L2. An Introduction to Classical Cryptosystems. Rocky K. C. Chang, 23 January 2015

Transcription

1 L2. An Introduction to Classical Cryptosystems Rocky K. C. Chang, 23 January 2015

2 This and the next set of slides 2

3 Outline Components of a cryptosystem Some modular arithmetic Some classical ciphers Shift Cipher Substitution Cipher Affine Cipher Vigenère Cipher Permutation Cipher Stream Ciphers Attack models and cryptanalysis 3

4 4 Elements of a secret-key cryptosystem

5 The Cryptosystem Eve m c m Alice Encryptor decryptor Bob K Secure channel Key source 5

6 A cryptosystem consists of M: a finite set of possible plaintexts C: a finite set of possible ciphertexts K: the key space, a finite set of possible keys E: A set of encryption rules D: A set of decryption rules For each K K, there is an E K () E and a D K () D, such that D K (E K (m)) = m for every m M. 6

7 Requirements for a practical cryptosystem Note that E K () must be a 1-to-1 function. If M = C, then E K () is a permutation. Practically, E K () and D K () should be efficiently computable. An attacker, upon seeing a ciphertext, should be unable to determine the key or the plaintext. The attack models Cryptanalysis: attempt to compute K given some ciphertexts. 7

8 8 Several classical ciphers

9 First, recall some modular arithmetic Suppose a and b are integers, and n is a positive integer (modulus). a mod n = the remainder of a/n {0, 1,, n 1}. Congruence a b (mod n) iff a mod n = b mod n, i.e., same remainders. a is congruent to b modulo n. E.g., 101 mod 7 = = mod 7 = 7(-15) + 4 = 4 9

10 The Shift Cipher Let M = C = K = {0, 1, 2,, 25} For 0 K 25, define E K (m) = (m + K) mod 26 D K (c) = (c K) mod 26 For example, K = 11 m: c: For K = 3, the Shift Cipher is often called the Caesar Cipher. Show that D K (E K (m)) = m for every mm. 10

11 The Substitution Cipher Let M = C = {0, 1, 2,, 25} K = {All possible permutations of the 26 numbers} For each permutation K K, define E K (m) = K(m) = c D K (c) = K -1 (c), the inverse permutation For example, one possible K is a b c d e f g h i j k l m n o p q r s X N Y A H P O G Z Q W B T S F L R C V E K (a) = X and D K (X) = a Is this cipher more secure? 11

12 Affine Cipher Let M = C = {0, 1, 2,, 25} K = (a, b), where a, b {0, 1, 2,, 25}. Encryption and decryption functions; E K (m) = (am + b) mod 26 D K (c) = a -1 (c - b) mod 26 E K (m) is not an one-to-one function for all a. When a = 1, Affine Cipher is the same as a Shift Cipher. Affine Cipher is still a special case of the Substitution Cipher. 12

13 The Vigenère (vee zhun AIR) Cipher Monoalphabetic (e.g., Shift and Substitution) vs polyalphabetic (e.g., Vigenère) M = C = K = (Z 26 ) n, where n is a positive integer. For a key K (keyword) = (k 1, k 2,, k n ), define E K (m 1, m 2,, m n ) = (m 1 +k 1, m 2 +k 2,, m n +k n ) D K (c 1, c 2,, c n ) = (c 1 k 1, c 2 k 2,, c n k n ), where the additions and subtractions are done in mod 26. For example, n= 6 and K = (2, 8, 15, 7, 4, 17), m: K: c:

14 The Permutation (or Transposition) Cipher All the ciphers so far involve substitution: a plaintext symbol replaced by a different symbol. A permutation cipher keeps the plaintext symbols unchanged but to alter their positions. M = C = (Z 26 ) n K = {All permutations of 1, 2,, n}. For a key K (a given permutation), define E K (m 1, m 2,, m n ) = (m K(1), m K(2),, m K(n) ) D K (c 1, c 2,, c n ) = (c K -1 (1), c K -1 (2),, c K -1 (n) ). 14

15 The Permutation Cipher (cont d) For example, n = 6 i: K(i): m : s h e s e l l s s e a s c : e e s l s h s a l s e s 15

16 The Stream Cipher The cryptosystems considered so far are known as block ciphers. The plaintexts are encrypted using the same key. An alternative is to generate a key stream y 1 y 2 y 3,. c = E y1 (m 1 )E y2 (m 2 )E y3 (m 3 ). M, C, and K are the same as before. g, the keystream generator, takes a key K to generate y 1 y 2 y 3,, where y i L. For each y in the keystream, there is an encryption rule E y () and a corresponding decryption rule D y (), such that D y (E y (m)) = m for every m M. 16

17 The Vigenère Cipher and the Stream Cipher Define Vigenère Cipher as a Stream Cipher: M = C = L = Z 26 (note the difference here) K = (Z 26 ) n For each y L, E y (m) = (m + y) mod 26 D y (m) = (c y) mod 26 The keystream: y i = k i if 1 i n; y i = k i-n, else. 17

18 Block cipher vs stream cipher Stream ciphers are typically faster than block. Block ciphers typically require more memory as their operations are based on blocks. Stream ciphers are more difficult to implement correctly. Block ciphers are more susceptible to noise in transmission. Stream ciphers do not provide integrity protection or authentication, whereas some block ciphers could provide them. 18

19 Attack models What kind of information available to the attacker? Kerckhoff s principle: a cryptosystem should be secure even if everything about the system, except the key, is public knowledge. The attack s objective is to determine the key in use. Different attack models: Ciphertext-only attack: Eve possesses ciphertexts. Known-plaintext attack: Eve possesses plaintexts and the corresponding ciphertexts. Chosen-plaintext attack: Eve can temporarily choose a plaintext and construct the corresponding ciphertext. Chosen-ciphertext attack: Eve can temporarily choose a ciphertext and construct the corresponding plaintext. 19

20 Cryptanalysis The Shift, Substitution, and Vigenère Ciphers are vulnerable to ciphertext-only attacks. The Permutation and Stream Ciphers are vulnerable to known-plaintext attacks. Most of the cryptanalysis are based on statistical properties of the English language. E has the highest occurrence rate (0.12) T, A, O, I, N, S, H, R ( ) V, K, J, X, Q, Z (< 0.01) Popular digrams: TH, HE, IN, ER, Popular trigrams: THE, ING, AND, HER, 20

21 Cryptanalysis of the Vigenère Cipher The first step is to determine n, the keyword length using Kasiski test. The method is based on 2 identical segments of plaintext will be encrypted to the same ciphertext if they are d positions apart, where d 0 (mod n). If 2 identical segments of ciphertext found and each length 3, it is likely that they correspond to identical segments of plaintext. The test: Search the ciphertext for pairs of identical segments of length 3. If exists, record the distance between them, say d 1, d 2,. n must divide the greatest common divisor of d 1, d 2,. 21

22 Conclusions Classical ciphers can be classified as Substitution vs permutation Monoalphabetic vs polyalphabetic Stream ciphers (e.g., JK Flip-Flop, A5, SEAL, RC4) vs block ciphers (e.g., DES, IDEA, AES, RC2) Various stream ciphers: Ciphers security The size of the key space Vulnerability under cryptanalysis 22

23 Acknowledgments This set of slides is prepared mainly based on D. Stinson, Cryptography: Theory and Practice, Chapman & Hall/CRC, Second Edition, Some of the book s materials can be found at chapter2.html The slide on block cipher vs stream cipher is based on Cryptool portal: 23