1. ISA 400 Management of Information Security
Week #4
Cryptography
Philip Robbins – October 24, 2015
Information Security & Assurance Program University of Hawai'i West Oahu 1

2. Cryptography
Agenda
Domain: Cryptography
Quiz
Assignment 2

3. Cryptology comes from “Crypto”
Cryptography
Cryptology comes from “Crypto”
- Meaning: To Hide
Definition: The science of hiding communications.
Why?
- Protect , PII, transactions & data.
Cryptographic systems use
- Codes: “secret keys”
- Ciphers: hiding the true meaning of a message 3

4. Cryptography & Encryption Confidentiality
- The process of protecting plaintext messages
from monitoring or eavesdropping.
- Cryptography vs.. Encryption?? N1
LAN N2
- Algorithm
- Key
- Algorithm
- Key
DATA /
PLAINTEXT
CLEARTEXT
DATA /
PLAINTEXT
CLEARTEXT
ENCRYPTION
DECRYPTION
CIPHERTEXT 4

5. 3 Basic Elements of Cryptography - Algorithm - Key - Data5

6. Basic Elements: Algorithm
Cryptography
Basic Elements: Algorithm
- Describes the process (instruction set) involved in producing a desired output.
- In the case of Cryptography what is our desired output?
Encryption / cipher text / Confidentiality
Does more Complexity = (mean) more Security? 6

7. Cryptography Non-reputation Authentication
- Sender can’t deny sending a message.
Authentication
- Associated with validating a user’s identity
- Also associated with the integrity of the message 7

8. Cryptography Authentication Digital Signatures
- Uses Hash Function & Encryption together
Digital Certificates
- Ensure identity of remote computer
- Trust; who are you sending your information to? 8

9. Substitution Algorithm
Cryptography
Substitution Algorithm
- Caesar’s Cipher
- Rotate (shift) alphabet
- Easy to decipher (frequency of common words, i.e. “the”)
Key?
Key Length? 9

10. Transposition Algorithm
Cryptography
Transposition Algorithm
- Encryption by changing position of plaintext.
- Rail Fence Cipher
DATA: 'WE ARE DISCOVERED. FLEE AT ONCE‘
KEY: 3 ‘Rails’ (rows)
CIPHERTEXT: 10

11. Steganography (not stenography)
Cryptography
Steganography (not stenography)
- Security through obscurity – concealing content.
- Not recommended as encryption substitute.
Concealment Cipher
- Not actually encrypted – just hidden.
- A message (hidden) within a message.
- Example: Message = Newspaper Page #, Word #, …
Running Key Cipher
- Text is used for a very long key stream.
- Clever use of components in the world.
- Example: Key = Every 3rd word from a book. 11

12. Cryptography Vernam Cipher - Gilbert Vernam - 1917
- Uses a basic Boolean XOR Function!!
XOR Logic Gate Symbols
XOR Truth Table 12

13. Cryptography
Stream Cipher: Dividing the message into bits for processing (Encrypting data one bit at a time). 13

14. Cryptography
Stream vs.. Block Cipher 14

15. Cryptography
Block Cipher: Dividing the message into blocks for processing
1 Block 15

16. Cryptography Key & Algorithm Relationship
- Algorithm’s are static mathematic functions.
- Algorithm does not change; the key does.
- The purpose of a key is to add randomization.
- The key is a group of instructions for the algorithms.
- Larger key space means better security:
128 bit strength = 2^128 = 3.4 x 10^38 possible keys (key space)
- Processing power can brute force keys < 128 bit 16

17. Cryptography
Key & Algorithm Relationship 17

18. Cryptography Symmetric (Private) Key Algorithm
- The same key is used to encipher plaintext to
produce cipher text
Plaintext ⊕ Key = Ciphertext
*and to*
- decipher cipher text to yield the original plaintext
Ciphertext ⊕ Key = Plaintext 18

19. Cryptography Symmetric (Private) Key Algorithm
- How is confidentiality maintained? 19

20. Cryptography Symmetric Key Algorithm - Advantages Fast
Hard to break if large key is used.
- Disadvantages
Only provides for confidentiality
Key Management
Distribution 20

21. = n(n-1)/2 Cryptography Symmetric Key Algorithm - Disadvantages
Key Management
Assume 10 people want to communicate with each other while ensuring confidentiality.
How many keys would you need?
# of communication
channels
= n(n-1)/2 21

22. Cryptography Symmetric Key Algorithm
- Disadvantages (Most serious deficiency)
Distribution
How would we transfer symmetric keys securely?
What if someone is monitoring our comms?
If sent in clear text someone can intercept. 22

23. Key Pair {Public Key, Private Key}
Cryptography
Asymmetric (Public Key) Encryption
- One key is required to encrypt.
Plaintext ⊕ Public Key = Ciphertext
*and*
- another key is required to decrypt.
Ciphertext ⊕ Private Key = Plaintext
Key Pair {Public Key, Private Key} 23

24. Cryptography Asymmetric (Public Key) Encryption
Key Pair {Public Key, Private Key} 24

25. Cryptography
Asymmetric Encryption
given to anyone
kept secret 25

26. Cryptography Asymmetric Encryption - SENDER
Messages are encrypted with either the public or private key.
The public key can be given to anyone.
- RECIEVER
Only the matching key pair will decrypt it.
The private key is kept secret. 26

27. Cryptography Asymmetric Encryption - Mathematically, It should not be
possible to get a key pair’s private key from the public key.
- Anyone with a private key can generate its public pair.
- This is done using one-way (hash) functions. 27

28. Cryptography Asymmetric Encryption - Advantages Key Management
Distribution
Confidentiality, Integrity, and Non-repudiation
- Disadvantages
Can’t encrypt large amounts of data. 28

29. Cryptography Asymmetric Encryption - Advantages
Solves Key Management Problem!!
Assume you wanted to communicate with 10 other people while ensuring confidentiality.
How many keys would you need now? 29

30. 30

31. Cryptography Hashing - Taking variable amounts
of data and compressing it
into a fixed length value,
producing unique outputs.
- A different MD5 hash would indicate
the file has been altered or corrupted.
- Message digest helps to verify integrity.
- Integrity and/or nonrepudiation 31

32. Cryptography Digital Signatures
Message goes through a Hashing algorithm.
The message and the message digest is encrypted with the sender’s private key.
The receiver validates the digital signature by decrypting it with the sender’s public key.
Provides integrity, authenticity, and non-repudiation.
If I use my private key to encrypt something then it proves it came from me. 32

33. Cryptography
Understanding Digital Signatures 33

34. How is integrity and non-repudiation maintained?
Cryptography
Understanding Digital Signatures
How is integrity and non-repudiation maintained? 34

35. Cryptography
Cryptographic Algorithms 35

36. Cryptography Cryptographic Algorithms
Symmetric Key Cryptography: Encryption Standards 36

37. Cryptography Characteristics of Strong Algorithms: - Confusion
Changing a char in plaintext doesn’t create predictable cipher text.
Reverse Engineering process is difficult.
Contains Complexity.
- Diffusion
Changes in plaintext creates large change in cipher text; avoiding discovery of key. 37

38. Cryptography Characteristics of Strong Algorithms: - Complexity
A flat cipher is created by distributing the frequency of characters evenly. 38

39. Cryptography Kerckoff’s Principal:
“…the security of a cipher system should depend on the key and not the algorithm…”
Why would it be advantageous to release the cipher algorithm to the public? Why wouldn’t it be…? 39

40. 40

41. How did they do that???
They sell you the private key. 41

42. Cryptography Attacks Birthday Attack
- Used to find the same hash value for two different inputs
Reveals any mathematical weaknesses in the hashing algorithm.
Total Hashes
Input attempts required for 50% chance of output collision 42

43. Cryptography Attacks Brute-Force Attack
- Tries all possible keys in a key space. 43

44. Cryptography Attacks Mathematical Attacks
Properties of the algorithm are attacked.
MAIN CATAGORIES
Chosen-plaintext attack: access to PT and CT to determine key.
Known plaintext attack: access to “known” PT and CT forms.
Chosen-ciphertext attack: access to the CT ready to be decrypted.
Ciphertext-only attack: access to CT but not the PT.
Side-channel attack: misc info, EM emissions, noise, vibrations, ... 44

45. Review Questions
Question #1
What is Cryptography? 45

46. Review Questions Question #1 What is Cryptography?
The science of hiding communications. 46

47. Review Questions
Question #2
What is encryption? 47

48. Review Questions Question #2 What is encryption?
Transforming data into an unreadable format. 48

49. Review Questions
Question #3
What is an algorithm? 49

50. Review Questions Question #3 What is an algorithm?
Describes the process (instruction set) involved in
producing a desired output. 50

51. Review Questions
Question #4
What is a Cryptographic Key? 51

52. Review Questions Question #4 What is a Cryptographic Key?
Piece of information that controls how the cryptographic
algorithm functions (works). 52

53. Review Questions
Question #5
What is Cryptanalysis? 53

54. Review Questions Question #5 What is Cryptanalysis?
Breaking cryptography; act of obtaining plain text from
cipher text. 54

55. Review Questions Question #6
Which of the following is a disadvantage of symmetric key encryption?
Key Size
Speed
Key Management
Key Strength 55

56. Review Questions Question #6
Which of the following is a disadvantage of symmetric key encryption?
Key Size
Speed
Key Management
Key Strength 56

57. Review Questions Question #7
Which of the following attacks requires an attacker to obtain several encrypted messages that have been encrypted using the same encryption algorithm?
Know plain text attack
Cipher text attack
Clear text attack
Replay attack 57

58. Review Questions Question #7
Which of the following attacks requires an attacker to obtain several encrypted messages that have been encrypted using the same encryption algorithm?
Know plain text attack
Cipher text attack
Clear text attack
Replay attack 58

59. Review Questions Question #8
Why does a digital signature contain a message digest?
To detect any alteration of the message
To indicate the encryption algorithm
To confirm the identity of the sender
To enable transmission in a digital format 59

60. Review Questions Question #8
Why does a digital signature contain a message digest?
To detect any alteration of the message
To indicate the encryption algorithm
To confirm the identity of the sender
To enable transmission in a digital format 60

61. Review Questions Question #9
Which is NOT a property of a one-way hash function?
It converts a message of a fixed length into a message digest of arbitrary length
It is computationally infeasible to construct two messages with the same digest
It converts a message of arbitrary length into a message of a fixed length
Given a digest value, it is computationally infeasible to find the corresponding message 61

62. Review Questions Question #9
Which is NOT a property of a one-way hash function?
It converts a message of a fixed length into a message digest of arbitrary length
It is computationally infeasible to construct two messages with the same digest
It converts a message of arbitrary length into a message of a fixed length
Given a digest value, it is computationally infeasible to find the corresponding message 62

63. Review Questions Question #10
What are the three most important functions that digital signatures perform?
Integrity, Confidentiality, and Authorization
Integrity, Authentication, and Nonrepudiation
Authorization, Authentication, and Nonrepudiation
Authorization, Detection, and Accountability 63

64. Review Questions Question #10
What are the three most important functions that digital signatures perform?
Integrity, Confidentiality, and Authorization
Integrity, Authentication, and Nonrepudiation
Authorization, Authentication, and Nonrepudiation
Authorization, Detection, and Accountability 64

65. Review Questions Question #11
What is the result of a hash algorithm being applied to a message?
A digital signature
A cipher text
A message digest
A plaintext 65

66. Review Questions Question #11
What is the result of a hash algorithm being applied to a message?
A digital signature
A cipher text
A message digest
A plaintext 66

67. Review Questions Question #12
A hash value is a fixed-length string used to verify message integrity?
TRUE
FALSE 67

68. Review Questions Question #12
A hash value is a fixed-length string used to verify message integrity?
TRUE
FALSE 68

69. Review Questions Question #13
Why did the NSA decide to drop support for DES?
The cost was too high.
The encryption algorithm was too slow.
The processing power of computers had increased.
It was too difficult for government agencies to use. 69

70. Review Questions Question #13
Why did the NSA decide to drop support for DES?
The cost was too high.
The encryption algorithm was too slow.
The processing power of computers had increased.
It was too difficult for government agencies to use. 70

71. Review Questions Question #14
Two different messages producing the same hash value results in which of the following?
Duplicate key
Corrupt key
Collision
Message digest 71

72. Review Questions Question #14
Two different messages producing the same hash value results in which of the following?
Duplicate key
Corrupt key
Collision
Message digest 72

73. Review Questions Question #15
Which of the following is an asymmetric algorithm?
DES
AES
RSA
Blowfish 73

74. Review Questions Question #15
Which of the following is an asymmetric algorithm?
DES
AES
RSA
Blowfish 74

75. Review Questions Question #16 (last one)
What type of cryptographic algorithm is being used? 75

76. Review Questions Question #16 (last one)
What type of cryptographic algorithm is being used?
Caesar Cipher / Substitution Algorithm / ROT 76

77. Quiz
Short answer, closed book, closed notes. 77

78. probbins@hawaii.edu Questions? www2.hawaii.edu/~probbins 78