Introduction to - Cryptography - PKI (Public Key Infrastructure) - Secure with PGP (Pretty Good Privacy) Dr.Tech. Göran Pulkkis Arcada Polytechnic ( ) Espoo, Finland

Cryptographic algorithms

Secret Key Cryptography

Public Key Cryptography

zinformation theory ztheory of computational complexity zinteger algebra (modulo arithmetics, factoring, random number generation, prime number generation and discrete logarithms) Mathematical basis of cryptography

Information theory z Confusion obscures the relationships between the plaintext and the encrypted ciphertext. The simplest confusion technique is substitution of binary patterns z Diffusion speads local information content of plaintext over the entire encrypted ciphertext. The simplest confusion technique is permutation of bit patterns

Quality Measures of Cryptosystems

Theory of Computational Complexity zthe computation time and memory space requirements of encryption and decryption operations zthe computation time requirements for breaking a cryptosystem

Ideal Cryptographic Algorithms zencryption and decryption operations have low complexity (=short execution times) zencryption can be broken only by guessing the correct key or trying out all possible keys, if the correct key is unknown (=exponential complexity - cracking time proportional to 2 n where n is the number of all possible keys)

Strong Encryption

zit has been mathematically proved to be ideal or zit has been for years been and is still being thoroughly studied in public research by many acknowledged cryptoanalysts all over the world and no easy cracking method (= estimated deterministic complexity lower than superpolynomial) is known in public A useful cryptographic algorithm

Conclusions for Applied Cryptography

Secret Key Algorithms in Use zTriple DES (Data Encryption Standard) with key length 112 or 168 bit zIDEA (International Data Encryption Standard) with key length 128 bits

 RSA (Rivest-Shamir-Adleman) with key length  1024 bits  ECC (Elliptic Curve Cryptography) based algorithms with key length  160 bits Public Key Algorithms in Use

Security of public key cryptosystems zirreproducible generation of large (>150 digits) random primes zthe high computational complexity of the problem to find the factors of a large (>300 digits) integer zthe high computational complexity of the problem to find the discrete logarithm in modulo arithmetics when the modulus is a large (>300 digits) integer

Modulo Arithmetics

zAn approach to secure random number generation is based on recording irreproducible physical randomness, like mouse movement traces, keystroke time intervals, physical noise, etc. zproved: number of primes  n/ln(n) when n . Thus there exists about /(154*ln(10))  3* positive primes which can be coded by 512 bits (“only” atoms in Universe). One of 300 numbers is on the average a prime! zlarge integers can efficiently be checked for primality in a PC (some milliseconds). Generate a large random odd integer, then step +2 and check. On average about 300 steps are needed until a prime is found Generation of large random primes

Basic Cryptographic Protocols zShared Secret Key Generation (Diffie-Hellman Key Exchange) zDigital Signatures - generation and checking zAuthentication Protocols (example: Kerberos, implemented in Win2000 logon)

Diffie-Hellman (D-H) Key Exchange zPublic key algorithms much slower than secret key algorithms (RSA ~ 1000 times slower than IDEA) zProtected info exchange using a shared secret key zD-H: A and B can agree on a shared secret key by exchanging only unencrypted integer values  Mathematics of D-H: K = (  XA mod p) XB mod p = (  XB mod p) XA mod p, when  (=a generator for modulo base p), p (=a prime),  XA mod p and  XB mod p are exchanded, XA is secret of A, XB is secret of B and K is the shared secret key

Digital signature generation zA message/document is combined with an encrypted (private key of signer) hash (a message digest) message hash algorithm hash encryption Private key of signer encrypted hash message Signed message

zThe unencrypted hash of a signed message is compared with the hash of the original message Checking a digital signature encrypted hash message Signed message hash algorithm hash decryption Public key of signer hash OK if match

Hash algorithms zReduce variable-length messages/documents to fixed-length (usually 128 or 160 bit) hashes zOriginal info not possible to deduce from a hash zProbability that 2 different messages/documents produce same hash ~ 0 (2 160 hash patterns more than atoms in a 6-dimensional Universe, where each atom is replaced by a new Universe) zhash = message digest or fingerprint zCommon hash algorithms: MD5 (128 bit), SHA-1 (160 bit), RIPEMD-160 (160 bit)