CS 155 Spring 2006 Cryptography Is

„ A tremendous tool

Cryptography Overview „ The basis for many security mechanisms Is not John Mitchell „ The solution to all security problems „ Reliable unless implemented properly

„ Reliable unless used properly

„ Something you should try to invent yourself unless Š you spend a lot of time becoming an expert Š you subject your design to outside review

Basic Cryptographic Concepts Five-Minute University Encryption scheme: „ functions to encrypt, decrypt data „ key generation algorithm Secret key vs. public key -1 „ Public key: publishing key does not reveal key -1 Father Guido Sarducci „ Secret key: more efficient, generally key = key Hash function, MAC Everything you could remember, five „ Map input to short hash; ideally, no collisions „ MAC (keyed hash) used for message integrity years after taking CS255 … ? Signature scheme „ Functions to sign data, verify signature

Web Purchase Secure communication

1 Secure Sockets Layer / TLS SSL/TLS Cryptography Standard for Internet security Public-key encryption „ Key chosen secretly (handshake protocol) „ Originally designed by Netscape „ Key material sent encrypted with public key „ Goal: “... provide privacy and reliability between two communicating applications” Symmetric encryption Two main parts „ Shared (secret) key encryption of data packets Signature-based authentication „ Handshake Protocol „ Client can check signed server certificate Š Establish shared secret key using public-key cryptography Š Signed certificates for authentication „ And vice-versa, in principal

„ Record Layer Hash for integrity Š Transmit data using negotiated key, encryption function „ Client, server check hash of sequence of messages „ MAC used in data packets (record protocol)

Example cryptosystems One-time pad

One-time pad Secret-key encryption scheme (symmetric) „ “Theoretical idea,” but leads to stream cipher „ Encrypt plaintext by xor with sequence of bits Feistel construction for symmetric key crypto „ Decrypt ciphertext by xor with same bit sequence „ Iterate a “scrambling function” „ Examples: DES, Lucifer, FREAL, Khufu, Khafre, LOKI, Scheme for pad of length n GOST, CAST, Blowfish, … „ Set P of plaintexts: all n-bit sequences „ AES (Rijndael) is also block cipher, but different „ Set C of ciphertexts: all n-bit sequences Complexity-based public-key cryptography „ Set K of keys: all n-bit sequences „ Modular exponentiation is a “one-way” fctns

„ Examples: RSA, El Gamal, elliptic curve systems, ... „ Encryption and decryption functions encrypt(key, text) = key ⊕ text (bit-by-bit) decrypt(key, text) = key ⊕ text (bit-by-bit)

Evaluation of one-time pad Feistel networks

Advantages Many block algorithms are Feistel networks „ Easy to compute encrypt, decrypt from key, text „ A block cipher encrypts data in blocks „ As hard to break as possible Š Encryption of block n+1 may depend on block n Š This is an information-theoretically secure cipher Š Given ciphertext, all possible plaintexts are equally likely, „ Feistel network is a standard construction for assuming that key is chosen randomly Š Iterating a function f on parts of a message Disadvantage Š Producing an invertible transformation „ Key is as long as the plaintext AES (Rijndael) is related Š How does sender get key to receiver securely? „ Also a block cipher with repeated rounds

„ Not a Feistel network Idea for stream cipher: use pseudo-random generators for key...

2 Feistel network: One Round Data Encryption Standard

Divide n-bit input in half and repeat Developed at IBM, some input from NSA, widely used Scheme requires Feistel structure L i-1 R i-1 „ Function f(Ri-1 ,Ki) „ Permute input bits „ Computation for Ki „ Repeat application of a S-box function K Š e.g., permutation of key K f i „ Apply inverse permutation to produce output Advantage Worked well in practice (but brute-force attacks now) „ Systematic calculation ⊕ „ Efficient to encrypt, decrypt Š Easy if f is table, etc. „ Not provably secure „ Invertible if Ki known Improvements L i R i Š Get Ri-1 from Li Š Compute f(R i-1 ,Ki) „ Triple DES, AES (Rijndael) Š Compute Li-1 by ⊕

Block cipher modes (for DES, AES, …) Electronic Code Book (ECB)

ECB – Electronic Code Book mode Plain Text Plain Text

„ Divide plaintext into blocks

„ Encrypt each block independently, with same key CBC – Cipher Block Chaining Block Block Block Block „ XOR each block with encryption of previous block Cipher Cipher Cipher Cipher „ Use initialization vector IV for first block OFB – Output Feedback Mode

„ Iterate encryption of IV to produce stream cipher CFB – Cipher Feedback Mode Ciphe r Tex t Cip her T „ Output block yi = input xi + encyrptK(yi-1) Problem: Identical blocks encrypted identically No integrity check

Cipher Block Chaining (CBC) Comparison (for AES, by Bart Preneel) Plain Text Plain Text

IV

Block Block Block Block Cipher Cipher Cipher Cipher Similar plaintext blocks produce similar ciphertext (see outline of head) Ciphe r Tex t Cip her T No apparent pattern Advantages: Identical blocks encrypted differently Last ciphertext block depends on entire input

3 RC4 stream cipher – “Ron’s Code” RSA Trade Secret Design goals (Ron Rivest, 1987): History

„ speed „ 1994 – leaked to cypherpunks mailing list

„ support of 8-bit architecture „ 1995 – first weakness (USENET post)

„ simplicity (circumvent export regulations) „ 1996 – appeared in Applied Crypto as Widely used “alleged RC4” „ 1997 – first published analysis „ SSL/TLS

„ Windows, Lotus Notes, Oracle, etc.

„ Cellular Digital Packet Data

„ OpenBSD pseudo-random number generator Weakness is predictability of first bits; best to discard them

Encryption/Decryption Security

key Goal: indistinguishable from random sequence „ given part of the output stream, it is impossible to distinguish it from a random string Problems state 000111101010110101 „ Second byte [MS01] ⊕ Š Second byte of RC4 is 0 with twice expected probability plain text plain text „ Related key attack [FMS01] = Š Bad to use many related keys (see WEP 802.11b) cipher text cipher t Recommendation „ Discard the first 256 bytes of RC4 output [RSA, MS]

Stream cipher: one-time pad based on pseudo-random generator

Complete Algorithm (all arithmetic mod 256) Complexity Classes Key scheduling for i := 0 to 255 S[i] := i hard Answer in polynomial space 0 1 2 3 4 5 6 … j := 0 PSpace may need exhaustive search for i := 0 to 255 Permutation of 256 bytes, depending on key j := j + S[i] + key[i] NP If yes, can guess and check in swap (S[i], S[j]) 2 123 134 24 1 218 53 … polynomial time i, j := 0 Random generator repeat Answer in polynomial time, with BPP i := i + 1 high probability j := j + S[i] 2 123 134 24 9 218 53 … swap (S[i], S[j]) P i j Answer in polynomial time output (S[ S[i] + S[j] ]) +24 easy compute answer directly

4 One-way functions One-way trapdoor A function f is one-way if it is A function f is one-way trapdoor if

„ Easy to compute f(x), given x „ Easy to compute f(x), given x

„ Hard to compute x, given f(x), for most x „ Hard to compute x, given f(x), for most x

„ Extra “trapdoor” information makes it easy to Examples (we believe they are one way) compute x from f(x)

„ f(x) = divide bits x = y@z and multiply f(x)=y*z x „ f(x) = 3 mod p, where p is prime Example (we believe) 3 3 „ f(x) = x mod pq, where p,q are primes with |p|=|q| „ f(x) = x mod pq, where p,q are primes with |p|=|q| „ Compute cube root using (p-1)*(q-1)

Public-key Cryptosystem Example: RSA Trapdoor function to encrypt and decrypt Arithmetic modulo pq „ encrypt(key, message) n „ Generate secret primes p, q ab key pair „ Generate secret numbers a, b with x ≡ x mod pq Public encryption key 〈n, a〉 -1 a „ decrypt(key , encrypt(key, message)) = message „ Encrypt(〈n, a〉, x) = x mod n Private decryption key 〈n, b〉 b Resists attack „ Decrypt(〈n, b〉, y) = y mod n Main properties „ Cannot compute m from encrypt(key, m) and key, „ This works unless you have key-1 „ Cannot compute b from n,a Š Apparently, need to factor n = pq

How RSA works (quick sketch) How well does RSA work?

Let p, q be two distinct primes and let n=p*q Can generate modulus, keys fairly efficiently * „ Efficient rand algorithms for generating primes p,q „ Encryption, decryption based on group Zn Š May fail, but with low probability „ For n=p*q, order φ(n) = (p-1)*(q-1) „ Given primes p,q easy to compute n=p*q and φ(n) Š Proof: (p-1)*(q-1) = p*q - p - q + 1 „ Choose a randomly with gcd(a, φ(n))=1 Key pair: 〈a, b〉 with ab ≡ 1 mod φ(n) „ Compute b = a-1 mod φ(n) by Euclidean algorithm a „ Encrypt(x) = x mod n Public key n, a does not reveal b

b „ „ Decrypt(y) = y mod n This is not proven, but believed ab „ Since ab ≡ 1 mod φ(n), have x ≡ x mod n But if n can be factored, all is lost ... Š Proof: if gcd(x,n) = 1, then by general group theory, otherwise use “Chinese remainder theorem”. Public-key crypto is significantly slower than symmetric key crypto

5 Message integrity Cryptographic hash functions Length-reducing function h For RSA as stated, integrity is a weak point „ Map arbitrary strings to strings of fixed length e e e „ encrypt(k*m) = (k*m) = k * m = encrypt(k)*encrypt(m) One way (“preimage resistance”)

„ This leads to “chosen ciphertext” form of attack „ Given y, hard to find x with h(x)=y Š If someone will decrypt new messages, then can trick them Collision resistant into decrypting m by asking for decrypt(ke *m) Implementations reflect this problem „ Hard to find any distinct m, m’ with h(m)=h(m’) nd „ “The PKCS#1 … RSA encryption is intended primarily to Also useful: 2 preimage resistance provide confidentiality. … It is not intended to provide „ Given x, hard to find x’≠x with h(x’)=h(x) integrity.” RSA Lab. Bulletin nd Additional mechanisms provide integrity „ Collision resistance ⇒ 2 preimage resistance

Iterated hash functions Applications of one-way hash

Password files (one way) Repeat use of block cipher or custom function Digital signatures (collision resistant) „ Pad input to some multiple of block length „ Sign hash of message instead of entire message „ Iterate a length-reducing function f x Data integrity Š f : 22k -> 2k reduces bits by 2 Pad to x=x1x2 …xk „ Compute and store hash of some data Š Repeat h0= some seed „ hi+1 = f(hi, xi) xi Check later by recomputing hash and comparing „ Some final function g Keyed hash for message authentication f(xi-1) f completes calculation „ MAC – Message Authentication Code

g

MAC: Message Authentication Code Basic CBC-MAC Plain Text Plain Text General pattern of use

„ Sender sends Message & MAC(Message), M1 IV=0

„ Receiver receives both parts

„ Receiver makes his own MAC(Message),M2

„ If M2 != M1, data has been corrupted Block Block Block Block „ If M2 == M1, data is valid Cipher Cipher Cipher Cipher Need for shared key

„ Suppose an attacker can compute MAC(x)

„ Intercept M and Hash(M) and resend as M' and Hash(M')

„ Receiver cannot detect that message has been altered. CBC block cipher, discarding all but last output block Additional post-processing (e.g, encrypt with second key) can improve output

6 Slides: A.K. Lenstra, B. de Weger HMAC: Keyed Hash-Based MAC Hash cryptanalysis before Aug ‘04

Internet standard RFC2104 MD4 considered broken: Den Boer, Bosselaers, and Dobbertin, ⊕ „ 1996, ‘meaningful’ collisions Uses hash of key, message: MD5 potentially weak: Dobbertin,

HMACK(M) „ 1996, collisions in the MD5 compression function = Hash[ (K+ XOR opad) || Iterated hash functions for which compression function Hash[(K+ XOR ipad)||M)] ] „ fixed points can be found (i.e., all hashes in the SHA family): „ Drew Dean et al. (1999) found 2nd preimage weakness Low overhead Š (hidden in Dean’s thesis, never published) ⊕ MD5 and up (128-bit keys or greater): „ opad, ipad are constants „ security of practical applications not seriously questioned Any of MD5, SHA-1, RIPEMD- Strong belief in effectiveness of tweaks 160, … can be used

K+ is the key padded out to size

Subsequent developments Digital Signatures

August 2004: Public-key encryption „ X. Wang et al.: actual random collisions in MD4 (‘no time’), 39 Š MD5 in time ≈ 2 , etc., for any IV „ Alice publishes encryption key „ A. Joux: cascading of iterated L-bit and perfect M-bit hash Š does not result in L+M-bit hash – as commonly believed „ Anyone can send encrypted message „ A. Joux: actual random collision for SHA-0 in time ≈ 251 „ Only Alice can decrypt messages with this key „ E. Biham: cryptanalysis of SHA-1 variants October 2004, Kelsey/Schneier (based on Joux): Digital signature scheme „ 2nd preimage weakness in any iterated hash (improving Dean) Feb 14, 2005, X. Wang et al. (based on Wang/Joux/Biham): „ Alice publishes key for verifying signatures „ actual random collision for SHA-0 in time ≈ 239 „ Anyone can check a message signed by Alice „ random collision possibility for SHA-1 in time ≈ 269 (or 266) (advantage: 269 < 280 ) „ Only Alice can send signed messages

Properties of signatures RSA Signature Scheme Functions to sign and verify -1 Publish decryption instead of encryption key „ Sign(Key , message) „ Alice publishes decryption key -1 true if x = Sign(Key , m) „ Anyone can decrypt a message encrypted by Alice „ Verify(Key, x, m) = false otherwise „ Only Alice can send encrypt messages In more detail, Resists forgery -1 „ Alice generates primes p, q and key pair 〈a, b〉 „ Cannot compute Sign(Key , m) from m and Key a „ Sign(x) = x mod n „ Resists existential forgery: b „ Verify(y) = y mod n given Key, cannot produce Sign(Key-1, m) ab „ Since ab ≡ 1 mod φ(n), have x ≡ x mod n for any random or otherwise arbitrary m

7 Slides: A.K. Lenstra, B. de Weger Public-Key Infrastructure (PKI) X.509 certificate Anyone can send Bob a secret message „ Provided they know Bob’s public key X.509 allows data with this format to be How do we know a key belongs to Bob? hashed and signed: p1|| m || p2 „ If imposter substitutes another key, read Bob’s mail where One solution: PKI „ p contains header, distinguished names, and „ Trusted root authority (VeriSign, IBM, United Nations) 1 „ header of public key part, Š Everyone must know the verification key of root authority „ may assume that p1 consists of whole number of blocks Š Check your browser; there are hundreds!! „ „ Root authority can sign certificates m is an RSA modulus „ Certificates identify others, including other authorities „ p2 contains public exponent, other data „ Leads to certificate chains

Trick: can choose m cleverly to get collision

Constructing a collision Some details

If collisions can be found for any IV, then collisions Construct colliding p1|| m || p2 and p1|| m’ || p2 as follows: can be concocted such that they have same Prepend: prescribed initial blocks „ pick properly formatted p1 with names etc., whole # blocks „ compute p1’s intermediate hash value h Proper (and identical) data appended to random data „ ask X. Wang to find random collision m1, m2 with h as IV pairs turns random pair plus appendix into pair of „ p1||m1 and p1||m2 now collide as well valid RSA moduli Promote: „ find m3 s.t. m1||m3 = m and m2||m3 = m’ are RSA moduli Arbitrarily selected data can be appended to colliding „ random m1, m2 extended to meaningful m1||m3 and m2||m3 messages of same length, and they will still collide Append: „ p1||m1||m3 = p1|| m and p1||m2||m3 = p1|| m’ still collide and so do p1|| m ||p2 and p1|| m’ ||p2 for any p2

1 & 3: due to iterative nature of hashes 2: a new trick for RSA moduli construction

Back to TLS Use of cryptography

ClientHello Version, Crypto choice, nonce

ServerHello, [Certificate], Version, Choice, nonce, [ServerKeyExchange], Signed certificate [CertificateRequest], containing server’s ServerHelloDone public key Ks

[Certificate], Secret key K C ClientKeyExchange, S C encrypted with S [CertificateVerify] server’s key Ks

switch to negotiated cipher switch to negotiated cipher Finished Hash of sequence of messages switch to negotiated cipher Finished Hash of sequence of messages

8 More detail … Crypto Summary

ClientHello C → S C, Ver , Suite , N Encryption scheme: C C C -1 encrypt(key, plaintext) decrypt(key ,ciphertext) ServerHello S → C VerS, SuiteS, NS, signCA{ S, KS }

ClientVerify C → S sign { C, V } Secret vs. public key CA C -1 { Ver , Secret } „ C C KS Public key: publishing key does not reveal key sign { Hash( Master(N , N , Secret ) + Pad + -1 C C S C 2 „ Secret key: more efficient; can have key = key Hash(Msgs + C + Master(NC, NS, SecretC) + Pad1)) } (Change to negotiated cipher) Hash function ServerFinished S → C{Hash( Master(N , N , Secret ) + Pad + C S C 2 „ Map long text to short hash; ideally, no collisions Hash( Msgs + S + Master(NC, NS, SecretC) + Pad1)) } „ Keyed hash (MAC) for message authentication Master(NC, NS, SecretC) Signature scheme ClientFinished C → S{Hash( Master(NC, NS, SecretC) + Pad2 + Hash( Msgs + C + Master(N , N , Secret ) + Pad )) -1 C S C 1 „ Private key and public key provide authentication } Master(NC, NS, SecretC)

Limitations of cryptography Why cryptosystems fail [Anderson] Most security problems are not crypto problems

„ This is good Security failures not publicized Š Cryptography works! „ Government: top secret

„ This is bad „ Military: top secret

Š People make other mistakes; crypto doesn’t solve them „ Private companies Examples Š Embarrassment Š Stock price „ Deployment and management problems [Anderson] Š Liability „ Ineffective use of cryptography Š Example 802.11b WEP protocol Paper reports problems in banking industry „ Anderson hired as consultant representing unhappy customers in 1992 class action suit

Anderson study of bank ATMs Sources of ATM Fraud Internal Fraud

US Federal Reserve regulations „ PINs issued through branches, not post „ Customer not liable unless bank proves fraud Š Bank employees know customer’s PIN numbers UK regulations significantly weaker „ One maintenance engineer modified an ATM Š Recorded bank account numbers and PINs „ Banker denial and negligence „ One bank issues “master” cards to employees „ Teenage girl in Ashton under Lyme Š Can debit cash from customer accounts Š Convicted of stealing from her father, forced to plead guilty, later determined to be bank error „ Bank with good security removed control to cut cost Š No prior study of cost/benefit; no actual cost reduction „ Sheffield police sergeant Š Charged with theft and suspended from job; bank error Š Increase in internal fraud at significant cost Š Employees did not report losses to management out of fear 1992 class action suit

9 Sources of ATM Fraud Sources of ATM Fraud

External Fraud PIN number attacks on lost, stolen cards „ Full account numbers on ATM receipts „ Bank suggestion of how to write down PIN Š Create counterfeit cards Š Use weak code; easy to break „ Attackers observe customers, record PIN „ Get account number from discarded receipt „ Programmer error - all customers issued same PIN Š One sys: Telephone card treated as previous bank card „ Banks store encrypted PIN on file „ Apparently programming bug Š Programmer can find own encrypted PIN, look for other „ Attackers observe customer, use telephone card accounts with same encrypted PIN „ Attackers produce fake ATMs that record PIN „ „ Postal interception accounts for 30% of UK fraud One large bank stored encrypted PIN on mag strip Š Nonetheless, banks have poor postal control procedures Š Possible to change account number on strip, leave encrypted PIN, withdraw money from other account „ Many other problems Š Test sequence causes ATM to output 10 banknotes

Additional problems Wider Implications

Some problems with encryption products Equipment designers and evaluators focus on

„ Special hardware expensive; software insecure technical weaknesses

„ Banks buy bad solutions when good ones exist „ Banking systems have some loopholes, but these Š Not knowledgeable enough to tell the difference do not contributed significantly to fraud „ Poor installation and operating procedures Attacks were made possible because

„ Cryptanalysis possible for homegrown crypto „ Banks did not use products properly

„ Basic errors in More sophisticated attacks described in paper Š System design Š Application programming Š Administration

Last mile security: wireless Summary Ethernet Many corporate wireless hubs installed without any Cryptographic systems suffer from lack of privacy or authentication. failure information „ POP/IMAP passwords easily sniffed off the air. „ Laptops in parking lot can access internal network. „ Understand all possible failure modes of system „ Plan strategy to prevent each failure Intended “solution”: use the WEP protocol (802.11b). „ Careful implementation of each strategy „ Provides 40-bit or 128-bit encryption using RC4 … Most security failures due to implementation and management error 802.11b card Base „ Program must carried out by personnel available keydata CRC-32 station key ⊕ RC4-pad( IV || key )

ciphertext , IV (IV is 24 bit initialization vector)

10 Some mistakes in the design of WEP What to do? data CRC-32 ⊕ Regard 802.11b networks as public channels. RC4-pad( IV || key ) „ Use SSH, SSL, IPsec, … CRC-32 ⇒ no packet integrity!! ciphertext , IV „ CRC-32 is linear „ Attacker can easily modify Lesson: packets in transit, e.g. inject “rm –rf *” „ Insist on open security reviews for upcoming standards „ Should use MAC for integrity „ Closed standards don’t work: e.g. GSM, CMEA, … Prepending IV is insufficient. „ Open review worked well for SSL and IPsec „ Fluhrer-Mantin-Shamir: RC4 is insecure in prepending IV mode Š Given 106 packets can get key. Š Implemented by Stubblefield, AirSnort, WEPCrack, …

„ Correct construction: Š packet-key = SHA-1( IV || key ) Š use longer IV, random.

Summary

Main functions from cryptography

„ Public-key encryption, decryption, key generation

„ Symmetric encryption Š Block ciphers, CBC Mode Š Stream cipher

„ Hash functions Š Cryptographic hash Š Keyed hash for Message Authentication Code (MAC)

„ Digital signatures Be careful

„ Many non-intuitive properties; prefer public review

„ Need to implement, use carefully

11