Cryptography: Review Day David Brumley Carnegie Mellon University

Cryptonium Pipe Goals: Privacy, Integrity, and Authenticity 2 Alice Bob Public Channel Eve E D cc’ m keke m or error keke read/write access

3

Privacy and Encryption 4

Perfect Secrecy [Shannon1945] (Information Theoretic Secrecy) Defn Perfect Secrecy (informal): We’re no better off determining the plaintext when given the ciphertext. 5 AliceBob Eve 1.Eve observes everything but the c. Guesses m 1 2.Eve observes c. Guesses m 2 Goal: \Pr[m = m_1] = \Pr[m = m_2]

The One Time Pad 6 Miller, 1882 and Vernam, 1917 \begin{align*} E(k,m) &= k \oplus m = c\\ D(k,c) &= k \oplus c = m\\ \end{align*} \[ \begin{split} D(k,E(k,m)) &= D(k, k \oplus m)\\ &= k \oplus (k \oplus m)\\ &= 0 \oplus m \\ &= m \end{split} \] m: k: c: k: m: M = C = K = {0,1} n

PRNGs, Stream Cipher PRNG(k): Amplify a small amount of randomness k. Stream Cipher: PRNG(k) xor M 7

Block Ciphers Modes of operations – CBC, CTR, etc. – What modes do for security, e.g., why ECB is bad, why randomize an IV for CBC, etc. Definitions – Is a block cipher a PRP or PRF Attacks 8

Exhaustive Search for block cipher key Goal: given a few input output pairs (m i, c i = E(k, m i )) i=1,..,nfind key k. Attack: Brute force to find the key k. Homework: What is the probability that the key k found with one pair is correct? For two pairs? 9

Meet in the middle attack Define 2E( (k 1,k 2 ), m) = E(k 1, E(k 2, m) ) key-len = 112 bits for 2DES Idea: key found when c’ = c’’: E(k i, m) = D(k j, c) m c' … … c … … c’’ m E(k 2,⋅)E(k 1,⋅) c 10

Semantic security under CPA 11 Modes that return the same ciphertext (e.g., ECB, CTR) for the same plaintext are not semantically secure under a chosen plaintext attack (CPA) (many-time-key) if c b = c 0 output 0 else output 1 m 0, m 0 ∊ M C 0 ← E(k,m) m 0, m 1 ∊ M C b ← E(k,m b ) Challenger k ← K Adversary A

Semantic security under CPA 12 Modes that return the same ciphertext (e.g., ECB, CTR) for the same plaintext are not semantically secure under a chosen plaintext attack (CPA) (many-time-key) if c b = c 0 output 0 else output 1 m 0, m 0 ∊ M C 0 ← E(k,m) m 0, m 1 ∊ M C b ← E(k,m b ) Challenger k ← K Adversary A Encryption modes must be randomized or use a nonce (or are vulnerable to CPA)

Hashes and MACS 13

Message Integrity Goal: integrity (not secrecy) Examples: – Protecting binaries on disk. – Protecting banner ads on web pages Security Principles: – Integrity means no one can forge a signature 14

Secure PRF: An Alternate Interpretation 15 For b = 0,1 define experiment EXP(b) as: Def: PRF is a secure PRF if for all efficient A, A does no better than guessing for b’. b’ Challenger F Adversary b’

Secure MAC Game Security goal: A cannot produce a valid tag on a message – Even if the message is gibberish 16 Challenger 1. k = KeyGen(l) 3. Compute i in 0...q: t i = S(m i, k) 5. b = V(m,t,k) Adversary A 2. Picks m 1,..., m q 4. picks m not in m 1,...,m q Generates t m 1,...,m q t 1,...,t q m,t b = {yes,no} existential forgery if b=“yes”

Birthday Paradox Rule of Thumb Given N possibilities, and random samples x 1,..., x j, PR[x i = x j ] ≈ 50% when j = N 1/2 17

One-way and Collision Resistance f is one-way if there is no computationally efficient Adversary given f(x) =y that can find a x’ such that f(x’) = y f is collision resistant if it is difficult to find two inputs x’ and x such that f(x) = f(x’) 18 These are different concepts! (Think of a collision resistant function that is not one way)

Generic attack on hash functions Let H: M  {0,1} n be a hash function ( |M| >> 2 n ) Generic alg. to find a collision in time O(2 n/2 ) hashes Algorithm: 1.Choose 2 n/2 random messages in M: m 1, …, m 2 n/2 (distinct w.h.p ) 2.For i = 1, …, 2 n/2 compute t i = H(m i ) ∈{0,1} n 3.Look for a collision (t i = t j ). If not found, got back to step 1. How well will this work? 19

Brute Force Online Brute Force Attack: input: hp = hash(password) to crack for each i in dictionary file if(h(i) == hp) output success; Time Space Tradeoff Attack: precompute: h(i) for each i in dict file in hash tbl input: hp = hash(password) check if hp is in hash tbl 20 “rainbow tables”

Salts Enrollment: 1.compute hp=h(password + salt) 2.store salt || hp Verification: 1.Look up salt in password file 2.Check h(input||salt) == hp What is this good for security, given that the salt is public? 21 Salt doesn’t increase security against online attack, but does make tables much bigger.

Authenticated Encryption 22

Motivating Question: Which is Best? E(k E, m||tag) S(k I, m) m Encryption Key = K E ; MAC key = k I Option 1: SSL (MAC-then-encrypt) mtagm S(k I, c)E(k E, m) m Option 2: IPsec (Encrypt-then-MAC) mmtag S(k I, m)E(k E, m) m Option 3: SSH (Encrypt-and-MAC) mmtag 23

An authenticated encryption system (E,D) is a cipher where As usual: E: K × M × N ⟶ C but D: K × C × N ⟶ M ∪{ ⊥ } Security: the system must provide – Semantic security under CPA attack, and – ciphertext integrity. The attacker cannot create a new ciphertext that decrypts properly. reject ciphertext as invalid 24

CCA Game Definition 25 Let ENC = (E,D) over (K,M,C). For b = {0,1} randomly chosen b Chal. k  K Adv. b’  {0,1} m i,0, m i,1  M : |m i,0 | = |m i,1 | c i  E(k, m i,b ) for i=1,…,q: (1) CPA query: c i  C : c i ∉ {c 1, …, c i-1 } m i  D(k, c i ) (2) CCA query: Ex: could query a changed c i

Public Key Cryptography 26

Eve observes: g, g a, g b Goal: compute a (or b) (i.e., calculate the discrete log) or compute g ab g a mod p 4. g b mod p 1. Pick a from [0,p-1)2. Pick b from [0,p-1) 5. Compute (g a ) b mod p as secret key 6. Compute (g b ) a mod p as secret key Alice Bob Eve

MITM Adversary As described, Diffie-Hellman is insecure against active Man In The Middle (MITM) attacks AliceBobMITM g a mod pg m mod p g b mod p g m mod p g ma mod p g mb mod p 28

Easy and Hard Problems Factoring Discrete Log Exponentiation 29

Questions? 30

31 Questions?

END

33 Thought

Public Key Encryption Def: a public-key encryption system is a triple of algorithms (G, E, D) G(): randomized alg. outputs a key pair (pk, sk) E(pk, m): randomized alg. that takes m∈M and outputs c ∈C D(sk,c): determisitic alg. that takes c∈C and outputs m ∈ M or ⊥ Consistency: ∀(pk, sk) output by G : ∀m∈M: D(sk, E(pk, m) ) = m Note: Without randomization, an attacker can determine E(pk,m 1 ) = E(pk,m 2 ) when m 1 =m 2 34

Semantic Security For b=0,1 define experiments EXP(b) (i.e., EXP(0) and EXP(1)): Def: Enc = (G,E,D) is sem. secure (a.k.a IND-CPA) if for all efficient A: Adv SS [A, Enc ] = |Pr[EXP(0)=1] – Pr[EXP(1)=1] | < negligible Chal. b Adv. A (pk,sk)  G() m 0, m 1  M : |m 0 | = |m 1 | c  E(pk, m b ) b’  {0,1} EXP(b) pk No query encryptions of messages. Why? 35