Dr. Igor Santos

Security of Information Systems

Cryptology

2

Contents

Historical Evolution Definitions Classic cipher Symmetric cryptography Asymmetric cryptography Cryptanalysis Steganography

3

Perspectiva histórica

Historical Evolution

4

Historical Evolution

«When Julius Caesar sent messages to his generals, he didn't trust his messengers. So he replaced every A in his messages with a D, every B with an E, and so on through the alphabet. Only someone who knew the "shift by 3" rule could decipher his messages.»

And so we begin.

Phill Zimmerman, "An Introduction to Cryptography"

5

Historical Evolution

Cryptology has always had a great interest in military and political Egyptian and Babylonian hieroglyphs Escítala of Sparta Julius Caesar, Charlemagne, Philip II, Napoleon San Bernardino already used usaba homophonic

substitution WW1: ADFGVX Code. Jefferson Cylinder WW2: Enigma machines, Lorenz SZ-40/42: Bombe,

Colossus WW2: PURPLE Machine: Magic Machines SIGABA and Typex ; Navajo Code

6

Historical Evolution

Key of sector such as: Banking

▪ ATMs, wire transfers, electronic banking, … Communication Networks

▪ VPNs, secure email, … E-Commerce Mobile Phones Pay TV and satellite TV Digital Rights Management (DRM)…

7

PORTADA DEFINICIONES

¿What is Cryptology?

8

Definitions

Cryptology From Greek krypto, "hidden" and logos,

"word" Science of secure communications

(usually secret)

9

Definitions

Secure Communication, 4 requirements Confidentiality

▪ The message can not be accessed or disclosed to individuals, entities or processes unauthorized

Authentication▪ Ensures the identities of the participants

in a communication

10

Definitions

Integrity

▪ Ensures that the message has not been

altered or destroyed in an unauthorized

manner

Non-Repudiation▪ Allows to test the involvement of the parties to a

communication, not being able to deny having sent or received a message

11

Definitions

Cryptography From Greek krypto, "hidden", and graphein

"write“ Literally meaning "hidden writing“ Concepts

▪ Text "clear" text that you want to hide▪ Text "encrypted" or "cipher" unreadable

gibberish▪ Encryption Algorithm: converts text "clear" in

"encrypted" and viceversa▪ Key: secret that enables the encryption algorithm

to convert

12

Definitions

Goal Maintain the privacy of the

communication between two entities altering the original message so that it is incomprehensible to anyone other than the addressee

13

Definitions

Encryption y De-cryption

14

Definitions

Cryptanalysis From Greek Kryptos, "hidden" and

analýein, "loose“▪ It is the study of methods for obtaining the

meaning of encrypted information, without access to the secret information required

Cryptology = Cryptography + Cryptanalysis

15

Definitions

Criptosistema {M, C, K, E, D} set, where:

▪ M represents the set of all messages unencrypted or clear

▪ C represents the set of all possible encrypted messages, or cryptograms

▪ K represents the set of keys that can be used in the cryptosystem

16

Definitions

▪ E is the set of cryptographic transformations applied to each elem. M to become elem. of C▪ There is a transformation Ek for each key K

▪ D is the set of decryption transformations analogous to E

Necessary condition for every cryptosystem Dk ( Ek (m) ) = m (reversibility)

17

Definitions

Basic types of cryptosystems Symmetric or private key cryptosystems

▪ They use the same key k to encrypt and decrypt

Asymmetric or public key cryptosystems▪ They use a key pair { kpub, kpr }, so that one is

used to encrypt and one to decrypt

Hybrid cryptosystems▪ They combine the two previous

cryptosystems

18

Definitions

Kerckhoffs’ principle (1883) “The security of a cryptosystem must not depend

on keeping secret the crypto algorithm. Safety depends only on keeping secret the key.”

True security is: Public availability of cryptographic algorithms

▪ To demonstrate theoretical and practical resistance▪ The opposite to “Security through obscurity”

▪ ¿Windows is secure?▪ DVD protection▪ GSM algorithm

Wide range of potential keys

19

Classic cipher

20

Classic cipher

Substitution cipher Aims to introduce confusion into the cryptosystem

▪ Simple substitution▪ Polyalphabetic substitution▪ Homophonic substitution

E.g.: Caesar chiper

Transposition cipher Aims to introduce diffusion in the cryptosystem E.g.: Escítala

Combination E.g.: ADFGVX

21

Cifrado por sustitución simple

Sustitución simple (Ej: Cifrado César) Claro: GALLIA EST OMNIS DIVISA... Clave

▪ ABCDEFGHIJKLMNOPQRSTUVWXYZ▪ DEFGHIJKLMNOPQRSTUVWXYZABC

Cifrado: JDOOLD HVW RPQLV GLYLVD... ¿Qué clave está usando? ¿Cuántas claves posibles hay?

22

Simple substitution cipher

Caesar cipher attack Frequency analysis

▪ Character typical distribution Brute force

▪ Only25 possible keys

23

Simple substitution cipher

Simple substitution (E.g.: Kamasutra) Clear

▪ ENCONTREMONOS A MEDIANOCHE Key

▪ A D H I K M O R S U W Y Z▪ V X B G J C Q L N E F P T

Encrypted▪ USMQSZLUCQSQN V CUXGVSQMBU

24

Polyalphabetic substitution cipher

Polyalphabetic substitution Set of simple monoalphabetic ciphers

E.g.: Alberti Use two or more cipher alphabets, switching

between them during encoding▪ clear: aquello▪ encrypted: FENFPAD

Plain alphabetEncrypted alphabet 1Encrypted alphabet 2

25

Polyalphabetic substitution cipher

E.g.: Vigènere clear: VIGENERE key: CHIFFRE encrypted: XPOJSVVG

Key character

Plain character

Encrypted character

26

Polyalphabetic substitution cipher

Attack to Vigènere Kasiski test

▪ Search words repeated in the ciphertext▪ Determine key length▪ Frequency Analysis▪ Problem: longer key than the ciphertext

27

Homophonic substitution cipher

Homophonic substitution Using different symbols depending on the

frequency of occurrence of letters in a language Example

▪ A (50%) → 1, 2, 3, 4▪ B (12.5%) → 5▪ C (12.5%) → 6▪ D (25%) → 7, 8

When you encrypt an A, you choose 1, 2, 3 or 4 depending on the criteria to be (random, sequential, etc.)

28

Homophonic substitution cipher E.g., Homophonic substitution cipher

for English

29

Transposition cipher

Clutter the "clear“ text Outline

Split the “clear” text in blocks of N characters▪ Example, N=6:

▪ “clear” text: WE WILL ATTACK AT DAWN▪ Bloques: WEWILL ATTACK ATDAWN

▪ Choose a permutation of N elements▪ {1, 2, 3, 4, 5, 6} → {4, 3, 5, 1, 2, 6}

Shuffle each block according to the permutation:▪ IWLWEL ATCATK WAWATDN

30

Transposition cipher

E.g.: Escítala Clear: ASI CIFRABAN CON LA ESCITALA Encrypted: AAC SNI ICT COA INL FLA RA

AE BS

31

Combination cipher

Substitution + trasposition (E.g.: ADFGVX) Monoalphabetic substituation

1. 6x6 table2. Random disposition of the 26 characters and the 10 digits▪ Message: Come at 10 pm

Plain text

c o m e a t 1 0 p m

Encypted text phase 1

FG DG

GX

XD

DV

DD

AV XG

AD

GX

32

Combination cipher

Transposition phase1. Key word (rows)2. Transpositition

by alphabetic order

▪ Cyphered text (by columns)▪ DDAD GXDA GVXX GDVG FXDG

S H A R K

F G D G G

X X D D V

D D A V X

G A D G X

A H K R S

D G G G F

D X V D X

A D X V D

D A X G G

33

Combination cipher

E.g.: Enigma (electromechanic device) http://enigmaco.de/enigma/enigma.swf

34

Combination cipher

Rotors / modifiers (26 possible positions)▪ 3 rotors -> 26 x 26 x 26 = 17576

Disposition of the rotors / modifiers▪ 3! = 6

Pegbox▪ 6 cables, exchange 6 pairs of letters between

26▪ Total multiple of keys = 3>

10,000,000,000,000,000

35

Symmetric cryptography

36

Symmetric cryptography

Main feature característica Keyencrypt = keydecrypt

Transmitter and receiver must hide a “shared secret”

Many drawbacks Key Distribution Keeping the key secret

Advantage The process of encryption / decryption is

very fast

37

Symmetric cryptography

Security depends on: Keeping the key secret How good the algorithm is

▪ You do not need to keep it secret▪ It is assumed that it is virtually impossible to

decrypt a message by just knowing the algorithm

38

Symmetric cryptography

39

Symmetric cryptography- DES DES (Data Encryption Standard)

Adopted as the standard for secure communications in the U.S. in 1976

Designed by IBM in collaboration with the NSA▪ Backdoor??

Unsafe Key Size 56 bits Possibility to break it in 24 hours by brute

force

40

Symmetric cryptography- DES

Based on a mathematical mechanism known as "The Feistel Network"▪ Block ciphering

▪ Basic operations transformed by N-bit plain text into N-bits ciphered text

▪ Block = 64 bits▪ 64-bit key, but 8 bits are used for parity, so that the

algorithm uses 56 bits

41

Symmetric cryptography- DES

Basic structure DESEntrance

Plaintext (64bits) Key (56 bits)

1. Initial Permutation (IP)2. 16 rounds (Feistel function)3. Final Permutation (PF)

42

Symmetric cryptography- DES

Feistel function1. Expansion2. Shuffle3. Substitution4. Permutation

Semiblock (32 bits)

Subkey (48 bits)

43

Symmetric cryptography– Triple DES

Triple DES Algorithm that performs triple DES

encryption Powered by IBM in 1998 Standard on credit cards and other forms

of electronic payment Variants

▪ 2 keys -> resulting key 112 bits (56 x 2)▪ 3 keys -> resulting key 168 bits (56 x 3)

44

Symmetric cryptography - AES AES (Advanced Encryption Standard)

Also known as Rijndael New U.S. encryption standard in 2002 Due to the replacement of the standard DES,

the U.S. Institute of Standards (NIST) organized in 1996 the AES contest

Requirements of the new algorithm▪ Public▪ Symmetric block cipher algorithm▪ Variable key length (which can grow)▪ Easily implementable in hardware and software

45

Symmetric cryptography - AES

Criteria▪ Strength against cryptanalysis▪ Computational efficiency (time)▪ Efficiency of implementation (memory)▪ Software and hardware adaptation▪ Simplicity of design▪ Flexibility▪ public License▪ Supporting 128-bit block and key sizes

of 128, 192 and 256 bits

46

Symmetric cryptography - AES

Variable block and key length▪ 128, 192, and 256

During the encryption process, it maintains an internal status array

Based on round schemas ▪ 9 rounds for block for 128-bit key▪ 11 rounds for block for 192bits key▪ 13 rounds for block for 256-bit key

47

Symmetric cryptography - AES

In each round, four transformations are applied to the matrix of state▪ Nonlinear byte substitution, independent

for each byte of the status matrix▪ Transposing the state rows cyclically with

different offsets▪ Shuffling the columns based on polynomial

operations▪ Adding the subkey of the round (of course,

key expansion) using XOR

48

Symmetric cryptography

From DES to AES: “A Stick Figure Guide to the Advanced

Encryption Standard (AES)”, byJeff Moser

49

Asymmetric cryptography

50

Asymmetric cryptography In 1976, Diffie and Hellman developed

a secure way to transfer a key Two different but complementary keys

▪ What key A encrypts, is only decrypted by key B▪ What key B encrypts, is only decrypted by key A

A key will be secret, and must be kept safely The other will be public, and it should be

shared for communication

51

Asymmetric cryptography

A wants to send an encrypted message to B A message encrypted with the public key

of B B receives the message B decrypts the message with his private

key

52

Asymmetric cryptography

53

Asymmetric cryptography

In 1977, Rivest, Shamir and Adleman published its asymmetric encryption algorithm: RSA

Based on the difficulty of factoring large numbers The public and private keys are obtained

from two large primes The attacker must obtain the divisors of

a number computationally intractable

54

Digital signature

Digital signature Process to digitally sign a content

▪ It calculates the hash function: MD5, SHA1, SHA256, etc.

▪ The hash is encrypted with the sender's private key and attached to content

▪ If someone wants to make sure that the content is legitimate, decrypts the hash with the sender's public key and checks

55

Digital signature

56

Digital certificate

Digital certificate Public key + data about its owner This digitally signed by a Certificate

Authority (CA)

57

Digital certificate

58

Criptografia hibrida

Hybrid cryptography

59

Hybrid cryptography

As asymmetric cryptography is computationally very expensive, it is usually combined with the symmetrical A random symmetric key is chosen It is transmitted securely using

asymmetric cryptography Once received, symmetric cryptography is

used Example: PGP (Pretty Good Privacy)

60

Hybrid cryptography

Encryption

61

Hybrid cryptography

Decryption

62

Cryptoanalysis

63

Cryptoanalysis

Science that tries to compromise the security of a cryptosystem Decoding a message without the key Getting the key from cryptograms

Techniques Differential cryptanalysis Linear cryptanalysis Statistical or frequency cryptanalysis Mathematical cryptanalysis Brute force

64

Cryptoanalysis

Differential cryptanalysis Tryies to infer the key from encrypted

messages with minimal differencesLinear cryptanalysis

Similar to differential cryptanalysis, but using XOR operations with the plaintext and the encryption to infer the key

65

Criptoanálisis

Statistical or frequency cryptanalysis Analyzes the frequency of occurrence of each

symbol in the encrypted text and compare it with the expected frequency in the plaintext

Mathematical cryptanalysis Try using mathematically efficient solutions to

problems that are based on asymmetric encryption algorithms (large numbers factorization, discrete logarithms, etc..)

66

Cryptoanalysis

Brute force Try all possible keys It is effective, but extremely inefficient Worthwhile if the key space is small

67

Cryptoanalysis

Examples Cracking UNIX passwords (MD5,

SHA1, SHA256) Cracking Windows password (NTLM) Cracking WEP key in Wi-Fi

68

Steganography

69

Steganography

The secret communication accomplished by hiding the existence of a message Hiding information through subliminal

channels Does not have to be encrypted ->

Weakness The interception of the message

immediately undertake all security

70

Steganography

Different methods along history Ancient Greece

▪ Wax tablet▪ Scalp

Chinese Empire▪ Silk and wax ball

XV century▪ hard-boiled egg

WW2▪ microfilm

71

Steganography

Current computing techniques Modify the least significant bits of image

files, audio, video, etc.. Using "cavities" in files SubtlemModifications not necessarily

digital Tools: Jsteg, MP3Stego, outguess, etc.

72

References

Esslinger, B. (2011). Introducción a la Criptografía y al Criptoanálisis. Alcance, Tecnología y Futuro de CrypTool: www.cryptool.org.Criptomonicón, por Gonzalo Álvarez Marañón, http://iec.csic.es/criptonomiconLucena López, M.J. (2011).Criptografía y Seguridad en Computadores. http://wwwdi.ujaen.es/~mlucena/lcripto.htmlGarcía-Bringas, P. (2011). Fundamentos de Criptología. Máster Universitario en Seguridad de la Información.Moser, J. (2009). A Stick Figure Guide to the Advanced Encryption Standard (AES). http://www.moserware.com/2009/09/stick-figure-guide-to-advanced.htmlJoaquin Medina Serrano. Los códigos secretoshttp://personal.telefonica.terra.es/web/jms32/Cifra/CodSecretos/IndCodSecr.html

73

References

ImágenesRTVEJeff MoserMaxamushttp://www.flickr.com/photos/letsbook/4697532713http://www.flickr.com/photos/ozh/13467627http://www.flickr.com/photos/melisande-origami/801277265

http://www.flickr.com/photos/pitel/5811777890http://www.flickr.com/photos/micaeltattoo/3724268384http://www.flickr.com/photos/brewbooks/3317973010http://www.wallpapersworld.net/?/download/human-evolution_w434.html

http://www.freakingnews.com/Limenut-Pictures-26052.asp