cryptography basics
DESCRIPTION
Cryptography Basics. Objectives. Explain general cryptography concepts Explain basic hashing concepts. Basic encryption concepts. Explain and implement protocols Explain core concepts of public key cryptography. Cryptography. Cryptography – science of encrypting information. - PowerPoint PPT PresentationTRANSCRIPT
![Page 1: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/1.jpg)
Cryptography Basics
![Page 2: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/2.jpg)
Objectives
Explain general cryptography concepts Explain basic hashing concepts. Basic encryption concepts. Explain and implement protocols Explain core concepts of public key cryptography
![Page 3: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/3.jpg)
Cryptography
Cryptography – science of encrypting information. “scrambles” data so only authorized parties can
“unscramble” and read data using two methodsCan substitute – change one letter with a different letterCan transpose – scramble the order of letters, without actually
changing one for another. The best cryptosystems both substitute and transpose.
![Page 4: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/4.jpg)
Basic Idea
![Page 5: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/5.jpg)
Cryptographic Terminology
Cryptography - a method of storing and transmitting data in a form only intended for authorized parties to read or process.
Cryptanalysis - science of studying, breaking, and reverse engineering algorithms and keys.
Encryption – the method of transforming data (plaintext) into an unreadable format.
Plain text – the format (usually readable) of data before being encrypted
Cipher text – the “Scrambled” format of data after being encrypted
![Page 6: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/6.jpg)
Cryptographic Terminology
Decryption – the method of turning cipher text back into plain text
Encryption algorithm – a set or rules or procedures that dictates how to encrypt and decrypt data. Also called an encryption “cipher”
Key – (crypto variable) a values used in the encryption process to encrypt and decrypt
![Page 7: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/7.jpg)
Cryptographic Terminology
Key space – the range of possible values used to construct keys example:
if a key can be 4 digits (0-9) key space = 10,000 (0000 – 9999)if it can be 6 digitskey space = 1,000,000 (000,000 – 999,999)
Key Clustering – Instance when two different keys generate the same cipher text from the same plaintext
Work factor – estimated time and resources to break a cryptosystem
![Page 8: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/8.jpg)
Cryptography History
Romans used a shift cipher called a “CEASAR” cipher. Shift Ciphers simply shift characters in an alphabet.
![Page 9: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/9.jpg)
ROT13 / shift cipher - http://www.rot13.com
![Page 10: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/10.jpg)
Transposition Cipher
Jumbles up the ordering of characters in a message. The Spartans of Greece used a form of this called the “Scytale” Cipher.
![Page 11: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/11.jpg)
Transposition Cipher
![Page 12: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/12.jpg)
Scytale
![Page 13: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/13.jpg)
Steganography
Hiding one message in another “Meet the mini me that ate later.” “Meet me later.”
![Page 14: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/14.jpg)
Vigenere Cipher
The Vigenère cipher is named for Blaise de Vigenère, although Giovan Battista Bellaso had invented the cipher earlier. Vigenère did invent a stronger autokey cipher.
Vigenère cipher is a method of encrypting alphabetic text by using a series of different Caesar ciphers based on the letters of a keyword. It is a simple form of polyalphabetic substitution.
This cipher is well known because while it is easy to understand and implement, it often appears to beginners to be unbreakable.
![Page 15: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/15.jpg)
Vigenere Table (tabula recta)
![Page 16: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/16.jpg)
Vigenere Cipher
For example, suppose that the plaintext to be encrypted is: ATTACKATDAWN
The person sending the message chooses a keyword and repeats it until it matches the length of the plaintext, for example, the keyword "LEMON": LEMONLEMONLE
The first letter of the plaintext, A, is enciphered using the alphabet in row L, which is the first letter of the key. This is done by looking at the letter in row L and column A of the Vigenère square, namely L. The rest of the plaintext is enciphered in a similar fashion.
Plaintext: ATTACKATDAWN Key: LEMONLEMONLE Ciphertext: LXFOPVEFRNHR
![Page 17: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/17.jpg)
Encryption Modes – Block
Take the message and break it up into fixed sized blocks, encrypt each block using the given key.
![Page 18: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/18.jpg)
Block (ECB encryption)
![Page 19: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/19.jpg)
Block Encryption Problems
![Page 20: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/20.jpg)
Solving Block Encryption Problems
Often with block encryption, we include a value in addition to the key that changes for each block, so we don’t get repetitive cipher text blocks. This is called Cipher Block Chaining (see next slide)
Initialization Vectors are used with the first block in CBC
![Page 21: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/21.jpg)
Cipher Block Chaining
![Page 22: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/22.jpg)
XORing
XORing is a Boolean mathematical “function” which creates an output bit based on two input bits. It outputs a 1 IF and ONLY if one bit of input is 1 and the other is a 0.
INPUT1 INPUT 2 XOR OUTPUT---------------------------------------------------------------------------
0 0 = 00 1 = 11 0 = 11 1 = 0
![Page 23: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/23.jpg)
Stream Encryption
The “key” is used as a key stream generator, which creates a series of bits each are is mathematically combined with the bit stream of plaintext to produce cipher text. This is done for small pieces of information, or information not in blocks.
Keyboard input Morse code Any input that arrives one bit or byte at a time
![Page 24: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/24.jpg)
Stream Encryption
Plain Text Bit Keystream Bit Output Bit0 11 11 00 11 XOR 1 = 0
Cipher text = 0
![Page 25: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/25.jpg)
Stream Encryption
Plain Text Bit Keystream Bit Output Bit
0 11 11 00 XOR 1 = 1
Cipher text = 0 1
![Page 26: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/26.jpg)
Stream Encryption
Plain Text Bit Keystream Bit Output Bit
0 11 11 XOR 0 = 1
Cipher text = 0 1 1
![Page 27: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/27.jpg)
Stream Encryption
Plain Text Bit Keystream Bit Output Bit
0 11 XOR 1 = 0
Cipher text = 0 1 1 0
![Page 28: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/28.jpg)
Stream Encryption
Plain Text Bit Keystream Bit Output Bit
0 XOR 1 = 1
Cipher text = 0 1 1 0 1
![Page 29: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/29.jpg)
One Time Pad
1011 – plain text 0101 – pad ------ XOR 1110 – cipher text In a one time pad you use a different key/pad each time
you send a message
![Page 30: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/30.jpg)
One Time Pad
A “perfect cryptosystem” Unbreakable if implemented properly The key is a series of bits (0 and 1) The plain text is converted to bits The message is XORed with the pad/key to generated the
cipher text (more)
![Page 31: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/31.jpg)
One Time Pad considerations
The pad must be used only one time The pad must be shared by both sides. The pad must be as long as the message The pad must be securely distributed The pad must be used up of truly random values
![Page 32: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/32.jpg)
Symmetric Encryption
Idea same key is used to BOTH encrypt and decrypt data!
![Page 33: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/33.jpg)
Symmetric Encryption
Called Symmetric or “Private Key encryption” Must securely distribute keys to both parties.
Chicken in the egg situation with networks Anyone with the key can either encrypt or decrypt Very Fast to encrypt or decrypt Key Management is the big issue
![Page 34: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/34.jpg)
Key Management
n: number of parties who want to securely communicate
# keys = (n*(n-1)) / 2 5 = (5*4)/2 = 10 keys 10 = (10*9)/2 = 45 keys 100 = (100*99)/2 = 4950 keys 1000 = (1000*999)/2 = 499500
keys
![Page 35: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/35.jpg)
Symmetric Algorithms – DES
Data Encryption Standard Developed from at NIST request for an encryption standard Chosen algorithm was called “Lucifer” from IBM Block Cipher Fixed sized blocks of 64 bits Key size 64 bits, effective size is 56 bits 16 rounds of substitution and transposition DES is no longer considered strong enough, can be broken
easily with distributed computing.
![Page 36: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/36.jpg)
Triple DES
Nothing but DES 3 times 3DES – EEE3 3DES – EDE3 3DES – EEE2 3DES – EDE2
Since it’s 3 x DES, 48 rounds of substitution and transposition.
![Page 37: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/37.jpg)
AES
Developed as a replacement to DES Actual algorithm is called “Rinjdael” Block cipher 128 bit blocks Key sizes of 128,192, 256 Rounds depend on key size
9: for 128 keys 11: for 192 keys 13: for 256 bit keys
![Page 38: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/38.jpg)
RC5
Block cipher Block size 32, 64, 128 Key Size up to 2048 bits Rounds up to 255, minimum of 12 recommended
![Page 39: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/39.jpg)
RC6
Block cipher based on RC5 Same attributes as RC5 Developed to be a AES candidate Faster that RC5
![Page 40: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/40.jpg)
RC4
Stream cipher – what was that again? Was proprietary, but released on Internet in 1994, “ARC4”
is the “open version of RC4” Key length 8 – 2048 bits Used in SSL and WEP communication
![Page 41: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/41.jpg)
Blowfish
Block cipher 64 bit blocks Keys 32 - 448 bits 16 rounds is the “full version” Free algorithm
![Page 42: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/42.jpg)
IDEA
International Data Encryption Algorithm Proposed AES candidate Block cipher 64 bit blocks 128 bit keys Not free, Patent expires soon though Used in PGP
![Page 43: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/43.jpg)
Symmetric
That’s Symmetric Encryption Understand the concept (shared keys) Understand it’s strengths (fast for bulk encryption and
decryption) Understand it’s weaknesses (key management, non-
repudiation) Understand the different algorithm “properties” on the
slides.
![Page 44: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/44.jpg)
Enter Non-Repudiation
Non-Repudiation – being able to definitively prove someone said or wrote something.
Proves they actually sent a message Proves the message was not altered
How do we provide non-repudiation? We’ll see soon after we talk about hashes, and asymmetric encryption.
![Page 45: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/45.jpg)
Asymmetric Encryption
Use 2 keys, public key to encrypt a message, private key can decrypt
![Page 46: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/46.jpg)
Asymmetric Encryption
Called Public key encryption Requires 2 related keys Public key – given to anyone Private key – kept secret Public key is used to encrypt message Private key is used to decrypt message Private key is used to sign messages Public key is used to validate signed messages
![Page 47: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/47.jpg)
Asymmetric Encryption
Key exchange is simple! Asymmetric Encryption is SLOW, not suitable for
encrypting large amounts of data What is a problem with Asymmetric Encryption and key
exchange? (MiM) Can be used to “digitally sign” a message (in a few slides) Provides integrity Provides non-repudiation Can anyone see a use to Asymmetric encryption already?*
(very important)
![Page 48: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/48.jpg)
Diffie-Hellman
The original Asymmetric algorithm Used with SSL, VPNs, ssh Used ONLY for key exchange Generates session keys for secure SYMETRIC encryption
communications
![Page 49: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/49.jpg)
Asymmetric Algorithms – RSA
Can be 100 times slower than DES Can be used for encryption, key exchange and digital
signatures Security based on difficulty of factoring large numbers. Was patented, has expired
![Page 50: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/50.jpg)
El-Gamal
Encryption or digital signatures Free Can be used for encryption, key exchange and digital
signatures Slow Based on / extended Diffie-Hellman
![Page 51: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/51.jpg)
ECC - Elliptic Curve Cryptography
Encryption, key exchange or digital signatures Security based on analyzing elliptic curves in finite fields Does not require much computing overhead as such used
in devices with low resources (PDAs, Cell phones etc)*
![Page 52: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/52.jpg)
Asymmetric Overview
Uses 2 keys, one for encryption, one for decryption This mitigates the key management, key distribution
problem (kind of…) Is VERY slow (orders of magnitude slower) Can provide integrity and proof of sender (non-repudiation) Often used in a hybrid system (along with private key
encryption) Encrypt symmetric keys using asymmetric algorithms Actually do large scale encryption with these asymmetric
keys!
![Page 53: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/53.jpg)
Hashing - Băm
Hashing is similar to encryption… but different. Hashing is a one way operation. Take input message Put through hashing function Retrieve fixed length value (hash digest)
![Page 54: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/54.jpg)
Hashing
Try for yourself at http://www.fileformat.info/tool/hash.htm
![Page 55: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/55.jpg)
Hashes
Once hashed, no way to get back the original message
Hash digests are fixed, so multiple messages theoretically could produce the same hash digest (collision)
![Page 56: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/56.jpg)
Hashes
Hashing can provide integrity (assuming no MiM (next slide))
Hashes can be combined with a private key to provide protection against MiM attacks (visualization in a few slides next slide)
The more bits in the digest, generally the more secure (less change for collision…generally)
One Example of a hash that you are probably familiar with is called a “CRC”
![Page 57: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/57.jpg)
Normal use of Hash
![Page 58: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/58.jpg)
Hash MiM attack (phase 1)
![Page 59: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/59.jpg)
Hash MiM attack (phase 2)
![Page 60: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/60.jpg)
HMAC
Hash-based Message Authentication Code
![Page 61: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/61.jpg)
HMAC
function hmac (key, message) if (length(key) > blocksize) then key = hash(key) // keys longer than blocksize are shortened end if if (length(key) < blocksize) then key = key zeroes(blocksize - length(key)) // keys ∥shorter than blocksize are zero-padded end if o_key_pad = [0x5c * blocksize] key // Where blocksize ⊕is that of the underlying hash function i_key_pad = [0x36 * blocksize] key // Where is exclusive ⊕ ⊕or (XOR) return hash(o_key_pad hash(i_key_pad message)) // ∥ ∥Where is concatenation∥end function
![Page 62: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/62.jpg)
Hash algorithms – SHA
Secure Hash Algorithm Designed/Published by NIST and NSA Designed for use in the DSS Modeled after MD4 SHA-1 (SHA-160) – 160 bit digest
512 bit blocks SHA-256 – 256 bit digest
512 bit blocks SHA-384 – 384 bit digest
1024 bit blocks SHA-512 – 512 bit digest
1024 bit blocks
![Page 63: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/63.jpg)
MD2
Developed by Ronald Rivest (of RC and RSA fame) Optimized to run on 8 bit computers 128 bit digest 128 bit blocks
![Page 64: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/64.jpg)
MD4
Optimized for 32 bit computers 128 bit digest Collisions can be found in under 1 minute on a PC ;(
![Page 65: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/65.jpg)
MD5
Similar to MD4, but more secure Slower and more secure 128 bit digest 512 bit blocks Was part of the NTLM authentication protocol Collisions in 8 hours on a PC Moving away from, to SHA
![Page 66: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/66.jpg)
Hash overview
Know what a hash is Concept Fixed length digest What is a hash used for Know what a collision is Know it’s susceptible to MiM Know what HMAC is, and what it tries to accomplish
Be familiar with MDx, and SHA-x Understand that SHA is considered the best algorithm
![Page 67: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/67.jpg)
Digital Signatures
![Page 68: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/68.jpg)
Digital Signing
![Page 69: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/69.jpg)
Digital Signing
Generally when I digital sign something.. I don’t encrypt the whole message. Instead Run message through hash algorithm, generated message
digest Sign the “message digest” Send both the original message and the encrypted message
digest
![Page 70: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/70.jpg)
Digital Signing
Provides Integrity Non repudiation NOT confidentiality
![Page 71: Cryptography Basics](https://reader035.vdocuments.net/reader035/viewer/2022062315/568164c2550346895dd6d500/html5/thumbnails/71.jpg)
Digital Signing