1. EEC 688/788 Secure and Dependable Computing Lecture 4 Wenbing Zhao Department of Electrical and Computer Engineering Cleveland State University wenbing@ieee.org

2. 2 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao Outline Next Monday: Labor day – no class Introduction to cryptography –One time pad –Block and stream ciphers –Breaking Encryption Schemes Symmetric-key algorithms –DES, AES, etc –Cipher modes

3. 3 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao One-Time Pads One-time pad: construct an unbreakable cipher –Choose a random bit string as the key –Convert the plaintext into a bit string –Compute the XOR of these two strings, bit by bit –The resulting ciphertext cannot be broken, because in a sufficiently large sample of ciphertext, each letter will occur equally often, as will every digram, every trigram, and so on => There is simply no information in the message because all possible plaintexts of the given length are equally likely

4. 4 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao The Vernam Cipher The Vernam Cipher is a type of one-time pad devised by Gilbert Vernam for AT&T

5. 5 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao The Vernam Cipher The encryption involves an arbitrarily long nonrepeating sequence of numbers that are combined with the plaintext Assume that the alphabetic letters correspond to their counterparts in arithmetic notation mod 26 –That is, the letters are represented with numbers 0 through 25 To use the Vernam cipher, we sum this numerical representation with a stream of random two-digit numbers

6. 6 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao The Vernam Cipher - Example Plaintext VERNAMCIPHER Numeric Equivalent 214171301228157417 + Random Number 7648168244358116054788 = Sum 9752339544156019751251105 = mod 26 19071718158192312251 Ciphertext tahrspitxmzb

7. 7 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao The Vernam Cipher - Observations The repeated letter t comes from different plaintext letters Duplicate ciphertext letters are generally unrelated when this encryption algorithm is used => there is no information in the message to be exploited

8. 8 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao The Vernam Cipher - Decryption To decrypt: (C i – K i ) mod 26 –Note on rules of mod on negative number: “The mod function is defined as the amount by which a number exceeds the largest integer multiple of the divisor that is not greater than that number” ( http://mathforum.org/library/drmath/view/52343.html) –Modula op always return non-negative number –E.g., (19-76) mod 26 = (-57) mod 26 = (-78+21) mod 26 = 21

9. 9 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao The Vernam Cipher - Decryption Ciphertext tahrspitxmzb Numeric equivalent 19071718158192312251 - One-time pad 7648168244358116054788 = Difference -57-48-9-65-2612-508-377-22-87 = mod 26 214171301228157417 Plaintext VERNAMCIPHER

10. 10 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao One-Time Pads Disadvantages –The key cannot be memorized, both sender and receiver must carry a written copy with them –Total amount of data can be transmitted is limited by the amount of key available –Sensitive to lost or inserted characters

11. 11 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao Stream Ciphers Stream ciphers: convert one symbol of plaintext immediately into a symbol of ciphertext –The transformation depends only on the symbol, the key, and the control information of the encryption algorithm

12. 12 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao Block Ciphers Block cipher: encrypts a group of plaintext symbols as one block –It works on blocks of plaintext and produce blocks of ciphertext –The columnar transposition is an example of block ciphers

13. 13 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao Cryptanalysis – Breaking Encryption Schemes Ciphertext-only: cryptanalyst has a quantity of ciphertext and no plaintext Known plaintext: cryptanalyst has some matched ciphertext and plaintext Chosen plaintext: cryptanalyst has the ability to encrypt pieces of plaintext of his own choosing

14. 14 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao Symmetric-Key Algorithms DES – The Data Encryption Standard AES – The Advanced Encryption Standard Other Ciphers Cipher Modes

15. 15 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao Data Encryption Standard Developed by IBM. US standard for unclassified info (1977) Same key for encryption as for decryption Encrypts in 64-bit blocks Uses 56-bit key Has 19 stages, 16 parameterized by different functions of the key

16. 16 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao Triple DES Triple DES – effectively increases the key length. It uses two keys and three stages –In first stage, the plaintext is encrypted using DES in the usual way with K 1 –In second stage, DES is run in decryption mode, using K 2 as the key –In third stage, another DES encryption is done with K 1 Triple DES encryption Triple DES decryption

17. 17 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao AES – The Advanced Encryption Standard AES is a result of a cryptographic contest –Organized by NIST in 1997 Rules for AES proposals 1.The algorithm must be a symmetric block cipher 2.The full design must be public 3.Key lengths of 128, 192, and 256 bits supported 4.Both software and hardware implementations required 5.The algorithm must be public or licensed on nondiscriminatory terms Winner: Rijndael (from two Belgian cryptographers: Joan Daemen and Vincent Rijmen)

18. 18 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao Other Symmetric-Key Ciphers

19. 19 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao Cipher Modes AES and DES (or any block cipher) is basically a monoalphabetic substitution cipher using big characters –Whenever the same plaintext block goes in the front end, the same ciphertext block comes out the back end –If you encrypt the plaintext abcdefgh 100 times with same DES key, you get the same ciphertext 100 times –An intruder can exploit this property to help subvert the cipher

20. 20 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao Electronic Code Book Mode In ECB mode, each plaintext block is encrypted independently with the block cipher ECB allows easy parallelization to yield higher performance. However, no processing is possible before a block is seen

21. 21 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao Electronic Code Book Mode - Problems In ECB, plaintext patterns are not concealed –Each identical block of plaintext gives an identical block of ciphertext. The plaintext can be easily manipulated by removing, repeating, or interchanging blocks Example

22. 22 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao Cipher Block Chaining Mode To avoid the ECB mode problem: replacing a block will cause the plaintext decrypted starting at the replaced to become garbage Exclusive OR the encrypted text with the next block of plaintext before encryption: C 0 = E(P 0 XOR IV), C 1 = E(P 1 XOR C 0 ), etc. Drawback: must wait until full 64-bit (128-bit) block to arrive to decrypt

23. 23 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao Cipher Block Chaining Mode Exclusive OR the encrypted text with the next block of plaintext before encryption: C 0 = E(P 0 XOR IV), C 1 = E(P 1 XOR C 0 ), etc. Initialization Vector Encryption Decryption

24. 24 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao Cipher Feedback Mode CFB mode makes a block cipher into a self- synchronizing stream cipher Basic operation: –Ci = E(Ci-1) XOR Pi, Pi = E(Ci-1) XOR Ci, C0 = IV –Issue: Losing a single bit or byte will ruin all data after that

25. 25 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao Cipher Feedback Mode To enable byte-by-byte encryption –When plaintext byte n (P n ) arrives, DES algorithm operates a 64-bit register to generate a 64-bit ciphertext –Leftmost byte of that ciphertext is extracted and XORed with P n –That byte is transmitted on the transmission line –The shift register is shifted left 8 bits, causing C n-8 to fall off the left end, and C n is inserted in the position just vacated at the right end by C 9 Drawback: One byte of transmission error will ruin 8 bytes of data

26. 26 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao Cipher Feedback Mode Encryption Decryption

27. 27 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao Stream Cipher Mode To be insensitive to transmission error, an arbitrarily large sequence of output blocks, called the keystream, is treated like a one-time pad and XORed with the plaintext to get the ciphertext –It works by encrypting an IV, using a key to get an output block –The output block is then encrypted, using the key to get a second output block –This block is then encrypted to get a third block, and so on The keystream is independent of the data, so (1) It can be computed in advance (2) It is completely insensitive to transmission errors

28. 28 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao Stream Cipher Mode Encryption Decryption

29. 29 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao Stream Cipher Mode It is essential never to use the same (key, IV) pair twice with a stream cipher because doing so will generate the same keystream each time Using the same keystream twice exposes the ciphertext to a keystream reuse attack Stream cipher mode is also called output feedback mode

30. 30 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao Keystream Reuse Attack Plaintext block, P0, is encrypted with the keystream to get P0 XOR K0 Later, a second plaintext block, Q0, is encrypted with the same keystream to get Q0 XOR K0 An intruder who captures both ciphertext blocks can simply XOR them together to get P0 XOR Q0, which eliminates the key The intruder now has the XOR of the two plaintext blocks If one of them is known or can be guessed, the other can also be found In any event, the XOR of two plaintext streams can be attacked by using statistical properties of the message

31. 31 6/20/2015EEC688: Secure & Dependable ComputingWenbing Zhao Counter Mode To allow random access to encrypted data –The IV plus a constant is encrypted, and the resulting ciphertext XORed with the plaintext –By stepping the IV by 1 for each new block, it is easy to decrypt a block anywhere in the file without first having to decrypt all of its predecessors