CMSC 426/626 NotesBased on: Cryptography and Network SecurityKey ManagementSymmetric EncryptionModern Block CiphersBlock vs Stream CiphersData Encryption Standard (DES)DES HistoryDES Design ControversyStrength of DES – Key SizeStrength of DES – Timing AttacksStrength of DES – Analytic AttacksDifferential CryptanalysisModes of OperationElectronic Codebook Book (ECB)Slide 16Advantages and Limitations of ECBCipher Block Chaining (CBC)Cipher Block Chaining (CBC)Advantages and Limitations of CBCCipher FeedBack (CFB)Slide 22Advantages and Limitations of CFBOutput FeedBack (OFB)Advantages and Limitations of OFBCounter (CTR)Slide 27Advantages and Limitations of CTRTriple DESWhy Triple-DES?Triple-DES with Two-KeysTriple-DES with Three-KeysAES - OriginsAES RequirementsAES Evaluation CriteriaAES ShortlistThe AES Cipher - RijndaelImplementation AspectsRC5RC5 CiphersStream CiphersStream Cipher PropertiesRC4RC4 SecurityPublic Key CryptographyDistribution of Public KeysPublic AnnouncementPublicly Available DirectoryPublic-Key AuthoritySlide 50Public-Key CertificatesSlide 52Public-Key Distribution of Secret KeysDiffie-Hellman Key ExchangeSlide 55Diffie-Hellman SetupSlide 57Diffie-Hellman ExampleElliptic Curve CryptographyMessage Authentication and Hash FunctionsMessage AuthenticationSecurity RequirementsMessage EncryptionSlide 64Message Authentication Code (MAC)MAC PropertiesRequirements for MACsUsing Symmetric Ciphers for MACsHash FunctionsHash Functions & Digital SignaturesHash Function PropertiesRequirements for Hash FunctionsHash AlgorithmsSlide 74MD5Strength of MD5Secure Hash Algorithm (SHA-1)SHA-1 verses MD5Revised Secure Hash StandardRIPEMD-160RIPEMD-160 verses MD5 & SHA-1Keyed Hash Functions as MACsHMACHMAC OverviewSlide 85HMAC SecurityDigital SignaturesSlide 88Digital Signature PropertiesDigital Signature Standard (DSS)DSA Key GenerationDSA Signature CreationDSA Signature VerificationSlide 94CMSC 426/626 NotesKrishna M. [email protected] on:Cryptography and Network SecurityThird Editionby William StallingsLecture slides by Lawrie BrownKey Management•public-key encryption helps address key distribution problems•have two aspects of this:–distribution of public keys–use of public-key encryption to distribute secret keysSymmetric EncryptionModern Block Ciphers•will now look at modern block ciphers•one of the most widely used types of cryptographic algorithms •provide secrecy and/or authentication services•in particular will introduce DES (Data Encryption Standard)Block vs Stream Ciphers•block ciphers process messages in into blocks, each of which is then en/decrypted •like a substitution on very big characters–64-bits or more •stream ciphers process messages a bit or byte at a time when en/decrypting•many current ciphers are block ciphers•hence are focus of courseData Encryption Standard (DES)•most widely used block cipher in world •adopted in 1977 by NBS (now NIST)–as FIPS PUB 46•encrypts 64-bit data using 56-bit key•has widespread use•has been considerable controversy over its securityDES History•IBM developed Lucifer cipher–by team led by Feistel–used 64-bit data blocks with 128-bit key•then redeveloped as a commercial cipher with input from NSA and others•in 1973 NBS issued request for proposals for a national cipher standard•IBM submitted their revised Lucifer which was eventually accepted as the DESDES Design Controversy•although DES standard is public•was considerable controversy over design –in choice of 56-bit key (vs Lucifer 128-bit)–and because design criteria were classified •subsequent events and public analysis show in fact design was appropriate•DES has become widely used, especially in financial applicationsStrength of DES – Key Size•56-bit keys have 256 = 7.2 x 1016 values•brute force search looks hard•recent advances have shown is possible–in 1997 on Internet in a few months –in 1998 on dedicated h/w (EFF) in a few days –in 1999 above combined in 22hrs!•still must be able to recognize plaintext•now considering alternatives to DESStrength of DES – Timing Attacks•attacks actual implementation of cipher•use knowledge of consequences of implementation to derive knowledge of some/all subkey bits•specifically use fact that calculations can take varying times depending on the value of the inputs to it•particularly problematic on smartcardsStrength of DES – Analytic Attacks•now have several analytic attacks on DES•these utilise some deep structure of the cipher –by gathering information about encryptions –can eventually recover some/all of the sub-key bits –if necessary then exhaustively search for the rest •generally these are statistical attacks•include–differential cryptanalysis –linear cryptanalysis –related key attacksDifferential Cryptanalysis•one of the most significant recent (public) advances in cryptanalysis •known by NSA in 70's cf DES design•Murphy, Biham & Shamir published 1990•powerful method to analyse block ciphers •used to analyse most current block ciphers with varying degrees of success•DES reasonably resistant to it, cf LuciferModes of Operation•block ciphers encrypt fixed size blocks•eg. DES encrypts 64-bit blocks, with 56-bit key •need way to use in practise, given usually have arbitrary amount of information to encrypt •four were defined for DES in ANSI standard ANSI X3.106-1983 Modes of Use•subsequently now have 5 for DES and AES•have block and stream modesElectronic Codebook Book (ECB)•message is broken into independent blocks which are encrypted •each block is a value which is substituted, like a codebook, hence name •each block is encoded independently of the other blocks Ci = DESK1 (Pi)•uses: secure transmission of single valuesElectronic Codebook Book (ECB)Advantages and Limitations of ECB•repetitions in message may show in ciphertext –if aligned with message block –particularly with data such graphics –or with messages that change very little, which become a code-book analysis problem •weakness due to encrypted message blocks being independent •main use is sending a few blocks of dataCipher Block Chaining (CBC) •message is broken into blocks •but these are linked together in the encryption operation •each previous cipher blocks is chained with current plaintext block, hence name •use Initial Vector (IV) to start process Ci = DESK1(Pi XOR Ci-1)C-1 = IV •uses: