ECE 646 Lecture 1 CRYPTOLOGY

Transcription

1 ECE 646 Lecture 1 CRYPTOLOGY Basic Concepts of Cryptology CRYPTOGRAPHY CRYPTANALYSIS Types of Cryptosystems from Greek cryptos - hidden, secret logos - word graphos - writing Basic Vocabulary Cryptosystem (Cipher) (plaintext, clear ) encryption (encipherment) (cryptogram, encrypted ) decryption (decipherment) (plaintext, clear ) M C M Sender Receiver N bits M bits K bits cryptographic Definition of a cryptosystem (cipher) space M enciphering transformation E K (M) family of enciphering transformations space K family of deciphering transformations K deciphering transformation D K (C) space C Substitution Cipher Key = a b c d e f g h i j k l m n o p q r s t u v w x y z f q i s h n c v j t y a u w d r e x l b m z o g k p enciphering deciphering TO BE OR NOT TO BE BD QH DX WDB BD QH TO BE OR NOT TO BE Number of s = 26! K K M M D K (E K (M)) = M 1

2 Kerckhoff s principle The security of a cipher MUST NOT depend on anything that cannot be easily changed Auguste Kerckhoff, 1883, Dutch Linguist and Cryptographer Unpublished vs published algorithm? Unpublished algorithm Published algorithm 1 Cryptanalysis must include recovering the algorithm 2 Smaller number of users, smaller motivation to break 3 Unavailable for other countries 1 The only reliable way of assessing cipher security 2 Prevents backdoors hidden by designers 3 Large number of implementations = low cost + high performance 4 No need for anti-reverseengineering protection 5 Software implementations 6 Domestic and international standardization Fundamental Tenet of Cryptography If lots of smart people have failed to solve a problem, then it probably will not be solved anytime soon Security of unpublished ciphers Commercial packages cracking unpublished encryption schemes built-in: Time: MS Word, MS Excel, MS Money Word-Perfect, ProWrite, Data Perfect Lotus 1-2-3, Symphony, Quattro-Pro Paradox, Semantec s Q&A PKZip, etc 1-2 minutes for old versions of programs up to several days for new versions of some programs Price: ~ $99 per module (in the past), $595 per toolkit (49 modules) Companies: Access Data Passwords recovered even for empty files! Breaking ciphers used in GSM, 1999 (1) GSM - world's most widely used mobile telephone technology (extended into 3G UMTS and 4G LTE Advanced) about 80% market share of all cellular phones over 2 billion subscribers across more than 212 countries and territories Initially, two voice encryption algorithms: A5/1 and A5/2 encrypt voice between the cell phone and the base station Breaking ciphers used in GSM (2) Both voice encryption algorithms never published designed and analyzed by the secretive "SAGE" group (part of ETSI European Telecommunications Standard Institute) A5/1 believed to be based on the modified French naval cipher Both algorithms reverse-engineered by "Marc Briceno" with the Smartcard Developer Association published by the Berkeley group A5/1 in May 1999, A5/2 in August

3 Breaking ciphers used in GSM (3) Published attacks A5/2 August 1999, Ian Goldberg and David Wagner, UC Berkeley Number of operations in the attack ~ 2 16 A5/1 May 1999, Jovan Golic Number of operations in the attack ~ 2 40 December 1999, Alex Biryukov and Adi Shamir Less than 1 second on a single PC with 128 MB RAM and two 73 GB hard disks Based on the analysis of the A5/1 output during the first two minutes of the conversation Breaking ciphers used in GSM (4) Recent Attacks A5/2 German computer engineer Karsten Nohl published a 2 TB rainbow table which enables deriving a session for any particular conversation with minimal hardware support A5/3 Published in 2003, based on the Japanese cipher Kasumi Built into about 40% of available handsets, but so far rarely activated by mobile carriers A5/3 Breaking ciphers used in GSM (5) Recent Attacks Crypto conference, August 15-19, 2010 An attack against Kasumi announced by Israeli researchers Orr Dunkelman, Nathan Keller, Adi Shamir Complexity: 2 26 bytes of encrypted data, 2 30 bytes of memory, 2 32 operations: single PC, 96-bit in a few minutes 128-bit in less then two hours A5/3 Breaking ciphers used in GSM (6) Recent Attacks 2010 attack is a related- attack attacker must be able to observe the results of encryptions using s that have a known relationship It is not clear that the Kasumi algorithm (A5/3) is used by the protocol in a way that would allow this attack to succeed Interestingly, the Kasumi algorithm is closely based on a Mitsubishi algorithm known as MISTY1 MISTY1 is not vulnerable to the 2010 attack Attack on Mifare Classics Dec 2007-Apr 2008 Features required from today s ciphers Secret algorithm Crypto-1 developed by Philips used, among the others, in the public transport system cards in London (Oyster card), Boston (CharlieCard), Perth (SmartRider), Seoul (T-money), Busan (Mybi), and in Netherlands (OV-Chipkaart) easily broken after successful reverse engineering of the chip A total of about 1 billion cards all over the world STRENGTH PERFORMANCE FUNCTIONALITY easy distribution digital signatures 3

4 Block vs stream ciphers M 1, M 2,, M n m 1, m 2,, m n Types of Cryptosystems (1) Block vs stream ciphers K Block cipher K Internal state - IS Stream cipher C 1, C 2,, C n c 1, c 2,, c n C i =f K (M i ) c i = f K (m i, IS i ) IS i+1 =g K (m i, IS i ) Every block of is a function of only one corresponding block of plaintext Every block of is a function of the current block of plaintext and the current internal state of the cipher Typical stream cipher Sender initialization vector (seed) Receiver initialization vector (seed) Types of Cryptosystems (2) Pseudorandom Key Generator Pseudorandom Key Generator Secret- vs public- ciphers k i stream k i stream m i plaintext c i c i m i plaintext Secret- (Symmetric) Cryptosystems Key Distribution Problem of Alice and Bob - K AB of Alice and Bob - K AB Network Alice Encryption Decryption Bob N - Users N (N-1) 2 Keys Users Keys 100 5, ,000 4

5 Public Key (Asymmetric) Cryptosystems Classification of cryptosystems Terminology Public of Bob - K B Private of Bob - k B The image cannot be displayed Your computer may not have enough memory to open the image, or the image may have been corrupted Restart your computer, and then open the file again If the red x still appears, you may have to delete the image and then insert it again secret- symmetric public asymmetric symmetric- Alice Encryption Network Decryption Bob classical conventional One-way function X f(x) Y EXAMPLE: f -1 (Y) f: Y=f(X) = A X mod P where P and A are constants, P is a large prime, A is an integer smaller than P Number of bits of P Average number of multiplications necessary to compute f f Trap-door one-way function Whitfield Diffie and Martin Hellman New directions in cryptography, 1976 X f(x) Y f -1 (Y) PUBLIC KEY PRIVATE KEY Alice Key Distribution Bob Bob s public Bob s private Bob s public Evaluating the security of secret- ciphers Bob s public Intruder 5

6 Given: Looked for: plaintext or Example: Classification of attacks (1) Ciphertext-only attack Frequency analysis of letters in the (effective only for most simple historical ciphers) Classification of attacks (2) Known plaintext attack Given: guessed fragment of the plaintext Looked for: remaining plaintext Example: or exhaustive search (brute-force ) attack successive s cipher Classification of attacks (3) Classification of attacks (4) Given: Capability to encipher an arbitrarily chosen fragment of the plaintext Looked for: Example: Chosen plaintext attack Encryption module M i M i * i=1n Given: Capability to decipher an arbitrarily chosen fragment of the Looked for: Chosen attack Encryption module Differential cryptanalysis Encryption module C i C i * Software or hardware? Implementing Cryptography SOFTWARE low cost flexibility (new cryptoalgorithms, protection against new attacks) security of data during transmission HARDWARE speed random generation access control to s tamper resistance (viruses, internal attacks) 6

7 Basic hardware implementations of cryptography Why are cryptographic chips needed? VLSI chip (ASIC, FPGA) smart card cryptographic card stand-alone cryptographic device hardware accelerators for web servers SSL (Secure Socket Layer) cryptographic protocol used by majority of today s web servers to protect credit card numbers for on-line transactions such as buying a book on the amazoncom Why are cryptographic chips needed? Virtual Private Network hardware accelerators for Virtual Private Networks (VPNs) IPSec (Secure Internet Protocol) cryptographic protocol used to support VPNs (Virtual Private Networks), ie, secure communication between remote Local Area Networks (LANs) using Internet Host Security gateway Internet Remote user Security gateway Host IPSec optional in IP ver 4, required in emerging IP ver 6 Acceleration can be provided using: - secure gateways Host Cryptographic end points local networks may belong to the same or different organizations security gateways may come from different vendors Host Why are cryptographic chips needed? hardware accelerators for wireless gateways IEEE most popular wireless protocol including strong encryption and authentication Wireless gateway Why are cryptographic chips needed? secure storage secure XML supply chain communication secure phones secure PDAs secure satellite communications cipher breaking 7

8 Evolution of cryptography and cryptanalysis cryptography ECC DES RSA mathematics algebra statistics Pairing-based number theory engineering rotor machines enciphering devices integrated circuits software operating packages systems specialized instructions physics quantum cryptography cryptanalysis Progress in Implementations of Cryptography mathematics statistics number theory permutation theory algebra engineering cryptologic bombs mainframes supercomputers computer specialized networks hardware physics quantum computing First Rotor Machines Cryptographic chips and boards Enigma 8

9 British Cryptologic Bomb Used to Break Enigma Progress in Implementations of Cryptoanalysis Colossus: First Mainframe Supercomputer Cray Computer Museum, Mountain View, CA CAIRN 3 Specialized Machine to Break RSA COPACOBANA Ruhr University, Bochum, University of Kiel, Germany, Cost: 8980 Japan 120 Spartan 3 FPGAs Clock frequency 100 MHz Tetsuya Izu and Jun Kogure and Takeshi Shimoyama (Fujitsu) CHES 2007 September