EEC 693/793 Special Topics in Electrical Engineering Secure and Dependable Computing Lecture 5 Wenbing Zhao Department of Electrical and Computer Engineering Cleveland State University

2 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Outline Vernam cipher Stream and block Ciphers Confusion and diffusion Symmetric-key algorithms Cipher modes

3 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao The Vernam Cipher - Example Plaintext VERNAMCIPHER Numeric Equivalent Random Number = Sum = mod Ciphertext tahrspitxmab

4 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao The Vernam Cipher - Decryption To decrypt: (C i – K i ) mod 26 –Note on rules of mod on negative number: “The mod function is defined as the amount by which a number exceeds the largest integer multiple of the divisor that is not greater than that number” ( –Modula op always return non-negative number –E.g., (19-76) mod 26 = (-57) mod 26 = (-78+21) mod 26 = 21

5 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao The Vernam Cipher - Decryption Ciphertext tahrspitxmzb Numeric equivalent One-time pad = Difference = mod Plaintext VERNAMCIPHER

6 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao EEC693 Hall of Fame Rajamani Aravinda Bhadriraju –For providing a decryption method for the Vernam cipher Ketan Patel –For asking me a technical question (how to decrypt Vernam cipher) that I could not answer immediately Sritambari Thakur –For noticing an inconsistency regarding the Vernam cipher example Sai Vinay Veeramachamaneni –For providing the first independent mathematical proof for the decryption method for the Vernam cipher

7 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Stream Ciphers Stream ciphers: convert one symbol of plaintext immediately into a symbol of ciphertext –The transformation depends only on the symbol, the key, and the control information of the encryption algorithm

8 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Block Ciphers Block cipher: encrypts a group of plaintext symbols as one block –It works on blocks of plaintext and produce blocks of ciphertext –The columnar transposition is an example of block ciphers

9 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Confusion and Diffusion Confusion: the interceptor should not be able to predict what will happen to the ciphertext by changing one character in the plaintext –An algorithm providing good confusion has a complex functional relationship between the plaintext/key pair and the ciphertext –Question: Does Caesar cipher provide good confusion?

10 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Confusion and Diffusion Diffusion: distributing the information from single plaintext letters over the entire output –Good diffusion means that the interceptor needs access to much of the ciphertext to be able to infer the algorithm Question: Which one provides better diffusion? –Substitution cipher –Transposition cipher

11 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Cryptanalysis – Breaking Encryption Schemes Ciphertext-only: cryptanalyst has a quantity of ciphertext and no plaintext Known plaintext: cryptanalyst has some matched ciphertext and plaintext Chosen plaintext: cryptanalyst has the ability to encrypt pieces of plaintext of his own choosing

12 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Symmetric-Key Algorithms DES – The Data Encryption Standard AES – The Advanced Encryption Standard Cipher Modes Other Ciphers

13 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Data Encryption Standard Developed by IBM. US standard for unclassified info (1977) Same key for encryption as for decryption Encrypts in 64-bit blocks Uses 56-bit key Has 19 stages, 16 parameterized by different functions of the key

14 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Triple DES Triple DES – effectively increases the key length. It uses two keys and three stages –In first stage, the plaintext is encrypted using DES in the usual way with K 1 –In second stage, DES is run in decryption mode, using K 2 as the key –In third stage, another DES encryption is done with K 1 Triple DES encryption Triple DES decryption

15 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao AES – The Advanced Encryption Standard AES is a result of a cryptographic contest –Organized by NIST in 1997 Rules for AES proposals 1.The algorithm must be a symmetric block cipher 2.The full design must be public 3.Key lengths of 128, 192, and 256 bits supported 4.Both software and hardware implementations required 5.The algorithm must be public or licensed on nondiscriminatory terms Winner: Rijndael (from two Belgian cryptographers: Joan Daemen and Vincent Rijmen)

16 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Other Symmetric-Key Ciphers

17 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Cipher Modes Despite all the complexity, AES and DES (or any block cipher) is basically a monoalphabetic substitution cipher using big characters –Whenever the same plaintext block goes in the front end, the same ciphertext block comes out the back end –If you encrypt the plaintext abcdefgh 100 times with same DES key, you get the same ciphertext 100 times –An intruder can exploit this property to help subvert the cipher

18 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Electronic Code Book Mode In ECB mode, each plaintext block is encrypted independently with the block cipher ECB allows easy parallelization to yield higher performance. However, no processing is possible before a block is seen

19 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Electronic Code Book Mode - Problems In ECB, plaintext patterns are not concealed –Each identical block of plaintext gives an identical block of ciphertext. The plaintext can be easily manipulated by removing, repeating, or interchanging blocks Example

20 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Cipher Block Chaining Mode To avoid the ECB mode problem: replacing a block will cause the plaintext decrypted starting at the replaced to become garbage Exclusive OR the encrypted text with the next block of plaintext before encryption: C 0 = E(P 0 XOR IV), C 1 = E(P 1 XOR C 0 ), etc. Drawback: must wait until full 64-bit (128-bit) block to arrive to decrypt

21 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Cipher Block Chaining Mode Exclusive OR the encrypted text with the next block of plaintext before encryption: C 0 = E(P 0 XOR IV), C 1 = E(P 1 XOR C 0 ), etc. Initialization Vector Encryption Decryption

22 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Cipher Feedback Mode To enable byte-by-byte encryption –When plaintext byte n (P n ) arrives, DES algorithm operates a 64-bit register to generate a 64-bit ciphertext –Leftmost byte of that ciphertext is extracted and XORed with P n –That byte is transmitted on the transmission line –The shift register is shifted left 8 bits, causing C n-8 to fall off the left end, and C n is inserted in the position just vacated at the right end by C 9 Drawback: One byte of transmission error will ruin 8 bytes of data

23 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Cipher Feedback Mode Encryption Decryption

24 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Stream Cipher Mode To be insensitive to transmission error, an arbitrarily large sequence of output blocks, called the keystream, is treated like a one-time pad and XORed with the plaintext to get the ciphertext –It works by encrypting an IV, using a key to get an output block –The output block is then encrypted, using the key to get a second output block –This block is then encrypted to get a third block, and so on The keystream is independent of the data, so (1) It can be computed in advance (2) It is completely insensitive to transmission errors

25 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Stream Cipher Mode Encryption Decryption

26 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Stream Cipher Mode It is essential never to use the same (key, IV) pair twice with a stream cipher because doing so will generate the same keystream each time Using the same keystream twice exposes the ciphertext to a keystream reuse attack Stream cipher mode is also called output feedback mode

27 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Keystream Reuse Attack Plaintext block, P0, is encrypted with the keystream to get P0 XOR K0 Later, a second plaintext block, Q0, is encrypted with the same keystream to get Q0 XOR K0 An intruder who captures both ciphertext blocks can simply XOR them together to get P0 XOR Q0, which eliminates the key The intruder now has the XOR of the two plaintext blocks If one of them is known or can be guessed, the other can also be found In any event, the XOR of two plaintext streams can be attacked by using statistical properties of the message

28 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Counter Mode To allow random access to encrypted data –The IV plus a constant is encrypted, and the resulting ciphertext XORed with the plaintext –By stepping the IV by 1 for each new block, it is easy to decrypt a block anywhere in the file without first having to decrypt all of its predecessors