Presentation Road Map 1 Authenticated Encryption 2 Message Authentication Code (MAC) 3 Authencryption and its Application Objective Modes of Operation

Privacy and Integrity: “ Two Essence of Network Security” Presenter Prosanta Gope Advisor Tzonelih Hwang Quantum Information and Network Security Lab, NCKU,2015

Flash Back

Message Authentication message authentication is concerned with: – protecting the integrity of a message – validating identity of originator – non-repudiation of origin (dispute resolution) Possible ways to accomplish “ Message Authentication ” 1. CBC-Residue, or CMAC (authentication using a block cipher). 2. HMAC ( authentication using a hash function).

Problems of Integrity Re-Visited

6 Message Authentication Integrity: M interferes with the transmission (modifies the message, or inserts a new one) interferes with the transmission (modifies the message, or inserts a new one) AliceBob How can Bob be sure that M really comes from Alice?

7 Sometimes: more important than secrecy! AliceBank transfer 1000 $ to Eve transfer 1000 $ to Bob Of course: usually we want both secrecy and integrity.

Part 1  Cryptography 8 ECB Cut and Paste Suppose plaintext is Alice digs Bob. Trudy digs Tom. Assuming 64-bit blocks and 8-bit ASCII: P 0 = “Alice di”, P 1 = “gs Bob. ”, P 2 = “Trudy di”, P 3 = “gs Tom. ” Ciphertext: C 0,C 1,C 2,C 3 Trudy cuts and pastes: C 0,C 3,C 2,C 1 Decrypts as Alice digs Tom. Trudy digs Bob.

CBC Residue

Cipher Block Chaining (CBC)

Ensuring Integrity Only Send Plain text M(m1,…m6) + CBC residue: (figure 4-12) The receiver computes the CBC residue from the plain text and compare it with the received CBC residue.

IF we Need Both the Privacy and Integrity Then what do ?

Solution 1.Perform Encryption using the secret Key K1. 2.Create CBC-Residue using another Secret Key K2. Note that: Unfortunately, the above approaches require twice the cryptographic power of encryption alone.

Offering Integrity Using Hash Function

What is Hash? Hashes are also called one-way hashes because once they are created they cannot be reversed. This means that a hash cannot be deciphered to determine the contents of the original message. Therefore hashes can only be used to compare data.

Basic Hash Function Diagram

Message Authentication Code A common solution for achieving message authenticity and integrity is to use a message authentication code (MAC). A MAC can be viewed as a cryptographically secure checksum of a message. 17

Message Authentication Code Cont.. Computing a MAC requires authorized senders and receivers to share a secret key, and this key is part of the input to a MAC computation. The sender computes a MAC over the packet with the secret key and includes the MAC with the packet. A receiver sharing the same secret key recomputed the MAC and compares it with the received MAC value. 18

19 Alice Bob (m, t=Tag k (m)) k k m є {0,1}* k is chosen randomly from some set T Vrfy k (m) є {yes,no} Message Authentication Codes – the idea

20 Warning: MACs do not offer protection against the “replay attacks”. AliceBob (m, t)... Since Vrfy has no state (or “memory”) there is no way to detect that (m,t) is not fresh! This problem has to be solved by the higher-level application (methods: time-stamping, sequence numbers...). This problem has to be solved by the higher-level application (methods: time-stamping, sequence numbers...).

raw CBC Construction 1: encrypted CBC-MAC F(k,  ) m[0]m[1]m[3]m[4]  F(k,  )  F(k 1,  ) tag

cascade Construction 2: NMAC (nested MAC) FFF m[0]m[1]m[3]m[4] F F tag >> > > k t ll fpad > k1k1 t

Privacy and Integrity: “ Two Essence of Network Security” Presenter Prosanta Gope Advisor Tzonelih Hwang Quantum Information and Network Security Lab, NCKU,2015

Flash Back

Presentation Road Map 1 Authenticated Encryption 2 Message Authentication Code (MAC) and Hash Function 3 Network Security and It’s Issues Objective Modes of Operation

.

Conventional Ways

Generic Composition

Which One is the Best?

Generic Composition

M M C C Hash How about that?

Problem Statements If there exists n number of blocks All the approaches either needs 2n encryptions or an additional Cryptographic Primitive like Hash.

Can we reduce the number of Encryption? Or Can we avoid to use of any additional Cryptographic Primitive

Yes, We Can Do It!

How ?

Single –Pass Authenticated Encryption Mode

State of the Art Single-Pass AE Scheme IAPM OCB

Introduction to Whitening

If you know the plaintext and if you also have the cipher corresponding to that. Can you get the encryption key? P P Enc C C K

“Whitening” What’s that? Whitening is the technique of XORing some key material with the input to a block, and XORing some other key material with the out put. P P Enc C C K1 K2 K

Usage This technique forces an attacker to guess not only the encryption key, but also the whitening values. It also makes the cipher randomize.

IAPM (integrity aware parallelizable mode)

OCB ( Offset Codebook Mode) Checksum = M 1 ⊕ … ⊕ M m.

OCB Cont. 45

Thanks!