CISC 210 - Class Today

1. CISC 210 - Class Today • “Help wanted” for security project • Recap • Block Ciphers • Block Cipher Modes • Group Problem Solve – Block Ciphers • Reading Assignment: • Internet Cryptography Chapters 1 and 2 • Chapter excerpt on Volume Encryption from “Authentication” R. Smith - University of St Thomas - Minnesota

2. “Help Wanted” for security project • (The title probably sounds more impressive than the actual work) • I need someone to help collect information about computer security product certifications over the past 3 years • Part-time student position for a few weeks • Qualifications • Can deal with MS Access • Can read a structured technical document and quickly extract data from it • Ability to puzzle out other languages (German, French, maybe Korean or Japanese) preferred but not required R. Smith - University of St Thomas - Minnesota

3. Recap • Crypto Building Blocks • One-way hash • Randomness • XOR for encryption • Keystream generation – pseudo-random number generation • Nonces • Block Ciphers • Another building block R. Smith - University of St Thomas - Minnesota

4. Cracking a Block Cipher • It’s a hard thing to do • Known plaintext attack • You may need several plaintext/ciphertext pairs to attack • Generally, you still must do trial-and-error key testing • Block ciphers are intentionally designed to make this hard. • The designers assume the attackers can get a bunch of plaintext/ciphertext pairs • Those pairs aren’t enough to leak the key R. Smith - University of St Thomas - Minnesota

5. Hacking Ciphertext • Let’s try encrypting with a block cipher • Let’s edit the ciphertext • Next, decrypt and see what happens. R. Smith - University of St Thomas - Minnesota

6. Cipher Block “Modes” • These use other crypto building blocks to solve certain problems with block ciphers • How do we handle partial blocks? • Not all digital data will fit exactly into the blocks • How do we do a ‘real’ stream cipher with a block cipher? • Also – There is a ‘patterning’ problem • If you just use the block cipher directly, you may leak information through patterns in the encrypted data R. Smith - University of St Thomas - Minnesota

7. “Straight” Crypto – ECB Mode • Just apply the key to the plaintext • Block after block after block R. Smith - University of St Thomas - Minnesota

8. BEFORE: AFTER: Penguin using Straight Crypto R. Smith - University of St Thomas - Minnesota

9. BEFORE: AFTER: What We Want R. Smith - University of St Thomas - Minnesota

10. What’s the problem? • The blocks themselves form patterns • We ‘leak’ information because of those patterns • Also, it only works on whole blocks • How do we encrypt partial blocks? • I.E. how do we make a block cipher into a stream cipher? R. Smith - University of St Thomas - Minnesota

11. A Simple Idea: Key Autokey (OFB) • The key stream is independent of the data stream • Sort of like a ‘stream cipher’ - can work bit by bit • The “Initialization Vector” – it’s a nonce R. Smith - University of St Thomas - Minnesota

12. OFB Decryption • Basically identical to the encryption operation • Start with the initialization vector (IV) • Generates the exact same key stream R. Smith - University of St Thomas - Minnesota

13. Another view of OFB • The block cipher provides the PRNG • The actual keystream varies with the key and the IV Initialization Vector (IV) Plaintext Block Cipher Algorithm Key Ciphertext R. Smith - University of St Thomas - Minnesota

14. A variant: Cipher Feedback (CFB) • Like OFB, but feeds forward the ciphertext • Keystream incorporates the ciphertext • Like OFB, simple XOR to encrypt R. Smith - University of St Thomas - Minnesota

15. CFB Decryption • Basically identical to the encryption operation • Start with the initialization vector (IV) • Generates the exact same key stream R. Smith - University of St Thomas - Minnesota

16. Yet Another: Counter Mode (CTR) • Like OFB, but uses a counter instead of chaining • “Nonce” is a random data value; counter increments • Like OFB, simple XOR to encrypt R. Smith - University of St Thomas - Minnesota

17. CTR Decryption • Basically identical to the encryption operation • Start with the initialization vector (IV) • Generates the exact same key stream R. Smith - University of St Thomas - Minnesota

18. A Popular Choice: CBC • Kind of Rube Goldberg-ish • Each block of plaintext is mixed with the previous block of ciphertext before encryption • Again, uses an IV R. Smith - University of St Thomas - Minnesota

19. CBC Decryption • Start with the initialization vector (IV) • XOR with decrypted ciphertext to yield plaintext • “Error extension” - how do errors propagate? • Can we “mix and match” blocks? R. Smith - University of St Thomas - Minnesota

20. Quick Overview of Modes • Seen Here • Codebook – the non-mode • OFB – gives us a basic stream cipher • CFB – Feeds back the ciphertext, not the keystream • CTR – reasonable choice for disk drive encryption • CBC – complicated and popular • Others • XEX – supercharged CTR mode, used in TrueCrypt R. Smith - University of St Thomas - Minnesota

21. In Class group exercise • Four groups, 4 problems • For each: • Is the output obviously messed up? • Does the output ever get back to normal? • If so, how much output gets affected (#bits, #blocks)? • Swap two blocks in CBC • Ciphertext flips 1 bit in CBC • Swap two blocks in CTR • Ciphertext flips 1 bit in CTR R. Smith - University of St Thomas - Minnesota

22. Desktop Crypto Implementations • File encryption • User controlled; sharing and separation on computer • Hard drive encryption • Done in hardware, no real user control • Volume encryption • Done in software; no real user control • Policy implications! R. Smith - University of St Thomas - Minnesota

23. Operating System Structure • Pieces of the OS, related to I/O system • File system • Device drivers • Drivers are flexible part • File system and API give a standard ‘view’ of hard drives to user programs R. Smith - University of St Thomas - Minnesota

24. Volume encryption • Device driver encrypts data written to the drive • Can’t boot without a password/phrase/key • Users can steal from each other • Trojan horse issue • Everything is safe if volume is stolen • (and key is unknown) R. Smith - University of St Thomas - Minnesota

25. Hard drive encryption • Fast crypto built into hard drive • Users can steal from each other • Crypto is harder to disable • Problem: how do we handle the key? R. Smith - University of St Thomas - Minnesota

26. Structure Alternatives • Hard drive encryption • At hardware level • Outside/beyond device driver • Volume encryption • At device driver level • File system sees a normal drive R. Smith - University of St Thomas - Minnesota

27. Software Crypto Dilemmas • How do we keep the crypto safe? • What can ‘they’ subvert • Subversion examples • File encryption • Hard drive encryption • Access control protections R. Smith - University of St Thomas - Minnesota

28. Cipher block modes The images all came from the Wikipedia entry on Block Cipher Modes The Penguin image was produced by lewing@isc.tamu.edu and The GIMP if someone asks. Creative Commons License This work is licensed under the Creative Commons Attribution-Share Alike 3.0 United States License. To view a copy of this license, visit http://creativecommons.org/licenses/by-sa/3.0/us/ or send a letter to Creative Commons, 171 Second Street, Suite 300, San Francisco, California, 94105, USA. R. Smith - University of St Thomas - Minnesota

29. R. Smith - University of St Thomas - Minnesota

30. R. Smith - University of St Thomas - Minnesota

31. Creative Commons License This work is licensed under the Creative Commons Attribution-Share Alike 3.0 United States License. To view a copy of this license, visit http://creativecommons.org/licenses/by-sa/3.0/us/ or send a letter to Creative Commons, 171 Second Street, Suite 300, San Francisco, California, 94105, USA. R. Smith - University of St Thomas - Minnesota