Introduction to Cryptography

Mag. iur. Dr. techn. Michael Sonntag Introduction to Cryptography Institute of Networks and Security Johannes Kepler University Linz, Austria E-Mail: [email protected] Thanks to Rudolf Hörmanseder for some slides (esp. drawings!) Why cryptography? Security is a very important aspect, especially if money (or equivalents) are affected by transactions Not every information should be available to everyone Note: Data is sent in the Internet over numerous "open systems", where anyone can listen it! Security is needed! The technical aspect of security is cryptography Encrypting data against disclosure and modifications Signing data against modifications and repudiation Note: Cryptography does not solve all security problems! Example: Communication analysis (who talks to whom when) Other aspects of security are also needed » E.g.: Do you know what your employees actually do with data? Solutions: DRM, deactivation codes, anonymizers, … Michael Sonntag Introduction to Cryptography 2 Application areas Storing data in encrypted form Even access will not lead to disclosure (stolen laptops!) Example: File/-system encryption, password storage Transmitting data securely Enc. transmission prevents eavesdropping and tampering Example: TLS Identifying your partner Preventing man-in-the-middle attacks Example: TLS with uni-/bidirectional certificates Proof of identity & authority Avoiding impersonation Example: GPG E-Mail signatures, digital signatures (Austria: "Bürgerkarte“ – “citizen card”) Michael Sonntag Introduction to Cryptography 3 Motivation Those cases where Data is being the attacker can transmitted understand the stored data/consequences processed (here underlined), and exposed to the following attacks: are more Inspection: without / with understanding problematic! Modification: without / with understanding Deletion: random / targeted Addition: random / targeted Replay: without / with knowledge of consequences Michael Sonntag Introduction to Cryptography 4 Software components Several different classes of algorithms required: Hash functions: Handling the whole document takes too long » Drawback: Content could be substituted (collisions)! Encryption/Decryption: The same algorithm for symmetric, but different one for asymmetric encryption/signatures » Encryption: Combining a document with a public key – Decryption: Combing encrypted document with private key » Signature: Combining a document with a private key – Verification: Checking the document + signature with public key Key agreement: Creating a shared secret » Even if both parties do not have a shared secret to start with! » Especially useful if the communication channel is insecure Key generation: Creating secure keys » Requires e.g. secure random generators » From passwords: Creating keys suitable for algorithms For each class many algorithms exist: Good & bad ones Michael Sonntag Introduction to Cryptography 5 First approach: En-/Decoding Encoding Very useful, but this is not “security” in any sensible way. Plain text Encoded text But often mistaken as such! Decoding Michael Sonntag Introduction to Cryptography 6 Basic functionality of cryptography Encryption Key Plain text Cipher text Key Decryption Michael Sonntag Introduction to Cryptography 7 Common requirements Key comparatively very small Data to encrypt very large In comparison to the other; not necessarily absolute Insecure channel Plain Cipher Cipher Plain Encryption Decryption text text text text Secure channel Gutmann P.: „Network Security: Security Requirements“, University of Auckland, http://www.cs.auckland.ac.nz/~pgut001 Michael Sonntag Introduction to Cryptography 8 Symmetric vs. asymmetric cryptography Symmetric cryptography: Very old Keys are short: >=56 Bits (DES) » Many algorithms known (many of them now insecure!) Well suited to a large & homogenous group of participants » Everyone knows the same key and can en-/decrypt messages from all others Key distribution: Problematic (Secure channel needed) Computationally very fast (1/100 – 1/1000 of asymm.) Asymmetric cryptography: Very new (≈1970) Keys are long: >=512 Bits (RSA/DSA; Ell. curves >=112) » Few algorithms known (most of them very secure) » Keys consist of two parts: One public, one private Only suitable for a single person » Encrypt TO this person or verify signatures FROM this person (Public) Key distribution: Problematic (common TTP needed)! Computationally slow: Calculation difficult/time-consuming Michael Sonntag Introduction to Cryptography 9 Symmetric (secret key) encryption Encryption Plain text Secret Key Cipher text Decryption Michael Sonntag Introduction to Cryptography 10 Symmetric cryptography Cleartext Encrypted message Cleartext ? Key exchange over secure channel The same key is used for encryption and decryption The key must therefore remain absolutely secret! So it must be transported securely » This is only possible through a different channel! Keys must be changed regularly (much encrypted content renders breaking the encryption easier!) Also used for authentication (but: repudiation possible!) "MAC" Message Authentication Code Michael Sonntag Introduction to Cryptography 11 Asymmetric (public key) encryption Encryption Public key Trapdoor function Plain text Cipher text Key generation Random number(s) Private key Decryption Michael Sonntag Introduction to Cryptography 12 Asymmetric cryptography Cleartext Encrypted message Cleartext Public key ? Private key Public key can be obtained in various ways, e.g. from a trusted third party One part (private) of the key is used for decryption/signature A encrypted to B: B's private key is used to decrypt A signed to B: A's private key is used to sign The other (public) is used for encryption/verification A encrypted to B: B's public key is used to encrypt A signed to B: A's public key is used to verify the signature The public key is available to everyone Problem: Association "Key ↔ Person" must be ensured Michael Sonntag Introduction to Cryptography 13 Combining Symmetric & Asymmetric Encryption (1) (Large) Random key Receiver‘s Plain text public key message D K K D (Fast) symmetric (Slow) asymmetric encryption encryption Goal: Encrypted Combination of (Large) random the functionality of Cipher text key asymmetric encryption with the speed of symmetric encryption Michael Sonntag Introduction to Cryptography 14 Combining Symmetric & Asymmetric Encryption (2) Encrypted Receiver‘s (Large) random private key Cipher text Key D K K D (Fast) symmetric (Slow) asymmetric decryption decryption Goal: (Large) Combination of Plain text the functionality of message asymmetric encryption with the speed of symmetric encryption Michael Sonntag Introduction to Cryptography 15 Sign: Encryption with private key + ... Encryption Sign Private key Plain text Plain text Cipher text Ok? ==? Public key Decryption Michael Sonntag Introduction to Cryptography 16 Check: Decrypt with public key + compare Encryption Message Digest Sign Private key Plain text Plain text Cipher text Message Digest Ok? ==? Public Key Decryption Michael Sonntag Introduction to Cryptography 17 Signature & Encryption Sender Random Receiver generator public key K Random D Asymmetric Encrypted key encryption random key K D Symmetric Plain text encryption Cipher text Message D Asymmetric Encrypted digest encryption signature K Sender private key Michael Sonntag Introduction to Cryptography 18 Signature & Decryption Receiver Receiver private key K Random Asymmetric D Encrypted key decryption random key K Symmetric D Plain text decryption Cipher text Message Asymmetric D Encrypted “Signature” ==? OK? digest decryption signature K Sender public key Michael Sonntag Introduction to Cryptography 19 Timestamps How do you know when some data existed? Add the time – but this can be easily falsified! Solution: Let someone else add the time and sign the result Attention: Time format (DST, timezone, …)! Problems: They should not know the content Send only hash value Interface? Costs? Organization? How exact is the time of the third party? Delay and accuracy acceptable? Trust in this third party (it can easily create false TS!)? The timestamped data existed at that time – but we don’t know for how long before it existed! » No backdating; but storing + timestamp later is possible! Michael Sonntag Introduction to Cryptography 20 Timestamping TSA = Time Stamping Authority Message Plain text digest Hash value Submit for timestamping Trusted Third Party Hash value Receive timestamp Hash value Asymmetric D Timestamp encryption Timestamp Encrypted K signature TSA TSA private key Certificate Michael Sonntag Introduction to Cryptography 21 Encryption modes Stream mode: each bit/byte is encrypted separately Block mode: Fixed-length amount of data Requires padding to “extend” too short data » Must be perfectly removable at the other side Mostly requires an initialization vector ( “zero-th” block) » Must be good random data and should always change – Same plaintext+same key Different ciphertext – Need not be secret Different options available, depending on requirements » Encryption only or authentication as well? » Random access to “center” of encrypted data needed (=disks)? Examples: Electronic Codebook (ECB) DO NOT USE; Cipher-block chaining (CBC) Try to avoid Examples (converting block stream cipher): Cipher feedback (CFB); Output feedback (OFB); Counter (CTR) Michael Sonntag Introduction to Cryptography 22 Algorithms Symmetric: DES/3DES: Based on permutations, substitution;

Load more