Cryptography

1
Cryptography

• Lynn Ackler
• Southern Oregon University

2
Information Assurance

• Keep information in a known and trusted state
  that can be used appropriately.

3
NSA Information Security Model
Information States
Transmission
Storage
Processing
Security Measures
Training
Confidentiality
Policies
Critical Information Characteristics
Technology
Integrity
Availability
4
Cryptography Introduction Chapter 1

• Cryptography - Services
• Confidentiality
• Authentication
• Integrity
• Nonrepudiation

5
Encryption/Decryption

• Render text unreadable
• Plaintext message to be scrambled
• Encryption scrambling the message
• Ciphertext scrambled message
• Decryption unscrambling the ciphertext

6
Cryptography

• Cryptography
• Art and science of encryption techniques
• Cryptographers
• Cryptanalysis
• Art and science of braking encryption
• Cryptanalysts
• Cryptology
• Branch of mathematics studing both cryptography
  and cryptanalysis

7
Encryption/Decryption
Original Plaintext
Plaintext
Ciphertext
Encryption
Decryption
M
C
M
E(M) C
D(C) M
D(E(M)) M
8
Keys(Magic decoder rings)

• Secrecy by obscurity
• Secret algorithm
• Secrecy via a secret
• Keys, usually a number kept secret
• Algorithm is public and studied
• Keyspace
• Set of all possible keys
• Should be big

9
Symmetric Key Cryptography

• Key to encrypt is the same as to decrypt
• Usually very fast
• Problem is to distribute the key
• Block ciphers/algorithms
• Stream ciphers/algorithms

10
Encryption/Decryption
Key
Key
Original Plaintext
Plaintext
Ciphertext
Encryption
Decryption
M
C
M
EK(M) C
DK(C) M
DK(EK(M)) M
11
Asymmetric Key Cryptography

• Key to encrypt is different from the key to
  decrypt
• Usually very slow
• Distribution is not a problem
• Block algorithm only

12
Encryption/Decryption
Decryption Key
Encryption Key
Original Plaintext
Plaintext
Ciphertext
Encryption
Decryption
M
C
M
EK1(M) C
DK2(C) M
DK2(EK1(M)) M
13
Public - Key Cryptography

• Two keys
• Public key
• Private key
• If one is used to encrypt the other must be used
  to decrypt.

14
Cryptanalysis

• Break the encryption
• Attack a cryptanalysis attempt
• Compromise loss of a key

15
Standard Attacks

• Cryptanalytic attacks
• Ciphertextonly attack
• Knownplaintext attack
• Chosenplaintetxt attack
• Adaptivechosenplaintext attack
• Chosenciphertext attacks
• Rubberhose attack

16
Ciphertext-only Attack

• Ciphertext of several messages
• Same key, hopefully
• Same algorithm
• Goals
• Recover plaintext and/or key/keys
• Example
• Encrypted hard drive

17
Known-plaintext Attack

• Plaintext and Ciphertext of several messages are
  known
• Same key, hopefully
• Same algorithm
• Goals
• Recover key/keys
• At least recover the next messasge
• Example
• A collection of e-mails

18
Chosen-plaintext Attack

• Plaintext and Ciphertext of several messages are
  known
• Can have ciphertext for any chosen plaintext
• Same key and algorithm
• Goals
• Recover the key
• At least recover the next message
• Example
• Encrypted bank deposits to your account

19
Chosen-ciphertext Attack

• Any Ciphertext can be decrypted
• Same key and algorithm
• Goals
• Recover the key
• Example
• Breaking a tamper proof crypto box

20
Rubber Hose Attack

• Uncooperative person
• Goals
• Recover the key
• Recover password
• Example
• Any one with a secret
• Technique
• Sex, Money and Pain

21
Security of Algorithms

• If the cost to break is greater than the value of
  the data, you are probably safe.
• Not always though.
• Seti at home

22
Categories of Breaks

• Total break
• Algorithm and key is deduced
• Global deduction
• An alternative algorithm is found
• Local deduction
• The plaintext is found for a single intercepted
  ciphertext
• Information deduction
• Format of plaintext, a few bits of the key, etc.

23
Security Levels

• Unconditionally secure
• One time pad
• Conditionally secure
• Brute force attack
• Computationally secure

24
Steganography

• Data hiding in plain sight.
• Often is not invariant under data compression.

25
Substitution Ciphers

• Alphabet substitution
• Monoalphabetic letter for letter
• Homophonic one or more for a letter
• Polygram block for block
• Polyalphabetic multiple simple substitutions
• Substitution algorithms
• Caeser Cipher rotate n mod 26
• Modulo arithmetic
• Lookup tables

26
Transposition Cipher

• Plaintext in rows
• Ciphertext from the columns

t h e q u i c k b r o w n
  f o x j u m e d o v e r
  t h e l a z y d o g    
Ciphertext t hfteoh xeq ujliuacmz key d b d
rooovgwe nr
27
Simple XOR

• XOR '' in C, Å in mathematics
• 0 Å 0 0
• 0 Å 1 1
• 1 Å 0 1
• 1 Å 1 0
• Note
• a Å 0 a
• a Å a 0
• (a Å b) Å b a

28
Simple XOR Encryption

• Key K
• Messag M
• Ciphertext C M Å K
• Message M C Å K (M Å K) Å K
• M Å (K Å K) M

29
One-Time Pads

• The one time pad is a substitution cipher with a
  very very long random substitution key.
• Statistically it is perfectly secure.

30
One-Time PadsProblems

• The key must be a random sequence of characters.
• The pad can be used only once.
• Both parties must have the exact same pad.
• If one character is dropped everything afterward
  is lost.

31
One-Time PadsUses

• Low bandwidth communication.
• Ultra secure communication.
• Forever secure.