MAC. SKE in Practice. Lecture 5

Transcription

1 MAC. SKE in Practice. Lecture 5

2 Active Adversary

3 Active Adversary An active adversary can inject messages into the channel

4 Active Adversary An active adversary can inject messages into the channel Eve can send ciphertexts to Bob and get them decrypted

5 Active Adversary An active adversary can inject messages into the channel Eve can send ciphertexts to Bob and get them decrypted Chosen Ciphertext Attack (CCA)

6 Active Adversary An active adversary can inject messages into the channel Eve can send ciphertexts to Bob and get them decrypted Chosen Ciphertext Attack (CCA) If Bob decrypts all ciphertexts for Eve, no security possible

7 Active Adversary An active adversary can inject messages into the channel Eve can send ciphertexts to Bob and get them decrypted Chosen Ciphertext Attack (CCA) If Bob decrypts all ciphertexts for Eve, no security possible What can Bob do?

8 Symmetric-Key Encryption RECALL SIM-CCA Security Send Recv Key/Enc Key/Dec SIM-CCA secure if: s.t. Replay Filter REAL IDEAL IDEAL Env Env REAL

9 Symmetric-Key Encryption RECALL SIM-CCA Security Invalid ciphertexts are silently ignored Send Recv Key/Enc Key/Dec SIM-CCA secure if: s.t. Replay Filter REAL IDEAL IDEAL Env Env REAL

10 Symmetric-Key Encryption RECALL SIM-CCA Security Send Recv Key/Enc Key/Dec SIM-CCA secure if: s.t. Replay Filter REAL IDEAL IDEAL Env Env REAL

11 Symmetric-Key Encryption RECALL Alternately (slightly weaker form): Adv can send its own messages SIM-CCA Security Send Recv Key/Enc Key/Dec SIM-CCA secure if: s.t. Replay Filter REAL IDEAL IDEAL Env Env REAL

12 Symmetric-Key Encryption RECALL IND-CCA Security Experiment picks b {0,1} and K KeyGen Adv gets (guarded) access to Dec K oracle For as long as Adversary wants Key/Enc Enc(m b,k) IND-CCA + ~correctness equivalent to SIM-CCA Key/Dec Adv sends two messages m 0, m 1 to the experiment Expt returns Enc(m b,k) to the adversary m b m 0,m 1 No challenge ciphertext answered Adversary returns a guess b Experiments outputs 1 iff b =b IND-CCA secure if for all feasible adversaries Pr[b =b] 1/2 b b b {0,1} b =b? Yes/No

13 Symmetric-Key Encryption RECALL IND-CCA Security Experiment picks b {0,1} and K KeyGen Adv gets (guarded) access to Dec K oracle For as long as Adversary wants Key/Enc Weaker Enc(m b,k) IND-CCA + ~correctness equivalent to SIM-CCA Key/Dec Adv sends two messages m 0, m 1 to the experiment Expt returns Enc(m b,k) to the adversary m b m 0,m 1 No challenge ciphertext answered Adversary returns a guess b Experiments outputs 1 iff b =b IND-CCA secure if for all feasible adversaries Pr[b =b] 1/2 b b b {0,1} b =b? Yes/No

14 CCA Security

15 CCA Security How to obtain CCA security?

16 CCA Security How to obtain CCA security? Use a CPA-secure encryption scheme, but make sure Bob accepts and decrypts only ciphertexts produced by Alice

17 CCA Security How to obtain CCA security? Use a CPA-secure encryption scheme, but make sure Bob accepts and decrypts only ciphertexts produced by Alice i.e., Eve can t create new ciphertexts that will be accepted by Bob

18 CCA Security How to obtain CCA security? Use a CPA-secure encryption scheme, but make sure Bob accepts and decrypts only ciphertexts produced by Alice i.e., Eve can t create new ciphertexts that will be accepted by Bob Achieves the stronger guarantee: in IDEAL, Eve can t send its own messages to Bob

19 CCA Security How to obtain CCA security? Use a CPA-secure encryption scheme, but make sure Bob accepts and decrypts only ciphertexts produced by Alice i.e., Eve can t create new ciphertexts that will be accepted by Bob Achieves the stronger guarantee: in IDEAL, Eve can t send its own messages to Bob CCA secure SKE reduces to the problem of CPA secure SKE and (shared key) message authentication

20 CCA Security How to obtain CCA security? Use a CPA-secure encryption scheme, but make sure Bob accepts and decrypts only ciphertexts produced by Alice i.e., Eve can t create new ciphertexts that will be accepted by Bob Achieves the stronger guarantee: in IDEAL, Eve can t send its own messages to Bob CCA secure SKE reduces to the problem of CPA secure SKE and (shared key) message authentication MAC: Message Authentication Code

21 Message Authentication Codes

22 Message Authentication Codes A single short key shared by Alice and Bob

23 Message Authentication Codes A single short key shared by Alice and Bob Can sign any (polynomial) number of messages

24 Message Authentication Codes A single short key shared by Alice and Bob Can sign any (polynomial) number of messages A triple (KeyGen, MAC, Verify) MAC K Ver K

25 Message Authentication Codes A single short key shared by Alice and Bob Can sign any (polynomial) number of messages A triple (KeyGen, MAC, Verify) MAC K Ver K Correctness: For all K from KeyGen, and all messages M, Verify K (M,MAC K (M))=1

26 Message Authentication Codes A single short key shared by Alice and Bob Can sign any (polynomial) number of messages A triple (KeyGen, MAC, Verify) Correctness: For all K from KeyGen, and all messages M, Verify K (M,MAC K (M))=1 Security: probability that an adversary can produce (M,s) s.t. Verify K (M,s)=1 is negligible unless Alice produced an output s=mac K (M) MAC K s i = MAC K (M i ) M i (M,s) Ver K Ver K (M,s) Advantage = Pr[ Ver K (M,s)=1 and (M,s) {(M i,s i )} ]

27 CCA Secure SKE

28 CCA Secure SKE CCA-Enc K1,K2 (m) = ( c:= CPA-Enc K1 (m), t:= MAC K2 (c) )

29 CCA Secure SKE CCA-Enc K1,K2 (m) = ( c:= CPA-Enc K1 (m), t:= MAC K2 (c) ) CPA secure encryption: Block-cipher/CTR mode construction

30 CCA Secure SKE CCA-Enc K1,K2 (m) = ( c:= CPA-Enc K1 (m), t:= MAC K2 (c) ) CPA secure encryption: Block-cipher/CTR mode construction MAC: from a PRF or Block-Cipher (coming up)

31 CCA Secure SKE CCA-Enc K1,K2 (m) = ( c:= CPA-Enc K1 (m), t:= MAC K2 (c) ) CPA secure encryption: Block-cipher/CTR mode construction MAC: from a PRF or Block-Cipher (coming up) SKE in practice can just use Block-Ciphers (coming up)

32 CCA Secure SKE CCA-Enc K1,K2 (m) = ( c:= CPA-Enc K1 (m), t:= MAC K2 (c) ) CPA secure encryption: Block-cipher/CTR mode construction MAC: from a PRF or Block-Cipher (coming up) SKE in practice can just use Block-Ciphers (coming up) In principle, constructions (less efficient) possible based on any One-Way Permutation or even any One-Way Function

33 Making a MAC

34 One-time MAC MAC Ver

35 One-time MAC To sign a single n bit message MAC Ver

36 One-time MAC To sign a single n bit message A simple (but inefficient) scheme MAC Ver

37 One-time MAC To sign a single n bit message A simple (but inefficient) scheme Shared secret key: 2n random strings (each k-bit long) (r i 0,r i 1) i=1..n MAC Ver r r r r r r

38 One-time MAC To sign a single n bit message A simple (but inefficient) scheme Shared secret key: 2n random strings (each k-bit long) (r i 0,r i 1) i=1..n MAC 010 Ver r r r r r r

39 One-time MAC To sign a single n bit message A simple (but inefficient) scheme 010 Shared secret key: 2n random strings (each k-bit long) (r i 0,r i 1) i=1..n MAC r 1 0 r 2 1 r 3 0 Ver Signature for m 1...m n be (r i mi) i=1..n r r r r r r

40 One-time MAC To sign a single n bit message A simple (but inefficient) scheme 010 Shared secret key: 2n random strings (each k-bit long) (r i 0,r i 1) i=1..n MAC r 1 0 r 2 1 r 3 0 Ver Signature for m 1...m n be (r i mi) i=1..n Negligible probability that Eve can produce a signature on m m r r r r r r

41 One-time MAC To sign a single n bit message A simple (but inefficient) scheme 010 Shared secret key: 2n random strings (each k-bit long) (r i 0,r i 1) i=1..n MAC r 1 0 r 2 1 r 3 0 Ver Signature for m 1...m n be (r i mi) i=1..n Negligible probability that Eve can produce a signature on m m r r r r r r Doesn t require any computational restrictions on adversary!

42 One-time MAC To sign a single n bit message A simple (but inefficient) scheme 010 Shared secret key: 2n random strings (each k-bit long) (r i 0,r i 1) i=1..n MAC r 1 0 r 2 1 r 3 0 Ver Signature for m 1...m n be (r i mi) i=1..n Negligible probability that Eve can produce a signature on m m r r r r r r Doesn t require any computational restrictions on adversary! More efficient one-time MACs exist (later)

43 (Multi-msg) MAC from PRF When Each Message is a Single Block

44 (Multi-msg) MAC from PRF When Each Message is a Single Block PRF is a MAC!

45 (Multi-msg) MAC from PRF When Each Message is a Single Block PRF is a MAC! MAC K (M) := F K (M) where F is a PRF

46 (Multi-msg) MAC from PRF When Each Message is a Single Block PRF is a MAC! MAC K (M) := F K (M) where F is a PRF M F K F K (M)

47 (Multi-msg) MAC from PRF When Each Message is a Single Block PRF is a MAC! MAC K (M) := F K (M) where F is a PRF Ver K (M,S) := 1 iff S=F K (M) M F K F K (M)

48 (Multi-msg) MAC from PRF When Each Message is a Single Block PRF is a MAC! MAC K (M) := F K (M) where F is a PRF Ver K (M,S) := 1 iff S=F K (M) Output length of F K should be big enough M F K F K (M)

49 (Multi-msg) MAC from PRF When Each Message is a Single Block PRF is a MAC! MAC K (M) := F K (M) where F is a PRF Ver K (M,S) := 1 iff S=F K (M) Output length of F K should be big enough M F K F K (M) If an adversary forges MAC with probability MAC, then can break PRF with advantage O( MAC 2 -m(k) ) (m(k) being the output length of the PRF) [How?]

50 (Multi-msg) MAC from PRF When Each Message is a Single Block PRF is a MAC! MAC K (M) := F K (M) where F is a PRF Ver K (M,S) := 1 iff S=F K (M) Output length of F K should be big enough M F K F K (M) If an adversary forges MAC with probability MAC, then can break PRF with advantage O( MAC 2 -m(k) ) (m(k) being the output length of the PRF) [How?] Advantage in breaking a PRF F: diff in prob a test has of outputting 1, when given F vs. truly random R

51 (Multi-msg) MAC from PRF When Each Message is a Single Block PRF is a MAC! MAC K (M) := F K (M) where F is a PRF Ver K (M,S) := 1 iff S=F K (M) Output length of F K should be big enough M F K F K (M) If an adversary forges MAC with probability MAC, then can break PRF with advantage O( MAC 2 -m(k) ) (m(k) being the output length of the PRF) [How?] If random function R used as MAC, then probability of forgery, MAC* = 2 -m(k) Advantage in breaking a PRF F: diff in prob a test has of outputting 1, when given F vs. truly random R

52 MAC for Multiple-Block Messages

53 MAC for Multiple-Block Messages What if message is longer than one block?

54 MAC for Multiple-Block Messages What if message is longer than one block? MAC ing each block separately is not secure (unlike in the case of CPA secure encryption)

55 MAC for Multiple-Block Messages What if message is longer than one block? MAC ing each block separately is not secure (unlike in the case of CPA secure encryption) Eve can rearrange the blocks/drop some blocks

56 MAC for Multiple-Block Messages What if message is longer than one block? MAC ing each block separately is not secure (unlike in the case of CPA secure encryption) Eve can rearrange the blocks/drop some blocks Could use a PRF that takes longer inputs

57 MAC for Multiple-Block Messages What if message is longer than one block? MAC ing each block separately is not secure (unlike in the case of CPA secure encryption) Eve can rearrange the blocks/drop some blocks Could use a PRF that takes longer inputs Can we use a PRF with a fixed block-length (i.e., a block cipher)?

58 MAC for Multiple-Block Messages

59 MAC for Multiple-Block Messages A simple solution: tie the blocks together

60 MAC for Multiple-Block Messages A simple solution: tie the blocks together Add to each block a random string r (same r for all blocks), total number of blocks, and a sequence number

61 MAC for Multiple-Block Messages A simple solution: tie the blocks together Add to each block a random string r (same r for all blocks), total number of blocks, and a sequence number B i = (r, t, i, M i )

62 MAC for Multiple-Block Messages A simple solution: tie the blocks together Add to each block a random string r (same r for all blocks), total number of blocks, and a sequence number B i = (r, t, i, M i ) MAC(M) = (r, (MAC(B i )) i=1..t )

63 MAC for Multiple-Block Messages A simple solution: tie the blocks together Add to each block a random string r (same r for all blocks), total number of blocks, and a sequence number B i = (r, t, i, M i ) MAC(M) = (r, (MAC(B i )) i=1..t ) r prevents mixing blocks from two messages, t prevents dropping blocks and i prevents rearranging

64 MAC for Multiple-Block Messages A simple solution: tie the blocks together Add to each block a random string r (same r for all blocks), total number of blocks, and a sequence number B i = (r, t, i, M i ) MAC(M) = (r, (MAC(B i )) i=1..t ) r prevents mixing blocks from two messages, t prevents dropping blocks and i prevents rearranging Inefficient! Tag length increases with message length

65 CBC-MAC

66 CBC-MAC PRF domain extension: Chaining the blocks

67 CBC-MAC PRF domain extension: Chaining the blocks m 1 m 2 m t... F K F K F K T

68 CBC-MAC PRF domain extension: Chaining the blocks cf. CBC mode for encryption (which is not a MAC!) m 1 m 2 m t... F K F K F K T

69 CBC-MAC PRF domain extension: Chaining the blocks cf. CBC mode for encryption (which is not a MAC!) t-block messages, a single block tag m 1 m 2 m t... F K F K F K T

70 CBC-MAC PRF domain extension: Chaining the blocks cf. CBC mode for encryption (which is not a MAC!) t-block messages, a single block tag Can be shown to be secure m 1 m 2 m t... F K F K F K T

71 CBC-MAC PRF domain extension: Chaining the blocks cf. CBC mode for encryption (which is not a MAC!) t-block messages, a single block tag Can be shown to be secure m 1 m 2 m t... F K F K F K T If restricted to t-block messages (i.e., same length)

72 CBC-MAC PRF domain extension: Chaining the blocks cf. CBC mode for encryption (which is not a MAC!) t-block messages, a single block tag Can be shown to be secure m 1 m 2 m t... F K F K F K T If restricted to t-block messages (i.e., same length) Else attacks possible (by extending a previously signed message)

73 Patching CBC-MAC

74 Patching CBC-MAC Patching CBC MAC to handle message of any (polynomial) length but still producing a single block tag (secure if block-cipher is):

75 Patching CBC-MAC Patching CBC MAC to handle message of any (polynomial) length but still producing a single block tag (secure if block-cipher is): Derive K as F K (t), where t is the number of blocks

76 Patching CBC-MAC Patching CBC MAC to handle message of any (polynomial) length but still producing a single block tag (secure if block-cipher is): Derive K as F K (t), where t is the number of blocks Use first block to specify number of blocks

77 Patching CBC-MAC Patching CBC MAC to handle message of any (polynomial) length but still producing a single block tag (secure if block-cipher is): Derive K as F K (t), where t is the number of blocks Use first block to specify number of blocks Important that first block is used: if last block, message extension attacks still possible

78 Patching CBC-MAC Patching CBC MAC to handle message of any (polynomial) length but still producing a single block tag (secure if block-cipher is): Derive K as F K (t), where t is the number of blocks Use first block to specify number of blocks Important that first block is used: if last block, message extension attacks still possible EMAC: Output not the last tag T, but F K (T), where K is an independent key (after padding the message to an integral number of blocks). No need to know message length a priori.

79 Patching CBC-MAC Patching CBC MAC to handle message of any (polynomial) length but still producing a single block tag (secure if block-cipher is): Derive K as F K (t), where t is the number of blocks Use first block to specify number of blocks Important that first block is used: if last block, message extension attacks still possible EMAC: Output not the last tag T, but F K (T), where K is an independent key (after padding the message to an integral number of blocks). No need to know message length a priori. CMAC: XOR last block with another key (derived from the original key using the block-cipher). Avoids padding when message is integral number of blocks.

80 Patching CBC-MAC Patching CBC MAC to handle message of any (polynomial) length but still producing a single block tag (secure if block-cipher is): Derive K as F K (t), where t is the number of blocks Use first block to specify number of blocks Important that first block is used: if last block, message extension attacks still possible EMAC: Output not the last tag T, but F K (T), where K is an independent key (after padding the message to an integral number of blocks). No need to know message length a priori. CMAC: XOR last block with another key (derived from the original key using the block-cipher). Avoids padding when message is integral number of blocks. NIST Recommendation. 2005

81 Patching CBC-MAC Patching CBC MAC to handle message of any (polynomial) length but still producing a single block tag (secure if block-cipher is): Derive K as F K (t), where t is the number of blocks Use first block to specify number of blocks Important that first block is used: if last block, message extension attacks still possible EMAC: Output not the last tag T, but F K (T), where K is an independent key (after padding the message to an integral number of blocks). No need to know message length a priori. CMAC: XOR last block with another key (derived from the original key using the block-cipher). Avoids padding when message is integral number of blocks. NIST Recommendation Later: Hash-based HMAC used in TLS and IPSec IETF Standard. 1997

82 SKE in Practice

83 Stream Ciphers

84 Stream Ciphers Used for one-time encryption

85 Stream Ciphers Used for one-time encryption RC4, estream portfolio,...

86 Stream Ciphers Used for one-time encryption RC4, estream portfolio,... In practice, stream ciphers take a key and an IV (for initialization vector) as inputs

87 Stream Ciphers Used for one-time encryption RC4, estream portfolio,... Also used to denote the random nonce chosen for encryption using a block-cipher In practice, stream ciphers take a key and an IV (for initialization vector) as inputs

88 Stream Ciphers Used for one-time encryption RC4, estream portfolio,... Also used to denote the random nonce chosen for encryption using a block-cipher In practice, stream ciphers take a key and an IV (for initialization vector) as inputs Heuristic goal: behave somewhat like a PRF (instead of a PRG) so that it can be used for multi-message encryption

89 Stream Ciphers Used for one-time encryption RC4, estream portfolio,... Also used to denote the random nonce chosen for encryption using a block-cipher In practice, stream ciphers take a key and an IV (for initialization vector) as inputs Heuristic goal: behave somewhat like a PRF (instead of a PRG) so that it can be used for multi-message encryption But often breaks if used this way

90 Stream Ciphers Used for one-time encryption RC4, estream portfolio,... Also used to denote the random nonce chosen for encryption using a block-cipher In practice, stream ciphers take a key and an IV (for initialization vector) as inputs Heuristic goal: behave somewhat like a PRF (instead of a PRG) so that it can be used for multi-message encryption But often breaks if used this way NIST Standard: For multi-message encryption, use a blockcipher in CTR mode

91 Block Ciphers

92 Block Ciphers DES, 3DES, Blowfish, AES,...

93 Block Ciphers DES, 3DES, Blowfish, AES,... Heuristic constructions

94 Block Ciphers DES, 3DES, Blowfish, AES,... Heuristic constructions Permutations that can be inverted with the key

95 Block Ciphers DES, 3DES, Blowfish, AES,... Heuristic constructions Permutations that can be inverted with the key Speed (hardware/software) is of the essence

96 Block Ciphers DES, 3DES, Blowfish, AES,... Heuristic constructions Permutations that can be inverted with the key Speed (hardware/software) is of the essence But should withstand known attacks

97 Block Ciphers DES, 3DES, Blowfish, AES,... Heuristic constructions Permutations that can be inverted with the key Speed (hardware/software) is of the essence But should withstand known attacks As a PRP (or at least, against key recovery)

98 Feistel Network

99 Feistel Network Building a permutation from a (block) function

100 Feistel Network Building a permutation from a (block) function Let f: {0,1} m {0,1} m be an arbitrary function

101 Feistel Network Building a permutation from a (block) function Let f: {0,1} m {0,1} m be an arbitrary function F f : {0,1} 2m {0,1} 2m defined as F f (x,y) = ( y, x f(y) ) f 1

102 Feistel Network Building a permutation from a (block) function Let f: {0,1} m {0,1} m be an arbitrary function F f : {0,1} 2m {0,1} 2m defined as F f (x,y) = ( y, x f(y) ) F f is a permutation (Why?) f 1

103 Feistel Network Building a permutation from a (block) function Let f: {0,1} m {0,1} m be an arbitrary function F f : {0,1} 2m {0,1} 2m defined as F f (x,y) = ( y, x f(y) ) F f is a permutation (Why?) Can invert (How?) f 1

104 Feistel Network Building a permutation from a (block) function Let f: {0,1} m {0,1} m be an arbitrary function F f : {0,1} 2m {0,1} 2m defined as F f (x,y) = ( y, x f(y) ) F f is a permutation (Why?) Can invert (How?) Given functions f 1,...,f t can build a t-layer Feistel network F f1...ft f 1

105 Feistel Network Building a permutation from a (block) function Let f: {0,1} m {0,1} m be an arbitrary function F f : {0,1} 2m {0,1} 2m defined as F f (x,y) = ( y, x f(y) ) F f is a permutation (Why?) Can invert (How?) Given functions f 1,...,f t can build a t-layer Feistel network F f1...ft f1 f 2

106 Feistel Network Building a permutation from a (block) function Let f: {0,1} m {0,1} m be an arbitrary function F f : {0,1} 2m {0,1} 2m defined as F f (x,y) = ( y, x f(y) ) F f is a permutation (Why?) Can invert (How?) Given functions f 1,...,f t can build a t-layer Feistel network F f1...ft Still a permutation from {0,1} 2m to {0,1} 2m f1 f 2

107 Feistel Network Building a permutation from a (block) function Let f: {0,1} m {0,1} m be an arbitrary function F f : {0,1} 2m {0,1} 2m defined as F f (x,y) = ( y, x f(y) ) F f is a permutation (Why?) Can invert (How?) Given functions f 1,...,f t can build a t-layer Feistel network F f1...ft Still a permutation from {0,1} 2m to {0,1} 2m Luby-Rackoff: A 3-layer Feistel network, in which 3 PRFs with independent seeds are the 3 round functions, is a PRP. A 4-layer Feistel gives a strong PRP f1 f 2

108 Feistel Network Building a permutation from a (block) function Let f: {0,1} m {0,1} m be an arbitrary function F f : {0,1} 2m {0,1} 2m defined as F f (x,y) = ( y, x f(y) ) F f is a permutation (Why?) Can invert (How?) Given functions f 1,...,f t can build a t-layer Feistel network F f1...ft Still a permutation from {0,1} 2m to {0,1} 2m Luby-Rackoff: A 3-layer Feistel network, in which 3 PRFs with independent seeds are the 3 round functions, is a PRP. A 4-layer Feistel gives a strong PRP Fewer layers do not suffice! [Exercise] f1 f 2

109 DES Block Cipher

110 NIST Standard DES Block Cipher Data Encryption Standard (DES), Triple-DES, DES-X

111 NIST Standard DES Block Cipher Data Encryption Standard (DES), Triple-DES, DES-X DES uses a 16-layer Feistel network (and a few other steps)

112 NIST Standard DES Block Cipher Data Encryption Standard (DES), Triple-DES, DES-X DES uses a 16-layer Feistel network (and a few other steps) The round functions are not PRFs, but ad hoc

113 NIST Standard DES Block Cipher Data Encryption Standard (DES), Triple-DES, DES-X DES uses a 16-layer Feistel network (and a few other steps) The round functions are not PRFs, but ad hoc Confuse and diffuse

114 NIST Standard DES Block Cipher Data Encryption Standard (DES), Triple-DES, DES-X DES uses a 16-layer Feistel network (and a few other steps) The round functions are not PRFs, but ad hoc Confuse and diffuse Defined for fixed key/block lengths (56 bits and 64 bits); key is used to generate subkeys for round functions

115 NIST Standard DES Block Cipher Data Encryption Standard (DES), Triple-DES, DES-X DES uses a 16-layer Feistel network (and a few other steps) The round functions are not PRFs, but ad hoc Confuse and diffuse Defined for fixed key/block lengths (56 bits and 64 bits); key is used to generate subkeys for round functions DES s key length too short

116 NIST Standard DES Block Cipher Data Encryption Standard (DES), Triple-DES, DES-X DES uses a 16-layer Feistel network (and a few other steps) The round functions are not PRFs, but ad hoc Confuse and diffuse Defined for fixed key/block lengths (56 bits and 64 bits); key is used to generate subkeys for round functions DES s key length too short Can now mount brute force key-recovery attacks (e.g. using $10K hardware, running for under a week, in 2006; now, in under a day)

117 NIST Standard DES Block Cipher Data Encryption Standard (DES), Triple-DES, DES-X DES uses a 16-layer Feistel network (and a few other steps) The round functions are not PRFs, but ad hoc Confuse and diffuse Defined for fixed key/block lengths (56 bits and 64 bits); key is used to generate subkeys for round functions DES s key length too short Can now mount brute force key-recovery attacks (e.g. using $10K hardware, running for under a week, in 2006; now, in under a day) DES-X: extra keys to pad input and output

118 NIST Standard DES Block Cipher Data Encryption Standard (DES), Triple-DES, DES-X DES uses a 16-layer Feistel network (and a few other steps) The round functions are not PRFs, but ad hoc Confuse and diffuse Defined for fixed key/block lengths (56 bits and 64 bits); key is used to generate subkeys for round functions DES s key length too short Can now mount brute force key-recovery attacks (e.g. using $10K hardware, running for under a week, in 2006; now, in under a day) DES-X: extra keys to pad input and output Triple DES: 3 successive applications of DES (or DES -1 ) with 3 keys

119 AES Block Cipher

120 NIST Standard AES Block Cipher Advanced Encryption Standard (AES)

121 NIST Standard AES Block Cipher Advanced Encryption Standard (AES) AES-128, AES-192, AES-256 (3 key sizes; block size = 128 bits)

122 NIST Standard AES Block Cipher Advanced Encryption Standard (AES) AES-128, AES-192, AES-256 (3 key sizes; block size = 128 bits) Very efficient in software implementations (unlike DES)

123 NIST Standard AES Block Cipher Advanced Encryption Standard (AES) AES-128, AES-192, AES-256 (3 key sizes; block size = 128 bits) Very efficient in software implementations (unlike DES) Uses Substitute-and-Permute instead of Feistel networks

124 NIST Standard AES Block Cipher Advanced Encryption Standard (AES) AES-128, AES-192, AES-256 (3 key sizes; block size = 128 bits) Very efficient in software implementations (unlike DES) Uses Substitute-and-Permute instead of Feistel networks Has some algebraic structure

125 NIST Standard AES Block Cipher Advanced Encryption Standard (AES) AES-128, AES-192, AES-256 (3 key sizes; block size = 128 bits) Very efficient in software implementations (unlike DES) Uses Substitute-and-Permute instead of Feistel networks Has some algebraic structure Operations in a vector space over the field GF(2 8 )

126 NIST Standard AES Block Cipher Advanced Encryption Standard (AES) AES-128, AES-192, AES-256 (3 key sizes; block size = 128 bits) Very efficient in software implementations (unlike DES) Uses Substitute-and-Permute instead of Feistel networks Has some algebraic structure Operations in a vector space over the field GF(2 8 ) The algebraic structure may lead to attacks?

127 NIST Standard AES Block Cipher Advanced Encryption Standard (AES) AES-128, AES-192, AES-256 (3 key sizes; block size = 128 bits) Very efficient in software implementations (unlike DES) Uses Substitute-and-Permute instead of Feistel networks Has some algebraic structure Operations in a vector space over the field GF(2 8 ) The algebraic structure may lead to attacks? Some implementations may lead to side-channel attacks (e.g. cache-timing attacks)

128 NIST Standard AES Block Cipher Advanced Encryption Standard (AES) AES-128, AES-192, AES-256 (3 key sizes; block size = 128 bits) Very efficient in software implementations (unlike DES) Uses Substitute-and-Permute instead of Feistel networks Has some algebraic structure Operations in a vector space over the field GF(2 8 ) The algebraic structure may lead to attacks? Some implementations may lead to side-channel attacks (e.g. cache-timing attacks) No simple hardness assumption known to imply any sort of security for AES

129 By Jeff Moser (

130 Cryptanalysis

131 Cryptanalysis Attacking stream ciphers and block ciphers

132 Cryptanalysis Attacking stream ciphers and block ciphers Typically for key recovery

133 Cryptanalysis Attacking stream ciphers and block ciphers Typically for key recovery Brute force cryptanalysis, using specialized hardware

134 Cryptanalysis Attacking stream ciphers and block ciphers Typically for key recovery Brute force cryptanalysis, using specialized hardware e.g. Attack on DES in 1998

135 Cryptanalysis Attacking stream ciphers and block ciphers Typically for key recovery Brute force cryptanalysis, using specialized hardware e.g. Attack on DES in 1998 Several other analytical techniques to speed up attacks

136 Cryptanalysis Attacking stream ciphers and block ciphers Typically for key recovery Brute force cryptanalysis, using specialized hardware e.g. Attack on DES in 1998 Several other analytical techniques to speed up attacks Sometimes theoretical : on weakened ( reduced round ) constructions, showing improvement over brute-force attack

137 Cryptanalysis Attacking stream ciphers and block ciphers Typically for key recovery Brute force cryptanalysis, using specialized hardware e.g. Attack on DES in 1998 Several other analytical techniques to speed up attacks Sometimes theoretical : on weakened ( reduced round ) constructions, showing improvement over brute-force attack Meet-in-the-middle, linear cryptanalysis, differential cryptanalysis, impossible differential cryptanalysis, boomerang attack, integral cryptanalysis, cube attack,...

138 Authenticated Encryption

139 Authenticated Encryption Doing encryption + authentication better

140 Authenticated Encryption Doing encryption + authentication better Generic composition: encrypt, then MAC

141 Authenticated Encryption Doing encryption + authentication better Generic composition: encrypt, then MAC Needs two keys and two passes

142 Authenticated Encryption Doing encryption + authentication better Generic composition: encrypt, then MAC Needs two keys and two passes AE aims to do this more efficiently

143 Authenticated Encryption Doing encryption + authentication better Generic composition: encrypt, then MAC Needs two keys and two passes AE aims to do this more efficiently Several constructions based on block-ciphers (modes of operation) provably secure modeling block-cipher as PRP

144 Authenticated Encryption Doing encryption + authentication better Generic composition: encrypt, then MAC Needs two keys and two passes AE aims to do this more efficiently Several constructions based on block-ciphers (modes of operation) provably secure modeling block-cipher as PRP One pass: IAPM, OCB,... [patented]

145 Authenticated Encryption Doing encryption + authentication better Generic composition: encrypt, then MAC Needs two keys and two passes AE aims to do this more efficiently Several constructions based on block-ciphers (modes of operation) provably secure modeling block-cipher as PRP One pass: IAPM, OCB,... [patented] Two pass: CCM, GCM, SIV,... [included in NIST standards]

146 Authenticated Encryption Doing encryption + authentication better Generic composition: encrypt, then MAC Needs two keys and two passes AE aims to do this more efficiently Several constructions based on block-ciphers (modes of operation) provably secure modeling block-cipher as PRP One pass: IAPM, OCB,... [patented] Two pass: CCM, GCM, SIV,... [included in NIST standards] AE with Associated Data: Allows unencrypted (but authenticated) parts of the plaintext, for headers etc.

147 SKE today

148 SKE today SKE in IPsec, TLS etc. mainly based on AES block-ciphers

149 SKE today SKE in IPsec, TLS etc. mainly based on AES block-ciphers AES-128, AES-192, AES-256

150 SKE today SKE in IPsec, TLS etc. mainly based on AES block-ciphers AES-128, AES-192, AES-256 Recommended: AES Counter-mode + CMAC (or HMAC)

151 SKE today SKE in IPsec, TLS etc. mainly based on AES block-ciphers AES-128, AES-192, AES-256 Recommended: AES Counter-mode + CMAC (or HMAC) Gives CCA security, and provides authentication

152 SKE today SKE in IPsec, TLS etc. mainly based on AES block-ciphers AES-128, AES-192, AES-256 Recommended: AES Counter-mode + CMAC (or HMAC) Gives CCA security, and provides authentication Older components/modes still in use

153 SKE today SKE in IPsec, TLS etc. mainly based on AES block-ciphers AES-128, AES-192, AES-256 Recommended: AES Counter-mode + CMAC (or HMAC) Gives CCA security, and provides authentication Older components/modes still in use Supported by many standards for legacy purposes

154 SKE today SKE in IPsec, TLS etc. mainly based on AES block-ciphers AES-128, AES-192, AES-256 Recommended: AES Counter-mode + CMAC (or HMAC) Gives CCA security, and provides authentication Older components/modes still in use Supported by many standards for legacy purposes In many applications (sometimes with modifications)

155 SKE today SKE in IPsec, TLS etc. mainly based on AES block-ciphers AES-128, AES-192, AES-256 Recommended: AES Counter-mode + CMAC (or HMAC) Gives CCA security, and provides authentication Older components/modes still in use Supported by many standards for legacy purposes In many applications (sometimes with modifications) e.g. RC4 in BitTorrent, Skype, PDF