Foundations of Network and Foundations of Network and Computer SecurityComputer SecurityJJohn BlackLecture #5Sep 6th2005CSCI 6268/TLEN 5831, Fall 2005Announcements• Please sign up for class mailing list by end of today– I think almost everyone has by now• Quiz #1 will be on Thursday, Day after tomorrowReview of Indistinguishability• Several people asked questions (email) about this– How to “break” a blockcipher• People are still trying to extract the key, decrypt arbitrary ciphertexts, decode messages, etc.• This is not your goal!– You must simply distinguish between a random permutation and the given blockcipher under a random keyLet’s use the Real-or-Random Model• This is equivalent to the model I gave last time– With 50% probability you get an oracle (a black box) with a random permutation; with 50% probability you get an oracle with a given blockcipher under some random key• You KNOW the blockcipher being used, but not the key– You submit plaintexts to your oracle and get back ciphertexts• After some “small” number of such queries, can you guess—with high probability of being correct—which kind of oracle you have?Two Examples• Recall blockcipher X:– I hand you an oracle that is either a random permutation or blockcipher X under a random key K; can you distinguish?• Recall one-round of DES:– I hand you an oracle that is either a random permutation or 1-round DES under a random key K; can you distinguish?• Recall two-rounds of DES:– Same question… it will be on the quiz.Goals of Encryption• Cryptographers want to give up exactly two pieces of information when encrypting a message1) That M exists2) The approximate length of M• The military sometimes does not even want to give up these two things!– Traffic analysis• We definitely don’t want to make it obvious when a message repeatsECB – Electronic Codebook• This is the most natural way to encrypt– It’s what we used with the Substitution Cipher– For blockcipher E under key K:– First, pad (if required) to ensure M ∈ ({0,1}n)+– Write M = M1M2… Mmwhere each Mihas size n-bits– Then just encipher each chunk:•Ci= EK(Mi) for all 1 · i · m– Ciphertext is C = C1C2… CmCBC Mode Encryption• Start with an n-bit “nonce” called the IV– Initialization Vector– Usually a counter or a random string• Blockcipher E under key K, M broken into m blocks of n bits as usual–C0= IV–Ci= EK(Mi⊕ Ci-1) for all 1 · i · mEKEKEKM2MmM1IVC1C2CmDigression on the One-Time Pad• Suppose Alice and Bob shared a 10,000 bit string K that was secret, uniformly random– Can Alice send Bob a 1KB message M with “perfect” security?– 1KB is 8,192 bits; let X be the first 8,192 bits of the shared string K– Alice sets C = M ⊕ X, and sends C to Bob– Bob computes C ⊕ X and recovers M• Recall that M ⊕ X ⊕ X = MSecurity of the One-Time Pad• Consider any bit of M, mi, and the corresponding bits of X and C, (xi, ci)– Then ci= mi⊕ xi– Given that some adversary sees cigo across a wire, what can he discern about the bit mi?• Nothing! Since xiis equally likely to be 0 or 1– So why not use the one-time pad all the time?• Shannon proved (1948) that for perfect security the key must be at least as long as the message–ImpracticalOne-Time Pad (cont)• Still used for very-top-secret stuff– Purportedly used by Russians in WW II• Note that it is very important that each bit of the pad be used at most one time!– The infamous “two time pad” is easily broken• Imagine C = M ⊕ X, C’ = M’ ⊕ X• Then C ⊕ C’ = M ⊕ X ⊕ M’ ⊕ X = M ⊕ M’• Knowing the xor of the two messages is potentially veryuseful• n-time pad for large n is even worse (WEP does this)Counter Mode – CTR • Blockcipher E under key K, M broken into m blocks of n bits, as usual• Nonce N is typically a counter, but not requiredC0= NCi= EK(N++) ⊕ Mi• Ciphertext is C = C0C1… CmCTR Mode• Again, n bits of ciphertext expansion• Non-deterministic encryption• Fully parallelizable in both directions• Not that widely used despite being known for a long time– People worry about counter overlap producing pad reuseWhy I Like Modes of Operation• Modes are “provably secure”– Unlike blockciphers which are deemed “hopefully secure” after intense scrutiny by experts, modes can be proven secure like this:• Assume blockcipher E is secure (computationally indistinguishable from random, as we described)• Then the mode is secure in an analogous black-box experiment– The proof technique is done via a “reduction” much like you did in your NP-Completeness class– The argument goes like this: suppose we could break the mode with computational resources X, Y, Z. Then we could distinguish the blockcipher with resources X’, Y’, Z’ where these resources aren’t that much different from X, Y, and ZSecurity Model• Alice and Bob– Traditional names– Let’s us abbreviate A and B– Adversary is the bad guy• This adversary is passive; sometimes called “eve”– Note also the absence of side-channels• Power consumption, timing, error messages, etcAdversaryAliceKey KKey KBobVarious Attack Models• Known-Ciphertext Attack (KCA)– You only know the ciphertext– Requires you know something about the plaintext (eg, it’s English text, an MP3, C source code, etc)– This is the model for the Sunday cryptograms which use a substitution cipher• Known-Plaintext Attack (KPA)– You have some number of plaintext-ciphertext pairs, but you cannot choose which plaintexts you would like to see– This was our model for exhaustive key search and the meet in the middle attackAttack Models (cont)• Chosen-Plaintext Attack (CPA)– You get to submit plaintexts of your choice to an encryption oracle (black box) and receive the ciphertexts in return– Models the ability to inject traffic into a channel• Send a piece of disinformation to an enemy and watch for its encryption• Send plaintext to a wireless WEP user and sniff the traffic as he receives it– This is the model we used for defining blockcipher security (computational indistinguishability)Attack Models (cont)• Chosen-Ciphertext Attack (CCA)– The strongest definition (gives you the most attacking power)– You get to submit plaintexts and ciphertexts to your oracles (black boxes)– Sometimes called a “lunchtime attack”– We haven’t used this one yet, but it’s a