Chaffing and Winnowing: Confidentiality Without Encryption
Total Page:16
File Type:pdf, Size:1020Kb
Chaffing and Winnowing: Confidentiality without Encryption Ronald L. Rivest Winnowing does not employ encryption, and so does MIT Laboratory for Computer Science not have a “decryption key.” Thus, the usual argu- 545 Technology Square ments in favor of “key recovery’’ don’t apply very well Cambridge, MA 02139 for winnowing. As usual, the policy debate about regulating technology ends up being obsoleted by A major goal of security techniques is “confidential- technological innovations. Trying to regulate confi- ity”—ensuring that adversaries gain no intelligence dentiality by regulating encryption closes one door from a transmitted message. There are two major and leaves two open (steganography and winnowing). techniques for achieving confidentiality: We now explain how a confidentiality system based Novel • Steganography: the art of hiding a secret message on winnowing works. There are two parts to sending techniques for within a larger one in such a way that the adver- a message: authenticating (adding MACs), and add- confidentiality sary can not discern the presence or contents of ing chaff. The recipient removes the chaff to obtain are interesting the hidden message. For example, a message the original message. in part because might be hidden within a picture by changing the of the current low-order pixel bits to be the message bits. (See The sender breaks the message into packets, and au- debate about Wayner (1996) for more information on thenticates each packet using a secret authentica- cryptographic steganography.) tion key. That is, the sender appends to each packet policy a “message authentication code” or “MAC” com- • Encryption: transforming the message to a puted as a function of the packet contents and the ciphertext such that an adversary who overhears secret authentication key, using some standard MAC the ciphertext can not determine the message algorithm, such as HMAC-SHA1 (see Krawczyk et sent. The legitimate receiver possesses a secret al. (1997)). We have the transformation of append- decryption key that allows him to reverse the en- ing a MAC thus: cryption transformation and retrieve the message. The sender may have used the same key to en- packet → packet, MAC crypt the message (with symmetric encryption schemes) or used a different, but related key (with The packet is still “in the clear”; no encryption has public-key schemes). DES and RSA are familiar been performed. We note that software that merely examples of encryption schemes. authenticates messages by adding MACs is automati- cally approved for export, as it is deemed not to en- Trying to regulate This paper introduces a new technique, which we crypt. confidentiality call “chaffing and winnowing’’—to winnow is to by regulating “separate out or eliminate (the poor or useless There is a secret key shared by the sender and the encryption closes parts),’’ (Webster’s Dictionary), and is often used receiver to authenticate the origin and contents of one door and when referring to the process of separating grain from each packet—the legitimate receiver, knowing the leaves two open chaff. secret authentication key, can determine that a (steganography packet is authentic by recomputing the MAC and and winnowing). Novel techniques for confidentiality are interesting comparing it to the received MAC. If the compari- in part because of the current debate about crypto- son fails, the packet and its MAC are automatically graphic policy as to whether law enforcement should discarded. The sender and the receiver can initially be given when authorized surreptitious access to the create and agree upon the secret authentication key plaintext of encrypted messages. The usual tech- with any standard technique, such as authenticated nique proposed for such access is “key recovery,” Diffie-Hellman. where law enforcement has a “back door’’ that en- ables them to recover the decryption key. We note that it is typical for each packet to contain a serial number as well. For example, when a long file Professor Ronald Rivest is associate director of MIT’s Laboratory for Computer Science. He can be contacted at [email protected]. is transmitted it is broken up into smaller packets, The text of this article can also be found at http://theory.lcs.mit.edu/ and each packet carries a unique serial number. The ~rivest/chaffing.txt serial numbers help the receiver to remove duplicate CRYPTOBYTES12 S U M M E R 1 9 9 8 — T H E T E C H N I C A L N E W S L E T T E R O F R S A L A B O R A T O R I E S packets, identify missing packets, and to correctly or- mined at a different level of the protocol stack, rather der the received packets when reassembling the file. than upon receipt of a bad packet, since the packet The MAC for a packet is computed as a function of may have been transmitted more than once and been the serial number of the packet as well as of the packet received OK already.) contents and the secret authentication key. As an example, we might have a sequence of the form: Let us verb a word, and let “chaffing” mean the pro- cess of adding chaff to a sequence of packets. As (1,Hi Bob,465231) above, “winnowing” is the (usual) process of discard- (2,Meet me at,782290) ing all packets with bad MACs. We call the good (3,7PM,344287) packets “wheat” for consistency of metaphor. (4,Love-Alice,312265) How much confidentiality does chaffing provide? of triples of sequence number, message, and MAC. This depends on the MAC algorithm, on how the original message is broken into packets, and on how The second process involved in sending a message is the chaffing is done. “adding chaff”: adding fake packets with bogus MACs. The chaff packets have the correct overall A typical MAC algorithm (such as HMAC-SHA1) Note that the format, have reasonable serial numbers and reason- will appear to act like a “random function” to the problem of able message contents, but have MACs that are not adversary, and in such a case the adversary will not providing valid. The chaff packets may be randomly inter- be able to distinguish wheat from chaff. It is pos- confidentiality mingled with the good (wheat) packets to form the sible in principle, however, to have an unfortunate by chaffing and transmitted packet sequence. Extending the preced- MAC algorithm that “leaks” information about the winnowing is ing example, chaff packets might make the received message being MAC’ed, allowing the adversary to based on the sequence look like: gain an advantage in distinguishing wheat from difficulty (for the chaff. For example, one could define a LEAKY- adversary) of (1,Hi Larry,532105) HMAC-SHA1 MAC algorithm to have an output distinguishing (1,Hi Bob,465231) that is the concatenation of the output of the the chaff from (2,Meet me at,782290) HMAC-SHA1 algorithm together with the low-or- the wheat. It is (2,I’ll call you at,793122) der bit of the message being MAC’ed. However, in not based on (3,6PM,891231) practice (and in theory) one looks for MAC algo- the difficulty of (3,7PM,344287) rithms that are indistinguishable from random func- breaking an (4,Yours-Susan,553419) tions, and such algorithms also work fine in a chaff- encryption (4,Love-Alice,312265) ing and winnowing application. scheme In this case, for each serial number, one packet is Note that the problem of providing confidentiality good (wheat) and one is bad (chaff). Instead of ran- by chaffing and winnowing is based on the difficulty domly intermingling the chaff with the wheat, the (for the adversary) of distinguishing the chaff from packets can also be output in sorted order, sorting the wheat. It is not based on the difficulty of break- first by serial number, and then by message contents. ing an encryption scheme, since there is no encryp- tion being performed (although confidentiality may To obtain the correct message, the receiver merely be obtained nonetheless, just as for steganography). discards all of the chaff packets, and retains the wheat packets. But this is what the receiver does If the adversary sees only one packet with a given anyway! In a a typical packet-based communication serial number, then that packet is probably wheat, system the receiver will automatically discard all and not chaff. So a good chaffing process will add at packets with bad MACs. So the “winnowing” pro- least one chaff packet for each packet serial number cess is a normal part of such a system. (Receiving a used by the message. packet with a bad MAC could conceivably trigger more of a response from the receiver, but not nor- The adversary may also distinguish wheat from chaff mally; the detection of a missing packet is deter- by the contents of each packet. If the wheat packets T H E T E C H N I C A L N E W S L E T T E R O F R S A L A B O R A T O R I E S — S U M M E R 1 9 9 8 13 CRYPTOBYTES each contains an English sentence, while the chaff The process of creating chaff is also easy: just create a packets contain random bits, then the adversary will chaff packet with whatever serial number and packet have no difficulty in winnowing the wheat from the contents you may like, and include a random 64-bit chaff himself. MAC value. This MAC value is overwhelmingly likely to be bad, and thus the packet created is over- I stress that the On the other hand, if each wheat packet contains a whelmingly likely to be chaff.