic curves
3 rd SKINNY Breaking Competition
3 rd SKINNY Breaking Competition C. Beierle, J. Jean, S. Kӧlbl, G. Leander, A. Moradi, T. Peyrin, Y. Sasaki, P. Sasdrich and S.M. Sim Eurocrypt 2018 Rump Session@ Tel Aviv 01/May/2018 SKINNY Overview Lightweight
Covert Communication & Malicious Cryptography
Computer Security Spring 2008 Covert Communication & Malicious Cryptography Aggelos Kiayias University of Connecticut Covert Channel A covert channel is a communication channel that carries information
Cryptography Functions
Cryptography Functions Lecture 3 1/29/2013 References: Chapter 2-3 Network Security: Private Communication in a Public World, Kaufman, Perlman, Speciner Types of Cryptographic Functions Secret (Symmetric)
Outline. CSCI 454/554 Computer and Network Security. Introduction. Topic 5.2 Public Key Cryptography. 1. Introduction 2. RSA
CSCI 454/554 Computer and Network Security Topic 5.2 Public Key Cryptography 1. Introduction 2. RSA Outline 3. Diffie-Hellman Key Exchange 4. Digital Signature Standard 2 Introduction Public Key Cryptography
What did we talk about last time? Public key cryptography A little number theory
Week 4 - Friday What did we talk about last time? Public key cryptography A little number theory If p is prime and a is a positive integer not divisible by p, then: a p 1 1 (mod p) Assume a is positive
PyNaCl. Release 0.2.1
PyNaCl Release 0.2.1 March 04, 2015 Contents 1 Public Key Encryption 3 1.1 Example................................................. 3 1.2 Reference................................................. 4 2
PyNaCl Documentation. Release Donald Stufft
PyNaCl Documentation Release 0.1.0 Donald Stufft October 27, 2013 CONTENTS i ii Contents: CONTENTS 1 2 CONTENTS CHAPTER ONE PUBLIC KEY ENCRYPTION Imagine Alice wants something valuable shipped to her.