1. Feb 18, 2003Mårten Trolin1 Previous lecture Block ciphers Modes of operations First assignment Hash functions

2. Feb 18, 2003Mårten Trolin2 This lecture More on hash functions Digital signatures Message Authentication Codes Padding

3. Feb 18, 2003Mårten Trolin3 Homepage for the course Reminder – there is a homepage for the course at http://www.nada.kth.se/~marten/AC/2003 with a mirror at http://students.mii.lu.lv/user/AC/2003 This page contains the latest information on the course All lectures can be downloaded from this page

4. Feb 18, 2003Mårten Trolin4 Hash functions A hash function is a function f:{0,1}*  {0,1} n. –Example: Check sums in communication protocols –Indices in databases One-way –Given x, unfeasible to compute an v such that H(v) = x Collision-free –Unfeasible to find v 1 and v 2 such that v 1  v 2 and H(v 1 ) = H(v 2 )

5. Feb 18, 2003Mårten Trolin5 Digital signatures Used to ensure authenticity. A digital signatures binds a document to a person. A person produces a digital signature using his private key The signature can be verified using the public key.

6. Feb 18, 2003Mårten Trolin6 How to sign a document d Compute the hash of d, v = H(d). Perform a private key operation on v. The result is a digital signature. What happens if the hash function is not collision free?

7. Feb 18, 2003Mårten Trolin7 Use of a digital signature Signature generation Private key Document Signature Signature verification Public key Document OK / not OK SignerVerifier

8. Feb 18, 2003Mårten Trolin8 Message Authentication Codes Digital signatures requires public/private keys The same functionality can be achived with symmetric keys –Called MAC – Message Authentication Code –Signer and verifier uses the same key Question: What are the advantages compared to digital signatures? What are the disadvantages?

9. Feb 18, 2003Mårten Trolin9 Two simple MACs Let E key, D key be a symmetric cipher, and let H be a hash function. Let m be the message to MAC and let k be the symmetric key. First proposition: Compute a hash of the document and encrypt it –E k (H(m)) Second proposition: Concatinate the message and the key and compute the hash –H(m  k)

10. Feb 18, 2003Mårten Trolin10 Use of a MAC MAC generation Symmetric key Document MAC MAC verification Symmetric key Document OK / not OK SignerVerifier

11. Feb 18, 2003Mårten Trolin11 Difference between MAC and digital signature If you can verify a MAC, you can also create it To prove the validity of a MAC to a third party, you need to reveal the key. Computing a MAC is (usually) must faster than computing a digital signature –Important for devices with low computing power

12. Feb 18, 2003Mårten Trolin12 Padding In public key cryptography, an adversary can try to encrypt until he finds the correct message –This is a real problem when the number of possible messages is low. (Yes/no, four-digit PIN code, etc.) –Often encrypting a low number is dangerous. –Without padding, the same clear text encrypts into the same cipher text each time. Padding adds random data to the clear text before encryption

13. Feb 18, 2003Mårten Trolin13 Padding, cont. (Artificial) example: We want to encrypt ”yes” or ”no” using a system for n bits. –”Yes” is encoded by 10 –”No” is encoded by 01 –Pad by adding (say) n – 3 random bits: Yes is encoded by 1b 2 b 3 …b n – 2 10 No is encoded by 1b 2 b 3 …b n – 2 01 To use test-encryption you need to try all 2 n – 3 combinations.

14. Feb 18, 2003Mårten Trolin14 Standards for padding Standards – important for interchange RSA Laboratories has defined several standards for public key cryptography called PKCS PKCS#1 describes how to encrypt and sign using RSA