Encryptiononly the basics

Reading Assignment

• Why crypto is hard http://www.counterpane.com/whycrypto.html

Topics

• What is Cryptology?• Conventional Encryption (secret key)

– Terminology and Properties• Public Key Encryption

– Terminology– Usage– Properties

• Cryptanalysis

Cryptology Definition

• Cryptography is the making of ciphers and codes.

• Cryptanalysis is the analysis and breaking of those ciphers.

• Cryptology is the study of both. (AMTH 387)

CryptographyCryptography

• Classified along three independent dimensions:– The type of operations used for transforming

plaintext to ciphertext (substitution, transposition)

– The number of keys used• symmetric (single key)• asymmetric (two-keys, or public-key encryption)

– The way in which the plaintext is processed (block, stream)

Substitution and Transposition

• Substitution example– A B C D E F G …– C D E F G H I …

• Transposition example– HERE_IS_A_MESSAGE

H E S _ S GE _ _ M S ER I A E A _

Secret Key Cryptography

• An encryption scheme has five ingredients:– Plaintext– Encryption algorithm– Secret Key– Ciphertext– Decryption algorithm

• Security depends on the secrecy of the key, not the secrecy of the algorithm

Use of Conventional Encryption

Average time required Average time required for exhaustivefor exhaustive key key

search search Key Size (bits)

Number of Alternative Keys

Time required at 106 Decryption/µs

32 232 = 4.3 x 109 2.15 milliseconds

56 256 = 7.2 x 1016 10 hours

128 2128 = 3.4 x 1038 5.4 x 1018 years

168 2168 = 3.7 x 1050 5.9 x 1030 years

Feistel Cipher StructureFeistel Cipher Structure

• Many conventional block encryption algorithms, including DES have a structure first described by Horst Feistel of IBM in 1973

• The realization of a Fesitel Network depends on the choice of the following parameters and design features (see next slide):

Feistel Cipher StructureFeistel Cipher Structure• Block size: larger block sizes mean greater

security• Key Size: larger key size means greater security• Number of rounds: multiple rounds offer

increasing security• Subkey generation algorithm: greater

complexity will lead to greater difficulty of cryptanalysis.

• Fast software encryption/decryption: the speed of execution of the algorithm becomes a concern

Exclusive OR• Message 0101 1100, key 1001• Encryption process

– Plaintext 0101 1100– Key 1001 1001– Cyphertext 1100 0101

• Decryption process– Cyphertext 1100 0101– Key 1001 1001– Plaintext

Conventional Encryption Conventional Encryption AlgorithmsAlgorithms

• Data Encryption Standard (DES)– The most widely used encryption scheme– The algorithm is referred to as the Data

Encryption Algorithm (DEA)– DES is a block cipher– The plaintext is processed in 64-bit blocks– The key is 56-bits in length

Time to break a code (10Time to break a code (1066 decryptions/µs)decryptions/µs)

Triple DEATriple DEA

• Use three keys and three executions of the DES algorithm (encrypt-decrypt-encrypt)

• C = ciphertext• P = Plaintext• EK[X] = encryption of X using key K• DK[Y] = decryption of Y using key K

• Effective key length of 168 bits

C = EK3[DK2[EK1[P]]]

Other Symmetric Block Other Symmetric Block CiphersCiphers

• International Data Encryption Algorithm (IDEA)– 128-bit key– Used in PGP

• Blowfish– Easy to implement– High execution speed – Run in less than 5K of memory

Other Symmetric Block Other Symmetric Block CiphersCiphers

• RC5– Suitable for hardware and software– Fast, simple– Adaptable to processors of different word lengths– Variable number of rounds– Variable-length key– Low memory requirement– High security– Data-dependent rotations

• Cast-128– Key size from 40 to 128 bits– The round function differs from round to round

Analysis of DES

• Advantages– Attacks well known– 3DES has effective key length of 168

• Disadvantages– No efficient software implementation– Must use 64 bit block

AES• AES (Advanced Encryption Standard) was

adopted by NIST in November 2001. Also called the Rijndael algorithm.

• Supports key size of 128, 192, and 256 bits. • Symmetric block cipher with block length

of 128 bits.• Efficient hardware and software

implementations.• Not a Feistal block cipher.

Location of Encryption DeviceLocation of Encryption Device• Link encryption:

– A lot of encryption devices– High level of security– Decrypt each packet at every switch

• End-to-end encryption– The source encrypt and the receiver decrypts– Payload encrypted– Header in the clear

• High Security: Both link and end-to-end encryption are needed

Key DistributionKey Distribution

1. A key could be selected by A and physically delivered to B.

2. A third party could select the key and physically deliver it to A and B.

3. If A and B have previously used a key, one party could transmit the new key to the other, encrypted using the old key.

4. If A and B each have an encrypted connection to a third party C, C could deliver a key on the encrypted links to A and B.

Key DistributionKey Distribution

• Session key:– Data encrypted with a one-time session key.

At the conclusion of the session the key is destroyed

• Permanent key:– Used between entities for the purpose of

distributing session keys

Public-Key Cryptography Principles

• The use of two keys has consequences in: key distribution, confidentiality and authentication.

• The scheme has six ingredients – Plaintext– Encryption algorithm– Two keys: Public and private key– Ciphertext– Decryption algorithm (inverse of encryption)

• Property: If you encrypt with one key, you need the other key to decrypt.

Encryption for Confidentiality using Public-Key system

Authentication using Public-Key System

Applications for Public-Key Cryptosystems

• Three categories:– Encryption/decryption for confidentiality:

The sender encrypts a message with the recipient’s public key.

– Digital signature (authentication): The sender ”signs” a message with his private key.

– Key exchange: Two sides cooperate two exhange a session key.

Requirements for Public-Key Cryptography

1. Computationally easy for a party B to generate a pair (public key KUb, private key KRb)

2. Easy for sender to generate ciphertext:

3. Easy for the receiver to decrypt ciphertext using private key:

)(MEC KUb

)]([)( MEDCDM KUbKRbKRb

Requirements for Public-Key Cryptography

4. Computationally infeasible to determine private key (KRb) knowing public key (KUb)

5. Computationally infeasible to recover message M, knowing KUb and ciphertext C

6. Either of the two keys can be used for encryption, with the other used for decryption:

)]([)]([ MEDMEDM KRbKUbKUbKRb

Public-Key Cryptographic Algorithms

• RSA and Diffie-Hellman • RSA - Ron Rives, Adi Shamir and Len Adleman

at MIT, in 1977.– RSA is a block cipher– The most widely implemented

• Diffie-Hellman – Exchange a secret key securely– Compute discrete logarithms

Diffie-Hellman Key Exchange

Other Public-Key Cryptographic Algorithms

• Digital Signature Standard (DSS)– Makes use of the SHA-1– Not for encryption or key exchange

• Elliptic-Curve Cryptography (ECC)– Good for smaller bit size– Low confidence level, compared with RSA– Very complex

Cryptographic Hash Functions

• Example: http://nsfsecurity.pr.erau.edu/crypto/generichash.html

Cryptanalysis

• If only the ciphertext is available– Pattern and frequency analysis for simple ciphers– Brute force – try all possible keys

• If <plaintext, ciphertext> is available– Previously classified info is unclassified– Encrypted info includes known patterns (packet

headers)

For Further Reading

• “Cryptography and Network Security, Principles and Practice” third edition, William Stallings, Prentice Hall

• For more detailed coverage, take the Applied Math course: AMTH 387