cryptography primer - iit madras cse dept. · 2019-03-24 · cryptography (its use) • a crucial...
TRANSCRIPT
Cryptography Primer
ChesterRebeiroIITMadras
Cryptography
• Acrucialcomponentinallsecuritysystems• Fundamentalcomponenttoachieve
• Confidentiality
Allowsonlyauthorizedusersaccesstodata
2
Cryptography (its use) • Acrucialcomponentinallsecuritysystems• Fundamentalcomponenttoachieve
• Confidentiality• DataIntegrity
Cryptographycanbeusedtoensurethatonlyauthorizeduserscanmakemodifications(forinstancetoabankaccountnumber)
3
Cryptography (its use) • Acrucialcomponentinallsecuritysystems• Fundamentalcomponenttoachieve
• Confidentiality• DataIntegrity• Authentication
Cryptographyhelpsproveidentities
4
Cryptography (its use) • Acrucialcomponentinallsecuritysystems• Fundamentalcomponenttoachieve
• Confidentiality• DataIntegrity• Authentication• Non-repudiation
Thesenderofamessagecannotclaimthatshedidnotsendit
Ididnotsendthat
5
SchemeforConfidentiality
Alice Bob
messageAttackatDawn!!
untrustedcommunicationlink
MalloryProblem:AlicewantstosendamessagetoBob(andonlytoBob)throughanuntrustedcommunicationlink
6
Encryption
Alice Bob
message“AttackatDawn!!”
untrustedcommunicationlink
MallorySecrets• OnlyAliceknowstheencryptionkeyKE• OnlyBobknowsthedecryptionkeyKD
E D
KE KD
“AttackatDawn!!”encryption decryption
#%AR3Xf34^$(ciphertext)
Onlyseesciphertext.cannotgettheplaintextmessagebecauseshedoesnotknowthekeys7
EncryptionAlgorithms
Alice BobuntrustedcommunicationlinkE D
KE KD
“AttackatDawn!!”encryption decryption
#%AR3Xf34($(ciphertext)
• ShouldbeeasytocomputeforAlice/Bob(whoknowthekey)• ShouldbedifficulttocomputeforMallory(whodoesnotknowthekey)• Whatis‘difficult’?
• Idealcase:ProvethattheprobabilityofMallorydeterminingtheencryption/decryptionkeyisnobetterthanarandomguess
• Computationally:ShowthatitisdifficultforMallorytodeterminethekeysevenifshehasmassivecomputationalpower
8
Ciphers
• SymmetricAlgorithms• EncryptionandDecryptionusethesamekey• i.e.KE=KD• Examples:
• BlockCiphers:DES,AES,PRESENT,etc.• StreamCiphers:A5,Grain,etc.
• AsymmetricAlgorithms• EncryptionandDecryptionkeysaredifferent• KE≠KD• Examples:
• RSA• ECC
9
E D
EncryptionKeys
• Howarekeysmanaged• HowdoesAlice&Bobselectthekeys?• Needalgorithmsforkeyexchange
10
Alice BobuntrustedcommunicationlinkE D
KE KD
“AttackatDawn!!”encryption decryption
#%AR3Xf34($(ciphertext)
AlgorithmicAttacks
• CanMalloryusetrickstobreakthealgorithm
• Therebyreducingthe‘difficulty’ofgettingthekey.
11
E
CiphersDesignChallenges
Wewantcryptoalgorithmstobefastandsmall
Forsecurity,thealgorithmsarecomputationallyintensive.Typicallyuselargenumbers,complexoperations
Needtoprotectagainstsidechannelattacks.
TradeoffsbetweenSecurity,Speed,Side-ChannelAttacks
Block Ciphers ChesterRebeiro
IITMadras
STINSON:chapters3
Block Cipher
14
Alice Bob
message“AttackatDawn!!”
untrustedcommunicationlinkE D
KE KD
“AttackatDawn!!”encryption decryption
#%AR3Xf34^$(ciphertext)
Encryptionkeyisthesameasthedecryptionkey(KE=KD)
Block Cipher : Encryption
BlockCipher(Encryption)
SecretKeyPlaintext Ciphertext
BlockLength
KeyLength
• Ablockcipherencryptionalgorithmencryptsnbitsofplaintextatatime• Mayneedtopadtheplaintextifnecessary• y=ek(x)
15
Block Cipher : Decryption
• Ablockcipherdecryptionalgorithmrecoverstheplaintextfromtheciphertext.• x=dk(y)
BlockCipher(Decryption)
SecretKeyCiphertext Plaintext
BlockLength
KeyLength
16
Inside the Block Cipher (an iterative cipher)
17
KeyWhitening
Round1
Round2
Round3
Roundn
PlaintextBlock
CiphertextBlock
key1
key2
key3
keyn
• Eachroundhasthesameendomorphiccryptosystem,whichtakesakeyandproducesanintermediateouput• Sizeofthekeyishuge…muchlargerthantheblocksize.
Inside the Block Cipher (the key schedule)
18
SecretKey
RoundKey1
RoundKey2
RoundKey3
RoundKeyn
KeyWhitening
Round1
Round2
Round3
Roundn
PlaintextBlock
CiphertextBlock
KeyExpansion
• Asinglesecretkeyoffixedsizeusedtogenerate‘roundkeys’foreachround
Inside the Round Function • AddRoundkey:Mixingoperationbetweentheroundinputandtheroundkey.typically,anex-oroperation
• Confusionlayer:Makestherelationshipbetweenroundinputandoutputcomplex.
• Diffusionlayer:dissipatetheroundinput.Avalancheeffect:Asinglebitchangeintheroundinputshouldcausehugechangesintheoutput.
Makesitdifficultfortheattackertopickoutsomebitsovertheothers(thinkHillcipher)
19
AddRoundKey
ConfusionLayer
DiffusionLayer
RoundInput
RoundOutput
The Advanced Encryption Standard (AES)
20
Advanced Encryption Standard (AES) • NIST’sstandardforblockciphersinceOctober2000.
• SPNnetworkwitheachroundhaving
• RandomnessLayer:Roundkeyaddition• ConfusionLayer:ByteSubstitution• DiffusionLayer:ShiftrowandMixcolumn(thelastrounddoesnothavemixcolumnstep)
KeyLength No.ofrounds
AES-128 16bytes 10
AES-192 24bytes 12
AES-256 32bytes 14
21
The AES State Representation
• 16bytesarrangedina4x4matrixofbytes
mieanjfbokgcplhd
ponmlkjihgfedcba16byteplaintext
MIEANJFBOKGCPLHD
16byteciphertext
AES
22
AES-128 Encryption
SecretKey
XORkey
ByteSubstitution
CiphertextBlock
ShiftRows
MixColumns(exceptforthelastround)
AddRoundKey
Loop
10tim
es
PlaintextBlock
KeyExpansion
RK1RK2RK3
RK10
23
4Operations• ByteSubstitution• ShiftRows• MixColumns• AddRoundKey
AES-128 Encryption
SecretKey
XORkey
ByteSubstitution
CiphertextBlock
ShiftRows
MixColumns(exceptforthelastround)
AddRoundKey
Loop
10tim
es
PlaintextBlock
KeyExpansion
RK1RK2RK3
RK10
24
confusion
diffusion
AES Operations
• AllAESoperationsareperformedinthefieldGF(28).• Thefield’sirreduciblepolynomialisx8+x4+x3+x+1
inbinarynotation(100011011)2inhexnotation(11B)16
25
Byte Substitution
a i mb j nc k od l p
A E I MB F J NC G K OD H L P
F
efgh
f
Sbox
7 7
6 6
5 5
4 4
3 3
2 2
1 1
0 0
1 1 1 1 1 0 0 0 00 1 1 1 1 1 0 0 10 0 1 1 1 1 1 0 10 0 0 1 1 1 1 1 01 0 0 0 1 1 1 1 01 1 0 0 0 1 1 1 01 1 1 0 0 0 1 1 11 1 1 1 0 0 0 1 1
b ab ab ab ab ab ab ab a
⎡ ⎤ ⎡ ⎤⎡ ⎤ ⎡ ⎤⎢ ⎥ ⎢ ⎥⎢ ⎥ ⎢ ⎥⎢ ⎥ ⎢ ⎥⎢ ⎥ ⎢⎢ ⎥ ⎢ ⎥⎢ ⎥ ⎢⎢ ⎥ ⎢ ⎥⎢ ⎥ ⎢⎢ ⎥ ⎢ ⎥⎢ ⎥ ⎢= ⊕⎢ ⎥ ⎢ ⎥⎢ ⎥ ⎢⎢ ⎥ ⎢ ⎥⎢ ⎥ ⎢⎢ ⎥ ⎢ ⎥⎢ ⎥ ⎢⎢ ⎥ ⎢ ⎥⎢ ⎥ ⎢⎢ ⎥ ⎢ ⎥⎢ ⎥ ⎢
⎢ ⎥ ⎢⎢ ⎥ ⎢ ⎥⎣ ⎦ ⎣ ⎦⎣ ⎦ ⎣ ⎦
⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥
• Makesanon-linearsubstitutionforeverybyteinthe4x4matrix
AffineTransformation
⎩⎨⎧
=
≠=
−
0)( if)0(0)( if)(
)(1
θθ
AAffineAAAffine
ASbox
26
AES S-box Design Rationale
• Thiss-boxconstructionwasproposedbyKaiserNybergin1993• Steps:
1. InverseinGF(28)• Provideshighdegreesofnon-linearity• Knowntohavegoodresistanceagainstdifferentialandlinearcryptanalysis
2. Affinetransformation• ensuresnofixedpoints:i.e.Fixedpoints:S(x)=x• ComplicatesAlgebraicattacks
27
⎩⎨⎧
=
≠=
−
0)( if)0(0)( if)(
)(1
θθ
AAffineAAAffine
ASbox
S-box Encryption Table
• Useatabletodothebytesubstitution• eg. 2c Sbox[42]=
28
Shift Rows
• ShiftRows• LeavetheFirstrowuntouched• LeftRotate(2ndRowby8bits)• LeftRotate(3rdRowby16bits)• LeftRotate(4thRowby24bits)
• AlongwithMixColumnsprovideshighdiffusion• Bitsflipinat-least25s-boxesafter4rounds
a e i mb f j nc g k od h l p
a e i mf j n bk o c gp d h l
mnop
abcdefghijkl
mbgl
afkpejodinch
29
Mix Columns The4x4matrixismultipliedwiththematrix
a i mb j nc k od l p
A E I MB F J NC G K OD H L P
e
f
g
h
E
F
G
H
h g f e H h g f e G
h g f e F h g f e E
2332
3232
+++=
+++=
+++=
+++=
⎥⎥⎥⎥
⎦
⎤
⎢⎢⎢⎢
⎣
⎡
×
⎥⎥⎥⎥
⎦
⎤
⎢⎢⎢⎢
⎣
⎡
plhdokgcnjfbmiea
2113321113211132
30
NotethatmultiplicationsareinGF(28)field
Mix Columns Rationale Whyusethismatrix?• ItisanMDSmatrix(MaximumDistanceSeparablecodes)
• Iftheinputofacolumnchangesthenalloutputschange• Thismaximizesthebranchnumber• ForAES,thebranchnumberis5
• Values[2,3,1,1],arethesmallestwhichresultinMDSmatrixthatisalsocirculant
• HasaninverseintheAESfield
⎥⎥⎥⎥
⎦
⎤
⎢⎢⎢⎢
⎣
⎡
2113321113211132
31
AES Operations (Add Round Key)
AdditionhereisadditioninGF(28),whichistheex-oroperation
a e i mb f j nc g k od h l p
k0 k4 k8 k12k1 k5 k9 k13k2 k6 k10 k14
k15k11k7k3
a+k0 e+k4 i+k8 m+k12b+k1 f+k5 j+k9 n+k13c+k2 g+k6 k+k10 o+k14
p+k15l+k11h+k7d+k3
32
AES-128 Decryption
SecretKey
XORRK10
InverseByteSubstitution
InverseShiftRows
AddRoundKey
InverseMixColumns(exceptforthelastround)
Loop
10tim
es
PlaintextBlock
CiphertextBlock
KeyExpansion
RK9RK8
RK1key
33
Inverse S-box
34
• SimplytheAESs-boxruninreverse• Aswiththes-boxoperation,alookuptablecanbeused
Inverse Shift Rows
• ShiftRows• LeavetheFirstrowuntouched• RightRotate(2ndRowby8bits)• RightRotate(3rdRowby16bits)• RightRotate(4thRowby24bits)
a e i mf j n bk o c gp d h l
mbgl
afkpejodinch
mnop
abcdefghijkl
a e i mb f j nc g k od h l p
35
Inverse Mix Column
h g f e H h gfe G h g f e F h g f e E
E9DBDE9DDBE99DBE
+++=
+++=
+++=
+++=
a i mb j nc k od l p
e
f
g
h
A E I MB F J NC G K OD H L P
E
F
G
H
• The4x4matrixismultipliedwiththematrix
• Thehardwareimplementationcanbedoneinasimilarwayasmixcolumns
⎥⎥⎥⎥
⎦
⎤
⎢⎢⎢⎢
⎣
⎡
E9DBBE9DDBE99DBE
36
AES Key Schedule
37
• Howtoexpandthesecretkey• DesignCriteria
o Efficiento Non-symmetric:Ensuredbyroundconstantso Efficientdiffusionpropertiesofsecretkeyintoroundkeyso Itshouldexhibitenoughnon-linearitytoprohibitthefulldeterminationofdifferences
intheexpandedkeyfromcipherkeydifferencesonly.
SecretKey
KeyExpansion
RK1RK2RK3
RK10
AES Key Schedule
38
K0,0
K0,4
K0,8
K0,12
K0,1
K0,5
K0,9
K0,13
K0,2
K0,6
K0,10
K0,14
K0,3
K0,7
K0,11
K0,15
rotword
S-boxoperation
roundconstantxor
K1,0
K1,4
K1,8
K1,12
secretkey
1stroundkey
K1,1
K1,5
K1,9
K1,13
K1,2
K1,6
K1,10
K1,14
K1,3
K1,7
K1,11
K1,15
2i-1000
39
Implementation Aspects of AES
Software Implementations of AES Encryption • S-boximplementedasalookup-table(256bytes)• ShiftrowscombinedwithMixcolumns• MultiplicationwithMDSmatrixeasilyachieved
• x2,donebyleftshift.Ifthereisanoverflowanex-orwith0x1Bisneeded• x3=x2+x
40
AES on 32 bit Systems (A Round of AES)
41
T Tables
42
CombiningOperations(foracolumn)
Define4T-Tables
OneRoundofAESusingT-Tables
OpenSSL Implementation of AES (with T-tables)
43
Last Round of AES
• Usesadifferenttable(Te4)
44
AES NI
• AcceleratingAESonmodernIntelandAMDprocessorswithdedicatedinstructions
45
Compact Implementations of AES
• HowshouldtheS-boxbeimplemented?• Lookuptable(256bytes)
• Thismaybetoolargeforsomedevices• Findingtheinverse(usingItoh-TsujiiortheextendedEuclideanalgorithm)andthenaffinetransformation
• Againexpensive(toobig!!!)• Thirdalternative
• Usecompositefields
46
Composite Fields for AES • TheAESFieldisGF(28)/x8+x4+x3+x+1
• Hasorder256• ManycompositefieldsforAESexists
• GF(24)2• Requirestwoirreduciblepolynomials
Onehastheformx4+....,wherecoefficientsareinGF(2)Thesecondhastheformx2+ax+b,wherea,bareinGF(24)
• GF((22)2)2• Requiresthreeirreduciblepolynomials
Firstoftheformx2+a1x+b1,wherea1,b1inGF(2)Secondhastheformx2+a2x+b2,wherea2,b2inGF(22)Thirdhastheformx2+a3x+b3,wherea3,b3inGF(22)2
47
Mapping between GF(28) and Composite Fields
48https://drive.google.com/file/d/0BwxUBZXYoUKCTEJmNUozMl9xM3M/edit?usp=sharing
}andreturn
']'[']'[
)GF(2fieldtheination(Multiplic''))GF(2fieldtheination(Multiplic''
2551For1';1'
)2(fieldofrootprimitiveaFind)2(fieldofrootprimitiveaFind0]0[and0]0[Initilize
FindMap(){
24
8
24
8
REVMAPMAPREVMAPMAP
toi
GFGF
REVMAPMAP
αββα
βββ
ααα
βαβ
α
=
=
⋅=
⋅=
=
==
==
Implementing the AES S-box in Composite Fields
49
MapInverseinComposite
Fieldeg.InGF((24)2)
ReverseMapx Sbox(x)
AffineTransform
S-box Based on Composite Fields -boxApproach
S-boxApproach No.ofSlices
CriticalPath
GateCount
Lookuptablebased
64 11.9ns 1128
CompositeFieldbased
30 18.3ns 312
PerformanceofS-boxesonFPGA*XOR NAND NOR TotalGatesintermsof
NAND(usingstdcelllib)
80 34 6 180
GateCountforcompositeSbox#
# D. Canright, A Very Compact S-box for AES, CHES-2005 * Simulation Results using Xilinx ISE
Overhead of Composite Field s-boxes
• Compositefields-boxesrequiremappingandreversemappingtoandfromthecompositefieldsineachround
• Analternateapproachistoconvertallotherroundoperationsintocompositefieldoperations.
• Thiswouldrequirejustonemappingandonereversemappingfortheentireencryption
• OperationsAddRoundKeyandShiftRowsarenotaltered.• MixColumnswillneedtobere-implemented
Modes of Operation
52
What are Modes of Operation? • Blockcipheralgorithmsonlyencryptasingleblockofmessage• Amodeofoperationdescribeshowtorepeatedlyapplyacipher'ssingle-blockoperationtosecurelytransformamountsofdatalargerthanablock
• ModesofOperation• Electroniccodebookmode(ECBMode)• Cipherfeedbackmode(CFBMode)• Cipherblockchainingmode(CBCmode)• Outputfeedbackmode(OFBmode)• Countermode
53
ECB Mode
• Everyblockinthemessageisencryptedindependentlywiththesamekey• Drawback1:Ifpi=pj(i≠j)thenci=cj
• Encryptionshouldprotectagainstknownplaintextattacks(sincetheattackercouldguesspartsofthemessage…..Likestereotypebeginnings)
• Drawback2:Aninterceptormayaltertheorderoftheblocksduringtransmission
• Notrecommendedforencryptionofmorethanoneblock
54
eK
p0
c0
eK
p1
c1
eK
p2
c2
eK
p3
c3
eK
p4
c4
CBC Mode
• CipherBlockChaining• Advantage1:Encryptiondependentontheciphertextofapreviousblock,therefore
• ci≠cj(i≠j)evenifpi=pj
• Advantage2:Intrudercannotaltertheorderoftheblocksduringtransmission
• Ifanerrorispresentinonereceivedblock(sayci)• Thenciandci+1willnotbedecryptedcorrectly• Allremainingblockswillbecorrectlydecrypted
55
eK
p0
c0
eK
p1
c1
eK
p2
c2
eK
p3
c3
eK
p4
c4
IV
CBC Mode Decryption
56
eK
p0
c0
eK
p1
c1
eK
p2
c2
eK
p3
c3
eK
p4
c4
IV
dK
c0
p0
dK
c1
p1
dK
c2
p2
dK
c3
p3
dK
c4
p4
IV
CFB (Cipher feedback Mode)
Cantransformablockcipherintoastreamcipher.• i.e.Eachblockencryptedwithadifferentkey
UsesashiftregisterthatisinitializedwithanIV
57
IV
eK
register
messagestream(8bitsatatime) ciphertextstream
(8bitstransmittedatatime)
EncryptionScheme
CFB - Error Propagation
UsesashiftregisterthatisinitializedwithanIVPreviousciphertextblockfedintoshiftregister
58
eK
register
Ciphertextstream(8bitsatatime) Plaintextstream
(8bitsdecryptedatatime)
DecryptionScheme
Output Feedback Mode (OFB) • VerysimilartoCFBbutfeedbacktakenfromoutputofek
• Anerrorinonebyteoftheciphertextsaffectsonlyonedecryption
59
eK
shiftreg
messagestream(8bitsatatime) ciphertextstream
(8bitstransmittedatatime)
EncryptionScheme(Decryptionschemeissimilar)
Counter Mode
• Arandomlyinitializedcounterisincrementedwitheveryencryption• Canbeparallelized
• Ie.Multipleencryptionenginescansimultaneouslyrun
• AswithOFB,anerrorinasingleciphertextblockaffectsonlyonedecryptedplaintext
60
eK
counter
c0
eK
counter+1
c1
eK
counter+2
c2
eK
counter+3
c3
eK
counter+4
c4
p0 p1 p2 p3 p4
Cryptographic Hash Functions
STINSON:chapter4
Issues with Integrity
Alice Bob
Message“AttackatDawn!!”
HowcanBobensurethatAlice’smessagehasnotbeenmodified?Note….Wearenotconcernedwithconfidentialityhere
“AttackatDusk!!”
62
Change‘Dawn’to‘Dusk’
unsecurechannel
Hashes Alice Bob
Message“AttackatDawn!!”
“AttackatDawn!!”
63
“AttackatDawn!!”
“Messagedigest”securechannel
Alicepassesthemessagethroughahashfunction,whichproducesafixedlengthmessagedigest.• ThemessagedigestisrepresentativeofAlice’smessage.• Evenasmallchangeinthemessagewillresultinacompletelynewmessagedigest• Typicallyof160bits,irrespectiveofthemessagesize.
Bobre-computesamessagehashandverifiesthedigestwithAlice’smessagedigest.
y=h(x)h
unsecurechannel h
=
Integrity with Hashes
64
y=h(x)y=h(x’)
Mallorydoesnothaveaccesstothedigesty.Hertask(tomodifyAlice’smessage)ismuchmoredifficult.Ifshemodifiesxtox’,themodificationcanbedetectedunlessh(x)=h(x’)Hashfunctionsarespeciallydesignedtoresistsuchcollisions
Alice Bob
Message“AttackatDawn!!”
“AttackatDawn!!”“AttackatDawn!!”
“Messagedigest”securechannel
y=h(x)h
insecurechannelh
=
Message Authentication Codes (MAC)
Alice Bob
Message“AttackatDawn!!”
65
“AttackatDawn!!”MessageDigest
MACsallowthemessageandthedigesttobesentoveraninsecurechannelHowever,itrequiresAliceandBobtoshareacommonkey
y=hK(x)
hK
unsecurechannel hK
=K
K
Avalanche Effect
Hashfunctionsprovideuniquedigestswithhighprobability.EvenasmallchangeinMwillresultinanewdigest
MessageM
HashFunction
Shortfixedlength
digestalsocalled‘hash’
Hash functions in Security • Digitalsignatures• Randomnumbergeneration• Keyupdatesandderivations• Onewayfunctions• MAC• Detectmalwareincode• Userauthentication(storingpasswords)
67
Hash Family
• Thehashfamilyisa4-tupledefinedby(X,Y,K,H)• Xisasetofmessages(maybeinfinite)• Yisafinitesetofmessagedigests(akaauthenticationtags)• Kisafinitesetofkeys• EachKƐK,definesakeyedhashfunctionhKƐH
68
X Y
hK
Hash Family : some definitions
• ValidpairunderK:(x,y)ƐXxysuchthat,x=hK(y)• Sizeofthehashfamily:isthenumberoffunctionspossiblefromsetXtosetY;
|Y| = Mand|X| = NthenthenumberofmappingspossibleisMN
• Thecollectionofallsuchmappingsaretermed(N,M)-hashmapping.
69
X Y
hK
Unkeyed Hash Function
• Thehashfamilyisa4-tupledefinedby(X,Y,K,H)• Xisasetofmessages(maybeinfinite,weassumetheminimumsizeisatleast2|Y|)
• Yisafinitesetofmessagedigests• Inanunkeyedhashfunction:|K|=1• Wethushaveonlyonemappingfunctioninthefamily
70
X Y
h
Security Aspects of Unkeyed Hash Functions
h=XàYy=h(x)----->noshortcutsincomputing.Theonlyvalidwayifcomputingyistoinvokethehashfunctionhonx• Threeproblemsthatdefinesecurityofahashfunction*PreimageResistance*SecondPreimageResistance*CollisionResistance
71
Hash function Requirement 1 Preimage Resistant
• Alsoknowasone-waynessproblem• IfMalloryhappenstoknowthemessagedigest,sheshouldnotbeabletodeterminethemessage
• Givenahashfunctionh:XàYandanelementyƐY. FindanyxƐX suchthat,h(x)=y
72X Y
h
Hash function Requirement 2 (Second Preimage)
• Malloryhasxandcancomputeh(x),sheshouldnotbeabletofindanothermessagex’whichproducesthesamehash.
• Itwouldbeeasytoforgenewdigitalsignaturesfromoldsignaturesifthehashfunctionusedweren’tsecondpreimageresistant
• Givenahashfunctionh:XàYandanelementxƐX,find,x’ƐX suchthat,h(x)=h(x’)
73X Y
h
Hash Function Requirement (Collision Resistant)
• Malloryshouldnotbeabletofindtwomessagesxandx’whichproducethesamehash
• Givenahashfunctionh:XàYandanelementxƐX, find,x,x’ƐX andx≠x’suchthat,h(x)=h(x’)
74
X Y
h
ThereisnocollisionFreehashFunctionbuthash
functionscanbedesignedsothat
collisionsaredifficulttofind.
Finding Collisions
75
Find_Collisions(h,Q){chooseQdistinctvaluesfromX(sayx1,x2,….,xQ)for(i=1;i<=Q;++i)yi=h(xi)ifthereexists(yj==yk)forj≠kthenreturn(xj,xk)returnFAIL}
∏−
=
⎟⎠
⎞⎜⎝
⎛ −−=1
1
11)(PrQ
i MiisobabilitySuccess εε
Birthday Paradox • Findtheprobabilitythatat-leasttwopeopleinaroomhavethesamebirthday
76
∏
∏−
=
−
=
⎟⎠
⎞⎜⎝
⎛ −−=
⎟⎠
⎞⎜⎝
⎛ −=
⎟⎠
⎞⎜⎝
⎛ −−⎟
⎠
⎞⎜⎝
⎛ −×⎟⎠
⎞⎜⎝
⎛ −×⎟⎠
⎞⎜⎝
⎛ −×=
−=
1
1
1
1
36511]Pr[
3651
36511
36531
36521
365111]'Pr[
]'Pr[1]Pr[:':
Q
i
Q
i
iA
i
QA
AAbirthdaysamethehaveroomtheinpeopletwonoAEvent
birthdaysamethehaveroomtheinpeopletwoatleastAEvent
!!
Birthday Paradox • Ifthereare23peopleinaroom,thentheprobabilitythattwobirthdayscollideis1/2
77
Collisions in Birthdays to Collisions in Hash Functions
78
Find_Collisions(h,Q){chooseQdistinctvaluesfromX(sayx1,x2,….,xQ)for(i=1;i<=Q;++i)yi=h(xi)ifthereexists(yj==yk)forj≠kthenreturn(xj,xk)returnFAIL}
∏−
=
⎟⎠
⎞⎜⎝
⎛ −−=1
1
11)(PrQ
i MiisobabilitySuccess εε |Y|=M
RelationshipbetweenQ,M,andsuccess
MQthenIf
MQ
17.15.011ln2
≈=
−≈
ε
ε
QalwaysproportionaltosquarerootofM.Ɛonlyaffectstheconstantfactor
Birthday Attacks and Message Digests
• Ifthesizeofamessagedigestis40bits• M=240
• Abirthdayattackwouldrequire220queries
• Thustoachieve128bitsecurityagainstcollisionattacks,hashesoflengthat-least256isrequired
79
MQ 17.1≈
Iterated Hash Functions • Sofar,we’velookedathashfunctionswherethemessagewaspickedfromafinitesetX
• Whatifthemessageisofaninfinitesize?• Weuseaniteratedhashfunction
• Thecoreinaniteratedhashfunctionisafunctioncalledcompress• Compress,hashesfromm+tbittombit
80
1}1,0{}1,0{:
≥
→+
tcompress mtm compress
m+tbit
mbit
Iterated Hash Function (given m and t)
81
AppendPad
PadLength
compress
g
inputmessage(x)(maybeofanylength)
m
t
m
• Inputmessageispaddedsothatitslengthisamultipleoft
• Numberofbitsinthepadappended
• Thecompressfunctionisinvokediterativelyforeachtbitblockinthemessage.Forthefirstoperation,an
initializationvectorisused
• Afteralltbitblocksareprocessed,thereisapostprocessingstep,andfinallythehashisobtained.Thisstepisoptional.
h(y)
IV y
concatenate
compress
• Concatenatepreviousmbitoutputwithnexttbitblock(IVusedonlyduringinitialization)
• mustbeat-leastm+t+1inlength
Iterated Hash Function (Principle)
• Anotherperspective
82
Hash Functions in Practice • MD5• NISTspecified“securehashalgorithm”
• SHA0:publishedin1993.160bithash.• Therewereunpublishedweaknessesinthisalgorithm• Thefirstpublishedweaknesswasin1998,whereacollisionattackwasdiscoveredwithcomplexity261
• SHA1:publishedin1995.160bithash.• SHA0replacedwithSHA1whichresolvedseveraloftheweaknesses• SHA1usedinseveralapplicationsuntil2005,whenanalgorithmtofindcollisionswithacomplexityof269was
developed• In2010,SHA1wasnolongersupported.AllapplicationsthatusedSHA1neededtobemigratedtoSHA2
• SHA2:publishedin2001.Supports6functions:224,256,384,512,andtwotruncatedversionsof512bithashes
• NocollisionattacksonSHA2asyet.Thebestattacksofarassumesreducedroundsofthealgorithm(46rounds)
• SHA3:publishedin2015.AlsoknownasKecchak
83
MD5
84
AppendPad
PadLength
inputmessagex
• Appendedwith1andthen0ssothatlengthisamultipleof512–64=448
• Messagelengthappended(in64bits)andsplitintoblocksof512bits
1
Round1
Round2
Round3
Round4
A B C D
• Eachroundhas16similaroperationsofthismodifiedFeistelform
512bits
32bitsx16
eachlimbisof32bits
round1round2round3round4
roundoperations32bit
messageparts
constants
128bithash
Collisions in MD5 (Timeline) • AbirthdayattackonMD5hascomplexityof264
• Smallenoughtobruteforcecollisionsearch• 1996,collisionsontheinnerfunctionsofMD5found• 2004,collisionsdemonstratedpractically• 2007,chosen-prefixcollisionsdemonstrated
• 2008,rogueSSLcertificatesgenerated• 2012,MD5collisionsusedincyberwarfare
• FlamemalwareusesanMD5prefixcollisiontofakeaMicrosoftdigitalcodesignature
85
Given two different prefixes p1, p2 find two appendages m1 and m2 such that hash(p1 || m1) = hash(p2 || m2)
MD5Collisionsdemos:http://www.mscs.dal.ca/~selinger/md5collision/
Collision attack on MD5 like hash functions
• Analyzedifferentialtrails• Abitdifferentfromblockciphers
• Nosecretkeyinvolved• WecanchooseMandNaswewant
• WehaveavalidattackifprobabilityoftrailisP>2-N/2
86
M,N
ΔH=0
Collision attack on MD5 like hash functions
WangandYumadeitpossibletofindtwopairsofblocks(mi,mi+1)and(ni,ni+1)suchthatF(F(s,mi),mi+1)=F(F(s,ni),ni+1)Wheresissomestateofthehashfunction(canbeanything)Themethodmakesitpossibletoconstructtwostringsm0,m1,m2,…..mi,mi+1,…......mk,m0,m1,m2,…..ni,ni+1,…......mk,whichhavethesameMD5hash.
87
M,N
ΔH=0
Example of an MD5 collision
88
Block1
Block2
A Visualization of the Collision
http://www.links.org/?p=6
A Visualization (Difference in just one MSB of the two blocks)
90
SHA1
91
inputmessage(x)(maybeofanylengthlessthan264)
IVeachwordis32bits(512/16=32)
expandto79words
32*5=160bithashoutput
Kacchak and the SHA3
• Usesaspongeconstruction• Achievesvariablelengthhashfunctions
92
securityparameter
bitrate
SuccessofanattackagainstKecchak<N2/2c+1whereNisnumberofcallstof
Message Authentication Codes (Keyed Hash Functions)
93
Alice Bob
Message“AttackatDawn!!”
“AttackatDawn!!”MessageDigest
y=hK(x)hK
unsecurechannel hK
=K
K
ProvidesIntegrityandAuthenticityIntegrity:MessagesarenottamperedAuthenticity:BobcanverifythatthemessagecamefromAlice(Doesnotprovidenon-repudiation)
CBC-MAC
94
eK
m0
eK
m1
eK
m2
eK
m3
hK(m0||m1||…||m4)
IV
Birthday Attack on CBC MAC
95
ByBirthdayparadox,in264steps(assuminga128bitcipher),acollisionwillarise.Let’sassumethatthecollisionoccursinthea-thandb-thstep.
ca = cbEk (ma ⊕ ca−1) = Ek (mb ⊕ cb−1)thusma ⊕ ca−1 =mb ⊕ cb−1ma ⊕mb = ca−1⊕ cb−1
Birthday Attack on CBC MAC
96
ByBirthdayparadox,in264steps(assuminga128bitcipher),acollisionwillarise.Let’sassumethatthecollisionoccursinthea-thandb-thstep.
ca = cbEk (ma ⊕ ca−1) = Ek (mb ⊕ cb−1)thusma ⊕ ca−1 =mb ⊕ cb−1ma ⊕mb = ca−1⊕ cb−1
M1 =m1 ||m2 || ... ||mi || ... ||mn
M2 =m1 ||m2 || ... || (mi ⊕ ca−1⊕ ca−2 ) || ... ||mn
HMAC • FIPSstandardforMAC• Basedonunkeyedhashfunction(SHA-1)
97
HMACk (x) = SHA1((K ⊕ opad) || SHA1(K ⊕ ipad) || x))Ipadandopadarepredefinedconstants