Lecture Four
Today’s Topics
Historic Symmetric ciphers Modern symmetric ciphers
DES, AES
Asymmetric ciphers RSA
Next class: Protocols
Shift cipher: each plaintext characters is replaced by a character k to the right. (When k=3, it’s a Caesar cipher). “Watch out for Brutus!” => “Jngpu bhg sbe Oehghf!” Only 25 choices! Not hard to break by brute force.
Substitution Cipher: each character in plaintext is replaced by a corresponding character of ciphertext. E.g., cryptograms in newspapers.
plaintext code: a b c d e f g h i f k l m n o p q r s t u v w x y z ciphertext code: m n b v c x z a s d f g h j k l p o i u y t r e w q
26! Possible pairs. Is is really that hard to break?
Example Ciphers
Substitution ciphers
The Caesar cipher has a small key space, but doesn’t create a statistical independence between the plaintext and the ciphertext.
The best ciphers allow no statistical attacks, thereby forcing a brute force, exhaustive search; all the security lies with the key space.
As cryptographic algorithms matured, the statistical independence between the plaintext and cipher text increased.
Ciphers
The caesar cipher, hill cipher, and playfair cipher all work with a single alphabet for doing substitutions
They are monoalphabetic substitutions.
A more complex (and more robust) alternative is to use different substitution mappings on various portions of the plaintext. Polyalphabetic substitutions.
More ciphers
Vigenère cipher: each character of plaintext is encrypted with a different a cipher key.
In the simplest version, each key is a shift cipher Plaintext: a b c d e f g h i f k l m n o p q r s t u v w x y z C1(k=6): f g h i j k l m n o p q r s t u v w x y z a b c d e
C2(k=20): t u v w x y z a b c d e f g h i j k l m n o p q r s Plaintext is encrypted as sequence of C1,C2,C1,C2,…
The example above has a period of 2: there are two alphabets used.
Breaking the Vigenère cipher
We assume the algorithm is known. (Safest assumption!) The ciphers keys repeat with period t. We need to find that
period. Once we find the period, we can attack each shift cipher
independently. (Shift ciphers are cake to break).
We must look for occurrences in the ciphertext of plaintext that is repeated in a multiple of the cipher key.
the man is in the plane on the ground. QER ASX AS SD QER SDFWD WE QER SDFWED
period = 10.
Breaking the Vigenère cipher
themanisintheplaneontheground QERASXASSDQERSDFWDWEQERSDFWED
period = 10. Chances of this happening three times are small.
More formally, we can apply statistical measures, like auto-correlation, to the ciphertext.
Intuitively, guess period is no larger than L. For each letter of ciphertext, Ci , count how often
Ci=Ci+T, where 1<T<L. Plot the counts for all Ts, the period will appear as a
spike on the graph.
Permutation (i.e., transposition)
Permuting the plaintext is another type of cipher technique; also referred to as permutation.
Take the input, rearrange the output in a specific way.
E.g., by writing the letters in a rectangle 1 3 2 4 5 6 7 8 <- key!(simple)
t h e l a u n c h c o d e i s i n t h e d e s k = thn eoh hct lde aed uie nss cik
You can even do this twice with the same key. Better, but… Using the technique simply is weak as it preserves the frequencies
of the letters. The stronger, modern ciphers combine permutations and
substitutions.
Rotors
Rotor machines have a keyboard and a series of rotors to mechanically assist in the encryption of text. Each rotor is an arbitrary permutation of the alphabet Output of one rotor is connected to the input of the next. For each character, the rotors shift like an odometer. Initial position of the rotors is the key.
For one rotor, period = 26 For two rotors, period = 262 = 676 three, period = 263 = 17,576 for six, 266 = 308,915,776 Not bad!
Two diagrams of the Enigma
http://fn2.freenet.edmonton.ab.ca/~jsavard/crypto/roto02.htm
Modern Cryptography
Symmetric key algorithm Examples: DES (Data Encryption Standard) IDEA (International Data Encryption Alg.) AES (Advanced Encryption Standard)
Public/Private key algorithm Examples: RSA (El Gamal, Elliptical curves)
Diffusion and Confusion (remember: P= plaintext, C= ciphertext)
The operations of cryptographic algorithms can be explained with two terms:
Diffusion spreads the influence of single bits of P over as much C as possible. For instance, if we flip a bit of P, each of the bits of C should
have about a ½ chance of flipping as well. Permutation is a tool for diffusion.
Confusion obscures the relationship between P and C; it eliminates redundancies and statistical patterns Substitution (that is table-look up) is a tool for confusion.
Confusion alone is sufficient for security, but expensive in terms of storage. A 128-bit key-dependent lookup table of 64-bit blocks of P to C requires 1041 bytes of memory.
Symmetric Key Algorithms
There are two basic cipher structures:
Block ciphers Plaintext is treated as n-bit blocks of data Ciphertext is same length as plaintext Can be made to behave as a stream cipher
Stream ciphers Encrypts one bit/byte at a time Useful if you have a never ending, bursty stream of data. Often easier to analyze mathematically Block ciphers can be made to behave as stream ciphers
Feistel Ciphers (also called Feistel Networks)
Most block ciphers are Feistel Networks
Approximate substitution cipher behavior using a combination of substitution and permutation (confusion and diffusion)
Defined in terms of Block size Key size Number of rounds Subkey generation algorithm Round function F
Two other considerations Speed in software/hardware Ease of analysis
Feistel Networks Consists of n –rounds. All rounds are identical.
Pi is broken in to two halves Li and Ri.
The key K is broken in to sub-keys Ki , one for each round.
A round function F is applied to Ri using Ki Li = Ri-1 Ri = Li-1 xor F ( Ri-1 , Ki )
Decryption is essentially the same as encryption using sub-keys Ki in reverse order.
L0 Plaintext
R0
F ⊕
F ⊕
F ⊕
L1
Li
Ln Rn
Ri
R1
Ln+1 Rn+1
Key1
Keyi
Keyn
Ciphertext
Round 1
Round i
Round n
Often Feistel networks make use of substitution boxes, called S-boxes. (for instance, in the function F)
The strength of a Feistel network is tied to the design of it’s S-boxes.
The design of the S-box can influence resistance against linear and differential cryptanalysis.
In general, an S-Box substitutes p input bits for q output bits.
For example: Given bits “110011” as input and an S-box
Take first and last bits “11” to choose row 3 (in decimal counting from 0)
Take middle four bits “1001”: column 9. E.g., the value from S-box 6
of DES is 14 (“1110”). Substitute “1110” for “110011”
Feistel Networks
14 1 7 6 8 … 4 10 1 13 … … 8 12 3 7
6
11
1001
S-Box 6 from DES
Data Encryption Standard (DES) Adopted by the US govt in ‘76, dropped recently for AES. A 16-round Feistel-network with an initial and final permutation of the
data.
Block cipher: data is encrypted in 64-bit blocks Symmetric Key algorithm, key length is 56-bits.
The 56-bit key is transformed in to sixteen 48-bit subkeys.
DES consists of initial permutation of the 64 bits (from the P-box) 16 identical "rounds" of operation where the data is confused and diffused
with the key and the previous round. A final permutation (from the P-box). Same algorithm for encryption and decryption (sub-keys are used in reverse
order for decryption).
DES The operation of each round is
identical, taking the output of the previous round as input.
During each round, the rightmost 32 bits of the input are moved to the left 32 bits of the output.
Then a function f() is run on the left and right halves, and the key.
The key is shifted for each round.
A final permutation finishes it.
Classic Feistel cipher operation!
Curious about DES and f()?
What’s f()? For round i Take 48 bits of the shifted key Expand the right 32-bits of the data to 48 bits XOR the two together, and then send it through the S-Box
(the predefined substitution table). The S-BOX produces 32 new bits, which is XORed with
the left half of the data.
Then Li= Ri-1 Ri = Li-1 ⊕ f (Ri, Ki)
Incredibly, this process is reversible.
DES An initial permutation (IP) Key transformation 16 rounds of:
Expansion permutation of input (Avalanche Effect)
Expands 32 bits to 48 bits, thus a single bit affects 2 substitutions. Dependency of output bits on input bits spread faster
S-box substitution (confusion)
P-box permutation (diffusion) A final permutation (IP-1)
More on DES
Exhaustive search is the best way to break it; there are 256 (about 7x1017 ) keys.
Originally, complaints that the NSA fixed the S-boxes to provide a backdoor. This has never been found, the S-boxes appear to be strong against even differential cryptanalysis (Which means the NSA knew about DC before 1978. It was first described publicly in 1990.)
In 1999, a machine was built by the EFF for $250K that broke a DES code in 22 hours with exhaustive search.
Reasonable for a small business to buy even then.
Stronger ciphers exist… too many to cover here.
Triple DES (3-DES) The keyspace of DES is too small.
3-DES was designed to use the widely installed base of DES Why not just use DES twice?
Subject to meet-in-the-middle attack A known plaintext attack is one order of magnitude harder in double DES than single
DES Alright, how about using 3 keys?
Key space unwieldy? We require backwards compatibility with DES…
3-DES: Choose two 64-bit keys K1 and K2, and encrypt as follows:
Ek1(Dk2(Ek1(P))) = C There is no advantage to using decryption for the second stage. BUT, if K1
= K2 we have backwards compatibility Ek1(Dk1(Ek1(P))) == Ek1(P)
Provides us with a key space of 2112 possible keys
Other Block Ciphers
International Data Encryption Algorithm Used in PGP (Pretty Good Privacy) Works on 64-bit input blocks, taken as four 16-bit blocks Uses a 128-bit key
Uses a total of 52 16-bit subkeys, 4 per round Decryption uses same algorithm
Different subkey generation Blowfish
Developed by Bruce Schneier Variable Key length Very fast, compact, simple
Twofish Also developed by Schneier Variation of blowfish Competitor for AES (it lost…)
Other Block Ciphers
GOST (Soviet Union) CAST SAFER Skipjack (Used in clipper chip) Khufu LOKI There are many others as well…
Advanced Encryption Standard
Designed to replace DES Organized by NIST Chosen from five candidate algorithms Reviewed by US government (NSA), industry and academia Required a four-year process to pick the algorithm
Winning algorithm “Rijndael” chosen 2 Oct 2000 pronounced “rhine-dahl” or “rain-doll”
Designed by Joan Daemen and Vincent Rijmen (Belgium).
Rijndael’s strengths
Good performer in hardware and software in both feedback and non-feedback modes
Good key setup time and key agility Low memory requirements (smart cards) Simplicity Flexible key and block size [128,192,256] bit Variable number of rounds Round structure lends itself to instruction-level
parallelism If you could crack a DES key in one second, it would take
149 trillion years to crack a AES key by brute force at the same speed
AES
Rijndael is an iterated block cipher with a variable block length and a variable key length.
Rijndael does NOT have the Feistel structure Each round consists of three uniform layers.
Builtin defenses against linear and differential cryptanalysis (wide-tail strategy…)
The algorithm works on blocks of plaintext of b bits The plaintext will be converted to ciphertext, and the
current state refers to any intermediate cipher result. We can right the state as a rectangular array of bytes, (4
rows)-by-(b/32 columns) i.e., 32 bits per column E.g. for 128-bit block size, b/32 = 4.
AES: Definitions:
text
a
0,0
a
1,1
a
0,1
a
3,0
a
2,0
a
1,0
a
1,3
a
0,3
a
3,2
a
2,2
a
1,2
a
0,2
a
3,1
a
2,1
a
3,3
a
2,3
State
Key: The shared secret cipher key used for encryption of size K bits
As with the state it is also considered as a rectangular array of bytes: (4 rows)-by-(K/32 columns)
RoundKey: The zeroth subkey is the original
key. The next subkeys do the following: (for a 128-bit key,) each column has
8 bits, 4 bytes in a row.
Key
text
K
0,0
K
1,1
K
0,1
K
3,0
K
2,0
K
1,0
K
1,3
K
0,3
K
3,2
K
2,2
K
1,2
K
0,2
K
3,1
K
2,1
K
3,3
K
2,3
Key or Round Key
4 bytes 4 bytes 4 bytes 4 bytes
Shift 1 byte
S-box
XOR
XOR
Round constant
4 bytes 4 bytes 4 bytes 4 bytes
An initial Round Key addition Nr-1 rounds (Where Nr is dependent on Nb and Nk. Nr is always
between 10 and 14 rounds) A final round In psuedo-code:
Rijndael(state,Key) { KeyExpansion(Key,expKey) AddRoundKey(State,expKey) for(i = 0;i<Nr;i++) { Round(State,expKey + Nb*i) } FinalRound(State,expKey + Nb*Nr)
}
AES: The cipher structure
AES: functions
KeyExpansion() The cipher key is expanded to a linear array of
(Nb*(Nr+1)) 4-byte words AddRoundKey()
The State is XORd with with the round key (which is derived from the cipher key)
FinalRound() is identical to Round() without the MixColumn() function (which we will see shortly)…
AES The Round structure
Again, in pseudo C
Round(State,RoundKey) { ByteSub(State) ShiftRow(State) MixColumn(State) AddRoundKey(State,RoundKey)
}
ByteSub() A non-linear byte substitution (basically an S-box).
ShiftRow() The rows of the State are cyclically shifted based on block size.
MixColumn() Each column is multiplied as a matrix against a fixed polynomial.
AddRoundKey() The State is XORd with with the round key (which is derived from the cipher key).
text
K
0,0
K
1,1
K
0,1
K
3,0
K
2,0
K
1,0
K
1,3
K
0,3
K
3,2
K
2,2
K
1,2
K
0,2
K
3,1
K
2,1
K
3,3
K
2,3
text
b
0,0
b
1,1
b
0,1
b
3,0
b
2,0
b
1,0
b
1,3
b
0,3
b
3,2
b
2,2
b
1,2
b
0,2
b
3,1
b
2,1
b
3,3
b
2,3
text
a
0,0
a
1,1
a
0,1
a
3,0
a
2,0
a
1,0
a
1,3
a
0,3
a
3,2
a
2,2
a
1,2
a
0,2
a
3,1
a
2,1
a
3,3
a
2,3
text
a
0,0
a
1,1
a
0,1
a
3,0
a
2,0
a
1,0
a
1,3
a
0,3
a
3,2
a
2,2
a
1,2
a
0,2
a
3,1
a
2,1
a
3,3
a
2,3
text
b
0,0
b
1,1
b
0,1
b
3,0
b
2,0
b
1,0
b
1,3
b
0,3
b
3,2
b
2,2
b
1,2
b
0,2
b
3,1
b
2,1
b
3,3
b
2,3
c(x)
text
a
0,0
a
1,1
a
0,1
a
3,0
a
2,0
a
1,0
a
1,3
a
0,3
a
3,2
a
2,2
a
1,2
a
0,2
a
3,1
a
2,1
a
3,3
a
2,3
text
b
0,0
b
1,1
b
0,1
b
3,0
b
2,0
b
1,0
b
1,3
b
0,3
b
3,2
b
2,2
b
1,2
b
0,2
b
3,1
b
2,1
b
3,3
b
2,3
No cyclic shift
cyclic shift by C1(1)
cyclic shift by C2(1)
cyclic shift by C3(1)
text
a
0,0
a
1,1
a
0,1
a
3,0
a
2,0
a
1,0
a
1,3
a
0,3
a
3,2
a
i , j
a
1,2
a
0,2
a
3,1
a
2,1
a
3,3
a
2,3
text
b
0,0
b
1,1
b
0,1
b
3,0
b
2,0
b
1,0
b
1,3
b
0,3
b
3,2
b
i , j
b
1,2
b
0,2
b
3,1
b
2,1
b
3,3
b
2,3
S-box
ByteSub
MixColumn
ShiftRow
AddRoundKey
AES Rijndael decryption
Inverse transforms are performed on C. The order of transforms, however is identical to encryption
Slower than encryption (by about 30%) Since the inverse cipher is not used in many applications
(MAC,CFB,OFB), the developers consider this not a big problem.
Asymmetric key Cryptography
One problem with symmetric key algorithms is you need a secure method of telling your partner the key.
Plus, you need a separate key for everyone you might communicate with.
Public-Key algorithms use a public-key and private-key pair over a message. Only the public-key can decrypt a message encrypted with the
private key. Similarly, only the private key can decrypt a message decrypted
with the public key.
Public-key Crypto
If you know my public key, then only I can read your message.
If you can decrypt a message with my public key, then I must have written it.
First proposed by Whitfield Diffie and Martin Hellman, and independently by Ralph Merkle in the late 1970s.
(And by the NSA some time before that.) Generally, these algorithms are much slower than
symmetric key algorithms.
Public-key Crypto
A crucial feature is that the private key is difficult to determine from the public key, and the robustness against chosen-plaintext attacks.
In practice, a hybrid of symmetric and public-key approaches is used.
RSA is the most widely used public-key algorithm. Let’s discuss RSA, and then come back to a general
discussion of public-key crypto.
Rivest, Shamir, and Adleman (RSA)
Relies on the difficulty of factoring large numbers. Choose two large prime numbers, p and q. Compute n = pq and z = (p-1)(q-1). Choose a number, e, less than n, which has no common factors (other
than 1) with z. (in other words, e and z are relatively prime). Find a number, d, such that ed-1 is exactly divisible (i.e., with no
remainder) by z ed ≡ 1 (mod z).
The public key that made available to the world is the pair of numbers (n,e);
the private key is the pair of numbers (n,d).
RSA
Private key = (n,d) Public key = (n,e)
Encryption of a character Mi Ci = Mi
e(mod n) Decryption of a cipher character Ci
Mi = Cid (mod n)
RSA
Does this actually work out? Trust us…It does…
Are you going to explain why this actually works? Well…no…
How does this actually work out? If anyone is interested in the slides from last year, just ask… All you need is some basic number theory. And lots of free time…
But for those of you still skeptical that it does work, we offer an example…
Example encryption and decrypt
Choose two primes p=47 and q=71. Then, n=pq= 3337. Choose e, relatively prime to z=46x70=3220
how about 79. We need a d such that ed ≡ 1 (mod z), in other words, d=
e-1 mod z. d= 79 -1 (mod 3220) = 1019
Public key (3337,79). Private key (3337,1019)
Encrypt 688 -> 68879 mod 3337 = 1570. Decrypt 1570 -> 15701019 mod 3337 = 688
because Mk(p-1)(q-1) (mod n) = 1 when p and q are prime,
Theorem: Cd (mod n) =M
Proof: Reason Cd (mod n)
= (Me )d (mod n) C = Me(mod n)
= Med (mod n) (a b) c = a bc
= Mkz+1 (mod n) ed ≡ 1 (mod z) and ed = kz+1
= MMkz (mod n) ab+1 = aab
= MMk(p-1)(q-1) (mod n) z = (p-1)(q-1)
=M
One last thing
Private key = (n,d) Public key = (n,e) Encryption of a character M
C = Me(mod n) Decryption of a cipher character C
M = Cd (mod n)
Given the public key, we can choose M, and then calculate C. Since we know n, why not solve for d?
Because it’s very difficult to calculate e, it’s called the discrete logarithm. (just like: x=ya, find a=logyx?)
It seems to be as hard as factoring primes, and the best known algorithm takes time exponential with the size of the prime.