Computer security module 2

Computer Security
Deepak John
SJCET-Palai

Advanced Encryption Standard(AES)
 Symmetric block cipher,designed by Rijmen-Daemen in Belgium and published
by National Institute of Standards and Technology (NIST) in December 2001.
 Intended to replace DES and 3DES
 DES is vulnerable to differential attacks
 3DES has slow performances
NIST Evaluation Criteria
 Security: The effort to crypt analyze an algorithm.
 Cost: The algorithm should be practical in a wide range of applications.
 Algorithm and Implementation Characteristics : Flexibility, simplicity etc.

Final evaluation criteria
 General Security
 Software Implementations
 Hardware Implementations
 Restricted-Space Environments
 Attacks on Implementations
 Encryption vs. Decryption
 Key Agility
 Potential for Instruction-Level Parallelism
 Other versatility and Flexibility

AES Cipher
 an iterative rather than Feistel cipher
 processes data as block of 4 columns of 4 bytes
 operates on entire data block in every round
 designed to have:
 resistance against known attacks
 speed and code compactness on many CPUs
 design simplicity

AES Structure
 processes data as state array
 Encryption/Decryption consists of 10 rounds of processing for 128-bit keys,12
rounds for 192-bit keys, and 14 rounds for 256-bit keys.
 Except for the last round , all other rounds are identical.
 Each round of processing includes
1. byte substitution (1 S-box; byte to byte substitution)
2. shift rows (permutation of bytes)
3. mix columns (substitution using matrix multiply of groups)
4. Add Round Key (XOR state with a portion of expended K)
 The order in which these four steps are executed is different for encryption and
decryption

 The input is a single 128 bit block both for decryption and encryption and is
known as the in matrix .
 This block is copied into a state array which is modified at each stage of the
algorithm and then copied to an output matrix .
 The key is expanded into an array of key schedule words (the w matrix).
 Ordering of bytes within the in and w matrix is by column.

Data structures in the AES algorithm

Byte Substitution
 a simple substitution of each byte
 uses S-box to perform a byte-by-byte
substitution of State
 uses one table of 16x16 bytes containing a
permutation of all 256 8-bit values
 each byte of state is replaced by byte indexed
by row (left 4-bits) & column (right 4-bits)
 eg. byte {95} is replaced by byte in row 9
column 5
 which has value {2A}
 designed to be resistant to all known attacks

Shift Rows
 a circular byte shift in each row
 1st row is unchanged
 2nd row does 1 byte circular shift to
left
 3rd row does 2 byte circular shift to
left
 4th row does 3 byte circular shift to
left

Mix Columns
 operates at the column level;
 it transforms each column of the state to a new column.

AddRoundKey
• adds a round key word with each state column matrix.
• Each column in the state matrix is XORed with a different word.
• proceeds one column at a time.
• the operation in AddRoundKey is matrix addition.

AES Key Expansion
 create round keys for each round,
 takes key and expands into array
of 44/52/60 32-bit words
 start by copying key into first 4
words

AES Decryption
 AES decryption is not identical to encryption since steps done in reverse.
 Decryption algorithm uses the expanded key in reverse order.
 All functions are easily reversible and their inverse form is used in decryption
Analysis of AES
the AES is secure against all known attacks.
Various aspects of its design incorporate specific features that help provide
security against specific attacks.
There are apparently no known attacks on AES.

Multiple Encryption & DES
 clear a replacement for DES was needed
 theoretical attacks that can break it
 demonstrated exhaustive key search attacks
 prior to this alternative was to use multiple encryption with DES implementations
 Triple-DES is the chosen form

Double-DES
 could use 2 DES encrypts on each block
 C = EK2(EK1(P))
 P = D(K1, D(K2, C))
 Encryption sequence: E-E
 Decryption sequence: D-D
 and have “meet-in-the-middle” attack
 since M = EK1(P) = DK2(C)
 The attacker tries to break the two-part encryption method from both sides
simultaneously, a successful effort enables him to meet in the middle of the
block cipher.

Triple-DES with Two-Keys
 hence must use 3 encryptions
 would seem to need 3 distinct keys
 Encryption sequence: E-D-E
 Decryption sequence: D-E-D
 but can use 2 keys with E-D-E sequence
 C = EK1(DK2(EK1(P)))
 P = D(K1, E(K2, D(K1, C)))
 if K1=K2 then can work with single
DES
 standardized in ANSI X9.17 & ISO8732
 no current known practical attacks

Triple-DES with Three-Keys
 although are no practical attacks on two-key Triple-DES have some indications
 can use Triple-DES with Three-Keys to avoid even these
 C = EK3(DK2(EK1(P)))
 P=DK1 (EK2 (EK3 (C)))
E D E

Modes of Operation
 block ciphers encrypt fixed size blocks
 eg. DES encrypts 64-bit blocks with 56-bit key
 NIST defines 5 possible modes to cover a wide variety of applications
1. Electronic CodeBook Mode (ECB)
2. Cipher Block Chaining Mode (CBC)
3. Cipher FeedBack Mode (CFB)
4. Output FeedBack Mode (OFB)
5. CounTeR Mode(CTR)
 can be used with any block cipher
 have block and stream modes

Electronic Code Book (ECB)
 message is broken into independent
blocks which are encrypted
 each block is a value which is
substituted, like a codebook,
 each block is encoded independently
of the other blocks
Ci = EK1(Pi)
 uses: secure transmission of single
values

Advantages and Limitations of ECB
 message repetitions may show in cipher text
 main use is sending a few blocks of data

Cipher Block Chaining (CBC)
 message is broken into blocks
 linked together in encryption
operation
 each previous cipher blocks is
chained with current plaintext block,
 use Initial Vector (IV) to start process
Ci = EK1(Pi XOR Ci-1)
Ci-1 = IV
 uses: bulk data encryption,
authentication

Advantages and Limitations of CBC
 a cipher text block depends on all blocks before it
 any change to a block affects all following cipher text blocks
 need Initialization Vector (IV)
 which must be known to sender & receiver
 hence IV must either be a fixed value
 or must be sent encrypted in ECB mode before rest of message

Stream Modes of Operation
 block modes encrypt entire block
 may need to operate on smaller units
 real time data
 convert block cipher into stream cipher
 cipher feedback (CFB) mode
 output feedback (OFB) mode
 counter (CTR) mode
 use block cipher as some form of pseudo-random number generator

Cipher Feed Back (CFB)
 message is treated as a stream of bits
 added to the output of the block cipher
 result is feed back for next stage
 standard allows any number of bit (1,8, 64 or 128 etc) to be feed back
 denoted CFB-1, CFB-8, CFB-64, CFB-128 etc

Ci = Pi XOR EK1(Ci-1)
C-1 = IV

Advantages and Limitations of CFB
 appropriate when data arrives in bits/bytes
 most common stream mode
 encryption mode used at both ends

Output Feed Back (OFB)
 output of cipher is added to message
 output is then feed back
 feedback is independent of message
 So feedback can be computed in advance

Ci = Pi XOR Oi
Oi = EK1(Oi-1)
Oi-1 = IV

Advantages and Limitations of OFB
 Encryption and decryption of blocks can be done in parallel

Counter (CTR)
 must have a different key & counter value for every plaintext block (never
reused)
 uses: high-speed network encryptions

Advantages and Limitations of CTR
 efficiency
 can do parallel encryptions in h/w or s/w
 can preprocess in advance of need
 random access to encrypted data blocks
 provable security (good as other modes)
 but must ensure never reuse key/counter values, otherwise could break.

STREAM CIPHERS
 Start with a secret key
 process message bit by bit (as a stream)
 have a pseudo random keystream
 Combine the stream with the plaintext
to produce the ciphertext (typically by
XOR)
 Ci = Mi XOR StreamKeyi
 but must never reuse stream key
 otherwise can recover messages

Stream Cipher Properties
 some design considerations are:
 long period with no repetitions
 statistically random
 depends on large enough key
 properly designed, can be as secure as a block cipher
 simpler & faster

RC4
 A symmetric key encryption algorithm invented by Ron Rivest
 Variable key size, byte-oriented stream cipher
 Normally uses 64 bit and 128 bit key sizes.
 Used in
 SSL/TLS (Secure socket, transport layer security) between web browsers and
servers,
 IEEE 802.11 wirelss LAN std: WEP (Wired Equivalent Privacy), WPA (WiFi
Protocol Access) protocol

RC4 Block Diagram
Plain Text
Secret Key
RC4
+
Encrypted
Text
Keystream
Cryptographically very strong and easy to implement

 Consists of 2 parts:
 Key Scheduling Algorithm (KSA):Generate State
array
 Pseudo-Random Generation Algorithm
(PRGA):Generate keystream, XOR keystream
with the data to generate encrypted stream
KSA
PRGA

The KSA
 Use the secret key to initialize and permutation of state vector S, done in two
steps
 A variable-length key of from 1 to 256 bytes (8 to 2048 bits) is used to initialize a
256-byte state vector S, with elements S[0],S[1], Á ,S[255].
 At all times, S contains a permutation of all 8-bit numbers from 0 through 255.

The PRGA  Generate key stream k , one by one
 XOR S[k] with next byte of message to encrypt/decrypt
i = j = 0;
While (more_byte_to_encrypt)
i = (i + 1) (mod 256);
j = (j + S[i]) (mod 256);
swap(S[i], S[j]);
k = (S[i] + S[j]) (mod 256);
Ci = Mi XOR S[k];
Sum of shuffled pair selects "stream key" value from permutation

Decryption using RC4
 Use the same secret key as during the encryption phase.
 Generate keystream by running the KSA and PRGA.
 XOR keystream with the encrypted text to generate the plain text.
 Logic is simple :
(A xor B) xor B = A
A = Plain Text or Data
B = KeyStream
RC4 Security
 claimed secure against known attacks
 since RC4 is a stream cipher, must never reuse a key

Confidentiality using Symmetric Encryption
 traditionally symmetric encryption is used to provide message confidentiality.
Placement of Encryption
 have two major placement alternatives
 link encryption
 encryption occurs independently on every link
 implies must decrypt traffic between links
 requires many devices, but paired keys
 end-to-end encryption
 encryption occurs between original source and final destination
 need devices at each end with shared keys

Encryption function of the front-end processor (FEP)

 On the host side, the FEP accepts packets. The user data portion of the packet is
encrypted, while the packet header bypasses the encryption process. The resulting
packet is delivered to the network.
 In the opposite direction, for packets arriving from the network, the user data
portion is decrypted and the entire packet is delivered to the host.
 Red data are sensitive or classified data . Black data are encrypted data.

 when using end-to-end encryption must leave headers in clear
 so network can correctly route information
 hence although contents protected, traffic pattern flows are not
 ideally want both at once
 end-to-end encryption protects data contents over entire path and provides
authentication
 link encryption protects traffic flows from monitoring
 can place encryption function at various layers in OSI Reference Model
 link encryption occurs at layers 1 or 2
 end-to-end can occur at layers 3, 4, 6, 7

Traffic Confidentiality
is related to the monitoring of communications flows between parties
 link encryption approach
 network-layer headers (e.g., frame or cell header) are encrypted, reducing the
opportunity for traffic analysis.
 it is still possible for an attacker to assess the amount of traffic on a network and
to observe the amount of traffic entering and leaving each end system.
 traffic padding
 An effective countermeasure to traffic analysis

 Traffic padding produces
cipher text output
continuously, even in the
absence of plaintext.
 A continuous random data
stream is generated. When
plaintext is available, it is
encrypted and transmitted.
 When input plaintext is not
present, random data are
encrypted and transmitted.

Key Distribution
 symmetric schemes require both parties to share a common secret key
 issue is how to securely distribute this key
 system failure due to a break in the key distribution scheme
 given parties A and B have various key distribution alternatives:
1. A can select key and physically deliver to B
2. third party can select & deliver key to A & B
3. if A & B have communicated previously can use previous key to encrypt a
new key
4. if A & B have secure communications with a third party C, C can deliver key
between A & B

Key Hierarchy
 typically have a hierarchy of keys
 session key
 temporary key
 used for encryption of data between users
 for one logical session then discarded
 master key
 used to encrypt session keys
 shared by user & key distribution center

1. A issues a request to the KDC for a session key to protect a logical connection to
B. The message includes the identity of A and B and a unique identifier, N1, for
this transaction.
2. The KDC responds with a message encrypted using Ka Thus, A is the only one
who can successfully read the message. The message includes two items
intended for A,
 A one-time session key(Ks) to be used for the session
 The original request message.
The message includes two items intended for B;
 The one-time session key, Ks to be used for the session
 An identifier of A (e.g., its network address), IDA
These two items are encrypted with Kb (the master key that the KDC shares
with B). They are to be sent to B to establish the connection and prove A's
identity.

3. A stores the session key for use in the upcoming session and forwards to B
the information that originated at the KDC for B, namely, E(Kb, [Ks || IDA]).
4. Using the newly minted session key for encryption, B sends a identifier N2, to A.
5. Also using Ks, A responds with f(N2), where f is a function that performs some
transformation on N2 (e.g., adding one).

Key Distribution Issues
 hierarchies of KDC’s required for large networks, but must trust each other
 session key lifetimes should be limited for greater security
 use of automatic key distribution on behalf of users,
 use of decentralized key distribution
 controlling key usage

Decentralized Key Control
1. A issues a request to B for a session key and includes a identifier N1
2. B responds with a message that is encrypted using the shared master key(MKm).
The response includes the session key selected by B, an identifier of B, the value
f(N1), and another identifier, N2.
3. Using the new session key, A returns f(N2) to B.

Random Numbers
 many uses of random numbers in cryptography
 used in authentication protocols
 session keys
 public key generation
 in all cases its critical that these values be
 statistically random, uniform distribution, independent
 unpredictability of future values from previous values

Pseudo Random Number Generators (PRNGs)
 use algorithmic techniques to create “random numbers”
 although are not truly random
 can pass many tests of “randomness”
Linear Congruential Generator
 common iterative technique using:
Xn+1 = (a Xn + c) mod m
 If m, a, c, and X0 are integers,
Using Block Ciphers as PRNGs
 for cryptographic applications, can use a block cipher to generate random
numbers

Introduction to Number Theory
Prime Numbers
 prime numbers only have divisors of 1 and self
Prime Factorisation
 to factor a number n is to write it as a product of other numbers: n=a x b x c .
 the prime factorisation of a number n is when its written as a product of
primes
 e.g. 91=71x131, 300=22x31x52

Relatively Prime Numbers & GCD
 two numbers a, b are relatively prime if have no common divisors apart from 1
 eg. 8 & 15 are relatively prime since factors of 8 are 1,2,4,8 and of 15 are
1,3,5,15 and 1 is the only common factor
 can determine the greatest common divisor by comparing their prime
factorizations and using least powers
 eg. 300=22x31x52 18=21x32 hence
GCD(18,300)=21x31x50=6

Fermat's Theorem
 If p is prime and a is a positive integer not divisible by p, then
ap-1 ≡ 1 (mod p) also ap ≡ p (mod p)
 useful in public key and primality testing
 Proof : Consider the set of positive integers less than p
: {1, 2, ...., p - 1} and multiply each element by a mod p, to get the set X
X= {a mod p, 2a mod p, ...(p - 1)a mod p}
i.e ap-1(p - 1)! ≡ (p - 1)! (mod p)
We can cancel the ( P-1) ! term because it is relatively prime to P . This yields
ap-1 ≡ 1 (mod p)

Example:
ap-1 ≡ 1 (mod p)
ap ≡ p (mod p)

Euler Totient Function ø(n)
 defined as the number of positive integers less than n and relatively prime to n.
 for example n=10, when doing arithmetic modulo n
 complete set of residues is(0….n-1)= {0,1,2,3,4,5,6,7,8,9}
 reduced set of residues is numbers which are relatively prime to n= {1,3,7,9}
 number of elements in reduced set of residues is called the Euler Totient
Function ø(n)

Euler's Theorem
 states that for every a and n that are relatively prime:
aø(n) ≡ 1 (mod n)
 eg.
a=3;n=10; ø(10)=4;
hence 34 = 81 = 1 mod 10
a=2;n=11; ø(11)=10;
hence 210 = 1024 = 1 mod 11

Primality Testing
 any positive odd integer n ≥ 3 can be expressed as
n - 1 = 2kq with k > 0, q odd
Miller-Rabin Algorithm
 a test based on Fermat’s Theorem
 The procedure TEST takes a candidate integer as input and returns the result
composite if is definitely not a prime, and the result inconclusive if may or may
not be a prime.

Example 1: Prime number n=29
 then (n - 1) = 28 = 22(7) = 2kq.
 First, let us try a=10 .compute 107 mod 29 = 17 , which is neither 1 nor 28 , so
we continue the test.
 The next calculation finds that (107)2 mod 29 = 28, and the test returns
inconclusive (i.e., 29 may be prime).
 Let’s try again with a=2 .We have the following calculations: 27 mod 29 = 12;
214 mod 29 = 28 ; and the test again returns inconclusive.
 If we perform the test for all integers in the range 1 through 28, we get the same
inconclusive result.

Example 2: composite number n = 13 * 17 = 221.
 Then n-1 =220 = = 22(55) = 2kq.
 Let us try a=5. Then we have 555 mod 221 = 112, which is neither 1 nor 220
 (555)2 mod 221 = 168 .the test returns composite, indicating that 221 is definitely
a composite number.
 suppose we had selected a=21 . Then we have 2155 mod 221 = 200;
(2155)2 mod 221 = 220 ; and the test returns inconclusive, indicating that 221
may be prime.
 In fact, of the 218 integers from 2 through 219, four of these will return an
inconclusive result, namely 21, 47, 174, and 200.

Chinese Remainder Theorem
 used to speed up modulo computations
 Theorem: Let m1,…,mn > 0 be relative prime. Then the system of equations
x ≡ ai (mod mi) (for i=1 to n) has a unique solution modulo M = m1·…·mn.

Example: What’s x such that: x ≡ 2 (mod 3) ,x ≡ 3 (mod 5) and x ≡ 2 (mod 7)
 So, a1 = 2, a2=3, a3=2 and m1 = 3 , m2=5, m3=7
 Using the Chinese Remainder theorem:
M = 357 = 105
 M1 = M/3 = 105/3 = 35 and M1
-1 = 2 (35 (mod 3))
 M2 = M/5 = 105/5 = 21 and M2
-1 = 1 (21 (mod 5))
 M3 = M/7 = 105/7=15 and M3
-1 = 1 (15 (mod 7))
 So x ≡ a1 M1 M1
-1 + a2 M2 M2
-1 +…………+ ak Mk Mk
-1 (mod M)
≡ 2 × 2 × 35 + 3 × 1 × 21 + 2 × 1 × 15 = 233 ≡ 23 (mod 105)
So answer: x ≡ 23 (mod 105)

Public Key Cryptography and RSA
Public Key Cryptography
 uses two keys – a public & a private key
 asymmetric
 developed to address two key issues:
 key distribution – how to have secure communications in general without
having to trust a KDC with your key
 digital signatures – how to verify a message comes intact from the claimed
sender

 public-key/two-key/asymmetric cryptography involves the use of two keys:
 a public-key, which may be known by anybody, and can be used to encrypt
messages, and verify signatures
 a private-key, known only to the recipient, used to decrypt messages, and sign
(create) signatures
 is asymmetric because
 those who encrypt messages or verify signatures cannot decrypt messages or
create signatures

1. Each user generates a pair of keys to be used for the encryption and decryption
of messages.
2. Each user places one of the two keys in a public register or other accessible file.
This is the public key. The companion key is kept private. each user maintains a
collection of public keys obtained from others.
3. If Bob wishes to send a confidential message to Alice, Bob encrypts the message
using Alice’s public key.
4. When Alice receives the message, she decrypts it using her private key. No other
recipient can decrypt the message because only Alice knows Alice’s private key.

 encrypting a message, using the sender’s private key. This provides the digital
signature.
 encrypt again, using the receiver’s public key.
 final cipher text can be decrypted only by the intended receiver, who alone has
the matching private key.

Public-Key Characteristics
 Public-Key algorithms rely on two keys where:
 it is computationally infeasible to find decryption key knowing only
algorithm & encryption key
 it is computationally easy to en/decrypt messages when the relevant
(en/decrypt) key is known
 either of the two related keys can be used for encryption, with the other used
for decryption (for some algorithms)

Public-Key Applications
 can classify uses into 3 categories:
 encryption/decryption (provide secrecy)
 digital signatures (provide authentication)
 key exchange (of session keys)
 some algorithms are suitable for all uses, others are specific to one

Security of Public Key Schemes
 brute force exhaustive search attack is always theoretically possible
 but keys used are too large (>512bits)
 requires the use of very large numbers
 hence is slow compared to private key schemes

RSA
 by Rivest, Shamir & Adleman of MIT in 1977
 best known & widely used public-key scheme
 is a block cipher in which the plaintext and cipher text are integers between 0 and
n - 1 for some n.
 uses large integers (e.g. 1024 bits).
 RSA makes use of an expression with exponentials.
 Encryption and decryption are of the following form, for some plaintext block M
and ciphertext block C.
C = Me mod n
M = Cd mod n = (Me ) d mod n = Med mod n

RSA Key Setup
each user generates a public/private key pair by:
 selecting two large primes at random p, q
 computing their system modulus n= p . q
 selecting at random the encryption key e
 where 1<e<ø(n), gcd (e, ø(n))=1
 note ø(n)=(p-1)(q-1)
 solve following equation to find decryption key d
 e.d=1 mod ø(n) and 0≤d≤n
 publish their public encryption key: PU={e,n}
 keep secret private decryption key: PR={d,n}

RSA Use
 to encrypt a message M the sender:
 obtains public key of recipient PU={e,n}
 computes: C = Me mod n, where 0≤M<n
 to decrypt the ciphertext C the owner:
 uses their private key PR={d,n}
 computes: M = Cd mod n

RSA Example - Key Setup
1. Select primes: p=17 & q=11
2. Compute n = pq =17 x 11=187
3. Compute ø(n)=(p–1)(q-1)=16 x 10=160
4. Select e: gcd(e,160)=1; choose e=7
5. Determine d: de=1 mod 160 and d < 160 Value is d=23 since
23x7=161= 10x160+1
6. Publish public key PU={7,187}
7. Keep secret private key PR={23,187}

RSA Example - En/Decryption
 sample RSA encryption/decryption is:
 given message M = 88
 encryption:
C = 887 mod 187 = 11
 decryption:
M = 1123 mod 187 = 88

Exponentiation
 can use the Square and Multiply Algorithm
 a fast, efficient algorithm for exponentiation
 x11 mod n=
x11 = x1+2+8 = (x)(x2)(x8)
=[(x mod n) × (x2 mod n) × (x8 mod n)] mod n
 e.g. 75 = 71 mod 11 × 74 mod 11 = 21 mod 11 = 10 mod 11

Efficient Encryption and Decryption
 encryption and decryption uses exponentiation to power e and power d
 hence if e and d are small, the system will be faster
 but if e and d are too small ,its not safe

RSA Security
 possible approaches to attacking RSA are:
 brute force key search (infeasible given size of numbers)
 mathematical attacks.
 timing attacks (on running of decryption)
 chosen ciphertext attacks

Mathematical attack
 mathematical approach takes 3 forms:
 factor n=p.q, hence compute ø(n) and then d
 determine ø(n) directly and compute d
 find d directly
Timing Attacks
 exploit timing variations in operations
 eg. multiplying by small vs large number
 countermeasures
 use constant exponentiation time
 add random delays
 blind values used in calculations

Chosen Ciphertext Attacks
 RSA is vulnerable to a Chosen Ciphertext Attack (CCA)
 attackers chooses ciphertexts & gets decrypted plaintext back

Computer security module 2

More Related Content

What's hot

Viewers also liked

Similar to Computer security module 2

More from Deepak John

Recently uploaded

Computer security module 2