1. CIT 380: Securing Computer SystemsSlide #1 CIT 380: Securing Computer Systems Classical Cryptography

2. CIT 380: Securing Computer SystemsSlide #2 What is Cryptography? Cryptography: The art and science of keeping messages secure. Cryptanalysis: the art and science of decrypting messages. Cryptology: cryptography + cryptanalysis

3. CIT 380: Securing Computer SystemsSlide #3 Terminology Plaintext: message to be encrypted. Also called cleartext. Encryption: altering a message to keep its contents secret. Ciphertext: encrypted message. Plaintext Ciphertext Encryption Procedure

4. History of Cryptography Cæsar cipher ~ 50 B.C.E. –Simple alphabetic substitution cipher. al-Kindi ~ 850 C.E. –Cryptanalysis using letter frequencies. CIT 380: Securing Computer SystemsSlide #4

5. CIT 380: Securing Computer SystemsSlide #5 Example: Cæsar cipher ABCDEFGHIJKLMNOPQRSTUVWXYZ DEFGHIJKLMNOPQRSTUVWXYZABC Plaintext is HELLO WORLD Change each letter to the third letter following it (X goes to A, Y to B, Z to C) –Key is 3, usually written as letter ‘D’ Ciphertext is KHOOR ZRUOG

6. Example: Cæsar cipher key=3 ABCDEFGHIJKLMNOPQRSTUVWXYZ DEFGHIJKLMNOPQRSTUVWXYZABC Decrypt: FRPSXWHU CIT 380: Securing Computer SystemsSlide #6

7. CIT 380: Securing Computer SystemsSlide #7 A Transposition Cipher Rearrange letters in plaintext. Example: Rail-Fence Cipher –Plaintext is HELLO WORLD –Rearrange as H L O O L E L W R D –Ciphertext is HLOOL ELWRD

8. CIT 380: Securing Computer SystemsSlide #8 Cryptosystem Security Dependencies 1.Quality of shared encryption algorithm E 2.Secrecy of key K

9. CIT 380: Securing Computer SystemsSlide #9 Cryptanalysis Goals –Decrypt a given message. –Recover encryption key. Adversarial models vary based on –Type of information available to adversary –Interaction with cryptosystem.

10. CIT 380: Securing Computer SystemsSlide #10 Cryptanalysis Adversarial Models 1.ciphertext only: adversary has only ciphertext; goal is to find plaintext, possibly key. 2.known plaintext: adversary has ciphertext, corresponding plaintext; goal is to find key. 3.chosen plaintext: adversary may supply plaintexts and obtain corresponding ciphertext; goal is to find key.

11. CIT 380: Securing Computer SystemsSlide #11 Classical Cryptography Sender & receiver share common key –Keys may be the same, or trivial to derive from one another. –Sometimes called symmetric cryptography.

12. CIT 380: Securing Computer SystemsSlide #12 Substitution Ciphers Substitute plaintext chars for ciphered chars. –Simple: Always use same substitution function. –Polyalphabetic: Use different substitution functions based on position in message.

13. CIT 380: Securing Computer SystemsSlide #13 Cryptanalysis of Cæsar Cipher Exhaustive search –If the key space is small enough, try all possible keys until you find the right one. –Cæsar cipher has 26 possible keys.

14. CIT 380: Securing Computer SystemsSlide #14 General Simple Substitution Cipher Key Space: All permutations of alphabet. Encryption: –Replace each plaintext letter x with K(x) Decryption: –Replace each ciphertext letter y with K -1 (y)

15. General Simple Substitution Cipher Example: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z K= F U B A R D H G J I L K N M P O S Q Z W X Y V T C E CRYPTO BQCOWP CIT 380: Securing Computer SystemsSlide #15

16. CIT 380: Securing Computer SystemsSlide #16 General Substitution Cryptanalysis Exhaustive search impossible –Key space size is 26! =~ 4 x 1026 –Historically thought to be unbreakable. –Yet people solve them as newspaper puzzles every day… Solution: frequency analysis. Lesson: A large key space is necessary but not sufficient for security of a cryptosystem.

17. CIT 380: Securing Computer SystemsSlide #17 Cryptanalysis: Frequency Analysis Languages have different frequencies of –letters –digrams (groups of 2 letters) –trigrams (groups of 3 letters) –etc. Simple substitution ciphers preserve frequency distributions.

18. CIT 380: Securing Computer SystemsSlide #18 English Letter Frequencies

19. Letter Frequency http://en.wikipedia.org/wiki/Letter_frequenc ieshttp://en.wikipedia.org/wiki/Letter_frequenc ies CIT 380: Securing Computer SystemsSlide #19

20. CIT 380: Securing Computer SystemsSlide #20 Additional Frequency Features 1.Digram frequencies –Common digraphs: EN, RE, ER, NT, TH 2.Trigram frequencies –Common trigrams: THE, ING, THA, ENT 3.Vowels other than E rarely followed by another vowel. 4.The letter Q is followed only by U. 5.Many others.

21. Bigram Frequency http://en.wikipedia.org/wiki/Bigram CIT 380: Securing Computer SystemsSlide #21