David Basin Institut f¨urInformatik Albert-Ludwigs-Universit¨at Freiburg
IT-Security: Theory and Practice (WS02) David Basin 1 Motivation then and now
Three can keep a secret, if two of them are dead. — Benjamin Franklin
We interact and transact by directing flocks of digital packets towards each other through cyberspace, carrying love notes, digital cash, and secret corporate documents. Our personal and economic lives rely on our ability to let such ethereal carrier pigeons mediate at a distance what we used to do with face-to-face meetings, paper documents, and a firm handshake. How do we converse privately when every syllable is bounced off a satellite and smeared over an entire continent? How should a bank know that it really is Bill Gates requesting from his laptop in Fiji a transfer of $10,000,000,000 to another bank? Fortunately, the mathematics of cryptography can help. — Ron Rivest
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 2 Road map
• Basic concepts
• A mathematical formalization
• Symmetric-key encryption
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 3 Network security model
Trusted Third Party Principal Principal
Message Information Message Channel Secret Secret Information Information
Opponent
Since information channel is untrusted, measures must be taken to ensure confidentiality (integrity, ...) of transactions.
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 4 Security measures and mechanisms
• Prevention: measures that hinder asset damage. Real-world: build a castle with a moat and crocodiles. E-Commerce: encrypt your credit card number.
• Detection: measures to detect when an asset has been damaged, how it has been damaged, and who caused the damage. Real-world: install a closed-circuit television. E-Commerce: monthly statement of credit card transactions.
• Reaction: take measures to recover your assets or rectify damages. Real-world: call the police and pray. E-Commerce: block old card and request a new one.
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 5 Information hiding
STEGANOGRAPHY SECRET (hidden) CODE WRITING SUBSTITUTION (replace words) CRYPTOGRAPHY CIPHER (scrambled) (replace letters) TRANSPOSITION
• Cryptology: the study of secret writing.
• Steganography: the science of hiding messages in other messages.
• Cryptography: the science of secret writing. N.B. Terms like encrypt, encode, and encipher are often (loosely and wrongly) used interchangeably
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 6 Cryptographic algorithms
• General Schema: Ekey1(P) = C , Dkey2(C ) = P Key1 Key2 Ciphertext Plaintext Plain Text Encryption Decryption P C P
• Security depends on secrecy of the key, not the algorithm
• Symmetric algorithms – Key1 = Key2, or are easily derived from each other.
• Asymmetric or public key algorithms – Different keys, which cannot be derived from each other. – Public key can be published without compromising private key.
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 7 Other cryptographic primitives
• A function f : X → Y is a one-way function, if f is “easy” to compute for all x ∈ X , but f −1 is “hard” to compute “Easy” and “hard” with respect to complexity theory
• A hash function is a one-way function that maps messages of arbitrary length to a fixed size value (e.g., 128 bits)
• We will see other cryptographic primitives later Trapdoor functions, pseudo-random generators, . . .
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 8 Goals for cryptographic algorithms
Key1 Key2 Ciphertext Plaintext Plain Text Encryption Decryption P C P
• Encryption and decryption are easy if keys are known.
• Keep plaintext (or keys) secret from attacker. I.e., it is hard to: – get P from C without Key2. – get the keys even if given one or more pairs of C and corresponding P,
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 9 Cryptanalysis
• Cryptanalysis: science of recovering the plaintext from ciphertext without the key.
• Always assume attackers know the algorithms used! – Worst-case analysis and realistic in open systems – Algorithms should be published to facilitate the evaluation of their security.
• Contrast with security by obscurity. Analogy: hide a letter under your mattress versus lock it in a safe, whose design has been published and whose locking mechanism has withstood attacks from the world’s best safecrackers.
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 10 Kinds of attacks
Ciphertext only Given: C1 = EK (M1),..., Cn = EK (Mn)
Deduce: M1,..., Mn or algorithm to compute Mn+1 from Cn+1 = EK (Mn+1)
Known plaintext Given: M1, C1 = EK (M1),..., Mn, Cn = EK (Mn)
Deduce: Inverse key or algorithm to compute Mn+1 from Cn+1 = EK (Mn+1)
Chosen plaintext Same as above but cryptanalyst may choose M1,..., Mn.
Adaptive chosen plaintext Cryptanalyst can not only choose plaintext, but he can modify the plaintext based on encryption results.
Chosen ciphertext Cryptanalyst can chose different ciphertexts to be decrypted and gets access to the decrypted plaintext.
Rubber-hose Cryptanalyst bribes or tortures someone until he gets the key!
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 11 Road map
• Basic concepts
• A mathematical formalization
• Symmetric key encryption
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 12 Encryption/decryption
• A, the alphabet, is a finite set.
• M, the message space, is A∗, the finite strings over A. M ∈ M is a plaintext (message).
• C is the ciphertext space, whose alphabet may differ from M.
• K denotes the key space of keys.
• Each e ∈ K determines a bijective function from M to C, denoted by Ee. Ee is the encryption function (or transformation).
• For each d ∈ K, Dd denotes a bijection from C to M. Dd is the decryption function.
• Applying Ee (or Dd ) is called encryption (or decryption).
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 13 Encryption/decryption (cont.)
• An encryption scheme (or cipher) consists of a set {Ee : e ∈ K} and a corresponding set {De : e ∈ K} with the property that for −1 each e ∈ K there is a unique d ∈ K such that Dd = Ee ; i.e.,
Dd (Ee(m)) = m for all m ∈ M .
• The keys e and d above form a key pair, sometimes denoted by (e, d). They can be identical.
• To construct an encryption scheme requires fixing a message space M, a ciphertext space C and a key space K, as well as encryption transformations {Ee : e ∈ K} and corresponding decryption transformations {Dd : d ∈ K}.
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 14 Question — why bother with keys?
• Formalization based on two parties exchanging a key pair (e, d) to achieve confidentiality.
• Why not just exchange encryption/decryption functions?
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 14 Question — why bother with keys?
• Formalization based on two parties exchanging a key pair (e, d) to achieve confidentiality.
• Why not just exchange encryption/decryption functions?
• Answer: By exchanging key pairs, if some encryption/decryption transformation is revealed, one doesn’t have to redesign entire scheme. Just exchange new keys!
• Analogy with combination lock: If your combination is compromised, just change it, not the physical lock. However, if the lock design is compromised . . .
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 15 An example
Let M = {m1, m2, m3} and C = {c1, c2, c3}. There are 3! = 6 bijections from M to C. The key space K = {1, 2, 3, 4, 5, 6} specifies these transformations.
E1 E2 E3 m1 c1 m1 c1 m1 c1 m2 c2 m2 c2 m2 c2 m3 c3 m3 c3 m3 c3
E4 E5 E6 m1 c1 m1 c1 m1 c1 m2 c2 m2 c2 m2 c2 m3 c3 m3 c3 m3 c3
Suppose Alice and Bob agree on the transformation E1. To encrypt m1, Alice computes E1(m1) = c3. Bob decrypts c3 by reversing the arrows on the diagram for E1 and observing that c3 points to m1.
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 16 Road map
• Basic concepts
• A mathematical formalization
• Symmetric-key encryption Codes, substitution ciphers, transposition ciphers, one-time pads.
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 17 Symmetric key encryption
• Consider an encryption scheme {Ee : e ∈ K} and {Dd : d ∈ K}. The scheme is symmetric-key if for each associated pair (e, d) it is computationally “easy” to determine d knowing only e and to determine e from d. In practice e = d. • Other terms: single-key, one-key, private-key, and conventional encryption. • A block cipher is an encryption scheme that breaks up the plaintext message into strings (blocks) of a fixed length t and encrypts one block at a time. • A stream cipher is one where the block-length is 1. • In contrast, codes work on words of varying length.
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 18 Codes
• Code: a string of symbols stands for a complete message.
• Translation given by a ‘code-book’.
Word Code ...... The 1701 secret 5603 mischiefs 4008 that 3790 I 2879 set 0524 ......
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 18 Codes
• Code: a string of symbols stands for a complete message.
• Translation given by a ‘code-book’.
Word Code ...... The 1701 secret 5603 mischiefs 4008 that 3790 I 2879 set 0524 ......
2327 6605 1702 9853 0001 0970 3190 8817 1320 0000 = 1701 5603 4008 3790 2879 0524 7946 = 2879 2870 6699 1702 3982 5550 8102 7354 0000 =
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 18 Codes
• Code: a string of symbols stands for a complete message.
• Translation given by a ‘code-book’.
Word Code ...... The 1701 secret 5603 mischiefs 4008 that 3790 I 2879 set 0524 ......
2327 6605 1702 9853 0001 0970 3190 8817 1320 0000 = I do the wrong, and first begin to brawl. 1701 5603 4008 3790 2879 0524 7946 = The secret mischiefs that I set abroach 2879 2870 6699 1702 3982 5550 8102 7354 0000 = I lay unto the grievous charge of others. (Richard III, Act I, Scene 3)
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 19 Another Example
This year’s trial of the embassy bombings revealed that Bin Laden associates began to use encryption before 1998. Sometimes members of the Al-Qaida confederation have alternatively resorted to simple code words. For instance, “working” is said to mean Jihad, “tools” meant weapons, “potatos” meant grenades and “the director” was an alias for Bin Laden. Steganographic approaches were also used to communicate in at least three terrorist acts, including the 1998 embassy bombings in Kenya and Tanzania. Lisa Krieger, Mercury News, Oct 1. 2001
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 20 Historical ciphers
• Used 4000 years ago by Egyptians to encipher hieroglypics.
• Ancient Hebrews enciphered certain words in the scriptures. • 2000 years ago Julius Ceasar used a simple substitution cipher. • Roger Bacon described several methods in 1200s. • Geoffrey Chaucer included several ciphers in his works • Leon Alberti devised a cipher wheel, and described the principles of frequency analysis in the 1460s. IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 21 Mono-alphabetic substitution ciphers
• Let K be the set of all permutations on the alphabet A. Define for each e ∈ K an encryption transformation Ee on strings m = m1m2 ··· mn ∈ M as
Ee(m) = e(m1)e(m2) ··· e(mn) = c1c2 ··· cn = c
• To decrypt c, compute the inverse permutation d = e−1 and
Dd (c) = d(c1)d(c2) ··· d(cn) = m
• Ee is a simple substitution cipher or a mono-alphabetic substitution cipher.
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 22 Substitution cipher examples
• KHOOR ZRUOG
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 22 Substitution cipher examples
• KHOOR ZRUOG = HELLO WORLD Caesar cipher: each plaintext character is replaced by the character three to the right modulo 26.
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 22 Substitution cipher examples
• KHOOR ZRUOG = HELLO WORLD Caesar cipher: each plaintext character is replaced by the character three to the right modulo 26.
• Zl anzr vf Nqnz
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 22 Substitution cipher examples
• KHOOR ZRUOG = HELLO WORLD Caesar cipher: each plaintext character is replaced by the character three to the right modulo 26.
• Zl anzr vf Nqnz = My name is Adam ROT13: shift each letter by 13 places. ‘A’ is replaced by ‘N’, ‘B’ by ‘O’, ...,
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 22 Substitution cipher examples
• KHOOR ZRUOG = HELLO WORLD Caesar cipher: each plaintext character is replaced by the character three to the right modulo 26.
• Zl anzr vf Nqnz = My name is Adam ROT13: shift each letter by 13 places. ‘A’ is replaced by ‘N’, ‘B’ by ‘O’, ...,
• 2-25-5 2-25-5
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 22 Substitution cipher examples
• KHOOR ZRUOG = HELLO WORLD Caesar cipher: each plaintext character is replaced by the character three to the right modulo 26.
• Zl anzr vf Nqnz = My name is Adam ROT13: shift each letter by 13 places. ‘A’ is replaced by ‘N’, ‘B’ by ‘O’, ...,
• 2-25-5 2-25-5 = BYE BYE Alphanumeric: substitute numbers for letters.
How hard are these to cryptanalyze? Caesar? General?
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 23 (In)security of substitution ciphers
• Key spaces are typically huge. 26 letters ; 26! possible keys. • Trivial to crack using frequence analysis (letters, digraphs, etc.). • Frequencies for English based on data-mining books/articles.
⇒ Serdhrapvrf sbe Ratyvfu onfrq ba qngn-zvavat obbxf/negvpyrf. • Easy to apply, except for short, atypical texts From Zanzibar to Zambia and Zaire, ozone zones make zebras run zany zigzags.
⇒ More sophistication required to mask statistical regularities.
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 24 Homophonic substitution ciphers
• To each a ∈ A associate a set H (a) of strings of t symbols, where H (a), a ∈ A are pairwise disjoint. A homophonic substitution cipher replaces each a with a randomly chosen string from H (a). To decrypt a string c of t symbols, one must determine an a ∈ A such that c ∈ H (a). The key for the cipher is the sets H (a).
• Example: A = {a, b}, H (a) = {00, 10}, and H (b) = {01, 11}. The plaintext ab encrypts to one of 0001, 0011, 1001, 1011.
• Rational: makes frequency analysis more difficult. Cost: data expansion and more work for decryption.
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 25 Polyalphabetic substitution ciphers
• Idea (Leon Alberti): conceal distribution using family of mappings.
• A polyalphabetic substitution cipher is a block cipher with block length t over alphabet A where: – the key space K consists of all ordered sets of t permutations over A, (p1, p2,..., pt). – Encryption of m = m1 ··· mt under key e = (p1, ··· , pt) is Ee(m) = p1(m1) ··· pt(mt). −1 −1 – Decryption key for e is d = (p1 , ··· pt ). IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 26 Example: Vigen`ereciphers
• Key given by sequence of numbers e = e1,..., et, where
pi (a) = (a + ei ) mod n
defining a permutation on an alphabet of size n.
• Example: English (n = 26), with k = 3,7,10
m = THI SCI PHE RIS CER TAI NLY NOT SEC URE
then
Ee(m) = WOS VJS SOO UPC FLB WHS QSI QVD VLM XYO
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 27 Transposition ciphers
• For block length t, let K be the set of permutations on {1,..., t}. For each e ∈ K and m ∈ M
Ee(m) = me(1)me(2) ··· me(t)
• The set of all such transformations is called a transposition cipher.
• To decrypt c = c1c2 ··· ct compute Dd (c) = cd(1)cd(2) ··· cd(t).
• N.B.: cryptanalysis easy as frequencies (of letters) preserved.
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 28 Transposition ciphers — example
• C = Aduaenttlydhatoiekounletmtoihahvsekeeeleeyqonouv
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 28 Transposition ciphers — example
• C = Aduaenttlydhatoiekounletmtoihahvsekeeeleeyqonouv
A n d i n t h e e n d t h e l o v e y o u t a k e i s e q u a l t o t h e l o v e y o u m a k e
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 28 Transposition ciphers — example
• C = Aduaenttlydhatoiekounletmtoihahvsekeeeleeyqonouv
A n d i n t h e e n d t h e l o v e y o u t a k e i s e q u a l t o t h e l o v e y o u m a k e
• Idea goes back to Greek Scytale: wrap belt spirally around baton and write plaintext lengthwise on it.
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 29 Composite ciphers
• Ciphers based on just substitutions or transpositions are not secure
• Ciphers can be combined. However . . . – two substitutions are really only one more complex substitution, – two transpositions are really only one transposition, – but a substitution followed by a transposition makes a new harder cipher.
• Product ciphers chain substitution-transposition combinations.
• Difficult to do by hand ; invention of cipher machines.
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 30 One-time pads (Vernam cipher)
• A one-time pad is a stream cipher defined on A = {0, 1}. Message m1 ··· mn is encrypted by a binary key string k1 ··· kn.
Ek1···kn (m1 ··· mn) = (m1 ⊕ k1) ··· (mn ⊕ kn)
Dk1···kn (c1 ··· cn) = (c1 ⊕ k1) ··· (cn ⊕ kn)
• Example: m = 010111, k = 110010, and c = 100101 • Since every key sequence is equally likely, so is every plaintext! Perfect (information theoretical) security, if key isn’t reused. • Until recently, communication between Moscow and Washington was secured this way. Keys transported by trusted courier. Problematic to securely exchange and synchronize long keys.
IT-Security: Theory and Practice (WS02) 29.10.02 David Basin 31 Bibliography
• Bruce Schneier. Applied Cryptography. John Wiley & Sons, New York, 1996.
• Dieter Gollmann. Computer Security. Wiley, 2000.
• Alfred J. Menezes, Paul C. van Oorschot, Scott A. Vanstone. Handbook of Applied Cryptography. CRC Press, 1996. Available online at http://cacr.math.uwaterloo.ca/hac/
• Arthur E. Hutt, Seymour Bosworth, Douglas B. Hoyt. Computer Security Handbook. John Wiley & Sons, 1995.
IT-Security: Theory and Practice (WS02) 29.10.02