IN2120 Information SecurityUniversity of OsloAutumn 2019

Lecture 2

Cryptography

University of Oslo, Autumn 2019

Audun Jøsang

Outline

• What is cryptography?

• Brief crypto history

• Symmetric cryptography– Stream ciphers

– Block ciphers

– Hash functions

• Asymmetric cryptography– Encryption

– Diffie-Hellman key exchange

– Digital signatures

– Post-Quantum Crypto

L02 Cryptography IN2120 - UiO 2019 2

Terminology

• Cryptography is the science of secret writing with the goal of hiding the meaning of a message.

• Cryptanalysis is the science of breaking cryptography.

• Cryptology covers both cryptography and cryptanalysis.

L02 Cryptography IN2120 - UiO 2019 3

Cryptology

Cryptography Cryptanalysis

L02 Cryptography

What can cryptography do?

• Crypto can provide the following security services:

– Confidentiality:• Makes data unreadable to entities who do not have the

appropriate cryptographic keys, even if they have the data.

– Data Integrity:• Entities with the appropriate cryptographic keys can verify that

data is correct and has not been altered, either deliberately or accidentally.

– Authentication:• Entities who communicate can be assured that the other

user/entity or the sender of a message is what it claims to be.

– Digital Signature and PKI (Public-Key Infrastructure):• Strong proof of data origin which can be verified by 3rd parties.

• Scalable (to the whole Internet) distribution of cryptographic keys.

IN2120 - UiO 2019 4

Taxonomy of cryptographic functions

“Cipher” is the term for a “cryptographic algorithm”

L02 Cryptography IN2120 - UiO 2019 5

Ciphers

Symmetric

One secret key

used for both

encryption and decryption

Asymmetric

Public key used for

encryption and private

key used for decryption

Block StreamCalled “public-key

cryptography”

AS

HashFunctions

Cryptographic Functions

Block Cipher vs. Stream Cipher

Ciphertext blocks

Plaintext blocks

n bits

Block cipher

Key Block Cipher

n bits

Key stream

generator

Key

Ciphertext streamPlaintext stream

Key stream

Stream cipher

L02 Cryptography 6IN2120 - UiO 2019

Note that the key stream repeats itself and is not totally random, hence a

stream cipher is not a One-Time-Pad.

Evolution of Ciphers

L02 Cryptography IN2120 - UiO 2019 7

AD → 1799 1800 → 1939 1940 → 1975 1976 → 2000

Medieval ciphers

2001 →→ BC

Caesar cipher

Poly-alphabetic

Substitution +

Transposition

Substution

Classical ciphers

Scytale

Transposition

Vigenère1566

Pre-WW2 ciphers

Vernam1916

One-timepad

WW2 ciphers

Complex mechanics

Enigma

Shannon

SP-networksInfo-theory

Pre-2000 ciphers

DES

Feistel

Asymmetriccrypto

Post-2000 ciphers

AES

Rijmen & Daemen

Post-Quantum

Asymmetriccrypto

DiffieHellman

Terminology

• Encryption: plaintext (cleartext) M is converted into a ciphertext C under the control of a key k.– We write C = E(M, k).

• Decryption with key k recovers the plaintext M from the ciphertext C.– We write M = D(C, k).

• Symmetric ciphers: the secret key is used for both encryption and decryption.

• Asymmetric ciphers: Pair of private and public keys where it is computationally infeasible to derive the private decryption key from the corresponding public encryption key.

8L02 Cryptography IN2120 - UiO 2019

Symmetric cryptography (secret key)

• “Secret key” means that the key is shared “in secret” between entities who are authorized to encrypt and decrypt

L02 Cryptography IN2120 - UiO 2019 9

Algorithm

encryption decryption

Plaintext

Ciphertext

Plaintext

Secret key Secret key

Algorithm

Alice Bob

Message Message

Strength of Ciphers

Factors for cryptographic strength:

• Key size. – Exhaustive key-search time depends on the key size.

– Typical key size for a symmetric cipher is 256 bit.

– Attacker must try 2256/2 keys on average to find the key, which would take millions of years, which is not practical.

– With N different keys, the key size is log2(N).

• Algorithm strength.– Key discovery by cryptanalysis can exploit statistical

regularities in the ciphertext.

– To prevent cryptanalysis, the bit-patterns / characters in the ciphertext should have a uniform distribution, i.e. all bit-patterns / characters should be equally probable.

L02 Cryptography IN2120 - UiO 2019 10

Letter Frequencies → Statistical cryptanalysis

Historic ciphers, like the Caesar Cipher, are weak because they fail to hide statistical regularities in the ciphertext.

L02 Cryptography IN2120 - UiO 2019 11

Letter frequencies in English

Caesar Cipher

This Photo by Unknown Author is licensed under CC BY-SA

Claude Shannon (1916 – 2001) The Father of Information Theory – MIT / Bell Labs

• Information Theory– Defined the „binary digit“ (bit)

as information unit

– Defined information „entropy“ tomeasure amount of information

• Cryptography– Model of secrecy systems

– Defined perfect secrecy

– Principle of S-P encryption(substitution & permutation) tohide statistical regularities

L02 Cryptography 12IN2120 - UiO 2019

Shannon’s S-P NetworkRemoves statistical regularities in ciphertext

• “S-P Networks” (1949)

– Substitutions & Permutations

– Substitute bits e.g. 0001 with 0110

– Permute parts e.g. part-1 to part-2

– Substitution provides “confusion” i.e. complex relationship between input and output

– Permutation provide “diffusion”, i.e. a single input bit influences many output bits

– Iterated S-P functions a specific number of times

– Functions must be invertible

. . . .P

. . . .

. . . .P

...

L02 Cryptography 13IN2120 - UiO 2019

plaintext

ciphertext

ED

S S S

S S S

S S S

AES - Advanced Encryption Standard• DES (Data Encryption Standard) from 1977 had a

56-bit key and a 64-bit block. In the mid-1990s DES could be cracked with exhaustive key search.

• In 1997, NIST announced an open competition for a new block cipher to replace DES.

• The best proposal called “Rijndael” was nominated as AES (Advanced Encryption Standard) in 2001.

• AES has key sizes of 128, 192 or 256 bit

and block size of 128 bit.

14L02 Cryptography IN2120 - UiO 2019

AES is designed by Vincent Rijmen and Joan Daemen from Belgium

Block Ciphers: Modes of Operation

• Block ciphers can be used in different modes in order to provide specific security protection.

• Common modes include:

– Electronic Code Book (ECB)

– Cipher Block Chaining (CBC)

– Output FeedBack (OFB)

– Cipher FeedBack (CFB)

– CounTeR Mode (CTR)

L02 Cryptography IN2120 - UiO 2019 15

Insecure

Secure

Electronic Code Book (ECB-mode)

THIS IS A SIMPLE PLAINTEXT MESSAGE.

Encryption

X&jÜ(mA’8Dwßµ<3Ji8(clÄ+#/2Haq%7Ö1k5a$jA~Kq1§ü

Encryption Encryption

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Encryption

Lo%91Pa*/qF8Ql0 Lo%91Pa*/qF8Ql0 Lo%91Pa*/qF8Ql0

Encryption Encryption

L02 Cryptography IN2120 - UiO 2019 16

Electronic Code Book

• ECB Mode encryption

– Simplest mode of operation

– Plaintext data is divided into blocks M1, M2, …, Mn

– Each block is then processed separately

• Plaintext block and key used as inputs to the encryption algorithm

L02 Cryptography IN2120 - UiO 2019 17

EncryptK

M1

C1

EncryptK

M2

C2

EncryptK

Mn

Cn

DecryptK

C1

M1

DecryptK

C2

M2

DecryptK

Cn

Mn

Vulnerability of ECB-mode

L02 Cryptography IN2120 - UiO 2019 18

CTRCounter Mode

L02 Cryptography

One-Time-Pad: Gilbert Vernam, 1917

• Property of bitwise XOR addition: ki ki = 0 and mi = ci ki = mi ki ki

• OTP offers perfect security assuming the OTP key is perfectly random, of same length as the message, and only used once

L02 Cryptography IN2120 - UiO 2019 20

bitwise

XOR additionbitwise

XOR-additionPlaintext

message M

Ciphertext

k1, k2, k3 … ki …

Alice Bob

mi = ci kici = mi ki

encryption decryption

Shared secret

OTP key K

Shared secret

OTP key K

c1, c2, c3 … ci…

Message Message

k1, k2, k3 … ki …

Plaintext

message M

The perfect cipher: One-Time-Pad

• Old version used a paper tape of random data

• Modern versions can use DVDs with Gbytes of random data

L02 Cryptography IN2120 - UiO 2019 21

Integrity Check Functions- Hash functions- MAC functions

L02 Cryptography 22IN2120 - UiO 2019

Hash functions (message digest functions)

Requirements for a one-way hash function h:

1.Ease of computation: given x, it is easy to compute h(x).

2.Compression: h maps inputs x of arbitrary bitlength to outputs h(x) of a fixed bitlength n.

3.One-way: given a value y, it is computationally infeasible to find an input x so that h(x)=y.

4.Collision resistance: it is computationally infeasible to find x and x’, where x ≠ x’, with h(x)=h(x’) (note: two variants of this property).

L02 Cryptography IN2120 - UiO 2019 23

Properties of hash functions

L02 Cryptography IN2120 - UiO 2019 24

x

h(x)

Ease of

computation

h(x)

Collisions

exist but are

hard to find

x x’?

h(.)

Pre-image

resistance

Weak collision

resistance

(2nd pre-image

resistance)

h(x)

x ?

h(.)

Strong

collision

resistance

? ?

Applications of hash functions

• Comparing files

• Protection of password

• Authentication of SW distributions

• Bitcoin

• Generation of Message Authentication Codes (MAC)

• Digital signatures

• Pseudo number generation/Mask generationfunctions

• Key derivation

L02 Cryptography IN2120 - UiO 2019 25

Well-known hash functions

• MD5 (1991): 128 bit digest. Relatively easy to break by finding collisions, due to short digest and poor design. Not to be used in new applications, but may be used in legacy applications.

• SHA-1 (Secure Hash Algorithm):160 bit digest. Designed by NSA in 1995 to operate with DSA (Digital Signature Standard). Attacks exist. Not recommended, but sometimes still in use.

• SHA-2 designed by NSA in 2001 provides 224, 256, 384, and 512 bit digest. Considered secure. Replacement for SHA-1.

• SHA-3: designed by Joan Daemen + others in 2010.

Standardized in 2015. Digest of: 224, 256, 384, and 512 bit.

SHA-3 has little use, because SHA-2 is considered strong.

L02 Cryptography IN2120 - UiO 2019 26

Message Authentication Codes

• A message M with a simple message hash h(M) can be changed by attacker.

• In communications, we need to verify the origin of data, i.e. we need message authentication.

• MAC (message authentication code) can use hash function as h(M, k) i.e. with message M and a secret key k as input.

• To validate and authenticate a message, the receiver has to share the same secret key used to compute the MAC with the sender.

• A third party who does not know the key cannot validate the MAC.

L02 Cryptography IN2120 - UiO 2019 27

Practical message integrity with MAC

L02 Cryptography IN2120 - UiO 2019 28

Shared

secret

key

h(M,K)

MAC

functionMAC

function

Message MReceived

message M’

Alice Bob

Verify h(M,K) = h(M ’,K)

Shared

secret key

h(M ’ ,K) MAC

MAC sent

together with

message M

MAC

MAC and MAC functions

• Terminology– MAC is the computed message authentication code h(M, k)

– MAC function is the algorithm used to compute a MAC

• Different types of MAC functions are e.g.– HMAC (Hash-based MAC algorithm))

– CBC-MAC (CBC based MAC algorithm)

– CMAC (Cipher-based MAC algorithm)

• MAC functions, a.k.a. keyed hash functions, support data origin authentication services.

L02 Cryptography IN2120 - UiO 2019 29

Public-Key Cryptography

Problem of symmetric key distribution

• Shared key between each pair

• In network of n users, each participant needs n-1 keys.

• Number of exchanged secret keys:= n(n-1)/2

= number of glasses touching at cocktail party

• Grows exponentially, which is a major problem.

• Is there a better way?– Public-key cryptography

Network of 5 nodes

L02 Cryptography 31IN2120 - UiO 2019

Cocktail party

James H. Ellis (1924 – 1997)Inventor of pub-key crypto, but received little recognition

• British engineer and mathematician

• Worked at GCHQ (Government Communications Headquarters)

• Idea of non-secret encryption to solve key distribution problem

• Encrypt with non-secret information in a way which makes it impossible to decrypt without related secret information

• Never found a practical method

L02 Cryptography 32IN2120 - UiO 2019

Clifford Cocks (1950 – )Inventor of RSA algorithm in 1973, recognized in 1998

• British mathematician and cryptographer

• Silver medal at the International Mathematical Olympiad, 1968

• Worked at GCHQ (equivalent to NSA)

• Heard from James Ellis the idea of non-secret encryption in 1973

• Spent 30 minutes in 1973 to invent a practical method

• Equivalent to the RSA algorithm

• Was classified TOP SECRET

• Result revealed in 1998

• Fellow of the British Royal Society in 2015.

L02 Cryptography 33IN2120 - UiO 2019

Malcolm J. Williamson (1950 – 2015)Inventor of key exchange but received little recognition

• British mathematician and cryptographer

• Gold medal at the International Mathematical Olympiad, 1968

• Worked at GCHQ until 1982

• Heard from James Ellis the idea of non-secret encryption, and from Clifford Cocks the practical method.

• Intrigued, spent 1 day in 1974 to invent a method for secret key exchange without secret channel

• Equivalent to the Diffie-Hellmann key exchange algorithm

L02 Cryptography 34IN2120 - UiO 2019

Ralph Merkle, Martin Hellman and Whitfield Diffie

• Merkle invented (1979) the Merkle Hash Tree and the Merkle Digital Signature Scheme, used e.g. in Bitcoin. Resistant to quantum computers.

• Diffie & Hellman(1976) invented a practical key exchange algorithm with discrete exponentiation.

• D&H defined public-key encryption (equiv. to non-secret encryption) (1976)

• Defined digital signature• “New directions in cryptography”

(1976)

L02 Cryptography 35IN2120 - UiO 2019

Diffie-Hellman key agreement (key exchange)(provides no authentication)

Attackers can not recover the integers a or b because discrete logarithm of large integers is computationally difficult. Hence, attackers are unable to compute the secret key = gab mod p.

L02 Cryptography IN2120 - UiO 2019 36

ga mod p

Alice computes the shared secret (gb)a = gab mod p

Bob computes the same shared secret (ga)b = gab mod p.

Alice picks private random integer a

gb mod p

Bob picks private random integer b

Applications of Diffie-Hellman Key Exchange

• IPSec (IP Security)

– IKE (Internet Key Exchange) is part of the IPSec protocol suite

– IKE is based on Diffie-Hellman Key Agreement

• SSL/TLS

– Several variations of SSL/TLS protocol including

• Fixed Diffie-Hellman

• Ephemeral Diffie-Hellman

• Anonymous Diffie-Hellman

L02 Cryptography IN2120 - UiO 2019 37

Ron Rivest, Adi Shamir and Len Adleman

• Read about public-key cryptography in 1976 article by Diffie & Hellman: “New directions in cryptography”

• Intrigued, they worked on finding a practical algorithm

• Spent several months in 1976 to re-invent the method for non-secret/public-key encryption discovered by Clifford Cocks 3 years earlier

• Named RSA algorithm

• Uses a pair of keys: public key and private key

L02 Cryptography 38IN2120 - UiO 2019

Asymmetric Ciphers: Examples of Cryptosystems

• RSA: best known asymmetric algorithm.

– RSA = Rivest, Shamir, and Adleman (published 1977)

– Historical Note: U.K. cryptographer Clifford Cocks invented the same algorithm in 1973, but didn’t publish.

• ElGamal Cryptosystem

– Based on the difficulty of solving the discrete log problem.

• Elliptic Curve Cryptography

– Based on the difficulty of solving the EC discrete log problem.

– Provides same level of security with smaller key sizes.

L02 Cryptography IN2120 - UiO 2019 39

Asymmetric Encryption: Basic encryption operation

• In practical applications, large messages are not encrypted directly with asymmetric algorithms. Hybrid systems are used.

L02 Cryptography IN2120 - UiO 2019 40

Bob’s

private key

C = E(M,Kpub(B)) M = D(C,Kpriv(B))

Alice’s

public-key

ring

Bob’s

public

key

Asymmetric

encryption

Asymmetric

decryption

Plaintext M Ciphertext C Plaintext M

Alice Bob

Hybrid Cryptosystems

• Symmetric ciphers are faster than asymmetric ciphers (because they are less computationally expensive ), but ...

• Asymmetric ciphers simplify key distribution, therefore ...

• a combination of both symmetric and asymmetric ciphers can be used – a hybrid system:– The asymmetric cipher is used to distribute a randomly

chosen symmetric key.

– The symmetric cipher is used for encrypting bulk data.

L02 Cryptography 41IN2120 - UiO 2019

Confidentiality Services:Hybrid Cryptosystems

Bob’s

private key

Kpriv(B)

Plaintext M

Ciphertext C

Plaintext MC = E(M,K) M = D(C,K)

Alice’s

public-key

ring

Generate secret

symmetric key KShared secret

symmetric key K

E(K,Kpub(B))

Encrypted

key K

Asymmetric

encryption

Asymmetric

decryption

Symmetric

encryption

Symmetric

decryption

L02 Cryptography 42IN2120 - UiO 2019

Alice Bob

Bob’s

public key Kpub(B)

Digital Signatures

L02 Cryptography 43IN2120 - UiO 2019

Digital Signature Mechanisms

• A MAC cannot be used as evidence to be verified by a 3rd party.

• Digital signatures can be verified by 3rd party.– Used for non-repudiation,

– data origin authentication and

– data integrity

• Digital signature mechanisms have three components:– key generation

– signing procedure (private)

– verification procedure (public)

44L02 Cryptography IN2120 - UiO 2019

Digital signature: Basic operation

• In practical applications, message M is not signed directly, only a hash value h(M) is signed.

L02 Cryptography IN2120 - UiO 2019 45

Alice’s

private key

C = E(M,Kpriv(A)) M = D(C,Kpub(A))

Alice’s

public

key

Bob’s

public-key

ring

Encryption

operation

(Signing)

Decryption

operation

(Validation)

Plaintext M C = (Signed M) Plaintext M

Alice Bob

Practical digital signature based on hash value

L02 Cryptography IN2120 - UiO 2019 46

Alice’s private

key

Sig = E(h(M),Kpriv(A))

h(M) = D(Sig,Kpub(A))

Bob’s

public-key

ring

Sign

hashed

message

Recover

hash

from Sig

Plaintext M

Digital

Signature

Received plaintext M’

Compute hash

h(M’ )

Verify h(M) = h(M’ )Compute hash

h(M)

Alice Bob

Alice’s

public key

Non-repudiation only possible with DigSig

L02 Cryptography IN2120 - UiO 2019 47

Alice Bob

Sharedsecret key

The MAC was made with the secret key, so I know that Alice sent the message.

But you have the same secret key, so maybe you sent the message.

Alice BobPrivate key The message was

signed by Alice, so I know that she sent the message.

You are right, only Alice could have signed the message.

Pulic key

Symmetric authentication

MAC

Non-repudiatable authentication

Digital signature

L02 Cryptography IN2120 - UiO 2019 48

DN

.no, 1

Dece

mbe

r 20

17

Principle for Quantum Computing

• Quantum Computing (QC) uses quantum superpositionsinstead of binary bits to perform computations.

• Quantum algorithms, i.e. algorithms for quantum computers, can solve certain problems much faster than classicalcomputer algorithms.

L02 Cryptography IN2120 - UiO 2019 49

ExperimentalQuantum

Computer

QC Threat to Traditional Cryptography

• Shor’s Quantum Algorithm (1994) can factor integers and compute discrete logarithms efficiently. With a powerful quantum computer (at least 1 million qubits), Shor’s algorithm would be devastating to traditional public key crypto algorithms.

• Grover’s Quantum Search Algorithm (1996) can be used to brute-force search for a k-bit secret key with an effort of only

which effectively doubles the required key sizes for ciphers.

• QC has been dismissed by most cryptographers until recent years. General purpose quantum computers do not currently exist, but are predicted to be built in foreseeable future.

2/22 kk =

L02 Cryptography IN2120 - UiO 2019 50

Cryptographic Functions and Services

L02 Cryptography IN2120 - UiO 2019 51

Hash-functions

Symmetricencryption

Asymmetricencryption & digital signature(Traditional), e.g. RSA, ECC, Diffie-Hellman

Confidentiality

Authentcity / Integrity

Digital SignaturePKI / key distribution

ConfidentialityT

Quantum Threat

Cryptographic Functions and Services

L02 Cryptography IN2120 - UiO 2019 52

Hash-functions

Symmetricencryption

Asymmetricencryption & digital signature(Post-Quantum), e.g., Lattice-based, Multivariate, Hash-based, Code-based, Elliptic curve isogeny

Confidentiality

Authentcity / Integrity

Digital SignaturePKI / key distribution

ConfidentialityPQ

Thanks to PQ Crypto wecan still use DigSig and PKI even with quantumcomputers of 1 million qubit

Collapse of traditional asymmetric crypto?

L02 Cryptography IN2120 - UiO 2019 53

10.000.000

1.000.000

100.000

10.000

0

1000

Collapse

No collapse

2030 2040 2050 2060 2070 2080

Very

uncert

ain

pre

dic

tion

2020 2090

?

?

?

Year

QuantumComputer Qubit size

50 qubitcomputer

Lo

ga

ritm

icsca

le

Towards Standardized PQC

• The term “Post-Quantum Crypto” means crypto which is resistant to powerful quantum computers.

• Many organizations plan to start using PQC just to be on the safe side, and not risk bad publicity.

L02 Cryptography IN2120 - UiO 2019 54

2016 2017 2018 2019 2020 2021 2022 2023

PQC already works

• Many initiatives for prototyping PQC in real applications

• Version of Chrome Browser with PQC TLS

• Disadvantage of PQC is high complexity and computation load

L02 Cryptography IN2120 - UiO 2019 55

End of lecture

UiO Autumn 2019 IN2120 - L02 Crypto 56