Permutation-based Authenticated Encryption
|
|
|
- Jody Melton
- 5 years ago
- Views:
Transcription
1 Permutation-based Authenticated Encryption Gilles Van Assche 1 1 STMicroelectronics COST Training School on Symmetric Cryptography and Blockchain Torremolinos, Spain, February / 44
2 Outline 1 Why permutations? 2 What is authenticated encryption? 3 An ideal AE scheme 4 Back to sponges 2 / 44
3 Why permutations? Outline 1 Why permutations? 2 What is authenticated encryption? 3 An ideal AE scheme 4 Back to sponges 3 / 44
4 Why permutations? Symmetric crypto: what textbooks and intro s say Symmetric cryptography primitives: Block ciphers Key stream generators Hash functions And their modes-of-use Picture by GlasgowAmateur 4 / 44
5 Why permutations? The truth about symmetric crypto today Block ciphers: 5 / 44
6 Why permutations? What block cipher are used for Hashing (as discussed) and its modes HMAC, MGF1, Block encryption: ECB, CBC, Stream encryption: synchronous: counter mode, OFB, self-synchronizing: CFB MAC computation: CBC-MAC, C-MAC, Authenticated encryption: OCB, GCM, CCM 6 / 44
7 Why permutations? Block cipher operation 7 / 44
8 Why permutations? Block cipher operation: the inverse 8 / 44
9 Why permutations? When do you need the inverse? Indicated in red: Hashing and its modes HMAC, MGF1, Block encryption: ECB, CBC, Stream encryption: synchronous: counter mode, OFB, self-synchronizing: CFB MAC computation: CBC-MAC, C-MAC, Authenticated encryption: OCB, GCM, CCM Most schemes with misuse-resistant claims So for most uses you don t need the inverse! 9 / 44
10 Block cipher internals Why permutations? 10 / 44
11 Why permutations? Davies-Meyer compression function 11 / 44
12 Why permutations? Removing diffusion restriction not required in hashing 12 / 44
13 Why permutations? Simplifying the view: iterated permutation 13 / 44
14 Why permutations? Designing a permutation Remaining problem: design of iterated permutation round function: good approaches known asymmetry: round constants Advantages with respect to block ciphers: less barriers more diffusion no more need for efficient inverse no more worries about key schedule 14 / 44
15 Why permutations? Examples of permutations In Salsa, Chacha, Grindahl In SHA-3 candidates: CubeHash, Grøstl, JH, MD6, In CAESAR candidates: Ascon, Icepole, Norx, π-cipher, Primates, Stribob, And of course in Keccak 15 / 44
16 What is authenticated encryption? Outline 1 Why permutations? 2 What is authenticated encryption? 3 An ideal AE scheme 4 Back to sponges 16 / 44
17 What is authenticated encryption? What is authenticated encryption (AE)? Messages and cryptograms M = (AD, P) message with associated data and plaintext M c = (AD, C) cryptogram with associated data and ciphertext All of M is authenticated but only P is encrypted wrapping: M to M c unwrapping: M c to M Symmetric cryptography: same key used for both operations Authentication aspect unwrapping includes verification of M c if not valid, it returns an error wrap operation adds redundancy: C > P often redundancy coded at the end of C: tag T Note: this is usually called AEAD 17 / 44
18 What is authenticated encryption? Limitation of AE: traffic analysis Traffic analysis: length of messages number of messages Solution creating dummy messages random-length padding of plaintext to be done on higher layer AE scheme security should be independent from this layer 18 / 44
19 What is authenticated encryption? Limitation of AE: need for message uniqueness Concrete AE proposals are deterministic Equal messages lead to equal cryptograms information leakage concern of replay attacks at unwrapping end Solution is using nonces (Number used only ONCE) impose that the AD is a nonce for the given key K often presented as a separate field N wrapping engine shall ensure (K, N) is unique wrapping becomes stateful a simple message counter suffices From now on we always include a nonce N 19 / 44
20 What is authenticated encryption? Functional behaviour Wrapping: state: K and past nonces N input: M = (N, AD, P) output: C or processing: if (N N ) return else add N to N and return C Wrap[K](N, AD, P) Unwrapping: state: K input: M c = (N, AD, C) output: P or processing: return Unwrap[K](N, AD, C): P if valid and otherwise 20 / 44
21 What is authenticated encryption? Sessions Session: cryptogram authenticates also previous messages full sequence of messages since the session started Additional protection against: insertion, omission, re-ordering of messages within a session Attention point: last message of session Alternative view: splits a long cryptogram in shorter ones intermediate tags See [Bellare, Kohno and Namprempre, ACM 2003], [KT, SAC 2011], [Boldyreva, Degabriele, Paterson, Stam, EC 2012] and [Hoang, Reyhanitabar, Rogaway and Vizár, 2015] 21 / 44
22 What is authenticated encryption? Functional behaviour, with sessions Initialization of stateful session object D state: past nonces N (may be omitted for unwrapping) input: key K, nonce N processing: if (N N ) return else add N to N and create D with D.S Init(K, N) D.S will be updated during the session Wrapping return C (i) D.Wrap(AD (i), P (i) ) this updates D.S Unwrapping return D.Unwrap(AD (i), C (i) ): P (i) or in case of no error, this updates D.S session may be aborted after specific number of errors 22 / 44
23 An ideal AE scheme Outline 1 Why permutations? 2 What is authenticated encryption? 3 An ideal AE scheme 4 Back to sponges 23 / 44
24 An ideal AE scheme Pseudo-random function (PRF) input 24 / 44
25 An ideal AE scheme Stream cipher nonce plaintext = ciphertext 25 / 44
26 An ideal AE scheme Message authentication code (MAC) plaintext plaintext 26 / 44
27 An ideal AE scheme Authenticated encryption nonce plaintext plaintext = ciphertext 27 / 44
28 An ideal AE scheme Incrementality packet #1 packet #1 28 / 44
29 An ideal AE scheme Incrementality packet #1 packet #2 packet #1 packet #2 28 / 44
30 An ideal AE scheme Incrementality packet #1 packet #2 packet #3 packet #1 packet #2 packet #3 28 / 44
31 An ideal AE scheme An ideal AE scheme Separate fixed-length tag, so M c = (N, AD, C, T) Functional components: random oracle RO variable output length, implied by the context RO e ( ) = RO( 1) for encryption RO a ( ) = RO( 0) for tag computation Wrapping if (N N ) it returns C RO e (K N AD) P T RO a (K N AD P) Unwrapping P RO e (K N AD) C T RO a (K N AD P) If (T = T) return, else return P Note: RO input shall be uniquely decodable in K, N AD and P 29 / 44
32 An ideal AE scheme Ideal AE scheme, now supporting sessions Initialization if (N N ) it returns D.S K N Wrapping of M (i) = (AD (i), P (i) ) D.S D.S AD (i) 1 D.S D.S P (i) 0 return (C (i), T (i) ) and then C (i) RO(D.S) P (i) and then T (i) RO(D.S) Unwrapping of M (i) c = (AD (i), C (i), T (i) ) save current state in case of error: S D.S D.S D.S AD (i) 1 and then P (i) RO(D.S) C (i) D.S D.S P (i) 0 and then τ RO(D.S) if (τ = T (i) ) return P (i), else D.S S and then return Note: RO input shall be uniquely decodable in K, N AD (i) and P (i) 30 / 44
33 An ideal AE scheme Security of our ideal AE scheme Attack model: adversary can adaptively query: Init, respecting nonce uniqueness (not counted), D.Wrap (q w times) and D.Unwrap (q u times) RO(x): n times Input to RO(K ) never repeats: outputs are uniformly random intra-session: each input to RO is longer than previous one inter-session: first part of RO input (N, K) never repeated So cryptograms C (i) and tags T (i) are uniformly random 31 / 44
34 An ideal AE scheme Forgery Target: building sequence of valid cryptograms M (1) c... M (l) c not obtained from calls to wrap for some M (1)... M (l) Strategy: best strategy: send random but well-formatted cryptograms success probability for q u attempts: q u 2 T Success after 2 T online calls to D.Unwrap 32 / 44
35 An ideal AE scheme Privacy break Target: learning on plaintext bits of M (l) c without unwrapping all of M (1) c Strategy:... M (l) c best strategy at unwrap: send cryptograms with modified C i or T i success probability for q u attempts: q u 2 T Success after 2 T online calls to D.Unwrap 33 / 44
36 An ideal AE scheme Key recovery Target(s): Strategy: single target key: getting one specific key multiple target: getting one key out of m target keys best strategy: exhaustive key search single target: success probability for n key guesses n2 K multi-target: success probability for n key guesses mn2 K 1 out of m keys recovered after 2 K log 2(m+1) offline calls to RO( ) Countermeasure: global nonce 34 / 44
37 Back to sponges Outline 1 Why permutations? 2 What is authenticated encryption? 3 An ideal AE scheme 4 Back to sponges 35 / 44
38 Back to sponges Use Sponge for MACing Key Padded message MAC 0 f f f f f 36 / 44
39 Back to sponges Use Sponge for (stream) encryption Key IV 0 f f f Key stream Similar to block cipher modes: Long keystream per IV: like OFB Short keystream per IV: like counter mode 37 / 44
40 Back to sponges Single pass authenticated encryption Key IV Padded message MAC 0 f f f f f Key stream But this is no longer the sponge 38 / 44
41 Back to sponges The duplex construction Object: D = duplex[f, pad, r] Requesting l-bit output Z = D.duplexing(σ, l) input σ and output Z limited in length Z depends on all previous inputs 39 / 44
42 Back to sponges Generating duplex responses with a sponge Z 0 = sponge(σ 0, l 0 ) 40 / 44
43 Back to sponges Generating duplex responses with a sponge Z 1 = sponge(pad(σ 0 ) σ 1, l 1 ) 40 / 44
44 Back to sponges Generating duplex responses with a sponge Z 2 = sponge(pad(σ 0 ) pad(σ 1 ) σ 2, l 2 ) 40 / 44
45 Back to sponges Full-state keyed duplex Z ¾ Z ¾ Z ¾ K ± iv f f f [Mennink, Reyhanitabar and Vizár, Asiacrypt 2015] [Daemen, Mennink, VA, Asiacrypt 2017] 41 / 44
46 Back to sponges Example: Keyak An authenticated-encryption scheme submitted to CAESAR using Keccak-p[1600, n r = 12] or Keccak-p[800, n r = 12] 0 SUV 1 T (0) SUV = Secret and Unique Value Works in sessions 42 / 44
47 Back to sponges Example: Keyak An authenticated-encryption scheme submitted to CAESAR using Keccak-p[1600, n r = 12] or Keccak-p[800, n r = 12] 0 SUV 1 P(1) A (1) T (0) C (1) T (1) SUV = Secret and Unique Value Works in sessions 42 / 44
48 Back to sponges Example: Keyak An authenticated-encryption scheme submitted to CAESAR using Keccak-p[1600, n r = 12] or Keccak-p[800, n r = 12] 0 SUV 1 P(1) A (1) P (2) T (0) C (1) T (1) C (2) T (2) SUV = Secret and Unique Value Works in sessions 42 / 44
49 Back to sponges Example: Keyak An authenticated-encryption scheme submitted to CAESAR using Keccak-p[1600, n r = 12] or Keccak-p[800, n r = 12] 0 SUV 1 P(1) A (1) P (2) A (3) T (0) C (1) T (1) C (2) T (2) T (3) SUV = Secret and Unique Value Works in sessions 42 / 44
50 Conclusions What textbooks and intro s should say from now on :-) Symmetric cryptography primitives: Block ciphers Key stream generators Permutations And their modes-of-use Picture by Sébastien Wiertz 43 / 44
51 Conclusions Any questions? Thanks for your attention! Q? 44 / 44
On authenticated encryption and the CAESAR competition
On authenticated encryption and the CAESAR competition Joan Daemen STMicroelectronics and Radboud University Crypto summer school 2015 Šibenik, Croatia, May 31 - June 5, 2015 1 / 39 What is authenticated
Permutation-based symmetric cryptography
Permutation-based symmetric cryptography Guido Bertoni 1 Joan Daemen 1 Michaël Peeters 2 Gilles Van Assche 1 1 STMicroelectronics 2 NXP Semiconductors Keccak & SHA-3 Day Université Libre de Bruxelles March
Message authentication codes
Message authentication codes Martin Stanek Department of Computer Science Comenius University stanek@dcs.fmph.uniba.sk Cryptology 1 (2017/18) Content Introduction security of MAC Constructions block cipher
Midgame Attacks. (and their consequences) Donghoon Chang 1 and Moti Yung 2. IIIT-Delhi, India. Google Inc. & Columbia U., USA
Midgame Attacks (and their consequences) Donghoon Chang 1 and Moti Yung 2 1 IIIT-Delhi, India 2 Google Inc. & Columbia U., USA Crypto is a Technical Science As technology moves, so should crypto designs
ECE 646 Lecture 8. Modes of operation of block ciphers
ECE 646 Lecture 8 Modes of operation of block ciphers Required Reading: I. W. Stallings, "Cryptography and Network-Security," 5 th and 6 th Edition, Chapter 6 Block Cipher Operation II. A. Menezes, P.
Feedback Week 4 - Problem Set
4/26/13 Homework Feedback Introduction to Cryptography Feedback Week 4 - Problem Set You submitted this homework on Mon 17 Dec 2012 11:40 PM GMT +0000. You got a score of 10.00 out of 10.00. Question 1
H must be collision (2n/2 function calls), 2nd-preimage (2n function calls) and preimage resistant (2n function calls)
What is a hash function? mapping of: {0, 1} {0, 1} n H must be collision (2n/2 function calls), 2nd-preimage (2n function calls) and preimage resistant (2n function calls) The Merkle-Damgård algorithm
SHA-3 vs the world. David Wong
SHA-3 vs the world David Wong Sneru MD4 Sneru MD4 Sneru MD4 MD5 Merkle Damgård SHA-1 SHA-2 Sneru MD4 MD5 Merkle Damgård SHA-1 SHA-2 Sneru MD4 MD5 Merkle Damgård SHA-1 SHA-2 Sneru MD4 MD5 Merkle Damgård
Summary on Crypto Primitives and Protocols
Summary on Crypto Primitives and Protocols Levente Buttyán CrySyS Lab, BME www.crysys.hu 2015 Levente Buttyán Basic model of cryptography sender key data ENCODING attacker e.g.: message spatial distance
CAESAR submission: K v1
CAESAR submission: K v1 Designed and submi ed by: Guido B 1 Joan D 1 Michaël P 2 Gilles V A 1 Ronny V K 1 http://keyak.noekeon.org/ keyak (at) noekeon (dot) org Version 1.0 March 13, 2014 1 STMicroelectronics
Solutions to exam in Cryptography December 17, 2013
CHALMERS TEKNISKA HÖGSKOLA Datavetenskap Daniel Hedin DIT250/TDA351 Solutions to exam in Cryptography December 17, 2013 Hash functions 1. A cryptographic hash function is a deterministic function that
Lecture 6: Symmetric Cryptography. CS 5430 February 21, 2018
Lecture 6: Symmetric Cryptography CS 5430 February 21, 2018 The Big Picture Thus Far Attacks are perpetrated by threats that inflict harm by exploiting vulnerabilities which are controlled by countermeasures.
HOST Cryptography III ECE 525 ECE UNM 1 (1/18/18)
AES Block Cipher Blockciphers are central tool in the design of protocols for shared-key cryptography What is a blockcipher? It is a function E of parameters k and n that maps { 0, 1} k { 0, 1} n { 0,
Cryptography Basics. IT443 Network Security Administration Slides courtesy of Bo Sheng
Cryptography Basics IT443 Network Security Administration Slides courtesy of Bo Sheng 1 Outline Basic concepts in cryptography systems Secret key cryptography Public key cryptography Hash functions 2 Encryption/Decryption
Winter 2011 Josh Benaloh Brian LaMacchia
Winter 2011 Josh Benaloh Brian LaMacchia Symmetric Cryptography January 20, 2011 Practical Aspects of Modern Cryptography 2 Agenda Symmetric key ciphers Stream ciphers Block ciphers Cryptographic hash
Automated Analysis and Synthesis of Modes of Operation and Authenticated Encryption Schemes
Automated Analysis and Synthesis of Modes of Operation and Authenticated Encryption Schemes Alex J. Malozemoff University of Maryland Joint work with Matthew Green, Viet Tung Hoang, and Jonathan Katz Presented
Symmetric Cryptography
CSE 484 (Winter 2010) Symmetric Cryptography Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee, and many others for sample slides and materials...
Security Analysis of Extended Sponge Functions. Thomas Peyrin
Security Analysis of Extended Sponge Functions Hash functions in cryptology: theory and practice Leiden, Netherlands Orange Labs University of Versailles June 4, 2008 Outline 1 The Extended Sponge Functions
CS155. Cryptography Overview
CS155 Cryptography Overview Cryptography Is n n A tremendous tool The basis for many security mechanisms Is not n n n n The solution to all security problems Reliable unless implemented properly Reliable
symmetric cryptography s642 computer security adam everspaugh
symmetric cryptography s642 adam everspaugh ace@cs.wisc.edu computer security Announcements Midterm next week: Monday, March 7 (in-class) Midterm Review session Friday: March 4 (here, normal class time)
DIAC 2015, Sept, Singapore
π-cipher V2.0 Danilo Gligoroski, ITEM, NTNU, Norway Hristina Mihajloska, FCSE, UKIM, Macedonia Simona Samardjiska, FCSE, UKIM, Macedonia Håkon Jacobsen, ITEM, NTNU, Norway Mohamed El-Hadedy, University
9/30/2016. Cryptography Basics. Outline. Encryption/Decryption. Cryptanalysis. Caesar Cipher. Mono-Alphabetic Ciphers
Cryptography Basics IT443 Network Security Administration Slides courtesy of Bo Sheng Basic concepts in cryptography systems Secret cryptography Public cryptography 1 2 Encryption/Decryption Cryptanalysis
Introduction to cryptology (GBIN8U16)
Introduction to cryptology (GBIN8U16) Finite fields, block ciphers Pierre Karpman pierre.karpman@univ-grenoble-alpes.fr https://www-ljk.imag.fr/membres/pierre.karpman/tea.html 2018 01 31 Finite fields,
Some Aspects of Block Ciphers
Some Aspects of Block Ciphers Palash Sarkar Applied Statistics Unit Indian Statistical Institute, Kolkata India palash@isical.ac.in CU-ISI Tutorial Workshop on Cryptology, 17 th July 2011 Palash Sarkar
Multiple forgery attacks against Message Authentication Codes
Multiple forgery attacks against Message Authentication Codes David A. McGrew and Scott R. Fluhrer Cisco Systems, Inc. {mcgrew,sfluhrer}@cisco.com May 31, 2005 Abstract Some message authentication codes
CS155. Cryptography Overview
CS155 Cryptography Overview Cryptography! Is n A tremendous tool n The basis for many security mechanisms! Is not n The solution to all security problems n Reliable unless implemented properly n Reliable
Advanced security notions for the SSH secure channel: theory and practice
Advanced security notions for the SSH secure channel: theory and practice Kenny Paterson - @kennyog Based on joint work with Martin Albrecht, Jean Paul Degabriele and Torben Hansen Information Security
Introduction to Modern Cryptography. Lecture 2. Symmetric Encryption: Stream & Block Ciphers
Introduction to Modern Cryptography Lecture 2 Symmetric Encryption: Stream & Block Ciphers Stream Ciphers Start with a secret key ( seed ) Generate a keying stream i-th bit/byte of keying stream is a function
Computer Security. 08r. Pre-exam 2 Last-minute Review Cryptography. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 08r. Pre-exam 2 Last-minute Review Cryptography Paul Krzyzanowski Rutgers University Spring 2018 March 26, 2018 CS 419 2018 Paul Krzyzanowski 1 Cryptographic Systems March 26, 2018 CS
Computer Security. 10r. Recitation assignment & concept review. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 10r. Recitation assignment & concept review Paul Krzyzanowski Rutgers University Spring 2018 April 3, 2018 CS 419 2018 Paul Krzyzanowski 1 1. What is a necessary condition for perfect
Symmetric Crypto MAC. Pierre-Alain Fouque
Symmetric Crypto MAC Pierre-Alain Fouque Message Authentication Code (MAC) Warning: Encryption does not provide integrity Eg: CTR mode ensures confidentiality if the blockcipher used is secure. However,
Symmetric-Key Cryptography Part 1. Tom Shrimpton Portland State University
Symmetric-Key Cryptography Part 1 Tom Shrimpton Portland State University Building a privacy-providing primitive I want my communication with Bob to be private -- Alice What kind of communication? SMS?
Pipelineable On-Line Encryption (POE)
Pipelineable On-Line Encryption (POE) FSE 2014 Farzaneh Abed 2 Scott Fluhrer 1 John Foley 1 Christian Forler 2 Eik List 2 Stefan Lucks 2 David McGrew 1 Jakob Wenzel 2 1 Cisco Systems, 2 Bauhaus-Universität
Cryptography [Symmetric Encryption]
![Cryptography [Symmetric Encryption]](/thumbs/89/100564864.jpg "Cryptography [Symmetric Encryption]")
CSE 484 / CSE M 584: Computer Security and Privacy Cryptography [Symmetric Encryption] Spring 2017 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin,
Authenticated Encryption in TLS
Authenticated Encryption in TLS Same modelling & verification approach concrete security: each lossy step documented by a game and a reduction (or an assumption) on paper Standardized complications - multiple
Cryptology complementary. Symmetric modes of operation
Cryptology complementary Symmetric modes of operation Pierre Karpman pierre.karpman@univ-grenoble-alpes.fr https://www-ljk.imag.fr/membres/pierre.karpman/tea.html 2018 05 03 Symmetric modes 2018 05 03
COMP4109 : Applied Cryptography
COMP4109 : Applied Cryptography Fall 2013 M. Jason Hinek Carleton University Applied Cryptography Day 8 (and maybe 9) secret-key primitives Message Authentication Codes Pseudorandom number generators 2
ASCON: A Submission to CAESAR Ch. Dobraunig, M. Eichlseder, F. Mendel, M. Schläffer Graz University of Technology CECC 2015
S C I E N C E P A S S I O N T E C H N O L O G Y ASCON: A Submission to CAESAR Graz University of Technology www.iaik.tugraz.at The Team Christoph Dobraunig Maria Eichlseder Florian Mendel Martin Schläffer
Hash Function. Guido Bertoni Luca Breveglieri. Fundations of Cryptography - hash function pp. 1 / 18
Hash Function Guido Bertoni Luca Breveglieri Fundations of Cryptography - hash function pp. 1 / 18 Definition a hash function H is defined as follows: H : msg space digest space the msg space is the set
Homework 2. Out: 09/23/16 Due: 09/30/16 11:59pm UNIVERSITY OF MARYLAND DEPARTMENT OF ELECTRICAL AND COMPUTER ENGINEERING
UNIVERSITY OF MARYLAND DEPARTMENT OF ELECTRICAL AND COMPUTER ENGINEERING ENEE 457 Computer Systems Security Instructor: Charalampos Papamanthou Homework 2 Out: 09/23/16 Due: 09/30/16 11:59pm Instructions
Misuse-resistant crypto for JOSE/JWT
Misuse-resistant crypto for JOSE/JWT Neil Madden OAuth Security Workshop, 2018 1 JOSE Content Encryption Methods Provide authenticated encryption AES-CBC with HMAC-SHA2 Requires random 128-bit IV Must
McOE: A Family of Almost Foolproof On-Line Authenticated Encryption Schemes
McOE: A Family of Almost Foolproof On-Line Authenticated Encryption Schemes Ewan Fleischmann Christian Forler Stefan Lucks Bauhaus-Universität Weimar FSE 2012 Fleischmann, Forler, Lucks. FSE 2012. McOE:
Block cipher modes. Lecturers: Mark D. Ryan and David Galindo. Cryptography Slide: 75
Block cipher modes Lecturers: Mark D. Ryan and David Galindo. Cryptography 2017. Slide: 75 Lecturers: Mark D. Ryan and David Galindo. Cryptography 2017. Slide: 76 Block cipher modes Block ciphers (like
Lecture 4: Authentication and Hashing
Lecture 4: Authentication and Hashing Introduction to Modern Cryptography 1 Benny Applebaum Tel-Aviv University Fall Semester, 2011 12 1 These slides are based on Benny Chor s slides. Some Changes in Grading
Cryptography Functions
Cryptography Functions Lecture 3 1/29/2013 References: Chapter 2-3 Network Security: Private Communication in a Public World, Kaufman, Perlman, Speciner Types of Cryptographic Functions Secret (Symmetric)
ECE 646 Lecture 7. Modes of Operation of Block Ciphers. Modes of Operation. Required Reading:
C 646 Lecture 7 Modes of Operation of Block Ciphers Required Reading: I. W. Stallings, "Cryptography and Network-Security," 5th dition, Chapter 6 Block Cipher Operation II. A. Menezes, P. van Oorschot,
AEGIS. A Fast Authenticated Encryption Algorithm. Nanyang Technological University KU Leuven and iminds DIAC 2014 AEGIS 1
AEGIS A Fast Authenticated Encryption Algorithm Hongjun Wu Bart Preneel Nanyang Technological University KU Leuven and iminds 1 AEGIS: A shield carried by Athena and Zeus 2 Different Design Approaches:
Course Business. Midterm is on March 1. Final Exam is Monday, May 1 (7 PM) Allowed to bring one index card (double sided) Location: Right here
Course Business Midterm is on March 1 Allowed to bring one index card (double sided) Final Exam is Monday, May 1 (7 PM) Location: Right here 1 Cryptography CS 555 Topic 18: AES, Differential Cryptanalysis,
CIS 4360 Secure Computer Systems Symmetric Cryptography
CIS 4360 Secure Computer Systems Symmetric Cryptography Professor Qiang Zeng Spring 2017 Previous Class Classical Cryptography Frequency analysis Never use home-made cryptography Goals of Cryptography
Content of this part
UNIVERSITY OF MASSACHUSETTS Dept. of Electrical & Computer Engineering Introduction to Cryptography ECE 597XX/697XX Part 5 More About Block Ciphers Israel Koren ECE597/697 Koren Part.5.1 Content of this
Lecture 1 Applied Cryptography (Part 1)
Lecture 1 Applied Cryptography (Part 1) Patrick P. C. Lee Tsinghua Summer Course 2010 1-1 Roadmap Introduction to Security Introduction to Cryptography Symmetric key cryptography Hash and message authentication
Lecture 5. Cryptographic Hash Functions. Read: Chapter 5 in KPS
Lecture 5 Cryptographic Hash Functions Read: Chapter 5 in KPS 1 Purpose CHF one of the most important tools in modern cryptography and security CHF-s are used for many authentication, integrity, digital
Cube Attacks and Cube-attack-like Cryptanalysis on the Round-reduced Keccak Sponge Function
Cube Attacks and Cube-attack-like Cryptanalysis on the Round-reduced Keccak Sponge Function Itai Dinur 1, Pawe l Morawiecki 2,3, Josef Pieprzyk 4 Marian Srebrny 2,3, and Micha l Straus 3 1 Computer Science
Duplexing the Sponge: Single-Pass Authenticated Encryption and Other Applications
Duplexing the Sponge: Single-Pass Authenticated Encryption and Other Applications Guido Bertoni 1, Joan Daemen 1, Michaël Peeters 2, and Gilles Van Assche 1 1 STMicroelectronics 2 NXP Semiconductors Abstract.
Block ciphers. CS 161: Computer Security Prof. Raluca Ada Popa. February 26, 2016
Block ciphers CS 161: Computer Security Prof. Raluca Ada Popa February 26, 2016 Announcements Last time Syntax of encryption: Keygen, Enc, Dec Security definition for known plaintext attack: attacker provides
Block Cipher Operation. CS 6313 Fall ASU
Chapter 7 Block Cipher Operation 1 Outline q Multiple Encryption and Triple DES q Electronic Codebook q Cipher Block Chaining Mode q Cipher Feedback Mode q Output Feedback Mode q Counter Mode q XTS-AES
Cryptography. Summer Term 2010
Summer Term 2010 Chapter 2: Hash Functions Contents Definition and basic properties Basic design principles and SHA-1 The SHA-3 competition 2 Contents Definition and basic properties Basic design principles
Introduction to Cryptography. Lecture 3
Introduction to Cryptography Lecture 3 Benny Pinkas March 6, 2011 Introduction to Cryptography, Benny Pinkas page 1 Pseudo-random generator seed s (random, s =n) Pseudo-random generator G Deterministic
CS 495 Cryptography Lecture 6
CS 495 Cryptography Lecture 6 Dr. Mohammad Nabil Alaggan malaggan@fci.helwan.edu.eg Helwan University Faculty of Computers and Information CS 495 Fall 2014 http://piazza.com/fci_helwan_university/fall2014/cs495
Cryptographic Hash Functions. Rocky K. C. Chang, February 5, 2015
Cryptographic Hash Functions Rocky K. C. Chang, February 5, 2015 1 This set of slides addresses 2 Outline Cryptographic hash functions Unkeyed and keyed hash functions Security of cryptographic hash functions
Accredited Standards Committee X9, Incorporated
Accredited Standards Committee X9, Incorporated The following document contains excerpts from draft standard of the Accredited Standards Committee, X9, Inc. (ASC X9) entitled ANS X9.102- Wrapping of Keys
Paper presentation sign up sheet is up. Please sign up for papers by next class. Lecture summaries and notes now up on course webpage
1 Announcements Paper presentation sign up sheet is up. Please sign up for papers by next class. Lecture summaries and notes now up on course webpage 2 Recap and Overview Previous lecture: Symmetric key
Jaap van Ginkel Security of Systems and Networks
Jaap van Ginkel Security of Systems and Networks November 17, 2016 Part 3 Modern Crypto SSN Modern Cryptography Hashes MD5 SHA Secret key cryptography AES Public key cryptography DES Presentations Minimum
Unit 8 Review. Secure your network! CS144, Stanford University
Unit 8 Review Secure your network! 1 Basic Problem Internet To first approximation, attackers control the network Can snoop, replay, suppress, send How do we defend against this? Communicate securely despite
Implementation and Analysis of the PRIMATEs Family of Authenticated Ciphers
Implementation and Analysis of the PRIMATEs Family of Authenticated Ciphers Ahmed Ferozpuri Abstract Lightweight devices used for encrypted communication require a scheme that can operate in a low resource
Software Benchmarking of the 2 nd round CAESAR Candidates
Software Benchmarking of the 2 nd round CAESAR Candidates Ralph Ankele 1, Robin Ankele 2 1 Royal Holloway, University of London, UK 2 University of Oxford, UK October 20, 2016 SPEED-B, Utrecht, The Netherlands
ECE596C: Handout #7. Analysis of DES and the AES Standard. Electrical and Computer Engineering, University of Arizona, Loukas Lazos
ECE596C: Handout #7 Analysis of DES and the AES Standard Electrical and Computer Engineering, University of Arizona, Loukas Lazos Abstract. In this lecture we analyze the security properties of DES and
The JAMBU Lightweight Authentication Encryption Mode (v2)
The JAMBU Lightweight Authentication Encryption Mode (v2) 29 Aug, 2015 Designers: Hongjun Wu, Tao Huang Submitters: Hongjun Wu, Tao Huang Contact: wuhongjun@gmail.com Division of Mathematical Sciences
Block ciphers, stream ciphers
Block ciphers, stream ciphers (start on:) Asymmetric cryptography CS 161: Computer Security Prof. Raluca Ada Popa Jan 31, 2018 Announcements Project 1 is out, due Feb 14 midnight Recall: Block cipher A
CSC 474/574 Information Systems Security
CSC 474/574 Information Systems Security Topic 2.2 Secret Key Cryptography CSC 474/574 Dr. Peng Ning 1 Agenda Generic block cipher Feistel cipher DES Modes of block ciphers Multiple encryptions Message
Symmetric Encryption 2: Integrity
http://wwmsite.wpengine.com/wp-content/uploads/2011/12/integrity-lion-300x222.jpg Symmetric Encryption 2: Integrity With material from Dave Levin, Jon Katz, David Brumley 1 Summing up (so far) Computational
Computer Security CS 526
Computer Security CS 526 Topic 4 Cryptography: Semantic Security, Block Ciphers and Encryption Modes CS555 Topic 4 1 Readings for This Lecture Required reading from wikipedia Block Cipher Ciphertext Indistinguishability
Cryptography 2017 Lecture 3
Cryptography 2017 Lecture 3 Block Ciphers - AES, DES Modes of Operation - ECB, CBC, CTR November 7, 2017 1 / 1 What have seen? What are we discussing today? What is coming later? Lecture 2 One Time Pad
How to Securely Release Unverified Plaintext in Authenticated Encryption
How to Securely Release Unverified Plaintext in Authenticated Encryption Elena Andreeva 1,2, Andrey Bogdanov 3, Atul Luykx 1,2, Bart Mennink 1,2, Nicky Mouha 1,2, and an Yasuda 1,4 1 epartment of Electrical
Power Analysis of MAC-Keccak: A Side Channel Attack. Advanced Cryptography Kyle McGlynn 4/12/18
Power Analysis of MAC-Keccak: A Side Channel Attack Advanced Cryptography Kyle McGlynn 4/12/18 Contents Side-Channel Attack Power Analysis Simple Power Analysis (SPA) Differential Power Analysis (DPA)
Block Cipher Modes of Operation
Block Cipher Modes of Operation Luke Anderson luke@lukeanderson.com.au 23 rd March 2018 University Of Sydney Overview 1. Crypto-Bulletin 2. Modes Of Operation 2.1 Evaluating Modes 2.2 Electronic Code Book
Symmetric Encryption. Thierry Sans
Symmetric Encryption Thierry Sans Design principles (reminder) 1. Kerkoff Principle The security of a cryptosystem must not rely on keeping the algorithm secret 2. Diffusion Mixing-up symbols 3. Confusion
Introduction to Cryptography. Lecture 3
Introduction to Cryptography Lecture 3 Benny Pinkas March 6, 2011 Introduction to Cryptography, Benny Pinkas page 1 Pseudo-random generator seed s (random, s =n) Pseudo-random generator G Deterministic
Cryptographic hash functions and MACs
Cryptographic hash functions and MACs Myrto Arapinis School of Informatics University of Edinburgh October 05, 2017 1 / 21 Introduction Encryption confidentiality against eavesdropping 2 / 21 Introduction
Data Encryption Standard (DES)
Data Encryption Standard (DES) Best-known symmetric cryptography method: DES 1973: Call for a public cryptographic algorithm standard for commercial purposes by the National Bureau of Standards Goals:
1 Achieving IND-CPA security
ISA 562: Information Security, Theory and Practice Lecture 2 1 Achieving IND-CPA security 1.1 Pseudorandom numbers, and stateful encryption As we saw last time, the OTP is perfectly secure, but it forces
Understanding Cryptography A Textbook for Students and Practitioners by Christof Paar and Jan Pelzl
Understanding Cryptography A Textbook for Students and Practitioners by Christof Paar and Jan Pelzl www.crypto-textbook.com Chapter 5 More About Block Ciphers ver. November 26, 2010 Last modified 10-2-17
Introduction to Network Security Missouri S&T University CPE 5420 Data Integrity Algorithms
Introduction to Network Security Missouri S&T University CPE 5420 Data Integrity Algorithms Egemen K. Çetinkaya Egemen K. Çetinkaya Department of Electrical & Computer Engineering Missouri University of
Study Guide to Mideterm Exam
YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE CPSC 467b: Cryptography and Computer Security Handout #7 Professor M. J. Fischer February 20, 2012 Study Guide to Mideterm Exam For the exam, you are responsible
CSE 127: Computer Security Cryptography. Kirill Levchenko
CSE 127: Computer Security Cryptography Kirill Levchenko October 24, 2017 Motivation Two parties want to communicate securely Secrecy: No one else can read messages Integrity: messages cannot be modified
CS408 Cryptography & Internet Security
CS408 Cryptography & Internet Security Lecture 18: Cryptographic hash functions, Message authentication codes Functions Definition Given two sets, X and Y, a function f : X Y (from set X to set Y), is
Stream Ciphers An Overview
Stream Ciphers An Overview Palash Sarkar Indian Statistical Institute, Kolkata email: palash@isicalacin stream cipher overview, Palash Sarkar p1/51 Classical Encryption Adversary message ciphertext ciphertext
ENGI 8868/9877 Computer and Communications Security III. BLOCK CIPHERS. Symmetric Key Cryptography. insecure channel
(a) Introduction - recall symmetric key cipher: III. BLOCK CIPHERS k Symmetric Key Cryptography k x e k y yʹ d k xʹ insecure channel Symmetric Key Ciphers same key used for encryption and decryption two
IDEA, RC5. Modes of operation of block ciphers
C 646 - Lecture 8 IDA, RC5 Modes of operation of block ciphers Required Reading: I. W. Stallings, "Cryptography and Network-Security," 5th dition, Chapter 6 Block Cipher Operation II. A. Menezes, P. van
Introduction to Network Security Missouri S&T University CPE 5420 Data Encryption Standard
Introduction to Network Security Missouri S&T University CPE 5420 Data Encryption Standard Egemen K. Çetinkaya Egemen K. Çetinkaya Department of Electrical & Computer Engineering Missouri University of
CIS 4360 Introduction to Computer Security Fall WITH ANSWERS in bold. First Midterm
CIS 4360 Introduction to Computer Security Fall 2010 WITH ANSWERS in bold Name:.................................... Number:............ First Midterm Instructions This is a closed-book examination. Maximum
Introduction to Cryptography. Lecture 2. Benny Pinkas. Perfect Cipher. Perfect Ciphers. Size of key space
Perfect Cipher Introduction to Cryptography Lecture 2 Benny Pinkas What type of security would we like to achieve? Given C, the adversary has no idea what M is Impossible since adversary might have a-priori
Cryptography: Symmetric Encryption (finish), Hash Functions, Message Authentication Codes
CSE 484 / CSE M 584: Computer Security and Privacy Cryptography: Symmetric Encryption (finish), Hash Functions, Message Authentication Codes Spring 2016 Franziska (Franzi) Roesner franzi@cs.washington.edu
Lecture 3: Symmetric Key Encryption
Lecture 3: Symmetric Key Encryption CS996: Modern Cryptography Spring 2007 Nitesh Saxena Outline Symmetric Key Encryption Continued Discussion of Potential Project Topics Project proposal due 02/22/07
Cryptography (cont.)
CSE 484 / CSE M 584 (Autumn 2011) Cryptography (cont.) Daniel Halperin Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee, and many others
BCA III Network security and Cryptography Examination-2016 Model Paper 1
Time: 3hrs BCA III Network security and Cryptography Examination-2016 Model Paper 1 M.M:50 The question paper contains 40 multiple choice questions with four choices and student will have to pick the correct
The Rectangle Attack
The Rectangle Attack and Other Techniques for Cryptanalysis of Block Ciphers Orr Dunkelman Computer Science Dept. Technion joint work with Eli Biham and Nathan Keller Topics Block Ciphers Cryptanalysis
Homework 2: Symmetric Crypto Due at 11:59PM on Monday Feb 23, 2015 as a PDF via websubmit.
Homework 2: Symmetric Crypto February 17, 2015 Submission policy. information: This assignment MUST be submitted as a PDF via websubmit and MUST include the following 1. List of collaborators 2. List of
Course Map. COMP 7/8120 Cryptography and Data Security. Learning Objectives. How to use PRPs (Block Ciphers)? 2/14/18
Course Map Key Establishment Authenticated Encryption Key Management COMP 7/8120 Cryptography and Data Security Lecture 8: How to use Block Cipher - many time key Stream Ciphers Block Ciphers Secret Key
Cryptography CS 555. Topic 11: Encryption Modes and CCA Security. CS555 Spring 2012/Topic 11 1
Cryptography CS 555 Topic 11: Encryption Modes and CCA Security CS555 Spring 2012/Topic 11 1 Outline and Readings Outline Encryption modes CCA security Readings: Katz and Lindell: 3.6.4, 3.7 CS555 Spring