S. Erfani, ECE Dept., University of Windsor Network Security. 2.3-Cipher Block Modes of operation

Transcription

1 2.3-Cipher Block Modes of operation Model of Conventional Cryptosystems The following figure, which is on the next page, illustrates the conventional encryption process. The original plaintext is converted into apparently random nonsense, called ciphertext. The encryption process consists of an algorithm and a key. The key is a value independent of the plaintext. The algorithm will produce a different output depending on the specific key being used at the time. Changing the key changes the output of the algorithm, i.e., the ciphertext. Once the ciphertext is produced, it may be transmitted. Upon reception, the ciphertext can be transformed back to the original plaintext by using a decryption algorithm and the same key that was used for encryption. Cryptanalyst X^ Y^ Message Source X Encryption Algorithm Y Decryption Algorithm Destination K Key Source Secure Channel Figure. 1: Model of Conventional Cryptosystem The security of conventional encryption depends on several factors: The Encryption Algorithm- It must be powerful enough that it is impractical to decrypt a message on the basis of the ciphertext alone. Sep

2 Secrecy of the key- It was shown that the security of conventional encryption depends on the secrecy of the key, not the secrecy of the algorithm. Referring to Fig. 1 above, with the message X and the encryption key K as input, the encryption algorithm forms the ciphertext. Y=E k (X) The intended receiver, in possession of the key is able to invert the transformation X=D k (Y) An opponent, observing Y but not having access to K or X, may attempt to recover X or K or both X and K. It is assumed that the opponent knows the encryption (E) and decryption (D) algorithms. If the opponent is interested in only this particular message, then the focus of the effort is to recover X by generating a plaintext estimate X^. Often, however, the opponent is interested in being able to read future messages as well, in which case an attempt is made to recover K by generating an estimate K^ Cryptanalysis The process of attempting to discover X or Y or both is known as cryptanalysis. The strategy used by the cryptanalysis depends on the nature of the encryption scheme and the information available to the cryptanalyst. The following table summarizes the various types of cryptanalytic attacks based on the amount of information known to the cryptanalyst. Table 1: Types of Attacks on Encrypted Message Attack Type Knowledge Known to Cryptanalyst Ciphertext only Encryption algorithm Ciphertext to be decoded Known Plaintext Encryption algorithm Ciphertext to be decoded One or more plaintext-ciphertext pairs formed with the same secret key Chosen Plaintext Encryption algorithm Ciphertext to be decoded Plaintext message chosen by cryptanalyst, together with its corresponding ciphertext generated with Sep

3 the same secret key Chosen Ciphertext Encryption algorithm Ciphertext to be decoded Purported ciphertext chosen by cryptanalyst, together with its corresponding decrypted plaintext generated with the secret key Chosen text Encryption algorithm Ciphertext to be decoded Plaintext message chosen by cryptanalyst, together with its corresponding ciphertext generated with the secret key Purported ciphertext chosen by cryptanalyst, together with its corresponding decrypted plaintext generated with the secret key Transposition Ciphers: Moving around Changing the positions of plaintext letters is another enciphering technique. It is called transposition, as in transferring position. Please note that many newspapers have transposition puzzles called jumbles. To illustrate this technique, let s do the following example. Example 1: Plaintext: last nite was heaven please marry me We use a 5x6 grid to write the plaintext as: Read down L A S T N I T E W A S H E A V E N P L E A S E M A R R Y M E To encipher the text, we only read letters down the first column, then letters down from the second column, and so on. The ciphered letters are the same as the plaintext letters except that they are positioned to form a new pattern, as given below. Ciphertext: LTELA AEAER SWVAR TAESY NSNEM IHPME To decipher the received ciphertext, the receiver must know two things: the length and width of the grid and the way letters are read from the grid. Sep

4 Note 1: The transposition cipher is also known as permutation cipher. We know give the mathematical description of the permutation cryptosystem as follows: Def: Permutation Cipher Let m be a positive integer. Let P =C = (Z 26 ) m and let K consist of all permutations of {1,, m}. For a key (i.e., a permutation) π, we define e π (x 1,, x m )=( x π(1),, x π(m) ) and d π (y 1,, y m )=( y π -1 (1),, y π -1 (m)), where π -1 is the inverse permutation to π. Example 2: Suppose m = 6 and the key is the following permutation π: x π(x) Note that the first row of this diagram lists the values of x, 1 x 6, and the 2 nd row lists the corresponding values of π(x). The inverse permutation π -1 can be constructed by interchanging the two rows in this diagram, and rearranging the columns so that the first row is in increasing order. Thus, carrying out these operations, we get the following decryption permutation π -1 as: x π -1 (x) Now, suppose we are given the plaintext Plaintext: she sells seashells by the seashore We first partition the plaintext into groups of six letters, and then rearrange each group of six letters according to permutation π. The result is shown in the following 6x6 grid. x π(x) E E S L S H S A L S E S L S H B L E H S Y E E T Sep

5 H R A E O S Hill Cipher Another interesting multi-alphabetic cipher is the Hill cipher, developed by the mathematician Lester Hill in The idea is based on linear transposition. In fact, permutation cipher is a special case of the Hill cipher. In this scheme, we take m linear combinations of the m successive plaintext alphabetic characters and produce an m ciphertext letters for them. The substitution is determined by m linear equations in which each letter is assigned its numerical value; i.e. {0, 1, 2, 25} = Z 26. For m = 3, the system can be described as follows: y = ( k x + k x + k x ) mod y = ( k x + k x + k x ) mod y = ( k x + k x + k x ) mod This can be expressed in terms of column vectors and matrices: or in a compact form y1 k11 k12 k13 x1 y = k k k x y 3 k31 k32 k 33 x 3 Y=KX Where Y and X are column vectors of length 3, representing the ciphertext and plaintext letters, and K is a 3 3 matrix, representing the encryption key. Operations are performed mod26. Decryption requires using the inverse of matrix K. Example 1: Consider the plaintext paymoremoney, and use the encryption key Sep

6 K = Find the resulting ciphertext. Solution: Plaintext: paymoremoney The first three letters of the plaintext are represented by vector (x 1, x 2, x 3 )=(15, 0, 24) Thus: y1 x y = K x = y 3 x 3 That is: y L y2 = 819 mod 26 = 13 = N y S Continuing in this fashion, the ciphertext for the entire plaintext is: Ciphertext: LNSHDLEWMTRW Q.E.D. Decryption requires using the inverse of the matrix K. The inverse K 1 of a matrix K is defined by the equation K K 1 = K 1 K =I, where I is the diagonal matrix that is all zeros except for ones along the main diagonal from upper left to lower right. Note 2: The inverse of a matrix does not always exist, but when it does, it satisfies the preceding equation. Exercise 1: Show that the inverse of matrix K used in above example is Sep

7 K = Note 3: It is easily shown that if the matrix K 1 is applied to the above resulting ciphertext, then the plaintext can be recovered. Exercise 2: A cryptanalyst receives the following ciphertext: LNSHDLEWMTRW He has also estimated the decryption matrix from some previous analysis for this Hill Cipher to be: K = What is the plaintext? We now give a precise description of the Hill Cipher over Z 26. Definition: Hill Cipher Cryptosystem Let m 2 be an integer, Let P=C=(Z 26 ) m and let K = {m m invertible matrix over Z 26 }. For a key K, we define: C = E K (P)=KP P = D K (C) = K 1 C= K 1 KP = P Note 1: Hill Cipher completely hides single-letter frequencies. Use of a larger matrix hides more frequency information. Sep

8 Note 2: The weakness of the Hill Cipher is that it is easily broken with a known plaintext attack. To show this, suppose we have m plaintext-ciphertext pairs, each of length m. Let P j =(P 1j, P 2j,, P mj ) C j =(C 1j, C 2j,, C mj ) Therefore, we can write C j =KP j 1 j m for some known key matrix K. We now define the following two m m square matrices: X = (P ij ) Y = (C ij ) Then, we can form the matrix equation Y=XK. Now, we can find the unknown key matrix K from the equation K=X -1 Y Let us illustrate the above attack by a simple example. Example 2: It is known that the plaintext friday is encrypted using a 2 2 Hill Cipher to yield the ciphertext PQCFKU. Find the key matrix K for this cryptosystem. Solution: Plaintext: f r i d a y P ij : Ciphertext: P Q C F K U C ij : For the unknown key matrix is K, we can write the following plaintext-ciphertext pairs: KP j = C j 1 j m Sep

9 Using the first two plaintext-ciphertext pairs, we can write the following matrix equation: = K mod 26 1 K = mod 26 = mod 26 = Therefore, we obtained the key matrix! The result can be verified by testing the remaining plaintext- ciphertext pair. Note 3 : From the above example and other examples worked out so far, we may conclude that neither cipher schemes of Substitution nor Transposition are strong enough to stand cryptanalytic attacks. One may find that using the two types together creates much better concealment than either method above. In fact, using substitution and transposition cipher methods repeatedly on ciphertext provides strong disguising patterns. We will discuss this scheme in the next chapter. Exercise 2: Why transposition ciphers are used if they are so easy to crack? Answer: Transposition can be looked at a set of instructions, one instruction for each letter, easily implemented by a computer and can be difficult to crack if they are repeatedly used on the same plaintext! Exercise 3: Repeat the transposition cipher used in Exercise 1 (on page 17) twice for the plaintext used: Solution: Sep

10 Plaintext: lastnitewasheavenpleasemarryme 1st transposed ciphertext: LTELAAEAERSWVARTAESYNSNEMIHPME 2nd transposed ciphertext: LEVSMTAAYIEERNHLRTSPASANMAWEE last nite was heaven please marry me LTELA AEAER SWVAR TAESY NSNEM I HPME Read down L A S T N I L T E L A A T E W A S H E A E R S W E A V E N P V A R T A E L E A S E M S Y N S N E A R R Y M E M I H P M E (a) 1 st transposed cipher. (b) The ou Sep