“Network Security”
Omer Rana CM0255
Material from:
Cryptography Components
Sender Receiver
Ciphertext Plaintext Plaintext Encryption Decryption
Encryption algorithm: Plaintext Ciphertext
• Cipher: encryption or decryption algorithms (or categories of algorithms) • Key: a number (set of numbers) – that the cipher (as an algorithm) operates on. • To encrypt a message: – Encryption algorithm – Encryption key Ciphertext – Plaintext
1 Three types of keys: Symmetric -key Secret Key Cryptography Public Key shared secret key Alice Bob Private Key
Plaintext Ciphertext Plaintext Encryption Decryption •Same key used by both parties •Key used for both encryption and decryption •Keys need to be swapped beforehand using a secure mechanism
Asymmetric -key To everyone (public) Bob’s public Cryptography key
Alice Bob Bob’s private key
Ciphertext Plaintext Plaintext Encryption Decryption
Differentiate between a public key and a private key
Symmetric-Key Cryptography • Traditional ciphers: – Character oriented – Two main approaches: • Substitution ciphers or • Transposition Ciphers • Substitution Ciper: – Substitute one symbol with another – Mono-alphabetic : a character (symbol) in plaintext is changed to the same character (symbol) in ciphertext regardless of its position in the text If L O, every instance of L will be changed to O Plaintext: HELLO Ciphertext: KHOOR – Poly-alphabetic : each occurrence can have a different substitute. Relationship between a character in plaintext to ciphertext is one-to-many (based on position being in beginning, middle or end of text). Divide text into group of characters and use a set of keys. THIS LECTUREIS REALLY INTERESTING Plaintext: HELLO Ciphertext: ABNZF
2 Other Traditional Ciphers • Shift/Caesar Cipher – Plaintext and Ciphertext contains upper case characters – Encryption: shift
Use shift cipher with key = 15 to encrypt message “HELLO” Solution: Each character is shifted 15 times: H W ET HELLO WTAAD LA OD
Transposition Cipher
• Change location of characters from plaintext to cipher text • Permute symbols in a block of symbols • Key is a mapping between the position of symbols in plaintext to cipher text 1 1 • Example: Plaintext: 1 2 3 4; Cipher text: 2 4 1 3 2 2 3 3
4 4 position
Encryption using the above Cipher:
Message “HELLO MY DEAR” Remove spaces: “HELLOMYDEAR” Divide into block of four: HELL OMYD EARZ – note addition of Z Ciphertext: ELHLMDOYAZER
3 Currently used Ciphers
• Traditional ciphers are character-oriented • Modern ciphers are bit-oriented – Can deal with text , numbers, video, audio, images, etc – Convert data into bit stream – then apply cipher • Symmetric cipher: – Use a combination of ciphers rather than just one – Ciphers may be applied in rounds • Examples: – XOR, Rotation Cipher, Substitution Cipher (S-box), Transposition Cipher (P-box) • Standards: – Data Encryption Standard (DES) – Advanced Encryption Standards (AES) – Others: Int. Data Encryption Algorithm (IDEA), Blowfish, CAST- 128, RC5
Modern Ciphers … 1 • XOR
A B C – Use of data (plaintext) and key 0 0 0 0 1 1 – Size of data, key and ciphertext are the same 1 0 1 – Interesting property: encryption and decryption are the same 1 1 0 Plaintext: 11011 Key: 01011 Ciphertext: 10000
Key: 01011 Recovered Plaintext: 11011 • Rotation Cipher – Key may be specifically defined or assumed – Keyless rotation: number of rotations (left/right) is pre-defined – If plaintext size is N; then after N rotations, we get original • Useless to apply more than N-1 rotations – Decryption: use same key but opposite direction of rotation
4 Modern Ciphers … 2 • Substitution: S-box – Similar to traditional substitution cipher for characters – Plaintext: stream of length N – Ciphertext: stream of length M, N<>M
• Transposition: P-box (Permutation box) – Similar to traditional transposition cipher for characters – Performs transposition at bit level – E.g.: Straight (N N), Expansion (N M, M>N), Compression (N M, M Round Ciphers • Ciphers involve multiple “rounds” – Each “round” is a complex cipher made up of simple ciphers – Each “round” has a key – which is a subset/variation of the general key (“round key”) • Key generator – If N rounds – N keys are generated – one for each round 5 Types Keys used for Encryption and Decryption Same Different Symmetric-Key Asymmetric-Key Cryptography Cryptography DES RSA AES Diffie-Hellman IDEA Blowfish CAST-128 RC5 Data Encryption Standard (DES) – from IBM 64-bit plaintext • Symmetric key cipher – divide plaintext into blocks (use same key Initial Permutation to encrypt/decrypt block) • 64-bit plaintext, 64-bit Round 1 k1 key Round • Two p-boxes, 16 Key complex (repeated) Generator round ciphers – with k16 Round 16 different key • Initial and final permutations are Final keyless straight Permutation permutations (inverse of each other) 64-bit ciphertext 6 DES function – for the ith Round 32 bits 32 bits Ri Li Ri 32 bits Expansion Permutation 48 bits f(Ri,Ki) Key (Ki) (Ki) + 48-bits 48 bits S-boxes Outcome S S S S S S S + XOR 32 bits Straight Permutation 32 bits Li+1 Ri+1 32 bits 32 bits Outcome Decryption Round 32 bits 32 bits Ri Li Ri 32 bits Expansion Permutation 48 bits f(Ri,Ki) Key (Ki) (Ki) + 48-bits 48 bits S-boxes Outcome S S S S S S S + XOR 32 bits Straight Permutation 32 bits Li+1 Ri+1 32 bits 32 bits Outcome 7 Triple DES (3DES) • To improve on the limited size of DES key – use of three DES blocks • Encryption block: – Encryption-Decryption-Encryption combination • Decryption block – Decryption-Encryption-Decryption combination • Two version: – 2 keys and 3 keys Triple DES 64-bit plaintext (3DES) 2 keys version: Encrypt DES Key 1 Key 1 = Key 3 Text encrypted by a Single DES block can Be decrypted by the new 3DES Decrypt DES Key 2 Encrypt DES Key 3 Key sizes: 112 bits and 168 bits 64-bit ciphertext 8 Advanced Encryption Standard (AES) – from NIST • Overcome limitation with small DES keysize – 3DES increases key size but slow • Uses Rijndael algorithm • Uses a complex round cipher with 3 key sizes – 128 bits (10 rounds), – 192 bits (12 rounds), – 256 bits (14 rounds) – data block: 128 bits 10 Blocks – identical (except 10), but each uses a different key • Other variations proposed which differ Each Round (except 10) is a cipher with four operations that are invertible . Last round has in either size of block, only three operations key, number of rounds, or function used Each operation uses a complex cipher AES (10 rounds, 128-bit key) Round i 128-bit plaintext 128-bit data k0 + Byte Substitution (SubByte) k1 Round 1 Byte Permutation Round (ShiftRow) Key Generator Round 10 k16 Complex Operation (different from other rounds) -- except Round 10 (MixColumn) 128-bit 128-bit ciphertext key ki + 128-bit data 9 Applying the Cipher • Electronic Code Block – Plaintext divided into N blocks, Ciphertext has N blocks – If Plaintext blocks 1,2,3 are identical Ciphertext blocks 1,2,3 are identical – Blocks are considered independent of each other – error in one block is not propagated to another • Cipher Block Chaining – Use previous cipher block in the preparation of the current block (Plaintext and Ciphertext still N blocks) – Identical blocks in Plaintext are not identical in Ciphertext – Blocks have dependencies – errors propagated across blocks – An initiation vector used to bootstrap the process Various other approaches are also possible Rivest, Shamir and Adleman (RSA) • Two keys – (e,d); e:public; d:private – Keys related • Selecting keys by Bob – Chose two large prime numbers: p, q – n=p * q; f=(p-1) * (q-1) – Chose a random integer “e” • d * e = 1 mod f Alice sends message to Bob: C = Pe (mod n) Public: e,n Private: f, d Bob receives message from Alice: P = Cd (mod n) Size of Plaintext block < n 10 RSA Example • Bob chooses: p=7; q=11 – n=p*q=7*11=77 – f=(7-1) * (11-1) = 60 • Bob chooses: e=13; and calculates: d=37 – Public key = 13 – Private key = 37 • Alice: Plaintext = 5 – C= 5 13 = 26 mod 77 – Bob receives ciphertext 26 • Bob: Ciphertext=26 – P= 26 37 = 5 mod 77 – Plaintext = 5 RSA … 2 • Slow if message is long – Useful for small message digests – Useful for Digital signatures – Useful for encrypting a symmetric key • Diffie-Hellman – Used for key exchange – Bob and Alice create a symmetric session key • They do not need to remember or store the key • They do not have to meet to agree on the key 11 • Bob and Alice: Diffie-Hellman – Choose two numbers: p, g – these are public • p: large prime number (1024 bits); • g: random number • Bob: chooses “y”; Alice: chooses “x” (x,y: large random numbers) Secret key has three parts: (p,g),x,y: (g,p=public; Bob knows y; Alice knows x). Each adds their own part to calculate the shared key Alice R1=gx mod p R2=gy mod p Bob R1 R2 x K=(R2) mod p K=(R1) y mod p Both reach Shared secret key the same K=gxy mod p value for the key, without Bob knowing x, (gx mod p) y mod p = (gy mod p) x mod p = gxy mod p and Alice knowing y Simple Diffie-Hellman Example • Assume: g=7; p=23 • Alice: chooses x=3; R1=7 3 mod 23 = 21 • Bob: chooses y=6; R2=7 6 mod 23 = 4 Alice 21 Bob 4 Bob Alice • Alice: calculate symmetric key (K) – K = 4 3 mod 23 = 18 • Bob: calculate symmetric key (K) 6 – K = 21 mod 23 = 18 gxy mod p = 7(3*6) mod 23 = 18 12 Man-in-the-middle attack • Diffie-Hellman is a sophisticated symmetric-key creation algorithm – If x,y are large numbers; difficult for another party to find the key (knowing only p,q) – Even if R1 and R2 intercepted, intruder still needs to know x,y – Finding x from R1; or y from R2 are difficult tasks • Alternative attack: – Intruder can fool Alice and Bob by creating two keys (one between each party) – Intermediate party (Eve) can fool Alice and Bob into believing they are communicating directly – Eve can also change/modify message before forwarding Alice Eve Bob R1=gx mod p R1 R2=gz mod p R2 R2 R3=gy mod p R3 K1=(R2) x mod p K1=(R1) z mod p K2=(R2) y mod p K2=(R3) z mod p Alice-Eve: K1= gxy mod p Eve-Bob: K2= gzy mod p 13