1. Cyber Operation and Penetration Testing Basic Cryptography and Applications Cliff Zou University of Central Florida 1

2. Acknowledgement Some slides modified from slides by textbook:
Computer Networking: A Top Down Approach Featuring the Internet, J. Kurose & K. Ross, Addison Wesley, 5rd ed., 2009
Message Authentication Code slides modified from textbook:
Cryptography and Network Security: Principles and Practice, by William Stallings
Network Security

3. Why This Introduction?
Some students may have no knowledge of basic cryptography and basic network security
Such knowledge is important
Such knowledge is necessary for continuing learning malware and software security

4. Friends and enemies: Alice, Bob, Trudy
well-known in network security world
Bob, Alice (lovers!) want to communicate “securely”
Trudy (intruder) may intercept, delete, add messages
Alice
Bob
channel
data, control messages
secure
sender
secure
receiver
data
data
Trudy

5. Who might Bob, Alice be? Web client/server (e.g., on-line purchases)
DNS servers
routers exchanging routing table updates
Two computers in peer-to-peer networks
Wireless laptop and wireless access point
Cell phone and cell tower
Cell phone and bluetooth earphone
RFID tag and reader

6. There are bad guys (and girls) out there!
Q: What can a “bad guy” do?
A: a lot!
eavesdrop: intercept messages
actively insert messages into connection
impersonation: can fake (spoof) source address in packet (or any field in packet)
hijacking: “take over” ongoing connection by removing sender or receiver, inserting himself in place
denial of service: prevent service from being used by others (e.g., by overloading resources)

7. The language of cryptography
Alice’s
encryption
key
Bob’s
decryption
key K A K B
encryption
algorithm
plaintext
ciphertext
decryption
algorithm
plaintext
symmetric key crypto: sender, receiver keys identical public-key crypto: encryption key public, decryption key secret (private)

8. Classical Cryptography
Transposition Cipher
Substitution Cipher
Simple substitution cipher (Caesar cipher)
Vigenere cipher
One-time pad

9. Transposition Cipher: rail fence
Write plaintext in two rows in column order
Generate ciphertext in row order
Example: “HELLOWORLD”
HLOOL
ELWRD
ciphertext: HLOOLELWRD
Problem: does not affect the frequency of individual symbols

10. Simple substitution cipher
substituting one thing for another
Simplest one: monoalphabetic cipher:
substitute one letter for another (Caesar Cipher)
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
D E F G H I J K L M N O P Q R S T U V W X Y Z A B C
Example: encrypt “I attack”

11. Problem of simple substitution cipher
However:
Previous cipher has a key with only 26 possible values
English texts have statistical structure:
the letter “e” is the most used letter. Hence, if one performs a frequency count on the ciphers, then the most frequent letter can be assumed to be “e”

12. Distribution of Letters in English
Frequency analysis

13. Vigenere Cipher
Idea: Uses Caesar's cipher with various different shifts, in order to hide the distribution of the letters.
A key defines the shift used in each letter in the text
A key word is repeated as many times as required to become the same length
Plain text: I a t t a c k
Key: (key is “234”)
Cipher text: K d x v d g m

14. Problem of Vigenere Cipher
Vigenere is easy to break (Kasiski, 1863):
Assume we know the length of the key. We can organize the ciphertext in rows with the same length of the key. Then, every column can be seen as encrypted using Caesar's cipher.
The length of the key can be found using several methods:
1. If short, try 1, 2, 3,
2. Find repeated strings in the ciphertext. Their distance is expected to be a multiple of the length. Compute the gcd of (most) distances.
3. Use the index of coincidence.

15. One-time Pad Extended from Vigenere cipher
Key is as long as the plaintext
Key string is random chosen
Pro: Proven to be “perfect secure”
Cons:
How to generate Key?
How to let bob/alice share the same key pad?
Code book

16. Symmetric key cryptographyAB K AB
encryption
algorithm
plaintext
message, m
ciphertext
decryption
algorithm
plaintext
K (m)
K (m) AB
m = K ( ) AB
symmetric key crypto: Bob and Alice share know same (symmetric) key: K
e.g., key is knowing substitution pattern in mono alphabetic substitution cipher
Q: how do Bob and Alice agree on key value? AB

17. Symmetric key crypto: DES
DES: Data Encryption Standard
US encryption standard [NIST 1993]
56-bit symmetric key, 64-bit plaintext input
How secure is DES?
DES Challenge: 56-bit-key-encrypted phrase (“Strong cryptography makes the world a safer place”) decrypted (brute force) in 4 months
no known “backdoor” decryption approach
making DES more secure (3DES):
use three keys sequentially on each datum
use cipher-block chaining

18. Symmetric key crypto: DES
DES operation
initial permutation 16 identical “rounds” of function application, each using different 48 bits of key final permutation

19. AES: Advanced Encryption Standard
new (Nov. 2001) symmetric-key NIST standard, replacing DES
processes data in 128 bit blocks
128, 192, or 256 bit keys
brute force decryption (try each key) taking 1 sec on DES, takes 149 trillion years for AES

20. Block Cipher one pass through: one input bit affects eight output bits
64-bit input
8bits
8bits
8bits
8bits
8bits
8bits
8bits
8bits
loop for n rounds T1 T2 T3 T4 T5 T6 T7 T8
8 bits
8 bits
8 bits
8 bits
8 bits
8 bits
8 bits
8 bits
one pass through: one input bit affects eight output bits
64-bit scrambler
64-bit output
multiple passes: each input bit affects most output bits
block ciphers: DES, 3DES, AES

21. Cipher Block Chaining +
cipher block: if input block repeated, will produce same cipher text:
m(1) = “HTTP/1.1”
c(1) = “k329aM02”
t=1
block
cipher …
m(17) = “HTTP/1.1”
c(17) = “k329aM02”
t=17
block
cipher
cipher block chaining: XOR ith input block, m(i), with previous block of cipher text, c(i-1)
c(0) transmitted to receiver in clear
what happens in “HTTP/1.1” scenario from above?
m(i) +
c(i-1)
block
cipher
c(i)

22. Public Key Cryptography
symmetric key crypto
requires sender, receiver know shared secret key
Q: how to agree on key in first place (particularly if never “met”)?
public key cryptography
radically different approach [Diffie-Hellman76, RSA78]
sender, receiver do not share secret key
public encryption key known to all
private decryption key known only to receiver

23. Public key cryptography+
Bob’s public
key K B -
Bob’s private
key K B
plaintext
message, m
encryption
algorithm
ciphertext
decryption
algorithm
plaintext
message
K (m) B +
m = K (K (m)) B + -

24. Public key encryption algorithms
Requirements: . . + - 1
need K ( ) and K ( ) such that B B
K (K (m)) = m B - + + 2
given public key K , it should be impossible to compute private key K B - B
RSA: Rivest, Shamir, Adelson algorithm

25. RSA: Choosing keys 1. Choose two large prime numbers p, q.
(e.g., 1024 bits each)
2. Compute n = pq, z = (p-1)(q-1)
3. Choose e (with e<n) that has no common factors
with z. (e, z are “relatively prime”).
4. Choose d such that ed-1 is exactly divisible by z.
(in other words: ed mod z = 1 ).
5. Public key is (n,e). Private key is (n,d). K B + K B -

26. RSA: Encryption, decryption
0. Given (n,e) and (n,d) as computed above
1. To encrypt bit pattern, m, compute
c = m mod n e
(i.e., remainder when m is divided by n)
2. To decrypt received bit pattern, c, compute
m = c mod n d d
(i.e., remainder when c is divided by n)
Magic
happens!
m = (m mod n) e
mod n d c

27. RSA example: Bob chooses p=5, q=7. Then n=35, z=24.
e=5 (so e, z relatively prime).
d=29 (so ed-1 exactly divisible by z). e
c = m mod n e
letter m m
encrypt: l 12 17 c d
m = c mod n d c
letter
decrypt: 17 12 l
Computational extensive

28. RSA: Why is that m = (m mod n) e mod n d
Useful number theory result: If p,q prime and
n = pq, then:
x mod n = x mod n y
y mod (p-1)(q-1)
(m mod n) e
mod n = m mod n d ed
= m mod n
ed mod (p-1)(q-1)
(using number theory result above)
= m mod n 1
(since we chose ed to be divisible by
(p-1)(q-1) with remainder 1 )
= m

29. RSA: another important property
The following property will be very useful later:
K (K (m)) = m B - +
K (K (m)) =
use public key first, followed by private key
use private key first, followed by public key
Result is the same!

30. Digital Signatures
Cryptographic technique analogous to hand- written signatures.
sender (Bob) digitally signs document, establishing he is document owner/creator.
verifiable, nonforgeable: recipient (Alice) can prove to someone that Bob, and no one else (including Alice), must have signed document

31. Bob’s message, m, signed (encrypted) with his private key
Digital Signatures
Simple digital signature for message m:
Bob signs m by encrypting with his private key KB, creating “signed” message, KB(m) - - K B -
Bob’s message, m
Bob’s private
key K B -
(m)
Dear Alice
Oh, how I have missed you. I think of you all the time! …(blah blah blah)
Bob
Bob’s message, m, signed (encrypted) with his private key
Public key
encryption
algorithm

32. Digital Signatures (more)-
Suppose Alice receives msg m, digital signature KB(m)
Alice verifies m signed by Bob by applying Bob’s public key KB to KB(m) then checks KB(KB(m) ) = m.
If KB(KB(m) ) = m, whoever signed m must have used Bob’s private key. + - + - + -
Alice thus verifies that:
Bob signed m.
No one else signed m.
Bob signed m and not m’.
Non-repudiation:
Alice can take m, and signature KB(m) to court and prove that Bob signed m. -

33. Message Digests
large
message m
H: Hash
Function
Computationally expensive to public-key-encrypt long messages
Goal: fixed-length, easy- to- compute digital “fingerprint”
apply hash function H to m, get fixed size message digest, H(m).
H(m)
Hash function properties:
many-to-1
produces fixed-size msg digest (fingerprint)
given message digest x, computationally infeasible to find m such that x = H(m)

35. Hash Function Algorithms
MD5 hash function widely used (RFC 1321)
computes 128-bit message digest in 4-step process.
arbitrary 128-bit string x, appears difficult to construct msg m whose MD5 hash is equal to x.
SHA-1 is also used.
US standard [NIST, FIPS PUB 180-1]
160-bit message digest

36. Digital signature = signed message digest
Alice verifies signature and integrity of digitally signed message:
Bob sends digitally signed message:
large
message m
H: Hash
function
KB(H(m)) -
encrypted
msg digest
H(m)
digital
signature
(encrypt)
Bob’s
private
key
large
message m K B -
Bob’s
public
key
digital
signature
(decrypt) K B +
KB(H(m)) -
encrypted
msg digest
H: Hash
function +
H(m)
H(m)
equal ?
No confidentiality !

37. Trusted Intermediaries
Symmetric key problem:
How do two entities establish shared secret key over network?
Solution:
trusted key distribution center (KDC) acting as intermediary between entities
Public key problem:
When Alice obtains Bob’s public key (from web site, , diskette), how does she know it is Bob’s public key, not Trudy’s?
Solution:
trusted certification authority (CA)

38. Key Distribution Center (KDC)
Alice, Bob need shared symmetric key.
KDC: server shares different secret key with each registered user (many users)
Alice, Bob know own symmetric keys, KA-KDC KB-KDC , for communicating with KDC.
KDC
KB-KDC
KP-KDC
KA-KDC
KX-KDC
KP-KDC
KY-KDC
KZ-KDC
KA-KDC
KB-KDC

39. Key Distribution Center (KDC)
Q: How does KDC allow Bob, Alice to determine shared symmetric secret key to communicate with each other?
KDC generates R1
KA-KDC(A,B)
KA-KDC(R1, KB-KDC(A,R1) )
Alice
knows R1
Bob knows to use R1 to communicate with Alice
KB-KDC(A,R1)
Alice and Bob communicate: using R1 as
session key for shared symmetric encryption
Why not R1=KB-KDC?

40. Certification Authorities
Certification authority (CA): binds public key to particular entity, E.
E (person, router) registers its public key with CA.
E provides “proof of identity” to CA.
CA creates certificate binding E to its public key.
certificate containing E’s public key digitally signed by CA – CA says “this is E’s public key” - K CA
(K ) B +
digital
signature
(encrypt) K B +
Bob’s
public
key K B + CA
private
key
certificate for Bob’s public key, signed by CA -
Bob’s
identifying information K CA

41. Certification Authorities
When Alice wants Bob’s public key:
gets Bob’s certificate (Bob or elsewhere).
apply CA’s public key to Bob’s certificate, get Bob’s public key K B + - K CA
(K ) B +
digital
signature
(decrypt)
Bob’s
public
key K B + CA
public
key + K CA

42. A certificate contains:
Serial number (unique to issuer)
info about certificate owner, including algorithm and key value itself (not shown)
info about certificate issuer
valid dates
digital signature by issuer

43. Internet Web Security Architecture
Web Server B CA
K+B
use a side channel
K-CA(K+B)
Client A
Cert Request
K-CA(K+B)
K+B(KAB, R)
KAB(R)
KAB(m)

44. Internet Web Security Conditions
Clients’ web browsers have built-in CAs.
CAs are trustable
Web servers have certificates in CAs.
Q: What if a server has no certificate?
Example: SSH servers

45. SSH Example Initial setup: Trust the first-time connection
Client A
Web Server B
K+B(KAB, R)
KAB(R)
KAB(m)
Initial setup:
Trust the first-time connection
Save the server’s public key

46. . . Secure Communication +
Assumption: Public keys are pre-distributed securely
E.g: through CA, or pre-established like SSH
Alice wants to send confidential , m, to Bob. KS
KS( ) .
KS(m ) m +
Internet
KB( ) . + KS
KB(KS ) + KB +
Alice:
generates random symmetric private key, KS.
encrypts message with KS (for efficiency)
also encrypts KS with Bob’s public key.
sends both KS(m) and K+B(KS) to Bob.

47. . Secure Communication - Bob:
Alice wants to send confidential , m, to Bob.
KS( ) .
KB( ) + -
KS(m )
KB(KS ) m KS KB
Internet
Bob:
uses his private key to decrypt and recover KS
uses KS to decrypt KS(m) to recover m

48. . Secure Communication +
Alice wants to provide sender authentication message integrity.
H( ) .
KA( ) - +
H(m )
KA(H(m)) m KA
Internet
compare
Alice digitally signs message.
sends both message (in the clear) and digital signature.

49. . Secure Communication +
Alice wants to provide secrecy, sender authentication, message integrity.
H( ) .
KA( ) - +
KA(H(m)) m KA
KS( )
KB( )
KB(KS ) KS KB
Internet
Alice uses three keys: her private key, Bob’s public key, newly created symmetric key

50. Hash Function and Message Authentication Code (MAC)

51. MD5 designed by Ronald Rivest (the R in RSA)
latest in a series of MD2, MD4
produces a 128-bit hash value
until recently was the most widely used hash algorithm
in recent times have both brute-force & cryptanalytic concerns
specified as Internet standard RFC1321
MD5 is the current, and very widely used, member of Rivest’s family of hash functions.

52. MD5 Overview pad message so its length is 448 mod 512
Padding of bits is always used.
Padding: 1000….0
append a 64-bit length value to message
Generate a message with 512L bits in length
initialise 4-word (128-bit) MD buffer (A,B,C,D)
process message in 16-word (512-bit) blocks:
output hash value is the final buffer value
The padded message is broken into 512-bit blocks, processed along with the buffer value using 4 rounds, and the result added to the input buffer to make the new buffer value. Repeat till run out of message, and use final buffer value as hash. nb. due to padding always have a full final block (with length in it).

53. MD5 Overview
Stallings Fig 12-1.

55. SHA Overview pad message so its length is 448 mod 512
append a 64-bit length value to message
initialise 5-word (160-bit) buffer (A,B,C,D,E) to
( ,efcdab89,98badcfe, ,c3d2e1f0)
process message in 16-word (512-bit) chunks:
expand 16 words into 80 words by mixing & shifting
use 4 rounds of 20 bit operations on message block & buffer
add output to input to form new buffer value
output hash value is the final buffer value
Note that the SHA-1 Overview is very similar to that of MD5.

57. Revised Secure Hash Standard
NIST have issued a revision FIPS 180-2
adds 3 additional hash algorithms
SHA-256, SHA-384, SHA-512
Different lengths of hash bits
designed for compatibility with increased security provided by the AES cipher
structure & detail is similar to SHA-1
See Stallings Tables 12.3 and 12.4 for details.

58. Message Authentication Code (MAC)
generated by an algorithm that creates a small fixed-sized block
depending on both message and some key
like encryption though need not be reversible
appended to message as a signature
receiver performs same computation on message and checks it matches the MAC
provides assurance that message is unaltered and comes from sender
An alternative authentication technique involves the use of a secret key to generate a small fixed-size block of data, known as a cryptographic checksum or MAC that is appended to the message. This technique assumes that two communicating parties, say A and B, share a common secret key K. A MAC function is similar to encryption, except that the MAC algorithm need not be reversible, as it must for decryption.

59. Message Authentication Code
a small fixed-sized block of data
generated from message + secret key
MAC = C(K,M)
appended to message when sent
Append operator
An alternative authentication technique involves the use of a secret key to generate a small fixed- size block of data, known as a cryptographic checksum or MAC that is appended to the message. This technique assumes that two communicating parties, say A and B, share a common secret key K. When A has a message to send to B, it calculates the MAC as a function of the message and the key: MAC = C(K, M). The message plus MAC are transmitted to the intended recipient. The recipient performs the same calculation on the received message, using the same secret key, to generate a new MAC. The received MAC is compared to the calculated MAC (Stallings Figure 12.4a). If we assume that only the receiver and the sender know the identity of the secret key, and if the received MAC matches the calculated MAC, then the receiver is assured that the message has not been altered, is from the alleged sender, and if the message includes a sequence number then the receiver can be assured of the proper sequence because an attacker cannot successfully alter the sequence number. A MAC function is similar to encryption. One difference is that the MAC algorithm need not be reversible, as it must for decryption. In general, the MAC function is a many-to-one function.

60. Message Authentication Codes
as shown the MAC provides authentication
can also use encryption for secrecy
generally use separate keys for each
can compute MAC either before or after encryption
is generally regarded as better done before
why use a MAC?
sometimes only authentication is needed
sometimes need authentication to persist longer than the encryption (eg. archival use)
Note: MAC is not a digital signature because both sender/receiver use the same key
The process depicted on the previous slide provides authentication but not confidentiality, because the message as a whole is transmitted in the clear. Confidentiality can be provided by performing message encryption either after (see Stallings Figure 12.4b) or before (see Stallings Figure 12.4c) the MAC algorithm. In both these cases, two separate keys are needed, each of which is shared by the sender and the receiver. Typically, it is preferable to tie the authentication directly to the plaintext, so the method of Figure 12.4b is used. Can use MAC in circumstances where just authentication is needed (or needs to be kept), see text for examples (e.g. such as when the same message is broadcast to a number of destinations; when one side has a heavy load and cannot afford the time to decrypt all incoming messages; or do not need to keep messages secret, but must authenticate messages). Finally, note that the MAC does not provide a digital signature because both sender and receiver share the same key.

61. Keyed Hash Functions as MACs
want a MAC based on a hash function
because hash functions are generally faster
crypto hash function code is widely available
hash includes a key along with message
original proposal:
KeyedHash = Hash(Key|Message)
some weaknesses were found with this
eventually led to development of HMAC (Hash-based message authentication code)
In recent years, there has been increased interest in developing a MAC derived from a cryptographic hash function, because they generally execute faster in software than symmetric block ciphers, and because code for cryptographic hash functions is widely available. A hash function such as SHA was not designed for use as a MAC and cannot be used directly for that purpose because it does not rely on a secret key. There have been a number of proposals for the incorporation of a secret key into an existing hash algorithm, originally by just pre-pending a key to the message. Problems were found with these earlier, simpler proposals, but they resulted in the development of HMAC.

62. HMAC Design Objectives
use, without modifications, hash functions
allow for easy replaceability of embedded hash function
preserve original performance of hash function without significant degradation
use and handle keys in a simple way.
have well understood cryptographic analysis of authentication mechanism strength
RFC 2104 lists the following design objectives for HMAC:
• To use, without modifications, available hash functions. In particular, hash functions that perform well in software, and for which code is freely and widely available.
• To allow for easy replaceability of the embedded hash function in case faster or more secure hash functions are found or required.
• To preserve the original performance of the hash function without incurring a significant degradation.
• To use and handle keys in a simple way.
• To have a well understood cryptographic analysis of the strength of the authentication mechanism based on reasonable assumptions about the embedded hash function.

63. HMAC specified as Internet standard RFC2104
uses hash function on the message:
HMACK(M)= Hash[(K+ XOR opad) ||
Hash[(K+ XOR ipad) || M)] ]
where K+ is the key padded out to size
opad, ipad are specified padding constants
any hash function can be used
eg. MD5, SHA-1, RIPEMD-160, Whirlpool
The idea of a keyed hash evolved into HMAC, designed to overcome some problems with the original proposals. It involves hashing padded versions of the key concatenated with the message, and then with another outer hash of the result prepended by another padded variant of the key. The hash function need only be used on 3 more blocks than when hashing just the original message (for the two keys + inner hash). HMAC can use any desired hash function, and has been shown to have the same security as the underlying hash function. Can choose the hash function to use based on speed/security concerns.

64. HMAC Generation Overview
SHA-1 HMAC Generation
Image comes from Wikipedia.com: based_message_authentication_code