Internet Lab (iLab1) Introduction to Cryptography Lars Wstrich - PowerPoint PPT Presentation

Chair of Network Architectures and Services Department of Informatics Technical University of Munich Internet Lab (iLab1) Introduction to Cryptography Lars Wüstrich ilab1@net.in.tum.de Chair of Network Architectures and Services Department of Informatics Technical University of Munich Slides based on: Network Security Introduction to modern cryptography (slides by Benjamin Hof) A Graduate Course in Applied Cryptography (Dan Boneh and Victor Shoup) Cryptography – WiSe 2019/20

Outline Cryptography Security Goals Symmetric encryption Hash functions Asymetric cryptography Summary 1/35

Outline Cryptography Security Goals Symmetric encryption Hash functions Asymetric cryptography Summary 2/35

What is Cryptography? • It is • a tool to protect information in computer systems • the basis of many security mechanisms • It is NOT : • the holy grail that solves all security problems • something that you should try to invent yourself We are just users of cryptography 3/35

Goals of cryptography 1. Secure communication in computer networks HTTPS Protection from: - Eavesdropping - Tampering 4/35

Goals of cryptography 2. Protect files (beyond computer networks) Disk Alice File 1 Alice Protection from: - Eavesdropping File 2 - Tampering 5/35

Outline Cryptography Security Goals Symmetric encryption Hash functions Asymetric cryptography Summary 6/35

Security Goals Our main security goals in computer networks are CIA: • Confidentiality • Integrity • Authenticity In addition to that, there are the goals of • Accountability (non-repudiation) • Availability • Access control 7/35

8/35

Building Blocks of Cryptography Digital Signatures Entity Zero-Knowledge Origin Non-Repudiation Proofs Authentication MAC Algorithms Cryptography Block Ciphers, Hash Functions Stream Ciphers Data Confidentiality Authentication Public-Key Encryption Authenticated Encryption 9/35

Outline Cryptography Security Goals Symmetric encryption Hash functions Asymetric cryptography Summary 10/35

What helps us reach our goals? Symmetric Crypto Asymmetric Crypto Confidentiality Integrity Authenticity Key Exchange 11/35

Symmetric Encryption Alice Bob m E(k, m) = c c D(k, c) = m E D k k In symmetric encryption there are two algorithms 1. An ecnryption algorithm E 2. A decryption algrothm D In addition there is a secret key k which is shared by the communicating parties. 12/35

Kerckhoffs’ principle Security should only depend on secrecy of the key, not the secrecy of the system. • key easier to keep secret • change • compatibility No security by obscurity. • scrutiny • standards • reverse engineering 13/35

Block ciphers • fixed key length and block length • chop m into n bit blocks • pad the last block m k n bit E c 14/35

Stream ciphers Stream ciphers, create a key stream that is XORed onto the message: nonce key initialization vector E keystream plaintext ⊕ ciphertext 15/35

What can we do so far? Symmetric Crypto Asymmetric Crypto Confidentiality � Integrity Authenticity Key exchange 16/35

Outline Cryptography Security Goals Symmetric encryption Hash functions Asymetric cryptography Summary 17/35

• Common practice in data communications: error detection code , to identify random errors introduced during transmission • Most simple error detection code: Parity • 7 data bits, 1 parity bit • Prefixes data with 1 ( 0 ) if number of set data bits is odd (even) • 0 0 11 00 11 • 1 0 11 00 10 • Further examples: Bit-Interleaved Parity, Cyclic Redundancy Check (CRC) 18/35

• Common practice in data communications: error detection code , to identify random errors introduced during transmission • Most simple error detection code: Parity • 7 data bits, 1 parity bit • Prefixes data with 1 ( 0 ) if number of set data bits is odd (even) • 0 0 11 00 11 • 1 0 11 00 10 • Further examples: Bit-Interleaved Parity, Cyclic Redundancy Check (CRC) • Underlying idea of these codes: add redundancy to a message for being able to detect , or even correct transmission errors 18/35

• Common practice in data communications: error detection code , to identify random errors introduced during transmission • Most simple error detection code: Parity • 7 data bits, 1 parity bit • Prefixes data with 1 ( 0 ) if number of set data bits is odd (even) • 0 0 11 00 11 • 1 0 11 00 10 • Further examples: Bit-Interleaved Parity, Cyclic Redundancy Check (CRC) • Underlying idea of these codes: add redundancy to a message for being able to detect , or even correct transmission errors • The error detection/correction code of choice and its parameters is a trade-off between: • Computational overhead • Increase of message length • ... and depends on the probability/characteristics of errors on the transmission medium 18/35

• We want to achieve: Integrity • We received message m . Has m been modified by an attacker? 19/35

• We want to achieve: Integrity • We received message m . Has m been modified by an attacker? • It is a different (and much harder!) problem to determine if m has been modified on purpose! 19/35

• We want to achieve: Integrity • We received message m . Has m been modified by an attacker? • It is a different (and much harder!) problem to determine if m has been modified on purpose! • Why? 19/35

• We want to achieve: Integrity • We received message m . Has m been modified by an attacker? • It is a different (and much harder!) problem to determine if m has been modified on purpose! • Why? • It is unlikely that a random error that modified a message also "fixes" the messages error detection code • An attacker can modify the message and fix the respective error detection code 19/35

• We want to achieve: Integrity • We received message m . Has m been modified by an attacker? • It is a different (and much harder!) problem to determine if m has been modified on purpose! • Why? • It is unlikely that a random error that modified a message also "fixes" the messages error detection code • An attacker can modify the message and fix the respective error detection code • Consequently, we need to add a code that fulfills some additional properties which should make it computationally infeasible for an attacker to tamper with messages 19/35

• We want to achieve: Integrity • We received message m . Has m been modified by an attacker? • It is a different (and much harder!) problem to determine if m has been modified on purpose! • Why? • It is unlikely that a random error that modified a message also "fixes" the messages error detection code • An attacker can modify the message and fix the respective error detection code • Consequently, we need to add a code that fulfills some additional properties which should make it computationally infeasible for an attacker to tamper with messages • Therefore we need: 1. Cryptographic Hash Functions 2. Message Authentication Codes 19/35

Hash functions input • one way function • easy to compute H ( · ) • variable length input • fixed length output output fixed length 20/35

• A function H is called a cryptographic hash function if: 21/35

• A function H is called a cryptographic hash function if: 1. H is a one way function For all pre-specified outputs y , it is computationally infeasible to find an x with H ( x ) = y "For any possible hash value y of a hash function, I cannot efficiently find an input x that yields y " → 1 st pre-image resistance 21/35

• A function H is called a cryptographic hash function if: 1. H is a one way function For all pre-specified outputs y , it is computationally infeasible to find an x with H ( x ) = y "For any possible hash value y of a hash function, I cannot efficiently find an input x that yields y " → 1 st pre-image resistance 2. Given x it is computationally infeasible to find any second input x’ with x � = x ’ such that H(x) = H(x’) "Given a first message x , I cannot efficiently find a second, different message x ′ that yields the same hash value as x " → 2 nd pre-image resistance Note: This property is very important for digital signatures. 21/35

• A function H is called a cryptographic hash function if: 1. H is a one way function For all pre-specified outputs y , it is computationally infeasible to find an x with H ( x ) = y "For any possible hash value y of a hash function, I cannot efficiently find an input x that yields y " → 1 st pre-image resistance 2. Given x it is computationally infeasible to find any second input x’ with x � = x ’ such that H(x) = H(x’) "Given a first message x , I cannot efficiently find a second, different message x ′ that yields the same hash value as x " → 2 nd pre-image resistance Note: This property is very important for digital signatures. 3. It is computationally infeasible to find any pair (x, x’) with x � = x ’ such that H(x) = H(x’) "I cannot efficiently find a pair of different input values x and x ′ that yield the same hash value" → Collision resistance 21/35