Computational Security, Stream and Block Cipher Functions

Transcription

1 Computational Security, Stream and Block Cipher Functions 18 March 2019 Lecture 3 Most Slides Credits: Steve Zdancewic (UPenn) 18 March 2019 SE 425: Communication and Information Security 1

2 Topics for Today Computational Security Modern Cryptographic Tools Stream Ciphers Block Ciphers Shared Key Encryption DES 18 March 2019 SE 425: Communication and Information Security 2

3 Computational Security In practice, strive for computationally security Given enough power, the attacker can crack the cipher (ex. brute force) But, an attacker with only bounded resources is extremely unlikely to crack it Example: Assume attacker has only polynomial time, then encryption algorithm that can t be inverted in less than exponential time is secure. Example: Encryption can be cracked in 10 years from today. Want to avoid trapdoors or shortcuts 18 March 2019 SE 425: Communication and Information Security 3

4 What s a good cipher? Indistinguishability under Chosen Plaintext Attack (IND-CPA) Game: 1. Alice chooses a secret key 2. Bart sends Alice plaintexts to encrypt. Alice encrypts and returns them. 3. Bart sends Alice two (new) messages m 1 and m 2 4. Alice flips a coin and encrypts either m 1 or m 2 based on it c 1. Alice sends Bart c 1 5. Bart must guess whether c 1 is the encryption of m 1 or m 2 Bart wins if he can guess better than 50% using a probabilistic polynomial time Turing machine 18 March 2019 SE 425: Communication and Information Security 4

5 What s a good cipher? Indistinguishability under Chosen Ciphertext Attack (IND-CCA1) Game: 1. Alice chooses a secret key 2. Bart sends Alice plaintexts to encrypt or decrypt. Alice encrypts or decrypts and returns them. 3. Bart sends Alice two (new) messages m 1 and m 2 4. Alice flips a coin and encrypts either m 1 or m 2 based on it c 1. Alice sends Bart c 1 5. Bart must guess whether c 1 is the encryption of m 1 or m 2 Bart wins if he can guess better than 50% using a probabilistic polynomial time Turing machine 18 March 2019 SE 425: Communication and Information Security 5

6 What s a good cipher? Indistinguishability under Adaptive Chosen Ciphertext Attack (IND-CCA2) Game: 1. Alice chooses a secret key 2. Bart sends Alice plaintexts to encrypt or decrypt. Alice encrypts or decrypts and returns them. 3. Bart sends Alice two (new) messages m 1 and m 2 4. Alice flips a coin and encrypts either m 1 or m 2 based on it c 1. Alice sends Bart c 1 5. Bart can ask Alice to decrypt any message except for c 1 6. Bart must guess whether c 1 is the encryption of m 1 or m 2 Bart wins if he can guess better than 50% using a probabilistic polynomial time Turing machine 18 March 2019 SE 425: Communication and Information Security 6

7 How they relate IND-CCA2 IND-CCA1 IND-CPA 18 March 2019 SE 425: Communication and Information Security 7

8 So Far Computational Security Modern Cryptographic Tools Stream Ciphers Block Ciphers Shared Key Encryption DES 18 March 2019 SE 425: Communication and Information Security 8

9 Types of Ciphers Block Ciphers Stream Ciphers Both do: Combination of input plaintext and key to produce cipher text They differ in: How the plaintext and key and combined 18 March 2019 SE 425: Communication and Information Security 9

10 Stream Ciphers Characterized by operating on one symbol at a time The alphabetic substitutions we have seen so far have been stream ciphers If the algorithm is XOR, this is a stream cipher: Some kinds of errors will affect subsequent encryptions and decryptions The message will decrypt to a point and then fail The recipient can recover by duplicating the error 18 March 2019 SE 425: Communication and Information Security 10

11 Stream Imagined File XOR Gen Key Ciphertext: March 2019 SE 425: Communication and Information Security 11

12 Block Ciphers Characterized by operating on more than one symbol at a time Takes a group of symbols as input, combines them a secret, and outputs a block of ciphertext In a good block cipher, all of the input characters influence all of the output Can introduce more randomness If the algorithm is f, this is a block cipher: p: p 1 p 2 p 3 p 4 p 5 p 6 p 7 p 8 p 9 p 10 f f f f f k: k 1 k 2 k 3 k 4 k 5 c: c 1 c 2 c 3 c 4 c 5 c 6 c 7 c 8 c 9 c March 2019 SE 425: Communication and Information Security 12

13 Block Imagined File Key f f f f Ciphertext: March 2019 SE 425: Communication and Information Security 13

14 Advantages and Disadvantages Stream ciphers: Operate relatively fast since they work on only one character at a time Lower error propagation since each symbol is affected only by itself Block Ciphers: Higher diffusion since the material for each block affects the entire block Single characters can not be swapped in and out by an attacker What about mapping one symbol to multiple symbols? 18 March 2019 SE 425: Communication and Information Security 14

15 Kinds of Industrial Strength Crypto Shared Key Cryptography Public Key Cryptography Cryptographic Hashes All aim for computational security Not all methods have been proved to be intractable to crack. 18 March 2019 SE 425: Communication and Information Security 15

16 Shared Key Cryptography Sender & receiver use the same (secret) key Also called symmetric or secret key cryptography Are block ciphers or stream ciphers Examples (Block): DES, Triple-DES, Blowfish, Twofish, AES, Rijndael, 18 March 2019 SE 425: Communication and Information Security 16

17 Challenges to Shared Key Crypto Stolen key means attacker can decrypt old ciphertext Change keys frequently to limit damage Distribution of keys is problematic Keys must be transmitted securely Use couriers? Distribute in pieces over separate channels? Number of keys is O(n 2 ) where n is # of participants 18 March 2019 SE 425: Communication and Information Security 17

18 Pairs of Shared Keys A B A B A B A B C C D C D E 18 March 2019 SE 425: Communication and Information Security 18

19 Shared Key Notation Encryption algorithm E key x plain cipher Notation: K{msg} = E(K, msg) Decryption algorithm D key x cipher plain D inverts E D(K, E(K, msg)) = msg Sometimes E is the same algorithm as D Use capital K for shared (secret) keys 18 March 2019 SE 425: Communication and Information Security 19

20 Secure Channel: Shared Keys Alice Bart K AB {Hello!} K AB {Hi!} K AB K AB An outsider shouldn t be able to tell: 1. The message contents 2. Which key the message was encrypted under 18 March 2019 SE 425: Communication and Information Security 20

21 Data Encryption Standard (DES) Adopted as a standard in 1976 Security analyzed by the National Security Agency (NSA) Key is 56b, padded to 64b using 8 parity bits Uses simple operators on (up to) 64b values Simple to implement in software or hardware Input is processed in 64b blocks Based on a series of 16 rounds Each cycle uses permutation & substitution to combine plaintext with the key 18 March 2019 SE 425: Communication and Information Security 21

22 DES Encryption 18 March 2019 SE 425: Communication and Information Security 22

23 DES Decryption Use the same algorithm as encryption, but use k 16 k 1 instead of k 1 k 16 Proof that this works: To obtain round j from j 1: (1) L j = R j 1 (2) R j = L j 1 f(r j 1, k j ) Rewrite in terms of round j 1: 1) R j 1 = L j 2) L j 1 f(r j 1, k j ) = R j 3) L j 1 f R j 1, k j f R j 1, k j = R j f(r j 1, k j ) 4) L j 1 = R j f(r j 1, k j ) 5) L j 1 = R j f(l j, k j ) 18 March 2019 SE 425: Communication and Information Security 23

24 Summary Computational Security Modern Cryptographic Tools Stream Ciphers Block Ciphers Shared Key Encryption DES 18 March 2019 SE 425: Communication and Information Security 24

25 One Round of DES (f of previous slide) Expansion Permuted choice of key S-box Permutation 18 March 2019 SE 425: Communication and Information Security 25

26 Types of Permutations in DES Permutation Permuted Choice Expansion Permutation 18 March 2019 SE 425: Communication and Information Security 26

27 DES S-Boxes Substitution table 6 bits of input replaced by 4 bits of output Which substitution is applied depends on the input bits Implemented as a lookup table 8 S-Boxes Each S-Box has a table of 64 entries Each entry specifies a 4-bit output 18 March 2019 SE 425: Communication and Information Security 27

28 DES S-Box Example 18 March 2019 SE 425: Communication and Information Security 28