Overview of Cryptography and Its Applications Dr. Monther Aldwairi New York Institute of Technology- Amman Campus INCS741: Cryptography

Motivation Historically Kings communicated with their generals using cryptographic methods. – Julius Caesar used a cipher named after him. Today with the advent of the Internet electronic services are integral part of our daily life – Exchanging payment in formation is vital for internet economy It’s empirical to protect electronic information

Terminology Cryptology is the all-inclusive term used for the study of secure communication over non-secure channels and related problems. Cryptography is the process of designing systems to realize secure communications over non- secure channels. Cryptanalysis deals with breaking cryptosystems. Coding Theory deals with symbolic representation of input information using symbols, often called codes such as – Compression, secrecy and error-correction.

Code Vs Cipher Code is replacing message words by codewords or symbols – Unanticipated words cannot be used Cipher is Encrypting the message using some algorithm – Stream Ciphers. Data fed to the algorithm in small chunks (bits, chars) – Block Ciphers. Data fed to the algorithm in blocks

Secure Communications Scenario Plain text

Security Issues 1.Read the message 2.Find the key and read all the encrypted messages 3.Integrity: Corrupt or modify the content of the message in such a way that Bob will think Alice sent the altered message. 4.Authentication: Impersonate Alice and communicate with Bob Oscar is a passive observer who is trying to perform (1) and (2). Mallory is more active and malicious who is trying to perform (3) And (4).

Possible Attacks 1.Ciphertext only: Eve has only a copy of ciphertext 2.Known Plaintext: Eve has a copy of ciphertext and the corresponding plaintext and tries the deduce the key. 3.Chosen Plaintext: Eve has temporary access to the encryption machine/algorithms. – She can encrypt large number of plaintexts and use them to deduce the key. 4.Chosen Ciphertext: Eve has temporary access to the decryption machine. – She can decrypt large number of ciphertexts and symbols and use them to deduce the key.

Kerckhoff’s and Shannon Principles A cryptosystem should be secure even if everything about the system, except the key, is public knowledge. The enemy knows the system edge. The security of the system, therefore, should be based 1.key length 2.The quality of the algorithm.

Symmetric Key Cryptography Encryption and decryption keys are known to both communicating parties (Alice and Bob). – A Secret key should be shared (or agreed) b/w the communicating parties. They are usually related and it is easy to derive the decryption key once one knows the encryption key. – In most cases, they are identical. All of the classical (pre-1970) cryptosystems are symmetric – Such as DES and AES (Rijndael)

Public Key Cryptography Encryption Key is made public! Public Key. Decryption Key is kept private. Private Key – Sender encrypts the message by the Public Key of the receiver – Only the receiver can decrypt the message by her/his Private Key Computationally expensive to find the Decryption Key from the Encryption Key – Such as RSA, Discrete Logarithm and Elliptic Curve Used to encrypt small amounts of data (key exchange or signatures)

Key Length The security of cryptographic algorithms is hard to measure. – How difficult is it for an adversary to find the key – The key should be large enough to prevent brute force or exhaustive search attack. – The adversary to determine the key simply by trying all possible keys in the key space. For example, DES utilizes 56-bit key, therefore there are 2 56 (or approx 7.2 x ) possible keys in the key space.

Key Length For a cryptanalyst, brute force should be the last choice. – He needs to take advantage of the weakness in the algorithm or in it’s implementation, in order to reduce the possible keys to try out. Longer keys do not necessarily improve the security Once secure is not always secure

Unbreakable Cryptosystems Almost all of the practical cryptosystems are theoretically breakable given the time and computational resources However, there is one system which is even theoretically unbreakable: One-time-pad. – One-time pad requires exchanging key that is as long as the plaintext. – However impractical, it is still being used in certain applications which necessitate very high-level security. Security of one-time pad systems relies on the condition that keys are generated using truly random sources.

Cryptographic Objectives Confidentiality – Hiding the contents of the messages exchanged. Integrity – Bob wants to make sure that Alice’s massage hasn’t been altered Authentication – Bob wants to make sure that Alice could have sent the message he received. 1.Identification: Identity of the sender. 2.Data-origin authentication: data origin, creator and time. Non-repudiation – Alice can’t deny sending the message.