Network Security: Secret Key Cryptography

Transcription

1 1 Network Security: Secret Key Cryptography Henning Schulzrinne Columbia University, New York Columbia University, Fall 2000 cfl , Henning Schulzrinne Last modified September 28, 2000

2 2 Secret Key Cryptography fixed-size block, fixed-size key! block DES, IDEA message into blocks?

3 3 Generic Block Encryption convert block into another, one-to-one long enough to avoid known-plaintext attack 64 bit typical (nice for RISC!) (peta) naive: 2 64 input values, 64 bits each! 2 70 bits output should look random plain, ciphertext: no correlation (half the same, half different) bit spreading substitution: 2 k ;k fi 64 values mapped k 2 k bits permutation: change bit position of each bit k log 2 k bits to specify round: combination of substitution of chunks and permutation do often enough so that a bit can affect every output bit but no more

4 4 Block Encryption 64 bit input 8bits 8bits 8bits 8bits 8bits 8bits 8bits 8bits S1 S2 S3 S4 S5 S6 S7 S8 key based substitution functions 8bits 8bits 8bits 8bits 8bits 8bits 8bits 8bits 64 bit intermediate permute the bits, possibly based on the key loop for n rounds 64 bit output

5 5 Data Encryption Standard (DES) published in 1977 by National Bureau of Standards developed at IBM ( Lucifer ) 56-bit key, with parity bits 64-bit blocks easy in hardware, slow in software 50 MIPS: 300 kb/s 10.7 Mb/s on a 90 MHz Pentium in 32-bit protected mode grow 1 bit every 2 years

6 6 Breaking DES brute force: check all keys 500,000 MIPS years easy if you have known plaintext have to know something about plaintext (ASCII, GIF,...) commercial DES chips not helpful: key loading time > decryption time easy to do with FPGA, without arousing suspicion easily defeated with repeated encryption

7 7 DES Overview initial permutation 56-bit key! bit per-round keys (different subset) 16 rounds: 64 bit input + 48-bit key! 64-bit output final permutation (inverse of initial) decryption: run backwards reverse key order

8 8 Permutation just slow down software ith byte! (9 i)th bits even-numbered bits into byte 1-4 odd-numbered bits into byte 5-8 no security value: if we can decrypt innards, we could decrypt DES

9 9 DES: Generating Per-Round Keys 56-bit key! bit keys K 1 ;:::K 16 : bits8,16,...,64areparity permutation split into 28-bit pieces C 0 ;D 0 : 57; 49;::: again, no security value rounds 1, 2, 9, 16: single-bit rotate left otherwise: two-bit rotate left permutation for left/right half of K i discard a few bits 48-bit key in each round

10 x Φ x =0 10 XOR Arithmetic x Φ 0=x x Φ 1=μx

11 11 DES Round mangler function can be non-reversible L = R n n+1 R n+1 = m(r n ;K n ) Φ L n R n = L n+1 decryption L n = m(r n ;K n ) Φ R n+1 because (ΦL n ;R n+1 ): R n+1 Φ R n+1 Φ L n = m() Φ L n Φ L n Φ R n+1

12 12 DES Mangler Function R(32);K(48) Φ L n! R n+1 expand from 32 to 48 bits: 4-bit chunks, borrow bits from neighbors 6-bit chunks: expanded R Φ K 8 different S-boxes for each 6 bits of data Sbox: 6 bit (64 entries) into 4 bit (16) table: 4 each four separate 4x4 S-boxes, selected by outer 2 bits of 6-bit chunk afterwards, random permutation: P-box

13 4 weak keys = C 0 ;D 0 =0:::0 or 1 :::1 own inverses: E k (m) =D k (m) semi-weak keys: E k1 (m) =D k2 (m) 13 DES: Weak Keys 16 keys to avoid: C 0 ;D ,1...1, , sequential key search avoid low-numbered keys

14 14 IDEA International Data Encryption Algorithm ETH Zurich, 1991 similar to DES: 64 bit blocks but 128-bit keys

15 +mod2 16 treat 0 as encoding for Primitive Operations 2 16-bit! 1 16-bit: Φ Ω 2 +1: 16 mod 9 reversible y inverse 8x 2 [1; 2 of ]a Ω x Ω y = a x, 16 or x Ω y =1 example: x = 2;y = Euclid s algorithm reason: is prime

16 16 IDEA Key Expansion 128-bit key! bit keys K 1 ;:::;K 52 encryption, decryption: different keys key generation: first chop off 16 bit chunks from 128 bit key eight 16-bit keys start at bit 25, chop again eight 16-bit keys shift 25 bits and repeat

17 64 bit input! 4 16-bit inputs: X a ;X b ;X c ;X d operations! output X 0 a ;X0 b ;X0 c ;X0 d odd rounds use 4K i : K a ;K b ;K c ;K d even rounds use 2K i : K e ;K f 17 IDEA: One Round 17 rounds, even and odd

18 X 0 a = X a Ω K a X 0 d = X d Ω K d X 0 c = X b + K b X 0 b = X c + K c X 0 a Ω K 0 a = X a Ω K a Ω K 0 a 18 IDEA: Odd Round reverse with inverses of K i :

19 Y in = X a Φ X b Y out = ((K e Ω Y in + Z in ) Ω K f X 0 a = X a Φ Y out X 0 b = X b Φ Y out X 0 c = X c Φ Z out X 0 d = X d Φ Z out 19 IDEA: Even Round mangler: Y out ;Z out = f(y in ;Z in ;K e ;K f ) Z in = X c Φ X d 3. Z out = K e Ω Y in + Y out

20 X 0 a = X a Φ Y out = X 0 a Φ Y out = (X a Φ Y out ) Φ Y out 20 IDEA Even Round: Inverse Feed X 0 a to input: = X a round is its own inverse! same keys

21 21 Encrypting a Large Message Electronic Code Book (ECB) Cipher Block Chaining (CBC) k-bit Cipher Feedback Mode (CFB) k-bit Output Feedback Mode (OFB)

22 22 Electronic Code Book (ECB) break into 64-bit blocks encrypt each block independently some plaintext same ciphertext easy to change message by copying blocks bit errors do not propagate rarely used

23 23 Cipher Block Chaining (CBC) simple Φ fix: blocks with 64-bit random number must keep random number secret repeats in plaintext 6! = ciphertext can still remove selected blocks

24 24 Cipher Block Chaining (CBC) random number r i+1 = c i : previous block of ciphertext random (but public) initialization vector (IV): avoid equal initial text Trudy can t detect changes in plaintext can t feed chosen plaintext to encryption but: can twiddle some bits (while modifying others): c modify n to change m desired n+1 m (and n ) combine with MICs

25 25 Output Feedback Mode (OFB) 64-bit OFB: encrypt encrypt IV:! b 1! b 2 ::: 0 b = m i Φ b i i, transmit with IV c ciphertext damage limited plaintext damage can be transmitted byte-by-byte but: known plaintext modify plaintext into anything extra/missing characters garble whole rest variation: k-bit OFB

26 26 Cipher Feedback Mode (CFB) similar to OFB: generate k bits, Φ with plaintext use k bits of ciphertext instead of IV-generated can t generate ahead of time 8-bit CFB will resynchronize after byte loss/insertion requires encryption for each k bits

27 27 Generating MICs only send last block of CBC CBC residue any modification in plaintext modifies CBC residue replicating last CBC block doesn t work P+I: use separate (but maybe related) secret keys for encryption and MIC two encryption passes CBC(message j hash)

28 two keys K 1, K 2 K 1 K 2 K 1 K 1 K 2 K 1 28 Multiple Encryption DES applicable to any encryption, important for DES encrypt-decrypt-encrypt (EDE): just reversible functions # # #! E! D! E! c m decryption just reverse: # # # standard CBC c! D! E! D! m

29 29 Triple DES: Why 3? security $ efficiency K 1 = K 2 : twice the work for encryption, cryptanalyst A:E(K 1 ) 2) r plaintext! c B:E(K i! i m (ciphertext) not quite equivalent to 112 bit key: assume (m given ;c 1 ); (m 2 ;c 2 ); (m 3 ;c 3 ) 1 2 Table (10 A: TB) entries: r = Kfm 56 g8k,sortbyr Table B: r = c entries: 56 1 decrypted with K,sorted find matching r K A ;K B if multiple K A ;K B pairs, test against m 2 ;c 2,etc values, 2 56 entries 1/256 chance to appear in table 2 48 matches

30 30 Triple DES: Why 3? Table A: abcd00 ab abcd abcd ab8348a abcd08 185ab c... r = E(m 1 ;K) (64 bits) K (56 bits) Table B:

31 31 = D(c 1 ;K) (64 bits) r abcd abcd abcd abcd09... (56 bits) K 38acd043858ac ab8a8d8a0 058a0fa858abcd fd884a computation:

32 32 Triple DES EDE: can run as single DES with K 1 = K 2 can be used with any chaining method CBC on the outside no change in properties CBC on the inside avoid plaintext manipulation but want self-synchronizing: wrong bit x in block n 1 n 1 garbled, n x changed, others unaffected CBC inside: parallelization