1. CSCE 715: Network Systems Security Chin-Tser Huang huangct@cse.sc.edu University of South Carolina

2. 9/12/20072 After DES… More symmetric encryption algorithms Triple-DES Advanced Encryption Standards

3. 9/12/20073 Triple DES Clearly a replacement for DES was needed theoretical attacks that can break it demonstrated exhaustive key search attacks Use multiple encryptions with DES implementations Triple-DES is the chosen form

4. 9/12/20074 Why Triple-DES? Double-DES may suffer from meet-in-the- middle attack works whenever use a cipher twice assume C = E K2 [E K1 [P]], so X = E K1 [P] = D K2 [C] given a know pair (P, C), attack by encrypting P with all keys and store then decrypt C with keys and match X value can show attack takes O(2 56 ) steps

5. 9/12/20075 Triple-DES with Two Keys Must use 3 encryptions would seem to need 3 distinct keys But can use 2 keys with E-D-E sequence encrypt & decrypt equivalent in security C = E K1 [D K2 [E K1 [P]]] if K1=K2 then can work with single DES Standardized in ANSI X9.17 & ISO8732 No current known practical attacks

6. 9/12/20076 Triple-DES with Three Keys Some proposed attacks on two-key Triple-DES, although none of them practical Can use Triple-DES with Three-Keys to avoid even these C = E K3 [D K2 [E K1 [P]]] Has been adopted by some Internet applications, e.g. PGP, S/MIME

7. 9/12/20077 Origins of Advanced Encryption Standard Triple-DES is slow with small blocks US NIST issued call for ciphers in 1997 15 candidates accepted in Jun 1998 5 were shortlisted in Aug 1999 Rijndael was selected as the AES in Oct 2000 Issued as FIPS PUB 197 standard in Nov 2001

8. 9/12/20078 AES Requirements Private key symmetric block cipher 128-bit data, 128/192/256-bit keys Stronger and faster than Triple-DES Active life of 20-30 years (+ archival use) Provide full specification and design details Both C and Java implementations NIST has released all submissions and unclassified analyses

9. 9/12/20079 AES Evaluation Criteria Initial criteria security – effort to practically cryptanalyze cost – computational algorithm & implementation characteristics Final criteria general security software & hardware implementation ease implementation attacks flexibility (in en/decrypt, keying, other factors)

10. 9/12/200710 AES Shortlist Shortlist in Aug 99 after testing and evaluation MARS (IBM) - complex, fast, high security margin RC6 (USA) - very simple, very fast, low security margin Rijndael (Belgium) - clean, fast, good security margin Serpent (Euro) - slow, clean, very high security margin Twofish (USA) - complex, very fast, high security margin Subject to further analysis and comment Contrast between algorithms with few complex rounds verses many simple rounds refined existing ciphers verses new proposals

11. 9/12/200711 The Winner - Rijndael Designed by Rijmen-Daemen in Belgium Has 128/192/256 bit keys, 128 bit data An iterative rather than feistel cipher treats data in 4 groups of 4 bytes operates an entire block in every round Designed to be resistant against known attacks speed and code compactness on many CPUs design simplicity Use finite field

12. 9/12/200712 Abstract Algebra Background Group Ring Field

13. 9/12/200713 Group A set of elements or “numbers” With a binary operation whose result is also in the set (closure) Obey following axioms associative law: (a.b).c = a.(b.c) has identity e : e.a = a.e = a has inverses a -1 : a.a -1 = e Abelian group if commutative a.b = b.a

14. 9/12/200714 Ring A set of elements with two operations (addition and multiplication) which are: an abelian group with addition operation multiplication has closure is associative distributive over addition: a(b+c) = ab + ac Commutative ring if multiplication operation is commutative Integral domain if multiplication operation has identity and no zero divisors

15. 9/12/200715 Field A set of numbers with two operations abelian group for addition abelian group for multiplication (ignoring 0) integral domain multiplicative inverse: aa -1 = a -1 a= 1 Infinite field if infinite number of elements Finite field if finite number of elements

16. 9/12/200716 Modular Arithmetic Define modulo operator a mod n to be remainder when a is divided by n Use the term congruence for: a ≡ b mod n when divided by n, a and b have same remainder e.g. 100  34 mod 11 b is called the residue of a mod n if 0  b  n-1 with integers can write a = qn + b

17. 9/12/200717 Divisor A non-zero number b is a divisor of a if for some m have a=mb ( a,b,m all integers) That is, b divides a with no remainder Denote as b|a E.g. all of 1,2,3,4,6,8,12,24 divide 24

18. 9/12/200718 Modular Arithmetic Can do modular arithmetic with any group of integers Z n = {0, 1, …, n-1} Form a commutative ring for addition With a multiplicative identity Some peculiarities if (a+b)≡(a+c) mod n then b≡c mod n but (ab)≡(ac) mod n then b≡c mod n only if a is relatively prime to n

19. 9/12/200719 Modulo 8 Example

20. 9/12/200720 Greatest Common Divisor (GCD) GCD (a,b) of a and b is the largest number that divides evenly into both a and b e.g. GCD(60,24) = 12 Two numbers are called relatively prime if they have no common factors (except 1) e.g. 8 and 15 relatively prime as GCD(8,15) = 1

21. 9/12/200721 Euclid's GCD Algorithm Use following theorem GCD(a,b) = GCD(b, a mod b) Euclid's Algorithm to compute GCD(a,b) A=a, B=b while B>0 R = A mod B A = B, B = R return A

22. 9/12/200722 Galois Fields Finite fields play a key role in cryptography Number of elements in a finite field must be a power of a prime p n Known as Galois fields Denoted GF(p n ) In particular often use the following forms GF(p) GF(2 n )

23. 9/12/200723 Galois Fields GF(p) GF(p) is set of integers {0,1, …, p-1} with arithmetic operations modulo prime p Form a finite field have multiplicative inverses Hence arithmetic is “well-behaved” and can do addition, subtraction, multiplication, and division without leaving the field GF(p)

24. 9/12/200724 Arithmetic in GF(7)

25. 9/12/200725 Finding Multiplicative Inverses By extending Euclid’s algorithm 1.(A1, A2, A3)=(1, 0, m); (B1, B2, B3)=(0, 1, b) 2. if B3 = 0 return A3 = gcd(m, b); no inverse 3. if B3 = 1 return B3 = gcd(m, b); B2 = b –1 mod m 4. Q = A3 div B3 5. (T1, T2, T3)=(A1 – Q B1, A2 – Q B2, A3 – Q B3) 6. (A1, A2, A3)=(B1, B2, B3) 7. (B1, B2, B3)=(T1, T2, T3) 8. goto 2

26. 9/12/200726 Polynomial Arithmetic Can compute using polynomials Several alternatives available ordinary polynomial arithmetic poly arithmetic with coords mod p poly arithmetic with coords mod p and polynomials mod M(x)

27. 9/12/200727 Ordinary Polynomial Arithmetic Add or subtract corresponding coefficients Multiply all terms by each other E.g. let f(x) = x 3 + x 2 + 2 and g(x) = x 2 – x + 1 f(x) + g(x) = x 3 + 2x 2 – x + 3 f(x) – g(x) = x 3 + x + 1 f(x) x g(x) = x 5 + 3x 2 – 2x + 2

28. 9/12/200728 Polynomial Arithmetic with Modulo Coefficients Compute value of each coefficient as modulo some value Could be modulo any prime But we are most interested in mod 2 i.e. all coefficients are 0 or 1 e.g. let f(x) = x 3 + x 2, g(x) = x 2 + x + 1 f(x) + g(x) = x 3 + x + 1 f(x) x g(x) = x 5 + x 2

29. 9/12/200729 Modular Polynomial Arithmetic Can write any polynomial in the form f(x) = q(x) g(x) + r(x) can interpret r(x) as being a remainder r(x) = f(x) mod g(x) If no remainder say g(x) divides f(x) If g(x) has no divisors other than itself and 1 say it is irreducible (or prime) polynomial Arithmetic modulo an irreducible polynomial forms a field

30. 9/12/200730 Polynomial GCD Can find greatest common divisor for polys c(x) = GCD(a(x), b(x)) if c(x) is the poly of greatest degree which divides both a(x), b(x) can adapt Euclid’s Algorithm to find it: EUCLID[a(x), b(x)] 1. A(x) = a(x); B(x) = b(x) 2. if B(x) = 0 return A(x) = gcd[a(x), b(x)] 3. R(x) = A(x) mod B(x) 4. A(x)  B(x) 5. B(x)  R(x) 6. goto 2

31. 9/12/200731 Modular Polynomial Arithmetic Can compute in field GF(2 n ) polynomials with coefficients modulo 2 whose degree is less than n hence must reduce modulo an irreducible poly of degree n (for multiplication only) Form a finite field Can always find an inverse can extend Euclid’s Inverse algorithm to find

32. 9/12/200732 Arithmetic in GF(2 3 )

33. 9/12/200733 Next Class AES algorithm Confidentiality of symmetric encryption Read Chapters 7, 8, 9