Cryptography
Total Page:16
File Type:pdf, Size:1020Kb
Cryptography Prof. Dr. Carsten Damm Dr. Henrik Brosenne University of Goettingen Institut of Computer Science Winter 2013/2014 Table of Contents Classical Cryptography Substitution Ciphers Transposition Ciphers Elementary Cryptanalysis Published Worksheet Published worksheet 02 substitution ciphers. Classical cryptosystems Classical cryptosystems act on characters (not bits or bytes). The main building blocks Substitution of characters by others. Transpositions, i.e. rearranging of character positions. Sometimes combinations of Substitutions and Transpositions. Notation Notation plaintext alphabet A ciphertext alphabet A0 0 ai denotes i-th letter from plaintext alphabet in its natural order (similarily ai ) m = m1m2 ::: sequence of plaintext letters c = c1c2 ::: sequence of ciphertext letters enciphering keys K or k deciphering keys K 0 or k0 enciphering map EK deciphering map DK 0 We will consider 4 types of substitution ciphers. Each of them easily seen to be symmetric ciphers: there is an efficient algorithm producing the deciphering key from the enciphering key. Simple substitution ciphers this is a monographic (substitution of single characters by single characters) and monoalphabetic substitution (each occurence of some ai is replaced by 0 0 the same ciphertext letter aj ): key = mapping A!A key = list of substitutions under the ordering of the plaintext alphabet, in case A = A0 it specifies a permutation π for A = A0 = the classical alphabet a key could be specified like this: K = ULOIDTGKXYCRHBPMZJQVWNFSAE keyspace is as large as 26!, nevertheless simple substitutions ciphers are easy to break formula: ci = π(mi ) Example Plaintext (paragraph from Kohel's book after passing it through the map π): SUPPOSETHATWEFIRSTENCODEAMESSAGEBYPURGINGALLNONALPHABETI CCHARACTERSEGNUMBERSSPACESANDPUNCTUATIONANDCHANGINGALLCH ARACTERSTOUPPERCASETHENTHEKEYSIZEWHICHBOUNDSTHESECURITYO FTHESYSTEMISALPHABETICCHARACTERSTHEREFORETHETOTALNUMBERO FKEYSISOFENORMOUSSIZENEVERTHELESSWEWILLSEETHATSIMPLESUBS TITUTIONISVERYSUSCEPTIBLETOCRYPTANALYTICATTACKS Key: ULOIDTGKXYCRHBPMZJQVWNFSAE simple substitution ciphertext: QWMMPQDVKUVFDTXJQVDBOPIDUHDQQUGDLAMWJGXBGURRBPBURMKULDVX OOKUJUOVDJQDGBWHLDJQQMUODQUBIMWBOVWUVXPBUBIOKUBGXBGURROK UJUOVDJQVPWMMDJOUQDVKDBVKDCDAQXEDFKXOKLPWBIQVKDQDOWJXVAP TVKDQAQVDHXQURMKULDVXOOKUJUOVDJQVKDJDTPJDVKDVPVURBWHLDJP TCDAQXQPTDBPJHPWQQXEDBDNDJVKDRDQQFDFXRRQDDVKUVQXHMRDQWLQ VXVWVXPBXQNDJAQWQODMVXLRDVPOJAMVUBURAVXOUVVUOCQ Easy statistical attack based on observation that frequencies of ciphertext symbols correspond to frequencies of plaintext letters under the above key, D is most frequent in ciphertext Special cases Affine ciphers numerically encode letters A, B,..., Z as elements f0,1,. ,25g = Z26 := Z=26Z then operate on letters by transformations of the form x 7! ax + b for any a coprime to 26 key = (a; b) ci = a ∗ mi + b (mod 26)) Translation ciphers special case of affine cipher with a = 1, also called shift cipher) or additive cipher (e.g. Caesar's cipher) Exercise 6 1 How many affine ciphers are there on the classical alphabet? 2 Read about ROT13 cipher and it's uses. 3 Vzcyrzrag gur EBG13 pvcure va Fntr. 4 Someone says: \OK, let's agree on this substitution system. But to improve it, we better double the key size and double-encrypt messages (encipher plaintext by first key, and afterwards encipher result by second key)." Good idea? 5 Consider a cryptosystem with plaintext alphabet = ciphertext alphabet. A key in that system is called involutoric if double-encryption with same key gives the plaintext. ROT13 is an example. Involutoric keys are convenient, but also weak in some sense. I How many involutoric keys are there for the translation ciphers? I How many involutoric keys are there for affine ciphers? I Find some involutoric but non-affine keys for general substitution ciphers on the classical alphabet. Try to estimate the number of such keys by constructing as many as possible involutions. Homophonic ciphers Homophonic ciphers precondition: #A0 > #A advanced variant of substitution ciphers: each plaintext letter can be replaced by any one of a set of ciphertext letters still monographic (single letters replaced by single characters from A0) thus: key = partition of A0 into #A sets for the classical alphabet: partition A0 into 26 blocks, key = ordered list of blocks enciphering: ai is replaced by random element from ith block 8i : ci 2 fπ1(mi ); π2(mi )g depending on choice, same plaintext can result in several ciphertexts! deciphering: element from ith block is deciphered as ith plaintext letter Example A0 = Klingonian alphabet, which contains 52 characters, as we all know The font is not available, so we represent each Klingonian letter simply by a pair of classical letters (corresponding to the pronunciation . ) and we arrange them in two rows, that specify our homophonic key: ABCDEFGHIJKLMNOPQRSTUVWXYZ LV MJ CW XP QO IG EZ NB YH UA DS RK TF MJ XO SL PE NU FV TC QD RK YH GW AB ZI UD PY KG JN SH MC FT LX BQ EI VR ZA OW XP HO DJ CY RN ZV WT LA SF BM GU QK IE To encipher the π-encoded message ALWAYSLOOKONTHEBRIGHTSIDEOFLIFE, we replace occurrences of ai by either the lower or the upper Klingonian pair in the ith key column The following are legal encipherings of the message: 1 LVRKYHLVABZVRKHOHOVRHOXPWTLXQOMJNUYHFTNBTCFVYHJNQOHOMCZABQMCSH 2 UDZAYHUDQKZVZAHOXODSXOMJTCLXSHMJRNBQFTNBWTZVBQXPQOHOIGZABQMCSH 3 LVRKYHUDQKZVRKXOXODSHOXPTCLXQOPYRNBQEZNBTCFVBQXPSHHOIGZAYHMCSH 4 LVZABMUDABFVRKHOHODSHOXPWTLXQOPYRNBQEZNBTCZVBQXPQOXOIGZABQMCQO The high frequency of E in plaintext is distributed among several ciphertext letters Polyalphabetic substitution ciphers Polyalphabetic substitution ciphers in a way similar to homphonic ciphers (several keys) but choice of key is not random but based on the position of the character in the plaintext ci = πf (i)(mi ) special case are periodic substitution ciphers: substitute the i-th plaintext letter using the (i (mod t))-th key ci = πf (i (mod t))(mi ) t is called the period: each t-th character is enciphered by the same simple substitution cipher the shorter the period, the weaker the system Example: Vigen`erecipher The Vigen`erecipher is a periodic translation cipher. each key specifies an affine translation identify the standard alphabet with Z=26Z = f0; 1; :::; 25g ci = (mi + k(i (mod t))) (mod 26) Message \Human salvation lies in the hands of the creatively maladjusted." Gives the encoded plaintext HUMANSALVATIONLIESINTHEHANDSOFTHECREATIVELYMALADJUSTED With key UVLOID enciphering performs the column additions. HUMANS ALVATI ONLIES INTHEH ANDSOF THECRE ATIVEL YMALAD JUSTED UVLOID UVLOID UVLOID UVLOID UVLOID UVLOID UVLOID UVLOID UVLOID -------------------------------------------------------------- BPXOVV UGGOBL IIWWMV CIEVMK UIOGWI NCPQZH UOTJMO SHLZIG DPDHMG Example: Running Key Cipher and Auto Key Cipher Running key cipher key K = k1k2::: is a long stream of letters 2 f0; 1; :::; 25g, non-periodic ci = mi + ki best would be completely random letters in the key stream (Vernam cipher to be talked about later), but makes key exchange inconvenient popular key agreements like this: Alice in Wonderland, start reading at page 5, bottom line ciphertext C = c1c2 ::: is defined by ci = mi + ki (mod 26) Autokey cipher, similar but the key stream consists of a short keyword k1k2:::k` with the plaintext(!) appended: k1k2:::kt m1m2::: ci = mi + ki (mod 26) for i ≤ ` else ci = mi + mi−` (mod 26) History polyalphabetic substitutions were suggested by Alberti mid of the 15th century tool: slide rules or adjustable metal discs containing the alphabet in unshifted and shifted version: ...XYZABCDEFGHIJKLMNOPQRSTUVWXYZABC... ...ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEF... Vigen`ere'scipher was first described by Bellaso a cryptologist in the service of the pope in the 16th century idea: specify key by a single word it was later misattributed to Vigen`ere,who instead invented the autokey cipher Vigen`ereciphers are reported to have been in military use until about 1940 (Wikipedia) this type of ciphers was successful for a long time Example: Rotor machine an electro-mechanical device for stream enciphering the plaintext implements a sophisticated polyalphabetic substitution cipher, main ideas: I each rotor defines a simple substitution I after substituting a single character the rotor moves one cycle step, thus giving a period of 26 I the next rotor applies another substitution but the cycle step is performed only after the previous one cycled for 26 steps 2 3 I thus two, three, . rotors give a period of 26 ; 26 ; ::: in use between 1920{1970 after its invention the design got to be known (some systems where patented, some where perhaps analyzed by secret service acitivities) the key consists of the sequence of rotor substitutions and the initial state of the system The Enigma starting substitution P (an arbitrary permutation of the alphabet!) defined by a plugboard 3 rotors: after being substituted by right, middle and left rotors (R; M; L) the symbol was “reflected” by a special rotor U in fixed position after passing the reflector U the symbol went again through rotors 3, 2, 1 doing their inverse substitutions L−1; M−1; R−1 and finally through the inverse plugboard substitution P−1 (see Wikipedia http://en.wikipedia.org/wiki/Enigma machine) if ρ is the cyclic permutation (A! B! C ! ... ! A) and if i; j; k are the actual cycle positions of the rotors the overall substitution in this situation reads as i −i j −j k −k EP;i;j;k =P(ρ Rρ )(ρ Mρ )(ρ Lρ )U (ρk L−1ρ−k )(ρj M−1ρ−j )(ρi R−1ρ−i )P−1 The Enigma Some details omitted. there where