Jaap van Ginkel Security of Systems and Networks

Transcription

1 Jaap van Ginkel Security of Systems and Networks November 3, 2014 Part 3 Modern Crypto Hashes

2 SSN Week 2 Hashes MD5 SHA Secret key cryptography AES Public key cryptography DES

3 Presentations Minimum 20 minutes Research question Related research Approach/Experiments Conclusions Open standards/open Source Example implementations or demo Your findings and personal view

4 Reports Individual contribution Who wrote what... Depth and clarity more important than length Discuss and read drafts of report Deadline 22nd December

5 Modern Cryptography Hashes Symmetric Cryptography Stream ciphers Block ciphers Asymmetric Cryptography Public Key Non Secret

6 Some Crypto Properties Deniable Encryption Plausible Deniability Perfect Forward Secrecy Non-repudiation Anti-replay Proof of delivery

7 HASH or Message Digest

8 Crypto Hash Function Crypto hash function h(x) must provide Compression output length is small Efficiency h(x) easy to compute for any x One-way given a value y it is infeasible to find an x such that h(x) = y Weak collision resistance given x and h(x), infeasible to find y x such that h(y) = h(x) Strong collision resistance infeasible to find any x and y, with x y such that h(x) = h(y) Lots of collisions exist, but hard to find any

9 Pre-Birthday Problem Suppose N people in a room How large must N be before the probability someone has same birthday as me is 1/2? Solve: 1/2 = 1 (364/365)N for N We find N = 253

10 Birthday Problem How many people must be in a room before probability is 1/2 that any two (or more) have same birthday? 1 365/ /365 (365 N+1)/365 Set equal to 1/2 and solve: N = 23 Surprising? A paradox? Maybe not: Should be about sqrt(365) since we compare all pairs x and y And there are 365 possible birthdays

11 Non-crypto Hash (1) Data X = (X0,X1,X2,,Xn-1), each Xi is a byte Define h(x) = X0+X1+X2+ +Xn-1 Is this a secure cryptographic hash? Example: X = ( , ) Hash is h(x) = If Y = ( , ) then h(x) = h(y) Easy to find collisions, so not secure

12 Non-crypto Hash (2) Cyclic Redundancy Check (CRC) Essentially, CRC is the remainder in a long division calculation Good for detecting burst errors Random errors unlikely to yield a collision But easy to construct collisions CRC has been mistakenly used where crypto integrity check is required (e.g., WEP)

13 Popular Crypto Hashes MD5 invented by Rivest 128 bit output Note: MD5 collisions easy to find SHA-1 A U.S. government standard, inner workings similar to MD5 160 bit output Many other hashes, but MD5 and SHA-1 are the most widely used Hashes work by hashing message in blocks

14 Crypto Hash Design Desired property: avalanche effect Change to 1 bit of input should affect about half of output bits Crypto hash functions consist of some number of rounds Want security and speed Avalanche effect after few rounds But simple rounds Analogous to design of block ciphers

15 Cryptographic Hash Different from parity or CRC! Also known as Message Digest Input always delivers fixed length output Hash properties Easy to compute One-way (Can't go back) Collision-resistant (No two inputs result in same hash) Output should be as random as possible (Avalanche) (cryptool demo)

16 Merkle-Damgård Construction

17 HASH Algorithms MD MD2 MD4 MD5 (IETF RFC1321), SHA SHA-1 (NIST) SHA-2 (Collection) (SHA-256/ /384) SHA-3 (New NIST competition) 2012

18 Demo fraud exam results Birthday Attack Exam Results for the course SSN of the master education SNE ===================================================== Course: Exam date: Credits: Teacher: Student ======= MSNSSNP6 [Security of Systems and Networks] December 18, ECTS Jaap van Ginkel First ===== Yonne Adriaan Florian Peter Jeroen James Carlo Last ==== de Bruijn Dens Ecard van Dongen van Kessel Gratchoff Rengo Result ======

19 Hash Brute force Attacks Exhaustive search Collision Attacks Find m1 and m2 where hash(m1) = hash(m2) Preimage Attacks Find m for hash(m) = h Second Preimage Attacks Find m2 for given m1 where hash(m2) = hash(m1)

20 MD5 128 bit Hash Broken since at least 2005 Still used a lot :-(

21 MD5 Algorithm 128 bit hash 512 bit block processing Padding with 1 then 0 64 Rounds in 4 groups Mi is Message block Ki is Constant F is nonlinear function

22 SHA Secure Hash Algorithm 1993 NIST FIPS SHA-0/SHA-1 Similar to MD5 160 bit Lots of research From 2^80 to 2^69 Move to SHA and 512 bit SHA-3 challenge

23 SHA-2

24 SHA-3 BLAKE Blue Midnight Wish CubeHash (Bernstein) ECHO (France Telecom) Fugue (IBM) Grøstl (Knudsen et al.) Hamsi JH Keccak (Keccak team, Daemen et al.) Luffa Shabal SHAvite-3 SIMD Skein (Schneier et al.)

25 HMAC Keyed-hash message authentication code MAC + Encryption HMAC-MD5 HMAC-SHA-1 Cryptool demo

26 Symmetric Encryption

27 Symmetric Encryption

28 One Time Pad OTP Proven Secure by Shannon Implemented in the Vernam Cipher XOR data stream with pad Truly random pad data needed Hardware noise sources

29 Secret Key Encryption Symmetric Encryption DES (Triple DES) IDEA AES (Rijndael) RC6 Blowfish

30 Key Distribution Expensive Vulnerable Difficult to scale

31 Taxonomy of Cryptography Symmetric Key Public Key (or asymmetric crypto) Same key for encryption and decryption Two types: Stream ciphers, Block ciphers Two keys, one for encryption (public), and one for decryption (private) And digital signatures nothing comparable in symmetric key crypto Hash algorithms Can be viewed as one way crypto

32 Taxonomy of Cryptanalysis From perspective of info available to Trudy Ciphertext only Known plaintext Chosen plaintext Lunchtime attack Protocols might encrypt chosen data Adaptively chosen plaintext Related key Forward search (public key crypto) And others

33 Symmetric Key Crypto Stream cipher based on one-time pad Except that key is relatively short Key is stretched into a long keystream Keystream is used just like a one-time pad Block cipher based on codebook concept Block cipher key determines a codebook Each key yields a different codebook Employs both confusion and diffusion Part 1 Cryptography 33

34 Stream Ciphers Part 1 Cryptography 34

35 Stream Ciphers

36 A5/1: Shift Registers A5/1 uses 3 shift registers X: 19 bits (x0,x1,x2,,x18) Y: 22 bits (y0,y1,y2,,y21) Z: 23 bits (z0,z1,z2,,z22) Part 1 Cryptography 36

37 A5/1: Keystream At each step: m = maj(x8, y10, z10) If x8 = m then X steps t = y20 y21 yi = yi 1 for i = 21,20,,1 and y0 = t If z10 = m then Z steps t = x13 x16 x17 x18 xi = xi 1 for i = 18,17,,1 and x0 = t If y10 = m then Y steps Examples: maj(0,1,0) = 0 and maj(1,1,0) = 1 t = z7 z20 z21 z22 zi = zi 1 for i = 22,21,,1 and z0 = t Keystream bit is x18 y21 z22

38 A5/1 X x0 x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16 x17 x18 Y y0 y1 y2 y3 y4 y5 y6 y7 y8 y9 y10 y11 y12 y13 y14 y15 y16 y17 y18 y19 y20 y21 Z z0 z1 z2 z3 z4 z5 z6 z7 z8 z9 z10 z11 z12 z13 z14 z15 z16 z17 z18 z19 z20 z21 z22 Each variable here is a single bit Key is used as initial fill of registers Each register steps (or not) based on maj(x8, y10, z10) Keystream bit is XOR of rightmost bits of registers

39 A5/1 X x0 x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16 x17 x18 Y y0 y1 y2 y3 y4 y5 y6 y7 y8 y9 y10 y11 y12 y13 y14 y15 y16 y17 y18 y19 y20 y21 Z z0 z1 z2 z3 z4 z5 z6 z7 z8 z9 z10 z11 z12 z13 z14 z15 z16 z17 z18 z19 z20 z21 z22 Each variable here is a single bit Key is used as initial fill of registers Each register steps (or not) based on maj(x8, y10, z10) Keystream bit is XOR of rightmost bits of registers

40 Shift Register Crypto Shift register crypto efficient in hardware Often, slow if implement in software In the past, very popular Today, more is done in software due to fast processors Shift register crypto still used some Resource-constrained devices

41 RC4 A self-modifying lookup table Table always contains a permutation of the byte values 0,1,,255 Initialize the permutation using key At each step, RC4 does the following Each step of RC4 produces a byte Swaps elements in current lookup table Selects a keystream byte from table Efficient in software Each step of A5/1 produces only a bit Efficient in hardware

42 RC4 Initialization S[] is permutation of 0,1,...,255 key[] contains N bytes of key for i = 0 to 255 S[i] = i K[i] = key[i (mod N)] next i j = 0 for i = 0 to 255 j = (j + S[i] + K[i]) mod 256 swap(s[i], S[j]) next i i = j = 0

43 RC4 Keystream For each keystream byte, swap elements in table and select byte i = (i + 1) mod 256 j = (j + S[i]) mod 256 swap(s[i], S[j]) t = (S[i] + S[j]) mod 256 keystreambyte = S[t] Use keystream bytes like a one-time pad Note: first 256 bytes should be discarded Otherwise, related key attack exists

44 Block Ciphers

45 (Iterated) Block Cipher Plaintext and ciphertext consist of fixed-sized blocks Ciphertext obtained from plaintext by iterating a round function Input to round function consists of key and output of previous round Usually implemented in software

46 Feistel Cipher: Encryption Feistel cipher is a type of block cipher, not a specific block cipher Split plaintext block into left and right halves: P = (L0,R0) For each round i = 1,2,...,n, compute Li= Ri 1 Ri= Li 1 F(Ri 1,Ki) where F is round function and Ki is subkey Ciphertext: C = (Ln,Rn) Part 1 Cryptography 46

47 Feistel Cipher: Decryption Start with ciphertext C = (Ln,Rn) For each round i = n,n 1,,1, compute Ri 1 = Li Li 1 = Ri F(Ri 1,Ki) where F is round function and Ki is subkey Plaintext: P = (L0,R0) Formula works for any function F But only secure for certain functions F

48

49 Data Encryption Standard DES developed in 1970 s DEA is algorithm Based on IBM s Lucifer cipher DES was U.S. government standard DES development was controversial NSA secretly involved Design process was secret Key length reduced from 128 to 56 bits Subtle changes to Lucifer algorithm

50 DES Numerology DES is a Feistel cipher with 64 bit block length 56 bit key length 16 rounds 48 bits of key used each round (subkey) Each round is simple (for a block cipher) Security depends heavily on S-boxes Each S-boxes maps 6 bits to 4 bits

51 DES Last Word (Almost) An initial permutation before round 1 Halves are swapped after last round A final permutation (inverse of initial perm) applied to (R16,L16) None of this serves security purpose

52 Security of DES Security depends heavily on S-boxes Everything else in DES is linear Thirty+ years of intense analysis has revealed no back door Attacks, essentially exhaustive key search Inescapable conclusions Designers of DES knew what they were doing Designers of DES were way ahead of their time

53

54 Block Cipher Notation P = plaintext block C = ciphertext block Encrypt P with key K to get ciphertext C Decrypt C with key K to get plaintext P C = E(P, K) P = D(C, K) Note: P = D(E(P, K), K) and C = E(D(C, K), K) But P D(E(P, K1), K2) and C E(D(C, K1), K2) when K1 K2

55 Triple DES Today, 56 bit DES key is too small But DES is everywhere, so what to do? Triple DES or 3DES (112 bit key) Exhaustive key search is feasible C = E(D(E(P,K1),K2),K1) P = D(E(D(C,K1),K2),K1) Why Encrypt-Decrypt-Encrypt with 2 keys? Backward compatible: E(D(E(P,K),K),K) = E(P,K) And 112 bits is enough

56 3DES Why not C = E(E(P,K),K)? Trick question --- it s still just 56 bit key Why not C = E(E(P,K1),K2)? A (semi-practical) known plaintext attack Pre-compute table of E(P,K1) for every possible key K1 (resulting table has 256 entries) Then for each possible K2 compute D(C,K2) until a match in table is found When match is found, have E(P,K1) = D(C,K2) Result gives us keys: C = E(E(P,K1),K2)

57 Advanced Encryption Standard Replacement for DES AES competition (late 90 s) NSA openly involved Transparent process Many strong algorithms proposed Rijndael Algorithm ultimately selected (pronounced like Rain Doll or Rhine Doll ) Iterated block cipher (like DES) Not a Feistel cipher (unlike DES)

58 AES Overview Block size: 128 bits (others in Rijndael) Key length: 128, 192 or 256 bits (independent of block size) 10 to 14 rounds (depends on key length) Each round uses 4 functions (3 layers ) ByteSub (nonlinear layer) ShiftRow (linear mixing layer) MixColumn (nonlinear layer) AddRoundKey (key addition layer)

59 AES ByteSub Treat 128 bit block as 4x6 byte array ByteSub is AES s S-box Can be viewed as nonlinear (but invertible) composition of two math operations

60 AES S-box Last 4 bits of input First 4 bits of input

61 AES ShiftRow Cyclic shift rows

62 AES MixColumn Invertible, linear operation applied to each column Implemented as a (big) lookup table Part 1 Cryptography 62

63 AES AddRoundKey XOR subkey with block Block Subkey RoundKey (subkey) determined by key schedule algorithm Part 1 Cryptography 63

64 AES Decryption To decrypt, process must be invertible Inverse of MixAddRoundKey is easy, since is its own inverse MixColumn is invertible (inverse is also implemented as a lookup table) Inverse of ShiftRow is easy (cyclic shift the other direction) ByteSub is invertible (inverse is also implemented as a lookup table)

65 DES DEA is algorithm 64 bits key with parity Effectively 56 bits Theoretically and practically considered cracked

66 Deep Crack

67 Triple DES 3 times? In a smart way Key length between 80 en 112 bits EEE EDE with K1, K2, K3, often K1 equals K3.

68 ECB M1 M2 M3 M4 C1 C2 C3 C4

69 ECB effect

70 CBC (Cipher Block Chaining) IV IV M1 M2 M3 M4 E E E E C1 C2 C3 C4

71 Cipher Block Chaining

72 CBC decryption

73 Cipher feedback (CFB)

74 Output Feedback Mode (OFB)

75 Use with error correcting codes

76

77 Counter (CTR) Mode Also known as Segmented Integer Counter (SIC) mode Random Access possible properties OFB

78 AES Competition NIST MARS RC-6 Rijndael Twofish Serpent

79 Rijndael Winner AES Joan Daemen en Vincent Rijmen

80

81

82

83 Chocolate Key Encryption Courtesy Prof. Ezra Brown of VA Tech.

84 1 RFC 2631 Diffie-Hellman Key Agreement Method

85 Public Key Cryptography Asymmetric encryption Expensive/Slow Diffie Hellmann RSA PGP

86 El Gamal Dr. Taher Elgamal طاهر الجمل Egyptian American cryptographer

87 Diffie Hellman Merkle

88 Public Key Encryption

89

90

91 William Stanley Jevons William Stanley Jevons (September 1, August 13, 1882), English economist and logician,

92 Non Secret Encryption James Ellis Clifford Cocks Secret research at GCHQ

93 RSA Ron Rivest, Adi Shamir en Len Adleman