Introduction to SHA-3 and Keccak
|
|
|
- Eugene Horton
- 10 years ago
- Views:
Transcription
1 Introduction to SHA-3 and Keccak Joan Daemen STMicroelectronics and Radboud University Crypto summer school 2015 Šibenik, Croatia, May 31 - June 5, / 45
2 Outline 1 The SHA-3 competition 2 The sponge construction 3 Inside Keccak 4 The SHA-3 FIPS 2 / 45
3 The SHA-3 competition Outline 1 The SHA-3 competition 2 The sponge construction 3 Inside Keccak 4 The SHA-3 FIPS 3 / 45
4 The SHA-3 competition Cryptographic hash functions Function h from Z 2 to Z n 2 Typical values for n: 128, 160, 256, 512 Pre-image resistant: it shall take 2 n effort to given y, find x such that h(x) = y 2nd pre-image resistance: it shall take 2 n effort to given M and h(m), find another M with h(m ) = h(m) Collision resistance: it shall take 2 n/2 effort to find x 1 = x 2 such that h(x 1 ) = h(x 2 ) More general: should behave like a random oracle 4 / 45
5 The SHA-3 competition The origins of the SHA-3 competition : NIST thinks about having a SHA-3 contest MD5 and standard SHA-1 were damaged by attacks SHA-2 based on the same principles than MD5 and SHA-1 open call for SHA-2 successor and for analysis, comparisons, etc. October 2008: Deadline for proposals more efficient than SHA-2 output lengths: 224, 256, 384, 512 bits security: collision and (2nd) pre-image resistant specs, reference and optimized code, test vectors design rationale and preliminary analysis patent waiver 5 / 45
6 The SHA-3 competition The SHA-3 competition First round: October 2008 to summer submissions, 51 accepted 37 presented at 1st SHA-3 candidate conf. in Leuven, February 2009 many broken by cryptanalysis NIST narrowed down to 14 semi-finalists Second round: summer 2009 to autumn 2010 analysis presented at 2nd SHA-3 conf. in Santa Barbara, August 2010 NIST narrowed down to 5 finalists Third round: autumn 2010 to October 2012 analysis presented at 3rd SHA-3 conf. in Washington, March 2012 October 2, 2012: NIST announces Keccak as SHA-3 winner 6 / 45
7 The SHA-3 competition NIST SHA-3: the battlefield EDON-R BMW Sgàil ZK-Crypt LANE Keccak Grøstl Maraca NKS2D MD6 Waterfall Hamsi MeshHash ECOH Abacus WaMM Ponic Skein CubeHash Spectral Hash DCH SWIFFTX ESSENCE Fugue SANDstorm Blender HASH 2X BOOLE StreamHash EnRUPT Twister Shabal LUX SHAMATA CRUNCH Cheetah ECHO Sarmal SIMD FSB NaSHA SHAvite-3 BLAKE Tangle Vortex MCSSHA3 DynamicSHA 2 ARIRANG DynamicSHA AURORA Luffa Lesamnta Khichidi-1 JH TIB3 16/06/2009 CHI [courtesy of Christophe De Cannière] 7 / 45
8 The sponge construction Outline 1 The SHA-3 competition 2 The sponge construction 3 Inside Keccak 4 The SHA-3 FIPS 8 / 45
9 The sponge construction Sponge origin: RadioGatún Initiative to design hash/stream function (late 2005) rumours about NIST call for hash functions starting point: fixing Panama [Daemen, Clapp, FSE 1998] with long-time colleagues Gilles Van Assche and Michaël Peeters and ST Italy colleague Guido Bertoni joining in RadioGatún [Keccak team, NIST 2nd hash workshop 2006] more conservative than Panama arbitrary output length expressing security claim for arbitrary output length function Sponge functions [Keccak team, Ecrypt hash, 2007] random sponge instead of random oracle as security goal sponge construction calling random permutation closest thing to a random oracle with a finite state 9 / 45
![2nd hash workshop 2006] more conservative than Panama arbitrary output length expressing security claim for arbitrary output length function Sponge functions [Keccak team,](/docs-images/43/8726548/images/page_9.jpg "Ecrypt hash, 2007] random sponge instead of random oracle as security goal sponge construction calling random permutation closest thing to a random oracle with a finite state")
10 The sponge construction The sponge construction Generalizes hash function: extendable output function (XOF) Calls a b-bit permutation f, with b = r + c r bits of rate c bits of capacity (security parameter) 10 / 45
11 The sponge construction Generic security: indistinguishability Success probability of distinguishing between: ideal function: a monolithic random oracle RO construction S[F] calling an random permutation F Adversary D sends queries (M, l) according to algorithm Express Pr(success D) as a function of total cost of queries N Problem: in real world, F is available to adversary 11 / 45
12 The sponge construction Generic security: indifferentiability [Maurer et al. (2004)] Applied to hash functions in [Coron et al. (2005)] distinguishing mode-of-use from ideal function (RO) covers adversary with access to permutation F at left additional interface, covered by a simulator at right Methodology: build P that makes left/right distinguishing difficult prove bound for advantage given this simulator P P may query RO for acting S-consistently: P[RO] 12 / 45
![(2005)] distinguishing mode-of-use from ideal function (RO) covers adversary with access to permutation F at left](/docs-images/43/8726548/images/page_12.jpg "additional interface, covered by a simulator at right Methodology: build P that makes left/right distinguishing")
13 The sponge construction Generic security of the sponge construction Concept of advantage: Pr(success D) = Adv(D) Theorem (Bound on the RO-differentiating advantage of sponge) A N2 2 c+1 A: differentiating advantage of random sponge from random oracle N: total data complexity c: capacity [Keccak team, Eurocrypt 2008] 13 / 45
14 The sponge construction Implications of the bound Let D: n-bit output pre-image attack. Success probability: for random oracle: P pre (D RO) = q2 n for random sponge: P pre (D S[F]) =? A distinguisher D with A = P pre (D S[F]) P pre (D RO) do pre-image attack if success, conclude random sponge and RO otherwise But we have a proven bound A N2 2 c+1, so P pre (D S[F]) P pre (D RO) + N2 2 c+1 Can be generalized to any attack Note that A is independent of output length n 14 / 45
![A distinguisher D with A = P pre (D S[F]) P pre (D RO) do pre-image attack if success, conclude random sponge and RO](/docs-images/43/8726548/images/page_14.jpg "otherwise But we have a proven bound A N2 2 c+1, so P pre (D S[F]) P pre (D RO) + N2 2 c+1 Can be generalized to any")
15 The sponge construction Implications of the bound (cont d) Informally, random sponge is like random oracle for N < 2 c/2 Security strength for output length n: collision-resistance: min(c/2, n/2) first pre-image resistance: min(c/2, n) second pre-image resistance: min(c/2, n) Proof assumes f is a random permutation provably secure against generic attacks but not against attacks that exploit specific properties of f No security against multi-stage adversaries 15 / 45
16 The sponge construction Design approach Hermetic sponge strategy Instantiate a sponge function Claim a security level of 2 c/2 Our mission Design permutation f without exploitable properties 16 / 45
17 The sponge construction How to build a strong permutation Like a block cipher Sequence of identical rounds Round consists of sequence of simple step mappings but not quite No key schedule Round constants instead of round keys Inverse permutation need not be efficient 17 / 45
18 Inside Keccak Outline 1 The SHA-3 competition 2 The sponge construction 3 Inside Keccak 4 The SHA-3 FIPS 18 / 45
19 Inside Keccak Keccak[r, c] Sponge function using the permutation Keccak-f 7 permutations: b {25, 50, 100, 200, 400, 800, 1600} from toy over lightweight to high-speed SHA-3 instance: r = 1088 and c = 512 permutation width: 1600 security strength 256: post-quantum sufficient Lightweight instance: r = 40 and c = 160 permutation width: 200 security strength 80: same as (initially expected from) SHA-1 See [The Keccak reference] for more details 19 / 45
20 Inside Keccak Keccak[r, c] Sponge function using the permutation Keccak-f 7 permutations: b {25, 50, 100, 200, 400, 800, 1600} from toy over lightweight to high-speed SHA-3 instance: r = 1088 and c = 512 permutation width: 1600 security strength 256: post-quantum sufficient Lightweight instance: r = 40 and c = 160 permutation width: 200 security strength 80: same as (initially expected from) SHA-1 See [The Keccak reference] for more details 19 / 45
21 Inside Keccak Keccak[r, c] Sponge function using the permutation Keccak-f 7 permutations: b {25, 50, 100, 200, 400, 800, 1600} from toy over lightweight to high-speed SHA-3 instance: r = 1088 and c = 512 permutation width: 1600 security strength 256: post-quantum sufficient Lightweight instance: r = 40 and c = 160 permutation width: 200 security strength 80: same as (initially expected from) SHA-1 See [The Keccak reference] for more details 19 / 45
22 Inside Keccak The state: an array of l bits y z state x 5 5 lanes, each containing 2 l bits (1, 2, 4, 8, 16, 32 or 64) (5 5)-bit slices, 2 l of them 20 / 45
23 Inside Keccak The state: an array of l bits y z lane x 5 5 lanes, each containing 2 l bits (1, 2, 4, 8, 16, 32 or 64) (5 5)-bit slices, 2 l of them 20 / 45
24 Inside Keccak The state: an array of l bits y z slice x 5 5 lanes, each containing 2 l bits (1, 2, 4, 8, 16, 32 or 64) (5 5)-bit slices, 2 l of them 20 / 45
25 Inside Keccak The state: an array of l bits y z row x 5 5 lanes, each containing 2 l bits (1, 2, 4, 8, 16, 32 or 64) (5 5)-bit slices, 2 l of them 20 / 45
26 Inside Keccak The state: an array of l bits y z column x 5 5 lanes, each containing 2 l bits (1, 2, 4, 8, 16, 32 or 64) (5 5)-bit slices, 2 l of them 20 / 45
27 Inside Keccak χ, the nonlinear mapping in Keccak-f Flip bit if neighbors exhibit 01 pattern Operates independently and in parallel on 5-bit rows Cheap: small number of operations per bit 21 / 45
28 Inside Keccak θ, a first attempt at mixing bits Compute parity c x,z of each column Add to each cell parity of neighboring columns: Cheap: two XORs per bit b x,y,z = a x,y,z c x 1,z c x+1,z + = column parity θʹ effect combine 22 / 45
29 Inside Keccak Diffusion of θ θʹ 1 + ( 1 + y + y 2 + y 3 + y 4) ( x + x 4) ( mod 1 + x 5, 1 + y 5, 1 + z w ) 23 / 45
30 Inside Keccak Diffusion of θ (kernel) θʹ 1 + ( 1 + y + y 2 + y 3 + y 4) ( x + x 4) ( mod 1 + x 5, 1 + y 5, 1 + z w ) 24 / 45
31 Inside Keccak Diffusion of the inverse of θ θʹ 1 + ( 1 + y + y 2 + y 3 + y 4) ( x 2 + x 3) ( mod 1 + x 5, 1 + y 5, 1 + z w ) 25 / 45
32 Inside Keccak ρ for inter-slice dispersion We need diffusion between the slices ρ: cyclic shifts of lanes with offsets ( ) i(i + 1)/2 mod 2 l x, with = y Offsets cycle through all values below 2 l ( ) i 1 ( ) / 45
33 Inside Keccak ι to break symmetry XOR of round-dependent constant to lane in origin Without ι, the round mapping would be symmetric invariant to translation in the z-direction susceptible to rotational cryptanalysis Without ι, all rounds would be the same susceptibility to slide attacks defective cycle structure Without ι, we get simple fixed points (000 and 111) 27 / 45
34 Inside Keccak A first attempt at Keccak-f Round function: R = ι ρ θ χ Problem: low-weight periodic trails by chaining: χ θʹ ρ χ: propagates unchanged with weight 4 θ : propagates unchanged, because all column parities are 0 ρ: in general moves active bits to different slices but not always 28 / 45
35 Inside Keccak The Matryoshka property χ θʹ ρ χ θʹ ρ Patterns in Q are z-periodic versions of patterns in Q Weight of trail Q is twice that of trail Q (or 2 n times in general) 29 / 45
36 Inside Keccak π for disturbing horizontal/vertical alignment ( ) x a x,y a x,y with = y ( ) ( ) x y 30 / 45
37 Inside Keccak A second attempt at Keccak-f Round function: R = ι π ρ θ χ Solves problem encountered before: χ θʹ ρ π π moves bits in same column to different columns! Almost there, still a final tweak 31 / 45
38 Inside Keccak Tweaking θ to θ θ 1 + ( 1 + y + y 2 + y 3 + y 4) ( x + x 4 z ) ( mod 1 + x 5, 1 + y 5, 1 + z w ) 32 / 45
39 Inside Keccak Inverse of θ θ 1 + ( 1 + y + y 2 + y 3 + y 4) Q, with Q = 1 + (1 + x + x 4 z) 1 mod 1 + x 5, 1 + z w Q is dense, so: Diffusion from single-bit output to input very high Increases resistance against LC/DC and algebraic attacks 33 / 45
40 Inside Keccak Keccak-f summary Round function: Number of rounds: l Keccak-f[25] has 12 rounds Keccak-f[1600] has 24 rounds R = ι χ π ρ θ 34 / 45
41 The SHA-3 FIPS Outline 1 The SHA-3 competition 2 The sponge construction 3 Inside Keccak 4 The SHA-3 FIPS 35 / 45
42 The SHA-3 FIPS The long road to the SHA-3 FIPS February 2013: NIST-Keccak-team meeting SHA-2 replacement by now less urgent but Keccak is more than just hashing! NIST disseminates joint SHA-3 proposal Summer 2013: Snowden revelations alleged NSA backdoor in DUAL EC DRBG SHA-3 proposal framed as NIST weakening Keccak Early 2014: standard takes shape addressing public concerns Friday, April 4, 2014: draft FIPS 202 for public comments August 2014: NIST announces plans at SHA-3 conference Mid 2015 (expected): FIPS 202 official publication 36 / 45
43 The SHA-3 FIPS FIPS 202: what is inside? Content Keccak instances for 4 hash functions 2 XOFs Keccak-f all 7 block widths even reduced-round versions unlike AES FIPS that has only 1 of the 5 Rijndael widths sponge construction Concept: toolbox for building other functions tree hashing, MAC, encryption, dedicated special publications (NIST SP 800-XX) under development 37 / 45
44 The SHA-3 FIPS XOF: extendable Output Function XOF: a function in which the output can be extended to any length. Good for full domain hash, stream ciphers and key derivation [Ray Perlner, SHA 3 workshop 2014] Quite natural for sponge keeps state and delivers more output upon request bits of output do not depend on the number of bits requested Allows simplification: instead of separate hash functions per output length a single XOF can cover all use cases: H-256(M) = XOF(M) / 45
45 The SHA-3 FIPS Domain separation Some protocols and applications need multiple hash functions or XOFs that should be independent With a single XOF? Yes: using domain separation output of XOF(M 0) and XOF(M 1) are independent unless XOF has a cryptographic weakness Generalization to 2 n functions with D an n-bit diversifier XOF D (M) = XOF(M D) Variable-length diversifiers: suffix-free set of strings 39 / 45
46 The SHA-3 FIPS The XOFs and hash functions in FIPS 202 Four drop-in replacements identical to those in Keccak submission Two extendable output functions (XOF) Tree-hashing ready: Sakura coding [Keccak team, eprint 2013/231] XOF Keccak[c = 256](M 11 11) Keccak[c = 512](M 11 11) SHAKE128 and SHAKE256 SHA-2 drop-in replacements Keccak[c = 448](M 01) 224 Keccak[c = 512](M 01) 256 Keccak[c = 768](M 01) 384 Keccak[c = 1024](M 01) 512 SHA3-224 to SHA / 45
47 The SHA-3 FIPS Tree hashing Features: hash recomputation when modifying small part of file parallelizable performance: function instruction cycles/byte Keccak[c = 256] 1 x86_ Keccak[c = 256] 2 AVX2 (128-bit only) 5.30 Keccak[c = 256] 4 AVX CPU: Haswell with AVX2 256-bit SIMD 41 / 45
48 The SHA-3 FIPS MAC (and key derivation) Key Padded message MAC 0 f f f f f KMAC[K](M) = H(K M) XMAC[K](M, λ) = XOF(K M λ) λ length of the output XKDF: key derivation function based on XOF (XMAC) HMAC [FIPS 198] no longer needed! 42 / 45
49 The SHA-3 FIPS Stream encryption Key IV 0 f f f Key stream Encryption: add key stream to plaintext bit per bit 43 / 45
50 The SHA-3 FIPS Efficient authenticated encryption Key IV Padded message MAC 0 f f f f f Key stream Basis: using Keccak-f in Duplex construction generic security equivalent to sponge [Keccak team, SAC 2011] also for random generation with reseeding (/dev/urandom ) Domain separation layer on top: duplexwrap 44 / 45
51 Conclusion Questions? / 45
Grøstl a SHA-3 candidate
Grøstl a SHA-3 candidate Krystian Matusiewicz Wroclaw University of Technology CECC 2010, June 12, 2010 Krystian Matusiewicz Grøstl a SHA-3 candidate 1/ 26 Talk outline Cryptographic hash functions NIST
SHA3 WHERE WE VE BEEN WHERE WE RE GOING
SHA3 WHERE WE VE BEEN WHERE WE RE GOING Bill Burr May 1, 2013 updated version of John Kelsey s RSA2013 presentation Overview of Talk Where We ve Been: Ancient history 2004 The Competition Where We re Going
Hash Function of Finalist SHA-3: Analysis Study
International Journal of Advanced Computer Science and Information Technology (IJACSIT) Vol. 2, No. 2, April 2013, Page: 1-12, ISSN: 2296-1739 Helvetic Editions LTD, Switzerland www.elvedit.com Hash Function
Hash Function JH and the NIST SHA3 Hash Competition
Hash Function JH and the NIST SHA3 Hash Competition Hongjun Wu Nanyang Technological University Presented at ACNS 2012 1 Introduction to Hash Function Hash Function Design Basics Hash function JH Design
Overview of Cryptographic Tools for Data Security. Murat Kantarcioglu
UT DALLAS Erik Jonsson School of Engineering & Computer Science Overview of Cryptographic Tools for Data Security Murat Kantarcioglu Pag. 1 Purdue University Cryptographic Primitives We will discuss the
Cryptography Lecture 8. Digital signatures, hash functions
Cryptography Lecture 8 Digital signatures, hash functions A Message Authentication Code is what you get from symmetric cryptography A MAC is used to prevent Eve from creating a new message and inserting
Permutation Based Cryptography for IoT
Permutation Based Cryptography for IoT Guido Bertoni 1 Joint work with Joan Daemen 1, Michaël Peeters 2 and Gilles Van Assche 1 1 STMicroelectronics 2 NXP Semiconductors CIoT 2012, Antwerp, November 21
Permutation-based encryption, authentication and authenticated encryption
Permutation-based encryption, authentication and authenticated encryption Guido Bertoni 1, Joan Daemen 1, Michaël Peeters 2, and Gilles Van Assche 1 1 STMicroelectronics 2 NXP Semiconductors Abstract.
CIS433/533 - Computer and Network Security Cryptography
CIS433/533 - Computer and Network Security Cryptography Professor Kevin Butler Winter 2011 Computer and Information Science A historical moment Mary Queen of Scots is being held by Queen Elizabeth and
Length extension attack on narrow-pipe SHA-3 candidates
Length extension attack on narrow-pipe SHA-3 candidates Danilo Gligoroski Department of Telematics, Norwegian University of Science and Technology, O.S.Bragstads plass 2B, N-7491 Trondheim, NORWAY [email protected]
Message Authentication
Message Authentication message authentication is concerned with: protecting the integrity of a message validating identity of originator non-repudiation of origin (dispute resolution) will consider the
Authentication requirement Authentication function MAC Hash function Security of
UNIT 3 AUTHENTICATION Authentication requirement Authentication function MAC Hash function Security of hash function and MAC SHA HMAC CMAC Digital signature and authentication protocols DSS Slides Courtesy
Table of Contents. Bibliografische Informationen http://d-nb.info/996514864. digitalisiert durch
1 Introduction to Cryptography and Data Security 1 1.1 Overview of Cryptology (and This Book) 2 1.2 Symmetric Cryptography 4 1.2.1 Basics 4 1.2.2 Simple Symmetric Encryption: The Substitution Cipher...
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Lecture No. # 11 Block Cipher Standards (DES) (Refer Slide
Cryptographic Hash Functions Message Authentication Digital Signatures
Cryptographic Hash Functions Message Authentication Digital Signatures Abstract We will discuss Cryptographic hash functions Message authentication codes HMAC and CBC-MAC Digital signatures 2 Encryption/Decryption
Enhancing Advanced Encryption Standard S-Box Generation Based on Round Key
Enhancing Advanced Encryption Standard S-Box Generation Based on Round Key Julia Juremi Ramlan Mahmod Salasiah Sulaiman Jazrin Ramli Faculty of Computer Science and Information Technology, Universiti Putra
An Efficient Cryptographic Hash Algorithm (BSA)
An Efficient Cryptographic Hash Algorithm (BSA) Subhabrata Mukherjee 1, Bimal Roy 2, Anirban Laha 1 1 Dept of CSE, Jadavpur University, Calcutta 700 032, India 2 Indian Statistical Institute, Calcutta
CSCE 465 Computer & Network Security
CSCE 465 Computer & Network Security Instructor: Dr. Guofei Gu http://courses.cse.tamu.edu/guofei/csce465/ Secret Key Cryptography (I) 1 Introductory Remarks Roadmap Feistel Cipher DES AES Introduction
Evaluation of Digital Signature Process
Evaluation of Digital Signature Process Emil SIMION, Ph. D. email: [email protected] Agenda Evaluation of digital signatures schemes: evaluation criteria; security evaluation; security of hash functions;
The Advanced Encryption Standard: Four Years On
The Advanced Encryption Standard: Four Years On Matt Robshaw Reader in Information Security Information Security Group Royal Holloway University of London September 21, 2004 The State of the AES 1 The
SHA-2 will soon retire
SHA-2 will soon retire The SHA-3 Song Michael Naehrig Christiane Peters Peter Schwabe Department of Mathematics and Computer Science Technische Universiteit Eindhoven, P.O. Box 513, 5600 MB Eindhoven,
Cryptography and Network Security
Cryptography and Network Security Spring 2012 http://users.abo.fi/ipetre/crypto/ Lecture 3: Block ciphers and DES Ion Petre Department of IT, Åbo Akademi University January 17, 2012 1 Data Encryption Standard
HASH CODE BASED SECURITY IN CLOUD COMPUTING
ABSTRACT HASH CODE BASED SECURITY IN CLOUD COMPUTING Kaleem Ur Rehman M.Tech student (CSE), College of Engineering, TMU Moradabad (India) The Hash functions describe as a phenomenon of information security
A PPENDIX H RITERIA FOR AES E VALUATION C RITERIA FOR
A PPENDIX H RITERIA FOR AES E VALUATION C RITERIA FOR William Stallings Copyright 20010 H.1 THE ORIGINS OF AES...2 H.2 AES EVALUATION...3 Supplement to Cryptography and Network Security, Fifth Edition
2 Classification of the SHA-3 Candidates
Classification of the SHA-3 Candidates Ewan Fleischmann 1, Christian Forler 1,2, and Michael Gorski 1 1 Bauhaus-University Weimar {Ewan.Fleischmann, Michael.Gorski}@uni-weimar.de 2 Sirrix AG security technologies
Lecture 4 Data Encryption Standard (DES)
Lecture 4 Data Encryption Standard (DES) 1 Block Ciphers Map n-bit plaintext blocks to n-bit ciphertext blocks (n = block length). For n-bit plaintext and ciphertext blocks and a fixed key, the encryption
Cryptography and Network Security Chapter 11
Cryptography and Network Security Chapter 11 Fifth Edition by William Stallings Lecture slides by Lawrie Brown (with edits by RHB) Chapter 11 Cryptographic Hash Functions Each of the messages, like each
Network Security. Chapter 3 Symmetric Cryptography. Symmetric Encryption. Modes of Encryption. Symmetric Block Ciphers - Modes of Encryption ECB (1)
Chair for Network Architectures and Services Department of Informatics TU München Prof. Carle Network Security Chapter 3 Symmetric Cryptography General Description Modes of ion Data ion Standard (DES)
Security Analysis of DRBG Using HMAC in NIST SP 800-90
Security Analysis of DRBG Using MAC in NIST SP 800-90 Shoichi irose Graduate School of Engineering, University of Fukui hrs [email protected] Abstract. MAC DRBG is a deterministic random bit generator
MAC. SKE in Practice. Lecture 5
MAC. SKE in Practice. Lecture 5 Active Adversary Active Adversary An active adversary can inject messages into the channel Active Adversary An active adversary can inject messages into the channel Eve
Network Security. Gaurav Naik Gus Anderson. College of Engineering. Drexel University, Philadelphia, PA. Drexel University. College of Engineering
Network Security Gaurav Naik Gus Anderson, Philadelphia, PA Lectures on Network Security Feb 12 (Today!): Public Key Crypto, Hash Functions, Digital Signatures, and the Public Key Infrastructure Feb 14:
One-Way Encryption and Message Authentication
One-Way Encryption and Message Authentication Cryptographic Hash Functions Johannes Mittmann [email protected] Zentrum Mathematik Technische Universität München (TUM) 3 rd Joint Advanced Student School
The Advanced Encryption Standard (AES)
The Advanced Encryption Standard (AES) Conception - Why A New Cipher? Conception - Why A New Cipher? DES had outlived its usefulness Vulnerabilities were becoming known 56-bit key was too small Too slow
lundi 1 octobre 2012 In a set of N elements, by picking at random N elements, we have with high probability a collision two elements are equal
Symmetric Crypto Pierre-Alain Fouque Birthday Paradox In a set of N elements, by picking at random N elements, we have with high probability a collision two elements are equal N=365, about 23 people are
Elliptic Curve Hash (and Sign)
Elliptic Curve Hash (and Sign) (and the 1-up problem for ECDSA) Daniel R. L. Brown Certicom Research ECC 2008, Utrecht, Sep 22-24 2008 Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 1 / 43
Hash Functions. Integrity checks
Hash Functions EJ Jung slide 1 Integrity checks Integrity vs. Confidentiality! Integrity: attacker cannot tamper with message! Encryption may not guarantee integrity! Intuition: attacker may able to modify
Lecture 9: Application of Cryptography
Lecture topics Cryptography basics Using SSL to secure communication links in J2EE programs Programmatic use of cryptography in Java Cryptography basics Encryption Transformation of data into a form that
Cryptography and Network Security Chapter 12
Cryptography and Network Security Chapter 12 Fifth Edition by William Stallings Lecture slides by Lawrie Brown (with edits by RHB) Chapter 12 Message Authentication Codes At cats' green on the Sunday he
Cryptography and Network Security. Prof. D. Mukhopadhyay. Department of Computer Science and Engineering. Indian Institute of Technology, Kharagpur
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Module No. # 01 Lecture No. # 12 Block Cipher Standards
Provable-Security Analysis of Authenticated Encryption in Kerberos
Provable-Security Analysis of Authenticated Encryption in Kerberos Alexandra Boldyreva Virendra Kumar Georgia Institute of Technology, School of Computer Science 266 Ferst Drive, Atlanta, GA 30332-0765
Network Security Part II: Standards
Network Security Part II: Standards Raj Jain Washington University Saint Louis, MO 63131 [email protected] These slides are available on-line at: http://www.cse.wustl.edu/~jain/cse473-05/ 18-1 Overview
Efficient Software Implementation of AES on 32-bit Platforms
Efficient Software Implementation of AES on 32-bit Platforms Guido Bertoni, Luca Breveglieri Politecnico di Milano, Milano - Italy Pasqualina Lilli Lilli Fragneto AST-LAB of ST Microelectronics, Agrate
SECURITY IN NETWORKS
SECURITY IN NETWORKS GOALS Understand principles of network security: Cryptography and its many uses beyond confidentiality Authentication Message integrity Security in practice: Security in application,
Comparison of seven SHA-3 candidates software implementations on smart cards.
Comparison of seven SHA-3 candidates software implementations on smart cards. Mourad Gouicem Oberthur Technologies Contact : {g.piret, e.prouff}@oberthur.com October 2010 Abstract In this work, we present
A NEW HASH ALGORITHM: Khichidi-1
A NEW HASH ALGORITHM: Khichidi-1 Abstract This is a technical document describing a new hash algorithm called Khichidi-1 and has been written in response to a Hash competition (SHA-3) called by National
Message Authentication Codes. Lecture Outline
Message Authentication Codes Murat Kantarcioglu Based on Prof. Ninghui Li s Slides Message Authentication Code Lecture Outline 1 Limitation of Using Hash Functions for Authentication Require an authentic
Introduction to Cryptography CS 355
Introduction to Cryptography CS 355 Lecture 30 Digital Signatures CS 355 Fall 2005 / Lecture 30 1 Announcements Wednesday s lecture cancelled Friday will be guest lecture by Prof. Cristina Nita- Rotaru
Talk announcement please consider attending!
Talk announcement please consider attending! Where: Maurer School of Law, Room 335 When: Thursday, Feb 5, 12PM 1:30PM Speaker: Rafael Pass, Associate Professor, Cornell University, Topic: Reasoning Cryptographically
Developing and Investigation of a New Technique Combining Message Authentication and Encryption
Developing and Investigation of a New Technique Combining Message Authentication and Encryption Eyas El-Qawasmeh and Saleem Masadeh Computer Science Dept. Jordan University for Science and Technology P.O.
Introduction to Computer Security
Introduction to Computer Security Hash Functions and Digital Signatures Pavel Laskov Wilhelm Schickard Institute for Computer Science Integrity objective in a wide sense Reliability Transmission errors
Overview of Symmetric Encryption
CS 361S Overview of Symmetric Encryption Vitaly Shmatikov Reading Assignment Read Kaufman 2.1-4 and 4.2 slide 2 Basic Problem ----- ----- -----? Given: both parties already know the same secret Goal: send
Network Security. Modes of Operation. Steven M. Bellovin February 3, 2009 1
Modes of Operation Steven M. Bellovin February 3, 2009 1 Using Cryptography As we ve already seen, using cryptography properly is not easy Many pitfalls! Errors in use can lead to very easy attacks You
Network Security. Security. Security Services. Crytographic algorithms. privacy authenticity Message integrity. Public key (RSA) Message digest (MD5)
Network Security Security Crytographic algorithms Security Services Secret key (DES) Public key (RSA) Message digest (MD5) privacy authenticity Message integrity Secret Key Encryption Plain text Plain
Fundamentals of Computer Security
Fundamentals of Computer Security Spring 2015 Radu Sion Intro Encryption Hash Functions A Message From Our Sponsors Fundamentals System/Network Security, crypto How do things work Why How to design secure
Lecture 9 - Message Authentication Codes
Lecture 9 - Message Authentication Codes Boaz Barak March 1, 2010 Reading: Boneh-Shoup chapter 6, Sections 9.1 9.3. Data integrity Until now we ve only been interested in protecting secrecy of data. However,
ChaCha, a variant of Salsa20
ChaCha, a variant of Salsa20 Daniel J. Bernstein Department of Mathematics, Statistics, and Computer Science (M/C 249) The University of Illinois at Chicago Chicago, IL 60607 7045 [email protected]
Recommendation for Applications Using Approved Hash Algorithms
NIST Special Publication 800-107 Recommendation for Applications Using Approved Hash Algorithms Quynh Dang Computer Security Division Information Technology Laboratory C O M P U T E R S E C U R I T Y February
EXAM questions for the course TTM4135 - Information Security May 2013. Part 1
EXAM questions for the course TTM4135 - Information Security May 2013 Part 1 This part consists of 5 questions all from one common topic. The number of maximal points for every correctly answered question
Outline. Computer Science 418. Digital Signatures: Observations. Digital Signatures: Definition. Definition 1 (Digital signature) Digital Signatures
Outline Computer Science 418 Digital Signatures Mike Jacobson Department of Computer Science University of Calgary Week 12 1 Digital Signatures 2 Signatures via Public Key Cryptosystems 3 Provable 4 Mike
On the Influence of the Algebraic Degree of the Algebraic Degree of
IEEE TRANSACTIONS ON INFORMATION THEORY, VOL. 59, NO. 1, JANUARY 2013 691 On the Influence of the Algebraic Degree of the Algebraic Degree of Christina Boura and Anne Canteaut on Abstract We present a
The Advanced Encryption Standard (AES)
The Advanced Encryption Standard (AES) All of the cryptographic algorithms we have looked at so far have some problem. The earlier ciphers can be broken with ease on modern computation systems. The DES
Digital Signatures. Murat Kantarcioglu. Based on Prof. Li s Slides. Digital Signatures: The Problem
Digital Signatures Murat Kantarcioglu Based on Prof. Li s Slides Digital Signatures: The Problem Consider the real-life example where a person pays by credit card and signs a bill; the seller verifies
On the Security of CTR + CBC-MAC
On the Security of CTR + CBC-MAC NIST Modes of Operation Additional CCM Documentation Jakob Jonsson * jakob [email protected] Abstract. We analyze the security of the CTR + CBC-MAC (CCM) encryption mode.
Modern Block Cipher Standards (AES) Debdeep Mukhopadhyay
Modern Block Cipher Standards (AES) Debdeep Mukhopadhyay Assistant Professor Department of Computer Science and Engineering Indian Institute of Technology Kharagpur INDIA -721302 Objectives Introduction
Network Security Technology Network Management
COMPUTER NETWORKS Network Security Technology Network Management Source Encryption E(K,P) Decryption D(K,C) Destination The author of these slides is Dr. Mark Pullen of George Mason University. Permission
AES Cipher Modes with EFM32
AES Cipher Modes with EFM32 AN0033 - Application Note Introduction This application note describes how to implement several cryptographic cipher modes with the Advanced ion Standard (AES) on the EFM32
CS 758: Cryptography / Network Security
CS 758: Cryptography / Network Security offered in the Fall Semester, 2003, by Doug Stinson my office: DC 3122 my email address: [email protected] my web page: http://cacr.math.uwaterloo.ca/~dstinson/index.html
CIS 6930 Emerging Topics in Network Security. Topic 2. Network Security Primitives
CIS 6930 Emerging Topics in Network Security Topic 2. Network Security Primitives 1 Outline Absolute basics Encryption/Decryption; Digital signatures; D-H key exchange; Hash functions; Application of hash
Computer Security: Principles and Practice
Computer Security: Principles and Practice Chapter 20 Public-Key Cryptography and Message Authentication First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Public-Key Cryptography
Bounds for Balanced and Generalized Feistel Constructions
Bounds for Balanced and Generalized Feistel Constructions Andrey Bogdanov Katholieke Universiteit Leuven, Belgium ECRYPT II SymLab Bounds 2010 Outline Feistel Constructions Efficiency Metrics Bounds for
Cryptography and Network Security Chapter 3
Cryptography and Network Security Chapter 3 Fifth Edition by William Stallings Lecture slides by Lawrie Brown (with edits by RHB) Chapter 3 Block Ciphers and the Data Encryption Standard All the afternoon
1 Signatures vs. MACs
CS 120/ E-177: Introduction to Cryptography Salil Vadhan and Alon Rosen Nov. 22, 2006 Lecture Notes 17: Digital Signatures Recommended Reading. Katz-Lindell 10 1 Signatures vs. MACs Digital signatures
CSC474/574 - Information Systems Security: Homework1 Solutions Sketch
CSC474/574 - Information Systems Security: Homework1 Solutions Sketch February 20, 2005 1. Consider slide 12 in the handout for topic 2.2. Prove that the decryption process of a one-round Feistel cipher
Message authentication and. digital signatures
Message authentication and " Message authentication digital signatures verify that the message is from the right sender, and not modified (incl message sequence) " Digital signatures in addition, non!repudiation
1 Construction of CCA-secure encryption
CSCI 5440: Cryptography Lecture 5 The Chinese University of Hong Kong 10 October 2012 1 Construction of -secure encryption We now show how the MAC can be applied to obtain a -secure encryption scheme.
Ascon. Ch. Dobraunig 1, M. Eichlseder 1, F. Mendel 1, M. Schläffer 2. 22nd Crypto Day, Infineon, Munich. (A Submission to CAESAR)
Ascon (A Submission to CAESAR) Ch. Dobraunig 1, M. Eichlseder 1, F. Mendel 1, M. Schläffer 2 1 IAIK, Graz University of Technology, Austria 2 Infineon Technologies AG, Austria 22nd Crypto Day, Infineon,
How To Attack A Block Cipher With A Key Key (Dk) And A Key (K) On A 2Dns) On An Ipa (Ipa) On The Ipa 2Ds (Ipb) On Pcode)
Cryptography and Network Security Chapter 6 Fifth Edition by William Stallings Lecture slides by Lawrie Brown (with edits by RHB) Chapter 6 Block Cipher Operation Many savages at the present day regard
Outline. CSc 466/566. Computer Security. 8 : Cryptography Digital Signatures. Digital Signatures. Digital Signatures... Christian Collberg
Outline CSc 466/566 Computer Security 8 : Cryptography Digital Signatures Version: 2012/02/27 16:07:05 Department of Computer Science University of Arizona [email protected] Copyright c 2012 Christian
Application of cube attack to block and stream ciphers
Application of cube attack to block and stream ciphers Janusz Szmidt joint work with Piotr Mroczkowski Military University of Technology Military Telecommunication Institute Poland 23 czerwca 2009 1. Papers
The Misuse of RC4 in Microsoft Word and Excel
The Misuse of RC4 in Microsoft Word and Excel Hongjun Wu Institute for Infocomm Research, Singapore [email protected] Abstract. In this report, we point out a serious security flaw in Microsoft
1 Data Encryption Algorithm
Date: Monday, September 23, 2002 Prof.: Dr Jean-Yves Chouinard Design of Secure Computer Systems CSI4138/CEG4394 Notes on the Data Encryption Standard (DES) The Data Encryption Standard (DES) has been
7! Cryptographic Techniques! A Brief Introduction
7! Cryptographic Techniques! A Brief Introduction 7.1! Introduction to Cryptography! 7.2! Symmetric Encryption! 7.3! Asymmetric (Public-Key) Encryption! 7.4! Digital Signatures! 7.5! Public Key Infrastructures
6.857 Computer and Network Security Fall Term, 1997 Lecture 4 : 16 September 1997 Lecturer: Ron Rivest Scribe: Michelle Goldberg 1 Conditionally Secure Cryptography Conditionally (or computationally) secure
The Stream Cipher HC-128
The Stream Cipher HC-128 Hongjun Wu Katholieke Universiteit Leuven, ESAT/SCD-COSIC Kasteelpark Arenberg 10, B-3001 Leuven-Heverlee, Belgium [email protected] Statement 1. HC-128 supports 128-bit
Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall 2010
CS 494/594 Computer and Network Security Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall 2010 1 Introduction to Cryptography What is cryptography?
How To Encrypt With A 64 Bit Block Cipher
The Data Encryption Standard (DES) As mentioned earlier there are two main types of cryptography in use today - symmetric or secret key cryptography and asymmetric or public key cryptography. Symmetric
Public Key Cryptography Overview
Ch.20 Public-Key Cryptography and Message Authentication I will talk about it later in this class Final: Wen (5/13) 1630-1830 HOLM 248» give you a sample exam» Mostly similar to homeworks» no electronic
Error oracle attacks and CBC encryption. Chris Mitchell ISG, RHUL http://www.isg.rhul.ac.uk/~cjm
Error oracle attacks and CBC encryption Chris Mitchell ISG, RHUL http://www.isg.rhul.ac.uk/~cjm Agenda 1. Introduction 2. CBC mode 3. Error oracles 4. Example 1 5. Example 2 6. Example 3 7. Stream ciphers
2. Cryptography 2.4 Digital Signatures
DI-FCT-UNL Computer and Network Systems Security Segurança de Sistemas e Redes de Computadores 2010-2011 2. Cryptography 2.4 Digital Signatures 2010, Henrique J. Domingos, DI/FCT/UNL 2.4 Digital Signatures
Improving Performance of Secure Data Transmission in Communication Networks Using Physical Implementation of AES
Improving Performance of Secure Data Transmission in Communication Networks Using Physical Implementation of AES K Anjaneyulu M.Tech Student, Y.Chalapathi Rao, M.Tech, Ph.D Associate Professor, Mr.M Basha,
Lecture 10: CPA Encryption, MACs, Hash Functions. 2 Recap of last lecture - PRGs for one time pads
CS 7880 Graduate Cryptography October 15, 2015 Lecture 10: CPA Encryption, MACs, Hash Functions Lecturer: Daniel Wichs Scribe: Matthew Dippel 1 Topic Covered Chosen plaintext attack model of security MACs
KALE: A High-Degree Algebraic-Resistant Variant of The Advanced Encryption Standard
KALE: A High-Degree Algebraic-Resistant Variant of The Advanced Encryption Standard Dr. Gavekort c/o Vakiopaine Bar Kauppakatu 6, 41 Jyväskylä FINLAND [email protected] Abstract. We have discovered that the