David Evans CS551: Security and Privacy University of Virginia Computer Science Lecture 6: Key Exchange The era of “electronic mail” [Potter1977] may soon be upon us; we must ensure that two important properties of the current “paper mail” system are preserved: (a) messages are private, and (b) messages can be signed. R. Rivest, A. Shamir and L. Adleman. A Method for Obtaining Digital Signatures and Public-Key Cryptosystems. Communications of the ACM, January (The original RSA paper.)

30 Aug 2000University of Virginia CS 5512 Menu PS1 RC6 Proof Challenge (Vic Ludwig) Key Distribution (Greg Lamm) Diffie-Hellman Key Agreement Intro to Public-Key Cryptosystems Return PS1

30 Aug 2000University of Virginia CS 5513 PS1 Problem 2 –Process more interesting than answer Problem 4 –Even a “provably perfect” scheme breaks in practice –Bonus question: any 98 agents obtain no information any 99 agents can determine message key data O(100 * n)

30 Aug 2000University of Virginia CS 5514 RC6 Proof Vic Ludwig

U.S. Army Key Distribution Greg Lamm

30 Aug 2000University of Virginia CS 5516 Two Distribution Schemes –Physically –OTAR Three Types of Distributions –Initial (Staging Area) –Operating Procedures –Compromise (Equipment or Keys) A tactical network (voice/data) can have over 20 keys. – Key Types Transmission Encryption Key (TEK)-128 bit Key Encryption Key (KEK)-128 bit Key Distribution is Technology + People U.S. Army Distribution

DTAC 2BDE BSA 45 CSB DREAR DMAIN 1-62 ADA Staging Area Key Distribution Close Connectivity Static Environment Data/Voice Network Key Distributed – Physically Test OTAR

DTAC 2BDE BSA 45 CSB DREAR DMAIN 1-62 ADA Tactical Network Key Distribution Dispersed Connectivity Dynamic Environment Data/Voice Network Key Distributed – OTAR

30 Aug 2000University of Virginia CS 5519 DTAC NCS 1-27 SCOUTS 1-27 TOC 1-14 SCOUTS 1-14 TOC AVN TOC 2d BDE ALT NCS 2d BDE TOC 45 CSG MAIN DREAR 45 CSG FWD AVN FARP FM Key Distribution Dispersed Connectivity NCS issues key distribution by SOP

30 Aug 2000University of Virginia CS Key Distribution Problems NCS ALT NCS TEK 1 damaged TEK 2 TEK 1 Multiple Key Distributors Issuing a second key at the staging area Good for compromise Bad if it is not the same (only testing TEK 1) Labeling Keys with name rather than code Key Training, Handling and Protection

30 Aug 2000University of Virginia CS Public-Key Cryptosystems

30 Aug 2000University of Virginia CS Public-Key Cryptosystems Distributing secret keys is hard and expensive Can two people communicate securely without having to meet first and establish a key?

30 Aug 2000University of Virginia CS Trust a Third Party Keys “R” Us knows K A, K B... Alice Bob E (“Bob”, K A ) E (K AB, K A ) E (K AB, K B ) E (M, K AB ) Generates random K AB E (“Alice” || K AB, K B )

30 Aug 2000University of Virginia CS Merkle’s Puzzles Ralph Merkle [1974] Alice generates 2 20 messages: “This is puzzle x. The secret is y.” ( x and y are random numbers) Encrypts each message using symmetric cipher with a different key. Sends all encrypted messages to Bob

30 Aug 2000University of Virginia CS Merkle’s Puzzles, cont. Bob chooses random message, performs brute-force attack to recover plaintext and key k Bob sends x (clear) to Alice Alice and Bob use k to encrypt messages

30 Aug 2000University of Virginia CS Is this secure? Alice: symmetric cipher DES ~2 55 expected brute force work to break DES Eve: has to break the 2 20 to find which one matches x. ~ 2 19 * 2 55 expected work Alice and Bob change keys frequently enough since it is less work to agree to a new key

30 Aug 2000University of Virginia CS Birth of Public Key Cryptosystems 1969 – ARPANet born: 4 sites –Whitfield Diffie starts thinking about strangers sending messages securely 1974 – Whitfield Diffie gives talk at IBM lab –Audience member mentions that Matrin Hellman (Stanford prof) had spoke about key distribution That night – Diffie starts driving 5000km to Palo Alto Diffie, Hellman and Ralph Merkle work on key distribution problem

30 Aug 2000University of Virginia CS We stand today on the brink of a revolution in cryptography. Diffie and Hellman, “New Directions in Cryptography”, IEEE Transactions on Information Theory, November 1976.

30 Aug 2000University of Virginia CS Secret Paint Mixing Analogy due to Simon Singh, The Code Book. AliceBob Yellow paint (public) Alice’s Secret Color Bob’s Secret Color C A = Yellow + Purple C B = Yellow + Red K = Yellow + Red + Purple K = Yellow + Purple + Red Eve

30 Aug 2000University of Virginia CS Diffie-Hellman Key Agreement 1.Choose public numbers: q (large prime number),  (generator mod q ) 2.A generates random X A and sends B: Y A =  X A mod q. 3.B generates random X B and sends A: Y B =  X B mod q. 4.A calculates secret key: K = (Y B ) X A mod q. 5.B calculates secret key: K = (Y A ) X B mod q.

30 Aug 2000University of Virginia CS What’s a generator?  is a generator mod q if for all 0  n < q, there is some 1  m < q such that  m = n mod q Is m unique? –Yes: Proof by counting. Discrete logarithm: given , n, and q find 0  m < q such that  m = n mod q.

30 Aug 2000University of Virginia CS Example What is a generator for q = 11 ? 2 1  = 64   = 128   = 256  = 16  = 512  = 32  = 1024  11 1 If q is prime, there must be a generator.

30 Aug 2000University of Virginia CS Diffie-Hellman Example 1.Choose public numbers: q (large prime number),  (generator mod q ): q = 11,  = 2 2.A generates random X A and sends B: Y A =  X A mod q. X A = 4, Y A = 2 4 mod 11 = 16 mod 11 = 5 3.B generates random X B and sends A: Y B =  X B mod q. X B = 6, Y B = 2 6 mod 11 = 64 mod 11 = 9 Example from Tom Dunigan’s notes:

30 Aug 2000University of Virginia CS Diffie-Hellman Example, cont. q = 11,  = 2 X A = 4, Y A = 5 X B = 6, Y B = 9 4.A calculates secret key: K = (Y B ) X A mod q. K = 9 4 mod 11 = 6561 mod 11 = 5. 5.B calculates secret key: K = (Y A ) X B mod q. K = 5 6 mod 11 = mod 11 = 5.

30 Aug 2000University of Virginia CS Is it magic? Things to Prove: 1.They generate the same keys: K = (Y B ) X A mod q = (Y A ) X B mod q 2.An eavesdropper cannot find K from any transmitted value: q, , Y A, Y B

30 Aug 2000University of Virginia CS Keys Agree Prove K = (Y B ) X A mod q = (Y A ) X B mod q. (Y B ) X A mod q(Y A ) X B mod q = (  X B mod q) X A mod q = (  X A mod q) X B mod q = (  X B ) X A mod q = (  X A ) X B mod q =  X B X A mod q =  X A X B mod q QED. Stallings: “by the rules of modular arithmetic”

30 Aug 2000University of Virginia CS Modular Exponentiation (a mod q) b mod q = a b mod q (7 mod 6) 2 mod 6 = 7 2 mod mod 6 = 49 mod 6 Proof by example?

30 Aug 2000University of Virginia CS Modular Exponentiation First prove: (a * b) mod q = (a mod q) * (b mod q) mod q Then, by induction, (a mod q) b mod q = a b mod q since a b = a * a b-1 and a 1 = a.

30 Aug 2000University of Virginia CS Modular Arithmetic (a * b) mod n = x x + (n * d0) = a * b x = a * b – (n * d0) a mod n = y  y = a – (n * d1) b mod n = z  z = b – (n * d2) (a mod n) * (b mod n) mod n = (a – (n * d1)) * (b – (n * d2)) mod n = (a * b + (a * (n * d2) – b * (n * d1) + (n * d1)(n * d2)) mod n = a * b mod n (all terms with n * are 0 mod n )

30 Aug 2000University of Virginia CS Secure from Eavesdropper An eavesdropper cannot find K from any transmitted value: q, , Y A, Y B K = (Y B ) X A mod q = (Y A ) X B mod q To find K without X A or X B we need to find x and y such that (Y B ) x mod q = (Y A ) y mod q Finding discrete logarithms is (probably) hard! (More on this later...)

30 Aug 2000University of Virginia CS Diffie-Hellman Use SSL Cisco encrypting routers Sun secure RPC etc...

30 Aug 2000University of Virginia CS Public-Key Cryptography Same paper introduced concept of Public-Key Cryptography Private algorithm: E Public algorithm: D Identity: E (D (m)) = D (E (m)) = m Secure: cannot determine E from D But didn’t know how to find suitable E and D

30 Aug 2000University of Virginia CS Who really invented public-key cryptography? General Communications Headquarters, Cheltenham (formed from Bletchley Park after WWII) 1969 – James Ellis asked to work on key distribution problem Secure telephone conversations by adding “noise” to line Late 1969 – idea for PK, but function

30 Aug 2000University of Virginia CS RSA & Diffie-Hellman Asks Clifford Cocks, Cambridge mathematics graduate, for help He discovers RSA (four years early) Then (with Malcolm Williamson) discovered Diffie-Hellman Kept secret until 1997! NSA claims they had it even earlier

30 Aug 2000University of Virginia CS Charge Next time: –Rivest, Shamir, Adelman: First solution to finding suitable E and D Identity: E (D (m)) = D (E (m)) = m Secure: cannot determine E from D Read the paper! –Go somewhere appropriate –Identify 2 questionable statements in the paper