INTRODUCTION TO CRYPTOGRAPHY

INTRODUCTION TO CRYPTOGRAPHY AUTHOR: ANAS TAWILEH anas@tawileh.net Available online at: http://www.tawileh.net/courses/ia This work is released under a Creative Commons Attribution-ShareAlike 2.5 License

Why do I Need Cryptography? Information transmitted on communication networks is usually sent in clear text. This means that the original form of the text is encoded and sent over the communications channel as it is. In this case, particularly when information is sent over a public network (such as the Internet), people interested in stealing your information may be able to intercept the traffic and reassemble the original message. Consider the scenario in Figure 1: Bob wants to send a piece of critical information to Sara through the network. He write his messages and sends it in clear text over the communication network, hoping that it will be opened only but its recipient, Sara. Bob failed to consider the potential risks that might face this transmission, namely, a bad guy looking for information that could be exploited listening to the conversation. Peter is sitting in between, sniffing all messages sent from Bob to Sara, on the hope that he can extract some useful information. When the message that contains the sensitive information arrives, he copies it. Because the message was sent in clear text, he can easily read its content with very little effort. Figure 1; Communicating in Clear Text Hi Sara, Here is your new credit card number: 4235 2123 2354 3452 2 1 Sara 3 Bob Peter Hi Sara, Here is your new credit card number: 4235 2123 2354 3452 Another risk that may be associated with electronic transmission of data is the impersonation of other people s identity. For example (Figure 2), Peter can intercept a message sent from Bob to Sara, change its content, and send it again so that Sara still believes it was legitimately sent by Bob. 2

Figure 2: Tampering with Messages You can transfer money from your account by logging into: www.peterbank.com You can transfer money from your account by logging into: www.hsbc.co.uk How easy e- banking is! 6 5 2 1 Sara Bob 4 3 You can transfer money from your account by logging into: www.hsbc.co.uk www.peterbank.com Peter Data encryption can be used to mitigate these risks by changing the information sent in a particular way to prevent eavesdroppers from extracting this information from messages traversing the network. It can also prevent someone from impersonating the identities of legitimate users, and therefore deceiving other users to engage in activities that will benefit his/her malicious intentions. How Cryptography Works? Cryptography is used to protect private information by converting clear text messages into cipher text. This conversion is executed by using a cipher. Let s assume that Bob wants to send the following message to Sara: Your account is now activated. This will be the clear text message, anyone who can intercept the communication can easily understand what Bob is telling Sara, and the conversation is not private anymore. Instead, Bob may decide to use the following cipher (Julius Caesar s cipher) to convert the clear text message to a cipher text that can not be understood by eavesdroppers: for each letter in the text, I will replace it with the next letter in the alphabet. Now, by applying this cipher to the original message, the message becomes ciphered or encrypted. Figure 3 illustrates this process. The resulting cipher text reads as follows: Zpvs bddpvou jt opx bdujwbufe. Obviously, if someone intercepts this message, it is much more difficult to interpret it than when it was sent in clear text. However, when this message reaches Sara, she can only decipher it if she has the same cipher. So, in order for encryption to work, the communicating parties should agree on a common cipher. This cipher should be kept secret among the legitimate communicating parties, because if it falls in the hands of the bad guys, they can use it to easily decipher the messages, rendering the whole encryption system useless! 3

Figure 3: Ciphering Your account is now activated Y > Z O > P U > V R > S A > B T > U C > D I > J S > T N > O V > W E > F D > E W > X Zpvs bddpvou jt opx bdujwbufe This is not to say that the cipher text will be impossible to crack. Actually, there is a dedicated field of science called Cryptoanalysis that looks into ways of breaking ciphered texts without having access to the cipher key itself. The previous example is quite an easy one to break. There are many ciphers that are much more complex and difficult to crack. However, it should be understood that encryption does not protect information forever. Using appropriate tools and methods, with a generous dose of persistence, any encrypted text can be broken. The question here is now long breaking a particular text would take. The massive development in computing capabilities has enabled the creation of very powerful encryption methods that would take hundreds or thousands of years to break. By the time the encrypted text can be broken into, it is very unlikely that the information it contains will hold any meaningful value. Encryption has two components: the encryption algorithm and the encryption key. In the Caesar s cipher used in the previous example, the algorithm can be described as follows: substitute every letter with the letter that is x letter after in the alphabet where x is the key used (x=1 in the above mentioned example). Therefore, when Bob sends his message to Sara, he asks her to use the Caesar s algorithm with a key value of 1. The only thing that has to be kept secret is the key, and the algorithm can be made public. Of course, algorithms and keys used to encrypt data in computer systems are much more complex, but all conform to these basic principles. How Can Cryptography Protect Me? Cryptography can help protecting the confidentiality of your information and communications in several ways, including (but not limited to): Encrypting files on your hard disk drive or any other storage media so that no one can get access to the information stored in these files other than you. Encrypting messages you send to other people to prevent eavesdroppers from sneaking into your conversations. Digitally sign your documents and emails in such a way as to enable the validation of their origin and preventing others from impersonating your identity. Digitally sign your documents and email so that others can make sure that no one has tampered with their content while in transit. Encrypting information transmission channels, such as accessing web pages or conducting online banking, to prevent the theft of your private or sensitive information. 4

Verify the validity of documents and emails signed by others to ensure their authenticity and that no one has tampered with their content while in transit. Types of Cryptography As explained earlier, Cryptography has two components: the cryptographic algorithm and the encryption key. Usually, cryptographic algorithms are made public, while encryption keys are protected and securely saved. In order for two parties to communicate securely, they should agree on a common algorithm and use the same encryption key. This is called Symmetric Cryptography because both the sender and receiver use the same shared key to encrypt and decrypt messages. Figure 4 illustrates the steps of symmetric cryptography. In this example, even if Peter will intercept the message, he can not decrypt its content unless he knows the shared key used to encrypt it. Figure 4: Symmetric Cryptography Hi Sara, Here is your new credit card number: 4235 2123 2354 3452 Hi Sara, Here is your new credit card number: 4235 2123 2354 3452 7 1 Shared Key Algorithm Decrypt Encrypt Shared Key Algorithm 6 5 3 2 Sara Bob Useless! 4 Kkjkcsh s&%$&q SJ123 ^w283 djh dwq8 &^%^ %$ ashdh z8as76qwejy j Peter Symmetric cryptography is based on the previous knowledge of the communicating parties of the shared key. For example, is a third person (Jack) wants to encrypt a message destined for Bob, he can not do so without knowing the shard key used by Bob. It might seem obvious that Bob can send his shared key to Jack to enable him to encrypt and decrypt messages, but how? What if Peter intercepts this communication and obtains a copy of the shared key? Peter will be able then to decrypt any messages using this key. Symmetric cryptography has another limitation as well. In order to enable anyone to encrypt the messages he wants to send to Bob, he should obtain Bob s shared key. This will allow this person to use this shared key to decrypt messages sent to Bob, or even encrypted files on Bob s hard disk. Furthermore, because the encryption key is shared among all communicating parties, it can be used to verify authenticity of origin and digitally sign documents or emails. 5

Asymmetric cryptography was developed to overcome these limitations. In asymmetric cryptography, users do not have a single shared key. Instead, the user will have a pair of keys: a private key and a public key. These keys work in conjunction with each other as follows: information encrypted with someone s public key can only be decrypted using this person s private key. In addition, the private key can be used to digitally sign messages. Digital signatures generated using someone s private key can only be verified using this person s public key. Because of this separation of keys, the user can easily distribute her public key without compromising the confidentiality of information encrypted with this public key, as this information can only be decrypted with her own private key. This means, however, that special care should be taken to protect the private key (also referred to as the secret key). Before sending any encrypted messages to a particular person, the public key o this person should be obtained. This can happen in several ways. For example, the owner of the public key may distribute it to his friends and colleagues as an email attachment, on a floppy disk or on a USB token. Also, the public key may be published on the web in an online directory service. Several services provide free hosting for public keys, such as PGP Global Directory (https://keyserver.pgp.com/vkd/getwelcomescreen.event). The public key is basically a piece of text, and is usually distributed in the form of a text file. Figure 5: Asymmetric Cryptography 1 Hi Sara, Here is your new credit card number: 4235 2123 2354 3452 7 Internet Hi Sara, Here is your new credit card number: 4235 2123 2354 3452 2 Sara s Public Key Sara s Private Key Algorithm Decrypt Encrypt Sara s Public Key Algorithm Sara 6 4 3 Bob 5 Sara s Private Key Kkjkcsh s&%$&q SJ123 ^w283 djh dwq8 &^%^ %$ ashdh z8as76qwejy j In the example shown in Figure 5, Bob wants to enhance the security of his communications with Sara by using asymmetric cryptography. First of all, he searches an online directory to locate and obtain 6

Sara s public key (we are here assuming that Sara already has a public/private key pair, and that her public key is published somewhere on the web). After he obtains Sara s public key, Bob can use this key to encrypt the message he want to send to Sara, confident that no one but her can actually decrypt the message. When Sara receives the message, she accesses her private key from its safe storage location. Depending on the software being used for encryption purposes, it may be asked for a certain passphrase each time she wants to access her private key in order to prevent misuse of this very important key. Sara then can use her own private key, in combination with the appropriate algorithm, to decrypt the incoming message. Using asymmetric cryptography is based on the availability of the public key of each participant of the encrypted information. This means that you have to collect the public keys for all the people with whom you may need to communicate securely. Keyrings are used to facilitate storage and management of the increasing number of public keys. Let s assume that Bob needs to communicate securely with three friends: Sara, Jack and Mona. After collecting the public key of each of his friends, Bob s keyring will contain the following: Bob s Private Key Bob s Public Key Sara s Public Key Jack s Public Key Mona s Public Key When Bob starts to use electronic mail to communicate with more friends and colleagues, the size of his keyring will grow proportionally. The increasing dependence on the Internet as a facilitator of almost every kind of human activity will certainly lead to significantly larger keyrings. Managing keyrings of such sizes will be an arduous task, and placing appropriate levels of trust in each key becomes virtually impossible. Public Key Infrastructures (PKI) were developed to address these issues. They facilitate the process of obtaining, distributing, trusting and managing cryptographic public keys and streamline the implementation of secure electronic communications infrastructures. 7

Practice Labs: Encryption Tools Windows Privacy Tools (WinPT) is an open source collection of tools for digital encryption released under the GNU Public License (GPL). It can be downloaded freely from the following website: http://winpt.sourceforge.net/en/download.php 1. Installing WinPT After downloading the WinPT package from the website, double click on the downloaded file, the Installation wizard will start. First, select the language you prefer for the installation, and click OK. In the Welcome dialogue, simply click Next. Next, you will be presented with the License Agreement dialogue. You have to accept the terms of the GNU General Public License before you can process with the installation. If you accept this license agreement, click I Agree. 8

The installation wizard will then prompt you to select the location where you want WinPT to be installed. Make sure you have selected the appropriate location, and click Next. In the next step, you can select the components you would like to install. For this exercise, accept the default settings and click Next. 9

The following dialogue screen will ask you to determine the Windows Start Menu folder to place WinPT in. If you do not have specific preferences, accept the default settings and click Next. Now select the start-up options for your WinPT setup. You can choose to Launch WinPT at Windows startup or Create a Quicklaunch link for WinPT. Here also you decide on the language you want to use in dealing with the program. When you are happy with these settings, click Next. 10

This step is very important for the successful operation of the software. First of all, select the GnuPG version you want to use. It is highly recommended that you use the default recommended option (GnuPG). If you want to change this, please make sure that you know exactly what you are doing. Then check the file types you want to associate with WinPT and, most importantly, select the folder in which you want to store your PGP keys. You should be very careful in protecting this folder. As we have seen earlier, your encryption is only valid as long as your encryption key remains secret. When you are done setting these options, click Install. WinPT will now install into your machine. This will take few moments. When the installation process is completed, you will be presented with the option to run WinPT immediately. 11

2. Configuring WinPT To start WinPT, click: Start > All Programs > Windows Privacy Tools > WinPT Tray. During its initialisation, WinPT will look for your key pair to be used in encrypting and decrypting information. Your key pair consists of your private and public keys. You use the private key to encrypt messages you send to others and to decrypt messages sent to you, as well as to digitally sign your documents and emails. The public key is sent to everyone who want to communicate with you, and is used by others to encrypt messages destined for you and to verify documents and emails signed by you. Because this is the first time you start WinPT, the program will not be able to locate your key pair. A dialogue window will ask you whether you want to continue with the configuration of the program. Click Yes. WinPT will then give you the choice to generate your key pair, import the key pair from another location and to specify a directory from which to access existing GPG keyrings. As you have not yet created your own key pair, select the first option and click OK. From the following dialogue box, choose the type of the key pair you want to generate (you can use the default option: DSA and ELG), the required subkey size (the larger the better, though that will take more time to generate) and enter your personal details (User name, optional comments and your email 12

address). You can also determine the expiry date of your key, when this date elapses, your keys will cease functioning. Lastly, type the passphrase you want twice. Please make sure that you select a good password. It generally recommended that you pick a password longer than 8 or 10 characters which includes alphanumerical and special characters. Always avoid the use of dictionary words or phrases that are easy to guess (such as your pet s name or your date of birth). When you have finished adding these information, click Start to initiate the key pair generation process. This process can take some time, so be patient! From the following dialogue box, choose the type of the key pair you want to generate (you can use the default option: DSA and ELG), the required subkey size (the larger the better, though that will take more time to generate) and enter your personal details (User name, optional comments and your email address). You can also determine the expiry date of your key, when this date elapses, your keys will cease functioning. Lastly, type the passphrase you want twice. Please make sure that you select a good password. It generally recommended that you pick a password longer than 8 or 10 characters which includes alphanumerical and special characters. Always avoid the use of dictionary words or phrases that are easy to guess (such as your pet s name or your date of birth). When you have finished adding these information, click Start to initiate the key pair generation process. This process can take some time, so be patient! WinPT will give you a message when the key generation process is completed. Click OK on this dialogue box. Your key pair is extremely important to enable you to encrypt and decrypt digital information. If you lose your key pair, and your private key in particular, you will not be able to recover information that you have previously encrypted. You should take tremendous care in protecting and saving your key pair. After your key pair is generated, WinPT will warn you of its importance and ask you to store it in a backup location. Please make sure that the backup media is stored in a very safe place, as theft of its content can reveal your private key, and consequently would enable others to break into your encrypted information. 13

Congratulations! You have now successfully installed and configured WinPT and will be in no time able to encrypt and protect your personal information. 3. Using WinPT 3.1. Encrypting Files Now that you have installed and configured WinPT, you can use it to encrypt any files you think need to be protected. Before you start, please make sure that WinPT is running in the system tray. Encrypting files using WinPT is very simple and straightforward. From within Windows Explorer, identify the file you want to encrypt. Right click on the file name (or icon) and from the dropdown menu, select WinPT. You will have several options to select from. You can encrypt the file, sign it or wipe it. For this exercise, you will focus on encrypting the file, while the other options will be discussed later. To encrypt the file, click Encrypt. You should decide who will be able to decrypt this file in order to use the correct public key for encrypting it. WinPT will use the selected public key to encrypt the file so that only the person who owns the corresponding private key can decrypt it. Of course this person may be you, you may want for instance to protect the privacy of your own information. In this case, you would use your own public key to encrypt the file. Because you may have several keys in your keyring, WinPT will present you with a dialogue box showing all the keys in your keyring, requesting you to select the key you want to use to encrypt the file. In this example, you want to encrypt the file for your own purposes, you do not want it to be decrypted by anyone else. Therefore, select your own key from the dialogue box and click OK. 14

WinPT will encrypt the file using the public key of the selected user. The encrypted file will be named: <Original-File-Name>.gpg If you have selected the Wipe Original option from the previous dialogue box, WinPT will destroy the original file. In this case, there will be no way to recover the information in the original file other than decrypting the newly encrypted file. 15

When you want to decrypt the file, right click on its name (or icon) in Windows Explorer. From the drop down menu, click Decrypt/Verify. If you have not deleted the original file, WinPT will recognise its existence, and prompt you to accept or reject overwriting it. Accept overwriting the old file by Clicking OK. You will be asked then to enter the pasphrase to access the private key that can decrypt the file. Enter your passphrase and click OK. WinPT will decrypt the file for you. 3.2. Signing Files You sign a file to inform the receiver that this file has been originated from you and not from someone impersonating your identity. When signing a file, your private key is used to generate a digital signature (a small piece of text) which authenticity can be verified using your public key. Because you are the only one having access to your private key, no one can generate your signature but yourself. The digital signature that you have produced can be embedded within the signed file itself, added into a separate file or presented as a piece of text that you can copy and paste wherever you want. To sign a file using WinPT, right click the file name (or icon) in Windows Explorer. From the WinPT menu, click Sign. You will be asked for the private key you want to use to produce the digital signature. Select the key you want to use from the drop down menu. You will need also to enter the passphrase to enable access to your selected private key. Then, choose the output option for the digital signature: you can generate the file in a Detached Signature file, or a piece of Text Output, or alternatively, I you do not check any of these options, to embed it in the original file. Remove the check mark next to the Detached Signature option to embed the signature in the original file and click OK. 16

WinPT will generate the digital signature and embed it in a new copy of the original file named: <original-file-name>.sig Now, when someone receives this file, she can easily verify its authenticity (which basically means that this file was really originated form you). However, in order to be bale to verify your signed file, the person attempting to do so must obtain a copy of your public key. To verify a signed file using WinPT, right click on the file name (or icon) in Windows Explorer. From the drop down menu, click Verify. WinPT will look in your keyring for the public key associated with the private key used to produce this digital signature. If the public key is found, the private key is checked against it, and if it matches, WinPT gives you the following message. This means that the signature is genuine and the file can be dealt with in confidence that you have personally signed it. If WinPT can not find the associate public key, the following message is displayed, informing you that the signature could not be checked due to a missing key. 17

3.3. Encrypting Emails Before you can encrypt emails sent to others, you have to obtain the public key of each recipient you wish to send encrypted messages to. In addition, you have to make your public key available for others if you want them to encrypt messages destined to you. Let s start by publishing your public key. First, you have to decide on the method you want to use to publish your public key. You can manually distribute your key to your friends as an email attachment or using any other media (such as a floppy disk, CD-ROM or a USB memory token). There will be no security risks associated with doing this as your public key is intended to be published. However, using this option will limit the number of people who can send you encrypted messages to those who have already received your public key. Another approach would be to publish your public key on a key directory on the Internet. Many websites provide such functionality for free, for example, PGP has a key directory service (PGP Global Directory) that can be accessed on the following website: https://keyserver.pgp.com/vkd/getwelcomescreen.event When you publish your public key through an online directory service, anyone who wants to send you and encrypted message can search this directory for your public key, download it, add it to her keyring and use it to encrypt the messages she wants to send you. You can also use the same service to find public keys for people you want to communicate with securely. Public keys are usually distributed in a text file form. In order to export your public key from your keyring, follow these steps: From the Windows system tray, right click the WinPT icon and select Key Manager. The Key Manager window will be displayed. This window will show you all the keys you have in your keyring. Click on your own key and then click Key > Export. Caution: make sure you do not export your private key unless you have a very good reason, WinPT will warn you if you do so by mistake. You will be asked then to select the location where you want to save your public key file and the file name you want to use. After you make your selection, click Save. 18

WinPT will confirm that your public key has been successfully exported. You can now distribute your key to your friends (or publish it in an online directory) by sending the file you have just generated. To complete this lab, send this file to one of your friends as an e-mail attachment. Now, let s assume that you have received the public key of one of your friends, and you want to add it to your keyring. You should have obtained the public key in a text file, make sure you place this file in a continent location. Next, from the Key Manager window, click Key > Import. Select the name of the public key s text file and click Open. 19

You will get a window showing all the public keys within this file. Select from this list the name of the key you want to add to your keyring and click Import. WinPT will display a dialogue box containing statistics about the successful import operation. Have a look at the information provided, and click OK. Note that your friend s public key has been added successfully to your keyring. You can now send her encrypted emails and verify emails and files signed by her. Congratulations! 20

Now that you have published your public key and obtained your friends private keys and added them to your keyring, you can start communicating with each other securely. WinPT has plug-ins for two mail clients: Microsoft Outlook Express and Eudora. In this lab, you will use the Microsoft Outlook Express plug-in. Before you start, make sure that the plug-in loader is started. Double click on the file: GPGOEInit.exe in the GPGOE folder located within your WinPT installation directory. A small icon will indicate that this program is working in the Windows system tray. Start Outlook Express and type an email message to your friend in exactly the same way as you would do normally. The critical point here is that the destination email address of the message should exactly match one of the public keys in your keyring. When you finish writing the message, and before sending it, click the Encrypt message button in the toolbar. A small lock will appear next to the (To:) field, indicating that this message will be encrypted. Now click Send. A dialogue box will appear, including the names of all recipients for which you have a public key in your keyring. Select the names of the message recipient(s) and click OK. 21

WinPT will encrypt the message before Outlook Express sends it to the recipient s email. You can be confident that no one will be able to intercept and understand this message on transit. Only the recipient who owns the corresponding private key can decrypt this message. When you receive an encrypted message, you should have the private key associated with the public key used to encrypt this message in order to be able to decrypt it. Double click on the encrypted message in Outlook Express to open it. The decrypt message dialogue box will appear, asking you for the passphrase to access your private key. Type in your passphrase and click OK. WinPT will use your private key to decrypt the message and display the original clear text content. 22

3.4. Signing Emails Public-private key cryptography can be used to maintain the authenticity of information in addition to keeping it secret. This can be achieved by signing files and emails. When an email for example is signed, a digital signature is generated using the signing user s private key. This digital signature can be verified by using the same user s public key. As no one has access to the private key but the signing user himself, the authenticity of the origin of the communication can be established. To sign a e-mail message using your own private key, type in the message normally in Outlook Express then click the Sign button in the toolbar. A small icon will appear next to the (To:) field indicating that this message will be signed by the sender. Click Send. A dialogue box will appear listing all the private keys you have in your keyring. Select the private key you want to sign the message with and click OK. You will be then promoted to type in the passphrase to access your private key. Type in the passphrase and click OK to sign and send the message. If you receive a signed message, you should verify its authenticity. This will require you to have the sender s public key in your keyring. You can obtain the sender s public key and add it to your keyring as mentioned above. To verify the authenticity of a message, double click on the message in Outlooks Express to open it. WinPT will check the digital signature contained within the message and present the results in a 23

dialogue box. If the digital signature matches the sender s public key, WinPT will inform you that the signature is good and show you the name of the signing body. Remember that you can also combine encryption with digital signatures to provide both confidentiality and authenticity of information. 24