David Evans CS551: Security and Privacy University of Virginia Computer Science Lecture 2: Breaking Unbreakable Ciphers Confronted with the prospect of defeat, the Allied cryptanalysts had worked night and day to penetrate German ciphers. It would appear that fear was the main driving force, and that adversity is one of the foundations of successful codebreaking. Simon Singh, The Code Book

30 Aug 2000University of Virginia CS 5512 Menu Survey Results Vigenère – “Le Chiffre Indéchiffrable” Shannon Principles: Perfect Ciphers

30 Aug 2000University of Virginia CS 5513 Survey Results Forged 15 out of 41 Broken into systems: 8 out of 41 PGP: 1 regular, 3 occasional Movies/Books: Sneakers (14), Hackers (4), Mission Impossible (2), Wargames (2), Cryptonomicon (2), Matrix, Takedown, Enemy of the State, Cuckoo’s Egg, Maximum Security, The Net

30 Aug 2000University of Virginia CS 5514 Vigenère Invented by Blaise de Vigenère, ~1550 Considered unbreakable for 300 years Broken by Charles Babbage but kept secret to help British in Crimean War Attack discovered independently by Friedrich Kasiski, 1863.

30 Aug 2000University of Virginia CS 5515 Vigenère Encryption Key is a N -letter string. E K (P) = C where C i = (P i + K i mod N ) mod Z (size of alphabet) E “KEY” (“test”) = DIQD C 0 = (‘t’ + ‘K’) mod 26 = ‘D’ C 1 = (‘e’ + ‘E’) mod 26 = ‘I’ C 2 = (‘s’ + ‘Y’) mod 26 = ‘Q’ C 3 = (‘t’ + ‘K’) mod 26 = ‘D’

30 Aug 2000University of Virginia CS 5516 Babbage’s Attack Use repetition to guess key length: Sequence XFO appears at 65, 71, 122, 176. Spacings = (71 – 65) = 6 = 3 * 2 (122 – 65) = 57 = 3 * 19 (176 – 122) = 54 = 3 * 18 Key is probably 3 letters long.

30 Aug 2000University of Virginia CS 5517 Key length - Frequency Once you know key length, can slice ciphertext and use frequencies: L 0 : DLQLCNSOLSQRNKGBSEVYNDOIOXAXYRSOSGYKY VZXVOXCDNOOSOCOWDKOOYROEVSRBXENI Frequencies: O: 12, S: 7, Guess O = e C i = (P i + K i mod N ) mod Z ‘ O’ = (‘e’ + K 0 ) mod = => K 0 = ‘K’

30 Aug 2000University of Virginia CS 5518 Sometimes, not so lucky... L 1 : LMISQITVYJSSSJAHYECYSXOXGWYGJMRRXEGWRPEJXSI SLIGHTVSXILWHXYXJPERISWTM S: 9, X: 7; I: 6 guess S = ‘e’ ‘S’ = (‘e’ + K 1 ) mod = => K 1 = ‘N’ ‘X’ = (‘e’ + K 1 ) mod = => K 1 = ‘M’ ‘I’ = (‘e’ + K 1 ) mod = => K 1 = ‘E’

30 Aug 2000University of Virginia CS 5519

30 Aug 2000University of Virginia CS Vigenère Simplification Use binary alphabet: C i = (P i + K i mod N ) mod 2 C i = P i  K i mod N Use a key as long as P: C i = P i  K i One-time pad – perfect cipher!

30 Aug 2000University of Virginia CS Ways to Convince “I tried really hard to break my cipher, but couldn’t. I’m a genius, so I’m sure no one else can break it either.” “Lots of really smart people tried to break it, and couldn’t.” Mathematical arguments – key size (dangerous!), statistical properties of ciphertext, depends on some provably (or believed) hard problem Invulnerability to known cryptanalysis techniques (but what about undiscovered techniques?) Show that ciphertext could match multiple reasonable plaintexts without knowing key Simple monoalphabetic secure for about 10 letters of English: XBCF CF FWPHGW This is secure Spat at troner

30 Aug 2000University of Virginia CS Real World Standard Attacker probably has details of algorithm Attacker has a limited amount of ciphertext, often has known plaintext, occasionally has chosen plaintext Breaking a cipher means the attacker can read a secret message

30 Aug 2000University of Virginia CS “Academic” Standard Assume attacker has full details of the algorithm Assume attacker has an unlimited number of chosen plaintext/ciphertext pairs Assume attacker can perform a very large number of computations, up to, but not including, 2 n, where n is the key size in bits (i.e. assume that the attacker can’t mount a brute force attack, but can get close).

30 Aug 2000University of Virginia CS Shannon’s Theory [1945] Message space: { M 1, M 2,..., M n } Assume finite number of messages Each message has probability p(M 1 ) + p(M 2 ) p(M n ) = 1 Key space: { K 1, K 2,..., K l } (Based on Eli Biham’s notes)

30 Aug 2000University of Virginia CS Perfect Cipher: Definition M1M1 M2M2 MnMn C1C1 C2C2 CnCn KaKa... KbKb A perfect cipher: there is some key that maps any message to any ciphertext with equal probability. For any i, j: p (M i |C j ) = p (M i )

30 Aug 2000University of Virginia CS Perfect Cipher Definition:  i, j : p (M i |C j ) = p (M i ) p(M) p(C | M) = p(C) p(M | C) So, a cipher is perfect iff:  M, Cp(C) = p (C | M) =  p(K) E K (M) = C K Sum over all keys such that E K (M) = C.

30 Aug 2000University of Virginia CS Perfect Cipher So, a cipher is perfect iff:  M, Cp(C) =  p(K) E K (M) = C Or:  C  p(K) is independent of M E K (M) = C Without knowing anything about the key, any ciphertext is equally likely to match and plaintext. K K

30 Aug 2000University of Virginia CS Example: Monoalphabetic Random monoalphabetic substitution for one letter message:  C,M: p(C) = p(C | M) = 1/26.

30 Aug 2000University of Virginia CS Example: One-Time Pad For each bit: p(C i = 0) = p(C i = 0 | M i = 0) = p(C i = 0 | M i = 1) = ½ since C i = K i  M i p (K i  M i = 0) = p (K i = 1) * p (M i = 1) + p (K i = 0) * p (M i = 0) Truly random K means p (K i = 1) = p (K i = 0) = ½ = ½ * p (M i = 1) + ½ * p (M i = 0) = ½ * (p (M i = 1) + p (M i = 0)) = ½ All key bits are independent, so: p(C) = p(C | M)QED.

30 Aug 2000University of Virginia CS Perfect Cipher Keyspace Theorem Theorem: If a cipher is perfect, there must be at least as many keys ( l ) are there are possible messages ( n ).

30 Aug 2000University of Virginia CS Proof by Contradiction Suppose there is a perfect cipher with l < n. (More messages than keys.) Let C 0 be some ciphertext with p(C 0 ) > 0. There exist m messages M such that M = D K (C 0 ) n - m messages M 0 such that M 0  D K (C 0 ) We know 1  m  l 0 and there is at least one message M 0.

30 Aug 2000University of Virginia CS Proof, cont. Consider the message M 0 where M 0  D K (C 0 ) for any K. So, p (C 0 | M 0 ) = 0. In a perfect cipher, p (C 0 | M 0 ) = p (C 0 ) > 0. Contradiction! It isn’t a perfect cipher. Hence, all perfect ciphers must have l  n.

30 Aug 2000University of Virginia CS Example: Monoalphabetic Random monoalphabetic substitution is not a perfect cipher for messages of up to 20 letters: l = 26! n = l < n its not a perfect cipher. In previous proof, could choose C 0 = “AB” and M 0 = “ee” and p (C 0 | M 0 ) = 0.

30 Aug 2000University of Virginia CS Example: Monoalphabetic Is random monoalphabetic substitution a perfect cipher for messages of up to 2 letters? l = 26! n = 26 2 l  n. No! Showing l  n does not prove its perfect.

30 Aug 2000University of Virginia CS Information Theory [Shannon 1948] Entropy ( H ): –Amount of information in a message H(M) = log 2 n where n is the number of possible meanings H (month of year) = log 2 12  3.6 (need 4 bits to encode a year)

30 Aug 2000University of Virginia CS Rate Absolute rate: how much information can be encoded R = log 2 Z(Z=size of alphabet) R English = Actual rate of a language: r = H(M) / N M is an N -letter message. r of months spelled out using ASCII: log 2 26  4.7 bits / letter = log 2 12 / (8 letters * 8 bits/letter)  0.06

30 Aug 2000University of Virginia CS Rate of English r(English) is about 1.3 bits/letter (.28 letters/letter). –How do we get this? How many meaningful 20-letter messages in English? r = H(M) / N 1.3 = H(M)/20 H(M) = 26 = log 2 n n = 2 26 = 6.7 million (of 2*10 28 possible) One out of 7 * randomly selected 20-letter groups

30 Aug 2000University of Virginia CS Redundancy Redundancy (D) is defined: D = R – r Redundancy in English: D = 4.7 – 1.3 = 3.4 bits/letter Each letter is 1.3 bits of content, and 3.4 bits of redundancy. (~72%) ASCII: 1 byte per letter D = 8 – 1.3 = % redundancy, 14% information

30 Aug 2000University of Virginia CS Unicity Distance Entropy of cryptosystem: (K = number of possible keys) H(K) = log 2 K H(64-bit key) = 64 Unicity: U = H(K)/D Minimum amount of ciphertext needed for brute-force attack to succeed.

30 Aug 2000University of Virginia CS Unicity Examples One-Time Pad H(K) = infinite U = H(K)/D = infinite Monoalphabetic Substitution H(K) = log 2 26!  87 D = 3.4 (redundancy in English) U = H(K)/D  25.5 Intuition: if you have 25 letters, probably only matches one possible plaintext. D = 0 (random bit stream) U = H(K)/D = infinite

30 Aug 2000University of Virginia CS Unicity Theoretical and probabilistic measure of how much ciphertext is needed to determine a unique plaintext Does not indicate how much ciphertext is needed for cryptanalysis If you have less than unicity distance ciphertext, can’t tell if guess is right. As redundancy approaches 0, hard to cryptanalyze even simple cipher.

30 Aug 2000University of Virginia CS Charge Problem Set 1: due next Monday Next time: –Project team assignments If I don’t have your survey yet, make sure I get it today! –DES – most widely used modern cipher