Cryptanalysis

1. Cryptanalysis Aaron Willett

2. What is Cryptology? • Cryptography (Encryption) • the practice and study of techniques for secure communication in the presence of third parties • Cryptanalysis (Decryption) •  the art of defeating cryptographic security systems, and gaining access to the contents of encrypted messages, without being given the cryptographic key.

3. History

4. Early Cryptology • Scytale • Julius Caesar • Vigenere Square

5. Vigenere Square

6. Cryptology circa WWII • German Enigma • Bombe • Japanese Red, Orange, Purple

7. Types • Ciphertext-only attack • Chosen-ciphertext attack • Known-plaintext attack • Chosen-plaintext attack

8. Ciphertext-Only Attack • Attacker has access to a set of ciphertexts • Guess-and-check • Frequency Analysis

9. Example 1Plaintext: HEREISANEXAMPLEOFAFREQUENCYANALYSISCiphertext: XTJTWICNTDCQLSTMOCOJTKGTNYBCNCSBIWI English Frequency Table Ciphertext Frequency Table

10. Example 2 • Sub1.pdf • Sub2.pdf • Sub3.pdf

11. Chosen-Ciphertext Attack • Tries to discover the key • Uses ciphertext chosen by attacker • Relies on being able to obtain decrypted plaintext • Two variations

12. Lunchtime Attack • Euphemism “Away on Lunch” • Attacker can make queries but only up until a certain point, after which the attacker must demonstrate some improved ability to attack the system. • Attacker cannot adapt queries • Results given after the ability to makes queries expires

13. Adaptive Chosen-Ciphertext • Similar to normal chosen-ciphertext • Ciphertext is chosen based on the result of the previous query

14. Known-Plaintext Attack • Attacker has the ciphertext and some samples of plaintext • Apply the known plaintext to the ciphertext to help decryption • Preferred over ciphertext-only

15. Example 3 • Plaintext: This is encrypted using a ROT3 Caesar Cipher • Ciphertext: Wklvlvhqfubswhgxvlqj d URW3 FdhvduFlskhu • Known-Plaintext: Caesar • By knowing ‘Caesar’ one can make educated assessments • Compare length, frequency of letters, patterns • ROT3 pattern

16. Chosen-Plaintext Attack • Chooses plaintext and receives corresponding ciphertext • Not always viable (E.g. Enigma WWII) • Two variations

17. Chosen-Plaintext Attack • Batch Chosen-Plaintext • Attacker chooses a “batch” of plaintexts before any encrypted ciphertext is received • Adaptive chosen-plaintext • Attacker makes n-amounts of interactive queries and alters their plaintext based on the previous query

18. Methods • Classical Cryptanalysis • Symmetrical Cryptanalysis • Hash Functions • External Attacks

19. Classical Cryptanalysis • Frequency Analysis • Index of Coincidence • Kasiski Examination

20. Index of Coincidence • Useful method to find the length of a key for Vigenere or Beaufort ciphers • Shifts the cipher text one position until circled back • Counts the occurrences of letters that are in the same position between the shifted ciphertext and the original • A high index of coincidence shows multiples of the key length

21. Example 4*Example courtesy of http://www.murky.org/blg/2004/10/index-of-coincidences-a-worked-example/ Ciphertext Shifts • VKMHG QFVMO IJOII OHNSN IZXSS CSZEA WWEXU LIOZB AGEKQ UHRDH IKHWE OBNSQ RVIES LISYK BIOVF IEWEO BQXIE UUIXK EKTUH NSZIB SWJIZ BSKFK YWSXS EIDSQ INTBD RKOZD QELUM AAAEV MIDMD GKJXR UKTUH TSBGI EQRVF XBAYG UBTCS XTBDR SLYKW AFHMM TYCKU JHBWV TUHRQ XYHWM IJBXS LSXUB BAYDI OFLPO XBULU OZAHE JOBDT ATOUT GLPKO FHNSO KBHMW XKTWX SX • Original: VKMHGQFVMOIJOIIOHNSNIZXSSCSZEA... Shift 1: KMHGQFVMOIJOIIOHNSNIZXSSCSZEAW... Shift 2: MHGQFVMOIJOIIOHNSNIZXSSCSZEAWW... Shift 3: HGQFVMOIJOIIOHNSNIZXSSCSZEAWWE... Shift 4: GQFVMOIJOIIOHNSNIZXSSCSZEAWWEX... Shift 5: QFVMOIJOIIOHNSNIZXSSCSZEAWWEXU... Shift 6: FVMOIJOIIOHNSNIZXSSCSZEAWWEXUL... Shift 7: VMOIJOIIOHNSNIZXSSCSZEAWWEXULI...

22. Index of Coincidence Shift Coincidences • 1 ________________________ • 2 ________________________ • 3 ________________________ • 4 ________________________ • 5 ________________________ • 6 ________________________ • 7 • 8 ________________________ • 12 ________________________ • 11 ________________________ • 13 ________________________ • 19 ________________________ • 25 ________________________ • 11

23. Kasiski Examination • Similar to finding the index of coincidence • Searches for repeated sequences of letters greater than 3 • Record the distance between occurrences • Attempt to find a common factor

24. Symmetric Algorithms • Boomerang Attack • Brute Force Attack • Davies' Attack • Differential Cryptanalysis • Integral Cryptanalysis • Linear Cryptanalysis • Meet-in-the-middle Attack • Mod-n Cryptanalysis • Slide Attack • XSL Attack

25. Brute Force Attack • Attacker runs trials against a cryptosystem for all possible keys • Sometimes infeasible • Time consuming

26. Key Length vs Brute Force Combinations

27. Differential Cryptanalysis • Useful against block and stream ciphers • AES, DES, Blowfish, RC4 • Chosen-plaintext attack • Feeds plaintext pairs into the cryptosystem and analyzes the difference defined by the XOR operation • Analyzing the results suggests possible key values

28. Linear Cryptanalysis • Also useful against block and stream ciphers • Develop linear equations that relate the plaintext and the ciphertext to certain key bits • Derive other key bits from these equations • Brute force

29. Hash Functions • Passwords are commonly saved in hash tables • Two methods to crack hash functions • Birthday Attack • Rainbow Table

30. Birthday Attack • Exploits the birthday paradox • Goal is to find two arbitrary inputs that yield the same hash value • Known as a hash collision • Useful when an attacker wants to modify a document with a digital signature

31. Birthday Paradox • As an example, consider the scenario in which a teacher with a class of 30 students asks for everybody's birthday, to determine whether any two students have the same birthday (corresponding to a hash collision as described below; for simplicity, ignore February 29). Intuitively, this chance may seem small. If the teacher picked a specific day (say September 16), then the chance that at least one student was born on that specific day is , about 7.9%. However, the probability that at least one student has the same birthday as any other student is nearly 70% (using the formula 

32. Example 5 • Mallory creates two documents X and Y, which have the same hash value. Mallory sends document X to Alice who verifies the document, signs it, and returns it to Mallory. Mallory then copies the digital signature from document X to document Y and sends document Y to Bob. The signature on document Y matches the document hash so Bob's software cannot detect any modifications done to the document.

33. Rainbow Table • Pre-computed table used for reversing hash functions • Typically used for cracking password hashes • Infeasible when a salt is added to a password

34. Rainbow Tables for Ophcrack • Alphanumeric – 388 MB • 80 Billion hashes; 12 septillion passwords • Extended – 7.5 GB • Contains  !"#$%&'()*+,-./:;<=>?@[\]^_`{|} ~ • 7 trillion hashes; 5 octillion passwords

35. External Attacks • Crude, non-mathematical methods • Black-bag and rubber-hose • Black-bag is a euphemism for the acquisition of cryptographic secrets through theft • Key-logging, trojan horse, physically stealing • Rubber-hose uses torture and coercion to obtain information • Humans are the weakest link

36. Questions?