Date post: | 21-Dec-2015 |
Category: |
Documents |
View: | 220 times |
Download: | 0 times |
Objectives
Describe symmetric and asymmetric cryptographic methods
Describe hashing and major hash functionsExplain public key infrastructure (PKI)
2
Cryptography?Traditionally, cryptography refers to
The practice and the study of encryptionTransforming information in order to prevent
unauthorized people to read it.
Today, cryptography goes beyond encryption/decryption to includeTechniques for making sure that encrypted
messages are not modified en routeTechniques for secure
identification/authentication of communication partners.
3
Question
2) Which of the following security issues is addressed by cryptographic systems?
a) Confidentiality; i.e. protection against eavesdroppingb) Authentication; i.e. assurance parties involved in a
communication are who they claim to bec) Message integrity; i.e. assurance that messages are not
altered en routed) Availability; i.e. making sure that communication systems
are not shut down by intruders.e) All of the above
4
Basic Terminology
Network
Plaintext“Hello”
Ciphertext “11011101”
Ciphertext “11011101”Plaintext“Hello”
DecryptionAlgorithm
Interceptor
Party A
Party B
Plaintext: original message to be sent. Could be text, audio, image, etc. Encryption/Decryption Algorithm: mathematical tool (software) used
to encrypt or decrypt Key: A string of bits used by to encrypt the plaintext or decrypt the
ciphertext Ciphertext: encrypted message. Looks like a random stream of bits
+ Decryption key
EncryptionAlgorithm
+ Encryption key
HelloHello
5
Basic Terminology (cont.) Encryption:
Converting plaintext into ciphertext using algorithms and keys The size of the ciphertext is proportional to the size of the plaintext Ciphertext is reversible to plaintext
Symmetric Key Encryption: Same key is used both for encryption and decryption Keys are usually identical or trivially identical*
Asymmetric Key Encryption: Also called Public/Private Key Encryption Two different keys are used: one for encryption, one for decryption
Party A Party B
Party AParty B
* Trivially identical means simple transformation could lead from one key to the another.
Flexcrypt: http://www.flexcrypt.com/flexcryptfree.html6
Questions3) Based on how symmetric encryption
systems work, which of the following is the worst thing to happen?
a) An attacker gets a copy of the encryption and decryption algorithms
b) An attacker gets the decryption keyc) a and b are equally damaging
4) Which of the following presents more challenge for exchanging keys between partners?a) Asymmetric encryptionb) Symmetric encryptionc) A and b are equally challenging
7
Symmetric Key Encryption methods
Two categories of methods Stream cipher: algorithm operates on individual bits (or bytes); one at a time Block cipher: operates on fixed-length groups of bits called blocks
Only a few methods are used today
Methods Year approved
Comments
Data Encryption Standard - DES 1977 1998: Electronic Frontier Foundation’s Deep Crack breaks a DES key in 56 hours
DES-Cipher Block Chaining
Triple DES – TDES or 3DES 1999
Advanced Encryption Standard – AES 2001 Most used today
Other symmetric encryption methods
IDEA (International Data Encryption Algorithm), RC5 (Rivest Cipher 5), CAST (Carlisle Adams Stafford Tavares), Blowfish
8
Data Encryption Standard (DES)
DES EncryptionProcess
64-Bit CiphertextBlock
64-Bit DES Symmetric Key(56 bits + 8 redundant bits)64-Bit Plaintext
Block
DES is a block encryption method, i.e. uses block cipher DES uses a 64 bit key; actually 56 bits + 8 bits computable
from the other 56 bits Problem: same input plaintext gives same output ciphertext
9
DES-Cipher Block Chaining
First64-Bit Plaintext Block
DES EncryptionProcess
Second64-Bit Plaintext Block
First64-Bit Ciphertext Block
InitializationVector (IV)
DES EncryptionProcess
Second64-Bit Ciphertext Block
DES Key
DES Key
DES-CBC uses ciphertext from previous block as input making decryption by attackers even harder
An 64-bit initialization vector is used for first block
10
Public Key Encryption methods Asymmetric encryption methods are used both for
Encryption in order to provide confidentialityDigital signature in order to provide partners’ authentication
Methods Year proposed
Comments
RSA by Ron Rivest, Adi Shamir, and Leonard Adleman
1977 1995: First attack in lab conditions was reported
Elliptic Curve Cryptosystem - ECC 1985 Becoming widely used
Other symmetric encryption methods:
Dieffe-Hellman, El-Gamal
11
Hashing Hashing:
Mathematical process for converting inputs into fixed-length outputs
Hash function: Algorithm that does the hashing. Uses an input + a shared secret
or password. Example: MD5, Secure Hash Algorithm.
Hash: Fixed-length output of the hashing
12
Encryption Versus HashingEncryption
Uses a key as aninput to an encryption method
Output is similar inlength to input
Reversible; ciphertextcan be decryptedback to plaintext
Use of Key
Length of Result
Reversibility
Hashing
Password is usually addedto text; the two arecombined, and thecombination is hashed
Output is of a fixedshort length, regardless of input
One-way function; hashcannot be “de-hashed” back to the original string
14
Asymmetric methods in B2B
Phase 1:Initial Negotiation
of Security Parameters
Phase 2:Mutual Authentication
Client PCServer
Phase 3:Key Exchange orKey Agreement
Three Initial “Hand-Shaking” Phases
Phase 4:Ongoing Communication with
Message-by-MessageConfidentiality, Authentication,
and Message Integrity15
Hashing for Authentication
* Challenge Handshake Authentication Protocol
CHAP* is an authentication scheme used by Point to Point Protocol (PPP) servers to validate the identity of remote clients
1) After the completion of the link establishment phase, the server sends a "challenge" message to the client.
2) The client responds with a value calculated using a one-way hash function, such as an MD5 or SHA (Secure Hash Algorithm).
3) The server checks the response against its own calculation of the expected hash value. If the values match, the server acknowledges the authentication; otherwise it should terminate the connection.
4) At random intervals the server sends a new challenge to the peer and repeats steps 1 through 3.
Shared secret
Digital Signature for Message-by-Message Authentication
To Create the Digital Signature:
1. Hash the plaintext to create abrief Message Digest; this is NOT the Digital Signature.
2. Sign (encrypt) the messagedigest with the sender’s privatekey to create the Digital Signature.
3. Transmit the plaintext + digitalsignature, encrypted withsymmetric key encryption.
Plaintext
MD
DS
Hash
Sign (Encrypt)with Sender’sPrivate Key
4. Encrypted withSession Key
DS Plaintext
Sender Receiver
17
Digital Signature for Message-by-Message Authentication
To Test the Digital Signature
5. Hash the received plaintextwith the same hashing algorithm
the sender used. This givesthe message digest.
6. Decrypt the digital signaturewith the sender’s public key.
This also should give themessage digest.
7. If the two match, themessage is authenticated.
MD
Received Plaintext
MD
DS
5. 6.
HashDecrypt withTrue Party’sPublic Key
7.Are they equal?
Plaintext
MD
DS
Hash
Sign (Encrypt)with Sender’sPrivate Key
18