sign in sign up
<<
Home , Authenticated encryption, Collision attack

Today’s Lecture

• Hashes and Codes Hashes, MACs & • Properties of Hashes and MACs Authenticated • CBC-MAC, MAC -> HASH (slow), • SHA1, SHA2, SHA3 Tom Chothia • HASH -> MAC, HMAC ICS Lecture 4 • – CCM

Hashes Signatures

l A hash of any message is a short string • Using RSA Epub(Dpriv(M)) = M generated from that message. • This can be used to sign messages. l The hash of a message is always the same. l Any small change makes the hash totally • Sign a message with the private and this can be different. verified with the public key. l It is very hard to go from the hash to the message. • Any real crypto suite will not use the same key for encryption and signing. l It is very unlikely that any two different messages have the same hash. – as this can be used to trick people into decrypting.

Signatures Uses of Hashing

Alice has a signing key Ks • Download/Message verification and wants to sign message M Plain Text • Tying parts of a message together (hash the whole message) Detached Signature: Dks(#(M))

RSA decrypt with key ks SHA hash • Hash message, then sign the hash.

• Protect Passwords Signed: M,Dks(#(M)) – Store the hash, not the password

1 Attacks on hashes Birthday Paradox

• : Find a message for a • How many people do you need to ask given hash: very hard. before you find 2 that have the same birthday? • Prefix : a collision attack where the attacker can pick a prefix for • 23 people, gives (23*22)/2 = 253 pairs. the message. • Prob. that two people have a different • Collision Attack: Find two “random” birthday is: 364/365 messages with the same hash. • (364/365)(23*22/2) = 0.4995

Message Authentication Codes Message Authentication Codes

• MACs are sometimes used for • MACs are hashes with a key. authentication: – Written MACKey(M) – E.g. in Alice and Bank share keyA, Alice sends to the bank: • You can only make or check the hash, if “Pay Bob £10”,MACkeyA(“Pay Bob £10”) you know the key. Possible attack on MAC: “Length • Stops guessing attacks. extension attack” add data to a MAC without knowing the key

CBC MAC An Inefficient

0000000000000 0000000000000

0000 0000 0000

MACKey(M) #(M)

2 The SHA Family of Hash SHA1

• The most common (and best) hashes • A on SHA-1 should need are the SHA hashes. 2^80 hash tests

• 1993, The US National Institute of • In 2005 a 2^63 attack was found. Standards and Technology (NIST), developed a new hash SHA-0 • Not really practical, but no-one trusts SHA-1 any more. • 1995, the NSA stepped in and “fixed” it: SHA-1 (160-bit hash). • So … SHA-2

SHA2 The SHA-3 Competition

• SHA2 is an improved version of SHA1 • Submissions opened on October 31, 2008, with a longer hash. • Round 1 • 256 or 512 bits: also called SHA256, – 13 submissions rejected without comment. SHA512. – 10 withdrawn by authors. – 16 rejected for design or performance. • Inc. Sony’s • Based on SHA-1 it has some of the • Conference in Feb 2009. 14 scheme picked same weaknesses. So, even though it to go through to round 2. seems secure the cryptographers aren’t – Dropped schemes include happy. • Ron Rivest’s, • Lockheed Martin

The SHA-3 Competition Merkle–Damgård (MD) Hashes

• The MD family of hashes is also popular. • Winner announced on October 2, 2012 as – Keccak, (Daemen et al. the AES guy) • MD4 & MD5 used, but weak. – Only useful when we only care about preimage attacks or Integrity. • This is too soon for it to be in standard APIs • MD6: Ron Rivest’s candidate for SHA3. – Seems good & fast. • Expect this to be the standard soon.

3 Broken Hash to MAC Broken Hash to MAC

• If we had a Hash we could try to make a Key Pay Bob £10 MAC by: 0000000000000

0000 0000 0000 MACKey(M) = H(Key,M)

MACKey(Pay Bob £10) • But this might allow a .

Only Alice and the Bank know “Key” Alice sends “Pay Bob £10,MACKey(Pay Bob £10)” to Bank

Broken Hash to MAC HMAC

Key Pay Bob £10 Pay Elvis £10 • To stop this (and other attacks) we use 0000000000000 :

0000 0000 0000 • Given a hash function H we define:

Pay Bob £10, MACKey(Pay Bob £10) MACKey( Pay Elvis £10) HMACK(M) = H( (K xor opad), H( (K xor ipad), M) ) Only Alice and the Bank know “Key” Alice sends “Pay Bob £10,MACKey(Pay Bob £10)” to Bank Attacker Elvis can add to the message without the key opad= 0x5c5c….5c ipad= 0x3636..36

Today’s Lecture Cipher Texts Can Be Altered

• Hashes and Message Authentication Codes • AES encryption with a particular key • Properties of Hashes and MACs maps any 128-bit block to a 128-bit • CBC-MAC, MAC -> HASH (slow), block (or 256) • SHA1, SHA2, SHA3 • HASH -> MAC, HMAC • AES decrypt also maps any 128-bit block to a 128-bit block. • Authenticated Encryption – CCM • Decrypt can be run on any block (not just ).

4 Block mode Known Plain Text Attacks

• CBC mode: any change affects all of • If I know the plaintext I can change CTR the rest of the message. encrypted messages.

• ECB mode: any change affects only the • I.e. if I know Enc(M1) and I know M1, I block. can make a that decrypts to any message I want, e.g. M2: • CTR mode: any change affects only the bits altered. Dec( Enc(M1) xor (M1 xor M2) ) = M2

Authenticated Encryption Modes CCM mode encryption • Authenticated encryption modes stop • First calculate an AES CBC-MAC on the this. data.

• With Authenticated Encryption you can • Then encrypt the message followed by only form a valid ciphertext if you know the MAC using the same key and CTR the key. mode.

• Most common way to do this is to add a • Not rocket science, but proven secure MAC to the ciphertext. – Fully defined as RFC 3610

Today’s Lecture

• Hashes and Message Authentication Codes • Properties of Hashes and MACs • CBC-MAC, MAC -> HASH (slow), • SHA1, SHA2, SHA3 • HASH -> MAC, HMAC

• Authenticated Encryption – CCM

5