cos433/math+473:+ cryptography - princeton universitymzhandry/2020-fall-cos433/... · 2020. 11....
TRANSCRIPT
![Page 1: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/1.jpg)
COS433/Math 473: Cryptography
Mark ZhandryPrinceton University
Fall 2020
![Page 2: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/2.jpg)
Announcements/Reminders
HW5 due Nov 10
PR2 due Dec 5
![Page 3: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/3.jpg)
Previously on COS 433…
![Page 4: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/4.jpg)
Digital Signatures(aka public key MACs)
![Page 5: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/5.jpg)
Message Integrity in Public Key Setting
m,σ
skpk
m
m’,σ’
Ver(pk,m’,σ’)
Goal: If Eve changed m, Bob should reject
pk
![Page 6: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/6.jpg)
Digital Signatures
Algorithms:• Gen() à (sk,pk)• Sign(sk,m) à σ• Ver(pk,m,σ) à 0/1
Correctness:Pr[Ver(pk,m,Sign(sk,m))=1: (sk,pk)ßGen()] = 1
![Page 7: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/7.jpg)
Building Digital Signatures
Non-‐trivial to construct with provable security
Most efficient constructions have heuristic security
![Page 8: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/8.jpg)
Signatures from TDPs
GenSig() = Gen()
Sign(sk,m) = F-1(sk, H(m) )
Ver(pk,m,σ): F(pk, σ) == H(m)
Theorem: If (Gen,F,F-1) is a secure TDP, and H is “modeled as a random oracle”, then (GenSig,Sign,Ver) is (strongly) CMA-‐secure
![Page 9: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/9.jpg)
Basic Rabin Signatures
GenSig(): let p,q be random large primessk = (p,q), pk = N = pq
Sign(sk,m): Solve equation σ2 = H(m) mod N using factors p,q• Output σ
Ver(pk,m,σ): σ2 mod N == H(m)
![Page 10: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/10.jpg)
Today
Signatures cont.Identification protocols
![Page 11: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/11.jpg)
Schnorr Signatures
sk = wpk = h:=gw
Sign(sk,m): Ver(h,m,(a,c)):• rßℤp bßH(m,a)• aßgr a×hb == gc?• bßH(m,a)• cßr+wb• Output (a,c)
Theorem: If Dlog is hard and His modeled as a random oracle, then Schnorr signatures are strongly CMA secure
![Page 12: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/12.jpg)
What’s the Smallest Signature?
RSA Hash-‐and-‐Sign: 2 kilobits
ECDSA (variant of Schnorr using “elliptic curves”): around 512 bits
BLS: 256 bits
Are 128-‐bit signatures possible?• No fundamental reason for impossibility, but all (practical) schemes require 256 bits or more
![Page 13: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/13.jpg)
Digital Signatures and the Public Key Infrastructure
skpk
![Page 14: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/14.jpg)
Digital Signatures and the Public Key Infrastructure
skpk
sk’
pk’
![Page 15: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/15.jpg)
Digital Signatures and the Public Key Infrastructure
skpk
sk’
pk’c’=Enc(pk’,m)
m
![Page 16: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/16.jpg)
Digital Signatures and the Public Key Infrastructure
skpk
sk’
pk’c’=Enc(pk’,m)
m
c=Enc(pk,m)
![Page 17: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/17.jpg)
Takeaway
Need some authenticated channel to ensure distribution of public keys
But how to authenticate channel in the first place without being able to distribute public keys?
![Page 18: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/18.jpg)
Solution: Certificate AuthoritiesCA
skCA
BusinessGovernment AgencyDepartment within company
pkCA
![Page 19: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/19.jpg)
Solution: Certificate Authorities
skB
pkB, CertCAàB
CA
skCA
CertCAàB=Sign(skCA,“Bob’s public key is pkB”)
![Page 20: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/20.jpg)
Solution: Certificate Authorities
Bob is typically some website• Obtains Cert by, say, sending someone in person to CA with pkB• Only needs to be done once
If Alice trusts CA, then Alice will be convinced that pkB belongs to Bob
Alice typically gets pkCA bundled in browser
![Page 21: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/21.jpg)
Limitations
Everyone must trust same CA• May have different standards for issuing certs
Single point of failure: if skCA is compromised, whole system is compromised
Single CA must handle all verification
![Page 22: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/22.jpg)
Multiple CAs
There are actually many CA’s, CA1, CA2,…
Bob obtains cert from all of them, sends all the certs with his public key
As long as Alice trusts one of the CA’s, she will be convinced about Bob’s public key
![Page 23: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/23.jpg)
Certificate Chaining
CA issues CertCAàB for Bob
Bob can now use his signing key to issue CertBàD to Donald
Donald can now prove his public key by sending (CertCAàB, CertBàD)• Proves that CA authenticated Bob, and Bob authenticated Donald
![Page 24: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/24.jpg)
Certificate Chaining
For Bob to issue his own certificates, a standard cert should be insufficient• CA knows who Bob is, but does not trust him to issue certs on its behalf
Therefore, Bob should have a stronger cert:
CertCAàB=Sign(skCA,“Bob’s public key is pkB and he can issue certificates on behalf of CA”)
![Page 25: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/25.jpg)
Certificate Chaining
One root CA
Many second level CAs CA1, CA2,…• Each has CertCAàCAi
Advantage: eases burden on root
Disadvantage: now multiple points of failure
![Page 26: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/26.jpg)
Invalidating Certificates
Sometimes, need to invalidate certificates• Private key stolen• User leaves company• Etc
Options:• Expiration• Explicit revocation
![Page 27: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/27.jpg)
Identification Protocols
![Page 28: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/28.jpg)
Identification
✓
![Page 29: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/29.jpg)
Identification
✘
![Page 30: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/30.jpg)
Identification
To identify yourself, you need something the adversary doesn’t have
Typical factors:• What you are: biometrics (fingerprints, iris scans,…)• What you have: Smart cards, SIM cards, etc• What you know: Passwords, PINs, secret keys
Today
![Page 31: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/31.jpg)
Types of Identification Protocols
Secret key:
Public Key:
sk vk
sk vk vk
![Page 32: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/32.jpg)
Types of Attacks
Direct Attack:
✘
vk
![Page 33: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/33.jpg)
Types of Attacks
Eavesdropping/passive:
sk vk
![Page 34: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/34.jpg)
Types of Attacks
Eavesdropping/passive:
sk vk
![Page 35: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/35.jpg)
Types of Attacks
Man-‐in-‐the-‐Middle/Active:
sk vk
![Page 36: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/36.jpg)
Types of Attacks
Man-‐in-‐the-‐Middle/Active:
sk vk
![Page 37: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/37.jpg)
Basic Password Protocol
sk=pwd vk=pwd
sk
sk == vk?
Never ever (ever ever…) use
![Page 38: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/38.jpg)
Problem with Basic Pwd Protocol
vkmust be kept secret at all costs
Issue: pwdA User PwdAlice pwdA
Bob pwdB
Charlie pwdC
… …
![Page 39: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/39.jpg)
Problem with Basic Pwd Protocol
vkmust be kept secret at all costs
Issue: pwdA User PwdAlice pwdA
Bob pwdB
Charlie pwdC
… …
![Page 40: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/40.jpg)
![Page 41: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/41.jpg)
Slightly Better Version
Let H be a hash function
STILL never ever (ever ever…) use
sk=pwd vk=H(pwd)
sk
H(sk) == vk?
![Page 42: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/42.jpg)
Slightly Better Version
Let H be a hash function
STILL never ever (ever ever…) use
pwdA User PwdAlice H(pwdA)Bob H(pwdB)Charlie H(pwdC)… …
![Page 43: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/43.jpg)
Slightly Better Version
Advantage of hashing:• Now if pwd database is leaks, adversary only gets hashes passwords
• For identification protocol, need actual password
• Therefore, adversary needs to invert hash function to break protocol
• Presumed hard
STILL never ever (ever ever…) use
![Page 44: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/44.jpg)
Weak Passwords
17%
50% of available passwords
https://blog.keepersecurity.com/2017/01/13/most-‐common-‐passwords-‐of-‐2016-‐research-‐study/
Data from 10M passwords leaked in 2016:
![Page 45: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/45.jpg)
Weak Passwords
Of course, pwds that have been leaked are likely the particularly common ones
Even so, 360M pwds covers about 25% of all users
![Page 46: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/46.jpg)
Online Dictionary Attacks
Suppose attacker gets list of usernames
Attacker tries logging in to each with pwd = ‘123456’
5-‐17% of accounts will be compromised
![Page 47: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/47.jpg)
Online Dictionary Attacks
How to slow down attacker?• Lock out after several unsuccessful attempts
• Honest users may get locked out too
• Slow down response after each unsuccessful attempt• 1s after 1st, 2s after 2nd, 4s after 3rd, etc
![Page 48: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/48.jpg)
Offline Dictionary Attacks
Suppose attacker gets hashed password vk = H(pwd)
Attack:• Assemble dictionary of 360M common passwords• Hash each, and check if you get vk• If so, you have just found pwd!
On modern hardware, takes a few seconds to recover a a passwords 25% of the time
![Page 49: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/49.jpg)
Offline Dictionary Attacks
Now consider what happens when adversary gets entire hashed password database• Hash dictionary once: O(|D|)• Index dictionary by hashes• Lookup each database entry in dictionary: O(|L|)
To get 25% of passwords takes O(|D|+|L|) time• Amortize cost of hashing dictionary over many passwords
![Page 50: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/50.jpg)
Salting
Let H be a hash function
pwdA User Salt PwdAlice sA H(sA,pwdA)Bob sB H(sB,pwdB)Charlie sC H(sC,pwdC)… … …
si random
![Page 51: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/51.jpg)
Salting
Salt length? Enough to make each user’s salt unique• At least 64 bits
Salting kills amortization:• To recover Alice’s key, adversary must hash entire dictionary with sA• To recover Bob’s key, adversary must hash entire dictionary with sB• Must hash entire dictionary again for each user
Running time: O(|D|×|L|)
![Page 52: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/52.jpg)
Unique Passwords
Different websites may employ different standards for password security• Some may store passwords in clear, some may hash without salt, some may salt
If you use the same password at a bank (high security) and your high school reunion (low security), could end up with your password stolen
![Page 53: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/53.jpg)
Unique Passwords
Solutions:• Password managers
• Salt master password to generate website-‐specific password (e.g. pwdhash):
Master password: pwdPwd for abcdefg.com: H(abcdefg.com,pwd)
![Page 54: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/54.jpg)
What Hash Function to Use
In LindedIn leak (using Sha1), 90% of passwords were recovered within a week
Problem: Sha1 is very fast!
To make hashing harder, want hash function that is just slow enough to be unnoticeable to user
![Page 55: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/55.jpg)
What Hash Function to Use
Examples: PBKDF2, bcrypt• Iterate hash function many times:
H’(x) = H(H(H(….H(x)….)))• Set #iterations to get desired hashing time
Still problem:• Adversary may have special purpose hardware
⇒ Can eval much faster than you can (50,000x)
![Page 56: COS433/Math+473:+ Cryptography - Princeton Universitymzhandry/2020-Fall-COS433/... · 2020. 11. 8. · COS433/Math+473:+ Cryptography Mark%Zhandry Princeton%University Fall%2020](https://reader036.vdocuments.mx/reader036/viewer/2022071601/613d39ae984e1626b65773f9/html5/thumbnails/56.jpg)
What Hash Function to Use
Memory-‐hard functions: functions that require a lot of memory to compute
• As far as we know, no special purpose memory
• Attacker doesn’t gain advantage using special purpose hardware
Examples: Scrypt, Argon2i