Dan Boneh Odds and ends Key Derivation Online Cryptography Course Dan Boneh.

Slides:

Advertisements

Similar presentations

TCC 2006 Research on Password-Authenticated Group Key Exchange Jeong Ok Kwon, Ik Rae Jeong, and Dong Hoon Lee (CIST, Korea Univ.) Kouchi Sakurai (Kyushu.

Advertisements

Boneh-Franklin Identity-based Encryption. 2 Symmetric bilinear groups G = ágñ, g p = 1 e: G G G t Bilinear i.e. e(u a, v b ) = e(u, v) ab Non-degenerate:

Dan Boneh Message integrity Message Auth. Codes Online Cryptography Course Dan Boneh.

ElGamal Security Public key encryption from Diffie-Hellman

Dan Boneh Using block ciphers Modes of operation: one time key Online Cryptography Course Dan Boneh example: encrypted , new key for every message.

Trusted 3rd parties Basic key exchange

Online Cryptography Course Dan Boneh

Hash Function. What are hash functions? Just a method of compressing strings – E.g., H : {0,1}*  {0,1} 160 – Input is called “message”, output is “digest”

Dan Boneh Stream ciphers Real-world Stream Ciphers Online Cryptography Course Dan Boneh.

CS 483 – SD SECTION BY DR. DANIYAL ALGHAZZAWI (3) Information Security.

Dan Boneh Public key encryption from Diffie-Hellman ElGamal Variants With Better Security Online Cryptography Course Dan Boneh.

1 Security Handshake Pitfalls. 2 Authentication Handshakes Secure communication almost always includes an initial authentication handshake: –Authenticate.

Dan Boneh Authenticated Encryption Active attacks on CPA-secure encryption Online Cryptography Course Dan Boneh.

CIS 5371 Cryptography 3b. Pseudorandomness.

CS457 – Introduction to Information Systems Security Cryptography 1b Elias Athanasopoulos

Dan Boneh Message Integrity A Parallel MAC Online Cryptography Course Dan Boneh.

© 2003 School of Computing, University of Leeds SY32 Secure Computing, Lecture 15 Implementation Flaws Part 3: Randomness and Timing Issues.

CMSC 414 Computer and Network Security Lecture 14 Jonathan Katz.

Apr 4, 2003Mårten Trolin1 Previous lecture TLS details –Phases Handshake Securing messages –What the messages contain –Authentication.

CMSC 414 Computer and Network Security Lecture 13 Jonathan Katz.

Authentication System

Dan Boneh Collision resistance Generic birthday attack Online Cryptography Course Dan Boneh.

Password Authentication J. Mitchell CS 259. Password fileUser exrygbzyf kgnosfix ggjoklbsz … kiwifruit hash function.

Dan Boneh Basic key exchange The Diffie-Hellman protocol Online Cryptography Course Dan Boneh.

Dan Boneh Basic key exchange Public-key encryption Online Cryptography Course Dan Boneh.

Dan Boneh Public Key Encryption from trapdoor permutations The RSA trapdoor permutation Online Cryptography Course Dan Boneh.

Dan Boneh Public Key Encryption from trapdoor permutations RSA in practice Online Cryptography Course Dan Boneh.

Dan Boneh Block ciphers The data encryption standard (DES) Online Cryptography Course Dan Boneh.

Dan Boneh Authenticated Encryption Definitions Online Cryptography Course Dan Boneh.

Cryptography and Network Security Chapter 11 Fifth Edition by William Stallings Lecture slides by Lawrie Brown.

Dan Boneh Public Key Encryption from trapdoor permutations Public key encryption: definitions and security Online Cryptography Course Dan Boneh.

Dan Boneh Authenticated Encryption Case study: TLS Online Cryptography Course Dan Boneh.

Dan Boneh Stream ciphers The One Time Pad Online Cryptography Course Dan Boneh.

Dan Boneh Public key encryption from Diffie-Hellman The ElGamal Public-key System Online Cryptography Course Dan Boneh.

CS555Spring 2012/Topic 51 Cryptography CS 555 Topic 5: Pseudorandomness and Stream Ciphers.

Lecture 11: Strong Passwords

Authentication Key HMAC(MK, “auth”) Server Encryption Key HMAC(MK, “server_enc”) User Password Master Key (MK) Client Encryption Key HMAC(MK, “client_enc”)

Dan Boneh Odds and ends Format preserving encryption Online Cryptography Course Dan Boneh.

Ryan Henry I 538 /B 609 : Introduction to Cryptography.

The Misuse of RC4 in Microsoft Office A paper by: Hongjun Wu Institute for Infocomm Research, Singapore ECE 578 Matthew Fleming.

Dan Boneh Using block ciphers Modes of operation: many time key (CTR) Online Cryptography Course Dan Boneh Example applications: 1. File systems: Same.

Attacks on OTP and stream ciphers

Dan Boneh Public Key Encryption from trapdoor permutations PKCS 1 Online Cryptography Course Dan Boneh.

Dan Boneh Using block ciphers Modes of operation: many time key (CBC) Online Cryptography Course Dan Boneh Example applications: 1. File systems: Same.

Dan Boneh Stream ciphers Pseudorandom Generators Online Cryptography Course Dan Boneh.

Dan Boneh Collision resistance Introduction Online Cryptography Course Dan Boneh.

Dan Boneh Public key encryption from Diffie-Hellman The ElGamal Public-key System Online Cryptography Course Dan Boneh.

Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP License. The OWASP.

Dan Boneh Basic key exchange Merkle Puzzles Online Cryptography Course Dan Boneh.

1 Standardizing Key Derivation Functions Hugo Krawczyk IBM Research Or: google kdf hmac.

CMSC 414 Computer and Network Security Lecture 20 Jonathan Katz.

Dan Boneh Message Integrity CBC-MAC and NMAC Online Cryptography Course Dan Boneh.

Odds and ends Tweakable encryption

PKCS #5: Password-Based Cryptography Standard

Dan Boneh Basic key exchange Trusted 3 rd parties Online Cryptography Course Dan Boneh.

Dan Boneh Collision resistance The Merkle-Damgard Paradigm Online Cryptography Course Dan Boneh.

Dan Boneh Stream ciphers PRG Security Defs Online Cryptography Course Dan Boneh.

Dan Boneh Odds and ends Deterministic Encryption Online Cryptography Course Dan Boneh.

Error-Correcting Codes and Pseudorandom Projections Luca Trevisan U.C. Berkeley.

Dan Boneh Introduction Discrete Probability (crash course, cont.) Online Cryptography Course Dan Boneh See also:

Online Cryptography Course Dan Boneh

TLS PRF Considered Harmful Issues with implementing Hardware Security Module Support for TLS.

Dan Boneh Public Key Encryption from trapdoor permutations Constructions Online Cryptography Course Dan Boneh Goal: construct chosen-ciphertext secure.

PKCS #5 v2.0: Password-Based Cryptography Standard

Dan Boneh Authenticated Encryption CBC paddings attacks Online Cryptography Course Dan Boneh.

Dan Boneh Authenticated Encryption Constructions from ciphers and MACs Online Cryptography Course Dan Boneh.

RSA Laboratories’ PKCS Series - a Tutorial

ATTACKS ON WINZIP ENCRYPTION

الأستاذ المساعد بقسم المناهج وطرق التدريس

Blockchains Lecture 4.

Presentation transcript:

Dan Boneh Odds and ends Key Derivation Online Cryptography Course Dan Boneh

Dan Boneh Deriving many keys from one Typical scenario. a single source key (SK) is sampled from: Hardware random number generator A key exchange protocol (discussed later) Need many keys to secure session: unidirectional keys; multiple keys for nonce-based CBC. Goal: generate many keys from this one source key SK k 1, k 2, k 3, … KDF

Dan Boneh When source key is uniform F: a PRF with key space K and outputs in {0,1} n Suppose source key SK is uniform in K Define Key Derivation Function (KDF) as: CTX: a string that uniquely identifies the application KDF ( SK, CTX, L) := F ( SK, (CTX ll 0) ) ll F ( SK, (CTX ll 1) ) ll ⋯ ll F ( SK, (CTX ll L) ) KDF ( SK, CTX, L) := F ( SK, (CTX ll 0) ) ll F ( SK, (CTX ll 1) ) ll ⋯ ll F ( SK, (CTX ll L) )

Template vertLeftWhite2 What is the purpose of CTX? KDF ( SK, CTX, L) := F ( SK, (CTX ll 0) ) ll F ( SK, (CTX ll 1) ) ll ⋯ ll F ( SK, (CTX ll L) ) KDF ( SK, CTX, L) := F ( SK, (CTX ll 0) ) ll F ( SK, (CTX ll 1) ) ll ⋯ ll F ( SK, (CTX ll L) ) Even if two apps sample same SK they get indep. keys It’s good practice to label strings with the app. name It serves no purpose

Dan Boneh What if source key is not uniform? Recall: PRFs are pseudo random only when key is uniform in K SK not uniform ⇒ PRF output may not look random Source key often not uniformly random: Key exchange protocol: key uniform in some subset of K Hardware RNG: may produce biased output

Dan Boneh Extract-then-Expand paradigm Step 1: extract pseudo-random key k from source key SK step 2: expand k by using it as a PRF key as before prob SK prob k extractor salt salt: a fixed non-secret string chosen at random

Dan Boneh HKDF: a KDF from HMAC Implements the extract-then-expand paradigm: extract: use k HMAC( salt, SK ) Then expand using HMAC as a PRF with key k

Dan Boneh Password-Based KDF (PBKDF) Deriving keys from passwords: Do not use HKDF: passwords have insufficient entropy Derived keys will be vulnerable to dictionary attacks PBKDF defenses: salt and a slow hash function Standard approach: PKCS#5 (PBKDF1) H (c) (pwd ll salt): iterate hash function c times (more on this later)

Dan Boneh End of Segment