Introduction to Cryptography and Security Mechanisms Dr Keith Martin McCrea

Before we start…

Introduction to Cryptography and Security Mechanisms Quiz 1 Which of the following activities can cryptography not be used to provide in the electronic world? AEnsuring that only an intended recipient can obtain some information BEnsuring that information cannot be altered before it reaches an intended recipient CEnsuring that a sender of some information cannot later deny having sent the information DEnsuring that some received information was sent by the claimed sender

Introduction to Cryptography and Security Mechanisms Quiz 2 Which of the following attacks is the odd one out? ASending a forged message BDeleting the opening phrase of a message CReading a message that was not intended for you DIntercepting a message and destroying it before it gets to the intended recipient

Introduction to Cryptography and Security Mechanisms Quiz 3 Under the worst-case conditions for a symmetric cipher system, we assume that the attacker of a cipher system has access to: AThe encryption algorithm, the encryption key, all ciphertexts BAll ciphertexts, some plaintext/ciphertext pairs, the decryption key CSome plaintext/ciphertext pairs, the encryption algorithm, all previously used decryption keys DThe encryption algorithm, all ciphertexts, some plaintext/ciphertext pairs

Introduction to Cryptography and Security Mechanisms: Unit 4 Historical algorithms Dr Keith Martin McCrea

Introduction to Cryptography and Security Mechanisms Learning Outcomes Describe a number of simple historical cipher systems Relate a number of historical cipher system to the basic model of a cipher system Appreciate the direction of historical advances in cipher system design Illustrate the properties of these historical cipher systems that make them unsuitable for modern use Formulate some essential basic design features for a modern cipher system

Introduction to Cryptography and Security Mechanisms Sections 1.Monoalphabetic ciphers 2.Historical advances

1. Monoalphabetic ciphers

Introduction to Cryptography and Security Mechanisms Ciphers in this unit Please note that all the ciphers in this unit are: Symmetric Operate on alphabetic characters Are not suitable for general modern use However, they allow us to: Illustrate the basic model of a cipher system Learn some basic design principles

Introduction to Cryptography and Security Mechanisms The Caesar Cipher The Caesar Cipher is clearly unsuitable for modern use! Identify at least three cryptographic weaknesses that result in the Caesar Cipher being regarded as insecure.

Introduction to Cryptography and Security Mechanisms The Simple Substitution Cipher The Simple Substitution Cipher is a considerable improvement on the Caesar Cipher What is the main improvement?

Introduction to Cryptography and Security Mechanisms Keyspace of the Substitution Cipher The key space of the Simple Substitution Cipher is approximately 4 x 10 26, that is: Just how big is that? There are an estimated 10 sextillion (that’s ) stars in our universe. That means that the Simple Substitution Cipher has about times the number of keys than there are stars in our universe. The key space of DES is somewhere between and That’s a much smaller number – it’s only about times the number of stars in our galaxy!

Introduction to Cryptography and Security Mechanisms Wise words Having a large key space is necessary to prevent an exhaustive key search, but it is not sufficient to guarantee the security of a cipher system. A large key is not a guarantee of security but a small key is a guarantee of insecurity. In other words (Martin Hellman’s, to be precise…)

Introduction to Cryptography and Security Mechanisms Letter frequency analysis The Substitution Cipher is broken very effectively by letter frequency analysis You obviously need to know some ciphertext to conduct this attack. Identify at least two other pieces of information that it would be useful to know in order to conduct an effective letter frequency analysis of the Simple Substitution Cipher.

Introduction to Cryptography and Security Mechanisms Four lessons 1.The Simple Substitution Cipher leaks information about the plaintext even before detailed letter frequency analysis has been conducted. 2.Knowing the context of the plaintext can be extremely important when conducting letter frequency analysis. 3.Letter frequency analysis really works! 4.It is not necessary to determine the entire key before being able to decrypt the ciphertext. The following four lessons can be learnt if you conduct Exercises 2, 3, 4 and 5 for this unit.

Introduction to Cryptography and Security Mechanisms Unicity distance The unicity distance of a cipher system is the number of ciphertext letters that you need before, given a ciphertext of that length, you can expect there to be only one meaningful plaintext and encryption key that could have been used to obtain that ciphertext. The unicity distance is a value that can be calculated from the statistical properties of the underlying plaintext language. For a Simple Substitution Cipher applied to English plaintexts, the unicity distance is usually regarded as being around 28 ciphertext letters.

Introduction to Cryptography and Security Mechanisms Unicity distance That’s the theory, so what about the practice? If you have 28 ciphertext characters from a Simple Substitution Cipher then you can be fairly sure that there is only one matching plaintext out there. Can you actually find it?

Introduction to Cryptography and Security Mechanisms Unicity distance In theoryNumber of ciphertext letters In practice Less than about 5 Between about 5 and 27 Around 28 = unicity distance Between 28 and about 200 More than about 200

2. Historical advances

Introduction to Cryptography and Security Mechanisms Advances on Simple Substitution Bearing in mind the lessons of the previous section, identify three types of cipher system design improvement that would make it harder to conduct single letter frequency analysis?

Introduction to Cryptography and Security Mechanisms Playfair Cipher The Playfair Cipher operates on pairs of letters (bigrams). The key is a 5x5 square consisting of every letter except J. Before encrypting, the plaintext must be transformed: Replace all J’s with I’s Write the plaintext in pairs of letters… …separating any identical pairs by a Z If the number of letters is odd, add a Z to the end

Introduction to Cryptography and Security Mechanisms Playfair Cipher: Encryption If two plaintext letters lie in the same row then replace each letter by the one on its “right” in the key square If two plaintext letters lie in the same column then replace each letter by the one “below” it in the key square Else, replace: –First letter by letter in row of first letter and column of second letter in the key square –Second letter by letter in column of first letter and row of second letter in the key square

Introduction to Cryptography and Security Mechanisms Playfair Cipher: Example STAND ERCHB KFGIL MOPQU VWXYZ GLOW WORM IK WT TW EO

Introduction to Cryptography and Security Mechanisms Playfair Cipher In what way has the Playfair Cipher defeated single letter frequency analysis? How might you try to decrypt a ciphertext that was encrypted using a Playfair Cipher, without knowing the key?

Introduction to Cryptography and Security Mechanisms English letter frequencies LetterNumberLetterNumberLetterNumber A 8.167B 1.492C2.782 D4.253E12.702F2.228 G2.015H 6.094I6.966 J0.153K 0.772L4.025 M2.406N 6.749O7.507 P1.929Q 0.095R5.987 S6.327T 9.056U2.758 V0.978W 2.360X0.150 Y1.974Z 0.074

Introduction to Cryptography and Security Mechanisms Histogram of letter frequencies

Introduction to Cryptography and Security Mechanisms Homophonic Coding A modification of the Simple Substitution Cipher The idea is to replace some plaintext letters with different ciphertext characters in order to confuse the ciphertext character frequency statistics.

Introduction to Cryptography and Security Mechanisms Homophonic Coding A possible homophonic code is as follows: Use a character alphabet of Use our table of letter frequencies: use 82 different characters to encode A use 15 different characters to encode B use 1 character to encode J, Q, Y and Z etc. How well do you think such a code will hold out against single letter frequency analysis? Do you think that such a code is suitable for adoption in a practical environment?

Introduction to Cryptography and Security Mechanisms Vigenère Cipher The Vigenère Cipher illustrates another important technique for defeating letter frequency analysis. What is it?

Introduction to Cryptography and Security Mechanisms Vigenère Cipher Make sure you understand how the Vigenère Cipher works by conducting Exercises 6, 7, 8 and 9 for this unit. How would you go about breaking the Vigenère Cipher?

Introduction to Cryptography and Security Mechanisms Summary A large key space alone does not guarantee security. It is possible to break a cipher system without first determining the key. The ciphertext produced by a cipher system should disguise the statistics of the plaintext alphabet. Effective techniques for disguising plaintext statistics include: –Increasing the size of the plaintext alphabet –Replacing plaintext characters with more than one different ciphertext character –Introducing positional dependence but these properties alone do not guarantee security.