CSCI283 Fall 2005 GWU All slides from Bishop’s slide set Stream Ciphers

6/4/2015CS283/Fall05/GWU/Vora/PKI All slides from Bishop's set2 Problems Using cipher requires knowledge of environment, and threats in the environment, in which cipher will be used –Is the set of possible messages small? –Do the messages exhibit regularities that remain after encipherment? –Can an active wiretapper rearrange or change parts of the message?

6/4/2015CS283/Fall05/GWU/Vora/PKI All slides from Bishop's set3 Attack #1: Precomputation Set of possible messages M small Public key cipher f used Idea: precompute set of possible ciphertexts f(M), build table (m, f(m)) When ciphertext f(m) appears, use table to find m Also called forward searches

6/4/2015CS283/Fall05/GWU/Vora/PKI All slides from Bishop's set4 Example Cathy knows Alice will send Bob one of two messages: enciphered BUY, or enciphered SELL Using public key e Bob, Cathy precomputes m 1 = { BUY } e Bob, m 2 = { SELL } e Bob Cathy sees Alice send Bob m 2 Cathy knows Alice sent SELL

6/4/2015CS283/Fall05/GWU/Vora/PKI All slides from Bishop's set5 May Not Be Obvious Digitized sound –Seems like far too many possible plaintexts –Initial calculations suggest 2 32 such plaintexts –Analysis of redundancy in human speech reduced this to about 100,000 (≈ 2 17 ) –This is small enough to worry about precomputation attacks

6/4/2015CS283/Fall05/GWU/Vora/PKI All slides from Bishop's set6 Misordered Blocks Alice sends Bob message –n Bob = 77, e Bob = 17, d Bob = 53 –Message is LIVE ( ) –Enciphered message is Eve intercepts it, rearranges blocks –Now enciphered message is Bob gets enciphered message, deciphers it –He sees EVIL

6/4/2015CS283/Fall05/GWU/Vora/PKI All slides from Bishop's set7 Notes Digitally signing each block won’t stop this attack Two approaches: –Cryptographically hash the entire message and sign it –Place sequence numbers in each block of message, so recipient can tell intended order –Then you sign each block

6/4/2015CS283/Fall05/GWU/Vora/PKI All slides from Bishop's set8 Statistical Regularities If plaintext repeats, ciphertext may too Example using DES: –input (in hex): –corresponding output (in hex): ef7c 4bb2 b4ce 6f3b Fix: cascade blocks together (chaining) –More details later

6/4/2015CS283/Fall05/GWU/Vora/PKI All slides from Bishop's set9 What These Mean Use of strong cryptosystems, well-chosen (or random) keys not enough to be secure Other factors: –Protocols directing use of cryptosystems –Ancillary information added by protocols –Implementation (not discussed here) –Maintenance and operation (not discussed here)

6/4/2015CS283/Fall05/GWU/Vora/PKI All slides from Bishop's set10 Stream, Block Ciphers E encipherment function –E k (b) encipherment of message b with key k –In what follows, m = b 1 b 2 …, each b i of fixed length Block cipher –E k (m) = E k (b 1 )E k (b 2 ) … Stream cipher –k = k 1 k 2 … –E k (m) = E k1 (b 1 )E k2 (b 2 ) … –If k 1 k 2 … repeats itself, cipher is periodic and the length of its period is one cycle of k 1 k 2 …

6/4/2015CS283/Fall05/GWU/Vora/PKI All slides from Bishop's set11 Stream Ciphers Often (try to) implement one-time pad by xor’ing each bit of key with one bit of message –Example: m = k = c = But how to generate a good key?

6/4/2015CS283/Fall05/GWU/Vora/PKI All slides from Bishop's set12 Synchronous Stream Ciphers n-stage Linear Feedback Shift Register: consists of –n bit register r = r 0 …r n–1 –n bit tap sequence t = t 0 …t n–1 –Use: Use r n–1 as key bit Compute x = r 0 t 0  …  r n–1 t n–1 Shift r one bit to right, dropping r n–1, x becomes r 0

6/4/2015CS283/Fall05/GWU/Vora/PKI All slides from Bishop's set13 Operation r0r0 r n–1 … bibi … …  cici r0´r0´ r n–1 ´ … r i ´ = r i–1, 0 < i ≤ n r 0 t 0 + … + r n–1 t n–1

6/4/2015CS283/Fall05/GWU/Vora/PKI All slides from Bishop's set14 Example 4-stage LFSR; t = 1001 rk i new bit computationnew r  00  10  01 =  00  00  11 =  00  00  01 =  10  00  01 =  10  10  01 =  10  10  11 =  10  10  11 = Key sequence has period of 15 ( )

6/4/2015CS283/Fall05/GWU/Vora/PKI All slides from Bishop's set15 NLFSR n-stage Non-Linear Feedback Shift Register: consists of –n bit register r = r 0 …r n–1 –Use: Use r n–1 as key bit Compute x = f(r 0, …, r n–1 ); f is any function Shift r one bit to right, dropping r n–1, x becomes r 0 Note same operation as LFSR but more general bit replacement function

6/4/2015CS283/Fall05/GWU/Vora/PKI All slides from Bishop's set16 Example 4-stage NLFSR; f(r 0, r 1, r 2, r 3 ) = (r 0 & r 2 ) | r 3 rk i new bit computationnew r 11000(1 & 0) | 0 = (0 & 1) | 0 = (0 & 1) | 1 = (1 & 0) | 1 = (1 & 0) | 0 = (0 & 1) | 0 = (0 & 1) | 1 = Key sequence has period of 4 (0011)

6/4/2015CS283/Fall05/GWU/Vora/PKI All slides from Bishop's set17 Eliminating Linearity NLFSRs not common –No body of theory about how to design them to have long period Alternate approach: output feedback mode –For E encipherment function, k key, r register: Compute r= E k (r); key bit is rightmost bit of r Set r to r and iterate, repeatedly enciphering register and extracting key bits, until message enciphered –Variant: use a counter that is incremented for each encipherment rather than a register Take rightmost bit of E k (i), where i is number of encipherment

6/4/2015CS283/Fall05/GWU/Vora/PKI All slides from Bishop's set18 Self-Synchronous Stream Cipher Take key from message itself (autokey) Example: Vigenère, key drawn from plaintext –keyXTHEBOYHASTHEBA –plaintextTHEBOYHASTHEBAG –ciphertextQALFPNFHSLALFCT Problem: –Statistical regularities in plaintext show in key –Once you get any part of the message, you can decipher more

6/4/2015CS283/Fall05/GWU/Vora/PKI All slides from Bishop's set19 Another Example Take key from ciphertext (autokey) Example: Vigenère, key drawn from ciphertext –keyXQXBCQOVVNGNRTT –plaintextTHEBOYHASTHEBAG –ciphertextQXBCQOVVNGNRTTM Problem: –Attacker gets key along with ciphertext, so deciphering is trivial

6/4/2015CS283/Fall05/GWU/Vora/PKI All slides from Bishop's set20 Variant Cipher feedback mode: 1 bit of ciphertext fed into n bit register –Self-healing property: if ciphertext bit received incorrectly, it and next n bits decipher incorrectly; but after that, the ciphertext bits decipher correctly –Need to know k, E to decipher ciphertext k E k (r) r …E …  mimi cici