1. David Evans http://www.cs.virginia.edu/~evans CS551: Security and Privacy University of Virginia Computer Science Lecture 3: Striving for Confusion Structures have been found in DES that were undoubtedly inserted to strengthen the system against certain types of attack. Structures have also been found that appear to weaken the system. Lexar Corporation, “An Evalution of the DES”, 1976.

2. 30 Aug 2000University of Virginia CS 5512 Menu Recap Last Time Enigma Projects Intro to Block Ciphers

3. 30 Aug 2000University of Virginia CS 5513 Last Time Cipher is perfect:  i, j : p (M i |C j ) = p (M i ) Given any ciphertext, the probability that it matches any particular message is the same. Equivalently,  i, j : p (C i |M j ) = p (C i ) Given any plaintext, the probability that it matches any particular ciphertext is the same.

4. 30 Aug 2000University of Virginia CS 5514 Slanted One-Time Pad Is one-time pad constructed with bad random number generator: p(K i = 0) =.51 C i = P i  K i perfect?

5. 30 Aug 2000University of Virginia CS 5515 Slanted One-Time Pad What is p(M = 0000 | C = 1111) ? = p(K 0 = 1) * p(K 1 = 1) * p(K 2 = 1) * p(K 3 = 1) =.49 4 = 0.0576 What is p(M = 1111 | C = 1111) ? = p(K 0 = 0) * p(K 1 = 0) * p(K 2 = 0) * p(K 3 = 0) =.51 4 = 0.0676

6. 30 Aug 2000University of Virginia CS 5516 Imperfect Cipher To prove a cipher is imperfect: –Find a ciphertext that is more likely to be one message than another –Show that there are more messages than keys Implies there is some ciphertext more likely to be one message than another even if you can’t find it.

7. 30 Aug 2000University of Virginia CS 5517 Enigma Invented commercially, 1923 Adopted by Nazi’s About 50,000 in use Modified throughout WWII, believed to be perfectly secure [Kahn67] didn’t know it was broken Turing’s 1940 Treatise on Enigma declassified in 1996. Enigma machine at NSA Museum

8. 30 Aug 2000University of Virginia CS 5518 Enigma Mechanics Three rotors (chosen from 5), scambled letters Each new letter, first rotor advances Other rotors advance when previous one rotates Reflector Plugboard

9. 30 Aug 2000University of Virginia CS 5519 Setup Plugboard: 6 cables to swap letters Rotors: Order of 3 rotors chosen from 5 Orientations: Initial positions of rotors (each rotor has 26 letters) What is H(K)?

10. 30 Aug 2000University of Virginia CS 55110 Entropy of Enigma K = ((26 *25) * (25 *25) * (24*24) * (23 * 23) * (22 * 22) * (21 * 21)) * (5 * 4 * 3) * (26 * 26 * 26) = 2.9 * 10 22 H(K) = log 2 K  75 U = H(K)/D German  25.5 Plugboard swaps 6 letters 3 wheels choosen from 5 Wheel orientations

11. 30 Aug 2000University of Virginia CS 55111 Operation Day key (distributed in code book) Each message begins with message key (“randomly” choosen by sender) encoded using day key Message key sent twice to check After receiving message key, re-orient rotors according to key

12. 30 Aug 2000University of Virginia CS 55112 Rejewski’s Cryptanalysis Poland in late 1930s –French spy acquired Enigma design documents Looked for patterns in repeated day key Gives clues to relationships of rotors –With enough day key messages could eliminate effect of plugboard swaps Reduced key space to 105,456 (orientations * rotors) –Brute force trial of each setting built up a table mapping key relationships to settings

13. 30 Aug 2000University of Virginia CS 55113 1939 Early 1939 – Germany changes scamblers and adds extra plugboard cables, stop double-transmissions –Poland unable to cryptanalyze July 1939 – Rejewski invites French and British cryptographers –It is actually breakable –Gives England replica Enigma machine constructed from plans

14. 30 Aug 2000University of Virginia CS 55114 Bletchley Park Alan Turing leads British effort to crack Enigma Use cribs (“WETTER” transmitted every day at 6am) Still needed to brute force check ~1M keys. Built “bombes” to automate testing

15. 30 Aug 2000University of Virginia CS 55115 Enigma Cryptanalysis Relied on combination of sheer brilliance, mathematics, espionage, operator errors, and hard work Huge impact on WWII –Britain knew where German U-boats were –Advance notice of bombing raids –But...keeping code break secret more important than short-term uses

16. 30 Aug 2000University of Virginia CS 55116 Questions? End of classical ciphers.

17. 30 Aug 2000University of Virginia CS 55117 Projects Preliminary Proposals due Sept 18 Open ended – proposal will lead to an “agreement” Different types of projects: –Design/Implement –Analyze –Research Survey Don’t limit yourself to ideas on list Meet with your team this week

18. 30 Aug 2000University of Virginia CS 55118 Project Evaluation Need not be 100% technical: politics, psychology, law, ethics, history, etc.; but shouldn’t be 0% technical. Design/Implementation projects less focus on quality and organization of writing (but still important) All team members get same project grade –Unless there are problems: tell me early!

19. 30 Aug 2000University of Virginia CS 55119 Block Ciphers Stream Ciphers –Encrypts small (bit or byte) units one at a time –Everything we have seen so far Block Ciphers –Encrypts large chunks (64 bits) at once

20. 30 Aug 2000University of Virginia CS 55120 Block cipher 64 bit blocks 2 64 possible plaintext blocks, must have at least 2 64 corresponding ciphertext blocks –There are 2 64 ! possible mappings Why not just create a random mapping? –Need a 2 64 * 64-bit table  10 21 bits –$14 quadrillion –Need to distribute new table if compromised Approximate ideal random mapping using components controlled by a key

21. 30 Aug 2000University of Virginia CS 55121 Goals of Block Cipher: Diffusion and Confusion Claude Shannon [1945] Diffussion: –Small change in plaintext, changes lots of ciphertext –Statistical properties of plaintext hidden in ciphertext Confusion: –Statistical relationship between key and ciphertext as complex as possible So, need to design functions that produce output that is diffuse and confused

22. 30 Aug 2000University of Virginia CS 55122 Feistel Cipher Structure Plaintext Round L0L0 R0R0  F K1K1 L1L1 R1R1 L 0 = left half of plaintext R 0 = right half of plaintext L i = R i - 1 R i = L i - 1  F ( R i - 1, K i ) C = R n || L n n is number of rounds (undo last permutation) Substitution Permutation

23. 30 Aug 2000University of Virginia CS 55123 One Round Feistel E (L 0 || R 0 ): L 1 = R 0 R 1 = L 0  F (R 0, K 1 )) C = R 1 || L 1 = L 0  F (R 0, K 1 )) || R 0 L i = R i - 1 R i = L i - 1  F ( R i - 1, K i )

24. 30 Aug 2000University of Virginia CS 55124 Decryption Ciphertext LD 0 RD 0  F KnKn L1L1 R1R1 LD 0 = left half of ciphertext RD 0 = right half of ciphertext LD i = RD i - 1 RD i = LD i - 1  F ( RD i - 1, K n – i + 1 ) P = RD n || LD n n is number of rounds Substitution Permutation

25. 30 Aug 2000University of Virginia CS 55125 Decryption D (L 0  F (R 0, K 1 )) || R 0 ) LD 0 = L 0  F (R 0, K 1 ) RD 0 = R 0 LD 1 = R 0 RD 1 = LD 0  F (RD 0, K 1 ) = L 0  F (R 0, K 1 )  F (RD 0, K 1 )) = L 0 P = RD 1 || LD 1 = L 0 || R 0 Yippee! LD i = RD i - 1 RD i = LD i - 1  F ( RD i - 1, K n – i + 1 )

26. 30 Aug 2000University of Virginia CS 55126 Multiple Rounds The entire round is a function: f K (L || R) = R || L  F (R, K)) swap (L || R) = R || L E = swap ° swap ° f K r ° swap ° f K r-1 °... ° f K 2 ° swap ° f K 1 D = f K 1 ° swap ° f K 2 °... ° f Kr-1 ° swap ° f K r ° swap ° swap

27. 30 Aug 2000University of Virginia CS 55127 Decryption swap (f K (swap (f K (L || R)) = swap (f K (swap (R || L  F (R, K)))) = swap (f K (L  F (R, K) || R)) = swap (R || (L  F (R, K))  F (R, K)) = swap (R || L) = L || R So swap ° f K its own inverse!

28. 30 Aug 2000University of Virginia CS 55128 F What are the requirements on F? –For decryption to work: none! –For security: Hide patterns in plaintext Hide patterns in key Coming up with a good F is hard

29. 30 Aug 2000University of Virginia CS 55129 DES NIST (then NBS) sought standard for data security (1973) IBM’s Lucifer only reasonable proposal Modified by NSA –Changed S-Boxes –Reduced key from 128 to 56 bits Adopted as standard in 1976 More bits have been encrypted using DES than any other cipher

30. 30 Aug 2000University of Virginia CS 55130 DES Algorithm Feistel cipher with added initial permutation Complex choice of F 16 rounds 56-bit key, shifts and permutations produce 48-bit subkeys for each round

31. 30 Aug 2000University of Virginia CS 55131 DES’s F Expand and Permute (using E table) 32 bits 48 bits  KnKn Substitute (using S boxes) 32 bits Permutation The goal is confusion!

32. 30 Aug 2000University of Virginia CS 55132 S-Boxes S-Box 6 bits 4 bits Example: 110011 1001 Critical to security NSA changed choice of S-Boxes Only non-linear step in DES 64 entry lookup table E(11)  E(01) + E(10)

33. 30 Aug 2000University of Virginia CS 55133 DES Avalanche Input:...............................................................*1 Permuted:.......................................*........................ 1 Round 1:.......*........................................................ 1 Round 2:.*..*...*.....*........................*........................ 5 Round 3:.*..*.*.**..*.*.*.*....**.....**.*..*...*.....*................. 18 Round 4:..*.*****.*.*****.*.*......*.....*..*.*.**..*.*.*.*....**.....** 28 Round 5: *...**..*.*...*.*.*.*...*.***..*..*.*****.*.*****.*.*......*.... 29 Round 6:...*..**.....*.*..**.*.**...*..**...**..*.*...*.*.*.*...*.***..* 26 Round 7: *****...***....**...*..*.*..*......*..**.....*.*..**.*.**...*..* Round 8: *.*.*.*.**.....*.*.*...**.*...*******...***....**...*..*.*..*... Round 9: ***.*.***...**.*.****.....**.*..*.*.*.*.**.....*.*.*...**.*...** Round 10: *.*..*.*.**.*..*.**.***.**.*...****.*.***...**.*.****.....**.*.. Round 11:..******......*..******....*....*.*..*.*.**.*..*.**.***.**.*...* Round 12: *..***....*...*.*.*.***...****....******......*..******....*.... Round 13: **..*....*..******...*........*.*..***....*...*.*.*.***...****.. Round 14: *.**.*....*.*....**.*...*..**.****..*....*..******...*........*. Round 15: **.*....*.*.*...*.**.*..*.*.**.**.**.*....*.*....**.*...*..**.** Round 16:.*..*.*..*..*.**....**..*..*..****.*....*.*.*...*.**.*..*.*.**.* Output:..*..**.*.*...*....***..***.**.*...*..*..*.*.*.**.*....*.*.*.**. Source: Willem de Graaf, http://www-groups.dcs.st-and.ac.uk/~wdg/slides/node150.html

34. 30 Aug 2000University of Virginia CS 55134 Key Schedule Need 16 48-bit keys –Best security: just use 16 independent keys –768 key bits 56-bit key used (64 bits for parity checking) –Produce 48-bit round keys by shifting and permuting

35. 30 Aug 2000University of Virginia CS 55135 DES Keys K i = PC (Shift (Left (K i-1 )) || Shift (Right (K i-1 ))) Key Shift (1 or 2 bits) 56 bits 28 bits Compress/Permute KnKn Next round How do you decrypt? Are there any weak keys?

36. 30 Aug 2000University of Virginia CS 55136 Is DES a perfect cipher? No: more messages than keys Even for 1 64-bit block 2 64 messages > 2 56 keys

37. 30 Aug 2000University of Virginia CS 55137 Attacking DES: Brute Force Key is 56 bits 2 56 = 7.2 * 10 16 = 72 quadrillion Try 1 per second = 9 Billion years to search entire space Distributed attacks –Steal/borrow idle cycles on networked PCs –Search half of key space with 100000 PCs * 1M keys/second in 25 days

38. 30 Aug 2000University of Virginia CS 55138 Brute Force Attacks RSA DES challenges: –1997:96 days (using 70,000 machines) –Feb 1998: 41 days (distributed.net) –July 1998: 56 hours (EFF custom hardware) –January 1999: 22 hours (EFF + distributed.net) 245 Billion keys per second NSA can probably crack DES routinely (but they won’t admit it)

39. 30 Aug 2000University of Virginia CS 55139 Charge Next time: –Better than brute force DES attacks –3-DES –Modes of Operation Problem Set 1 Due Monday Start thinking about projects