Attacks on OTP and stream ciphers

Slides:

Advertisements

Similar presentations

ECE454/CS594 Computer and Network Security

Advertisements

Dan Boneh Using block ciphers Modes of operation: one time key Online Cryptography Course Dan Boneh example: encrypted , new key for every message.

Online Cryptography Course Dan Boneh

Dan Boneh Stream ciphers Real-world Stream Ciphers Online Cryptography Course Dan Boneh.

CMSC 414 Computer (and Network) Security Lecture 4 Jonathan Katz.

Dan Boneh Authenticated Encryption Active attacks on CPA-secure encryption Online Cryptography Course Dan Boneh.

Introduction to Cryptography David Brumley Carnegie Mellon University Credits: Many slides from Dan Boneh’s June 2012 Coursera crypto.

1 Introduction CSE 5351: Introduction to cryptography Reading assignment: Chapter 1 of Katz & Lindell.

WEP 1 WEP WEP 2 WEP  WEP == Wired Equivalent Privacy  The stated goal of WEP is to make wireless LAN as secure as a wired LAN  According to Tanenbaum:

Wireless LAN Security Jerry Usery CS 522 December 6 th, 2006.

CMSC 414 Computer and Network Security Lecture 3 Jonathan Katz.

Foundations of Network and Computer Security J J ohn Black Lecture #34 Dec 5 th 2007 CSCI 6268/TLEN 5831, Fall 2007.

Computer Security CS 426 Lecture 3

Dan Boneh Basic key exchange The Diffie-Hellman protocol Online Cryptography Course Dan Boneh.

Dan Boneh Basic key exchange Public-key encryption Online Cryptography Course Dan Boneh.

Dan Boneh Public Key Encryption from trapdoor permutations RSA in practice Online Cryptography Course Dan Boneh.

Active attacks on CPA-secure encryption

Dan Boneh Authenticated Encryption Definitions Online Cryptography Course Dan Boneh.

Dan Boneh Authenticated Encryption Chosen ciphertext attacks Online Cryptography Course Dan Boneh.

Dan Boneh Public Key Encryption from trapdoor permutations Public key encryption: definitions and security Online Cryptography Course Dan Boneh.

Dan Boneh Authenticated Encryption Case study: TLS Online Cryptography Course Dan Boneh.

Dan Boneh Stream ciphers The One Time Pad Online Cryptography Course Dan Boneh.

CS526Topic 3: One-time Pad and Perfect Secrecy 1 Information Security CS 526 Topic 3 Cryptography: One-time Pad, Information Theoretic Security, and Stream.

13-1 Last time Security in Networks Network Security Controls Firewalls Honeypots Intrusion Detection Systems.

One-Time Pad Or Vernam Cipher Sayed Mahdi Mohammad Hasanzadeh Spring 2004.

CS555Spring 2012/Topic 51 Cryptography CS 555 Topic 5: Pseudorandomness and Stream Ciphers.

CS555Spring 2012/Topic 111 Cryptography CS 555 Topic 11: Encryption Modes and CCA Security.

Dan Boneh Using block ciphers Modes of operation: many time key (CTR) Online Cryptography Course Dan Boneh Example applications: 1. File systems: Same.

Classical Crypto By: Luong-Sorin VA, IMIT Dith Nimol, IMIT.

More About DES Cryptography and Network Security Reference: Sec 3.1 of Stallings Text.

Dan Boneh Using block ciphers Modes of operation: many time key (CBC) Online Cryptography Course Dan Boneh Example applications: 1. File systems: Same.

Dan Boneh Stream ciphers Pseudorandom Generators Online Cryptography Course Dan Boneh.

Cryptography Lecture 2 Arpita Patra. Summary of Last Class  Introduction  Secure Communication in Symmetric Key setting >> SKE is the required primitive.

Giuseppe Bianchi Warm-up example 1 found on a real paper! Warm-up example 1 found on a real paper!

Dan Boneh Basic key exchange Merkle Puzzles Online Cryptography Course Dan Boneh.

WEP – Wireless Encryption Protocol A. Gabriel W. Daleson CS 610 – Advanced Security Portland State University.

Odds and ends Tweakable encryption

Encryption Protocols used in Wireless Networks Derrick Grooms.

Encryption CS110: Computer Science and the Internet.

Template vertLeftWhite2 Authenticated Encryption Attacking non-atomic decryption Online Cryptography Course Dan Boneh.

Dan Boneh Stream ciphers Stream ciphers are semantically secure Online Cryptography Course Dan Boneh Goal: secure PRG ⇒ semantically secure stream cipher.

CS555Spring 2012/Topic 71 Cryptography CS 555 Topic 7: Stream Ciphers and CPA Security.

Dan Boneh Basic key exchange Trusted 3 rd parties Online Cryptography Course Dan Boneh.

Dan Boneh Introduction Course Overview Online Cryptography Course Dan Boneh.

Introduction to Cryptography

802.11b Security CSEP 590 TU Osama Mazahir. Introduction Packets are sent out into the air for anyone to receive Eavesdropping is a much larger concern.

Dan Boneh Collision resistance The Merkle-Damgard Paradigm Online Cryptography Course Dan Boneh.

Dan Boneh Stream ciphers PRG Security Defs Online Cryptography Course Dan Boneh.

Dan Boneh Odds and ends Deterministic Encryption Online Cryptography Course Dan Boneh.

Giuseppe Bianchi Warm-up example WEP. Giuseppe Bianchi WEP lessons  Good cipher is far from being enough  You must make good USAGE of cipher.

Wired Equivalent Privacy (WEP) Chris Overcash. Contents What is WEP? What is WEP? How is it implemented? How is it implemented? Why is it insecure? Why.

University of Malawi, Chancellor College

Dan Boneh Public Key Encryption from trapdoor permutations Constructions Online Cryptography Course Dan Boneh Goal: construct chosen-ciphertext secure.

Dan Boneh Authenticated Encryption CBC paddings attacks Online Cryptography Course Dan Boneh.

Slide 1 Vitaly Shmatikov CS 378 Stream Ciphers. slide 2 Stream Ciphers uRemember one-time pad? Ciphertext(Key,Message)=Message  Key Key must be a random.

@Yuan Xue CS 285 Network Security Block Cipher Principle Fall 2012 Yuan Xue.

หัวข้อบรรยาย Stream cipher RC4 WEP (in)security LFSR CSS (in)security.

Secrecy of (fixed-length) stream ciphers

PRPs and PRFs CS255: Winter 2017

Cryptography Lecture 9.

Cryptography Lecture 12.

B504/I538: Introduction to Cryptography

Cryptography and Security Fall 2009 Steve Lai

Cryptography Lecture 6.

Cryptography Lecture 7 Arpita Patra © Arpita Patra.

B504/I538: Introduction to Cryptography

Symmetric-Key Encryption

Cryptography Lecture 8.

Cryptography Lecture 12.

Cryptography Lecture 11.

Presentation transcript:

Attacks on OTP and stream ciphers Online Cryptography Course Dan Boneh Stream ciphers Attacks on OTP and stream ciphers

Review OTP: E(k,m) = m ⊕ k , D(k,c) = c ⊕ k Making OTP practical using a PRG: G: K ⟶ {0,1}n Stream cipher: E(k,m) = m ⊕ G(k) , D(k,c) = c ⊕ G(k) Security: PRG must be unpredictable (better def in two segments)

Attack 1: two time pad is insecure !! Never use stream cipher key more than once !! C1  m1  PRG(k) C2  m2  PRG(k) Eavesdropper does: C1  C2  m1  m2 Enough redundancy in English and ASCII encoding that: m1  m2  m1 , m2

Real world examples Project Venona MS-PPTP (windows NT): k k Venona: soviet messages sent from 1941 to 1946, decrypted about 3000 messages. Need different keys for C⟶S and S⟶C

Real world examples 802.11b WEP: m k k Length of IV: 24 bits Repeated IV after 224 ≈ 16M frames On some 802.11 cards: IV resets to 0 after power cycle m CRC(m) k PRG( IV ll k ) k IV ciphetext

Avoid related keys 802.11b WEP: key for frame #1: (1 ll k) key for frame #2: (2 ll k) m CRC(m) k PRG( IV ll k ) k IV ciphetext ⋮

A better construction k k ⇒ now each frame has a pseudorandom key PRG k k ⇒ now each frame has a pseudorandom key better solution: use stronger encryption method (as in WPA2)

Yet another example: disk encryption

Two time pad: summary Never use stream cipher key more than once !! Network traffic: negotiate new key for every session (e.g. TLS) Disk encryption: typically do not use a stream cipher

Attack 2: no integrity (OTP is malleable) enc ( ⊕k ) m⊕k m p (m⊕k)⊕p ⊕ dec ( ⊕k ) m⊕p Modifications to ciphertext are undetected and have predictable impact on plaintext

Attack 2: no integrity (OTP is malleable) enc ( ⊕k ) From: Bob From: Bob ⊕ ⋯ dec ( ⊕k ) From: Eve From: Eve Modifications to ciphertext are undetected and have predictable impact on plaintext Bob: 42 6F 62 , Eve: 45 76 65 , Bob ⊕ Eve: 07 19 07

End of Segment