Date post: | 21-Dec-2015 |
Category: |
Documents |
View: | 219 times |
Download: | 0 times |
Announcements:Announcements: HW4 – DES due Friday midnightHW4 – DES due Friday midnight
Any volunteers to help config C/C# later today?Any volunteers to help config C/C# later today?Who’s using Scheme?Who’s using Scheme?
Quiz on ch 3 postponed until after breakQuiz on ch 3 postponed until after break Term project groups and topics due end of week after breakTerm project groups and topics due end of week after break
Use ch 10 – 19 as inspirationUse ch 10 – 19 as inspiration
TodayToday Finish RijndaelFinish Rijndael RSA conceptsRSA concepts
Questions?Questions?
DTTF/NB479: DszquphsbqizDTTF/NB479: Dszquphsbqiz Day 19Day 19
Rijndael/AESRijndael/AESTie-ins with Galois field, Tie-ins with Galois field,
GF(2GF(288):):S-box implements z = S-box implements z =
AxAx-1-1 + b in GF(2 + b in GF(288))MixColumn multiplies by MixColumn multiplies by
a matrix in GF(2a matrix in GF(288) to ) to diffuse bitsdiffuse bits
Key schedule (next) Key schedule (next) uses S-box and uses S-box and powers in GF(2powers in GF(288) )
Wikipedia’s Wikipedia’s visualsvisuals
AddRoundKey (AddRoundKey (ARKARK))
XOR the round key XOR the round key with matrix d. with matrix d.
Key schedule on next slideKey schedule on next slide
ikde
Key ScheduleKey Schedule
)43(...)5()4()3()2()1()0( WWWWWWW
Write original key as 4x4matrix with 4 columns: W(0), W(1), W(2), W(3). Key for round i is (W(4i), W(4i+1), W(4i+2), W(4i+3))
Other columns defined recursively:
otherwiseiW
iifiWTiWiW
)1(
|4))1(()4()(
)2()00000010()(
))((
0
0
0
)(
)(
84/)4( GFinir
iWT
ir
h
g
f
e
d
c
b
a
iW
i
Sbox
Highly non-linear. Resists attacks at finding whole key when part is known
K0K1 K10
192-, 256-bit versions similar
DecryptionDecryptionE(k) is:E(k) is:
(ARK(ARK00, BS, SR, MC, ARK, BS, SR, MC, ARK11, … BS, SR, , … BS, SR,
MC, ARKMC, ARK99, BS, SR, ARK, BS, SR, ARK1010))
Each function is invertible:Each function is invertible:
ARK; IBS; ISR; IMCARK; IBS; ISR; IMC
So D(k) is:So D(k) is:
ARKARK1010, ISR, IBS, ARK, ISR, IBS, ARK99, IMC, ISR, IBS, , IMC, ISR, IBS,
… ARK… ARK11, IMC, ISR, IBS, ARK, IMC, ISR, IBS, ARK00))
Half-round structure:Half-round structure:Write E(k) = ARK, (BS, SR), (MC, ARK), … (BS, SR), (MC, ARK), (BS, SR), ARKWrite E(k) = ARK, (BS, SR), (MC, ARK), … (BS, SR), (MC, ARK), (BS, SR), ARK
(Note that last MC wouldn’t fit)(Note that last MC wouldn’t fit)D(k) = ARK, (ISR, IBS), (ARK, IMC), (ISR, IBS), … (ARK, IMC), (ISR, IBS), ARKD(k) = ARK, (ISR, IBS), (ARK, IMC), (ISR, IBS), … (ARK, IMC), (ISR, IBS), ARK
Can write:Can write:D(k) = ARK, (IBS, ISR), (IMC, IARK), … (IBS, ISR), (IMC, IARK), (IBS, ISR), ARKD(k) = ARK, (IBS, ISR), (IMC, IARK), … (IBS, ISR), (IMC, IARK), (IBS, ISR), ARK
Wrap-upWrap-up
Do you trust 128-bit encryption now?Do you trust 128-bit encryption now?
You should, especially when keys are sent You should, especially when keys are sent using public key cryptography (next)using public key cryptography (next)
Public-key CryptographyPublic-key Cryptography
Problem: how can I send my AES key Problem: how can I send my AES key without Eve intercepting it?without Eve intercepting it?Consider a scheme in which everyone Consider a scheme in which everyone publishes a (public) method by which publishes a (public) method by which messages can be encrypted and sent to messages can be encrypted and sent to them … but only the publisher can them … but only the publisher can decrypt. decrypt. Knowing how to encrypt does not reveal how Knowing how to encrypt does not reveal how
to decrypt!to decrypt!
RSA (Rivest – Shamir – Adelman)RSA (Rivest – Shamir – Adelman)
For Alice to send a message to Bob.For Alice to send a message to Bob.Bob chooses primes p,q (large, ~100 digits each)Bob chooses primes p,q (large, ~100 digits each)He publishes his public key (n,e):He publishes his public key (n,e): n = pq n = pq e, a large number such that gcd(e, (p-1)(q-1)) = 1e, a large number such that gcd(e, (p-1)(q-1)) = 1
Alice has a message m < n.Alice has a message m < n. Otherwise (if m > n), break message into chunks < nOtherwise (if m > n), break message into chunks < n
Alice sends c = mAlice sends c = mee(mod n)(mod n)Bob computes cBob computes cdd (mod n) = (m (mod n) = (mee))dd = m (mod n). = m (mod n).What does he use for d? What does he use for d?
Why does decryption work? Why does decryption work?
Alice – (m) Alice – (m) Bob BobBob’s key: Bob’s key:
n = pq n = pq e: gcd(e, (p-1)(q-1)) = 1e: gcd(e, (p-1)(q-1)) = 1 This is so This is so
d=ed=e-1-1 mod (p-1)(q-1) exists mod (p-1)(q-1) exists
Alice sends c = mAlice sends c = mee(mod (mod n)n)Bob computes cBob computes cdd (mod n) (mod n) = (m= (mee))dd = m (mod n), = m (mod n), where d = ewhere d = e-1-1 (mod n). (mod n).What does he use for d?What does he use for d?
Recall Euler’s theorem:Recall Euler’s theorem:
as long as gcd(m,n) = 1as long as gcd(m,n) = 1
So mSo meded = m (mod n) = m (mod n) iff ed = 1 (mod iff ed = 1 (mod (n) (n) = 1 (mod (p-1)(q-1)) = 1 (mod (p-1)(q-1))
So d = eSo d = e-1-1 *mod (p-1)(q-1) *mod (p-1)(q-1)
)(mod1)( nm n
Toy example Toy example
Alice – (m) Alice – (m) Bob Bob
Bob’s key: Bob’s key: n = pq = (13)(17) = 221n = pq = (13)(17) = 221 e = 35: gcd(e, (p-1)(q-1)) = 1e = 35: gcd(e, (p-1)(q-1)) = 1 d=ed=e-1-1 mod 192 exists: mod 192 exists:
d = __11__d = __11__
m = 20 (letter t)m = 20 (letter t) 1-based1-based, so leading ‘a’ = 1 not , so leading ‘a’ = 1 not
ignoredignored
c = mc = mee(mod n) = _197___(mod n) = _197___
ccdd (mod n) = _20__ (mod n) = _20__
Issues: Issues: How to compute How to compute
20203535(mod 221)?(mod 221)?
Efficiency is O(log e)Efficiency is O(log e)
How to compute d?How to compute d?
Extended Euclidean alg.Extended Euclidean alg.
And why is this secure? And why is this secure? Why can’t Eve calculate d Why can’t Eve calculate d
herself?herself?
SecuritySecurity
Eve knows e, n, and c onlyEve knows e, n, and c only
To find d = eTo find d = e-1-1 (mod (mod (n)),(n)),Eve needs to know Eve needs to know (n) = (p-1)(q-1)(n) = (p-1)(q-1)
If she knows n, she can factor it into p and If she knows n, she can factor it into p and q to find q to find (n), right?(n), right?
That’s a big That’s a big ifif, since n is ~200 digits long!, since n is ~200 digits long!
Large numbers are Large numbers are hard hard to factor!to factor! Can’t just test every prime from 1 .. sqrt(n)Can’t just test every prime from 1 .. sqrt(n)
SecuritySecurity
c = mc = mee (mod n) (mod n)
Can Eve just compute e-th root of c?Can Eve just compute e-th root of c? Not since mod nNot since mod n Unless we brute force, but not when n is Unless we brute force, but not when n is
large!large!
Is Is (n) as hard to find as the factors of n?(n) as hard to find as the factors of n?
Claim: factoring n hard Claim: factoring n hard finding finding (n) hard(n) hardEquivalently: Equivalently: (n) easy (n) easy factoring n easy factoring n easy
If I know n and If I know n and (n), how can I find p, q?(n), how can I find p, q? Hint: write n and Hint: write n and (n) in terms of p and q.(n) in terms of p and q.
I will show later that finding d is as hard to find I will show later that finding d is as hard to find as factors of n (uses factoring).as factors of n (uses factoring).So Eve has no shortcuts to factoring!So Eve has no shortcuts to factoring!