WINTER SCHOOL ON COMPUTER SECURITY. Prof. Eli Biham
|
|
|
- Bruce Bell
- 10 years ago
- Views:
Transcription
1 WINTR SCHOOL ON COMPUTR SCURITY Prof. li Biham Computer Science Department Technion, Haifa , Israel January 27, 2014 c li Biham c li Biham - January 27,
2 Cryptanalysis of Modes of Operation c li Biham - January 27, Cryptanalysis of Modes of Operation
3 Single Modes: the DS Modes of Operation Modes of Operation are used to hide patterns in the plaintexts, protect against chosen plaintext attacks, and to support fast on-line encryption with precomputation. None of the modes can protect against known plaintext attacks. c li Biham - January 27, Cryptanalysis of Modes of Operation
4 Single Modes: the DS Modes of Operation (cont. The standard modes of DS are: CB CBC CFB OFB Other modes were proposed: PCBC, counter mode, PFF, etc. We will call these modes single modes. c li Biham - January 27, Cryptanalysis of Modes of Operation
5 Multiple Modes of Operation Due to the recent development in the analysis of DS (including the ability to exhaustively search for keys, it was proposed to use multiple (cascaded modes of operation. c li Biham - January 27, Cryptanalysis of Modes of Operation
6 xample: The Triple-CB Mode: Triple-DS P 0 P 1 P 2 P 3 P 4 box 1 box 2 box 3 C 0 C 1 C 2 C 3 C 4 c li Biham - January 27, Cryptanalysis of Modes of Operation
7 xample: The Triple-CBC Mode Claimed to be as secure as triple-ds in (single CBC mode: P 0 P 1 P 2 P 3 P 4 IV 1 box 1 IV 2 box 2 IV 3 box 3 C 0 C 1 C 2 C 3 C 4 c li Biham - January 27, Cryptanalysis of Modes of Operation
8 xample: The CBC CBC 1 CBC Mode Was almost accepted as an ANSI standard: P 0 P 1 P 2 P 3 P 4 IV 1 box 1 IV 2 box 2 IV 3 box 3 C 0 C 1 C 2 C 3 C 4 c li Biham - January 27, Cryptanalysis of Modes of Operation
9 Advantages of Multiple Modes Multiple modes were claimed to have several advantages: 1. More secure than single modes, 2. As fast as single encryption on pipelinable hardware, 3. Attackers cannot know the feedbacks used during encryption, and thus cannot even mount known plaintext attacks! c li Biham - January 27, Cryptanalysis of Modes of Operation
10 ANSI Triple Modes Standardization ANSI X9F1 committee is working on a triple modes standard, already several years, which had to be accepted at the end of It included three kinds of modes: 1. The standard DS modes, with (two or three-key triple DS as the underlying cipher. 2. Interleaved variants of the same modes, to allow efficient hardware implementations. 3. The CBCM mode. c li Biham - January 27, Cryptanalysis of Modes of Operation
11 Multiple Modes Cannot Reduce Strength Let A and B be two modes and let C be the combined double mode C=AB, whose component keys K A and K B are chosen independently. The following theorem shows that C is not weaker than either of its components. theorem: The cracking problem of either A or B is efficiently reducible to the cracking problem of C=AB. conclusion: A multiple mode may not be weaker than its strongest component, if the component keys are chosen independently. c li Biham - January 27, Cryptanalysis of Modes of Operation
12 Multiple Modes Cannot Reduce Strength (cont. A counter-example when the keys are not independent: P 0 P 1 P 2 P 3 P 4 IV 1 Feal Feal Feal Feal Feal IV 2 Feal Feal Feal Feal Feal IV 3 DS DS DS DS DS C 0 C 1 C 2 C 3 C 4 c li Biham - January 27, Cryptanalysis of Modes of Operation
13 Multiple Modes Cannot Reduce Strength (cont. The weakest components in this mode are those using Feal. By methods described later, we can find the key K 1 of the first component using 2 18 chosen ciphertexts, and thus also of the third component using DS. The key of the second component can then be easily found using 1000 chosen ciphertexts (or 2 24 known plaintexts. The third component (which uses DS by itself is much more resistant than the whole system, and cannot be attacked successfully by any known method with complexity smaller than c li Biham - January 27, Cryptanalysis of Modes of Operation
14 Cryptanalysis of Multiple Modes of Operation All the triple (cascaded modes of operation of DS are not much more secure than single modes (as they require up to complexity and plaintexts. The cryptanalytic techniques to attack multiple modes attack one single componentmodeatatime, andcanbebasedonanytechniquetoattacksinglemodes, including differential and linear cryptanalysis, Davies attack, and exhaustive search. The main observation is that the attacker can have some control over the unknown feedbacks, and can thus feed them with the data required to apply cryptanalysis of the single modes. To feed these values, the attacks are usually chosen plaintext or chosen ciphertext. c li Biham - January 27, Cryptanalysis of Modes of Operation
15 Technique A: Differential Cryptanalysis As an example we attack the CB CBC CBC mode: P 0 P 1 P 2 P 3 P 4 box 1 IV 2 box 2 IV 3 box 3 C 0 C 1 C 2 C 3 C 4 c li Biham - January 27, Cryptanalysis of Modes of Operation
16 Technique A: Differential Cryptanalysis (cont. 1. Let Ω T be the ciphertext difference required to attack DS with chosen ciphertexts (the usual attack from the opposite direction. 2. Assume that n pairs are required for an attack of DS using this Ω T. c li Biham - January 27, Cryptanalysis of Modes of Operation
17 Technique A: Differential Cryptanalysis (cont. 3. The attacker chooses n pairs of ciphertext tuples (C 0,C 1,C 2, and (C 0 Ω T,C 1,C 2, with arbitrary C 0,C 1,C The attacker requests to decrypt the 6n blocks by the triple mode under the unknown keys. 5. The ciphertext difference in each pair of tuples is (Ω T,0,0. 6. After decryption of one component the difference is (,Ω T,0. 7. After decryption of two components the difference is (,,Ω T. 8. The plaintexts are known, and in particular P 2 and P 2. c li Biham - January 27, Cryptanalysis of Modes of Operation
18 Technique A: Differential Cryptanalysis (cont. P 0 P 1 P 2 P 3 P 4 P 2 box 1 Ω T IV 2 Ω T 0 box 2 IV 3 box 3 Ω T 0 0 C 0 C 1 C 2 C 3 C 4 Legend: Known differences Known values (underlined c li Biham - January 27, Cryptanalysis of Modes of Operation
19 Technique A: Differential Cryptanalysis (cont. 9. We result with n pairs P 2, P 2, for which K1 (P 2 K1 (P 2 = Ω T This is exactly the data required for differential cryptanalysis! 10. If the underlying cipher is DS, we need 2 47 chosen ciphertext blocks to find the key of the CB component. The other component keys can be recovered by other techniques. c li Biham - January 27, Cryptanalysis of Modes of Operation
20 Technique : Using xhaustive Search This technique uses exhaustive search for the component keys, and can thus be applied for any underlying cipher, independent of its internal operations. All the techniques described later use exhaustive search as a basic tool for more complex analysis, and thus also have this property. c li Biham - January 27, Cryptanalysis of Modes of Operation
21 Technique : Using xhaustive Search (cont. As an example we attack the CBC CBC CB mode: P 0 P 1 P 2 P 3 P 4 IV 1 box 1 IV 2 box 2 box 3 C 0 C 1 C 2 C 3 C 4 c li Biham - January 27, Cryptanalysis of Modes of Operation
22 Technique : Using xhaustive Search (cont. 1. The attacker chooses one pair of tuples (C 0,C 1,C 2, (C 0,C 1,C 2, where C 0 C He requests the plaintexts (P 0,P 1,P 2 and (P 0,P 1,P The value P 2 P 2 is the difference of the CB mode in the first block! c li Biham - January 27, Cryptanalysis of Modes of Operation
23 Technique : Using xhaustive Search (cont. P 0 P 1 P 2 P 3 P 4 IV 1 IV 2 P 2 P 2 P 2 P P 2 P box 1 box 2 box C 0 C 1 C 2 C 3 C 4 Legend: Differences c li Biham - January 27, Cryptanalysis of Modes of Operation
24 Technique : Using xhaustive Search (cont. 4. The attacker exhaustively search all keys for D K3 (C 0 D K3 (C 0 = P 2 P 2 5. The two tuples can be generated with only four chosen ciphertext blocks. c li Biham - January 27, Cryptanalysis of Modes of Operation
25 Technique : Using xhaustive Search (cont. A known plaintext variant: Given about 2 65 random known plaintext tuples, the birthday paradox predicts the existence of a pair (C 0,C 1,C 2 and (C 0,C 1,C 2 with C 1 = C 1 and C 2 = C 2! c li Biham - January 27, Cryptanalysis of Modes of Operation
26 Technique : Using xhaustive Search (cont. Another example: CBC 1 CB CBC P 0 P 1 P 2 P 3 P 4 IV 1 box 1 box 2 IV 3 box 3 C 0 C 1 C 2 C 3 C 4 c li Biham - January 27, Cryptanalysis of Modes of Operation
27 Technique : Using xhaustive Search (cont. xercise: Find all the three keys with 3 chosen plaintexts, or 2 64 known plaintexts. c li Biham - January 27, Cryptanalysis of Modes of Operation
28 Technique F: The Birthday Technique Described on the triple-cbc mode: P 0 P 1 P 2 P 3 P 4 IV 1 box 1 IV 2 box 2 IV 3 box 3 C 0 C 1 C 2 C 3 C 4 c li Biham - January 27, Cryptanalysis of Modes of Operation
29 Technique F: The Birthday Technique (cont. 1. We choose ciphertext tuples of the form (C,C,C,C. c li Biham - January 27, Cryptanalysis of Modes of Operation
30 Technique F: The Birthday Technique (cont. 2. During decryption we get P 0 P 1 P 2 P 3 P 4 Z IV 1 Y Y box 1 IV 2 X X X box 2 IV 3 box 3 C C C C C 0 C 1 C 2 C 3 C 4 Legend: Values c li Biham - January 27, Cryptanalysis of Modes of Operation
31 Technique F: The Birthday Technique (cont. 3. The function X = D K3 (C C behaves like a random function, thus, given 2 33 such tuples, a collision is expected to occur with a high probability. 4. This collision can be identified by comparing the resultant plaintext block Z. A key search can be applied with 2 57 DS encryptions. 5. Note: Collisions can occur in each of the CBC components, thus only a third occur in the last component. This increases the complexity by a factor of at most 3, without increase in the number of chosen ciphertexts. c li Biham - January 27, Cryptanalysis of Modes of Operation
32 Technique G This technique enables to attack modes whose plaintext and ciphertext are mixed with some unknown feedback, or do not affect the encryption box at all. It is later used as a building block by the techniques described afterwards. We describe two variants of this technique on two examples: the triple mode CB CB OFB and on the double mode CBC OFB. c li Biham - January 27, Cryptanalysis of Modes of Operation
33 The CB CB OFB mode: Technique G (cont. P 0 P 1 P 2 P 3 P 4 box 1 box 2 IV 3 box 3 C 0 C 1 C 2 C 3 C 4 c li Biham - January 27, Cryptanalysis of Modes of Operation
34 Technique G (cont. To attack this mode we choose a plaintext consisting of 2 64 equal blocks P. We result with a ciphertext C 0, C 1,..., which equals the output of the OFB component V i XORed with a fixed value. We choose some value u arbitrarily, and guess that it appears in the OFB stream. We encrypt it under all possible keys K, and test whether the difference u K (u is a difference between two consecutive ciphertext blocks. We usually succeed, as the cycle of the OFB mode includes about 2 63 different blocks. Otherwise, we try another value u. c li Biham - January 27, Cryptanalysis of Modes of Operation
35 Technique G (cont. The CBC OFB mode: P 0 P 1 P 2 P 3 P 4 IV 1 IV 2 C 0 C 1 C 2 C 3 C 4 c li Biham - January 27, Cryptanalysis of Modes of Operation
36 Technique G (cont. In this case we attack the CBC component: we choose the ciphertext to consist of 2 64 C followed by 2 64 C. We get p pairs of the form C V i = K1 (P i C V i 1 C V i = K1 (P i C V i 1 where p is the period of the OFB component. Again, we guess a value u arbitrarily, and hope that it is one of the V i s in the cycle (whose period is very easily identified from the plaintexts. WecomputeP i V i 1 andpi V i 1 (fortheunknownibytheaboveequations, and test whether the resultant difference equals P i Pi for some i. As a bonus we also recover the OFB stream. c li Biham - January 27, Cryptanalysis of Modes of Operation
37 Summary Using these and other cryptanalytic techniques, it is possible to cryptanalyze all the = 215 triple-modes of operation. A related-model with known oe chosen IV s (by Wagner may require even fewer amouts of data. c li Biham - January 27, Cryptanalysis of Modes of Operation
38 The nd c li Biham - January 27, The nd
1 Data Encryption Algorithm
Date: Monday, September 23, 2002 Prof.: Dr Jean-Yves Chouinard Design of Secure Computer Systems CSI4138/CEG4394 Notes on the Data Encryption Standard (DES) The Data Encryption Standard (DES) has been
On the Security of Double and 2-key Triple Modes of Operation
On the Security of Double and 2-key Triple Modes of Operation [Published in L. Knudsen, d., Fast Software ncryption, vol. 1636 of Lecture Notes in Computer Science, pp. 215 230, Springer-Verlag, 1999.]
Modes of Operation of Block Ciphers
Chapter 3 Modes of Operation of Block Ciphers A bitblock encryption function f: F n 2 Fn 2 is primarily defined on blocks of fixed length n To encrypt longer (or shorter) bit sequences the sender must
Lecture 4 Data Encryption Standard (DES)
Lecture 4 Data Encryption Standard (DES) 1 Block Ciphers Map n-bit plaintext blocks to n-bit ciphertext blocks (n = block length). For n-bit plaintext and ciphertext blocks and a fixed key, the encryption
Table of Contents. Bibliografische Informationen http://d-nb.info/996514864. digitalisiert durch
1 Introduction to Cryptography and Data Security 1 1.1 Overview of Cryptology (and This Book) 2 1.2 Symmetric Cryptography 4 1.2.1 Basics 4 1.2.2 Simple Symmetric Encryption: The Substitution Cipher...
Lecture Note 8 ATTACKS ON CRYPTOSYSTEMS I. Sourav Mukhopadhyay
Lecture Note 8 ATTACKS ON CRYPTOSYSTEMS I Sourav Mukhopadhyay Cryptography and Network Security - MA61027 Attacks on Cryptosystems Up to this point, we have mainly seen how ciphers are implemented. We
Cryptography and Network Security Block Cipher
Cryptography and Network Security Block Cipher Xiang-Yang Li Modern Private Key Ciphers Stream ciphers The most famous: Vernam cipher Invented by Vernam, ( AT&T, in 1917) Process the message bit by bit
How To Attack A Block Cipher With A Key Key (Dk) And A Key (K) On A 2Dns) On An Ipa (Ipa) On The Ipa 2Ds (Ipb) On Pcode)
Cryptography and Network Security Chapter 6 Fifth Edition by William Stallings Lecture slides by Lawrie Brown (with edits by RHB) Chapter 6 Block Cipher Operation Many savages at the present day regard
lundi 1 octobre 2012 In a set of N elements, by picking at random N elements, we have with high probability a collision two elements are equal
Symmetric Crypto Pierre-Alain Fouque Birthday Paradox In a set of N elements, by picking at random N elements, we have with high probability a collision two elements are equal N=365, about 23 people are
A New 128-bit Key Stream Cipher LEX
A New 128-it Key Stream Cipher LEX Alex Biryukov Katholieke Universiteit Leuven, Dept. ESAT/SCD-COSIC, Kasteelpark Arenerg 10, B 3001 Heverlee, Belgium http://www.esat.kuleuven.ac.e/~airyuko/ Astract.
6.857 Computer and Network Security Fall Term, 1997 Lecture 4 : 16 September 1997 Lecturer: Ron Rivest Scribe: Michelle Goldberg 1 Conditionally Secure Cryptography Conditionally (or computationally) secure
Network Security. Chapter 3 Symmetric Cryptography. Symmetric Encryption. Modes of Encryption. Symmetric Block Ciphers - Modes of Encryption ECB (1)
Chair for Network Architectures and Services Department of Informatics TU München Prof. Carle Network Security Chapter 3 Symmetric Cryptography General Description Modes of ion Data ion Standard (DES)
Network Security. Modes of Operation. Steven M. Bellovin February 3, 2009 1
Modes of Operation Steven M. Bellovin February 3, 2009 1 Using Cryptography As we ve already seen, using cryptography properly is not easy Many pitfalls! Errors in use can lead to very easy attacks You
Message authentication
Message authentication -- Hash based MAC unctions -- MAC unctions based on bloc ciphers -- Authenticated encryption (c) Levente Buttyán ([email protected]) Secret preix method MAC (x) = H( x) insecure!
Error oracle attacks and CBC encryption. Chris Mitchell ISG, RHUL http://www.isg.rhul.ac.uk/~cjm
Error oracle attacks and CBC encryption Chris Mitchell ISG, RHUL http://www.isg.rhul.ac.uk/~cjm Agenda 1. Introduction 2. CBC mode 3. Error oracles 4. Example 1 5. Example 2 6. Example 3 7. Stream ciphers
Overview of Cryptographic Tools for Data Security. Murat Kantarcioglu
UT DALLAS Erik Jonsson School of Engineering & Computer Science Overview of Cryptographic Tools for Data Security Murat Kantarcioglu Pag. 1 Purdue University Cryptographic Primitives We will discuss the
IT Networks & Security CERT Luncheon Series: Cryptography
IT Networks & Security CERT Luncheon Series: Cryptography Presented by Addam Schroll, IT Security & Privacy Analyst 1 Outline History Terms & Definitions Symmetric and Asymmetric Algorithms Hashing PKI
CIS433/533 - Computer and Network Security Cryptography
CIS433/533 - Computer and Network Security Cryptography Professor Kevin Butler Winter 2011 Computer and Information Science A historical moment Mary Queen of Scots is being held by Queen Elizabeth and
A PPENDIX H RITERIA FOR AES E VALUATION C RITERIA FOR
A PPENDIX H RITERIA FOR AES E VALUATION C RITERIA FOR William Stallings Copyright 20010 H.1 THE ORIGINS OF AES...2 H.2 AES EVALUATION...3 Supplement to Cryptography and Network Security, Fifth Edition
The Misuse of RC4 in Microsoft Word and Excel
The Misuse of RC4 in Microsoft Word and Excel Hongjun Wu Institute for Infocomm Research, Singapore [email protected] Abstract. In this report, we point out a serious security flaw in Microsoft
IronKey Data Encryption Methods
IronKey Data Encryption Methods An IronKey Technical Brief November 2007 Information Depth:Technical Introduction IronKey is dedicated to building the world s most secure fl ash drives. Our dedication
Cryptographic hash functions and MACs Solved Exercises for Cryptographic Hash Functions and MACs
Cryptographic hash functions and MACs Solved Exercises for Cryptographic Hash Functions and MACs Enes Pasalic University of Primorska Koper, 2014 Contents 1 Preface 3 2 Problems 4 2 1 Preface This is a
Network Security - ISA 656 Introduction to Cryptography
Network Security - ISA 656 Angelos Stavrou September 18, 2007 Codes vs. K = {0, 1} l P = {0, 1} m C = {0, 1} n, C C E : P K C D : C K P p P, k K : D(E(p, k), k) = p It is infeasible to find F : P C K Let
The Advanced Encryption Standard (AES)
The Advanced Encryption Standard (AES) All of the cryptographic algorithms we have looked at so far have some problem. The earlier ciphers can be broken with ease on modern computation systems. The DES
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Lecture No. # 11 Block Cipher Standards (DES) (Refer Slide
SD12 REPLACES: N19780
ISO/IEC JTC 1/SC 27 N13432 ISO/IEC JTC 1/SC 27 Information technology - Security techniques Secretariat: DIN, Germany SD12 REPLACES: N19780 DOC TYPE: TITLE: Standing document ISO/IEC JTC 1/SC 27 Standing
Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall 2010
CS 494/594 Computer and Network Security Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall 2010 1 Introduction to Cryptography What is cryptography?
GCM-SIV: Full Nonce Misuse-Resistant Authenticated Encryption at Under One Cycle per Byte. Yehuda Lindell Bar-Ilan University
GCM-SIV: Full Nonce Misuse-Resistant Authenticated Encryption at Under One Cycle per Byte Shay Gueron Haifa Univ. and Intel Yehuda Lindell Bar-Ilan University Appeared at ACM CCS 2015 How to Encrypt with
CIS 6930 Emerging Topics in Network Security. Topic 2. Network Security Primitives
CIS 6930 Emerging Topics in Network Security Topic 2. Network Security Primitives 1 Outline Absolute basics Encryption/Decryption; Digital signatures; D-H key exchange; Hash functions; Application of hash
Cryptographic mechanisms
General Secretariat for National Defence Central Directorate for Information Systems Security PRIME MINISTER Paris, 2007 september 14 No. 1904/SGDN/DCSSI/SDS/LCR Cryptographic mechanisms Rules and recommendations
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Karagpur
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Karagpur Lecture No. #06 Cryptanalysis of Classical Ciphers (Refer
Lecture 10: CPA Encryption, MACs, Hash Functions. 2 Recap of last lecture - PRGs for one time pads
CS 7880 Graduate Cryptography October 15, 2015 Lecture 10: CPA Encryption, MACs, Hash Functions Lecturer: Daniel Wichs Scribe: Matthew Dippel 1 Topic Covered Chosen plaintext attack model of security MACs
Message Authentication Codes
2 MAC Message Authentication Codes : and Cryptography Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 28 October 2013 css322y13s2l08, Steve/Courses/2013/s2/css322/lectures/mac.tex,
MAC. SKE in Practice. Lecture 5
MAC. SKE in Practice. Lecture 5 Active Adversary Active Adversary An active adversary can inject messages into the channel Active Adversary An active adversary can inject messages into the channel Eve
Cryptography and Network Security
Cryptography and Network Security Spring 2012 http://users.abo.fi/ipetre/crypto/ Lecture 3: Block ciphers and DES Ion Petre Department of IT, Åbo Akademi University January 17, 2012 1 Data Encryption Standard
Cryptography and Network Security Chapter 3
Cryptography and Network Security Chapter 3 Fifth Edition by William Stallings Lecture slides by Lawrie Brown (with edits by RHB) Chapter 3 Block Ciphers and the Data Encryption Standard All the afternoon
The Order of Encryption and Authentication for Protecting Communications (Or: How Secure is SSL?)
The Order of Encryption and Authentication for Protecting Communications (Or: How Secure is SSL?) Hugo Krawczyk Abstract. We study the question of how to generically compose symmetric encryption and authentication
How To Encrypt With A 64 Bit Block Cipher
The Data Encryption Standard (DES) As mentioned earlier there are two main types of cryptography in use today - symmetric or secret key cryptography and asymmetric or public key cryptography. Symmetric
The Encryption Technology of Automatic Teller Machine Networks
Software Engineering 4C03 Winter 2005 The Encryption Technology of Automatic Teller Machine Networks Researcher: Shun Wong Last revised: April 2nd, 2005 1 Introduction ATM also known as Automatic Teller
Symmetric Crypto MAC. Pierre-Alain Fouque
Symmetric Crypto MAC Pierre-Alain Fouque Birthday Paradox In a set of D elements, by picking at random D elements, we have with high probability a collision two elements are equal D=365, about 23 people
Introduction. Where Is The Threat? Encryption Methods for Protecting Data. BOSaNOVA, Inc. Phone: 866-865-5250 Email: [email protected] Web: www.theq3.
Introduction Within the last ten years, there has been a vast increase in the accumulation and communication of digital computer data in both the private and public sectors. Much of this information has
Dierential Cryptanalysis of DES-like Cryptosystems Eli Biham Adi Shamir The Weizmann Institute of Science Department of Apllied Mathematics July 19, 1990 Abstract The Data Encryption Standard (DES) is
Talk announcement please consider attending!
Talk announcement please consider attending! Where: Maurer School of Law, Room 335 When: Thursday, Feb 5, 12PM 1:30PM Speaker: Rafael Pass, Associate Professor, Cornell University, Topic: Reasoning Cryptographically
Block encryption. CS-4920: Lecture 7 Secret key cryptography. Determining the plaintext ciphertext mapping. CS4920-Lecture 7 4/1/2015
CS-4920: Lecture 7 Secret key cryptography Reading Chapter 3 (pp. 59-75, 92-93) Today s Outcomes Discuss block and key length issues related to secret key cryptography Define several terms related to secret
Password-based encryption in ZIP files
Password-based encryption in ZIP files Dmitri Gabbasov December 15, 2015 Abstract In this report we give an overview of the encryption schemes used in the ZIP file format. We first give an overview of
Network Security: Cryptography CS/SS G513 S.K. Sahay
Network Security: Cryptography CS/SS G513 S.K. Sahay BITS-Pilani, K.K. Birla Goa Campus, Goa S.K. Sahay Network Security: Cryptography 1 Introduction Network security: measure to protect data/information
Digital Signatures. Prof. Zeph Grunschlag
Digital Signatures Prof. Zeph Grunschlag (Public Key) Digital Signatures PROBLEM: Alice would like to prove to Bob, Carla, David,... that has really sent them a claimed message. E GOAL: Alice signs each
Common Pitfalls in Cryptography for Software Developers. OWASP AppSec Israel July 2006. The OWASP Foundation http://www.owasp.org/
Common Pitfalls in Cryptography for Software Developers OWASP AppSec Israel July 2006 Shay Zalalichin, CISSP AppSec Division Manager, Comsec Consulting [email protected] Copyright 2006 - The OWASP
Cryptographic Algorithms and Key Size Issues. Çetin Kaya Koç Oregon State University, Professor http://islab.oregonstate.edu/koc [email protected].
Cryptographic Algorithms and Key Size Issues Çetin Kaya Koç Oregon State University, Professor http://islab.oregonstate.edu/koc [email protected] Overview Cryptanalysis Challenge Encryption: DES AES Message
Message Authentication Codes. Lecture Outline
Message Authentication Codes Murat Kantarcioglu Based on Prof. Ninghui Li s Slides Message Authentication Code Lecture Outline 1 Limitation of Using Hash Functions for Authentication Require an authentic
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Module No. #01 Lecture No. #10 Symmetric Key Ciphers (Refer
CSCE 465 Computer & Network Security
CSCE 465 Computer & Network Security Instructor: Dr. Guofei Gu http://courses.cse.tamu.edu/guofei/csce465/ Secret Key Cryptography (I) 1 Introductory Remarks Roadmap Feistel Cipher DES AES Introduction
Data Encryption WHITE PAPER ON. Prepared by Mohammed Samiuddin. www.itmr.ac.in
01 0110 0001 01101 WHITE PAPER ON Data Encryption Prepared by Mohammed Samiuddin www.itmr.ac.in Contents INTRODUCTION... 2 NEED FOR DATA ENCRYPTION... 3 DUE CARE... 3 REPUTATIONAL RISK... 3 REGULATORY
Cryptanalysis of Grain using Time / Memory / Data Tradeoffs
Cryptanalysis of Grain using Time / Memory / Data Tradeoffs v1.0 / 2008-02-25 T.E. Bjørstad The Selmer Center, Department of Informatics, University of Bergen, Pb. 7800, N-5020 Bergen, Norway. Email :
Developing and Investigation of a New Technique Combining Message Authentication and Encryption
Developing and Investigation of a New Technique Combining Message Authentication and Encryption Eyas El-Qawasmeh and Saleem Masadeh Computer Science Dept. Jordan University for Science and Technology P.O.
Security Evaluation of the SPECTR-128. Block Cipher
pplied Mathematical Sciences, ol. 7,, no. 4, 6945-696 HIKI td, www.m-hikari.com http://dx.doi.org/.988/ams..584 Security Evaluation of the SPECT-8 Block Cipher Manh Tuan Pham, am T. u Posts and Telecommunications
How To Understand And Understand The History Of Cryptography
CSE497b Introduction to Computer and Network Security - Spring 2007 - Professors Jaeger Lecture 5 - Cryptography CSE497b - Spring 2007 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse497b-s07/
Chair for Network Architectures and Services Department of Informatics TU München Prof. Carle. Network Security. Chapter 13
Chair for Network Architectures and Services Department of Informatics TU München Prof. Carle Network Security Chapter 13 Some More Secure Channel Issues Outline In the course we have yet only seen catastrophic
Cryptography Lecture 8. Digital signatures, hash functions
Cryptography Lecture 8 Digital signatures, hash functions A Message Authentication Code is what you get from symmetric cryptography A MAC is used to prevent Eve from creating a new message and inserting
Split Based Encryption in Secure File Transfer
Split Based Encryption in Secure File Transfer Parul Rathor, Rohit Sehgal Assistant Professor, Dept. of CSE, IET, Nagpur University, India Assistant Professor, Dept. of CSE, IET, Alwar, Rajasthan Technical
AES Cipher Modes with EFM32
AES Cipher Modes with EFM32 AN0033 - Application Note Introduction This application note describes how to implement several cryptographic cipher modes with the Advanced ion Standard (AES) on the EFM32
Multiplicative Ciphers. Cryptography of Multiplicative Ciphers
Fall 2006 Chris Christensen MAT/CSC 483 Multiplicative Ciphers It is evident from the relative ease with which the Caesar Cipher or its generalization to an arbitrary number of positions of shift has been
Message Authentication Code
Message Authentication Code Ali El Kaafarani Mathematical Institute Oxford University 1 of 44 Outline 1 CBC-MAC 2 Authenticated Encryption 3 Padding Oracle Attacks 4 Information Theoretic MACs 2 of 44
Serpent: A Proposal for the Advanced Encryption Standard
Serpent: A Proposal for the Advanced Encryption Standard Ross Anderson 1 Eli Biham 2 Lars Knudsen 3 1 Cambridge University, England; email [email protected] 2 Technion, Haifa, Israel; email [email protected]
EXAM questions for the course TTM4135 - Information Security May 2013. Part 1
EXAM questions for the course TTM4135 - Information Security May 2013 Part 1 This part consists of 5 questions all from one common topic. The number of maximal points for every correctly answered question
Chapter 11 Security+ Guide to Network Security Fundamentals, Third Edition Basic Cryptography
Chapter 11 Security+ Guide to Network Security Fundamentals, Third Edition Basic Cryptography What Is Steganography? Steganography Process of hiding the existence of the data within another file Example:
A Comparative Study Of Two Symmetric Encryption Algorithms Across Different Platforms.
A Comparative Study Of Two Symmetric Algorithms Across Different Platforms. Dr. S.A.M Rizvi 1,Dr. Syed Zeeshan Hussain 2 and Neeta Wadhwa 3 Deptt. of Computer Science, Jamia Millia Islamia, New Delhi,
Chapter 8. Network Security
Chapter 8 Network Security Cryptography Introduction to Cryptography Substitution Ciphers Transposition Ciphers One-Time Pads Two Fundamental Cryptographic Principles Need for Security Some people who
Ky Vu DeVry University, Atlanta Georgia College of Arts & Science
Ky Vu DeVry University, Atlanta Georgia College of Arts & Science Table of Contents - Objective - Cryptography: An Overview - Symmetric Key - Asymmetric Key - Transparent Key: A Paradigm Shift - Security
AN3270 Application note
Application note Using the STM8L16x AES hardware accelerator Introduction The purpose of cryptography is to protect sensitive data to avoid it being read by unauthorized persons. There are many algorithms
CS3235 - Computer Security Third topic: Crypto Support Sys
Systems used with cryptography CS3235 - Computer Security Third topic: Crypto Support Systems National University of Singapore School of Computing (Some slides drawn from Lawrie Brown s, with permission)
1 Construction of CCA-secure encryption
CSCI 5440: Cryptography Lecture 5 The Chinese University of Hong Kong 10 October 2012 1 Construction of -secure encryption We now show how the MAC can be applied to obtain a -secure encryption scheme.
Authenticated encryption
Authenticated encryption Dr. Enigma Department of Electrical Engineering & Computer Science University of Central Florida [email protected] October 16th, 2013 Active attacks on CPA-secure encryption
Cryptography and Network Security Chapter 12
Cryptography and Network Security Chapter 12 Fifth Edition by William Stallings Lecture slides by Lawrie Brown (with edits by RHB) Chapter 12 Message Authentication Codes At cats' green on the Sunday he
Techniques of Asymmetric File Encryption. Alvin Li Thomas Jefferson High School For Science and Technology Computer Systems Lab
Techniques of Asymmetric File Encryption Alvin Li Thomas Jefferson High School For Science and Technology Computer Systems Lab Abstract As more and more people are linking to the Internet, threats to the
Secure Network Communications FIPS 140 2 Non Proprietary Security Policy
Secure Network Communications FIPS 140 2 Non Proprietary Security Policy 21 June 2010 Table of Contents Introduction Module Specification Ports and Interfaces Approved Algorithms Test Environment Roles
A Practical Attack on Broadcast RC4
A Practical Attack on Broadcast RC4 Itsik Mantin and Adi Shamir Computer Science Department, The Weizmann Institute, Rehovot 76100, Israel. {itsik,shamir}@wisdom.weizmann.ac.il Abstract. RC4is the most
1.1 Terminology and Assumptions
Attacks on Additive Encryption of Redundant Plaintext and Implications on Internet Security David A. McGrew and Scott R. Fluhrer mcgrew, sfluhrer @cisco.com Cisco Systems, Inc. 170 West Tasman Drive, San
Cryptographic Engine
Cryptographic Engine HIGHLIGHTS This section of the manual contains the following major topics: 1.0 Introduction... 2 2.0 Registers... 4 3.0 Theory of Operation... 12 4.0 Module Operation... 27 5.0 Operation
Massachusetts Institute of Technology Handout 13 6.857: Network and Computer Security October 9, 2003 Professor Ronald L. Rivest.
Massachusetts Institute of Technology Handout 13 6.857: Network and Computer Security October 9, 2003 Professor Ronald L. Rivest Quiz 1 1. This quiz is intended to provide a fair measure of your understanding
SYMMETRIC ENCRYPTION. Mihir Bellare UCSD 1
SYMMETRIC ENCRYPTION Mihir Bellare UCSD 1 Syntax A symmetric encryption scheme SE = (K,E,D) consists of three algorithms: K and E may be randomized, but D must be deterministic. Mihir Bellare UCSD 2 Correct
SPC5-CRYP-LIB. SPC5 Software Cryptography Library. Description. Features. SHA-512 Random engine based on DRBG-AES-128
SPC5 Software Cryptography Library Data brief SHA-512 Random engine based on DRBG-AES-128 RSA signature functions with PKCS#1v1.5 ECC (Elliptic Curve Cryptography): Key generation Scalar multiplication
AES1. Ultra-Compact Advanced Encryption Standard Core. General Description. Base Core Features. Symbol. Applications
General Description The AES core implements Rijndael encoding and decoding in compliance with the NIST Advanced Encryption Standard. Basic core is very small (start at 800 Actel tiles). Enhanced versions
EDA385 Embedded Systems Design. Advanced Course
EDA385 Embedded Systems Design. Advanced Course Encryption for Embedded Systems Supervised by Flavius Gruian Submitted by Ahmed Mohammed Youssef (aso10ayo) Mohammed Shaaban Ibraheem Ali (aso10mib) Orges
Cryptography & Network Security. Introduction. Chester Rebeiro IIT Madras
Cryptography & Network Security Introduction Chester Rebeiro IIT Madras The Connected World 2 Information Storage 3 Increased Security Breaches 81% more in 2015 http://www.pwc.co.uk/assets/pdf/2015-isbs-executive-summary-02.pdf
SAMPLE EXAM QUESTIONS MODULE EE5552 NETWORK SECURITY AND ENCRYPTION ECE, SCHOOL OF ENGINEERING AND DESIGN BRUNEL UNIVERSITY UXBRIDGE MIDDLESEX, UK
SAMPLE EXAM QUESTIONS MODULE EE5552 NETWORK SECURITY AND ENCRYPTION September 2010 (reviewed September 2014) ECE, SCHOOL OF ENGINEERING AND DESIGN BRUNEL UNIVERSITY UXBRIDGE MIDDLESEX, UK NETWORK SECURITY
Outline. CSc 466/566. Computer Security. 8 : Cryptography Digital Signatures. Digital Signatures. Digital Signatures... Christian Collberg
Outline CSc 466/566 Computer Security 8 : Cryptography Digital Signatures Version: 2012/02/27 16:07:05 Department of Computer Science University of Arizona [email protected] Copyright c 2012 Christian
1. a. Define the properties of a one-way hash function. (6 marks)
1. a. Define the properties of a one-way hash function. (6 marks) A hash function h maps arbitrary length value x to fixed length value y such that: Hard to reverse. Given value y not feasible to find
Security Aspects of. Database Outsourcing. Vahid Khodabakhshi Hadi Halvachi. Dec, 2012
Security Aspects of Database Outsourcing Dec, 2012 Vahid Khodabakhshi Hadi Halvachi Security Aspects of Database Outsourcing Security Aspects of Database Outsourcing 2 Outline Introduction to Database
Overview of Symmetric Encryption
CS 361S Overview of Symmetric Encryption Vitaly Shmatikov Reading Assignment Read Kaufman 2.1-4 and 4.2 slide 2 Basic Problem ----- ----- -----? Given: both parties already know the same secret Goal: send
Introduction To Security and Privacy Einführung in die IT-Sicherheit I
Introduction To Security and Privacy Einführung in die IT-Sicherheit I Prof. Dr. rer. nat. Doğan Kesdoğan Institut für Wirtschaftsinformatik [email protected] http://www.uni-siegen.de/fb5/itsec/
Bounds for Balanced and Generalized Feistel Constructions
Bounds for Balanced and Generalized Feistel Constructions Andrey Bogdanov Katholieke Universiteit Leuven, Belgium ECRYPT II SymLab Bounds 2010 Outline Feistel Constructions Efficiency Metrics Bounds for