Lecture 9 Overview

RSA Invented by Cocks (GCHQ), independently, by Rivest, Shamir and Adleman (MIT) Two keys e and d used for Encryption and Decryption – The keys are interchangeable M = D(d, E(e, M) ) = D(e, E(d, M) ) – Public key encryption Based on problem of factoring large numbers – Not in NP-complete – Best known algorithm is exponential 2 CS 450/650 Lecture 9: RSA

RSA To encrypt message M compute – c = M e mod N To decrypt ciphertext c compute – M = c d mod N 3 CS 450/650 Lecture 9: RSA

Let p and q be two large prime numbers Let N = pq Choose e relatively prime to (p  1)(q  1) – a prime number larger than p-1 and q-1 Find d such that ed mod (p  1)(q  1) = 1 Key Choice 4 CS 450/650 Lecture 9: RSA

RSA Recall that e and N are public If attacker can factor N, he can use e to easily find d – since ed mod (p  1)(q  1) = 1 Factoring the modulus breaks RSA It is not known whether factoring is the only way to break RSA 5 CS 450/650 Lecture 9: RSA

Does RSA Really Work? Given c = M e mod N we must show – M = c d mod N = M ed mod N We’ll use Euler’s Theorem – If x is relatively prime to N then x  (N) mod N =1  (n): number of positive integers less than n that are relatively prime to n. If p is prime then,  (p) = p-1 6 CS 450/650 Lecture 9: RSA

Does RSA Really Work? Facts: – ed mod (p  1)(q  1) = 1 – ed = k(p  1)(q  1) + 1by definition of mod –  (N) = (p  1)(q  1) – Then ed  1 = k(p  1)(q  1) = k  (N) M ed = M (ed-1)+1 = M  M ed-1 = M  M k  (N) = M  (M  (N) ) k mod N = M  1 k mod N = M mod N 7 CS 450/650 Lecture 9: RSA

More Efficient RSA Modular exponentiation example – 5 20 = = 25 mod 35 A better way: repeated squaring – Note that 20 = 2  10, 10 = 2  5, 5 = 2  2 + 1, 2 = 1  2 – 5 1 = 5 mod 35 – 5 2 = (5 1 ) 2 = 5 2 = 25 mod 35 – 5 5 = (5 2 ) 2  5 1 = 25 2  5 = 3125 = 10 mod 35 – 5 10 = (5 5 ) 2 = 10 2 = 100 = 30 mod 35 – 5 20 = (5 10 ) 2 = 30 2 = 900 = 25 mod 35 No huge numbers and it’s efficient! CS 450/650 Lecture 9: RSA 8

Symmetric vs Asymmetric Secret Key (Symmetric)Public Key (Asymmetric) Number of keys12 Protection of keyMust be kept secretOne key must be kept secret; the other can be freely exposed Best usesCryptographic workhorse; secrecy and integrity of datasingle characters to blocks of data, messages, files Key exchange, authentication Key distributionMust be out-of-bandPublic key can be used to distribute other keys SpeedFastSlow; typically, 10,000 times slower than secret key CS 450/650 Fundamentals of Integrated Computer Security 9

Lecture 10 Cryptographic Hash Functions CS 450/650 Fundamentals of Integrated Computer Security Slides are modified from Hesham El-Rewini

Cryptographic Hash Functions Message Digest Functions – Protect integrity – Create a message digest or fingerprint of a digital document – MD4, MD5, SHA Message Authentication Codes (MACs) – Protect both integrity and authenticity – Produce fingerprints based on both a given document and a secret key CS 450/650 Lecture 10: Hash Functions 11

Message Digest Functions Checksums  fingerprint of a message – If message changes, checksum will not match Most checksums are good in detecting accidental changes made to a message – They are not designed to prevent an adversary from intentionally changing a message resulting a message with the same checksum Message digests are designed to protect against this possibility CS 450/650 Lecture 10: Hash Functions 12

One-Way Hash Functions Example M = “Elvis” H(M) = (“E” + “L” + “V” + “I” + “S”) mod 26 H(M) = ( ) mod 26 H(M) = 67 mod 26 H(M) = 15 H M H(M) = h CS 450/650 Lecture 10: Hash Functions 13

Collision Example x = “Viva” Y = “Vegas” H(x) = H(y) = 2 H xH(x) H yH(y) = CS 450/650 Lecture 10: Hash Functions 14

Collision-resistant, One-way hash fnc. Given M, – it is easy to compute h Given any h, – it is hard to find any M such that H(M) = h Given M1, it is difficult to find M2 – such that H(M1) = H(M2) Functions that satisfy these criteria are called message digest – They produce a fixed-length digest (fingerprint) CS 450/650 Lecture 10: Hash Functions 15

Message Authentication Codes A message authentication code (MAC) is a key-dependent message digest function – MAC(M,k) = h CS 450/650 Lecture 10: Hash Functions 16

A MAC Based on a Block Cipher M1 Encrypt k M1 Encrypt k XOR M1 Encrypt k XOR … MAC CS 450/650 Lecture 10: Hash Functions 17

Secure Hash Algorithm (SHA)

SHA SHA SHA – SHA-224, SHA-256, SHA-384, SHA-512 SHA-1 A message composed of b bits 160-bit message digest CS 450/650 Lecture 8: Secure Hash Algorithm 19

Step 1 -- Padding Padding  the total length of a padded message is multiple of 512 – Every message is padded even if its length is already a multiple of 512 Padding is done by appending to the input – A single bit, 1 – Enough additional bits, all 0, to make the final 512 block exactly 448 bits long – A 64-bit integer representing the length of the original message in bits CS 450/650 Lecture 8: Secure Hash Algorithm 20

Padding (cont.) MessageMessage length10…0 64 bits Multiple of bit CS 450/650 Lecture 8: Secure Hash Algorithm 21

Example M = (20 bits) Padding is done by appending to the input – A single bit, 1 – 427 0s – A 64-bit integer representing 20 Pad(M) = …

Example Length of M = 500 bits Padding is done by appending to the input: – A single bit, 1 – 459 0s – A 64-bit integer representing 500 Length of Pad(M) = 1024 bits

Step 2 -- Dividing Pad(M) Pad (M) = B 1, B 2, B 3, …, B n Each B i denote a 512-bit block Each B i is divided into bit words – W 0, W 1, …, W 15 CS 450/650 Lecture 8: Secure Hash Algorithm 24

Step 3 – Compute W 16 – W 79 To Compute word W j (16<=j<=79) – W j-3, W j-8, W j-14, W j-16 are XORed – The result is circularly left shifted one bit CS 450/650 Lecture 8: Secure Hash Algorithm 25

Initialize 32-bit words A = H 0 = B = H 1 = EFCDAB89 C = H 2 = 98BADCFE D = H 3 = E = H 4 = C3D2E1F0 K 0 – K 19 = 5A K 20 – K 39 = 6ED9EBA1 K 40 – K 49 = 8F1BBCDC K 60 – K 79 = CA62C1D6 CS 450/650 Lecture 8: Secure Hash Algorithm 26

Step 5 – Loop For j = 0 … 79 TEMP = CircLeShift_5 (A) + f j (B,C,D) + E + W j + K j E = D; D = C; C = CircLeShift_30(B); B = A; A = TEMP Done +  addition (ignore overflow) CS 450/650 Lecture 8: Secure Hash Algorithm 27

Four functions For j = 0 … 19 – f j (B,C,D) = (B AND C) OR (B AND D) OR (C AND D) For j = 20 … 39 – f j (B,C,D) = (B XOR C XOR D) For j = 40 … 59 – f j (B,C,D) = (B AND C) OR ((NOT B) AND D) For j = 60 … 79 – f j (B,C,D) = (B XOR C XOR D) CS 450/650 Lecture 8: Secure Hash Algorithm 28

Step 6 – Final H 0 = H 0 + A H 1 = H 1 + B H 2 = H 2 + C H 3 = H 3 + D H 4 = H 4 + E CS 450/650 Lecture 8: Secure Hash Algorithm 29

Done Once these steps have been performed on each 512-bit block (B 1, B 2, …, B n ) of the padded message, – the 160-bit message digest is given by H 0 H 1 H 2 H 3 H 4 CS 450/650 Lecture 8: Secure Hash Algorithm 30

SHA Output size (bits) Internal state size (bits) Block size (bits) Max message size (bits) Word size (bits) RoundsOperations Collisions found SHA − , and, or, xor, rot Yes SHA − , and, or, xor, rot None (2 51 attack) SHA-2 256/ − , and, or, xor, shr, rot None 512/ − , and, or, xor, shr, rot None CS 450/650 Lecture 8: Secure Hash Algorithm 31