1. Planned Activities on Computer Security for Sunday Academy 2013-2014
Jun Liu, Jason Waskiewicz, Allen Nash

2. Time Schedule 11:00-11:15 Cultural Connection
11:15-11:45 General Introduction
11:45-12:00 Activity 1: Hands-on Practice on Symmetric-Key Ciphers.
12:00-12:30 Lunch
12:30-1:00 continue on with Activity 1.
1:00-2: Activity 2: Hands-on Practice on Asymmetric-Key Ciphers.
2:00-2: Activity 3: Zero-Knowledge Proof.
2:45-3:00 Wrap-up and Evaluation

3. What We Are Going To Learn?
Understanding the general goals of security.
Understanding the essential concerns in achieving the general goals of security.
Learning a few cryptographic methods.
Learning to evaluate the weakness of a cryptographic method.

4. Goals of Security
Confidentiality is the most common aspect of information security, which is to protect the confidential information.
Integrity means that changes on information can only be done by authorized entities.
Availability means that information needs to be accessible to authorized entities.

5. Common Attacks Attacks Threatening Confidentiality
Snooping refers to unauthorized access to or interception of data.
Attacks Threatening Integrity
Modification means that the attacker intercepts the message and changes it.
Masquerading means the attacker impersonates somebody else.
Attacks Threatening Availability
Denial of service (DoS) may slow down or totally crash the service of a system.

6. Security Services
Data confidentiality is to fight against the attacks threatening confidentiality.
Security mechanism: encipherment
Data integrity is to fight against the attacks threatening integrity.
Security mechanism: encrypted digest
Access control is to fight against the attacks threatening availability.

7. Security and Cultural Relations
Navajo Code Talkers
They were a small band of warriors who created an unbreakable code from the ancient language of their people and changed the course of modern history.
When America's best cryptographers were falling short, they were able to use their language as a successful code.
They have served with distinction in every major engagement of the Pacific war field from , their unbreakable code played a pivotal role in saving countless lives and hastening the war's end.

8. Common Attacks (1) Phishing Attacks
The act of sending an to a user falsely claiming to be an established legitimate enterprise.
Such attacks are the attempts to steal the identity by fooling the user to provide the private identity information.
The directs the user to visit a bogus Web site and to update personal information:
such as passwords, credit card information, social security numbers, and bank account information.
Actually, the personal information will be recorded by the attackers who will use the personal information to illegally access a user’s actual account at the established legitimate enterprise.
Suggestion to fighting against phishing attacks:
Making sure that you are accessing the legitimate enterprise website before you provide any personal information.

9. Common Attacks (2)
Phishing Attacks
Example

10. Common Attacks (3) Phishing Attacks Signs of phishing emails
Generic greeting
Phishing s are usually sent in large batches.
To save time, Internet criminals use generic names like "First Generic Bank Customer” to avoid typing all recipients' names out.
Suggestion: If you don't see your name, be suspicious.
Forged link
Even if a link has a name you recognize somewhere in it, it doesn't mean it links to the real organization.
Suggestion:
Roll your mouse over the link and see if it matches what appears in the . If there is a discrepancy, don't click on the link.
Websites where it is safe to enter personal information begin with "https" — the "s" stands for secure. If you don't see "https" do not proceed.

11. Common Attacks (4) Phishing Attacks Signs of phishing emails
Requests personal information
The point of sending phishing is to trick you into providing your personal information.
If you receive an requesting your personal information, it is probably a phishing attempt.
Sense of urgency
Internet criminals want you to provide your personal information now. They do this by making you think something has happened that requires you to act fast.

12. Common Attacks (5)
Phishing Attacks
Forged website

13. Common Attacks (6) Keylogging
Keylogger is a software program or hardware device that is used to monitor and log each of the keys typed through a computer keyboard.
The user who installed the program or hardware device can view all keys.
Keyloggers allow your information to be transmitted to an unknown third party.
Some keyloggers capture screens, rather than keystrokes.
Some keyloggers can also secretly turn on video or audio recorders, and transmit the recorded information over your internet connection.

14. Common Attacks (7) Software Keylogger
It is a program that can record each stroke on the keyboard.
It will automatically start capturing keystrokes as soon as the computer is turned on and remain undetected in the background.
It can be programmed to send a summary of all the keystrokes via .

15. Common Attacks (8) Hardware Keylogger
It usually looks like a USB drive which can be connected to the victim's computer.
It comes with the keylogging software which is pre-installed on the device.
A summary of the keystrokes is recorded on the USB drive.

16. Common Attacks (9) How to protect yourself from key logging
Use a firewall.
Keyloggers usually send information through the internet.
A firewall will monitor your computer's online activity and sniff out the suspicious data transmission.
Install a password manager.
Keyloggers can't steal what you don't type.
Password mangers automatically fill out important forms without making you to type anything in.
Update your software.
Once a company knows of any exploits in their software, it works on an update to deal with the exploitation.
Change passwords.
If you still don't feel protected, you can change your password frequently.

17. Planned Activities Three activities have been planned:
Activity 1: Hands-on practice on traditional symmetric-key ciphers.
Activity 2: Hands-on practice on asymmetric-key cryptography.
Activity 3: Hands-on practice on zero-knowledge proof.

18. Activity 1: Symmetric-Key Ciphers

19. Activity 1 Examples of Symmetric-Key Ciphers
We will look into a few examples of Symmetric-Key Ciphers to see how they work.
Caesar cipher: Julius Caesar used an additive cipher to communicate with his officers.
Caesar used a key of 3 for his communications.
Vigenere cipher: It is an example of polyalphabetic substitution cipher.
Transposition cipher: It does not substitute one symbol for another, instead it changes the location of the symbols.

20. Activity 1 Caesar cipher (1)
It is the earliest known substitution cipher made by Julius Caesar.
It is the first attested use in military affairs.
It replaces each letter by the 3rd letter on the right.
The transformation is defined as
a b c d e f g h i j k l m n o p q r s t u v w x y z
D E F G H I J K L M N O P Q R S T U V W X Y Z A B C
Example:
Plaintext: meet me after the toga party
Ciphertext: PHHW PH DIWHU WKH WRJD SDUWB

21. Activity 1 Caesar cipher (2)
The security of the mono-alphabetic substitution cipher
We could follow a brute force search approach by simply trying each possible key in turn.
When given a cipher text, just try all shifts of letters until we see meaningful text.
Another systematic way of cracking the Caesar cipher is to use the features in English language.
Human languages are redundant, and characters are not equally commonly used.
In English, E is by far the most common letter, followed by T,R,N,I,O,A,S.
Other letters like Z,J,K,Q,X are fairly rare.

22. Activity 1 Caesar cipher (3)

23. Activity 1 Caesar cipher (4)
Mono-alphabetic substitution ciphers do not change the relative letter frequencies.
Attackers can simply calculate the letter frequencies for cipher text and compare the counts against known values.
To solve the ties, tables of common double/triple letters help a lot.
Example:
given cipher text:
UZQSOVUOHXMOPVGPOZPEVSGZWSZOPFPESXUDBMETSXAIZ
VUEPHZHMDZSHZOWSFPAPPDTSVPQUZWYMXUZUHSX
EPYEPOPDZSZUFPOMBZWPFUPZHMDJUDTMOHMQ
count relative letter frequencies.
P Z U S O M H D E X V W F T Q Y G A B Y I J
guess P and Z are e and t, respectively.
guess ZW is th and hence ZWP is the.
proceeding with trial and error finally get:
it was disclosed yesterday that several informal but
direct contacts have been made with political
representatives of the viet cong in moscow

24. Activity 1 Caesar cipher (5)
Relative letter frequencies
P: e t i a s o c n _ _ _ h _ m w _ _ _ _ _ _
C: P Z U S O M H D E X V W F T Q Y G A B I J
Partial translation:
itwas isc ose este a thatse e a in o m
UZQSOVUOHXMOPVGPOZPEVSGZWSZOPFPESXUDBMET
a t i ectcontactsha e eenma ewith o it
SXAIZVUEPHZHMDZSHZOWSFPAPPDTSVPQUZWYMXUZ
ica e esentati eso the ietcon inmoscow
UHSXEPYEPOPDZSZUFPOMBZWPFUPZHMDJUDTMOHMQ

25. Activity 1 Caesar cipher (6)
We continue to work on the translation
P: e t i a s o c n _ _ _ h _ m w _ _ _ _ _ _
C: P Z U S O M H D E X V W F T Q Y G A B I J
E  r
itwas isc ose ester a thatse era in orm
UZQSOVUOHXMOPVGPOZPEVSGZWSZOPFPESXUDBMET
a t irectcontactsha e eenma ewith o it
SXAIZVUEPHZHMDZSHZOWSFPAPPDTSVPQUZWYMXUZ
ica re resentati eso the ietcon inmoscow
UHSXEPYEPOPDZSZUFPOMBZWPFUPZHMDJUDTMOHMQ

26. Activity 1 Caesar cipher (7)
We continue to work on the translation
P: e t i a s o c n r l _ h _ m w _ _ _ _ _ _
C: P Z U S O M H D E X V W F T Q Y G A B I J
X  l
itwas isclose ester a thatse eralin orm
UZQSOVUOHXMOPVGPOZPEVSGZWSZOPFPESXUDBMET
al t irectcontactsha e eenma ewith olit
SXAIZVUEPHZHMDZSHZOWSFPAPPDTSVPQUZWYMXUZ
icalre resentati eso the ietcon inmoscow
UHSXEPYEPOPDZSZUFPOMBZWPFUPZHMDJUDTMOHMQ

27. Activity 1 Caesar cipher (8)
We continue to work on the translation
P: e t i a s o c n r l d h _ m w _ _ _ _ _ _
C: P Z U S O M H D E X V W F T Q Y G A B I J
V  d
itwasdisclosed esterda thatse eralin orm
UZQSOVUOHXMOPVGPOZPEVSGZWSZOPFPESXUDBMET
al tdirectcontactsha e eenmadewith olit
SXAIZVUEPHZHMDZSHZOWSFPAPPDTSVPQUZWYMXUZ
icalre resentati eso the ietcon inmoscow
UHSXEPYEPOPDZSZUFPOMBZWPFUPZHMDJUDTMOHMQ

28. Activity 1 Caesar cipher (9)
We continue to work on the translation
P: e t i a s o c n r l d h v m w _ _ _ _ _ _
C: P Z U S O M H D E X V W F T Q Y G A B I J
F  v
itwasdisclosed esterda thatseveralin orm
UZQSOVUOHXMOPVGPOZPEVSGZWSZOPFPESXUDBMET
al tdirectcontactshave eenmadewith olit
SXAIZVUEPHZHMDZSHZOWSFPAPPDTSVPQUZWYMXUZ
icalre resentativeso thevietcon inmoscow
UHSXEPYEPOPDZSZUFPOMBZWPFUPZHMDJUDTMOHMQ

29. Activity 1 Caesar cipher (10)
We continue to work on the translation
P: e t i a s o c n r l d h v m w p y b _ _ _
C: P Z U S O M H D E X V W F T Q Y G A B I J
itwasdisclosedyesterdaythatseveralin orm
UZQSOVUOHXMOPVGPOZPEVSGZWSZOPFPESXUDBMET
alb tdirectcontactshavebeenmadewithpolit
SXAIZVUEPHZHMDZSHZOWSFPAPPDTSVPQUZWYMXUZ
icalrepresentativeso thevietcon inmoscow
UHSXEPYEPOPDZSZUFPOMBZWPFUPZHMDJUDTMOHMQ
Proceeding with trial and error finally get:
it was disclosed yesterday that several informal but
direct contacts have been made with political
representatives of the viet cong in moscow

30. Activity 1 Vigenere cipher (1)
It is the simplest example of the polyalphabetic substitution ciphers.
It improve security of Caesar ciphers by using multiple letters.
It makes cryptanalysis harder with the flatter frequency distribution.
A key is multiple letters long K = k1 k2 ... kd
The ith letter specifies ith alphabet to use.
Use each alphabet in turn.
Repeat from start after d letters in message.
Decryption simply works in reverse.

31. Activity 1 Vigenere cipher (2)
An Example of Vigenère Cipher
The keyword is: deceptive
key:
session 1 | session | session 3
deceptivedeceptivedeceptive
Plaintext:
wearediscoveredsaveyourself
ciphertext:
ZICVTWQNGRZGVTWAVZHCQYGLMGJ
Relative frequency (flatter)
G V Z C T W Q A M I J L N R Y

32. Activity 1 Vigenere cipher (3)
Security of Vigenère Cipher
The letter frequencies are obscured because that one plaintext letter may corresponds to multiple ciphertext.
But, the letter frequencies are not totally lost.
Steps of cracking
Start with letter frequencies to see if look monoalphabetic cipher or not.
If not, then need to determine number of alphabets, since then can attach each.
The Kasiski Method can be used to crack the Vigenère Cipher.

33. Activity 1 Transposition cipher (1)
The transposition cipher is to divide the plaintext into groups of predetermined size, called blocks, and then use a key to permute the characters in each block separately.
It will make the cipher text to have the same frequency distribution as the original text.
The encryption key is the size of the blocks.

34. Activity 1 Transposition cipher (2)
Plaintext: ‘WE ARE DISCOVERED. FLEE AT ONCE’
First, removing punctuations an write the text in a row:
WEAREDISCOVEREDFLEEATONCE
Organizing the plaintext into a block for a block size of 6:
W E A R E D
I S C O V E
R E D F L E
E A T O N C
E Q K J E U
Then, reading the text column wise and put the text into a row to form the cipher:
WIREE ESEAQ ACDTK ROFOJ EVLNE DEECU
In order to restore the plaintext from the cipher, we must have to know the block size.
The block size is the secret which is only known to Alice and Bob.

35. Activity 1 Transposition cipher (3)
Exercise:
Cipher text:
WIESHNMSEGEONWMUDABRRTECIERENRIZKRTZ
What is the plain text?
Hint: You have to guess the size of the block.
Time limit: 1 minute.

36. Activity 1 Transposition cipher (4)
Exercise:
Cipher text:
WIESHNMSEGEONWMUDABRRTECIERENRIZKRTZ
What is the plain text?
Hint: You have to guess the size of the block.
Answer:
Key: 4
Plain text:
When drinking water, remember its source.

37. Activity 2: Asymmetric-Key Cryptography (1)
Symmetric-key cryptography is based on sharing secrecy between Alice and Bob.
The shared key has to be updated periodically.
It is difficult to send the new key to Alice and Bob.
There is a need that the secrecy is not sent.
The solution is the asymmetric-key cryptography which is based on personal secrecy.

38. Activity 2: Asymmetric-Key Cryptography (2)
Asymmetric-key cryptography uses two separate keys: one private key and one public key.
The private key is never sent out from the key owner.
The public key is supposed to be known by everyone in the world.
Plaintext and cipher text are treated as integers in asymmetric-key cryptography.
The main idea behind asymmetric-key cryptography is the concept of the trapdoor one-way function.

39. Activity 2: Asymmetric-Key Cryptography (3)

40. Activity 2: Asymmetric-Key Cryptography (4)
One-Way Function (OWF)
1. f is easy to compute.
2. f −1 is difficult to compute.
Trapdoor One-Way Function (TOWF)
3. Given y and a trapdoor, x can be computed easily.

41. Activity 2: Asymmetric-Key Cryptography (5)
Example of trapdoor one-way function
For two large prime numbers p and q.
n = p × q is a one-way function.
Given p and q , it is always easy to calculate n;
Given n, it is very difficult to compute p and q when p and q are large.
When given n and one of the factors, it becomes easy to calculate the other factor.

42. Activity 2: Asymmetric-Key Cryptography (6)
A difficult calculation:
Given a sequence
[295, 592, 301, 14, 28, 353, 120, 236]
and a value 1129
It is known that the value 1129 is a sum of a portion of the sequence.
Can you quickly figure out the items in the sequence, which are used to form the value of 1129?

43. Activity 2: Asymmetric-Key Cryptography (7)
An easy calculation:
Given a new sequence
[2, 7, 11, 21, 42, 89, 180, 354]
and a value 372
It is known that the value 372 is a sum of a portion of the sequence.
Can you quickly figure out the items in the sequence that are used to form the value of 372?

44. Activity 2: Asymmetric-Key Cryptography (8)
The sequence [2, 7, 11, 21, 42, 89, 180, 354] is super-increasing.
The decomposition of 372 is very easy.
354
*354 = 18 1
180
18 - 0*180 = 18 89
18 - 0*89 = 18 42
18 - 0*42 = 18 21
18 - 0*21 = 18 11
18 - 1*11 = 7 7
7 - 1* = 0 2
0 - 0* = 0

45. Activity 2: Asymmetric-Key Cryptography (9)
Example asymmetric-key cipher
Public key:
[295, 592, 301, 14, 28, 353, 120, 236]
Cipher: 1129
Private key:
[2, 7, 11, 21, 42, 89, 180, 354]
Plaintext: a

46. Activity 2: Asymmetric-Key Cryptography (10)
We play a simple game to show the procedure of the knapsack cryptosystem.
First, I create a pair of private and public keys.
Second, I publish my public key to everyone.
The public key consists of 8 integers.
Public key = [295, 592, 301, 14, 28, 353, 120, 236].
Third, I keep the private key as a personal secret.
Fourth, each of you choose a character and encodes the character into an 8-bits representation.
For example, the character a is expressed as
Fifth, you encode the plaintext into a cipher.
For example, the cipher text of plaintext a is integer 1129.
0*295+1*592+1*301+0*14+0*28+0*353+0*120+1*236 = 1129
Sixth, you show your cipher to others to let them to guess what your original character is (without disclosing your original character).

47. Activity 2: Asymmetric-Key Cryptography (11)
The key owner can always quickly get to know the original character, once you show me the cipher.
The trick lies in the way that the key is generated.
The length of the public key consists of 8 integers
Choosing a supper-increasing sequence
[2, 7, 11, 21, 42, 89, 180, 354].
The sum of the sequence of the private key is n=881.
Another integer r=588 is chosen to cook the private key into a public key through
(2 * 588) mod 881 = 295
(7 * 588) mod 881 = 592
(11 * 588) mod 881 = 301
(21 * 588) mod 881 = 14
(42 * 588) mod 881 = 28
(89 * 588) mod 881 = 353
(180 * 588) mod 881 = 120
(354 * 588) mod 881 = 236
The inverse of r is r-1 = 442.
It can be verified that r * r-1 = 588*442 mod 881 = 1 mod 881
Public key = [295, 592, 301, 14, 28, 353, 120, 236]
Private key = {[2, 7, 11, 21, 42, 89, 180, 354], n=881, r=588}.

48. Activity 2: Asymmetric-Key Cryptography (12)
I show that how I can quickly find out the original character.
Suppose I get the cipher C=1129.
I compute
C * r-1 mod n
= 1129 * 442 mod 881 = 372.
Next, I decompose 372 based on the super-increasing sequence. (see the table on the right)
The plain text is a
a =
Note: the decomposition always starts from the larger numbers and continues to smaller numbers.
354
*354 = 18 1
180
18 - 0*180 = 18 89
18 - 0*89 = 18 42
18 - 0*42 = 18 21
18 - 0*21 = 18 11
18 - 1*11 = 7 7
7 - 1* = 0 2
0 - 0* = 0

49. Activity 3: Zero-Knowledge Proof (1)
An essential question:
How to convince someone that you have the solution to a problem, without revealing any detail of your solution to others?
Example:
You have a secret or a new invention.
You want to sell your secret/invention to the potential buyers.
A dilemma:
The buyers won’t pay you before they are convinced by the truthfulness of your secret/invention.
You won’t disclose more details of your secret/invention before you get paid.

50. Activity 3: Zero-Knowledge Proof (2)
The solution: zero-knowledge proof.
The proof consists of a prover and a verifier.
In our example,
the owner of a secret/invention is the prover;
a potential buyer is the verifier.
The prover interacts with the verifier to prove the truthfulness of the secret/invention.
The prover should prove the truthfulness of the secret/invention, without revealing any detail.
Whatever can be learned from the proof, can be learned without it.

51. Activity 3: Zero-Knowledge Proof (3)
The solution: zero-knowledge proof.
The proof is to design a conversation between the verifier and the prover, such that
the verifier should be made to agree with the truthfulness of the secret/invention, if the secret/invention is true;
the verifier has the chance of finding a contradiction, if the secret/invention is not true;
the proof itself does not leak any detail of the secret to the verifier.

52. Activity 3: Zero-Knowledge Proof (4)
An example zero-knowledge proof
Sudoku Puzzles
A Sudoku puzzle is a 9x9 board partially filled out with numbers 1-9.
The goal is to fill out the rest of the board with numbers 1-9 such that every row, column and the 3x3 sub-boxes all have exactly one of each digit in them.
Unsolved puzzle
Solved puzzle

53. Activity 3: Zero-Knowledge Proof (5)
An example zero-knowledge proof
Sudoku Puzzles

54. Activity 3: Zero-Knowledge Proof (6)
An example zero-knowledge proof
Sudoku Puzzles

55. Activity 3: Zero-Knowledge Proof (7)
An example zero-knowledge proof
Sudoku Puzzles