CS101 Lecture 21: Overview of Cryptography Codes and Ciphers Overview/Questions What is cryptography? What are the challenges of data encryption? What factors make an encryption strategy successful? What about public key encryption. What is it? On what assumptions does this strategy rely? 1 2 What is Cryptography? Cryptography Cryptography is the art of writing or breaking codes and ciphers. From the Greek, meaning hidden writing. Code A substitution scheme for converting plaintext into ciphertext. Cipher A scrambled message. Also called ciphertext. Why do we need cryptography? The Caesar Shift Cipher Shift characters some to the right or left. Example: SHIFT = 3 ABCDEFGHIJKLMNOPQRSTUVWXYZ DEFGHIJKLMNOPQRSTUVWXYZABC (code) Example: KHOOR JRRGEBH D GDB LQ WKH OLIH How many unique codes (shifts) are there? 3 4 1
Questions About Ciphering Uniqueness How many unique codes exist in a scheme? Difficulty How hard is it for sender/receiver to encode/decode the cipher? How hard is it for an observer to decrypt the cipher? Numbered Code Replace each character with a number A B C D E F G H I J K L M 1 2 3 4 5 6 7 8 9 10 11 12 13 N O P Q R S T U V W X Y Z 14 15 16 17 18 19 20 21 22 23 24 25 26 Example: 23 9 19 8 25 15 21 23 5 18 5 8 5 18 5 The above looks difficult, but isn t 5 6 Numbered Code + Caesar Shift A B C D E F G H I J K L M 5 6 7 8 9 10 11 12 13 14 15 16 17 N O P Q R S T U V W X Y Z 18 19 20 21 22 23 24 25 26 1 2 3 4 Example: 10 22 13 9 18 8 19 10 24 12 9 8 9 0 13 16 Alphabet Cipher Write out alphabet in rows, make column substitutions: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z Examples: NYY NYBAT GUR JNGPUGBJRE FRRX NAQ QRFGBEL There are any number of these codes This is a bit more difficult. Rating of 2 stars. 7 8 2
Another Alphabet Cipher Codeword Alphabet Cipher Write out alphabet in rows, make column substitutions: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z Z Y X W V U T S R Q P O N M L K J I H G F E D C B A Examples: XRGB LU MVD LIOVZMH There are any number of these codes Difficulty rating: 2 stars. 9 First reverse letters A B C D E F G H I J K L M N O P Q R S T U V W X Y Z Z Y X W V U T S R Q P O N M L K J I H G F E D C B A Then add a codeword shift and then remove duplicate letters. For example: codeword TABLE T A B L E Z Y X W V U S R Q P O N M K J I H G F D C Can you decrypt these examples? TREMWBT OIQUD'K LWSSERT There are any number of these codes Difficulty rating: 3 stars 10 Crypto Quote of the Day Can you decipher this hidden message? Crypto Quote of the Day How difficult is this -- how many possible codes? Each letter of the alphabet has been replaced by a different letter ter or number. Source: http://www.eastoftheweb.com 11 36 ways to choose a, 35 ways to choose b, 36! / 10! -- about 1.028 * 10 35 possible codes How would you decode it? 12 3
Decoding Ciphers The typical strategy for breaking a code is to use some known pattern in plaintext and comparing it to the ciphertext. Standard byte sequence at start of document, picture, etc. Combine pattern search with brute force (trying all possible combinations). Shift and Substitution Ciphers The most obvious problems with either shift or substitution ciphers are: Easy to crack by brute force. Sender and receiver need to agree in advance about encryption strategy. Multiple senders and one receiver? All of the senders can decode each other s messages. 13 14 Recall ASCII Encoding Remember that all data stored in the computer are in binary format. Today, text is encoded in ASCII, or UTF-8 8 scheme. ASCII Example: HELLO GOODBYE -> 01001000 01000101 01001100 01001100 01001111 00100000 01001111 01001111 01000100 01000010 01011001 01000101 Shared Key Encryption Sender and receiver agree on some encryption key. Suppose it s s long random bit sequence, as long as the plaintext message to encode. Use Bitwise XOR to encode/decode. An encryption strategy could modify the bit pattern. 15 16 4
Sender uses bitwise XOR to encode Sender Shared Key Encryption Secret key 01010101 Ciphered Transmission: 00010010 Secret key 01010101 Eavesdropper Data transmission is ciphered -- looks random Receiver uses bitwise XOR to decode Receiver 17 Shared Key Encryption Advantages: Use long random numbers, very hard to crack. XOR operation is extremely fast for both encoding and decoding. Disadvantages: Sender and receiver must agree in advance of the shared key to use. Each additional sender must get a new key, so key management becomes an issue. 18 Public Key Encryption Public Key Encryption Uses a pair of related keys for encoding/decoding information. Public key is used for encoding only. Private key is used for decoding only. A public key/private key combination is mathematically related by a shared secret. 19 Sender asks certificate authority for R s PK Sender Public Key ABABABAB CA sends R s PK to Sender Ciphered Transmission: WXYZWXYZ Sender encrypts with public key Certificate Authority Private Key BABABABA Receiver Receiver decrypts with private key 20 5
PK Assumptions Even though public/private keys are related, it is computationally infeasible to calculate private key given public key. The keys are based on products of large prime numbers. It is possible to factor, but we think it will take way too long. Actually, we don t t know for sure that it will take a long time; there could be a new method developed which makes factoring easy! PK Assumptions How long will it take to decipher by brute force? 8-bits: 2 8 or 256 possible keys to try. 64-bits: 2 64 possible keys. For a supercomputer trying a million keys per second, it will take about 585,000 years. 128-bit key: would take about 10 25 years. The universe is only about 10 10 years old 21 22 Distributing Encryption Keys Public Key Encryption PK Encryption requires a way to obtain unique encryption keys for vendors. Sender asks certificate authority for R s PK Certificate Authority VeriSign,, Inc., is a company which serves as a Certificate Authority to distribute certificates/keys. Now more than 3,000,000 certificates in its database. 23 Sender Public Key ABABABAB CA sends R s PK to Sender Ciphered Transmission: WXYZWXYZ Sender encrypts with public key Private Key BABABABA Receiver Receiver decrypts with private key 24 6
Role of Certificate Authority The CA verifies an applicant s credentials, and attests to the authenticity of the entity which owns a certificate. For example, VeriSign attests that it really is Bank of America who holds the private key to decrypt your bank password. Summary Cryptography is the art of encoding or decoding secret writing. To be effective, encryption must be easy enough to encode, and difficult to decode. Public Key encryption uses what we believe to be a hard-to to-crack bit pattern key. Important assumption is that we trust the CA! 25 26 7