15-853Page 1 CPS 214 Computer Networks and Distributed Systems Cryptography Basics RSA SSL SSH Kerberos

15-853Page 2 Basic Definitions Private Key or Symmetric: Key 1 = Key 2 Public Key or Asymmetric: Key 1  Key 2 Key 1 or Key 2 is public depending on the protocol Encryption Decryption Key 1 Key 2 Cyphertext E key1 (M) = C D key2 (C) = M Original Plaintext Plaintext

15-853Page 3 What does it mean to be secure? Unconditionally Secure: Encrypted message cannot be decoded without the key Shannon showed in 1943 that key must be as long as the message to be unconditionally secure – this is based on information theory A one time pad – xor a random key with a message (Used in 2 nd world war) Security based on computational cost: it is computationally “infeasible” to decode a message without the key. No (probabilistic) polynomial time algorithm can decode the message.

15-853Page 4 Primitives: One-Way Functions (Informally): A function Y = f(x) is one-way if it is easy to compute y from x but “hard” to compute x from y Building block of most cryptographic protocols And, the security of most protocols rely on their existence. Unfortunately, not known to exist. This is true even if we assume P  NP.

15-853Page 5 One-way functions: possible definition 1.F(x) is polynomial time 2.F -1 (x) is NP-hard What is wrong with this definition?

15-853Page 6 One-way functions: better definition For most y no single PPT (probabilistic polynomial time) algorithm can compute x Roughly: at most a fraction 1/|x| k instances x are easy for any k and as |x| ->  This definition can be used to make the probability of hitting an easy instance arbitrarily small.

15-853Page 7 Some examples (conjectures) Factoring: x = (u,v) y = f(u,v) = u*v If u and v are prime it is hard to generate them from y. Discrete Log: y = g x mod p where p is prime and g is a “generator” (i.e., g 1, g 2, g 3, … generates all values < p). DES with fixed message: y = DES x (m) This would assume a family of DES functions of increasing key size (for asymptotics)

15-853Page 8 One-way functions in private-key protocols y = ciphertext m = plaintext k = key Is y = E k (m) (i.e. f = E k ) a one-way function with respect to y and m? What do one-way functions have to do with private- key protocols?

15-853Page 9 One-way functions in private-key protocols y = ciphertext m = plaintext k = key How about y = E k (m) = E(k,m) = E m (k) (i.e. f = E m ) should this be a one-way function? In a known-plaintext attack we know a (y,m) pair. The m along with E defines f E m (k) needs to be easy E m -1 (y) should be hard Otherwise we could extract the key k.

15-853Page 10 One-way functions in public-key protocols y = ciphertext m = plaintext k = public key Consider: y = E k (m) (i.e., f = E k ) We know k and thus f E k (m) needs to be easy E k -1 (y) should be hard Otherwise we could decrypt y. But what about the intended recipient, who should be able to decrypt y?

15-853Page 11 One-Way Trapdoor Functions A one-way function with a “trapdoor” The trapdoor is a key that makes it easy to invert the function y = f(x) Example: RSA (conjecture) y = x e mod n Where n = pq (p, q are prime) p or q or d (where ed = 1 mod (p-1)(q-1)) can be used as trapdoors In public-key algorithms f(x) = public key (e.g., e and n in RSA) Trapdoor = private key (e.g., d in RSA)

15-853Page 12 One-way Hash Functions Y = h(x) where –y is a fixed length independent of the size of x. In general this means h is not invertible since it is many to one. –Calculating y from x is easy –Calculating any x such that y = h(x) give y is hard Used in digital signatures and other protocols.

15-853Page 13 Protocols: Digital Signatures Goals: 1.Convince recipient that message was actually sent by a trusted source 2.Do not allow repudiation, i.e., that’s not my signature. 3.Do not allow tampering with the message without invalidating the signature Item 2 turns out to be really hard to do

15-853Page 14 Using Public Keys More Efficiently AliceBob D k1 (m) AliceBob D k1 (h(m)) + m K1 = Alice’s private key Bob decrypts it with her public key h(m) is a one-way hash of m

15-853Page 15 Key Exchange Private Key method Public Key method Trent AliceBob E ka (k)E kb (k) Generates k Alice Bob Generates k E k1 (k) k1 = Bob’s public key Or we can use a direct protocol, such as Diffie- Hellman (discussed later)

15-853Page 16 Private Key Algorithms Encryption Decryption Key 1 Cyphertext E k (M) = C D k (C) = M Original Plaintext Plaintext What granularity of the message does E k encrypt?

15-853Page 17 Private Key Algorithms Block Ciphers: blocks of bits at a time –DES (Data Encryption Standard) Banks, linux passwords (almost), SSL, kerberos, … –Blowfish (SSL as option) –IDEA (used in PGP, SSL as option) –Rijndael (AES) – the new standard Stream Ciphers: one bit (or a few bits) at a time –RC4 (SSL as option) –PKZip –Sober, Leviathan, Panama, …

15-853Page 18 Private Key: Block Ciphers Encrypt one block at a time (e.g. 64 bits) c i = f(k,m i ) m i = f ’ (k,c i ) Keys and blocks are often about the same size. Equal message blocks will encrypt to equal codeblocks –Why is this a problem? Various ways to avoid this: –E.g. c i = f(k,c i-1  m i ) “Cipher block chaining” (CBC) Why could this still be a problem? Solution: attach random block to the front of the message

15-853Page 19 Iterated Block Ciphers Consists of n rounds R = the “round” function s i = state after round i k i = the i th round key R R R s1s m c key k1k1 k2k2 knkn s2s2

15-853Page 20 Iterated Block Ciphers: Decryption Run the rounds in reverse. Requires that R has an inverse. R -1 s1s m c key k2k2 knkn s2s2 k1k1

15-853Page 21 Feistel Networks If function is not invertible rounds can still be made invertible. Requires 2 rounds to mix all bits. F kiki XOR F kiki high bitslow bits ForwardsBackwards RR -1 Used by DES (the Data Encryption Standard)

15-853Page 22 Product Ciphers Each round has two components: –Substitution on smaller blocks Decorrelate input and output: “confusion” –Permutation across the smaller blocks Mix the bits: “diffusion” Substitution-Permutation Product Cipher Avalanche Effect: 1 bit of input should affect all output bits, ideally evenly, and for all settings of other in bits

15-853Page 23 Rijndael Selected by AES (Advanced Encryption Standard, part of NIST) as the new private-key encryption standard. Based on an open “competition”. –Competition started Sept –Narrowed to 5 Sept MARS by IBM, RC6 by RSA, Twofish by Counterplane, Serpent, and Rijndael –Rijndael selected Oct –Official Oct. 2001? (AES page on Rijndael)AES page on Rijndael Designed by Rijmen and Daemen (Dutch)

15-853Page 24 Public Key Cryptosystems Introduced by Diffie and Hellman in Encryption Decryption K1K1 K2K2 Cyphertext E k (M) = C D k (C) = M Original Plaintext Plaintext Public Key systems K 1 = public key K 2 = private key Digital signatures K 1 = private key K 2 = public key Typically used as part of a more complicated protocol.

15-853Page 25 One-way trapdoor functions Both Public-Key and Digital signatures make use of one-way trapdoor functions. Public Key: –Encode: c = f(m) –Decode: m = f -1 (c) using trapdoor Digital Signatures: –Sign: c = f -1 (m) using trapdoor –Verify: m = f(c)

15-853Page 26 Example of SSL (3.0) SSL (Secure Socket Layer) is the standard for the web (https). Protocol (somewhat simplified): Bob -> amazon.com B->A: client hello: protocol version, acceptable ciphers A->B: server hello: cipher, session ID, |amazon.com| verisign B->A: key exchange, {masterkey} amazon’s public key A->B: server finish: ([amazon,prev-messages,masterkey]) key1 B->A: client finish: ([bob,prev-messages,masterkey]) key2 A->B: server message: (message1,[message1]) key1 B->A: client message: (message2,[message2]) key2 |h| issuer = Certificate = Issuer, issuer’s private key private key = Digital signature {…} public key = Public-key encryption [..] = Secure Hash (…) key = Private-key encryption key1 and key2 are derived from masterkey and session ID hand- shake data

15-853Page 27 Diffie-Hellman Key Exchange A group (G,*) and a primitive element (generator) g is made public. –Alice picks a, and sends g a to Bob –Bob picks b and sends g b to Alice –The shared key is g ab Note this is easy for Alice or Bob to compute, but assuming discrete logs are hard is hard for anyone else to compute. Can someone see a problem with this protocol?

15-853Page 28 Person-in-the-middle attack Alice BobMallory gaga gbgb gdgd gcgc Key 1 = g ad Key 1 = g cb Mallory gets to listen to everything.

15-853Page 29 RSA Invented by Rivest, Shamir and Adleman in 1978 Based on difficulty of factoring. Used to hide the size of a group Z n * since:. Factoring has not been reduced to RSA –an algorithm that generates m from c does not give an efficient algorithm for factoring On the other hand, factoring has been reduced to finding the private-key. –there is an efficient algorithm for factoring given one that can find the private key.

15-853Page 30 RSA Public-key Cryptosystem What we need: p and q, primes of approximately the same size n = pq  (n) = (p-1)(q-1) e  Z  (n) * d = inv. of e in Z  (n) * i.e., d = e -1 mod  (n) Public Key: (e,n) Private Key: d Encode: m  Z n E(m) = m e mod n Decode: D(c) = c d mod n

15-853Page 31 RSA continued Why it works: D(c) = c d mod n = m ed mod n = m 1 + k(p-1)(q-1) mod n = m 1 + k  (n) mod n = m(m  (n) ) k mod n = m (because  (n) = 0 mod  (n)) Why is this argument not quite sound? What if m  Z n * then m  (n)  1 mod n Answer 1: Not hard to show that it still works. Answer 2: jackpot – you’ve factored n

15-853Page 32 RSA computations To generate the keys, we need to –Find two primes p and q. Generate candidates and use primality testing to filter them. –Find e -1 mod (p-1)(q-1). Use Euclid’s algorithm. Takes time log 2 (n) To encode and decode –Take m e or c d. Use the power method. Takes time log(e) log 2 (n) and log(d) log 2 (n). In practice e is selected to be small so that encoding is fast.

15-853Page 33 Security of RSA Warning: –Do not use this or any other algorithm naively! Possible security holes: –Need to use “safe” primes p and q. In particular p- 1 and q-1 should have large prime factors. –p and q should not have the same number of digits. Can use a middle attack starting at sqrt(n). –e cannot be too small –Don’t use same n for different e’s. –You should always “pad”

15-853Page 34 RSA Performance Performance: (600Mhz PIII) (from: ssh toolkit):ssh toolkit AlgorithmBits/keyMbits/sec RSA Keygen sec/key sec/key RSA Encrypt /sec /sec1.2 RSA Decrypt /sec /sec.024 ElGamal Enc /sec.031 ElGamal Dec /sec.061 DES-cbc5695 twofish-cbc Rijndael128180

15-853Page 35 RSA in the “Real World” Part of many standards: PKCS, ITU X.509, ANSI X9.31, IEEE P1363 Used by: SSL, PEM, PGP, Entrust, … The standards specify many details on the implementation, e.g. –e should be selected to be small, but not too small – “multi prime” versions make use of n = pqr… this makes it cheaper to decode especially in parallel (uses Chinese remainder theorem).

15-853Page 36 Factoring in the Real World Quadratic Sieve (QS): –Used in 1994 to factor a 129 digit (428-bit) number Machines, 8 months. Number field Sieve (NFS): –Used in 1999 to factor 155 digit (512-bit) number. 35 CPU years. At least 4x faster than QS –Used in to factor 200 digits (663 bits) 75 CPU years ($20K prize)

15-853Page 37 SSH v2 Server has a permanent “host” public-private key pair (RSA or DSA). Client warns if public host key changes. Diffie-Hellman used to exchange session key. –Server selects g and p and sends to client. –Client and server create DH private keys. Client sends public DH key. –Server sends public DH key and signs hash of DH shared secret and other 12 other values with its private “host” key. Symmetric encryption using 3DES, Blowfish, AES, or Arcfour begins. User can authenticate by sending password or using public- private key pair. If using keys, server sends “challenge” signed with users public key for user to decode with private key.

15-853Page 38 Kerberos A key-serving system based on Private-Keys (DES). Assumptions Built on top of TCP/IP networks Many “clients” (typically users, but perhaps software) Many “servers” (e.g. file servers, compute servers, print servers, …) User machines and servers are potentially insecure without compromising the whole system A kerberos server must be secure.

15-853Page 39 Kerberos (kinit) Kerberos Authentication Server Client Service Server Ticket Granting Server (TGS) Request ticket-granting-ticket (TGT) 2. 3.Request server-ticket (ST) 4. 5.Request service

15-853Page 40 C = client S = server K = key or session key T = timestamp V = time range TGS = Ticket Granting Service A = Net Address Ticket Granting Ticket: T C,TGS = TGS,{C,A,V,K C,TGS }K TGS Server Ticket: T C,S = S, {C,A,V,K C,S }K S Authenticator: A C,S = {C,T}K C,S 1.Client to Kerberos: C,TGS 2.Kerberos to Client: {K C,TGS }K C, T C,TGS 3.Client to TGS: {T C,TGS, S}, A C,TGS 4.TGS to Client: {K C,S }K C,TGS, T C,S 5.Client to Server: A C,S, T C,S Kerberos V Message Formats Possibly repeat

15-853Page 41 Kerberos Notes All machines have to have synchronized clocks –Must not be able to reuse authenticators Servers should store all previous and valid tickets –Help prevent replays Client keys are typically a one-way hash of the password. Clients do not keep these keys. Kerberos 5 uses CBC mode for encryption Kerberos 4 was insecure because it used a nonstandard mode.