CSCE 813 Internet Security Symmetric Cryptography

Transcription

1 CSCE 813 Internet Security Symmetric Cryptography Professor Lisa Luo Fall 2017

2 Previous Class Essential Internet Security Requirements Confidentiality Integrity Authenticity Availability Accountability 2

3 Previous Class Attacks against Internet Message interception; Traffic analysis; Message loss; Message modification; Message insertion; Message replay; Denial-of-Service attack Attack Surface Components reachable and exploitable by attackers Attack surface reduction A practice that minimizes the attack surface Attack Trees A tree-structured graph showing how a system can be attacked 3

4 Model for Internet Security Protecting information channel to achieve security objectives: the CIA (+ AA) Triad One technique: Cryptography 4

5 Outline Classical Cryptography Two categories of Cryptography: Symmetric Cryptography Asymmetric Cryptography (discussed next class) Cryptography Application 5

6 Cryptography Cryptography: from Greek Crypto-: secret; -graphy: writing The art of secret writing Cryptography: creates ciphers Cryptanalysis: break ciphers Cryptography + Cryptanalysis = Cryptology 6

7 Notation P: plaintext C: ciphertext K: key E: encryption; e.g., C = E (K, P) D: decryption; e.g., P = D(K, C) 7

8 Basic Encryption & Decryption Assumption: 1. Encryption/decryption algorithms are known to the public 2. K is only known to the sender and receiver plaintext Ciphertext plaintext Encryption C = E(K, P) Decryption P = D(K, C) 8

9 The history of Cryptology is the arm race between Cryptography and Cryptanalysis 9

10 Caesar Cipher (simple substitution) C = (P + K) % 26; Julius Caesar used K = 3 How to decipher C = KHOOR? Ø Receiver: o knows K = 3, and can easily get P = HELLO Ø Attacker: o do not know K, but knows the algorithm. 10

11 Cryptanalysis I: Try Them All Only 26 possible keys ¾ try them all! Exhaustive key search (brute-force attack) Solution: K = 3 11

12 Keyword Cipher (even-less-simple substitution) Key is some permutation of letters Need not be a shift For example Plaintext Ciphertext a b c d e f g h i j k l m n o p q r s t u v w x y z J I C A X S E Y V D K W B Q T Z R H F M P N U L G O How to find the key? There are a huge number of possible keys (26!) rather than 26 12

13 Cryptanalysis II Can t try all 26! simple substitution keys Can we be more clever? English letter frequency counts 13

14 Cryptanalysis II: Frequency Analysis We know that a substitution is used But not necessarily a shift by n Can we find the key given ciphertext: PBFPVYFBQXZTYFPBFEQJHDXXQVAPTPQJKTOYQWIPB VWLXTOXBTFXQWAXBVCXQWAXFQJVWLEQNTOZQGGQ LFXQWAKVWLXQWAEBIPBFXFQVXGTVJVWLBTPQWAEB FPBFHCVLXBQUFEVWLXGDPEQVPQGVPPBFTIXPFHXZH VFAGFOTHFEFBQUFTDHZBQPOTHXTYFTODXQHFTDPT OGHFQPBQWAQJJTODXQHFOQPWTBDHHIXQVAPBFZQ HCFWPFHPBFIPBQWKFABVYYDZBOTHPBQPQJTQOTOG HFQAPBFEQJHDXXQVAVXEBQPEFZBVFOJIWFFACFCCF HQWAUVWFLQHGFXVAFXQHFUFHILTTAVWAFFAWTEVOI TDHFHFQAITIXPFHXAFQHEFZQWGFLVWPTOFFA 14

15 Cryptanalysis II: Frequency Analysis Ciphertext: PBFPVYFBQXZTYFPBFEQJHDXXQVAPTPQJKTOYQWIPBVWLXTO XBTFXQWAXBVCXQWAXFQJVWLEQNTOZQGGQLFXQWAKVWLX QWAEBIPBFXFQVXGTVJVWLBTPQWAEBFPBFHCVLXBQUFEVWL XGDPEQVPQGVPPBFTIXPFHXZHVFAGFOTHFEFBQUFTDHZBQP OTHXTYFTODXQHFTDPTOGHFQPBQWAQJJTODXQHFOQPWTBD HHIXQVAPBFZQHCFWPFHPBFIPBQWKFABVYYDZBOTHPBQPQJT QOTOGHFQAPBFEQJHDXXQVAVXEBQPEFZBVFOJIWFFACFCCF HQWAUVWFLQHGFXVAFXQHFUFHILTTAVWAFFAWTEVOITDHFHF QAITIXPFHXAFQHEFZQWGFLVWPTOFFA Decrypt this message using info below Ciphertext frequency counts: A B C D E F G H I So, F -> E Q -> T J K L M N O P Q R S T U V W X Y Z

16 All classical ciphers are easy to break by some frequency analysis 16

17 Never ever use any home-made cryptography! 17

18 Cryptosystem is Secure Cryptosystem is secure o o Caesar Cipher: 1. does not have large key space Keyword Cipher: 1. have large key space (good!) 2. vulnerable to frequency analysis NO Have large key space? YES Not secure (vulnerable to brute-force attack) Vulnerable to shortcut attacks (e.g., frequency analysis)? Too abstract? YES NO Not secure Secure 18

19 Two Properties of a Secure Cipher Shannon s proposal in 1949: develop a cipher that alternates confusion and diffusion functions Confusion: the key and ciphertext should involve as much as possible each digit of the ciphtertext depends on several parts of the key Diffusion: the statistical structure of the plaintext is dissipated into the statistics of the ciphertext when a digit of the plaintext is changed, many digits of the ciphertext are affected 19

20 Symmetric Cryptography 20

21 Feistel Cipher 21

22 Feistel Structure Input block is divided into halves and processed alternatively Each round has: XOR Substitution (using the S-box) Permutation (using the P-box) 22

23 Data Encryption Standard (DES) 23

24 Data Encryption Standard (DES) NIST symmetric encryption standard Key size: 56 bits Block size: 64 bits 64-bit plaintext block; 64-bit ciphertext block How it works? 24

25 A DES Round (DES has 16 rounds) 25

26 Mangler Function R is expanded from 32-bit to 48-bit 26

27 Mangler Function Each S-box is a 6-bit to 4-bit decoder 27

28 S-Box There are 8 S-boxes producing 32-bit Mangle Function output 28

29 S-Box Each 6-bit input is converted to a 4-bit output The eight 4-bit outputs is combined into a 32-bit quantity whose bits are then permuted 29

30 Permutation of the 32-bit Ouptut P-box No pattern frequency analysis does not work 30

31 Security Analysis The substitution and permutation ensures: Ø bits of the output of an S-box on one round affects the input of multiple S-boxes on the next round Achieving Diffusion 31

32 Diffusion Effect o o A change in one bit of the plaintext or one bit of the key should produce a change in many bits of the ciphertext Table (a): two plaintext with 1-bit difference and a single key are selected o Table (b): two keys with 1- bit difference and a single plaintext are selected 32

33 Attacks on DES Already broken Brute-force attack: 56-bit key size not long enough Cryptanalysis by exploiting weakness in S-box design Differential cryptanalysis: observe the behavior of pairs of text blocks evolving along each round of the cipher, can find a DES key given 2 47 chosen plaintexts Timing attacks: information about the key or the plaintext is obtained by observing how long to decrypt various ciphertexts 33

34 Triple-DES Triple-DES: still widely used A = E(K 1, P), B = D(K 2, A), C = E(K 3, B) Key size: 3 x 56 = 168 bits; secure When k 1 = k 2 = k 3, 3-DES becomes DES, since the second operation (D) offsets the first (E) It provides compatibility with DES when needed Disadvantage: slow 34