Introduction to Software Security Crypto Basics (Chapter 2)

Transcription

1 Introduction to Software Security Crypto Basics (Chapter 2) Seong-je Cho Spring 2018 Computer Security & Operating Systems Lab, DKU

2 Textbook Sources / References M. T. Goodrich and R. Tamassia, Introduction to Computer Security, Pearson (Addison-Wesley) Many photos in presentation licensed from google images or wikipedia Please do not duplicate and distribute - 2 -

3 Contents How to speak crypto Substitution Cipher Transposition Cipher One-Time Pad Codebook Cipher Crypto history Taxonomy - 3 -

4 Crypto Cryptology The art and science of making and breaking secret codes Cryptography making secret codes Cryptosystem Pair of algorithms that take a key and convert plaintext to ciphertext and back. Cryptanalysis breaking secret codes Crypto all of the above (and more) Alice Bob Eve - 4 -

5 How to Speak Crypto A cipher or cryptosystem is used to encrypt the plaintext The result of encryption is ciphertext We decrypt ciphertext to recover plaintext A key is used to configure a cryptosystem A symmetric key cryptosystem uses the same key to encrypt as to decrypt A public key cryptosystem uses a public key to encrypt and a private key to decrypt (sign) - 5 -

6 Symmetric key cryptosystem DES (Data Encryption Standard) AES (Advanced Encryption Standard) SEED - 6 -

7 Asymmetric key cryptosystem RSA (Rivest, Sharmir, Adleman) ECC (Elliptic Curve Cryptography) Public key cryptosystem - 7 -

8 Basis assumption Crypto The system is completely known to the attacker Only the key is secret Also known as Kerckhoffs Principle Crypto algorithms are not secret Why do we make this assumption? Experience has shown that secret algorithms are weak when exposed Secret algorithms never remain secret Better to find weaknesses beforehand - 8 -

9 Crypto as Black Box The message M is called the plaintext. Alice will convert plaintext M to an encrypted form using an encryption algorithm E that outputs a ciphertext C for M. Sender Communication channel Recipient plaintext 평문 encrypt ciphertext decrypt plaintext plaintext shared secret key Attacker (eavesdropping) shared secret key Symmetric key cryptosystem - 9 -

10 Substitution Cipher

11 Simple Substitution Replace each letter with the one three over in the alphabet. Plain: meet me after the toga party Key Plaintext Ciphertext a b c d e f g h i j k l m n o p q r s t u v w x y z D E F G H I J K L M N O P Q R S T U V W X Y Z A B C Cipher: PHHW PH DIWHU WKH WRJD SDUWB Another example Plaintext: fourscoreandsevenyearsago Ciphertext: IRXUVFRUHDAGVHYHABHDUVDIR Shift by 3 is Caesar s cipher

12 Ceasar s Cipher Decryption Suppose we know a Ceasar s cipher is being used Ciphertext: VSRQJHEREVTXDUHSDQWU Plaintext Ciphertext a b c d e f g h i j k l m n o p q r s t u v w x y z D E F G H I J K L M N O P Q R S T U V W X Y Z A B C Plaintext: spongebobsquarepants

13 Not-so-Simple Substitution Shift by n for some n {0,1,2,,25} Then key is n Example: key = 7 Plaintext Ciphertext a b c d e f g h i j k l m n o p q r s t u v w x y z H I J K L M N O P Q R S T U V W X Y Z A B C D E F G

14 Given Cryptanalysis I: Try Them All A simple substitution (shift by n) is used But the key is unknown Given ciphertext: meqefscerhcsyeviekmvp How to find the key? Exhaustive key search Only 26 possible keys try them all! Solution: key = 4 IAMABOYANDYOUAREAGIRL

15 Brute-force cryptanalysis of Caesar cipher Cryptanalysis I: Try Them All

16 Even-less-Simple Substitution Key is some permutation of letters Need not be a shift For example Plaintext a b c d e f g h i Ciphertext j k l m n o p q r s t u v w x y z J I C A X S E Y V D K W B Q T Z R H F M P N U L G O Then 26! > 2 88 possible keys! Dominates the art of secret writing throughout the first millennium

17 Cryptanalysis II: Be Clever We know that a simple substitution is used But not necessarily a shift by n Can we find the key given ciphertext: PBFPVYFBQXZTYFPBFEQJHDXXQVAPTPQJKTOYQWIPBVWLXTOXBTFXQWAXBVC XQWAXFQJVWLEQNTOZQGGQLFXQWAKVWLXQWAEBIPBFXFQVXGTVJVWLBTP QWAEBFPBFHCVLXBQUFEVWLXGDPEQVPQGVPPBFTIXPFHXZHVFAGFOTHFEFBQU FTDHZBQPOTHXTYFTODXQHFTDPTOGHFQPBQWAQJJTODXQHFOQPWTBDHHI XQVAPBFZQHCFWPFHPBFIPBQWKFABVYYDZBOTHPBQPQJTQOTOGHFQAPBFEQJ HDXXQVAVXEBQPEFZBVFOJIWFFACFCCFHQWAUVWFLQHGFXVAFXQHFUFHILT TAVWAFFAWTEVOITDHFHFQAITIXPFHXAFQHEFZQWGFLVWPTOFFA

18 Cryptanalysis II Can t try all 2 88 simple substitution keys Can we be more clever? English letter frequency counts A C E G I K M O Q S U W Y

19 Cryptanalysis II Ciphertext PBFPVYFBQXZTYFPBFEQJHDXXQVAPTPQJKTOYQWIPBVWLXTOXBTFXQWAX BVCXQWAXFQJVWLEQNTOZQGGQLFXQWAKVWLXQWAEBIPBFXFQVXGTVJV WLBTPQWAEBFPBFHCVLXBQUFEVWLXGDPEQVPQGVPPBFTIXPFHXZHVFAGFOT HFEFBQUFTDHZBQPOTHXTYFTODXQHFTDPTOGHFQPBQWAQJJTODXQHFO QPWTBDHHIXQVAPBFZQHCFWPFHPBFIPBQWKFABVYYDZBOTHPBQPQJTQOT OGHFQAPBFEQJHDXXQVAVXEBQPEFZBVFOJIWFFACFCCFHQWAUVWFLQHGF XVAFXQHFUFHILTTAVWAFFAWTEVOITDHFHFQAITIXPFHXAFQHEFZQWGFL VWPTOFFA Decrypt this message using info below Ciphertext frequency counts: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

20 Frequency analysis history Discovered by the Arabs Earliest known description of frequency analysis is in a book by the 9-century scientist al-kindi Rediscovered or introduced from the Arabs in Europe during the Renaissance Frequency analysis made substitution cipher inscure. Frequency Statistics of Language In addition to the frequency info of single letters, the frequency info of two-letter (digram) or three-letter (trigram) combinations can be used for the cryptanalysis Most frequent digrams TH, HE, IN, ER, RE, AN, ON, EN, AT Most frequent trigrams THE, ING, AND, HER, ERE, ENT, THA, NTH, WAS, ETH, FOR, DTH

21 Monoalphabetic Substitution Ciphers Cryptography Further generalization of the Caesar cipher, Plain: ABCDEFGHIJKLMNOPQRSTUVWXYZ Cipher: DEFGHIJKLMNOPQRSTUVWXYZABC is obtained by allowing any permutation of 26 characters for the cipher Key size = 26 Key space = 26! 4x10 26 Unique mapping of plaintext alphabet to ciphertext alphabet Monoalphabetic For a long time thought secure, but easily breakable by frequency analysis attack Computer Security & OS Lab. DKU

22 Vigenere Cipher Cryptography A method of encrypting alphabetic text by using a series of different Caesar ciphers based on the letters of a keyword Choose key word Repeat key word to match character count to plaintext Assign key word character to plaintext characters Replace plaintext with shifted letter from character s Vigenere Table row Computer Security & OS Lab. DKU

23 Polyalphabetic System with Vigene re Table Cryptography 1 st i Z 2 nd i T Computer Security & OS Lab. DKU

24 Vigenère cipher Cryptography Best-known polyalphabetic ciphers Each key letter determines one of 26 Caesar (shift) ciphers c i = E(p i ) = p i + k i mod(key length) Example: Key: Plaintext: Cipheretxt: deceptivedeceptivedeceptive wearediscoveredsaveyourself ZICVTWQNGRZGVTWAVZHCQYGLMGJ Keyword is repeated to make a key as long as the plaintext Given a sufficient amount of ciphertext, common sequences are repeated, exposing the period (keyword length) Target of the cryptanalysis Computer Security & OS Lab. DKU

25 Cryptography Key: Plaintext: Cipheretxt: deceptivedeceptivedeceptive wearediscoveredsaveyourself ZICVTWQNGRZGVTWAVZHCQYGLMGJ Computer Security & OS Lab. DKU

26 Vigenère cipher Cryptography If the keyword length is N, then Vigenère cipher, in effect, consists of N monoalphabetic substitution ciphers Improvement over the Playfair cipher, but language structure and frequency information still remain Vigenère autokey system: after key is exhausted, use plaintext for running key (to eliminate the periodic nature) Key: Plaintext: Cipheretxt: deceptivewearediscoveredsav wearediscoveredsaveyourself ZICVTWQNGKZEIIGASXSTSLVVWLA Key and plaintext share the same frequency distribution of letters a statistical technique can be used for the cryptanalysis, (e.g., e enciphered with e would occur with a frequency of (0.1275) , t enciphered with t would occur with a frequency of (0.0925) , etc.) Computer Security & OS Lab. DKU

27 Substitution Boxes Cryptography Vigenère cipher can be visualized using a two-dimensional table 1 st letter in a pair would specify a row 2 nd letter in a pair would specify a column Each entry would be the unique two-letter substitution to use for the pair This substitution can also be done on binary numbers. Such substitutions are usually described by substitution boxes, or S-boxes. Computer Security & OS Lab. DKU

28 Transposition cipher, Hill cipher Computer Security & OS Lab. DKU

29 Transposition Cipher Cryptography method of encryption by which the positions held by units of plaintext (which are commonly characters or groups of characters) are shifted according to a regular system, so that the ciphertext constitutes a permutation of the plaintext. Hide the message by rearranging the letter order without altering the actual letters used Rail Fence Cipher Write message on alternate rows, and read off cipher row by row Example (Two rails): Meet me after the toga party M e m a t r h t g p r y e t e f e t e o a a t MEMATRHTGPRYETEFETEOAAT Example (Three rails) : 'WE ARE DISCOVERED. FLEE AT ONCE Computer Security & OS Lab. DKU W E C R L T E E R D S O E E F E A O C A I V D E N WECRL TEERD SOEEF EAOCA IVDEN

30 Transposition (Permutation) Techniques Cryptography Columnar Transposition Ciphers Message is written in rectangle, row by row, but read off column by column; The order of columns read off is the key Example 1: Key: Plaintext: a t t a c k p o s t p o n e d u n t i l t w o a m x y z Ciphertext:TTNA APTM TSUO AODW COIXKNLYPETZ Example 2: Ciphertext is EATI TNIH MEXN ETMG MEDT Generalization: multiple transpositions Computer Security & OS Lab. DKU

31 Double Transposition Cryptography Plaintext: attackxatxdawn Permute rows and columns Ciphertext: xtawxnattxadakc Key: matrix size and permutations (3,5,1,4,2) and (1,3,2) Computer Security & OS Lab. DKU

32 The Hill Cipher Cryptography Use of linear algebra To encrypt a message, each block of n letters (considered as an n-component vector) is multiplied by an invertible n n matrix, again modulus 26. The matrix used for encryption is the cipher key The key (or GYBNQKURP in letters) To decrypt the message, each block is multiplied by the inverse of the matrix used for encryption. the inverse matrix of the key matrix (IFKVIVVMI in letters) Source: Computer Security & OS Lab. DKU

33 The Hill Cipher Cryptography Key: GYBNQKURP in letters Plaintext: ACT (A:0, C:2, T:19) or Plaintext: CAT Ciphertext of ACT is ( POH ), Ciphertext of CAT is ( FIN ) Decryption Computer Security & OS Lab. DKU

34 One-time Pad

35 One-time Pad Encryption e=000 h=001 i=010 k=011 l=100 r=101 s=110 t=111 Encryption: Plaintext Key = Ciphertext P h e i l h i t l e r K C s r l h s s t h s r Assume that the (right) key was given to Alice

36 One-time Pad Decryption e=000 h=001 i=010 k=011 l=100 r=101 s=110 t=111 Decryption: Ciphertext Key = Plaintext C s r l h s s t h s r K P h e i l h i t l e r Assume that the (right) key was given to Bob

37 One-time Pad (1 st threat scenario) Double agent claims sender used key : C s r l h s s t h s r K P k i l l h i t l e r e=000 h=001 i=010 k=011 l=100 r=101 s=110 t=111 Double agent, Charlie, claims that the key was (wrong key.) Bob cannot understand the decrypted message, and contact to Alice

38 One-time Pad (2 nd threat scenario) Sender (Alice) is captured and claims the key is: C s r l h s s t h s r K P h e l i k e s i k e e=000 h=001 i=010 k=011 l=100 r=101 s=110 t=111 Assume that Alice is captured, but she is double agent and told the adversary the (wrong) key The adversary didn t know the fact and can release her

39 One-time Pad Summary Provably secure, when used correctly Ciphertext provides no info about plaintext All plaintexts are equally likely Pad must be random, used only once Pad is known only by sender and receiver Pad is same size as message No assurance of message integrity Why not distribute message(plaintext) the same way as the pad(key)?

40 Others (Codebook, Information theory )

41 Codebook Literally, a book filled with codewords Zimmerman Telegram encrypted via codebook Februar fest finanzielle folgender Frieden Friedenschluss : : Modern block ciphers are codebooks! More on this later

42 Early 20th Century WWI Zimmerman Telegram Gentlemen do not read each other s mail Henry L. Stimson, Secretary of State, 1929 WWII golden age of cryptanalysis Japanese Purple (codename MAGIC) German Enigma (codename ULTRA) Enigma Machine Encryption machine used by Germans in the WWII, relies on electricity Plug board: allowed for pairs of letters to be remapped before the encryption process started and after it ended. Light board Keyboard Set of rotors: user must select three rotors from a set of rotors to be used in the machine. A rotor contains one-to-one mappings of all the letters. Reflector (half rotor)

43 Alan Turing

44 Post-WWII History Claude Shannon father of the science of information theory Computer revolution lots of data Data Encryption Standard (DES), 70 s Public Key cryptography, 70 s CRYPTO conferences, 80 s Advanced Encryption Standard (AES), 90 s Crypto moved out of classified world

45 Claude Shannon The founder of Information Theory 1949 paper: Comm. Thy. of Secrecy Systems Confusion and diffusion Confusion obscure relationship between plaintext and ciphertext Making the relationship between the ciphertext and the key as complex and involved as possible One aim is to make it very hard to find the key even if one has a large number of plaintext-ciphertext pairs produced with the same key E.g.) simple substitution cipher Diffusion spread plaintext statistics through the ciphertext Change of one character in the plaintext results in several characters changed in the ciphertext One-time pad only uses confusion, while double transposition only uses diffusion Proved that one-time pad is secure

46 Symmetric Key Taxonomy of Cryptography Same key for encryption as for decryption Stream ciphers Block ciphers Public Key Two keys, one for encryption (public), and one for decryption (private) Digital signatures nothing comparable in symmetric key crypto Hash algorithms

47 Taxonomy of Cryptography 현대암호 대칭키암호 공개키암호 스트림암호 블록암호 해쉬함수 이산대수 소인수분해 RC4, LFSR AES, SEED SHA1,HAS-160 DH, DSA RSA

48 Substitution ciphers Summary, Q & A Mono-alphabetic (Basic unit is letters) Poly-alphabetic (Basic unit is single letters) Statistical Attacks Numerous tests have failed to do statistical analysis of the ciphertext Transposition ciphers Hill cipher