CRYPTOGRAPHY KNOWLEDGE AREA Issue 1.0 AUTHOR: Nigel Smart – KU Leuven EDITOR: George Danezis – University College London REVIEWERS: Dan Bogdanov - Cybernetica Kenny Patterson – Royal Holloway, University of London Liqun Chen – University of Surrey © Crown Copyright, The National Cyber Security Centre 2018. This information is licensed under the Open Government Licence v3.0. To view this licence, visit http://www.nationalarchives.gov.uk/doc/open-government-licence/ When you use this information under the Open Government Licence, you should include the following attribution: CyBOK Cryptography Knowledge Area Issue 1.0 © Crown Copyright, The National Cyber Security Centre 2018, licensed under the Open Government Licence http://www.nationalarchives.gov.uk/doc/open-government-licence/. The CyBOK project would like to understand how the CyBOK is being used and its uptake. The project would like organisations using, or intending to use, CyBOK for the purposes of education, training, course development, professional development etc. to contact it at [email protected] to let the project know how they are using CyBOK. Issue 1.0 is a stable public release of the Cryptography Knowledge Area. However, it should be noted that a fully-collated CyBOK document which includes all of the Knowledge Areas is anticipated to be released by the end of July 2019. This will likely include updated page layout and formatting of the individual Knowledge Areas. Cryptography Nigel P. Smart June 2018 INTRODUCTION The purpose of this chapter is to explain the various aspects of cryptography which we feel should be known to an expert in cyber-security. The presentation is at a level needed for an instructor in a module in cryptography; so they can select the depth needed in each topic. Whilst not all experts in cyber-security need be aware of all the technical aspects mentioned below, we feel they should be aware of all the overall topics and have an intuitive grasp as to what they mean, and what services they can provide. Our focus is mainly on primitives, schemes and protocols which are widely used, or which are suitably well studied that they could be used (or are currently being used) in specific application domains. Cryptography by its very nature is one of the more mathematical aspects of cyber-security; thus this chapter contains a lot more mathematics than one has in some of the other chapters. The overall presentation assumes a basic knowledge of either first-year undergraduate mathematics, or that found in a discrete mathematics course of an undergraduate Computer Science degree. The chapter is structured as follows: After a quick recap on some basic mathematical notation (Sec- tion 1), we then give an introduction to how security is defined in modern cryptography. This section (Section 2) forms the basis of our discussions in the other sections. Section 3 discusses information theoretic constructions, in particular the one-time pad, and secret sharing. Sections 4 and 5 then detail modern symmetric cryptography; by discussing primitives (such as block cipher constructions) and then specific schemes (such as modes-of-operation). Then in Sections 6 and 7 we discuss the standard methodologies for performing public key encryption and public key signatures, respectively. Then in Section 8 we discuss how these basic schemes are used in various standard protocols; such as for authentication and key agreement. All of the sections, up to and including Section 8, focus exclusively on constructions which have widespread deployment. Section 9 begins our treatment of constructions and protocols which are less widely used; but which do have a number of niche applications. These sections are included to enable the instructor to pre- pare students for the wider applications of the cryptography that they may encounter as niche applica- tions become more mainstream. In particular, Section 9 covers Oblivious Transfer, Zero-Knowledge, and Multi-Party Computation. Section 10 covers public key schemes with special properties, such as group signatures, identity-based encryption and homomorphic encryption. The chapter assumes the reader wants to use cryptographic constructs in order to build secure systems, it is not meant to introduce the reader to attack techniques on cryptographic primitives. Indeed, all primitives here can be assumed to have been selected to avoid specific attack vectors, or key lengths chosen to avoid them. Further details on this can be found in the regular European Key Size and Algorithms report, of which the most up to date version is [1]. For a similar reason we do not include a discussion of historical aspects of cryptography, or historical ciphers such as Caesar, Vigenère or Enigma. These are at best toy examples, and so have no place in a such a body of knowledge. They are best left to puzzle books. However the interested reader is referred to [2]. CONTENT 1 Mathematics [3, c8–c9,App B][4, c1–c5] Cryptography is inherently mathematical in nature, the reader is therefore going to be assumed to be familiar with a number of concepts. A good textbook to cover the basics needed, and more, is that of Galbraith [5]. Before proceeding we will set up some notation: The ring of integers is denoted by Z, whilst the fields of rational, real and complex numbers are denoted by Q, R and C. The ring of integers modulo N will be denoted by Z=NZ, when N is a prime p this is a finite field often denoted by Fp. The set ∗ ∗ of invertible elements will be written (Z=NZ) or Fp. An RSA modulus N will denote an integer N, which is the product of two (large) prime factors N = p · q. Finite abelian groups of prime order q are also a basic construct. These are either written multi- x plicatively, in which case an element is written as g for some x 2 Z=qZ; when written additively an element can be written as [x] · P . The element g (in the multiplicative case) and P (in the additive case) is called the generator. The standard example of finite abelian groups of prime order used in cryptography are elliptic curves. An elliptic curve over a finite field Fp is the set of solutions (X; Y ) to an equation of the form E : Y 2 = X3 + A · X + B where A and B are fixed constants. Such a set of solutions, plus a special point at infinity denoted by O, form a finite abelian group denoted by E(Fp). The group law is a classic law dating back to Newton and Fermat called the chord-tangent process. When A and B are selected carefully one can ensure that the size of E(Fp) is a prime q. This will be important later in Section 2.3 to ensure the discrete logarithm problem in the elliptic curve is hard. Some cryptographic schemes make use of lattices which are discrete subgroups of the subgroups n n·m of R . A lattice can be defined by a generating matrix B 2 R , where each column of B forms a basis element. The lattice is then the set of elements of the form y = B · x where x ranges over all m elements in Z . Since a lattice is discrete it has a well-defined length of the shortest non-zero vector. In Section 2.3 we note that finding this shortest non-zero vector is a hard computational problem. Sampling a uniformly random element from a set A will be denoted by x A. If the set A consists of a single element a we will write this as the assignment x a; with the equality symbol = being reserved for equalities as opposed to assignments. If A is a randomized algorithm, then we write x A(y; r) for the assignment to x of the output of running A on input y with random coins r. 2 Cryptographic Security Models [3, c1–c4][4, c11] Modern cryptography has adopted a methodology of ‘Provable Security’ to define and understand the security of cryptographic constructions. The basic design procedure is to define the syntax for a cryptographic scheme. This gives the input and output behaviours of the algorithms making up the scheme and defines correctness. Then a security model is presented which defines what security goals are expected of the given scheme. Then, given a specific instantiation which meets the given syntax, a formal security proof for the instantiation is given relative to some known hard problems. The security proof is not an absolute guarantee of security. It is a proof that the given instantiation, when implemented correctly, satisfies the given security model assuming some hard problems are indeed hard. Thus, if an attacker can perform operations which are outside the model, or manages 4 to break the underlying hard problem, then the proof is worthless. However, a security proof, with respect to well studied models and hard problems, can give strong guarantees that the given con- struction has no fundamental weaknesses. In the next subsections we shall go into these ideas in more detail, and then give some examples of security statements; further details of the syntax and security definitions can be found in [6, 7]. At a high level the reason for these definitions is that the intuitive notion of a cryptographic construction being secure is not sufficient enough. For example the natural definition for encryption security is that an attacker should be unable to recover the decryption key, or the attacker should be unable to recover a message encrypted under one ciphertext. Whilst these ideas are necessary for any secure scheme they are not sufficient. We need to protect against an attacker aims for find some information about an encrypted message, when the attacker is able to mount chosen plaintext and chosen ciphertext attacks on a legitimate user.