ICT 6541 Applied Cryptography. Hossen Asiful Mustafa

Transcription

1 ICT 6541 Applied Cryptography Hossen Asiful Mustafa

2 Encryption & Decryption Key (K) Plaintext (P) Encrypt (E) Ciphertext (C) C = E K (P) Same Key (K) Ciphertext (C) Decrypt (D) Plaintext (P) P = D K (C) P = D K (E K (P))

3 DES - Data Encryption Standard Intended usage: * Unclassified government business (USA) * Sensitive private sector business DES could not be legally exported from the US as software (but could be published in a US book, or printed on a T-Shirt!) Re-certified every five years, i.e. 1983, 1988, US NSA ( National Security Agency aka No Such Agency ) were reluctant for DES to be re-certified in Many feared that NSA has secret trapdoor in the DES US NBS ( National Bureau of Standards, now called NIST) request for proposals. None judged worthy nd request for proposals. * US NSA urges IBM to submit its cipher Lucifer * US NSA modifies IBM s submission US NBS publishes proposal Much comment about US NSA modifications, e.g. fear of backdoors, shortening of key from 128 to 56 bits DES Standard published. US NSA thought standard would be HW only, but NBS published enough details for software implementation DES widely used worldwide 1998 DES brute force attackable

4 Basics DES is an example of a BLOCK CIPHER (but can also be operated as a STREAM CIPHER) Plaintext encrypted 64-bits at a time. 56 bits used for key. The security lies in the key 2 56 = 7.2x10 16 possible keys 64- bit P 56-bit Key E 64-bit C Desired Design Criteria: Ciphertext should depend on the plaintext and key in a complicated and involved way (CONFUSION) Each bit of ciphertext should depend on all bits of plaintext and all bits of the key (DIFFUSION) AVALANCHE EFFECT Small changes to input cause massive variation in output. In DES flipping 1 bit of the key or 1 bit of a 64-bit input block will flip 50% of the output block s bits

5 Structure of DES 64-bit Plaintext 56-bit Key Initial Permutation (IP) 64 Generate L&R halves Round Round 16 ENCRYPTION Each block is subjected to 16 rounds of substitutions and permutations (transpositions). Permutations act to diffuse data, substitutions act to confuse data Each round uses 48 bits from key called the subkey. Initial and final permutation appear to be redundant. DECRYPTION Same process as encryption but with subkeys applied in reverse order Swap L & R halves Inverse of IP 64-bit Ciphertext

6 Feistel Cipher: a cipher design pattern Encryption N rounds Plaintext = (L 0, R 0 ) For 1 <= i <= n L i = R i-1 R i = L i-1 xor f(r i-1, K i ) Subkeys K i derived from key K Ciphertext = (R n, L n ) Note: swapped halves Decryption As Encryption above, but subkeys applied in reverse order: N, N-1, N-2, Block size: Large block size better bit or 256-bits blocks best Key size: These days at least 128 bits, more better, e.g. 192 or 256 bits Number of rounds: Typically at least 16 rounds needed Round function f and subkey generation:: Designed to make cryptanalysis difficult Round function f: typically built from transpositions, substitutions, modular arithmetic, etc.

7 Feistel Cipher Feistel Cipher for 3 rounds L 0 R 0 Plaintext L 1 =R 0 R 1 =L 0 xor f(r 0, K 1 ) L 2 =R 1 R 2 =L 1 xor f(r 1, K 2 ) This example should also make clear why Decryption needs to supply key K3 in the first round, key K2 in the second round, and key K1 in the third round L 3 =R 2 R 3 =L 2 xor f(r 2, K 3 ) R 3 L 3 Ciphertext

8 DES ALGORITHM 8

9 A Round of DES Left (32) Right (32) Key in (56) 8 non-linear S-Boxes 32 P-Box E-Box is XOR Key-Box 32 Left (32) 32 Right (32) Key out (56)

10 A Round of DES Left (32) Right (32) 8 S-Boxes 32 P-Box E-Box Subkey 48) A Round Left i = Right i-1 Right i = Left i-1 xor f i f i = P (S( E(Right i-1 ) xor Subkey i )) 32 Left (32) 32 Right (32)

11 Initial Permutation Read Left to Right, Top to Bottom Plaintext bit 58 goes to Bit Position 1 Plaintext bit 50 goes to Bit Position 2 Does this increase security? 11

12 Key Box 64-bit key transforms to 56-bit by discarding the parity bit (every 8-bit) Read Left to Right, Top to Bottom Plaintext bit 57 goes to Bit Position 1 12

13 Key Box The 56-bit key is divided into two 28-bit halves. The halves are circularly shifted left by either one or two bits, depending on the round. 13

14 Key Box 48-bit subkey is generated in each round This is called compression-permutation Read Left to Right, Top to Bottom Key bit 14 goes to Bit Position 1 of subkey 8 bits are ignored 14

15 Key Box 56 bits Rotate Left 1 or 2 bits Rotate Left 1 or 2 bits Permutation & Compression Subkey new input for key box bits

16 E-Box 32 bits bits E box expands & permutates (from 32-bits to 48 bits). Changes order as well as repeating certain bits (Helps with avalanche effect).

17 E-Box 32 bits are divided into 8 blocks of 4 bits For each block: 1 st and 4 th bits are repeated twice 2 nd and 3 rd bits are not repeated The bits are permuted as shown in the table 17

18 S-Boxes 48 bits S[1]... S[8] 32 bits Each S-box takes 6-bits of input and produces 4-bits of output. S-Boxes give DES it s security. Other boxes are linear and easier to analyze. S-Boxes are non-linear and much harder to analyze.

19 S-Box [n] b1 b2 b3 b4 b5 b6 Result = SBOX [n] [Row] [Column] r1 r2 r3 r4 Each S-box has its own substitution table. Outer 2 bits select row, middle 4 bits select column of substitution table. Entry gives new 4 bit value.

20 Substitution table for S-Box S1 What is the output for S-Box-1 for input ?

21 P-Box 32 bits bits P-Box is just a mathematical permutation.

22 P-Box Read Left to Right, Top to Bottom Key bit 16 goes to Bit Position 1 22

23 Final Permutation Inverse of initial permutation Read Left to Right, Top to Bottom Key bit 40 goes to Bit Position 1 23

24 DES ALGORITHM 24

25 DES decryption Same algorithm Keys must be used in reverse order If the encryption keys for each round are K1K2 K3,..., K16 then The decryption keys are K16 K15 K14,..., K1 Right circular shift for subkey generation Key shift at each round is 0,1,2,2,2,2,2,2,1,2,2,2,2,2,2,1. 25

26 Security of DES Design criteria (particularly of S- Boxes) not revealed until 1994 No known trapdoors. No proof of non-existence either Oddity: If both plaintext and key are complemented so is resulting ciphertext. DES has 4 weak keys & 6 pairs of semi-weak keys which should not be used.

27 Security of DES BRUTE FORCE ATTACK 2 56 keys but brute force attacks are now becoming feasible In 1993 Michael Wiener showed that it was possible to cheaply build hardware that undertook a known-plaintext attack: in 3.5 hours for $1 million in 21 mins for $10 million in 35 hours for $100,000 Intelligence agencies and those with the financial muscle most probably have such hardware.

28 Security of DES Differential Cryptanalysis Exploits how small changes in plaintext affect ciphertext. For DES, requires 2^47 chosen plaintexts for 16 rounds! Can break 8-round DES in seconds. Mostly theoretical; designer considered this attack during design phase Linear Cryptanalysis Approximate effect of encryption (notably S-boxes) with linear functions. For DES, requires 2^43 known plaintexts for 16 rounds!

29 Security of DES DES was finally broken by DESCHALL in 1997 They used distributed systems where unique host and different IP address were recorded They won $10,000 prize Now DES is replaced by 3DES with 168-bit key

30 Double DES (Multiple Encryption) Encrypt twice with two keys K1 K2 MEET-IN-THE MIDDLE ATTACK Known plaintext attack (i.e. have crib P1 & C1) P E E C For all K1 encrypt P1: list all results in Table T For each K2 decrypt C1 -> X. If X in T, check K1 & K2 with new crib (P2, C2). If okay then keys found. P1 * E T find X X * D C1 Reduces to 2 56 for Double DES, but T is huge!

31 Triple DES (part of DES standard) TRIPLE DES WITH 2 KEYS (EDE2) 3 keys considered unnecessary Cost of 2 key attack is thus nd Stage is decryption because if K2=K1 we gain backward compatibility with Single DES Available in PEM (Privacy Enhanced Mail), PGP, and others. P K1 E K2 D K1 E C TRIPLE DES WITH 3 KEYS (EDE3) Preferred by some K1 K2 K3 168-bit key length P E D E C

32 Self Study Variants of DES 32