Breaking Korea Transit Card with Side-Channel Attack
|
|
|
- Maximilian Parrish
- 6 years ago
- Views:
Transcription
1 Breaking Korea Transit Card with Side-Channel Attack -Unauthorized Recharging- Black Hat Asia 2017 Tae Won Kim, Tae Hyun Kim, and Seokhie Hong
2 Outline 1. Attack Goal & Scenario 2. Target Device Details Introduction of Target Device Authentication Protocol Analysis Cryptosystem 3. Key Recovery Attack Attack environment & Measurement Set-Up Attack Overview Attack Results 4. Recharging Simulation 5. Conclusion
3 1. Attack Goal & Scenario 2. Target Device Details Introduction of Target Device Authentication Protocol Analysis Cryptosystem 3. Key Recovery Attack Attack environment & Measurement Set-Up Attack Overview Attack Results 4. Recharging Simulation 5. Conclusion
4 Recharging on Transit Card Vending & Reload Device USER
5 Recharging on Transit Card Vending & Reload Device USER
6 Our Ultimate Goal Free recharging as much as attacker want Vending & Reload Device Attacker
7 Attack Scenario toward Goal Phase 1. Extract authentication key for recharging using side-channel analysis attack Attacker
8 Attack Scenario toward Goal Phase 1. Extract authentication key for recharging using side-channel analysis attack Attacker Phase 2. Design free recharging tool with restored key
9 Attack Scenario toward Goal Phase 1. Extract authentication key for recharging using side-channel analysis attack Attacker Phase 2. Design free recharging tool with restored key
10 1. Attack Goal & Scenario 2. Target Device Details Introduction of Target Device Authentication Protocol Analysis Cryptosystem 3. Key Recovery Attack Attack environment & Measurement Set-Up Attack Overview Attack Results 4. Recharging Simulation 5. Conclusion
11 Target device Transit card Pre-paid transit card for the freeway in Korea Over 800 million cards were issued and used Cafeteria and convenience store in the freeway service area Movie theater, Airport car park etc... Contact Smartcard Equipped with cryptographic engine in hardware level Countermeasure employed against side-channel attacks Support ISO/IEC 7816 standard and KS X 6924 Korea standard
12 Authentication protocol for recharging Public information Secret information Crypto algorithm Transit Card Random Number 1 gen Session key 1 gen E( Random Number-1, Card Key ) Card reader Request recharging Secure Access Module Signature 1 gen E ( Card information, Session key-1 )
13 Authentication protocol for recharging Public information Secret information Crypto algorithm Transit Card Random Number 1 gen Session key 1 gen E( Random Number-1, Card Key ) Signature 1 gen E ( Card information, Session key-1 ) Card reader Request recharging Random Number 1, Card Information, Signature 1 Secure Access Module Card Key gen E( Card information, Master Key ) Session key 1 gen E( Random Number 1, Card Key ) Verify Signature 1
14 Authentication protocol for recharging Public information Secret information Crypto algorithm Transit Card Random Number 1 gen Session key 1 gen E( Random Number-1, Card Key ) Signature 1 gen E ( Card information, Session key-1 ) Card reader Request recharging Random Number 1, Card Information, Signature 1 Secure Access Module Card Key gen E( Card information, Master Key ) Session key 1 gen E( Random Number 1, Card Key ) Verify Signature 1 Random Number 2 gen Session key 2 gen E( Ran Number-2, Session Key-1 ) Signature 2 gen E ( Card info, Session key-2 )
15 Authentication protocol for recharging Public information Secret information Crypto algorithm Transit Card Random Number 1 gen Session key 1 gen E( Random Number-1, Card Key ) Signature 1 gen E ( Card information, Session key-1 ) Card reader Request recharging Random Number 1, Card Information, Signature 1 Secure Access Module Card Key gen E( Card information, Master Key ) Session key 1 gen E( Random Number 1, Card Key ) Verify Signature 1 Random Number 2 gen Session key 2 gen E( Ran Number-2, Session Key-1 ) Random Number 2 Signature -2 Session key 2 gen E( Ran Number-2, Session Key-1 ) Signature 2 gen E ( Card info, Session key-2 ) Verify Signature - 2 Recharging
16 Authentication protocol for recharging Public information Secret information Crypto algorithm Transit Card Random Number 1 gen Session key 1 gen E( Random Number-1, Card Key ) Signature 1 gen E ( Card information, Session key-1 ) Card reader Request recharging Random Number 1, Card Information, Signature 1 Secure Access Module Card Key gen E( Card information, Master Key ) Session key 1 gen E( Random Number 1, Card Key ) Verify Signature 1 Session key 2 gen E( Ran Number-2, Session Key-1 ) Send card a valid signature!! Random Number 2 Signature -2 Random Number 2 gen Session key 2 gen E( Ran Number-2, Session Key-1 ) Signature 2 gen E ( Card info, Session key-2 ) Verify Signature - 2 Recharging
17 Authentication protocol for recharging Public information Secret information Crypto algorithm Transit Card Card reader Secure Access Module Random Number 1 gen Request Require recharging Session key 1 gen E( Random Number-1, Card Key ) Signature 1 gen E ( Card information, Session key-1 ) Target Random Number 1, Card Information, Signature 1 Card Key gen E( Card information, Master Key ) Session key 1 gen E( Random Number 1, Card Key ) Verify Signature 1 Session key 2 gen E( Ran Number-2, Session Key-1 ) Send card a valid signature!! Random Number 2 Signature -2 Random Number 2 gen Session key 2 gen E( Ran Number-2, Session Key-1 ) Signature 2 gen E ( Card info, Session key-2 ) Verify Signature - 2 Recharging
18 Authentication protocol for recharging Public information Secret information Crypto algorithm Transit Card Card reader Secure Access Module Random Number 1 gen Request Require recharging Session key 1 gen E( Random Number-1, Card Key ) Signature 1 gen E ( Card information, Session key-1 ) Target Random Number 1, Card Information, Signature 1 Card Key gen E( Card information, Master Key ) Session key 1 gen E( Random Number 1, Card Key ) Verify Signature 1 Session key 2 gen E( Ran Number-2, Session Key-1 ) Send card a valid signature!! Random Number 2 Signature -2 Random Number 2 gen Session key 2 gen E( Ran Number-2, Session Key-1 ) Signature 2 gen E ( Card info, Session key-2 ) Verify Signature - 2 Recharging
19 Crypto Algorithm Analysis Sign & verify P 1 (128-bit) P 2 P N => performs crypto Algorithm IV(0 128 ) 128-bit Block cipher & operation mode Crypto function => Two Triple-DES Crypto Crypto Crypto Cipher Block Chaining (CBC) mode Initial Vector Signature value C 1 C 2 C N signature (32-bits) Most significant 32-bit of last ciphertext block Padding rule
20 Outline 1. Attack Goal & Scenario 2. Target Device Details Introduction of Target Device Authentication Protocol Analysis Cryptosystem 3. Key Recovery Attack Attack environment & Measurement Set-Up Attack Overview Attack Results 4. Recharging Simulation 5. Conclusion
21 Attack Environment Attack under the secure transit card APDU commands for recharging the card Hardware Board Card reader Oscilloscope Spectrum Analyze Software For the acquisitions(customized) Signal preprocessing(customized) Analysis(Customized) Matlab PC - Smartcard control - Oscilloscope control store signals Oscilloscope command response - Signal Acquisition iteration filtered signal Measurement setup Reader - Communication with card Spectrum analyzer - Frequency analysis - Filtering power EM
22 Attack Overview Phase 1 : Locate the positon of T-DES 1. I/O signal analysis 2. Visual Inspection Find similar patterns 3. Plaintext CPA Find location of relating plaintext Can deduce location of target operation from plaintext location
23 Attack Overview K 1 K 2 K 1 P DES Encryption DES Decryption 2-Key Triple DES Encryption Phase 2 : DPA Attack for key recovery 1. Pre-processing Compression Alignment 2. First Round attack in the DES 48-bit Key recovery 6-bitwise CPA 3. Correction of error Prevent error propagation Method based on BS-CPA Round attack 56-bit full-key recovery 32-bitwise CPA DES Encryption C Phase 1 : Locate the positon of T-DES 1. I/O signal analysis 2. Visual Inspection Find similar patterns 3. Plaintext CPA Find location of relating plaintext Can deduce location of target operation from plaintext location
24 Attack Overview K 1 K 2 K 1 P DES Encryption DES Decryption 2-Key Triple DES Encryption DES Encryption Phase 2 : DPA Attack for key recovery 1. Pre-processing Compression Alignment 2. First Round attack in the DES 48-bit Key recovery 6-bitwise CPA 3. Correction of error Prevent error propagation Method based on BS-CPA Round attack 56-bit full-key recovery 32-bitwise CPA C Phase 3 : Verification of restored the key - Compare the signature value through card response with the signature value generated by recovered key - This is only way to confirm the validity Phase 1 : Locate the positon of T-DES 1. I/O signal analysis 2. Visual Inspection Find similar patterns 3. Plaintext CPA Find location of relating plaintext Can deduce location of target operation from plaintext location
25 Attack Overview K 1 K 2 K 1 P DES Encryption DES Decryption 2-Key Triple DES Encryption DES Encryption Phase 2 : DPA Attack for key recovery 1. Pre-processing Compression Alignment 2. First Round attack in the DES 48-bit Key recovery 6-bitwise CPA 3. Correction of error Prevent error propagation Method based on BS-CPA Round attack 56-bit full-key recovery 32-bitwise CPA C Phase 3 : Verification of restored the key - Compare the signature value through card response with the signature value generated by recovered key - This is only way to confirm the validity Phase 1 : Locate the positon of T-DES 1. I/O signal analysis 2. Visual Inspection Find similar patterns 3. Plaintext CPA Find location of relating plaintext Can deduce location of target operation from plaintext location If fail, return to the beginning Repeat until the key is found Tremendous trials and errors!!
26 Some Problems for Key Recovery Hiding Countermeasure Pre-processing for mitigation Filtering, Alignment Increases the number of traces Alignment Align, whenever guess the location of target operation There is no good reference pattern By effect of hiding countermeasure Need elaborated work One or two point of misalignment leads to attack failure More requirement of time cost, memory Compression of trace Parallel processing
27 Visual Inspection Search for similar patterns Execution of three crypto function =>6 T-DES Overview measurement T-DES T-DES T-DES T-DES T-DES T-DES Voltage Session Key gen 1 Crypto function 2 T-DES Signature gen 2 Crypto function 4 T-DES Time(# of samples)
28 Time(# of samples) Plaintext CPA Perform after alignment Result of CPA => Indicate location relating to plaintext Mean trace Correlation 8-Byte plaintext correlation coefficient peaks
29 Time(# of samples) Plaintext CPA Perform after alignment Result of CPA => Indicate location relating to plaintext Mean trace Correlation 8-Byte plaintext correlation coefficient peaks
30 Time(# of samples) Plaintext CPA Two possible intervals for target operation T-DES? T-DES? Correlation Which one is exact? =>only can be identified through CPA attack for key recovery 8-Byte plaintext correlation coefficient peaks
31 48-bit key recovery Correlation Coefficients for the first Round of DES (a) Sbox 1 (b) Sbox 2 (c) Sbox 3 Time(# of samples) Time(# of samples) Time(# of samples) Correlation Correlation Time(# of samples) Time(# of samples) Time(# of samples) Correlation Correlation Correlation Correlation Correlation Correlation Correlation (d) Sbox 4 (e) Sbox 5 (f) Sbox 6 (g) Sbox 7 (h) Sbox 8 (i) Sbox 1-8 Time(# of samples) Time(# of samples) Time(# of samples)
32 Full Key Recovery Correlation coefficients for the Hamming distances between rounds(2-15) of the T-DES Correct key guess => Observe 14 peaks Correlation Correlation Time(# of samples) correct key guess Time(# of samples) incorrect key guess
33 Verification of Restored Entire Key Same Response values from the card including signatures Generated signatures by ourselves
34 1. Attack Goal & Scenario 2. Target Device Details Introduction of Target Device Authentication Protocol Analysis Cryptosystem 3. Key Recovery Attack Attack environment & Measurement Set-Up Attack Overview Attack Results 4. Recharging Simulation 5. Conclusion
35 Card Number Card Number (a) Before recharging, check balance with ATM (b) Balance : 20,050 ( ) (c) Recharging Tool (f) After recharging, Balance : 30,050 ( ) (d) Execution of our recharging program. Insert amount of money you wish to recharge => 10,000 ( ) (e) Completion of recharging
36 1. Attack Goal & Scenario 2. Target Device Details Introduction of Target Device Authentication Protocol Analysis Cryptosystem 3. Key Recovery Attack Attack environment & Measurement Set-Up Attack Overview Attack Results 4. Recharging Simulation 5. Conclusion
37 Conclusion Demonstrated that side-channel analysis attack is serious threat in real-world Hacking the Korea transit card in a black-box manner Showing financial damage through unauthorized recharging balance Practical attack Trials and errors Approx. six months Current extracting key in same device Approx. 63 hours (trace collection : 58 hours + Attack : 5 hours) Further works For black box attack, combination of reverse engineering and sidechannel attack Go on attack for any commercial devices!
38 More details? Could please see white paper & Questions? Thank you
Side channel attack: Power Analysis. Chujiao Ma, Z. Jerry Shi CSE, University of Connecticut
Side channel attack: Power Analysis Chujiao Ma, Z. Jerry Shi CSE, University of Connecticut Conventional Cryptanalysis Conventional cryptanalysis considers crypto systems as mathematical objects Assumptions:
SIDE CHANNEL ATTACKS AGAINST IOS CRYPTO LIBRARIES AND MORE DR. NAJWA AARAJ HACK IN THE BOX 13 APRIL 2017
SIDE CHANNEL ATTACKS AGAINST IOS CRYPTO LIBRARIES AND MORE DR. NAJWA AARAJ HACK IN THE BOX 13 APRIL 2017 WHAT WE DO What we do Robust and Efficient Cryptographic Protocols Research in Cryptography and
Breaking the Bitstream Decryption of FPGAs
Breaking the Bitstream Decryption of FPGAs 05. Sep. 2012 Amir Moradi Embedded Security Group, Ruhr University Bochum, Germany Acknowledgment Christof Paar Markus Kasper Timo Kasper Alessandro Barenghi
Homework 2. Out: 09/23/16 Due: 09/30/16 11:59pm UNIVERSITY OF MARYLAND DEPARTMENT OF ELECTRICAL AND COMPUTER ENGINEERING
UNIVERSITY OF MARYLAND DEPARTMENT OF ELECTRICAL AND COMPUTER ENGINEERING ENEE 457 Computer Systems Security Instructor: Charalampos Papamanthou Homework 2 Out: 09/23/16 Due: 09/30/16 11:59pm Instructions
Lecture 1 Applied Cryptography (Part 1)
Lecture 1 Applied Cryptography (Part 1) Patrick P. C. Lee Tsinghua Summer Course 2010 1-1 Roadmap Introduction to Security Introduction to Cryptography Symmetric key cryptography Hash and message authentication
Power Analysis of Atmel CryptoMemory Recovering Keys from Secure EEPROMs
Power Analysis of Atmel CryptoMemory Recovering Keys from Secure EEPROMs Josep Balasch 1, Benedikt Gierlichs 1, Roel Verdult 2, Lejla Batina 1,2, and Ingrid Verbauwhede 1 1 ESAT/COSIC, KU Leuven 2 ICIS/Digital
ISO/IEC INTERNATIONAL STANDARD
INTERNATIONAL STANDARD ISO/IEC 9797-1 Second edition 2011-03-01 Information technology Security techniques Message Authentication Codes (MACs) Part 1: Mechanisms using a block cipher Technologies de l'information
Power Analysis Attacks
Power Analysis Attacks Elisabeth Oswald Computer Science Department Crypto Group eoswald@cs.bris.ac.uk Elisabeth.Oswald@iaik.tugraz.at Outline Working principle of power analysis attacks DPA Attacks on
HOST Differential Power Attacks ECE 525
Side-Channel Attacks Cryptographic algorithms assume that secret keys are utilized by implementations of the algorithm in a secure fashion, with access only allowed through the I/Os Unfortunately, cryptographic
Cryptography Basics. IT443 Network Security Administration Slides courtesy of Bo Sheng
Cryptography Basics IT443 Network Security Administration Slides courtesy of Bo Sheng 1 Outline Basic concepts in cryptography systems Secret key cryptography Public key cryptography Hash functions 2 Encryption/Decryption
Cryptography Functions
Cryptography Functions Lecture 3 1/29/2013 References: Chapter 2-3 Network Security: Private Communication in a Public World, Kaufman, Perlman, Speciner Types of Cryptographic Functions Secret (Symmetric)
Side-Channel Attack against RSA Key Generation Algorithms
Side-Channel Attack against RSA Key Generation Algorithms CHES 2014 Aurélie Bauer, Eliane Jaulmes, Victor Lomné, Emmanuel Prouff and Thomas Roche Agence Nationale de la Sécurité des Systèmes d Information
A CCA2 Secure PKE Based on McEliece Assumptions in the Standard Model
A CCA2 Secure PKE Based on McEliece Assumptions in the Standard Model Jörn Müller-Quade European Institute for System Security KIT, Karlsruhe, Germany 04/23/09 Session ID: CRYP301 Session Classification:
Lecture 3: Symmetric Key Encryption
Lecture 3: Symmetric Key Encryption CS996: Modern Cryptography Spring 2007 Nitesh Saxena Outline Symmetric Key Encryption Continued Discussion of Potential Project Topics Project proposal due 02/22/07
ISA 562: Information Security, Theory and Practice. Lecture 1
ISA 562: Information Security, Theory and Practice Lecture 1 1 Encryption schemes 1.1 The semantics of an encryption scheme. A symmetric key encryption scheme allows two parties that share a secret key
9/30/2016. Cryptography Basics. Outline. Encryption/Decryption. Cryptanalysis. Caesar Cipher. Mono-Alphabetic Ciphers
Cryptography Basics IT443 Network Security Administration Slides courtesy of Bo Sheng Basic concepts in cryptography systems Secret cryptography Public cryptography 1 2 Encryption/Decryption Cryptanalysis
Crypto tidbits: misuse, side channels. Slides from Dave Levin 414-spring2016
Crypto tidbits: misuse, side channels Slides from Dave Levin 414-spring2016 A paper from 2013 that looked at how Android apps use crypto, as a function of 6 rules that reflect the bare minimum a secure
SOLUTIONS FOR HOMEWORK # 1 ANSWERS TO QUESTIONS
SOLUTIONS OR HOMEWORK # 1 ANSWERS TO QUESTIONS 2.4 A stream cipher is one that encrypts a digital data stream one bit or one byte at a time. A block cipher is one in which a block of plaintext is treated
Security against Timing Analysis Attack
International Journal of Electrical and Computer Engineering (IJECE) Vol. 5, No. 4, August 2015, pp. 759~764 ISSN: 2088-8708 759 Security against Timing Analysis Attack Deevi Radha Rani 1, S. Venkateswarlu
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Lecture 6 Michael J. Fischer Department of Computer Science Yale University January 27, 2010 Michael J. Fischer CPSC 467b, Lecture 6 1/36 1 Using block ciphers
Technological foundation
Technological foundation Carte à puce et Java Card 2010-2011 Jean-Louis Lanet Jean-louis.lanet@unilim.fr Cryptology Authentication Secure upload Agenda Cryptology Cryptography / Cryptanalysis, Smart Cards
3 Symmetric Key Cryptography 3.1 Block Ciphers Symmetric key strength analysis Electronic Code Book Mode (ECB) Cipher Block Chaining Mode (CBC) Some
3 Symmetric Key Cryptography 3.1 Block Ciphers Symmetric key strength analysis Electronic Code Book Mode (ECB) Cipher Block Chaining Mode (CBC) Some popular block ciphers Triple DES Advanced Encryption
CS155. Cryptography Overview
CS155 Cryptography Overview Cryptography! Is n A tremendous tool n The basis for many security mechanisms! Is not n The solution to all security problems n Reliable unless implemented properly n Reliable
Symmetric Key Algorithms. Definition. A symmetric key algorithm is an encryption algorithm where the same key is used for encrypting and decrypting.
Symmetric Key Algorithms Definition A symmetric key algorithm is an encryption algorithm where the same key is used for encrypting and decrypting. 1 Block cipher and stream cipher There are two main families
Chapter 3 Block Ciphers and the Data Encryption Standard
Chapter 3 Block Ciphers and the Data Encryption Standard Last Chapter have considered: terminology classical cipher techniques substitution ciphers cryptanalysis using letter frequencies transposition
Block Cipher Modes of Operation
Block Cipher Modes of Operation Luke Anderson luke@lukeanderson.com.au 23 rd March 2018 University Of Sydney Overview 1. Crypto-Bulletin 2. Modes Of Operation 2.1 Evaluating Modes 2.2 Electronic Code Book
PASSWORDS & ENCRYPTION
PASSWORDS & ENCRYPTION Villanova University Department of Computing Sciences D. Justin Price Fall 2014 CRYPTOGRAPHY Hiding the meaning of a message from unintended recipients. Open source algorithms are
Masking as a Side-Channel Countermeasure in Hardware
Masking as a Side-Channel Countermeasure in Hardware 6. September 2016 Ruhr-Universität Bochum 1 Agenda Physical Attacks and Side Channel Analysis Attacks Measurement setup Power Analysis Attacks Countermeasures
Encryption Algorithms Authentication Protocols Message Integrity Protocols Key Distribution Firewalls
Security Outline Encryption Algorithms Authentication Protocols Message Integrity Protocols Key Distribution Firewalls Overview Cryptography functions Secret key (e.g., DES) Public key (e.g., RSA) Message
CS155. Cryptography Overview
CS155 Cryptography Overview Cryptography Is n n A tremendous tool The basis for many security mechanisms Is not n n n n The solution to all security problems Reliable unless implemented properly Reliable
Outline. Data Encryption Standard. Symmetric-Key Algorithms. Lecture 4
EEC 693/793 Special Topics in Electrical Engineering Secure and Dependable Computing Lecture 4 Department of Electrical and Computer Engineering Cleveland State University wenbing@ieee.org Outline Review
WhatsApp Encryption Overview. Technical white paper
WhatsApp Encryption Overview Technical white paper July 6, 2017 Originally published April 5, 2016 Contents Introduction................................... 3 Terms......................................
Computational Security, Stream and Block Cipher Functions
Computational Security, Stream and Block Cipher Functions 18 March 2019 Lecture 3 Most Slides Credits: Steve Zdancewic (UPenn) 18 March 2019 SE 425: Communication and Information Security 1 Topics for
2.1 Basic Cryptography Concepts
ENEE739B Fall 2005 Part 2 Secure Media Communications 2.1 Basic Cryptography Concepts Min Wu Electrical and Computer Engineering University of Maryland, College Park Outline: Basic Security/Crypto Concepts
DPA CONTEST 08/09 A SIMPLE IMPROVEMENT OF CLASSICAL CORRELATION POWER ANALYSIS ATTACK ON DES
DPA CONTEST 08/09 A SIMPLE IMPROVEMENT OF CLASSICAL CORRELATION POWER ANALYSIS ATTACK ON DES, Fakultät für Informatik Antonio Almeida Prof. Dejan Lazich Karlsruhe, 9 th June 2010 KIT Universität des Landes
Practical Electromagnetic Template Attack on HMAC
Practical Electromagnetic Template Attack on HMAC Pierre Alain Fouque 1 Gaétan Leurent 1 Denis Réal 2,3 Frédéric Valette 2 1ENS,75Paris,France. 2CELAR,35Bruz,France. 3INSA-IETR,35Rennes,France. September
Block Cipher Operation. CS 6313 Fall ASU
Chapter 7 Block Cipher Operation 1 Outline q Multiple Encryption and Triple DES q Electronic Codebook q Cipher Block Chaining Mode q Cipher Feedback Mode q Output Feedback Mode q Counter Mode q XTS-AES
Lecture 4: Symmetric Key Encryption
Lecture 4: Symmetric ey Encryption CS6903: Modern Cryptography Spring 2009 Nitesh Saxena Let s use the board, please take notes 2/20/2009 Lecture 1 - Introduction 2 Data Encryption Standard Encrypts by
Lecture 6: Symmetric Cryptography. CS 5430 February 21, 2018
Lecture 6: Symmetric Cryptography CS 5430 February 21, 2018 The Big Picture Thus Far Attacks are perpetrated by threats that inflict harm by exploiting vulnerabilities which are controlled by countermeasures.
CS 161 Computer Security
Raluca Popa Spring 2018 CS 161 Computer Security Discussion 3 Week of February 5, 2018: Cryptography I Question 1 Activity: Cryptographic security levels (20 min) Say Alice has a randomly-chosen symmetric
: Practical Cryptographic Systems March 25, Midterm
650.445: Practical Cryptographic Systems March 25, 2010 Instructor: Matthew Green Midterm Name: As with any exam, please do not collaborate or otherwise share information with any other person. You are
CSE 3461/5461: Introduction to Computer Networking and Internet Technologies. Network Security. Presentation L
CS 3461/5461: Introduction to Computer Networking and Internet Technologies Network Security Study: 21.1 21.5 Kannan Srinivasan 11-27-2012 Security Attacks, Services and Mechanisms Security Attack: Any
Secret Key Algorithms (DES) Foundations of Cryptography - Secret Key pp. 1 / 34
Secret Key Algorithms (DES) Foundations of Cryptography - Secret Key pp. 1 / 34 Definition a symmetric key cryptographic algorithm is characterized by having the same key used for both encryption and decryption.
Double-DES, Triple-DES & Modes of Operation
Double-DES, Triple-DES & Modes of Operation Prepared by: Dr. Mohamed Abd-Eldayem Ref.: Cryptography and Network Security by William Stallings & Lecture slides by Lawrie Brown Multiple Encryption & DES
CHAPTER 6. SYMMETRIC CIPHERS C = E(K2, E(K1, P))
CHAPTER 6. SYMMETRIC CIPHERS Multiple encryption is a technique in which an encryption algorithm is used multiple times. In the first instance, plaintext is converted to ciphertext using the encryption
Secret Key Cryptography
Secret Key Cryptography 1 Block Cipher Scheme Encrypt Plaintext block of length N Decrypt Secret key Cipher block of length N 2 Generic Block Encryption Convert a plaintext block into an encrypted block:
ECRYPT II Workshop on Physical Attacks November 27 th, Graz, Austria. Stefan Mangard.
Building Secure Hardware ECRYPT II Workshop on Physical Attacks November 27 th, Graz, Austria Stefan Mangard Infineon Technologies, Munich, Germany Stefan.Mangard@infineon.com Outline Assets and Requirements
CIS 4360 Introduction to Computer Security Fall WITH ANSWERS in bold. First Midterm
CIS 4360 Introduction to Computer Security Fall 2010 WITH ANSWERS in bold Name:.................................... Number:............ First Midterm Instructions This is a closed-book examination. Maximum
Differential Computation Analysis Hiding your White-Box Designs is Not Enough
Differential Computation Analysis Hiding your White-Box Designs is Not Enough Joppe W. Bos Summer school on real-world crypto and privacy Šibenik, Croatia 1. NXP Semiconductors Operations in > 35 countries,
Computer Security CS 526
Computer Security CS 526 Topic 4 Cryptography: Semantic Security, Block Ciphers and Encryption Modes CS555 Topic 4 1 Readings for This Lecture Required reading from wikipedia Block Cipher Ciphertext Indistinguishability
Secret Key Algorithms (DES)
Secret Key Algorithms (DES) G. Bertoni L. Breveglieri Foundations of Cryptography - Secret Key pp. 1 / 34 Definition a symmetric key cryptographic algorithm is characterized by having the same key used
Fault injection attacks on cryptographic devices and countermeasures Part 1
Fault injection attacks on cryptographic devices and countermeasures Part 1 Israel Koren Department of Electrical and Computer Engineering University of Massachusetts Amherst, MA Outline Introduction -
P2_L6 Symmetric Encryption Page 1
P2_L6 Symmetric Encryption Page 1 Reference: Computer Security by Stallings and Brown, Chapter 20 Symmetric encryption algorithms are typically block ciphers that take thick size input. In this lesson,
CSCI 454/554 Computer and Network Security. Topic 3.2 Secret Key Cryptography Modes of Operation
CSCI 454/554 Computer and Network Security Topic 3.2 Secret Key Cryptography Modes of Operation Processing with Block Ciphers Most ciphers work on blocks of fixed (small) size How to encrypt long messages?
Side Channel Analysis of an Automotive Microprocessor
ISSC 2008, Galway. June 18 19 Side Channel Analysis of an Automotive Microprocessor Mark D. Hamilton, Michael Tunstall,EmanuelM.Popovici, and William P. Marnane Dept. of Microelectronic Engineering, Dept.
A physical level perspective
UMass CS 660 Advanced Information Assurance Spring 2011Guest Lecture Side Channel Analysis A physical level perspective Lang Lin Who am I 5 th year PhD candidate in ECE Advisor: Professor Wayne Burleson
The Davies-Murphy Power Attack. Sébastien Kunz-Jacques Frédéric Muller Frédéric Valette DCSSI Crypto Lab
The Davies-Murphy Power Attack Sébastien Kunz-Jacques Frédéric Muller Frédéric Valette DCSSI Crypto Lab Introduction Two approaches for attacking crypto devices traditional cryptanalysis Side Channel Attacks
Block cipher modes. Lecturers: Mark D. Ryan and David Galindo. Cryptography Slide: 75
Block cipher modes Lecturers: Mark D. Ryan and David Galindo. Cryptography 2017. Slide: 75 Lecturers: Mark D. Ryan and David Galindo. Cryptography 2017. Slide: 76 Block cipher modes Block ciphers (like
Introduction to Software Countermeasures For Embedded Cryptography
Introduction to Software Countermeasures For Embedded Cryptography David Vigilant UMPC Master, 1 st December, 2017 Outline 1 Context and Motivations 2 Basic Rules and Countermeasures Examples Regarding
10/1/2015. Authentication. Outline. Authentication. Authentication Mechanisms. Authentication Mechanisms. Authentication Mechanisms
Authentication IT443 Network Security Administration Instructor: Bo Sheng Authentication Mechanisms Key Distribution Center and Certificate Authorities Session Key 1 2 Authentication Authentication is
EEC-484/584 Computer Networks
EEC-484/584 Computer Networks Lecture 23 wenbing@ieee.org (Lecture notes are based on materials supplied by Dr. Louise Moser at UCSB and Prentice-Hall) Outline 2 Review of last lecture Introduction to
Security+ Guide to Network Security Fundamentals, Third Edition. Chapter 11 Basic Cryptography
Security+ Guide to Network Security Fundamentals, Third Edition Chapter 11 Basic Cryptography Objectives Define cryptography Describe hashing List the basic symmetric cryptographic algorithms 2 Objectives
18-642: Cryptography
18-642: Cryptography 4/16/2018 Cryptography [without system integrity] is like investing in an armored car to carry money between a customer living in a cardboard box and a person doing business on a park
New attacks on the MacDES MAC Algorithm. 1st July Two new attacks are given on a CBC-MAC algorithm due to Knudsen and Preneel, [2],
![New attacks on the MacDES MAC Algorithm. 1st July Two new attacks are given on a CBC-MAC algorithm due to Knudsen and Preneel, [2],](/thumbs/94/119451994.jpg "New attacks on the MacDES MAC Algorithm. 1st July Two new attacks are given on a CBC-MAC algorithm due to Knudsen and Preneel, [2],")
New attacks on the MacDES MAC Algorithm Don Coppersmith IBM Research T. J. Watson Research Center Yorktown Heights, NY 10598, USA copper@watson.ibm.com Chris J. Mitchell Information Security Group Royal
Processing with Block Ciphers
AIT 682: Network and Systems Security Topic 3.2 Secret Cryptography Modes of Operation Instructor: r. Kun Sun rocessing with Block Ciphers Most ciphers work on blocks of fixed (small) size How to encrypt
CSC/ECE 574 Computer and Network Security. Processing with Block Ciphers. Issues for Block Chaining Modes
CSC/C 574 Computer and Network Security Topic 3.2 Secret Cryptography Modes of Operation CSC/C 574 r. eng Ning 1 rocessing with Block Ciphers Most ciphers work on blocks of fixed (small) size How to encrypt
Goals of Modern Cryptography
Goals of Modern Cryptography Providing information security: Data Privacy Data Integrity and Authenticity in various computational settings. Data Privacy M Alice Bob The goal is to ensure that the adversary
Security of Block Ciphers Beyond Blackbox Model
CRYPTCU ction Meeting November 6, 2016 ecurity of Block Ciphers Beyond Blackbox Model Takanori Isobe ONY Corporation bout Me Researcher/Engineer in ony Corporation since 2008 s a Researcher Cryptanalysis
Symmetric Encryption Algorithms
Symmetric Encryption Algorithms CS-480b Dick Steflik Text Network Security Essentials Wm. Stallings Lecture slides by Lawrie Brown Edited by Dick Steflik Symmetric Cipher Model Plaintext Encryption Algorithm
Pass, No Record: An Android Password Manager
Pass, No Record: An Android Password Manager Alex Konradi, Samuel Yeom December 4, 2015 Abstract Pass, No Record is an Android password manager that allows users to securely retrieve passwords from a server
The question paper contains 40 multiple choice questions with four choices and students will have to pick the correct one (each carrying ½ marks.).
Time: 3hrs BCA III Network security and Cryptography Examination-2016 Model Paper 2 M.M:50 The question paper contains 40 multiple choice questions with four choices and students will have to pick the
Advanced Encryption Standard and Modes of Operation. Foundations of Cryptography - AES pp. 1 / 50
Advanced Encryption Standard and Modes of Operation Foundations of Cryptography - AES pp. 1 / 50 AES Advanced Encryption Standard (AES) is a symmetric cryptographic algorithm AES has been originally requested
CSC 474/574 Information Systems Security
CSC 474/574 Information Systems Security Topic 2.2 Secret Key Cryptography CSC 474/574 Dr. Peng Ning 1 Agenda Generic block cipher Feistel cipher DES Modes of block ciphers Multiple encryptions Message
Defeating Embedded Cryptographic Protocols by Combining Second-Order with Brute Force
Defeating Embedded Cryptographic Protocols by Combining Second-Order with Brute Force Benoit Feix (B), Andjy Ricart, Benjamin Timon, and Lucille Tordella UL Transaction Security Lab, Basingstoke, England
Using block ciphers 1
Using block ciphers 1 Using block ciphers DES is a type of block cipher, taking 64-bit plaintexts and returning 64-bit ciphetexts. We now discuss a number of ways in which block ciphers are employed in
Differential Computation Analysis Hiding your White-Box Designs is Not Enough
Differential Computation Analysis Hiding your White-Box Designs is Not Enough Joppe W. Bos Microsoft Research Visit, August 24, 2016 Redmond, WA, USA 1. NXP Semiconductors Operations in > 35 countries,
Security issues: Encryption algorithms. Threats Methods of attack. Secret-key Public-key Hybrid protocols. CS550: Distributed OS.
Security issues: Threats Methods of attack Encryption algorithms Secret-key Public-key Hybrid protocols Lecture 15 Page 2 1965-75 1975-89 1990-99 Current Platforms Multi-user timesharing computers Distributed
Block Ciphers. Secure Software Systems
1 Block Ciphers 2 Block Cipher Encryption function E C = E(k, P) Decryption function D P = D(k, C) Symmetric-key encryption Same key is used for both encryption and decryption Operates not bit-by-bit but
ECE Lecture 2. Basic Concepts of Cryptology. Basic Vocabulary CRYPTOLOGY. Symmetric Key Public Key Protocols
ECE 646 - Lecture 2 Basic Concepts of Cryptology 1 CRYPTOLOGY CRYPTOGRAPHY CRYPTANALYSIS Symmetric Key Public Key Protocols Block Cipher Stream Cipher from Greek cryptos - hidden, secret logos - word graphos
Improved differential fault analysis on lightweight block cipher LBlock for wireless sensor networks
Jeong et al. EURASIP Journal on Wireless Communications and Networking 2013, 2013:151 RESEARCH Improved differential fault analysis on lightweight block cipher LBlock for wireless sensor networks Kitae
Plaintext-Recovery Attacks Against Datagram TLS
Information Security Group Royal Holloway, University of London 6th Feb 2012 Contents 1 Results 2 3 4 Padding Oracle Realisation Against OpenSSL 5 Attacking the GnuTLS Implementation of DTLS 6 Results
CSCE 813 Internet Security Symmetric Cryptography
CSCE 813 Internet Security Symmetric Cryptography Professor Lisa Luo Fall 2017 Previous Class Essential Internet Security Requirements Confidentiality Integrity Authenticity Availability Accountability
The Xirrus Wi Fi Array XS4, XS8 Security Policy Document Version 1.0. Xirrus, Inc.
The Xirrus Wi Fi Array XS4, XS8 Security Policy Document Version 1.0 Xirrus, Inc. March 8, 2011 Copyright Xirrus, Inc. 2011. May be reproduced only in its original entirety [without revision]. Page 1 TABLE
CIS 6930/4930 Computer and Network Security. Topic 3.2 Secret Key Cryptography Modes of Operation
CIS 6930/4930 Computer and Network Security Topic 3.2 Secret Key Cryptography Modes of Operation 1 Cipher Feedback Mode (CFB) IV Key 64 64 64 64 64 M 1 M 2 M 3 M 4 64 64 64 46 + padding 64 64 64 64 C 1
Symmetric Cryptography. Chapter 6
Symmetric Cryptography Chapter 6 Block vs Stream Ciphers Block ciphers process messages into blocks, each of which is then en/decrypted Like a substitution on very big characters 64-bits or more Stream
EM Analysis in the IoT Context: Lessons Learned from an Attack on Thread
EM Analysis in the IoT Context: Lessons Learned from an Attack on Thread Daniel Dinu 1, Ilya Kizhvatov 2 1 Virginia Tech 2 Radboud University Nijmegen CHES 2018 Outline 1 Introduction 2 Side-Channel Vulnerability
Block Cipher Modes of Operation
Block Cipher Modes of Operation Luke Anderson luke@lukeanderson.com.au 24th March 2016 University Of Sydney Overview 1. Crypto-Bulletin 2. Modes Of Operation 2.1 Evaluating Modes 2.2 Electronic Code Book
1-7 Attacks on Cryptosystems
1-7 Attacks on Cryptosystems In the present era, not only business but almost all the aspects of human life are driven by information. Hence, it has become imperative to protect useful information from
Practical Aspects of Modern Cryptography
Practical Aspects of Modern Cryptography Lecture 3: Symmetric s and Hash Functions Josh Benaloh & Brian LaMacchia Meet Alice and Bob Alice Bob Message Modern Symmetric s Setup: Alice wants to send a private
The embedded security challenge: Protecting bits at rest
The embedded security challenge: Protecting bits at rest Patrick Schaumont schaum@vt.edu Acknowledgements: Eric Simpson, Pengyuan Yu Secure Embedded Systems Group ECE Department Secret bits-at-rest Hi-Res
EE 595 (PMP) Introduction to Security and Privacy Homework 1 Solutions
EE 595 (PMP) Introduction to Security and Privacy Homework 1 Solutions Assigned: Tuesday, January 17, 2017, Due: Sunday, January 28, 2017 Instructor: Tamara Bonaci Department of Electrical Engineering
CS 161 Computer Security. Week of September 11, 2017: Cryptography I
Weaver Fall 2017 CS 161 Computer Security Discussion 3 Week of September 11, 2017: Cryptography I Question 1 Activity: Cryptographic security levels (20 min) Say Alice has a randomly-chosen symmetric key
Cryptography MIS
Cryptography MIS-5903 http://community.mis.temple.edu/mis5903sec011s17/ Cryptography History Substitution Monoalphabetic Polyalphabetic (uses multiple alphabets) uses Vigenere Table Scytale cipher (message
BCA III Network security and Cryptography Examination-2016 Model Paper 1
Time: 3hrs BCA III Network security and Cryptography Examination-2016 Model Paper 1 M.M:50 The question paper contains 40 multiple choice questions with four choices and student will have to pick the correct
Introduction to Network Security Missouri S&T University CPE 5420 Data Encryption Standard
Introduction to Network Security Missouri S&T University CPE 5420 Data Encryption Standard Egemen K. Çetinkaya Egemen K. Çetinkaya Department of Electrical & Computer Engineering Missouri University of
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 6 January 25, 2012 CPSC 467b, Lecture 6 1/46 Byte padding Chaining modes Stream ciphers Symmetric cryptosystem families Stream ciphers
page 1 Introduction to Cryptography Benny Pinkas Lecture 3 November 18, 2008 Introduction to Cryptography, Benny Pinkas
Introduction to Cryptography Lecture 3 Benny Pinkas page 1 1 Pseudo-random generator Pseudo-random generator seed output s G G(s) (random, s =n) Deterministic function of s, publicly known G(s) = 2n Distinguisher
Cryptography & Key Exchange Protocols. Faculty of Computer Science & Engineering HCMC University of Technology
Cryptography & Key Exchange Protocols Faculty of Computer Science & Engineering HCMC University of Technology Outline 1 Cryptography-related concepts 2 3 4 5 6 7 Key channel for symmetric cryptosystems
Countermeasures against EM Analysis
Countermeasures against EM Analysis Paolo Maistri 1, SebastienTiran 2, Amine Dehbaoui 3, Philippe Maurine 2, Jean-Max Dutertre 4 (1) (2) (3) (4) Context Side channel analysis is a major threat against
Message authentication codes
Message authentication codes Martin Stanek Department of Computer Science Comenius University stanek@dcs.fmph.uniba.sk Cryptology 1 (2017/18) Content Introduction security of MAC Constructions block cipher