CRYPTOGRAPHY

TROY ESPIRITU & MARICON RAFOL

Presenters

Brief History

2000 B.C.-Origin of Cryptography• Egyptian practice of Hieroglyphics.

100 to 44 B.C.-Use of a Modern Cipher• Julius Caesar (Substitution Cipher)

ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Transform to

 

DEFGHIJKLMNOPQRSTUVWXYZABC

 Caesar C3 Substitution Cipher

Cont. Ex. of Julius Caesar message:

ATTACK AT DAWN

 

DWWDFNDWGCZQ

1980’s & 1990’s- Evolved into a digital world• With microprocessor and PC

CRYPTOGRAPHY

The science of hiding the meaning of communication from unintended recipients. The word is derived from the Greek kryptos (hidden) & graphein (to write).

Purpose of Cryptography

To protect transmitted information from being read and understood by anyone except the intended recipient.

How it is done?

First the original text is changed into a cipher text then back to the original text. In this manner, no one can understand the cipher text, except the sender and receiver.• For example there is a word ABCD which

means it can be 1234. This order is sent afterwards to the receiver.

Key Terms

AlgorithmsComplex mathematical formulas that dictate how plain

text can be turned into cipher (encrypted) text.

KeysAre random or pseudo random bits/data that will be

inserted into the algorithm for the encryption/decryption to work.

Cipher textEncrypted message

Objectives of cryptography concerns the following :

1) Confidentiality (the information cannot be understood by anyone for whom it was unintended)

2) Integrity (the information cannot be altered in storage or transit between sender and intended receiver without the alteration being detected)

Cont.

3) Non-repudiation (the creator/sender of the information cannot deny at a later stage his or her intentions in the creation or transmission of the information)

4) Authentication (the sender and receiver can confirm each others identity and the origin/destination of the information)

* Will be discussed later on how these can be achieved

Data Confidentiality (Privacy) Cryptographic operations for the purpose of data

privacy (confidentiality) prevent an unauthorized person from reading a message.

The following operations are included in data privacy:

Encrypt/Decrypt The encrypt operation changes plaintext data into

cipher text through the use of a cipher algorithm and key. To restore the plaintext data, the decrypt operation must employ the same algorithm and key.

Three levels of Encryption/decryption:

Field level encryption With field level encryption, the user application explicitly

requests cryptographic services. The user application completely controls key generation, selection, distribution, and what data to encrypt.

Session level encryption With encryption at the session layer, the system requests

cryptographic services instead of an application. The application may or may not be aware that encryption is happening.

Link level encryption Link level encryption is performed at the lowest level of the

protocol stack, usually by specialized hardware.

Types of Ciphers

SubstitutionReplaces bits, characters, or blocks with different bits,

characters, or blocks.- Caesar C3 Substitution Cipher TranspositionMoves around the bits, characters, and blocks without

replacing the original

* It is the key which will determine what will be substituted with what, or where it will be moved to.

Other novel ciphers

Running Key- Clever steps in the real world.

(3rd book in volume, 23rd page, 5 line down, 8th letter can be written as 32358)

Concealment- Message is concealed within a larger message

ConcealmentAn example employment review:

1. Bob Smith, my assistant programmer, can always be found2. hard at work in his cubicle. Bob works independently, without3. wasting company time talking to colleagues. Bob never4. thinks twice about assisting fellow employees, and he always5. finishes given assignments on time. Often Bob takes extended6. measures to complete his work, sometimes skipping coffee7. breaks. Bob is a dedicated individual who has absolutely no8. vanity in spite of his high accomplishments and profound9. knowledge in his field. I firmly believe that Bob can be10. classed as a high-caliber employee, the type which cannot be11. dispensed with. Consequently, I duly recommend that Bob be12. promoted to executive management, and a proposal will be13. executed as soon as possible. Odd lines show true message

Methods of Encryption

1. Private Key or Symmetric key algorithm, the key is a shared secret between two communicating parties. Encryption and decryption both use the same key.

Sender:

Plain text -> Algorithm -> Use secret key -> Secret message

Receiver:

Secret Message -> Algorithm -> Use same secret key -> Plain text

Symmetric Cryptography

There are two types of symmetric key algorithms:

Block ciphers

• In a block cipher, the actual encryption code works on a fixed-size block of data.

• Usually Software driven as its easier to manipulate blocks of data using software programs

Stream ciphers

• Stream ciphers do not work on a block basis, but convert 1 bit (or 1 byte) of data at a time.

• Usually hardware driven as its easier to manipulate bits or bytes on the hardware level

Symmetric Cryptography

Strengths:- Much faster than asymmetric systems.- Hard to break if the key is of very large size.

Weaknesses:- Key DistributionDelivery of keys should be secure.

- ScalabilityOne key for each pair of users.

- Limited securityCan provide confidentiality, but using the same key to encrypt/decrypt has no way

to prove authenticity or non-repudiation.

Symmetric Sample

DES Data Encryption Standard• Block Encryption Algorithm

• 64 bits of plain text goes in, 64 bits of cipher text goes out

• Order of 16 substitutions and transpositions depend on the key. Each character of the block is encrypted one at a time

• Has 4 different encryption modes• Electronic Code Book

• Specific plain text will always return the same cipher text

• Cipher Block Chaining• Uses key and previous block value on the current block

• Cipher Feedback• Uses the previous cipher text to create the random bits

• Output Feedback• Functions like feedback mode, but generates a stream of bits

Methods of Encryption 2

2. Public key or asymmetric key algorithm• Pair of keys is used. One of the keys, the private key, is

kept secret and not shared with anyone. The other key, the public key, is not secret and can be shared with anyone. • Private key: only known to the owner of the key-pair

• Public key: available to anyone

• When data is encrypted by one of the keys, it can only be decrypted and recovered by using the other key.

• The two keys are mathematically related, but it is virtually impossible to derive the private key from the public key.

Asymmetric Cryptography

Sender:Plain text -> Algorithm -> Use private key -> Secret message

Receiver:Secret Message -> Algorithm -> Use public key -> Plain text

OrSender:Plain text -> Algorithm -> Use public key -> Secret message

Receiver:Secret Message -> Algorithm -> Use private key -> Plain text

Asymmetric CryptographyScenario 1

Open Message Format• Provides Authenticity/non-repudiation

Message is encrypted with the private key.Message is decrypted with the public key.

Good: We are assured that message came from holder of private key. (Assume that holder is authentic)

Bad: Everybody can read the message. (everyone has the public key)

Asymmetric CryptographyScenario 2

Secure Message Format• Provides Confidentiality

Message is encrypted with the public key. Message is decrypted with the private key.

Good: Nobody can decrypt the message except the holder of the private key.

Bad: Anybody could have encrypted and sent it. (everyone has the public key)

Asymmetric CryptographyScenario 3

Secure and Signed Message Format

• Provides both Confidentiality and Authenticity

• Use of 2 pairs of asymmetric keys. Each user having their own key pairs.

• Secret/Private Keys are not compromised through delivery

Asymmetric CryptographyScenario 3 Message is encrypted with sender's private key.

• (Providing authenticity/non-repudiation by ensuring that only the public key of the sender can decrypt this message.)

Message is again encrypted receiver's public key• (Providing confidentiality by ensuring that only the receiver's

private key can decrypt this message.)

Message is first decrypted with receiver's private key Message is then decrypted with the sender's public key

Asymmetric Cryptography

Strengths:

-Better Key distribution

-Better Scalability

-Can provide Confidentiality, Authenticity, and Non-repudiation

Weakness:

-Works much slower than symmetric systems

Asymmetric Sample

RSA (Inventors initials)• Based on the difficulty of factoring large numbers.

El Gamal• Based on calculating discreet logarithms in a finite

field

Data Integrity, Authenticity, & Non-repudiation

Encrypted data does not mean the data can not be manipulated (e.g. repeated, deleted, or even altered). To rely on data, you need to know that it comes from an authorized source and is unchanged.

Additional cryptographic operations:Hash (Message Digest) A cryptographic hash operation produces a fixed-length output string (often

called a digest) from a variable-length input string. For all practical purposes, the following statements are true of a good hash function:

• Collision resistant: If any portion of the data is modified, a different hash will be generated.

• One-way: The function is irreversible. That is, given a digest, it is not possible to find the data that produces it.

Cont.

MAC (Message Authentication Code) A MAC operation uses a secret key and cipher

algorithm to produce a value (the MAC) which later can be used to ensure the data has not been modified. Typically, a MAC is appended to the end of a transmitted message. The receiver of the message uses the same MAC key, and algorithm as the sender to reproduce the MAC. If the receiver's MAC matches the MAC sent with the message, the data has not been altered.

Cont.

HMAC (Hash MAC) An HMAC operation uses a cryptographic hash function and a

secret shared key to produce an authentication value. It is used in the same way a MAC is used.

Sign/Verify A sign operation produces an authentication value called a

digital signature. A sign operation works as follows: • The data to be signed is hashed, to produce a digest.

• The digest is encrypted using a PKA algorithm and a private key, to produce the signature.

The verify operation works as follows: • The signature is decrypted using the sender's PKA public key, to produce digest.

• The data that was signed is hashed, to produce digest.

• If the two digests are equal, the signature is valid.

Public Key Cryptography

Hybrid of Symmetric and Asymmetric algorithms.• Remember:

• Symmetric: faster, but only confidentiality is secured

• Asymmetric: slower, but confidentiality, authenticity, and non-repudiation is secured

So what if we are to send large amounts of data?

PKC Continued

Use a hybrid system!• Use symmetric algorithms to encrypt the

actual message (faster encrypt/decrypt)

• Use asymmetric algorithms to encrypt and send the secret key of the symmetric algorithm (secure delivery of key)

Public Key Infrastructure

Consists of programs, data formats, procedures, communication protocols, security policies, and public key cryptography mechanisms working in a comprehensive manner to enable a wide range of dispersed people to communicate in a secure and predictable fashion

PKI Continued

Is different from Public Key Cryptography in that PKC is one piece of the PKI.

PKI contains the pieces that will identify users, create and distribute/maintain and revoke certificates, manage keys, and enable all these technologies to communicate and work together for the purpose of encrypted communication.

Provides Confidentiality, Access Control, Integrity, Authentication, and Non-repudiation

PKI – Key Components

Certificates• Mechanism to bind a public key to a collection

of components sufficient to uniquely authenticate the claimed owner

Certificate Authority• Organization that maintains and issues the

certificates. Certificates will be validated against the database of the CA.

PKI – Steps in General

Request for a certificate from the CA CA provides certificate and keys Request for a recipients public key Send encrypted message along with certificate Recipient checks certificate with CA CA confirms certificate Public Key Cryptography commences

PKI Components CA RA (Registration Authority) Certificate Repository Certificate Revocation System Key Backup and Recovery System Automatic Key update Management of key histories Cross certification with other CAs Time-stamping Client-side software

Cryptographic Attacks

Brute Force• Trying every possible combination of key

patterns.

Known Plaintext• The attacker has a copy of the plaintext

corresponding to the cipher text.

Chosen Plaintext• Chosen plaintext is encrypted and the output

cipher text is obtained

Adaptive Chosen Plaintext• A form of a chosen plaintext attack where the

selection of the plaintext is altered according to the previous results.

Ciphertext Only• Only the ciphertext is available.

Chosen Ciphertext• Portions of the ciphertext are selected for trial

decryption while having access to the corresponding decrypted plaintext.

Cont.

Cont. Adaptive Chosen Ciphertext

• A form of a chosen ciphertext attack where the selection of the portions of ciphertext for the attempted decryption is based on the results of previous attempts.

Birthday Attacks• Usually applied to the probability of two different messages

using the same hash function that produces a common message digest; or a given message and its corresponding message digest finding another message that when passed through the same hash generates the same specific message digest.

Meet-in-the-Middle• Is applied to double encryption schemes by encrypting

known plaintext from one end with each possible key and comparing the result in the middle with the decryption of the corresponding ciphertext with each possible key.

Cont. Man-in-the-Middle

• An attacker taking advantage of the store and forward nature of most networks by intercepting messages and forwarding modified version of the original message while in between two parties attempting secure communications.

Differential Cryptanalysis• Is applied to private key cryptographic systems by

looking at ciphertext pairs, which were generated through the encryption of plaintext pairs, with specific differences and analyzing the effect of these differences.

Cont.

Linear Cryptanalysis• Using parts of known plaintext and corresponding

ciphertext to generate a linear approximation of a portion of the key.

Differential Linear Cryptanalysis• Using both differential and linear approaches.

Factoring• Using mathematical approach to determine the prime

factors of large numbers. Statistical

• Exploiting the lack of randomness in key generation.

End