Fundamentals of Cryptography

Transcription

1 Fundamentals of Cryptography Topics in Quantum-Safe Cryptography June 23, 2016

2 Part III Data Encryption Standard

3 The Feistel network design m m 0 m 1 f k 1 1 m m 1 2 f k 2 2 DES uses a Feistel network design. Plaintext is divided into two halves. Key is used to generate subkeys k 1, k 2,..., k h f i is a component function whose output value depends on k i and m i m 2 m 3 m h c m h+1

4 Feistel Ciphers: A Class of Block Ciphers Components of a Feistel cipher: Parameters: n (half the block length), h (number of rounds), l (key size). M = {0, 1} 2n, C = {0, 1} 2n, K = {0, 1} l. A key scheduling algorithm which determines subkeys k 1, k 2,..., k h from a key k. Each subkey k i defines a component function f i : {0, 1} n {0, 1} n.

5 Components of a Feistel Cipher Encryption takes h rounds: Plaintext is m = (m 0, m 1 ), where m i {0, 1} n. Round 1: (m 0, m 1 ) (m 1, m 2 ), where m 2 = m 0 f 1 (m 1 ). Round 2: (m 1, m 2 ) (m 2, m 3 ), where m 3 = m 1 f 2 (m 2 ).. Round h: (m h 1, m h ) (m h, m h+1 ), where m h+1 = m h 1 f h (m h ). Ciphertext is c = (m h, m h+1 ). Decryption: Given c = (m h, m h+1 ) and k, to find m = (m 0, m 1 ): Compute m h 1 = m h+1 f h (m h ). Similarly, compute m h 2,..., m 1, m 0.

6 Feistel Cipher (notes) No restrictions on the functions f i in order for the encryption procedure to be invertible. Underlying principle: Take something simple and use it several times; hope that the result is complicated Confusion: Each round changes the message bits in a non-linear way. Diffusion: Small changes in the message propagate rapidly to neighbouring bits. Implementation: Encryption: Only need to implement one round; the same code can be used for each round. Decryption uses the same code as for encryption. (Use subkeys in reverse order.)

7 Overview of DES Feistel cipher with n = 32, h = 16, l = 56. Plaintext (64 bits) Initial permutation 16 round Feistel network Initial permutation 1 Key Schedule Key (56 bits) Ciphertext (64 bits)

8 Initial permutation In Out In Out In Out In Out Credit: Wikipedia

9 Key scheduling algorithm Round Left shift each half number by this many bits

10 Permuted Choice #1 In Out In Out In Out In Out

11 Permuted Choice #2 In Out In Out In Out In Out

12 Structure of the component functions Recall f i : {0, 1} 32 {0, 1} bits m Expansion table 48 bits i k i 48 bits S1 S2 S3 S4 S5 S6 S7 S8 Permutation 32 bits fi (m i )

13 Expansion table In Out 2, , 7 6, , 13 In Out 12, , 19 18, , 25 In Out 24, , 31 30, , 37 In Out 36, , 43 42, , 47

14 Permutation In Out In Out

15 DES S-boxes Substitution-boxes or S-boxes (S1, S2, S3, S4, S5, S6, S7, S8): Each S-box is a function taking six input bits and producing four output bits. S-boxes are the only components of DES that are non-linear. (Without the S-boxes, changing one plaintext bit would change very few ciphertext bits.) Security of DES crucially depends on their choice. DES with randomly selected S-boxes is easy to break.

16 S 1 S 2 S 3 S 4 S 5 S 6 S 7 S 8 DES S-boxes. Columns denote middle four bits of input. Rows denote outer two bits of input David 0Jao

17 Cryptanalysis of DES DES did more to galvanize the field of cryptanalysis than anything else. Now there was an algorithm to study. Bruce Schneier Brute force attacks (try every key): (1977 estimate) $20 million machine to find keys in one day (1993 estimate) $1 million machine to find keys in 7 hours (1999) EFF DES Cracker: $250,000 machine, 4.5 days per key (2006) COPACOBANA: $10,000 machine, 4.5 days per key (2012) Cloudcracker.com: $200 and 11.5 hours per key Non-brute-force attacks: Differential cryptanalysis (Eli Biham & Adi Shamir, 1991): 2 49 chosen plaintexts Linear cryptanalysis (Mitsuru Matsui, 1993): 2 43 known plaintexts

18 Attacks on DES Differential cryptanalysis [Biham & Shamir ]: Recovers key given 2 47 chosen plaintext/ciphertext pairs. DES was designed to resist this attack. Differential cryptanalysis is more effective against other block ciphers. Linear cryptanalysis [Matsui 1993]: Recovers key given 2 43 known plaintext/ciphertext pairs. Storing these pairs takes 131,000 Gbytes. Implemented in 1993: 10 days on 12 machines. Brute force June 1997: Broken by Internet search (3 months). July 1998: Broken in 3 days by EFF machine ($250,000). Jan 1999: Broken in 22 hrs, 15 min David (EFF Jao + distributed.net).

19 Implementation attacks on DES Power analysis attacks: Kocher, Jaffe & Jun Processor power consumption depends on instruction. Measure power consumption of instructions executed in 16th round of DES encryptions suffice to expose the secret key. Differential fault analysis (DFA) attacks: Biham & Shamir Attack: induce random errors in 16th round of DES. 200 erroneous decryptions expose the secret key.

20 Part IV Advanced Encryption Standard

21 The Advanced Encryption Standard (AES) Sept. 1997: Call issued for AES candidate algorithms. Requirements: Key sizes: 128, 192 and 256 bits. Block size: 128 bits. Efficient on both hardware and software platforms. Availability on a worldwide, non-exclusive, royalty-free basis.

22 The AES Process Aug. 1998: 15 submissions in Round 1. Aug. 1999: NIST selects five finalists: MARS, RC6, Rijndael, Serpent, Twofish. 1999: NSA performs a hardware efficiency comparison. Oct. 2, 2000: Rijndael is selected. Dec. 2001: The AES standard is officially adopted (FIPS 197). Rijndael is an iterated block cipher, based on a substitution-permutation network design.

23 Substitution-Permutation Networks A substitution-permutation network (SPN) is a multiple-round iterated block cipher where each round consists of a substitution operation followed by a permutation operation. plaintext k 1 S S S S Round 1 k 2 S S S S Round 2

24 Advanced Encryption Standard AES is an SPN where the permutation operation consists of two linear transformations (one of which is a permutation). All operations are byte oriented. The block size of AES is 128 bits. Each round key is 128 bits. A key schedule is used to generate the round keys. AES accepts three different key lengths. The number of rounds depends on the key length: key length h

25 General structure of the cipher As with the previous ciphers we have studied: The substitution operation (S-box) is the only non-linear component of the cipher. The permutation operations (permutation and linear transformation) spread out the non-linearities in each round.

26 AES Round Operations Each round updates a variable called State which consists of a 4 4 array of bytes (note: = 128, the block size). State is initialized with the 128-bit plaintext: a 0,0 a 0,1 a 0,2 a 0,3 a 1,0 a 1,1 a 1,2 a 1,3 a 2,0 a 2,1 a 2,2 a 2,3 a 3,0 a 3,1 a 3,2 a 3,3 plaintext After h rounds are completed, one final additional round key is XOR-ed with State to produce the ciphertext (key whitening). The AES round function uses four operations: AddRoundKey (key mixing) SubBytes (S-box) ShiftRows (permutation) MixColumns (matrix multiplication / linear transformation)

27 Add Round Key Bitwise-XOR each byte of State with the corresponding byte of the round key.

28 Substitute Bytes Take each byte in State and replace it with the output of the S-box. S : {0, 1} 8 {0, 1} 8 is a fixed and public function.

29 The AES S-box a b c d e f c 77 7b f2 6b 6f c b fe d7 ab ca 82 c9 7d fa f0 ad d4 a2 af 9c a4 72 c0 20 b7 fd f f7 cc 34 a5 e5 f1 71 d c7 23 c a e2 eb 27 b c 1a 1b 6e 5a a0 52 3b d6 b3 29 e3 2f d1 00 ed 20 fc b1 5b 6a cb be 39 4a 4c 58 cf 60 d0 ef aa fb 43 4d f9 02 7f 50 3c 9f a a3 40 8f 92 9d 38 f5 bc b6 da ff f3 d2 80 cd 0c 13 ec 5f c4 a7 7e 3d 64 5d f dc 22 2a ee b8 14 de 5e 0b db a0 e0 32 3a 0a c c2 d3 ac e4 79 b0 e7 c8 37 6d 8d d5 4e a9 6c 56 f4 ea 65 7a ae 08 c0 ba e 1c a6 b4 c6 e8 dd 74 1f 4b bd 8b 8a d0 70 3e b f6 0e b9 86 c1 1d 9e e0 e1 f d9 8e 94 9b 1e 87 e9 ce df f0 8c a1 89 0d bf e d 0f b0 54 bb 16

30 Shift Rows Permute the bytes of State by applying a cyclic shift to each row.

31 Mix Columns This step is the most mathematically complicated step in the algorithm. Multiplications take place in GF(256). b a 0 b 1 b 2 = a 1 a 2 b a 3

32 AES Encryption From the key k, derive h + 1 round keys k 0, k 1,..., k h via the key schedule. The encryption function: State plaintext State State k 0 for i = 1... h 1 do State SubBytes(State) State ShiftRows(State) State MixColumns(State) State State k i State SubBytes(State) State ShiftRows(State) State State k h ciphertext State Note that in the final round, MixColumns is not applied.

33 AES key schedule (for 128-bit keys) For 128-bit keys, AES has ten rounds, so we need eleven subkeys. Each k i is a 32-bit word (viewed as a 4-byte array). Each group of four k i s forms a 128-bit subkey. The first round subkey (k 0, k 1, k 2, k 3 ) equals the actual AES key. (Diagram from stackexchange.com/q/20)

34 Key schedule core (for 128-bit keys) The functions f i : {0, 1} 32 {0, 1} 32 are defined as follows: Left-shift the input cyclically by 8 bits. Apply the AES S-box to each byte. Bitwise XOR the left-most byte with a constant which varies by round according to the following table. Round constant Round constant 1 0x01 6 0x20 2 0x02 7 0x40 3 0x04 8 0x80 4 0x08 9 0x1B 5 0x x36 Output the result.