Dr. Kalpakis CMSC 621, Advanced Operating Systems. Fall 2003 URL: Security & Cryptography

CMSC 621, Fall URL: Protection vs Security The protection mechanisms (ACLs, etc) discussed earlier assist us in preventing unauthorized access and use of computer resources what happens if an intruder bypasses the protection mechanisms? Cryptography can be used so that an intruder is unable to understand or use information obtained without authorization

CMSC 621, Fall URL: Cryptography Terminology Plaintext (or cleartext) is the intelligible message Ciphertext is the unintelligible message Encryption and decryption Are the processes to convert between plaintext and ciphertext Key Is the parameter used in an encryption/decryption algorithm

CMSC 621, Fall URL: Cryptography Terminology Cryptosystem A system for encryption/decryption of information Symmetric cryptosystem use the same key for both encryption and decryption Asymmetric cryptosystem use the different keys for encryption and decryption Cryptology the designing & breaking of cryptosystems Cryptography the practice of using cryptosystems for confidentiallity of information Cryptoanalysis the breaking cryptosystems

CMSC 621, Fall URL: Basic Structure of a Cryptosystem EncryptDecrypt Break Encryption Key K e Decryption Key K d Plaintext M Ciphertext C Plaintext M Side Information Alice Bob Eve

CMSC 621, Fall URL: Basic Attacks to Cryptosystems Cryptosystem attacks are classified based on the amount of side information available to an intruder Attack classification ciphertext-only intruder only has access to the ciphertext known-plaintext intruder has access to the ciphertext and considerable amount of plaintext chosen-plaintext intruder has access to a chosen plaintext and its corresponding ciphertext

CMSC 621, Fall URL: Design Principles for Cryptosystems Shannon’s principles Diffusion principle spread the correlations and dependencies among key and words over the text as much as possible in order to maximize the length of plaintext needed to break the system Confusion principle change a piece of information so that ciphertext has no obvious relationship with plaintext Computational Intractability principle “every” algorithm for determining a key needed to break cryptosystem is “believed” to require exhaustive search of a very large search space

CMSC 621, Fall URL: A Taxonomy of Cryptosystems Conventional systems Modern systems private key systems public key systems

CMSC 621, Fall URL: Conventional Cryptosystems Conventional cryptosystems are based on substitution ciphers Caesar’s cipher E(M) = (M + k) modulo 26 where M is a letter and k=3 is the key Simple substitution cipher E(M) = Key[M] where Key is an arbitrary permutation of a single alphabet Vigenere cipher choose N simple substitution ciphers and encrypt the jth letter using the (j mod N) substitution cipher One-time pad encrypt by Xoring message with a key, whose size equals the size of the message

CMSC 621, Fall URL: DES The Data Encryption Standard (DES) is a modern private-key cryptosystem It is a block cipher that uses two basic operations permutation, and substitution It breaks a message in 64-bit blocks and encrypts/decrypts each block individually It uses a 56-bit secret key, which is expanded to 64-bits using parity bits

CMSC 621, Fall URL: DES Has three stages plaintext block undergoes an initial permutation IP permuted block undergoes for 16 times a complex transformation A block at the ith iteration is broken into two 32-bit blocks Li & Ri transformed block undergoes the inverse IP’ of the permutation IP at the 1st stage DES transformation in the ith iteration, i=1,2,…,16 K i = Phi(Key, i) 48-bit key of ith iteration L i = R i-1 R i = L i xor F (R i-1, K i )

CMSC 621, Fall URL: DES Function F does the following expands R i into a 48-bits quantity E(R i ) by permuting and duplicating some bits of R Xors E(R i ) with K i and partitions the result into eight 6-bit blocks Q 1, Q 2,…,Q 8 passes each Q j 6-bit block through a separate 6-to-4 bit substitution box concatenates all transformed 4-bit Q j blocks and then permutes them

CMSC 621, Fall URL: DES Decryption is done by executing the three stages in reverse order and each time using the inverse function/operation permute cipher text using IP’ undo the 16 transformations, for i=16,15,…,1, using the same keys K 1, K 2, …, K 16 R i-1 = R i L i-1 = R i xor f ( L i, K i ) permute transformed ciphertext with IP For added security, block chaining can be used each plaintext block is Xored with the ciphertext of the previous plaintext block triple encryption (DES does not form a group) Rijdael: new private key standard

CMSC 621, Fall URL: Public-Key Cryptosystems Private key cryptosystems requires a secure mechanism for distributing the private keys to communicating parties Diffie and Hellman proposed public key cryptosystems public key systems make the encryption key publicly available and keep the decryption key secret public key systems are based on the computational intractability principle (using problems such as factoring primes, discrete logarithm, knapsack, etc)

CMSC 621, Fall URL: Public Key Cryptosystems public key systems satisfy the following D SK (E PK (M)) = M for every message M The encryption and decryption functions E and D are computationally efficient Knowledge of E, D, and PK (public key) does not compromise SK (secret key) D PK (E SK (M)) = M for every message M, if message singing/verification is desired

CMSC 621, Fall URL: Trapdoor One-Way Functions One-way functions F F is invertible and easy to compute inverting F is computationally intractable, ie given y finding x such that y=F(x) is believed to be computationally infeasible Trapdoor one-way functions F y=F(x) can be solved efficiently provided some secret information for F is available Diffie and Hellman suggested that one way to implement public key systems is to use trapdoor one-way functions

CMSC 621, Fall URL: Number Theory Background GCD Recursion Theorem & the Extended Euclid’s algorithm

CMSC 621, Fall URL: Number Theory Background Euler’s phi function, Euler’s and Fermat’s Theorems

CMSC 621, Fall URL: Number Theory Background The Chinese Remainder Theorem Origins Sun-Tsu, circa 100 A.D. considered the problem of finding those integers x that leave remainders 2, 3, and 2 when divided by 3, 5, and 7 respectively (which are of the form x=23+105k). Its essence

CMSC 621, Fall URL: Number Theory Background A corollary of the Chinese Remainder Theorem states that

CMSC 621, Fall URL: RSA Rivest, Shamir, and Adleman introduced the RSA public-key cryptosystem based on Diffie and Hellman RSA works as follows

CMSC 621, Fall URL: RSA RSA’s encryption function is E PK (M) = M e mod n where PK=(e,n) RSA’s decryption function is D SK (M) = M d mod n where SK=(d,n) these two encryption/decryption functions satisfy D SK (E PK (M)) = M D PK (E SK (M)) = M can be computed efficiently given PK or SK knowledge of PK does not compromise SK

CMSC 621, Fall URL: RSA Correctness of RSA is based on Fermat’s theorem and on the Chinese Remainder Theorem Example values for RSA choose p=5 and q=11 set n=55 and N=40 choose d=23 compute e=7 using the extended Euclid algorithm encrypt M=8 to 2 using “repeated squaring”

CMSC 621, Fall URL: RSA A more realistic example set of values for RSA (courtesy of Prof. Stephens) n = p = q = e = d = sqrt(n) approximately = number of positive integers < n that are relative prime to n is equal to phi(n) phi(n) =

CMSC 621, Fall URL: Authentication Objective verify the identity of communicating entities Authentication services interactive communication (synchronous) one-way communication (asynchronous) signed communication (verifiable conversation by third party) Potential threats altering messages replaying old messages denial of service interference with ongoing communication impersonation

CMSC 621, Fall URL: Interactive Communication Protocols Require an authoritative Authentication Server (AS) for securely distributing conversation keys Each user registers its secret key with the AS, which is shared only between the AS and the user, and their public key if any Requirements – use case Alice wants to communicate with Bob so that the message is intelligible to Bob, but not Eve it should be evident that the message was sent by Alice, and that is not a replay of an older message from Alice

CMSC 621, Fall URL: Interactive Communication with Private Key Systems Alice wants to converse with Bob Denning-Sacco’s modification to handle compromised conversation keys A message is not a reply attack if |LocalClock-T|<LocalClock’s disrepancy from AS’s clock plus the estimated maximum network delay

CMSC 621, Fall URL: Interactive Communication with Public Key Systems Alice wants to communicate with Bob

CMSC 621, Fall URL: One-Way Communication with Private Key Systems Alice wants to message M to Bob Bob should be able to authenticate integrity of Alice’s message even if Alice is not currently available Eve should not be able to impersonate Alice Protocol is succeptible to playback attacks

CMSC 621, Fall URL: One-Way Communication with Public Key Systems Alice wants to message M to Bob

CMSC 621, Fall URL: Digital Signatures Must satisfy the following a user can not forge signatures sender of signed message can not deny the validity of his signature receipient can not modify the signature of a signed message

CMSC 621, Fall URL: Digital Signatures using Private Key Systems Alice wants to sign a message to be sent to Bob

CMSC 621, Fall URL: Digital Signatures using Public Key Systems Alice wants to sign a message to be sent to Bob

CMSC 621, Fall URL: Kerberos An authentication system for an open network computing environment where user’s machines are under their complete control and can not be trusted to identify users to network services Consists of Client (C) Kerberos Server (K) Ticket Granting Server (TGS) Server (S) User (U)

CMSC 621, Fall URL: Kerberos Phase I: Getting the Initial Ticket User provides the Client machine his/her identity Client sends to Kerberos server K the msg Kerberos server K Client upon receipt of msg

CMSC 621, Fall URL: Kerberos, Phase II: Getting a Server Ticket User/Client wants to use a network service S Ticket Granting Server TGS Client upon receiving msg from TGS

CMSC 621, Fall URL: Kerberos, Phase III: Requesting a Service Client requests service from server S Service server S upon receipt of the msg