1. Introduction to Information Security Lecture 6: Other Cryptographic Primitives 2009. 7.

2. 2 1.Mode of Operation 2.Blind Signatures 3.Secret Sharing and Threshold Cryptography 4.Zero-knowledge Proofs 5.Identification, Authentication Contents

3. 3 Mode of Operation

4. 4 Modes of Operation – ECB Mode  Electronic Code Book Mode Break a message into a sequence of plaintext blocks Each plaintext block is encrypted (or decrypted) independently The same plaintext block always produces the same ciphertext block May not be secure; e.g., a highly structured message Typically used for secure transmission of single vales (e.g., encryption key) E P1P1 C1C1 E P2P2 C2C2 E PnPn CnCn D D D P1P1 P2P2 PnPn K K...

5. 5 Modes of Operation – CBC Mode  Cipher Block Chaining Mode Each ciphertext block is affected by previous blocks No fixed relationship between the plaintext block and its input to the encryption function The same plaintext block, if repeated, produces different ciphertext blocks IV(Initializing Vector) must be known to both ends Most widely used for block encryption E P1P1 C1C1 E P2P2 C2C2 E PnPn CnCn K... IV D D D K... IV P1P1 P2P2 PnPn C 1 = E K (P 1  IV) P 1 = IV  D K (C 1 ) C 3 = E K (P 3  C 2 ) P 3 = C 2  D K (C 3 ) C 2 = E K (P 2  C 1 ) P 2 = C 1  D K (C 2 ) C 4 = E K (P 4  C 3 ) P 4 = C 3  D K (C 4 )

6. 6 Modes of Operation – CFB Mode  Cipher Feedback Mode A way of using a block cipher as a stream cipher A shift register of block size maintains the current state of the cipher operation, initially set to some IV The value of the shift register is encrypted using key K and the leftmost j bits of the output is XORed with j-bit plaintext P i to produce j-bit ciphertext C i The value of the shift register is shifted left by j bits and the C i is fed back to the rightmost j bits of the shift register Typically j = 8, 16, 32, 64 … Decryption function D K is never used E P1P1 E P2P2 K... IV C1C1 E C2C2 E PnPn E CnCn E P1P1 E P2P2 K... IV C1C1 E C2C2 E PnPn E CnCn

7. 7 Modes of Operation – OFB Mode  Output Feedback Mode The structure is similar to that of CFB, but CFB: Ciphertext is fed back to the shift register OFB: Output of E is fed back to the shift register For security reason, only the full feedback (j = block size) mode is used No error propagation More vulnerable to a message stream modification attack May useful for secure transmission over noisy channel (e.g., satellite communication) E P1P1 E P2P2 K... IV C1C1 E C2C2 E PnPn E CnCn E C1C1 E C2C2 K... IV P1P1 E P2P2 E CnCn E PnPn

8. 8 Modes of Operation – CTS Mode  Ciphertext Stealing Mode Eliminates the padding requirement for block ciphers The same as CBC mode, except for the encryption/decryption of the the last two blocks (one complete block and the remaining partial block) Adopted in H.235 as one of operating modes for block ciphers E P1P1 E P n-1 E PnPn K IV... C n-1 00…0 CnCn C1C1 X E C1C1 C n-1 CnCn K IV... P n-1 PnPn P1P1 X D E D E D 00…0 CnCn X C n-2 * H.235 covers security and encryption for H.323 and other H.245 based terminals. * H.323 covers multimedia communication on any packet network

9. 9 Cryptographic Protocols

10. 10 Typical E-commerce Scenario 카드사용자 1. 거래요청 ( 신용카드정보전송 ) 6. 상품 및 영수증 상점 5. 거래승인 7. 정산요청 2. 거래카드 및 거래정보 Acquiring Bank 3. 승인요청 4. 거래승인 8. 신용카드 대금 청구서 카드 회사 - Combination of lots of computation / communication. - Must be fare to all participating entities

11. 11 Cryptographic Protocols  Cryptographic algorithms Algorithm executed by a single entity Algorithms performing cryptographic functions Encryption, Hash, digital signature, etc…  Cryptographic protocols Protocols executed between multiple entities through pre-defined steps of communication performing security-related functions Perform more complicated functions than what the primitive algorithms can provide Primitives: Key agreement, secret sharing, blind signature, coin toss, secure multiparty computations, etc … Complex application protocols: e-commerce, e-voting, e-auction, etc …

12. 12 Cryptographic Protocols  Protocols Designed to accomplish a task through a series of communication steps, involving two or more entities  Cryptographic Protocols Protocols that use cryptography Non-face-to-face interaction over an open network Cannot trust other entities Entity A Entity B Threat Internet

13. 13 Security Requirements in Protocols Confidentiality Integrity Authentication Non-repudiation Correctness Verifiability Fairness Anonymity Privacy Robustness Efficiency Etc…… Combinations of these requirements according to applications

14. 14 Protocol Primitives  Coin Toss game over Communication Network Two parties play coin toss game over the communication network Can it be made fair?  Blind Signatures Signer signs a document without knowledge of the document and the resulting signature Message and the resulting signature are hidden from the signer Many applications which require anonymity or privacy Digital cash, e-voting  Key Agreements Two or more parties agree on a secret key over communication network in such a way that both influence the outcome. Do not require any trusted third party (TTP)

15. 15 Protocol Primitives  Secret Sharing Distribute a secret amongst a group of participants Each participant is allocated a share of the secret Secret can be reconstructed only when the shares are combined together Individual shares are of no use on their own.  Threshold Cryptography A message is encrypted using a public key and the corresponding private key is shared among multiple parties. In order to decrypt a ciphertext, a number of parties exceeding a threshold is required to cooperate in the decryption protocol.

16. 16 Protocol Primitives  Zero-knowledge Proofs An interactive method for one party to prove to another that a (usually mathematical) statement is true, without revealing anything other than the validity of the statement.  Identification, Authentication Over the communication network, one party, Alice, shows to another party, Bob, that she is the real Alice. Allows one party, Alice, to prove to another party, Bob, that she possesses secret information without revealing to Bob what that secret information is.

17. 17 Application Protocols  Electronic Commerce SET (Secure Electronic Transaction) – Credit card transaction Digital cash, micropayment, e-check, e-money e-auction e-banking  e-government  e-voting  Fair exchange of digital signature (for contract signing)  Application Scenarios  Traditional applications transfer to electronic versions  New applications appear with the help of crypto

18. 18 Blind Signatures

19. Blind Signature Signing without seeing the message - We should not reveal the content of the letter to the signer. - For example, using a carbon-enveloped message Signature User Signer Signature 1) Send an carbon-enveloped message 2) Sign on the envelop 3) Take off the envelop and get the signed message

20. 20 Motivation of Blind Signature  One interesting question of public key cryptosystem is whether we can use digital signature to create some form of digital currency. The scenario is described as follows: 1)A bank published his public key. 2)When one of his customer makes a withdrawal from his account, the bank provides it with a digitally signed note that specifies the amount withdrawn. 3)The customer can present it to a merchant, who can then verify the bank’s signature. 4)Upon completing a transaction, the vender can then remit the note to the bank, which will then credit the vendor the amount specified in the note. 5)This note is, in effect, a digital monetary instrument, we called it as “Electronic Cash or E-Cash”.  Privacy issue of digital cash??? The bank can easily trace a cash to a specific user.

21. 21 E-Cash Scenario Bank Customer Shop Withdrawal Request E-cash Issuing Payment Deposit Public Key

22. 22 David Chaum’s Blind Signature  David Chaum proposed a very elegant solution to this problem, known as blind signature. He is also named as the “father of E-cash”

23. 23 Blind Signature Blind signature scheme is a protocol that allows the provider to obtain a valid signature for a message m from the signer without him seeing the message and its signature. If the signer sees message m and its signature later, he can verify that the signature is genuine, but he is unable to link the message-signature pair to the particular instance of the signing protocol which has led to this pair. Many applications Useful when values need to be certified, yet anonymity should be preserved e-cash, e-voting

24. 24 Blind Signature Protocol Steps 1)Alice takes the document and uses a “blinding factor” to blind the document. (Blinding Phase) 2)Alice sends the blinded document to Bob and Bob signs the blinded document. (Signing Phase) 3)Alice can remove the blinding factor and obtain the signature on the original document. (Unblinding Phase)

25. 25 RSA-based Blind Signature User Signer Get a signature for a message m. r  Z N * m’ = H(m) r e mod N σ’ = m’ d mod N σ = σ’ r -1 mod N = (H(m) r e ) d r -1 mod N = H(m) d mod N (1) Blinding m’ σ’ (2) Signing σ = σ’ r -1 mod N (3) Unblinding σ is a valid signature of the signer The signer cannot have any information on m and σ.

26. 26 Schnorr-based Blind Signature User Signer (r’,s’) is an unknown signature for the unknown message m (2) Blinding e (3) Signing (4) Unblinding r s (1) Challenge

27. 27 Zero-Knowledge Proofs

28. 28 Interactive Proof Systems Prover Verifier  Verifier is curious about prover’s knowledge.  He will query difficult questions, s.t. the secret should be used to answer.  Should be random questions  Prover knows a secret (precious) information.  Wants to prove that he knows it, but do not want to reveal it. The verifier’s strategy is a probabilistic polynomial-time (PPT) procedure.

29. 29 Ali Baba’s Cave Alice wants to prove to Bob that she knows how to open the secret door between A and B, but will not reveal the secret itself. Procedure – Alice and Bob go to cave – Alice goes to A or B randomly (Bob cannot see) – Bob tells Alice to come from A or B – If Alice knows the secret, she can appear from the correct side of the cave every time Bob repeats as many times until he believe Alice knows the secret to open the secret door How about Trudy? Can he convince Bob without knowing the secret?

30. 30 Interactive Proof Protocol Prover and verifier share common inputs (functions or values) The protocol yields Accept if every Response is accepted by the Verifier Otherwise, the protocol yields Reject P Prover V Verifier Commitment Challenge Response Repeats t rounds Common Inputs Common Inputs

31. Completeness – If the statement is true, the honest verifier will be convinced of this fact by an honest prover. – Prob[(P,V)(x) = Accept | x  L] ≥ ε where ε  (½,1] Soundness – If the statement is false, no cheating prover can convince the honest verifier that it is true, except with some small probability. – Prob[(¬P,V)(x) = Accept | x  L] ≤ δ where δ  [0,½) Requirements of Interactive Proofs 31

32. 32 Instances of interactive proofs with the following properties: – Completeness – true theorems are provable – Soundness – false theorems are not provable – Zero-Knowledge – No information about the prover’s private input (secret) is revealed to the verifier GMR(Goldwasser, Micali, Rackoff) 1.“The knowledge complexity of interactive-proof systems”, Proc. of 17 th ACM Sym. on Theory of Computation, pp.291-304, 1985 2. “The knowledge complexity of interactive-proof systems”, Siam J. on Computation, Vol. 18, pp.186-208, 1989 (revised version) Fundamental Theorem [GMR]: “Zero-knowledge proofs exist for all languages in NP” Zero-Knowledge Proofs

33. How to formalize “Verifier learns nothing”? Simulation Paradigm (informally): Require: anything that can be computed in poly-time by interacting with prover can also be computed in poly-time without interacting with prover. That is, for every poly-time verifier V *, there exists a poly- time simulator S s.t. [output of S(x)]  [output of V * after interacting with P on x]. Defining Zero-Knowledge 33

34. A prover tries to prove that he knows a discrete logarithm x Proof of Knowledge (of discrete logarithm) Commitment Challenge Response Prover Verifier

35. 35 Example: p=23, g=7, q=22 Key generation x=13, y=20 Prover proves that he knows x=13 corresponding to y=20 without revealing x Commitment Challenge Response Prover Verifier Proof of Knowledge (of discrete logarithm)

36. 36 Prover tries to prove that two discrete logarithms are equal without revealing x Commitment Challenge Response Prover Verifier Proof of Equality of two discrete logarithms

37. 37 Commitment Challenge Response Prover Verifier Proof of Equality of two discrete logarithms

38. Non-interactive Zero-knowledge (NIZK) proofs using Fiat- Shamir Heuristic Non-Interactive Zero-Knowledge Proof Prover Verifier

39. 39 Identification, Authentication

40. 40  Entity Authentication (Identification) Over the communication network, one party, Alice, shows to another party, Bob, that she is the real Alice. Authenticate an entity by presenting some identification information Should be secure against various attacks Through an interactive protocols using secret information  Message Authentication Show that a message was generated by an entity Using digital signature or MAC Authentication

41. 41  Using Something Known Password, PIN  Using Something Possessed IC card, Hardware token  Using Something Inherent Biometrics Approach for Identification

42. 42 Approach for Identification MethodExamplesReliabilitySecurityCost What you Remember (know) Password Telephone # Reg. # M/L M (theft) L (imperso- nation) Cheap What you have Registered Seal Magnetic Card IC Card M L (theft) M (imperso- nation) Reason- able What you are Bio-metric (Fingerprint, Eye, DNA, face, Voice, etc) H H (theft) H (Imperso- nation) Expen- sive

43. 43  Password-based scheme (weak authentication) –crypt passwd under UNIX –one-time password  Challenge-Response scheme (strong authentication) –Symmetric cryptosystem –MAC (keyed-hash) function –Asymmetric cryptosystem  Using Cryptographic Protocols –Fiat-Shamir identification protocol –Schnorr identification protocol, etc Approach for Identification

44. 44 passwd, A passwd table A h(passwd) ProverVerifier passwd h = A y accept n reject Identification by Password Sniffing attack Replay attack - Static password

45. 45 1. login ID 2. N 4. X N client Hash function f() pass-phrase S Initial Setup 3. compute f N (S) = X N Host compute f(s), f(f(S)),...., X 1,X 2,X 3,...,X N store X N+1 Hash function f() pass-phrase S 5. compute f(X N ) = X N+1 6. compare 7. store S/Key (One-Time Password System)

46. Commitment Challenge Response Prover Verifier Schnorr Identification