INTRODUCTION TO
CRYPTOGRAPHY
Dr. Sriram Sankaran, Amrita University
Lecture Outline
Introduction
Encryption
Hash functions
Message Authentication codes
Digital Signatures
Session key establishment protocols
Pseudo-random number generators
Advanced authentication techniques
Introduction to Cryptography
Cryptography focuses on the prevention of attacks
Not a panacea for security problems
Attacks can be classified into Passive and Active
Passive
Attempts to learn or make use of the system but does not affect
system resources
Examples: eavesdropping, traffic analysis
Hard to detect
Active
Attempts to alter or affect system operation
Examples: Spoofing, reply, modification, DoS
Difficult to prevent
Security Mechanisms
Encryption
Symmetric, Asymmetric key protocols
Digital Signatures
Access Control Schemes
Access Control Lists, Capabilities, Security labels
Data Integrity Mechanisms
Message Authentication Codes, Sequence numbering,
Timestamping, Cryptographic chaining
Authentication protocols
Passwords, Cryptographic challenge-response protocols,
biometrics
Traffic padding, route control
Classical Model of Encryption
Goal of the adversary
To systematically recover plaintexts from ciphertexts
To deduce the (decryption) key
Kerckhoff’s principle
We must assume that the adversary knows all details of E and D
Security of the system should be based on the protection of the
decryption key
Adversary Models
Ciphertext-only attack
the adversary can only observe ciphertexts produced by the same encryption
key
Known-plaintext attack
the adversary can obtain corresponding plaintext-ciphertext pairs produced
with the same encryption key
(Adaptive) Chosen-plaintext attack
the adversary can choose plaintexts and obtain the corresponding ciphertexts
(Adaptive) Chosen-ciphertext attack
the adversary can choose ciphertexts and obtain the corresponding plaintexts
Related-key attack
the adversary can obtain ciphertexts, or plaintext-ciphertext pairs that are
produced with different encryption keys that are related in a known way to a
specific encryption key
Security of Encryption Schemes
An encryption scheme is secure in a given adversary
model if it is computationally infeasible for the
adversary to determine the target decryption key
under the assumptions of the given model
For many encryption schemes used in practice, no
proof of security exists
These schemes are used, nevertheless, because they are
efficient and they resist all known attacks
Some encryption schemes are provably secure,
however these schemes are often inefficient
Classification of Encryption Schemes
Symmetric-key encryption
it is easy to compute K’ from K (and vice versa)
usually K’ = K
two main types:
◼ stream ciphers – operate on individual characters of the
plaintext
◼ block ciphers – process the plaintext in larger blocks of
characters
Asymmetric-key encryption
it is hard (computationally infeasible) to compute K’
from K
K can be made public (→ public-key cryptography)
Popular Encryption Ciphers
Stream Cipher
One-Time-Pad
RC4
Block Cipher
DES/AES
RC5
Stream Ciphers
Processes the message bit by bit (as a stream)
Typically has a (pseudo) random stream key
Combined (XORed) with plaintext bit by bit
Randomness of stream key completely destroys any
statistical properties in the message
Ci = Mi XOR StreamKeyi
Stream key should not be reused
Vernam Cipher and One-time pad
Vernam cipher
ci = pi ki for i = 1, 2, …
where pi are the plaintext digits, ki are the key stream digits, ci
are the ciphertext digits, and is the bitwise XOR operation
One-time pad
a Vernam cipher where the key stream digits are generated
independently and uniformly at random
the one-time pad is unconditionally secure [Shannon, 1949]
◼ I(P; C) = H(P) - H(P|C) = 0
a necessary condition for a symmetric key cipher to be
unconditionally secure is that H(K) H(P) [Shannon, 1949]
◼ practically, the key must have as many bits as the compressed
plaintext
◼ impractical because of key management problems
Block Ciphers
an n bit block cipher is a function E: {0, 1}n x
{0, 1}k → {0, 1}n, such that for each K {0,
1}k, E(x, K) = EK(x) is an invertible mapping
from {0, 1}n to {0, 1}n
Block Cipher Design Criteria
Completeness
each bit of the output block should depend on each bit of
the input block and on each bit of the key
Avalanche effect
changing one bit in the input block should change
approximately half of the bits in the output block
similarly, changing one key bit should result in the change of
approximately half of the bits in the output block
Statistical independence
input and output should appear to be statistically
independent
Block Cipher modes of operation
ECB – Electronic Codebook
used to encipher a single plaintext block (e.g., a DES key)
CBC – Cipher Block Chaining
repeated use of the encryption algorithm to encipher a
message consisting of many blocks
CFB – Cipher Feedback
used to encipher a stream of characters, dealing with each
character as it comes
OFB – Output Feedback
another method of stream encryption, used on noisy
channels
CTR – Counter
simplified OFB with certain advantages
Block Cipher – ECB mode
Block Cipher – CBC mode
Block Cipher – CFB mode
Block Cipher – OFB mode
Block Cipher – CTR mode
Iterated Hash Functions
Input is divided into fixed length blocks x 1, x2, …, xL
Last block is padded if necessary
Each input block is processed according to the following scheme
f is called the compression function
can be based on a block cipher, or
can be a dedicated compression function
Desirable properties of MAC functions
Ease of computation
given an input x and a secret key k, it is easy to compute
MACk(x)
Key non-recovery
it is computationally infeasible to recover the secret key k,
given one or more text-MAC pairs (xi, MACk(xi)) for that k
Computation resistance
given zero or more text-MAC pairs (xi, MACk(xi)), it is
computationally infeasible to find a text-MAC pair (x,
MACk(x)) for any new input x xi
computation resistance implies key non-recovery but the
reverse is not true in general
CBC-MAC
CBC-MAC is secure for messages of a fixed number of blocks
(Adaptive chosen-text existential) forgery is possible if variable
length messages are allowed
→ It is recommended to involve the length of the message in the CBC
MAC computation
Asymmetric Cryptography
Asymmetric-key encryption
it is hard (computationally infeasible) to compute K’ from K
K can be made public (public-key cryptography)
no need for key setup before communication
Public-keys are not confidential but they must be authentic !
Security of asymmetric-key encryption schemes is usually based on some
well-known or widely believed hard problems
Hardness of Asymmetric Cryptography
Discrete logarithm problem
Given a prime p, a generator g of Zp*, and an element
y in Zp*, find the integer x, 0 x p-2, such that gx
mod p = y
◼ true complexity is unknown
◼ it is believed that it does not belong to P
RSA Scheme
Key generation
select p, q large primes (about 500 bits each)
n = pq, (n) = (p-1)(q-1)
select e such that 1 < e < (n) and gcd(e, (n)) = 1
compute d such that ed mod (n) = 1 (this is easy if (n) is known)
the public key is (e, n)
the private key is d
Encryption
represent the message as an integer m in [0, n-1]
compute c = me mod n
Decryption
compute m = cd mod n
Relation to factoring
the problem of computing d from (e, n) is
computationally equivalent to the problem of factoring
n
if one can factor n, then one can easily compute d
if one can compute d, then one can efficiently factor n
the problem of computing m from c and (e, n) (called
the RSA problem) is believed to be computationally
equivalent to factoring
if one can factor n, then one can easily compute m from c
and (e, n)
there’s no formal proof for the other direction
Hash Functions
a hash function maps bit strings of arbitrary finite
length to bit strings of fixed length (n bits)
many-to-one mapping → collisions are unavoidable
however, finding collisions are difficult → the hash value
of a message can serve as a compact representative
image of the message (similar to fingerprints)
Desirable properties of Hash functions
Ease of computation
Given an input x, the hash value h(x) of x is easy to compute
Weak collision resistance (2nd preimage resistance)
Given an input x, it is computationally infeasible to find a second input
x’ such that h(x’) = h(x)
Strong collision resistance (collision resistance)
It is computationally infeasible to find any two distinct inputs x and x’
such that h(x) = h(x’)
One-way property (preimage resistance)
Given a hash value y (for which no preimage is known), it is
computationally infeasible to find any input x s.t. h(x) = y
Message Authentication Codes
MAC functions can be viewed as hash functions with two functionally
distinct inputs: a message and a secret key
They produce a fixed size output (say n bits) called the MAC
Practically it should be infeasible to produce a correct MAC for a
message without the knowledge of the secret key
MAC functions can be used to implement data integrity and message
origin authentication services
MAC generation and verification
30/80
HMAC
Need for Salting
let us assume that the adversary observes a ciphertext
c = EK(m)
let the set of possible plaintexts be M
if M is small, then the adversary can try to encrypt every
message in M with the publicly known key K until she finds
the message m that maps into c
the usual way to prevent this attack is to randomize the
encryption
some random bytes are added to the plaintext message before
encryption through the application of the PKCS #1 formatting
rules
when the message is decrypted, the recipient can recognize and
discard these random bytes
El-Gamal Encryption Scheme
Key generation
generate a large random prime p and choose generator g of the multiplicative
group Zp* = {1, 2, …, p-1}
select a random integer a, 1 a p-2, and compute A = ga mod p
the public key is (p, g, A)
the private key is a
Encryption
represent the message as an integer m in [0, p-1]
select a random integer r, 1 r p-2, and compute R = gr mod p
compute C = mAr mod p
the ciphertext is the pair (R, C)
Decryption
compute m = CRp-1-a mod p
Proof of decryption
CRp-1-a mArRp-1-a mgargr(p-1-a) m(gp-1)r m (mod p)
Relation to hard problem
Security of the ElGamal scheme is said to be based
on the discrete logarithm problem in Zp*, although
equivalence has not been proven yet
Recovering m given p, g, A, R, and C is equivalent to
solving the Diffie-Hellman problem
Digital Enveloping
Most popular public-key encryption methods are several orders of
magnitude slower than the best known symmetric key schemes
→ Public-key encryption is used together with symmetric-key encryption; the
technique is called digital enveloping
Digital Signatures
Digital Signatures
Similar to MACs but
unforgeable by the receiver
verifiable by a third party
Used for message authentication and non-repudiation
(of message origin)
Based on public-key cryptography
private key defines a signing transformation SA
◼ SA(m) =
public key defines a verification transformation VA
◼ VA(m, ) = true if SA(m) =
◼ VA(m, ) = false otherwise
Attacks on Digital Signature Schemes
Key-only attack
Only the public key is available to the adversary
Known-message attack
Adversary has signatures for a set of messages known to her but
not chosen by her
Chosen-message attack
Adversary obtains signatures for messages chosen by her before
attempting to break the signature scheme
Adaptive chosen-message attack
Adversary is allowed to use the signer as an oracle
she may request signatures for messages which depend on
previously obtained signatures
Hash and Sign paradigm
Public/private key operations are slow
Hash the message first and apply public/private
key operations to the hash value only
Examples of Digital Signature Schemes
RSA
essentially identical to the RSA encryption scheme
signature = decryption with private key
typical signature length is 1024 bits
DSA (Digital Signature Algorithm)
based on the ElGamal signature scheme
typical signature length is 1024 bits
ECDSA (Elliptic Curve DSA)
same as DSA but works over elliptic curves
reduced signature length (typically 320 bits)
Session Key Establishment Protocols
Session key Establishment Protocols
Goal of session key establishment protocols
to setup a shared secret between two (or more) parties
it is desired that the secret established by a fixed pair of parties
varies on subsequent executions of the protocol (dynamicity)
established shared secret is used as a session key to protect
communication between the parties
Motivation for use of session keys
To limit available ciphertext for cryptanalysis
To limit exposure caused by the compromise of a session key
To avoid long-term storage of a large number of secret keys
(keys are created on-demand when actually required)
To create independence across communication sessions or
applications
Basic Classification
Key transport protocols
one party creates or otherwise obtains a secret value,
and securely transfers it to the other party
Key agreement protocols
a shared secret is derived by the parties as a function
of information contributed by each, such that no party
can predetermine the resulting value
Further Services
Entity authentication
Implicit key authentication
one party is assured that no other party aside from a specifically identified second
party (and possibly some trusted third parties) may gain access to the established
session key
Key confirmation
one party is assured that a second (possibly unidentified) party actually possesses
the session key
possession of a key can be demonstrated by
◼ producing a one-way hash value of the key or
◼ encryption of known data with the key
Explicit key authentication
implicit key authentication + key confirmation
Key freshness
one party is assured that the key is new (never used before)
Further protocol characteristics
Reciprocity
guarantees are provided unilaterally
guarantees are provided mutually
Efficiency
number of message exchanges (passes) required
total number of bits transmitted (i.e., bandwidth used)
complexity of computations by each party
possibility of precomputations to reduce on-line computational complexity
Third party requirements
on-line, off-line, or no third party at all
degree and type of trust required in the third party
System setup
distribution of initial keying material
Wide Mouth Frog Protocol
A flaw in the Wide Mouth Frog
Protocol
Signed Encrypted Keys
Diffie Hellman Protocol
Pseudorandom Number Generators
Pseudo-Random Number Generators
A random number is a number that cannot be predicted by
an observer before it is generated
if the number is generated within the range [0, N-1], then its
value cannot be predicted with any better probability than 1/N
the above is true even if the observer is given all previously
generated numbers
A cryptographic pseudo-random number generator (PRNG)
is a mechanism that processes somewhat unpredictable
inputs and generates pseudo-random outputs
if designed, implemented, and used properly, then even an
adversary with enormous computational power should not be
able to distinguish the PRNG output from a real random sequence
General Operation of PRNGs
Desirable properties of PRNGs
Adversary cannot compute the internal state of the PRNG,
even if she has observed many outputs of the PRNG
Adversary cannot compute the next output of the PRNG,
even if she has observed many previous outputs of the
PRNG
If adversary can observe or even manipulate the input
samples that are fed in the PRNG, but she does not know the
internal state of the PRNG, then the adversary cannot
compute the next output and the next internal state of the
PRNG
If adversary has somehow learned the internal state of the
PRNG, but she cannot observe the input samples that are
fed in the PRNG, then the adversary cannot figure out the
internal state of the PRNG after the re-keying operation
Advanced Authentication Techniques
Hash Chains
A hash chain is a sequence of hash values that are computed by iteratively
calling a one-way hash function on an initial value v 0
Hash chains can be used for repeated authentications at the cost of a single
digital signature
Alice computes a hash chain and commits to it by signing vn and
distributing it to potential verifiers
later on, Alice can authenticate herself repeatedly (at most n times) by
revealing the elements of the hash chain in reverse order
when vn-i is revealed, verifiers can check if h (i)(vn-i) = vn (or h(vn-i) = vn-i+1
if they remember the last revealed element)
each hash chain element can be used only once for authenticating Alice
Merkle Trees
TESLA
Broadcast authentication mechanism based on symmetric key cryptographic
primitives
Main idea: asymmetry through delayed disclosure of authentication keys
Alice wants to broadcast a message m
Alice computes a MAC on m with a key unknown to the verifiers
Verifiers receive message m with the MAC, but they cannot immediately verify
authenticity
Later, Alice discloses the key used to compute the MAC
Verifiers can now verify the MAC; if it is correct, they know that the message was sent
by Alice, because at the time of reception nobody else knew the key
Assumptions:
Loose time synchronization between the participants
Each party knows an upper bound on the maximum synchronization error
Initial secret between the parties to bootstrap the whole mechanism
TESLA (Contd..)
MAC keys are consecutive elements in a one-way key chain:
K0 → K1 → … → K n
Ki = h(Ki-1)
Protocol operation:
setup: Alice sends Kn to each verifier in an authentic manner
time is divided into epochs
each message sent in epoch i is authenticated with key Kn-i
Kn-i is disclosed in epoch i+d, where d is a system parameter
Kn-i is verified by checking h(Kn-i) = Kn-i+1
