Lecture 13: Message Authentication Codes


 Alfred Chandler
 2 years ago
 Views:
Transcription
1 Lecture 13: Message Authentication Codes Last modified 2015/02/02 In CCA security, the distinguisher can ask the library to decrypt arbitrary ciphertexts of its choosing. Now in addition to the ciphertexts honestly generated by the library using the encryption key, there are maliciously crafted ciphertexts also floating around. Towards achieving CCA security, it would be helpful to provide a mechanism to the decryption algorithm to distinguish honestlygenerated ciphertexts from all other ciphertexts. We re not interested in the problem of privacy (hiding information from an adversary); rather we are interested here in the problem of authenticity. We want a way to enforce that only someone with the secret key could have generated a particular piece of information (in this case a ciphertext). The tool for the job is called a message authentication code, or MAC for short. It consists of two algorithms: KeyGen: samples a secret key for the MAC MAC(k, m): given the secret key k and a plaintext m M, output a MAC (sometimes called a tag ) t. Typically MAC is deterministic. Confusingly, we use the term MAC to sometimes refer to the scheme itself, and sometimes just the tag associated with the message (i.e., the MAC of m ). Think of a MAC as a kind of signature that will be appended to a piece of data. Only someone with the secret key can generate a valid MAC. Our intuitive security requirement is that: an adversary who sees many valid MACs (m, MAC(k, m)) cannot produce a forgery a valid MAC of a different message Security Definition This is a totally new kind of security requirement. It has nothing to do with hiding information. Rather, it is about whether the adversary can actually generate a particular piece of data (e.g., a MAC forgery). To express such a requirement in a security definition, we need some new tricks in our repertoire. We want to talk about the inability of an adversary to generate a particular piece of data. So let s start with a much simpler statement: no adversary should be able to guess a uniformly chosen value. We formalize this idea with the following two libraries: L left : r {0, 1} n GUESS(g): if g = r return 1 else return 0 L right : GUESS(g): return 0 c Copyright 2015 Mike Rosulek. Licensed under Creative Commons BYNCSA 4.0. Latest version at
2 110 LECTURE 13. MESSAGE AUTHENTICATION CODES The left library allows the calling program to attempt to guess a uniformly chosen string. The right library doesn t even bother to verify the calling program s guess it doesn t even bother to sample a random target string! Focus on the difference between these two libraries. Their GUESS subroutines give the same output on nearly all inputs. There is only one input r on which they disagree. If a calling program can manage to find that input r, then it can easily distinguish the libraries. Therefore, if the libraries are indistinguishable, it means that the adversary cannot find/generate one of these special inputs! That s the kind of property we want to express. Indeed, in this case, an adversary who makes q queries to the GUESS subroutine achieves a bias of at most q/2 n. For polynomialtime adversaries, this is a negligible bias. The MAC security definition. Let s follow the pattern from the simple example above. We want to say that no adversary can generate a MAC forgery. So our libraries will provide a mechanism to let the adversary check whether it has a forgery. One library will actually perform the check, and the other library will simply say no. The two libraries are different only in how they behave when the adversary calls a subroutine on a true forgery. So by demanding that the two libraries be indistinguishable, we are actually demanding that no adversary can generate forgeries (except with negligible probability). The formal definition is below: Definition: Let Σ be a MAC scheme, and let L Σ macreal and LΣ macfake be defined as below. Then Σ is a secure MAC if L Σ macreal = L Σ macfake. k Σ.KeyGen k Σ.KeyGen T = L Σ macreal : GETMAC(m Σ.M): return Σ.MAC(k, m) VER(m Σ.M, t): if t = Σ.MAC(k, m): rue else return false L Σ macfake : GETMAC(m Σ.M): t := Σ.MAC(k, m) T := T {(m, t)} VER(m Σ.M, t): if (m, t) T : rue else return false We do allow the adversary to request MACs of chosen messages, hence the GETMAC subroutine. This means that the adversary is always capable of obtaining valid MACs. However, MACs that were generated by GETMAC don t count as forgeries only a MAC of a different message would be a forgery. For this reason, the L macfake library keeps track of which MACs were generated by GETMAC, in the set T. It is clear that these MACs will always be judged valid by VER. But for all other inputs to VER, L macfake simply answers false. TODO: discuss: adversary wins by doing any forgery we don t care whether it s a forgery on some particular (meaningful) message
3 13.2. A PRF IS A MAC A PRF is a MAC The definition of a PRF says (more or less) that even if you ve seen the output of the PRF on several chosen inputs, all other outputs look independently uniformly random. And, as we saw in our earlier example, uniformly random values are hard to guess. Putting these two observations together, and we re awfully close to to the MAC definition. Indeed, a PRF is a secure MAC. There is one subtlety worth pointing out. An adversary might make call VER on (m, t) trying to produce a forgery, and then later call GETMAC(m) (on the same m) to learn the true value of MAC(k, m). This idea is not captured by our simple guesstherandom number libraries from above. To make that example more relevant, we have to extend it as follows: r := undefined L left : r {0, 1} n GUESS(g): if g = r return 1 else return 0 PEEK(): return r L right : GUESS(g): if r undefined: return 0 else: if g = r return 1 else return 0 PEEK() : r {0, 1} n return r Now the libraries allow the calling program to actually see the secret value r via the PEEK subroutine. Intuitively, if you haven t yet PEEK ed, then it should be hard to guess the secret value. The L right library waits until the adversary PEEK s to actually sample r. Before that time, GUESS simply answers no. TODO: expand, give more of a formal proof Claim: The scheme MAC(k, m) = F (k, m) is a secure MAC, when F is a secure pseudorandom function CBCMAC A PRF typically supports only messages of a fixed length, but we will soon see that it s useful to have a MAC that supports longer messages. A classical approach to extend the input size of a MAC involves the CBC block cipher mode applied to a PRF. The result is shown in Figure CBCMAC differs from CBC encryption mode in two important ways: First, there is no initialization vector. Indeed, CBCMAC is deterministic (you can think of it as CBC encryption but with the initialization vector fixed to all zeroes). Second, CBCMAC outputs only the last block. Claim: If F is a secure PRF, then for every fixed l, CBCMAC is a secure MAC for message space M = {0, 1} nl. TODO: The proof of this claim is slightly beyond the scope of these notes. Maybe I will eventually find a way to incorporate it.
4 112 LECTURE 13. MESSAGE AUTHENTICATION CODES m 1 m 2 m l CBCMAC F (k, m 1 m l ): t := 0 n : for i = 1 to l: t := F (k, m i t) F k F k F k t Figure CBCMAC Note that we have restricted the message space to messages of exactly l blocks. Unlike CBC encryption, CBCMAC is not suitable for messages of variable lengths. If the adversary is allowed to request the CBCMAC of messages of different lengths, then it is possible for the adversary to generate a forgery (see the homework) EncryptThenMAC It is possible to achieve CCA security in a modular way, combining any CPAsecure encryption scheme with a secure MAC. One must be careful, though, to combine these two components in the right way! Let E denote an encryption scheme, and M denote a MAC scheme. Then let EtM denote the encryptthenmac construction given below: EtM.KeyGen: return (k e, k m ) EtM.Enc((k e, k m ), m): c E.Enc(k e, m) t := M.MAC(k m, c) EtM.Dec((k e, k m ), (c, t)): if t M.MAC(k m, c): In the Dec algorithm, we are interpreting err as a special symbol that will never be confused with a valid plaintext. Claim: EncryptthenMAC has CCA security if its underlying encryption scheme has CPA security and its underlying MAC scheme is a secure MAC (with message space of the MAC containing the ciphertext space of the encryption scheme). Proof: As usual, we start with an arbitrary adversary A linked to L EtM ccal. In this interaction, the CHALLENGE subroutine will encrypt m L under E.Enc. Our goal is to therefore find a way to apply the CPA security of E to switch m L with m R. What is preventing us from doing just that? The difficulty arises in the fact that E.Dec appears in the code of L ccal. If we were to factor out the Eencryption statements in terms of L E cpal, we would also have to make k local to the LE cpal library. Then there would be no way to carry out the E.Dec that remain in L ccal, since L E cpal provides no way to perform decryptions using the (local) secret key k. However, our use of a MAC provides a path to writing the interaction in terms of L cpal. After applying the security of the MAC, we will obtain an interaction in which the E.Dec statement is unreachable. Hence, it can be safely removed! What remains is an interaction involving only E.KeyGen and E.Enc, which can be written in terms of L cpal. At that point, we can switch E.Enc(k, m L ) with E.Enc(k, m R ) and the rest of the proof follows as a mirror image.
5 13.4. ENCRYPTTHENMAC 113 c E.Enc(k e, m L ) t M.MAC(k m, c) S := S { (c, t) } if (c, t) S if t M.MAC(k m, c): c E.Enc(k e, m L ) t := GETMAC(c) S := S {(c, t)} if (c, t) S if not VER(c, t) : GETMAC(c): return M.MAC(k m, c) VER(c, t): if t = M.MAC(k m, c): rue else return false (a) (b) c E.Enc(k e, m L ) t := GETMAC(c) S := S {(c, t)} if (c, t) S if not VER(c, t): T = GETMAC(c): t := M.MAC(k m, c) T := T {(c, t)} VER(c, t): if (c, t) T : rue else return false c E.Enc(k e, m L ) t := M.MAC(k m, c) S := S {(c, t)} if (c, t) S if (c, t) S : (c) (d) Figure Some steps in the CCAsecurity proof of encryptthenmac.
6 114 LECTURE 13. MESSAGE AUTHENTICATION CODES c := CHALLENGE (m L, m R ) t := M.MAC(k m, c) S := S {(c, t)} if (c, t) S if (c, t) S: CHALLENGE (m L, m R ): c := E.Enc(k e, m L ) return c Figure Some steps in the CCAsecurity proof of encryptthenmac, continued. (e) The formal steps of the proof are described in Figures 13.2 & In diagram (a), the details of the EtM construction have been filled in for A L EtM ccal. Justification for each of the steps is given below: (a) (b) We factor out all of the statements involving the MAC scheme. No effect on the program s output distribution. (b) (c) In (b) we have some program linked with L M macreal. By the MAC security of scheme M we can replace that library with L M macfake to obtain (c). The program s output distribution changes by at most a negligible amount. (c) (d) We inline subroutines, with no effect on the output distribution. We have simplified variables to some extent, since sets S and T are always identical. (d) (e) In program (d) the final statement of the DEC subroutine is unreachable! In other words, the Dec algorithm of the CPAsecure scheme E is never used. Now it is possible to factor out all of the statements involving the CPAsecure encryption scheme E in terms of library L M cpal. No effect on the program s distribution. With program (e) we are stopping just before the halfway point of the proof. It should be clear that we can now replace L cpal with L cpar to begin obtaining encryptions of m R. Then reversing the steps (a) (b) (c) (d) in the normal way, we will eventually arrive at L EtM ccar as desired.
7 13.5. PROBLEMS Problems 1. (B&R) Consider the following MAC scheme, where F is a secure PRF: KeyGen: k {0, 1} n return k MAC(k, m 1 m l ): // each m i is n bits t := 0 n for i = 1 to l: t := t F (k, m i ) Show that the scheme is not a secure MAC. Describe a distinguisher and compute its bias. 2. (B&R) Consider the following MAC scheme, where F is a secure PRF: KeyGen: k {0, 1} n return k MAC(k, m 1 m l ): // each m i is n bits t := 0 n for i = 1 to l: t := t F (k, i m i ) In the above, F (k, i m i ) denotes calling the PRF on an input consisting of the number i encoded in binary, followed by block m i. Assume that F supports inputs of arbitrary length. Show that the scheme is not a secure MAC. Describe a distinguisher and compute its bias. 3. Suppose we expand the message space of CBCMAC to M = ({0, 1} n ). In other words, the adversary can request a MAC on a message consisting of any number of blocks. Show that the result is not a secure MAC. Construct a distinguisher and compute its bias. Hint: Request a MAC on two singleblock messages, then use the result to forge the MAC of a twoblock message. 4. CBCMAC is similar to CBC encryption, except that it outputs the last block only. For this problem, define a new variant of CBC encryption which outputs the XOR of all of the blocks. NEWMAC F (k, m 1 m l ): t := 0 n : for i = 1 to l: t := t F (k, m i t) (a) Is NEWMAC a secure MAC for message space M = ({0, 1} n )? (b) Is NEWMAC a secure MAC for message space M = {0, 1} nl (with fixed l)? 5. Let E be a CPAsecure encryption scheme and M be a secure MAC. Show that the following encryption scheme (encrypt & MAC) is not CCAsecure:
8 116 LECTURE 13. MESSAGE AUTHENTICATION CODES E&M.KeyGen: return (k e, k m ) E&M.Enc((k e, k m ), m): c E.Enc(k e, m) t := M.MAC(k m, m) E&M.Dec((k e, k m ), (c, t)): m := E.Dec(k e, c) if t M.MAC(k m, m): return m Describe a distinguisher and compute its bias.
Lecture 9  Message Authentication Codes
Lecture 9  Message Authentication Codes Boaz Barak March 1, 2010 Reading: BonehShoup chapter 6, Sections 9.1 9.3. Data integrity Until now we ve only been interested in protecting secrecy of data. However,
More informationMessage Authentication Code
Message Authentication Code Ali El Kaafarani Mathematical Institute Oxford University 1 of 44 Outline 1 CBCMAC 2 Authenticated Encryption 3 Padding Oracle Attacks 4 Information Theoretic MACs 2 of 44
More informationAuthentication and Encryption: How to order them? Motivation
Authentication and Encryption: How to order them? Debdeep Muhopadhyay IIT Kharagpur Motivation Wide spread use of internet requires establishment of a secure channel. Typical implementations operate in
More informationAuthenticated encryption
Authenticated encryption Dr. Enigma Department of Electrical Engineering & Computer Science University of Central Florida wocjan@eecs.ucf.edu October 16th, 2013 Active attacks on CPAsecure encryption
More informationLecture 10: CPA Encryption, MACs, Hash Functions. 2 Recap of last lecture  PRGs for one time pads
CS 7880 Graduate Cryptography October 15, 2015 Lecture 10: CPA Encryption, MACs, Hash Functions Lecturer: Daniel Wichs Scribe: Matthew Dippel 1 Topic Covered Chosen plaintext attack model of security MACs
More informationTalk announcement please consider attending!
Talk announcement please consider attending! Where: Maurer School of Law, Room 335 When: Thursday, Feb 5, 12PM 1:30PM Speaker: Rafael Pass, Associate Professor, Cornell University, Topic: Reasoning Cryptographically
More information1 Construction of CCAsecure encryption
CSCI 5440: Cryptography Lecture 5 The Chinese University of Hong Kong 10 October 2012 1 Construction of secure encryption We now show how the MAC can be applied to obtain a secure encryption scheme.
More informationMAC. SKE in Practice. Lecture 5
MAC. SKE in Practice. Lecture 5 Active Adversary Active Adversary An active adversary can inject messages into the channel Active Adversary An active adversary can inject messages into the channel Eve
More informationMACs Message authentication and integrity. Table of contents
MACs Message authentication and integrity Foundations of Cryptography Computer Science Department Wellesley College Table of contents Introduction MACs Constructing Secure MACs Secure communication and
More informationDesigning Hash functions. Reviewing... Message Authentication Codes. and message authentication codes. We have seen how to authenticate messages:
Designing Hash functions and message authentication codes Reviewing... We have seen how to authenticate messages: Using symmetric encryption, in an heuristic fashion Using publickey encryption in interactive
More information1 Message Authentication
Theoretical Foundations of Cryptography Lecture Georgia Tech, Spring 200 Message Authentication Message Authentication Instructor: Chris Peikert Scribe: Daniel Dadush We start with some simple questions
More informationMessage Authentication Codes 133
Message Authentication Codes 133 CLAIM 4.8 Pr[Macforge A,Π (n) = 1 NewBlock] is negligible. We construct a probabilistic polynomialtime adversary A who attacks the fixedlength MAC Π and succeeds in
More informationMESSAGE AUTHENTICATION IN AN IDENTITYBASED ENCRYPTION SCHEME: 1KEYENCRYPTTHENMAC
MESSAGE AUTHENTICATION IN AN IDENTITYBASED ENCRYPTION SCHEME: 1KEYENCRYPTTHENMAC by Brittanney Jaclyn Amento A Thesis Submitted to the Faculty of The Charles E. Schmidt College of Science in Partial
More informationCiphertext verification security of symmetric encryption schemes
www.scichina.com info.scichina.com www.springerlink.com Ciphertext verification security of symmetric encryption schemes HU ZhenYu 1, SUN FuChun 1 & JIANG JianChun 2 1 National Laboratory of Information
More informationSymmetric Crypto MAC. PierreAlain Fouque
Symmetric Crypto MAC PierreAlain Fouque Birthday Paradox In a set of D elements, by picking at random D elements, we have with high probability a collision two elements are equal D=365, about 23 people
More informationProvableSecurity Analysis of Authenticated Encryption in Kerberos
ProvableSecurity Analysis of Authenticated Encryption in Kerberos Alexandra Boldyreva Virendra Kumar Georgia Institute of Technology, School of Computer Science 266 Ferst Drive, Atlanta, GA 303320765
More informationCSC474/574  Information Systems Security: Homework1 Solutions Sketch
CSC474/574  Information Systems Security: Homework1 Solutions Sketch February 20, 2005 1. Consider slide 12 in the handout for topic 2.2. Prove that the decryption process of a oneround Feistel cipher
More informationDeveloping and Investigation of a New Technique Combining Message Authentication and Encryption
Developing and Investigation of a New Technique Combining Message Authentication and Encryption Eyas ElQawasmeh and Saleem Masadeh Computer Science Dept. Jordan University for Science and Technology P.O.
More informationLecture 5  CPA security, Pseudorandom functions
Lecture 5  CPA security, Pseudorandom functions Boaz Barak October 2, 2007 Reading Pages 82 93 and 221 225 of KL (sections 3.5, 3.6.1, 3.6.2 and 6.5). See also Goldreich (Vol I) for proof of PRF construction.
More information1 Domain Extension for MACs
CS 127/CSCI E127: Introduction to Cryptography Prof. Salil Vadhan Fall 2013 Reading. Lecture Notes 17: MAC Domain Extension & Digital Signatures KatzLindell Ÿ4.34.4 (2nd ed) and Ÿ12.012.3 (1st ed).
More informationAuthenticated Encryption: Relations among Notions and Analysis of the Generic Composition Paradigm By Mihir Bellare and Chanathip Namprempre
Authenticated Encryption: Relations among Notions and Analysis of the Generic Composition Paradigm By Mihir Bellare and Chanathip Namprempre Some slides were also taken from Chanathip Namprempre's defense
More informationIdentitybased Encryption with PostChallenge Auxiliary Inputs for Secure Cloud Applications and Sensor Networks
Identitybased Encryption with PostChallenge Auxiliary Inputs for Secure Cloud Applications and Sensor Networks Tsz Hon Yuen  Huawei, Singapore Ye Zhang  Pennsylvania State University, USA Siu Ming
More informationThe Order of Encryption and Authentication for Protecting Communications (Or: How Secure is SSL?)
The Order of Encryption and Authentication for Protecting Communications (Or: How Secure is SSL?) Hugo Krawczyk Abstract. We study the question of how to generically compose symmetric encryption and authentication
More informationLecture 3: OneWay Encryption, RSA Example
ICS 180: Introduction to Cryptography April 13, 2004 Lecturer: Stanislaw Jarecki Lecture 3: OneWay Encryption, RSA Example 1 LECTURE SUMMARY We look at a different security property one might require
More informationCryptographic hash functions and MACs Solved Exercises for Cryptographic Hash Functions and MACs
Cryptographic hash functions and MACs Solved Exercises for Cryptographic Hash Functions and MACs Enes Pasalic University of Primorska Koper, 2014 Contents 1 Preface 3 2 Problems 4 2 1 Preface This is a
More informationChosenCiphertext Security from IdentityBased Encryption
ChosenCiphertext Security from IdentityBased Encryption Dan Boneh Ran Canetti Shai Halevi Jonathan Katz Abstract We propose simple and efficient CCAsecure publickey encryption schemes (i.e., schemes
More informationOverview of Cryptographic Tools for Data Security. Murat Kantarcioglu
UT DALLAS Erik Jonsson School of Engineering & Computer Science Overview of Cryptographic Tools for Data Security Murat Kantarcioglu Pag. 1 Purdue University Cryptographic Primitives We will discuss the
More informationMessage Authentication Codes
2 MAC Message Authentication Codes : and Cryptography Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 28 October 2013 css322y13s2l08, Steve/Courses/2013/s2/css322/lectures/mac.tex,
More informationSYMMETRIC ENCRYPTION. Mihir Bellare UCSD 1
SYMMETRIC ENCRYPTION Mihir Bellare UCSD 1 Syntax A symmetric encryption scheme SE = (K,E,D) consists of three algorithms: K and E may be randomized, but D must be deterministic. Mihir Bellare UCSD 2 Correct
More informationError oracle attacks and CBC encryption. Chris Mitchell ISG, RHUL http://www.isg.rhul.ac.uk/~cjm
Error oracle attacks and CBC encryption Chris Mitchell ISG, RHUL http://www.isg.rhul.ac.uk/~cjm Agenda 1. Introduction 2. CBC mode 3. Error oracles 4. Example 1 5. Example 2 6. Example 3 7. Stream ciphers
More informationCS558. Network Security. Boston University, Computer Science. Midterm Spring 2014.
CS558. Network Security. Boston University, Computer Science. Midterm Spring 2014. Instructor: Sharon Goldberg March 25, 2014. 9:3010:50 AM. Onesided handwritten aid sheet allowed. No cell phone or calculators
More information1 Digital Signatures. 1.1 The RSA Function: The eth Power Map on Z n. Crypto: Primitives and Protocols Lecture 6.
1 Digital Signatures A digital signature is a fundamental cryptographic primitive, technologically equivalent to a handwritten signature. In many applications, digital signatures are used as building blocks
More information1 Signatures vs. MACs
CS 120/ E177: Introduction to Cryptography Salil Vadhan and Alon Rosen Nov. 22, 2006 Lecture Notes 17: Digital Signatures Recommended Reading. KatzLindell 10 1 Signatures vs. MACs Digital signatures
More informationModes of Operation of Block Ciphers
Chapter 3 Modes of Operation of Block Ciphers A bitblock encryption function f: F n 2 Fn 2 is primarily defined on blocks of fixed length n To encrypt longer (or shorter) bit sequences the sender must
More informationCryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Module No. #01 Lecture No. #10 Symmetric Key Ciphers (Refer
More informationLeakageResilient Authentication and Encryption from Symmetric Cryptographic Primitives
LeakageResilient Authentication and Encryption from Symmetric Cryptographic Primitives Olivier Pereira Université catholique de Louvain ICTEAM Crypto Group B1348, Belgium olivier.pereira@uclouvain.be
More informationLecture 15  Digital Signatures
Lecture 15  Digital Signatures Boaz Barak March 29, 2010 Reading KL Book Chapter 12. Review Trapdoor permutations  easy to compute, hard to invert, easy to invert with trapdoor. RSA and Rabin signatures.
More informationMessage Authentication Codes. Lecture Outline
Message Authentication Codes Murat Kantarcioglu Based on Prof. Ninghui Li s Slides Message Authentication Code Lecture Outline 1 Limitation of Using Hash Functions for Authentication Require an authentic
More information2. Compressing data to reduce the amount of transmitted data (e.g., to save money).
Presentation Layer The presentation layer is concerned with preserving the meaning of information sent across a network. The presentation layer may represent (encode) the data in various ways (e.g., data
More informationOverview of Symmetric Encryption
CS 361S Overview of Symmetric Encryption Vitaly Shmatikov Reading Assignment Read Kaufman 2.14 and 4.2 slide 2 Basic Problem   ? Given: both parties already know the same secret Goal: send
More informationGCMSIV: Full Nonce MisuseResistant Authenticated Encryption at Under One Cycle per Byte. Yehuda Lindell BarIlan University
GCMSIV: Full Nonce MisuseResistant Authenticated Encryption at Under One Cycle per Byte Shay Gueron Haifa Univ. and Intel Yehuda Lindell BarIlan University Appeared at ACM CCS 2015 How to Encrypt with
More informationCS 758: Cryptography / Network Security
CS 758: Cryptography / Network Security offered in the Fall Semester, 2003, by Doug Stinson my office: DC 3122 my email address: dstinson@uwaterloo.ca my web page: http://cacr.math.uwaterloo.ca/~dstinson/index.html
More informationSecurity Analysis of DRBG Using HMAC in NIST SP 80090
Security Analysis of DRBG Using MAC in NIST SP 80090 Shoichi irose Graduate School of Engineering, University of Fukui hrs shch@ufukui.ac.jp Abstract. MAC DRBG is a deterministic random bit generator
More informationCryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Karagpur
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Karagpur Lecture No. #06 Cryptanalysis of Classical Ciphers (Refer
More informationAuthenticated Encryption: Relations among notions and analysis of the generic composition paradigm
An extended abstract of this paper appears in Tatsuaki Okamoto, editor, Advances in Cryptology ASIACRYPT 2000, Volume 1976 of Lecture Notes in Computer Science, pages 531 545, Kyoto, Japan, December 3
More informationReconsidering Generic Composition
Reconsidering Generic Composition Chanathip Namprempre Thammasat University, Thailand Phillip Rogaway University of California, Davis, USA Tom Shrimpton Portland State University, USA 1/24 What is the
More informationChair for Network Architectures and Services Department of Informatics TU München Prof. Carle. Network Security. Chapter 13
Chair for Network Architectures and Services Department of Informatics TU München Prof. Carle Network Security Chapter 13 Some More Secure Channel Issues Outline In the course we have yet only seen catastrophic
More informationNetwork Security. Modes of Operation. Steven M. Bellovin February 3, 2009 1
Modes of Operation Steven M. Bellovin February 3, 2009 1 Using Cryptography As we ve already seen, using cryptography properly is not easy Many pitfalls! Errors in use can lead to very easy attacks You
More informationComputational Soundness of Symbolic Security and Implicit Complexity
Computational Soundness of Symbolic Security and Implicit Complexity Bruce Kapron Computer Science Department University of Victoria Victoria, British Columbia NII Shonan Meeting, November 37, 2013 Overview
More information6.857 Computer and Network Security Fall Term, 1997 Lecture 4 : 16 September 1997 Lecturer: Ron Rivest Scribe: Michelle Goldberg 1 Conditionally Secure Cryptography Conditionally (or computationally) secure
More informationSecurity Aspects of. Database Outsourcing. Vahid Khodabakhshi Hadi Halvachi. Dec, 2012
Security Aspects of Database Outsourcing Dec, 2012 Vahid Khodabakhshi Hadi Halvachi Security Aspects of Database Outsourcing Security Aspects of Database Outsourcing 2 Outline Introduction to Database
More informationOn the Security of CTR + CBCMAC
On the Security of CTR + CBCMAC NIST Modes of Operation Additional CCM Documentation Jakob Jonsson * jakob jonsson@yahoo.se Abstract. We analyze the security of the CTR + CBCMAC (CCM) encryption mode.
More informationlundi 1 octobre 2012 In a set of N elements, by picking at random N elements, we have with high probability a collision two elements are equal
Symmetric Crypto PierreAlain Fouque Birthday Paradox In a set of N elements, by picking at random N elements, we have with high probability a collision two elements are equal N=365, about 23 people are
More informationIntroduction to Cryptography CS 355
Introduction to Cryptography CS 355 Lecture 30 Digital Signatures CS 355 Fall 2005 / Lecture 30 1 Announcements Wednesday s lecture cancelled Friday will be guest lecture by Prof. Cristina Nita Rotaru
More informationCryptography and Network Security Department of Computer Science and Engineering Indian Institute of Technology Kharagpur
Cryptography and Network Security Department of Computer Science and Engineering Indian Institute of Technology Kharagpur Module No. # 01 Lecture No. # 05 Classic Cryptosystems (Refer Slide Time: 00:42)
More informationCryptography and Network Security Chapter 12
Cryptography and Network Security Chapter 12 Fifth Edition by William Stallings Lecture slides by Lawrie Brown (with edits by RHB) Chapter 12 Message Authentication Codes At cats' green on the Sunday he
More informationFuzzy IdentityBased Encryption
Fuzzy IdentityBased Encryption Janek Jochheim June 20th 2013 Overview Overview Motivation (Fuzzy) IdentityBased Encryption Formal definition Security Idea Ingredients Construction Security Extensions
More informationChosenCiphertext Security from IdentityBased Encryption
ChosenCiphertext Security from IdentityBased Encryption Dan Boneh Ran Canetti Shai Halevi Jonathan Katz June 13, 2006 Abstract We propose simple and efficient CCAsecure publickey encryption schemes
More informationCryptoVerif Tutorial
CryptoVerif Tutorial Bruno Blanchet INRIA ParisRocquencourt bruno.blanchet@inria.fr November 2014 Bruno Blanchet (INRIA) CryptoVerif Tutorial November 2014 1 / 14 Exercise 1: preliminary definition SUFCMA
More information159.334 Computer Networks. Network Security 1. Professor Richard Harris School of Engineering and Advanced Technology
Network Security 1 Professor Richard Harris School of Engineering and Advanced Technology Presentation Outline Overview of Identification and Authentication The importance of identification and Authentication
More informationDigital Signatures. What are Signature Schemes?
Digital Signatures Debdeep Mukhopadhyay IIT Kharagpur What are Signature Schemes? Provides message integrity in the public key setting Counterparts of the message authentication schemes in the public
More informationFundamentals of Computer Security
Fundamentals of Computer Security Spring 2015 Radu Sion Intro Encryption Hash Functions A Message From Our Sponsors Fundamentals System/Network Security, crypto How do things work Why How to design secure
More informationNetwork Security. Computer Networking Lecture 08. March 19, 2012. HKU SPACE Community College. HKU SPACE CC CN Lecture 08 1/23
Network Security Computer Networking Lecture 08 HKU SPACE Community College March 19, 2012 HKU SPACE CC CN Lecture 08 1/23 Outline Introduction Cryptography Algorithms Secret Key Algorithm Message Digest
More informationChapter 11. Asymmetric Encryption. 11.1 Asymmetric encryption schemes
Chapter 11 Asymmetric Encryption The setting of publickey cryptography is also called the asymmetric setting due to the asymmetry in key information held by the parties. Namely one party has a secret
More informationDigital Signatures. Prof. Zeph Grunschlag
Digital Signatures Prof. Zeph Grunschlag (Public Key) Digital Signatures PROBLEM: Alice would like to prove to Bob, Carla, David,... that has really sent them a claimed message. E GOAL: Alice signs each
More informationRecommendation for Applications Using Approved Hash Algorithms
NIST Special Publication 800107 Recommendation for Applications Using Approved Hash Algorithms Quynh Dang Computer Security Division Information Technology Laboratory C O M P U T E R S E C U R I T Y February
More informationLecture 2: Complexity Theory Review and Interactive Proofs
600.641 Special Topics in Theoretical Cryptography January 23, 2007 Lecture 2: Complexity Theory Review and Interactive Proofs Instructor: Susan Hohenberger Scribe: Karyn Benson 1 Introduction to Cryptography
More informationAdvanced Cryptography
Family Name:... First Name:... Section:... Advanced Cryptography Final Exam July 18 th, 2006 Start at 9:15, End at 12:00 This document consists of 12 pages. Instructions Electronic devices are not allowed.
More informationSymmetric Key cryptosystem
SFWR C03: Computer Networks and Computer Security Mar 811 200 Lecturer: Kartik Krishnan Lectures 222 Symmetric Key cryptosystem Symmetric encryption, also referred to as conventional encryption or single
More informationOutline. Computer Science 418. Digital Signatures: Observations. Digital Signatures: Definition. Definition 1 (Digital signature) Digital Signatures
Outline Computer Science 418 Digital Signatures Mike Jacobson Department of Computer Science University of Calgary Week 12 1 Digital Signatures 2 Signatures via Public Key Cryptosystems 3 Provable 4 Mike
More informationCryptographic Hash Functions Message Authentication Digital Signatures
Cryptographic Hash Functions Message Authentication Digital Signatures Abstract We will discuss Cryptographic hash functions Message authentication codes HMAC and CBCMAC Digital signatures 2 Encryption/Decryption
More informationIntroduction. Digital Signature
Introduction Electronic transactions and activities taken place over Internet need to be protected against all kinds of interference, accidental or malicious. The general task of the information technology
More informationOutline. CSc 466/566. Computer Security. 8 : Cryptography Digital Signatures. Digital Signatures. Digital Signatures... Christian Collberg
Outline CSc 466/566 Computer Security 8 : Cryptography Digital Signatures Version: 2012/02/27 16:07:05 Department of Computer Science University of Arizona collberg@gmail.com Copyright c 2012 Christian
More informationFirst Semester Examinations 2011/12 INTERNET PRINCIPLES
PAPER CODE NO. EXAMINER : Martin Gairing COMP211 DEPARTMENT : Computer Science Tel. No. 0151 795 4264 First Semester Examinations 2011/12 INTERNET PRINCIPLES TIME ALLOWED : Two Hours INSTRUCTIONS TO CANDIDATES
More informationNetwork Security CS 5490/6490 Fall 2015 Lecture Notes 8/26/2015
Network Security CS 5490/6490 Fall 2015 Lecture Notes 8/26/2015 Chapter 2: Introduction to Cryptography What is cryptography? It is a process/art of mangling information in such a way so as to make it
More informationClient Server Registration Protocol
Client Server Registration Protocol The ClientServer protocol involves these following steps: 1. Login 2. Discovery phase User (Alice or Bob) has K s Server (S) has hash[pw A ].The passwords hashes are
More informationCryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Module No. # 01 Lecture No. # 02 Overview on Modern Cryptography
More informationA CLOUD SECURITY APPROACH FOR DATA AT REST USING FPE
A CLOUD SECURITY APPROACH FOR DATA AT REST USING FPE Nilekh Chaudhari 1 1 Cloud Research and Development, Syntel Ltd., Mumbai, India ABSTRACT In a cloud scenario, biggest concern is around security of
More informationCIS 6930 Emerging Topics in Network Security. Topic 2. Network Security Primitives
CIS 6930 Emerging Topics in Network Security Topic 2. Network Security Primitives 1 Outline Absolute basics Encryption/Decryption; Digital signatures; DH key exchange; Hash functions; Application of hash
More informationDigital Signatures. Murat Kantarcioglu. Based on Prof. Li s Slides. Digital Signatures: The Problem
Digital Signatures Murat Kantarcioglu Based on Prof. Li s Slides Digital Signatures: The Problem Consider the reallife example where a person pays by credit card and signs a bill; the seller verifies
More informationCyber Security Workshop Encryption Reference Manual
Cyber Security Workshop Encryption Reference Manual May 2015 Basic Concepts in Encoding and Encryption Binary Encoding Examples Encryption Cipher Examples 1 P a g e Encoding Concepts Binary Encoding Basics
More informationAuthentication requirement Authentication function MAC Hash function Security of
UNIT 3 AUTHENTICATION Authentication requirement Authentication function MAC Hash function Security of hash function and MAC SHA HMAC CMAC Digital signature and authentication protocols DSS Slides Courtesy
More informationKey Privacy for Identity Based Encryption
Key Privacy for Identity Based Encryption Internet Security Research Lab Technical Report 20062 Jason E. Holt Internet Security Research Lab Brigham Young University c 2006 Brigham Young University March
More informationComputer Networks  CS132/EECS148  Spring 2013 
Computer Networks  CS132/EECS148  Spring 2013 Instructor: Karim El Defrawy Assignment 5 Deadline : May 30th 9:30pm (hard and soft copies required) 
More informationCounter Expertise Review on the TNO Security Analysis of the Dutch OVChipkaart. OVChipkaart Security Issues Tutorial for NonExpert Readers
Counter Expertise Review on the TNO Security Analysis of the Dutch OVChipkaart OVChipkaart Security Issues Tutorial for NonExpert Readers The current debate concerning the OVChipkaart security was
More informationPublic Key Encryption that Allows PIR Queries
Public Key Encryption that Allows PIR Queries Dan Boneh Eyal Kushilevitz Rafail Ostrovsky William E Skeith III Appeared at CRYPTO 2007: 5067 Abstract Consider the following problem: Alice wishes to maintain
More informationUniversal Hash Proofs and a Paradigm for Adaptive Chosen Ciphertext Secure PublicKey Encryption
Universal Hash Proofs and a Paradigm for Adaptive Chosen Ciphertext Secure PublicKey Encryption Ronald Cramer Victor Shoup December 12, 2001 Abstract We present several new and fairly practical publickey
More informationNetwork Security Technology Network Management
COMPUTER NETWORKS Network Security Technology Network Management Source Encryption E(K,P) Decryption D(K,C) Destination The author of these slides is Dr. Mark Pullen of George Mason University. Permission
More informationChapter 7. Message Authentication. 7.1 The setting
Chapter 7 Message Authentication In most people s minds, privacy is the goal most strongly associated to cryptography. But message authentication is arguably even more important. Indeed you may or may
More informationChapter 12. Digital signatures. 12.1 Digital signature schemes
Chapter 12 Digital signatures In the public key setting, the primitive used to provide data integrity is a digital signature scheme. In this chapter we look at security notions and constructions for this
More informationPractice Questions. CS161 Computer Security, Fall 2008
Practice Questions CS161 Computer Security, Fall 2008 Name Email address Score % / 100 % Please do not forget to fill up your name, email in the box in the midterm exam you can skip this here. These practice
More informationPrinceton University Computer Science COS 432: Information Security (Fall 2013)
Princeton University Computer Science COS 432: Information Security (Fall 2013) This test has 13 questions worth a total of 50 points. That s a lot of questions. Work through the ones you re comfortable
More informationQUANTUM COMPUTERS AND CRYPTOGRAPHY. Mark Zhandry Stanford University
QUANTUM COMPUTERS AND CRYPTOGRAPHY Mark Zhandry Stanford University Classical Encryption pk m c = E(pk,m) sk m = D(sk,c) m??? Quantum Computing Attack pk m aka Postquantum Crypto c = E(pk,m) sk m = D(sk,c)
More informationAuthentic Digital Signature Based on Quantum Correlation
Authentic Digital Signature Based on Quantum Correlation XiaoJun Wen, Yun Liu School of Electronic Information Engineering, Beijing Jiaotong University, Beijing 00044, China Abstract: An authentic digital
More informationVulnerabilità dei protocolli SSL/TLS
Università degli Studi di Milano Facoltà di Scienze Matematiche, Fisiche e Naturali Dipartimento di Informatica e Comunicazione Vulnerabilità dei protocolli SSL/TLS Andrea Visconti Overview Introduction
More information15251: Great Theoretical Ideas in Computer Science Anupam Gupta Notes on Combinatorial Games (draft!!) January 29, 2012
15251: Great Theoretical Ideas in Computer Science Anupam Gupta Notes on Combinatorial Games (draft!!) January 29, 2012 1 A TakeAway Game Consider the following game: there are 21 chips on the table.
More informationThe Feasibility and Application of using a Zeroknowledge Protocol Authentication Systems
The Feasibility and Application of using a Zeroknowledge Protocol Authentication Systems Becky Cutler Rebecca.cutler@tufts.edu Mentor: Professor Chris Gregg Abstract Modern day authentication systems
More informationCIS433/533  Computer and Network Security Cryptography
CIS433/533  Computer and Network Security Cryptography Professor Kevin Butler Winter 2011 Computer and Information Science A historical moment Mary Queen of Scots is being held by Queen Elizabeth and
More informationCryptography: Authentication, Blind Signatures, and Digital Cash
Cryptography: Authentication, Blind Signatures, and Digital Cash Rebecca Bellovin 1 Introduction One of the most exciting ideas in cryptography in the past few decades, with the widest array of applications,
More information