CSCE 548 Building Secure Software Symmetric Cryptography

Transcription

1 CSCE 548 Building Secure Software Symmetric Cryptography Professor Lisa Luo Spring 2018

2 Previous Class Important terms Vulnerability Attack Attack vector Exploit 2

3 Previous Class Attack surface Components reachable and exploitable by attackers Attack surface reduction A practice that minimizes the attack surface Threat modeling STRIDE Attack trees: A tree-structured graph showing how a system can be attacked 3

4 Outline Classical Cryptography Two categories of Cryptography: Symmetric Cryptography Asymmetric Cryptography (discussed in next class) 4

5 Notation P: plaintext C: ciphertext K: key E: encryption; e.g., C = E (K, P) D: decryption; e.g., P = D(K, C) 5

6 Basic Encryption & Decryption Assumption: 1. Encryption/decryption algorithms are known to the public 2. K is only known to the sender and receiver plaintext Ciphertext plaintext Encryption C = E(K, P) Decryption P = D(K, C) 6

7 What do you need Cryptography for? Confidentiality I do not want the message to be read by my enemy (The copyright of these graphs belong to Mark Vandenwauver) 7

8 What do you need Cryptography for? Data Integrity Has the message been manipulated? 8

9 What do you need Cryptography for? Authentication Am I talking with the right person? Is this message really from the chief? 9

10 What do you need Cryptography for? Non-repudiation I can prove you indeed sent the message You cannot deny 10

11 Cryptographic Goals Confidentiality Information is unintelligible to attackers Data Integrity Data manipulation by attackers can be detected Data manipulation: insertion, deletion, and substitution Authentication Entity authentication: impersonation can be detected Data-origin authentication: fake messages can be detected Non-repudiation You cannot deny 11

12 Classical Cryptography 12

13 Caesar Cipher C = (P + K) % 26; Julius Caesar used K = 3 How to decipher C = KHOOR? Ø Receiver: o knows K = 3, and can easily get P = HELLO Ø Attacker: o do not know K, but knows the algorithm. 13

14 Break the Cipher Only 26 possible keys ¾ try them all! Exhaustive key search (brute-force attack) Solution: K = 3 14

15 Keyword Cipher Key is some permutation of letters Need not be a shift For example 15

16 Keyword Cipher GFS WMY OG LGDVS MF SFNKYHOSU ESLLMRS, PC WS BFGW POL DMFRQMRS, PL OG CPFU M UPCCSKSFO HDMPFOSXO GC OIS LMES DMFRQMRS DGFR SFGQRI OG CPDD GFS LISSO GK LG, MFU OISF WS NGQFO OIS GNNQKKSFNSL GC SMNI DSOOSK. WS NMDD OIS EGLO CKSJQSFODY GNNQKKPFR DSOOSK OIS 'CPKLO', OIS FSXO EGLO GNNQKKPFR DSOOSK OIS 'LSNGFU' OIS CGDDGWPFR EGLO GNNQKKPFR DSOOSK OIS 'OIPKU', MFU LG GF, QFOPD WS MNNGQFO CGK MDD OIS UPCCSKSFO DSOOSKL PF OIS HDMPFOSXO LMEHDS. OISF WS DGGB MO OIS NPHISK OSXO WS WMFO OG LGDVS MFU WS MDLG NDMLLPCY POL LYEAGDL. WS CPFU OIS EGLO GNNQKKPFR LYEAGD MFU NIMFRS PO OG OIS CGKE GC OIS 'CPKLO' DSOOSK GC OIS HDMPFOSXO LMEHDS, OIS FSXO EGLO NGEEGF LYEAGD PL NIMFRSU OG OIS CGKE GC OIS 'LSNGFU' DSOOSK, MFU OIS CGDDGWPFR EGLO NGEEGF LYEAGD PL NIMFRSU OG OIS CGKE GC OIS 'OIPKU' DSOOSK, MFU LG GF, QFOPD WS MNNGQFO CGK MDD LYEAGDL GC OIS NKYHOGRKME WS WMFO OG LGDVS. How to decipher the message without the key? There are a huge number of possible keys (26!) rather than 26 16

17 Frequency Analysis Can t try all 26! simple substitution keys Can we be more clever? English letter frequency counts 17

18 Frequency Analysis The ordered occurrences of letters in the ciphertext So, S -> E O -> T Another frequencybased strategy: the most frequent threeletter word OIS is probably THE 18

19 All classical ciphers are easy to break by some frequency analysis 19

20 Never ever use any home-made cryptography! 20

21 Symmetric Cryptography

22 Symmetric Block Cipher - DES DES: Data Encryption Standard NIST symmetric encryption standard Already broken; 56-bit key size is too small Block size: 64 bits 64-bit plaintext input; 64-bit ciphertext output How it works? Feistel structure: input block is divided into halves and processed alternatively XOR, Substitution (using the S-box), and Permutation (using the P-box) 22

23 Feistel Structure 23

24 Symmetric Block Cipher Triple-DES Triple-DES: still widely used A = E(K 1, P), B = D(K 2, A), C = E(K 3, B) Key size: 3 x 56 = 168 bits; secure When k 1 = k 2 = k 3, 3-DES becomes DES, since the second operation (D) offsets the first (E) It provides compatibility with DES when needed Disadvantage: slow 24

25 Symmetric Block Cipher - AES Advanced Encryption Standard (or Rijndael) Superseded DES as the NIST symmetric encryption standard since 2001 Block size: 128 bits (16 bytes) Key size: 128, 192 or 256 bits (slower with longer keys) DES vs. AES Longer key size -> more secure AES is faster than DES AES is suitable for parallel processing Encryption based on substitution and permutation 25

26 Issue with Block Ciphers DES can only process 64-bit blocks AES can only process 128-bit blocks Q: How to process a long message? 26

27 Modes of Operation for Block Ciphers A Mode of Operation describes how block ciphers are applied to a message longer than a block; usually, it is simply called Mode E.g., ECB (do not use it), CBC (Cipher Block Chaining), CFB (Cipher Feedback) Q: How to interpret AES128-CBC? AES128: cipher block with 128-bit key CBC: mode of operation Similarly, you can interpret 3DES-CFB 27

28 Electronic Codebook (ECB) Message is divided into 64-bit or 128-bit blocks Each block is processed independently Identical plaintext blocks lead the same ciphertext blocks 28

29 Serious Issue with ECB The simple strategy leaks too much information By applying ECB encryption to the left bitmap image, you get the right one Why? Same plaintext block Þ same ciphertext! *-ECB 29

30 Cipher Block Chaining (CBC) Each previous cipher block is chained with current plaintext block Even identical plaintext blocks will produce different ciphertext (as long as their preceding ciphertext blocks are different) 30

31 Effect of Applying CBC *-CBC q Why? Same plaintext yields different ciphertext! 31

32 Decryption based on CBC Q1: If an incorrect IV is provided, will you get wrong decryption results? Only the first block is corrupted; you still get correct results for other blocks Q2: If one ciphertext is corrupted, what is the consequence? Only the corresponding plaintext block and the one next to it are corrupted. Others are decrypted to the correct results 32

33 Summary Why do we need Cryptography? Confidentiality, data integrity, authentication, nonrepudiation Classical Cryptography Symmetric Cryptography Block ciphers: DES (do not use it); Triple-DES; AES Mode of Operation for block ciphers: ECB (do not use it); CBC; CFB; OFB; CTR 33