1 / 39

David Evans cs.virginia/~evans - PowerPoint PPT Presentation

Lecture 3: Striving for Confusion. Structures have been found in DES that were undoubtedly inserted to strengthen the system against certain types of attack. Structures have also been found that appear to weaken the system. Lexar Corporation, “An Evalution of the DES”, 1976. David Evans

I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.

PowerPoint Slideshow about ' David Evans cs.virginia/~evans' - lara-contreras

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.

- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript

Structures have been found in DES that were undoubtedly inserted to strengthen the system against certain types of attack. Structures have also been found that appear to weaken the system.

Lexar Corporation, “An Evalution of the DES”, 1976.

David Evans

http://www.cs.virginia.edu/~evans

CS551: Security and Privacy

University of Virginia

Computer Science

• Recap Last Time

• Enigma

• Projects

• Intro to Block Ciphers

University of Virginia CS 551

• Cipher is perfect:  i, j: p (Mi|Cj) = p (Mi)

Given any ciphertext, the probability that it matches any particular message is the same.

• Equivalently,  i, j: p (Ci|Mj) = p (Ci)

Given any plaintext, the probability that it matches any particular ciphertext is the same.

University of Virginia CS 551

• Is one-time pad constructed with bad random number generator:

p(Ki = 0) = .51Ci = Pi Ki

perfect?

University of Virginia CS 551

• What is p(M = 0000 | C = 1111)?

= p(K0 = 1) * p(K1 = 1) * p(K2 = 1) * p(K3 = 1)

= .494 = 0.0576

• What is p(M = 1111 | C = 1111)?

= p(K0 = 0) * p(K1 = 0) * p(K2 = 0) * p(K3 = 0)

= .514 = 0.0676

University of Virginia CS 551

• To prove a cipher is imperfect:

• Find a ciphertext that is more likely to be one message than another

• Show that there are more messages than keys

• Implies there is some ciphertext more likely to be one message than another even if you can’t find it.

University of Virginia CS 551

• Invented commercially, 1923

• Adopted by Nazi’s

• About 50,000 in use

• Modified throughout WWII, believed to be perfectly secure

• [Kahn67] didn’t know it was broken

• Turing’s 1940 Treatise on Enigma declassified in 1996.

Enigma machine at NSA Museum

University of Virginia CS 551

• Three rotors (chosen from 5), scambled letters

• Each new letter, first rotor advances

• Other rotors advance when previous one rotates

• Reflector

• Plugboard

University of Virginia CS 551

• Plugboard: 6 cables to swap letters

• Rotors: Order of 3 rotors chosen from 5

• Orientations: Initial positions of rotors (each rotor has 26 letters)

• What is H(K)?

University of Virginia CS 551

Plugboard swaps 6 letters

K = ((26 *25)* (25 *25)* (24*24)

* (23 * 23) * (22 * 22) * (21 * 21))

* (5 * 4 * 3)

* (26 * 26 * 26)

= 2.9 * 1022

H(K) = log2 K  75

U = H(K)/DGerman 25.5

3 wheels choosen from 5

Wheel orientations

University of Virginia CS 551

• Day key (distributed in code book)

• Each message begins with message key (“randomly” choosen by sender) encoded using day key

• Message key sent twice to check

• After receiving message key, re-orient rotors according to key

University of Virginia CS 551

• Poland in late 1930s

• French spy acquired Enigma design documents

• Looked for patterns in repeated day key

• Gives clues to relationships of rotors

• With enough day key messages could eliminate effect of plugboard swaps

• Reduced key space to 105,456 (orientations * rotors)

• Brute force trial of each setting built up a table mapping key relationships to settings

University of Virginia CS 551

• Early 1939 – Germany changes scamblers and adds extra plugboard cables, stop double-transmissions

• Poland unable to cryptanalyze

• July 1939 – Rejewski invites French and British cryptographers

• It is actually breakable

• Gives England replica Enigma machine constructed from plans

University of Virginia CS 551

• Alan Turing leads British effort to crack Enigma

• Use cribs (“WETTER” transmitted every day at 6am)

• Still needed to brute force check ~1M keys.

• Built “bombes” to automate testing

University of Virginia CS 551

• Relied on combination of sheer brilliance, mathematics, espionage, operator errors, and hard work

• Huge impact on WWII

• Britain knew where German U-boats were

• Advance notice of bombing raids

• But...keeping code break secret more important than short-term uses

University of Virginia CS 551

End of classical ciphers.

University of Virginia CS 551

• Preliminary Proposals due Sept 18

• Open ended – proposal will lead to an “agreement”

• Different types of projects:

• Design/Implement

• Analyze

• Research Survey

• Don’t limit yourself to ideas on list

• Meet with your team this week

University of Virginia CS 551

• Need not be 100% technical: politics, psychology, law, ethics, history, etc.; but shouldn’t be 0% technical.

• Design/Implementation projects less focus on quality and organization of writing (but still important)

• All team members get same project grade

• Unless there are problems: tell me early!

University of Virginia CS 551

• Stream Ciphers

• Encrypts small (bit or byte) units one at a time

• Everything we have seen so far

• Block Ciphers

• Encrypts large chunks (64 bits) at once

University of Virginia CS 551

• 64 bit blocks

• 264 possible plaintext blocks, must have at least 264 corresponding ciphertext blocks

• There are 264! possible mappings

• Why not just create a random mapping?

• Need a 264 * 64-bit table  1021 bits

• Need to distribute new table if compromised

• Approximate ideal random mapping using components controlled by a key

University of Virginia CS 551

Goals of Block Cipher:Diffusion and Confusion

• Claude Shannon [1945]

• Diffussion:

• Small change in plaintext, changes lots of ciphertext

• Statistical properties of plaintext hidden in ciphertext

• Confusion:

• Statistical relationship between key and ciphertext as complex as possible

• So, need to design functions that produce output that is diffuse and confused

University of Virginia CS 551

Plaintext

L0 = left half of plaintext

R0 = right half of plaintext

Li = Ri - 1

Ri = Li - 1 F (Ri - 1, Ki )

C = Rn || Ln

n is number of rounds

(undo last permutation)

R0

L0

K1

Substitution

F

Round

Permutation

L1

R1

University of Virginia CS 551

Li = Ri - 1

Ri = Li - 1 F (Ri - 1, Ki )

E (L0 || R0):

L1 = R0

R1 = L0 F (R0, K1))

C = R1 ||L1 = L0 F (R0, K1)) || R0

University of Virginia CS 551

Ciphertext

LD0 = left half of ciphertext

RD0 = right half of ciphertext

LDi = RDi - 1

RDi = LDi - 1

 F (RDi - 1, Kn – i + 1)

P = RDn || LDn

n is number of rounds

RD0

LD0

Kn

Substitution

F

Permutation

L1

R1

University of Virginia CS 551

LDi = RDi - 1

RDi = LDi - 1 F (RDi - 1, Kn – i + 1)

Decryption

D (L0 F (R0, K1)) || R0)

LD0 = L0 F (R0, K1) RD0 = R0

LD1 = R0

RD1 = LD0  F (RD0, K1)

= L0 F (R0, K1) F (RD0, K1))

= L0

P = RD1 || LD1 = L0 || R0

Yippee!

University of Virginia CS 551

• The entire round is a function:

fK (L || R) = R|| L  F (R, K))

swap (L || R) = R || L

• E = swap ° swap ° fKr° swap ° fKr-1 °

... ° fK2° swap ° fK1

• D = fK1° swap ° fK2° ... °

fKr-1 ° swap ° fKr° swap ° swap

University of Virginia CS 551

swap (fK (swap (fK (L || R))

= swap (fK (swap (R|| L  F (R, K))))

= swap (fK (L  F (R, K) || R))

= swap (R || (L  F (R, K))  F (R, K))

= swap (R || L) = L || R

Soswap ° fKits own inverse!

University of Virginia CS 551

• What are the requirements on F?

• For decryption to work: none!

• For security:

• Hide patterns in plaintext

• Hide patterns in key

• Coming up with a good F is hard

University of Virginia CS 551

• NIST (then NBS) sought standard for data security (1973)

• IBM’s Lucifer only reasonable proposal

• Modified by NSA

• Changed S-Boxes

• Reduced key from 128 to 56 bits

• Adopted as standard in 1976

• More bits have been encrypted using DES than any other cipher

University of Virginia CS 551

• Feistel cipher with added initial permutation

• Complex choice of F

• 16 rounds

• 56-bit key, shifts and permutations produce 48-bit subkeys for each round

University of Virginia CS 551

32 bits

Expand and Permute (using E table)

48 bits

Kn

Substitute (using S boxes)

32 bits

Permutation

The goal is confusion!

University of Virginia CS 551

6 bits

Example: 110011

S-Box

64 entry lookup table

1001

4 bits

Critical to security

NSA changed choice of S-Boxes

Only non-linear step in DES

E(11)  E(01) + E(10)

University of Virginia CS 551

Input: ...............................................................* 1

Permuted: .......................................*........................ 1

Round 1: .......*........................................................ 1

Round 2: .*..*...*.....*........................*........................ 5

Round 3: .*..*.*.**..*.*.*.*....**.....**.*..*...*.....*................. 18

Round 4: ..*.*****.*.*****.*.*......*.....*..*.*.**..*.*.*.*....**.....** 28

Round 5: *...**..*.*...*.*.*.*...*.***..*..*.*****.*.*****.*.*......*.... 29

Round 6: ...*..**.....*.*..**.*.**...*..**...**..*.*...*.*.*.*...*.***..* 26

Round 7: *****...***....**...*..*.*..*......*..**.....*.*..**.*.**...*..*

Round 8: *.*.*.*.**.....*.*.*...**.*...*******...***....**...*..*.*..*...

Round 9: ***.*.***...**.*.****.....**.*..*.*.*.*.**.....*.*.*...**.*...**

Round 10: *.*..*.*.**.*..*.**.***.**.*...****.*.***...**.*.****.....**.*..

Round 11: ..******......*..******....*....*.*..*.*.**.*..*.**.***.**.*...*

Round 12: *..***....*...*.*.*.***...****....******......*..******....*....

Round 13: **..*....*..******...*........*.*..***....*...*.*.*.***...****..

Round 14: *.**.*....*.*....**.*...*..**.****..*....*..******...*........*.

Round 15: **.*....*.*.*...*.**.*..*.*.**.**.**.*....*.*....**.*...*..**.**

Round 16: .*..*.*..*..*.**....**..*..*..****.*....*.*.*...*.**.*..*.*.**.*

Output: ..*..**.*.*...*....***..***.**.*...*..*..*.*.*.**.*....*.*.*.**.

Source: Willem de Graaf, http://www-groups.dcs.st-and.ac.uk/~wdg/slides/node150.html

University of Virginia CS 551

• Need 16 48-bit keys

• Best security: just use 16 independent keys

• 768 key bits

• 56-bit key used (64 bits for parity checking)

• Produce 48-bit round keys by shifting and permuting

University of Virginia CS 551

56 bits

Key

Next round

28 bits

28 bits

Ki = PC (Shift (Left (Ki-1))

|| Shift (Right (Ki-1)))

Shift (1 or 2 bits)

Shift (1 or 2 bits)

Compress/Permute

Kn

How do you decrypt?

Are there any weak keys?

University of Virginia CS 551

• No: more messages than keys

• Even for 1 64-bit block

264 messages > 256 keys

University of Virginia CS 551

• Key is 56 bits

• 256 = 7.2 * 1016 = 72 quadrillion

• Try 1 per second = 9 Billion years to search entire space

• Distributed attacks

• Steal/borrow idle cycles on networked PCs

• Search half of key space with

100000 PCs * 1M keys/second in 25 days

University of Virginia CS 551

• RSA DES challenges:

• 1997: 96 days (using 70,000 machines)

• Feb 1998: 41 days (distributed.net)

• July 1998: 56 hours (EFF custom hardware)

• January 1999: 22 hours (EFF + distributed.net)

• 245 Billion keys per second

• NSA can probably crack DES routinely (but they won’t admit it)

University of Virginia CS 551

• Next time:

• Better than brute force DES attacks

• 3-DES

• Modes of Operation

• Problem Set 1 Due Monday

• Start thinking about projects

University of Virginia CS 551