Break the Code

Codes, Ciphers and Secret Writings.

Transcript

1. Break the Code Codes, Ciphers and Secret Writing Kent Wang @pragkent
2. Cryptography is everywhere
3. Crypto core 1. secret key establishment 2. secure communication ??? …
4. Same key Symmetric Ciphers E D m c = E(k, m) c m k k
5. Historical Ciphers
6. Caesar Cipher E D m c = E(k, m) c m k k SHIFT = 3 Examples: E(k, “ABC”) = “DEF” D(k, “DEF”) = “ABC” 25 Key Space
7. Lesson 1: The key space should be large enough!
8. Substitution Cipher E D m c = E(k, m) c m k k A -> C B -> F C -> K … Examples: E(k, “ABC”) = “CFK” D(k, “CFK”) = “ABC” 26! Key Space 288 ≈
9. Break Substitution Cipher 0 3.25 6.5 9.75 13 e t a o i n s h r d 0 5 10 15 20 e s d t n y r o l f Top 10 Letters Top 10 End Of Word Letters
10. Lesson 2: Ciphertext should not leak anything about plaintext!
11. Modern Ciphers
12. – Claude Shannon Ciphertext should reveal no “information” about plaintext.
13. Information Theoretic Security A cipher (E,D) over (K,M,C) has perfect secrecy if ∀m 0 ,m 1 ∈M (|m 0 |=|m 1 |) and ∀c∈C Pr[E(k,m 0 )=c] = Pr[E(k,m 1 )=c] where k⟵K Given ciphertext can’t tell if msg is m 0 or m 1 Adversary learns nothing about plaintext from ciphertext No ciphertext only attack! (but other attacks possible)
14. The One Time Pad 0 1 0 1 1 1 1 1 0 0 1 0 ⊕ msg key 1 0 0 1 0 1 CT Pros. Pr[E(k,m)=c] = # keys s.t. E(k,m) = c / |K| = 1 / |K| => OTP has perfect secrecy Cons. Key length >= message length => Hard to use in practice
15. G Stream Ciphers G(k) ⊕ m c k PRG: Pseudorandom Generator G G(k) ⊕ c k PRG: Pseudorandom Generator m E D
16. Two time pad is insecure c1 = m1 ⊕ PRG(k) c2 = m2 ⊕ PRG(k) c1 ⊕ c2 = m1 ⊕ m2 Example: m1 = “ ” m2 = “a” k = “1” c = c1 ⊕ c2 = m1 ⊕ m2 = “ ” ⊕ “a” c ⊕ “ ” = “a” m1 ⊕ m2 => m1, m2 crib dragging
17. Real world examples client server MS-PPTP (windows NT): k k C0 C1 S0 S1 (C0||C1)⊕G(k) (S0||S1)⊕G(k) Need different keys for client -> server and server -> client
18. Lesson 3: Never use stream cipher key more than once!
19. Block Ciphers E D m key key PT block PT block CT block n bits n bits n bits k bits 3DES: n = 64 bits, k = 168 bits AES: n = 128 bits, k = 128, 192, 256 bits
20. key expansion Block Ciphers key k R(k1, ·) R(k2, ·) R(kn, ·) 3DES: n = 48 AES: n = 10 m c k1 k2 kn Round function
21. ECB mode m1 m2 c1 c2 PT: CT: Electronic Code Book (ECB): Problem: If m1 = m2 then c1 = c2
22. ECB mode Problem: If m1 = m2 then c1 = c2
23. Lesson 4: Never use block cipher ECB mode!
24. - CPA Security “If secret key is to be used multiple times, given the same plaintext message twice, encryption must produce different outputs.”
25. CTR Mode m[0] IV IV m[1] m[2] m[3] c[0] c[1] c[2] c[3] ⊕ choose randomly F(k, IV) F(k, IV + 1) F(k, IV + 2) F(k, IV+3)
26. CBC Mode - Encryption m[0] E(k, ·) IV IV m[1] m[2] m[3] c[0] c[1] c[2] c[3] ⊕ ⊕ E(k, ·) ⊕ E(k, ·) ⊕ E(k, ·) choose randomly
27. CBC Mode - Decryption m[0] D(k, ·) IV IV m[1] m[2] m[3] c[0] c[1] c[2] c[3] D(k, ·) D(k, ·) D(k, ·) ⊕ ⊕ ⊕ ⊕
28. CPA Analysis Note: CBC is only secure as long as q2L2 << |X|. AdvCPA [A, ECBC ] ≤ 2⋅PRP Adv[B, E] + 2 q2 L2 / |X| q = # messages encrypted with k , L = length of max message Suppose we want AdvCPA [A, ECBC ] ≤ 1/232 ⇐ q2 L2 /|X| < 1/ 232 • AES: |X|=2128 ⇒ qL<248 => after 248 AES blocks, must change key • 3DES: |X|=264 ⇒ qL<216 => after 216 3DES blocks, must change key
29. CBC Mode - Padding m[0] E(k, ·) IV IV m[1] m[2] m[3] || pad c[0] c[1] c[2] c[3] ⊕ ⊕ E(k, ·) ⊕ E(k, ·) ⊕ E(k, ·) choose randomly TLS: for n > 0, n byte pad is n n … n
30. Comparison: CTR vs. CBC CBC CTR uses PRP PRF parallel processing No Yes Security of rand. enc. q2L2 << |X| q2L << |X| dummy padding block Yes No
31. Padding Oracle m[0] D(k, ·) IV IV m[1] m[2] m[3] c[0] c[1] c[2] c[3] D(k, ·) D(k, ·) D(k, ·) ⊕ ⊕ ⊕ ⊕ x If attacker can differentiate the padding error and message error, then attacker could break this cipher. x⊕0x1⊕ guess g guess 1 message error if guess is correct padding error if guess is wrong
32. Padding Oracle via Timing If attacker can differentiate the padding error and message error, then attacker could break this cipher. bad pad good pad, bad mac Credit: Brice Canvel (fixed in OpenSSL 0.9.7a)
33. Lesson 5: Do not implement crypto primitives yourself!
34. Topics We Didn’t Cover • Rigorous Reasoning of Cipher Security • Integrity - MAC • Authenticated Encryption • Key Exchange • Public-key Cryptography • …
35. Things to remember Cryptography is: • A rigorous science Cryptography is not: • Black magic • Reliable unless implemented and used properly • Something you should try to invent yourself
37. Thank you Kent Wang @pragkent